# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=544 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 545 --- ## [Libbeat test failures on 32-bit systems](https://discuss.elastic.co/t/libbeat-test-failures-on-32-bit-systems/72418)
**Author:** [@spacewrangler](https://discuss.elastic.co/u/spacewrangler)\ **Replies:** 2\ **Last updated:** [January 23, 2017, 9:02pm UTC](https://discuss.elastic.co/t/libbeat-test-failures-on-32-bit-systems/72418 "2017-01-23T21:02:03Z")
I'm working on getting beats to build/run on my Raspberry Pi 3, running Raspbian, which is 32-bit. I'm running into a test build failure in libbeat/processors/processor\_test.go, and consequently, make unit-tests fails. … --- ## [Formatting output of Filebeat Kafka plugin](https://discuss.elastic.co/t/formatting-output-of-filebeat-kafka-plugin/72528)
**Author:** [@Arvind\_Kalyan](https://discuss.elastic.co/u/Arvind_Kalyan)\ **Replies:** 1\ **Last updated:** [January 23, 2017, 8:43pm UTC](https://discuss.elastic.co/t/formatting-output-of-filebeat-kafka-plugin/72528 "2017-01-23T20:43:32Z")
Hi, Using Filebeat 5.1 (latest). Currently when I log one line with message "hello", it comes in Kafka as this: {"@timestamp":"2017-01-23T19:42:22.991Z","beat":{"hostname":"ip-10-0-14-90","name":"ip-10-0-14-90","ver… --- ## [Disk Space Metrics "wrong" when working with overlay mounts](https://discuss.elastic.co/t/disk-space-metrics-wrong-when-working-with-overlay-mounts/72442)
**Author:** [@guenther](https://discuss.elastic.co/u/guenther)\ **Replies:** 1\ **Last updated:** [January 23, 2017, 1:01pm UTC](https://discuss.elastic.co/t/disk-space-metrics-wrong-when-working-with-overlay-mounts/72442 "2017-01-23T13:01:18Z")
Hi, I'm using Metricbeat on a machine where several overlay Filesystems are mounted. The hard drive actually only has about 440G but the Kibana Dashboards of Metricbeats show me, that the server has several TeraByte. … --- ## [Filebeat:Events in Kibana not in Sequence](https://discuss.elastic.co/t/filebeat-events-in-kibana-not-in-sequence/72464)
**Author:** [@ARD](https://discuss.elastic.co/u/ARD)\ **Replies:** 2\ **Last updated:** [January 23, 2017, 12:53pm UTC](https://discuss.elastic.co/t/filebeat-events-in-kibana-not-in-sequence/72464 "2017-01-23T12:53:38Z")
I have configured filebeat to a kafka output which is subsequently fed to elastic and then visualized in kibana. ApplicationLogfile--\>Filebeat--\>kafka--\>logstash--\>Kibana The issue is, when the Application writes even… --- ## [Create new version of existing document / enforce the id](https://discuss.elastic.co/t/create-new-version-of-existing-document-enforce-the-id/69746)
**Author:** [@Florck](https://discuss.elastic.co/u/Florck)\ **Replies:** 13\ **Last updated:** [January 23, 2017, 12:35pm UTC](https://discuss.elastic.co/t/create-new-version-of-existing-document-enforce-the-id/69746 "2017-01-23T12:35:20Z")
Dear all, For our need we develop a beat for which we need not to add new values at each time in elasticsearch, but potentially update existing one. We have not found any way to enforce the id of the document to be p… --- ## [ETL Tool?](https://discuss.elastic.co/t/etl-tool/71637)
**Author:** [@jt3000](https://discuss.elastic.co/u/jt3000)\ **Replies:** 5\ **Last updated:** [January 23, 2017, 12:21pm UTC](https://discuss.elastic.co/t/etl-tool/71637 "2017-01-23T12:21:41Z")
Hello! I'm newbie in Beat. 1. Is Beat a ETL tool to integrate different data source from different database and then merge all data into one common and single database? 2. What context is Beat beats being used in b… --- ## [Holding onto handles of deleted files](https://discuss.elastic.co/t/holding-onto-handles-of-deleted-files/72340)
**Author:** [@justinyeh3112](https://discuss.elastic.co/u/justinyeh3112)\ **Replies:** 1\ **Last updated:** [January 23, 2017, 12:11pm UTC](https://discuss.elastic.co/t/holding-onto-handles-of-deleted-files/72340 "2017-01-23T12:11:51Z")
Hi, Is there a good way to have filebeat let go of the filehandle for a file after a certain amount of inactivity to the file? We are running into the following problem: Filebeat is tracking FileA The output target … --- ## [Filebeat-\>logstash connection reset by peer](https://discuss.elastic.co/t/filebeat-logstash-connection-reset-by-peer/72290)
**Author:** [@Bizzelicious](https://discuss.elastic.co/u/Bizzelicious)\ **Replies:** 4\ **Last updated:** [January 23, 2017, 11:23am UTC](https://discuss.elastic.co/t/filebeat-logstash-connection-reset-by-peer/72290 "2017-01-23T11:23:51Z")
Hi! I have several Filebeat containers (one filebeat container per host) in my infrastructure sending logs to three Logstash containers, located on one instance each. Filebeat is configured to Load balance between thos… --- ## [Filebeat on CentOS7 and Ubuntu 16.04](https://discuss.elastic.co/t/filebeat-on-centos7-and-ubuntu-16-04/72297)
**Author:** [@dban](https://discuss.elastic.co/u/dban)\ **Replies:** 1\ **Last updated:** [January 23, 2017, 10:52am UTC](https://discuss.elastic.co/t/filebeat-on-centos7-and-ubuntu-16-04/72297 "2017-01-23T10:52:34Z")
Hey Guys, Just having a small problem im sure someone with experience can give some input. If i run filebeat -c filebeat.yml -e -d "" (debugging) i get data streaming into kibana dashboards but if i dont run filebea… --- ## [Filebeat with Logstash and Elasticsearch failed to create Index in ES](https://discuss.elastic.co/t/filebeat-with-logstash-and-elasticsearch-failed-to-create-index-in-es/72167)
**Author:** [@sezanawa](https://discuss.elastic.co/u/sezanawa)\ **Replies:** 4\ **Last updated:** [January 23, 2017, 10:50am UTC](https://discuss.elastic.co/t/filebeat-with-logstash-and-elasticsearch-failed-to-create-index-in-es/72167 "2017-01-23T10:50:59Z")
Hallo Everbody I have installed ELK and FIlebeat on my local machine. ELK is working fine with Fileinput and filter but Filebeat is not working properly. Filebeat configurations are working fine and it send data to Log… --- ## [Sending logs to SIEMonster any platform](https://discuss.elastic.co/t/sending-logs-to-siemonster-any-platform/71583)
**Author:** [@mdavis00](https://discuss.elastic.co/u/mdavis00)\ **Replies:** 6\ **Last updated:** [January 23, 2017, 10:37am UTC](https://discuss.elastic.co/t/sending-logs-to-siemonster-any-platform/71583 "2017-01-23T10:37:31Z")
I cannot seem to get beats to send logs data from Windows, Linux or Mac. Has anyone used beats to get logs to SIEMonster? P.S. I'm new to beats and elastic as on a few days ago, sorry for my ignorance. --- ## [Filebeat doesn't clear the registry file after logrotation](https://discuss.elastic.co/t/filebeat-doesnt-clear-the-registry-file-after-logrotation/68193)
**Author:** [@nan008](https://discuss.elastic.co/u/nan008)\ **Replies:** 14\ **Last updated:** [January 23, 2017, 10:34am UTC](https://discuss.elastic.co/t/filebeat-doesnt-clear-the-registry-file-after-logrotation/68193 "2017-01-23T10:34:43Z")
Hi, OS: Linux CentOS 7 Filebeat: filebeat.x86\_64 5.0.2-1 We decided to logrotate the logs that are send to ES. The logrotate is done and we want to track the the old file for 5 minutes to not loose any lines and t… --- ## [Harvesting Old Files That Were Recently Modified](https://discuss.elastic.co/t/harvesting-old-files-that-were-recently-modified/72105)
**Author:** [@locolbd](https://discuss.elastic.co/u/locolbd)\ **Replies:** 3\ **Last updated:** [January 23, 2017, 8:19am UTC](https://discuss.elastic.co/t/harvesting-old-files-that-were-recently-modified/72105 "2017-01-23T08:19:27Z")
Hello All, I am unable to get filebeat to harvest a file that was created years ago but recently modified. Background: Curator deletes any index that is older than 14 days. (elasticsearch) File was created 2013, howe… --- ## [Cannot start File beat in windows](https://discuss.elastic.co/t/cannot-start-file-beat-in-windows/71143)
**Author:** [@Dharma\_Teja\_Koneru](https://discuss.elastic.co/u/Dharma_Teja_Koneru)\ **Replies:** 12\ **Last updated:** [January 22, 2017, 11:41am UTC](https://discuss.elastic.co/t/cannot-start-file-beat-in-windows/71143 "2017-01-22T11:41:25Z")
Hi, I'm trying to configure filebeat in windows 2012 R2 to send logs to a ubuntu server where the logstash and kibana are configured. when i try to start filebeat in windows i get the error: ERROR 1053: The service did … --- ## [ERR Connecting error publishing events (retrying): Get read: connection reset by peer](https://discuss.elastic.co/t/err-connecting-error-publishing-events-retrying-get-read-connection-reset-by-peer/72330)
**Author:** [@ciscoexp](https://discuss.elastic.co/u/ciscoexp)\ **Replies:** 3\ **Last updated:** [January 21, 2017, 1:41pm UTC](https://discuss.elastic.co/t/err-connecting-error-publishing-events-retrying-get-read-connection-reset-by-peer/72330 "2017-01-21T13:41:56Z")
I am getting these error messages and I have the most basic configuration of Logstash/FileBeat. ERR Connecting error publishing events (retrying): Get http://10.200.21.90:5044: read tcp 10.200.23.167:44340-\>10.200.21.… --- ## [CPU Usage doesn't come for 100%](https://discuss.elastic.co/t/cpu-usage-doesnt-come-for-100/71943)
**Author:** [@prakash1243](https://discuss.elastic.co/u/prakash1243)\ **Replies:** 3\ **Last updated:** [January 20, 2017, 4:47pm UTC](https://discuss.elastic.co/t/cpu-usage-doesnt-come-for-100/71943 "2017-01-20T16:47:54Z")
Hi - We are tying to run the Metric beat on a Windows server for every 10 Millie seconds (0.01s). We wanted to know how much Metricbeat service would consume the CPU usage. We ran it for few hours and checked the CPU, s… --- ## [Packetbeat: Something wired with "WARN Time in pcap went backwards"](https://discuss.elastic.co/t/packetbeat-something-wired-with-warn-time-in-pcap-went-backwards/72142)
**Author:** [@moooofly](https://discuss.elastic.co/u/moooofly)\ **Replies:** 2\ **Last updated:** [January 20, 2017, 4:21am UTC](https://discuss.elastic.co/t/packetbeat-something-wired-with-warn-time-in-pcap-went-backwards/72142 "2017-01-20T04:21:33Z")
when analyzing pcap files, I always find outputs as follow: ➜ packetbeat git:(master) ✗ ./packetbeat -c ./packetbeat.yml -e -I redis\_xxxx.pcap 2\>&1 |grep "pcap went backwards" ... 2017/01/11 06:57:47.091832 sniffer.g… --- ## [Processor \[drop\_event\] not dropping events](https://discuss.elastic.co/t/processor-drop-event-not-dropping-events/72186)
**Author:** [@RedNickelPython](https://discuss.elastic.co/u/RedNickelPython)\ **Replies:** 8\ **Last updated:** [January 19, 2017, 8:34pm UTC](https://discuss.elastic.co/t/processor-drop-event-not-dropping-events/72186 "2017-01-19T20:34:47Z")
ver 5.1.1 I have the below implemented to drop windows events not needed, but am still getting events that should be blocked. I had previously tried processors: - drop\_event: when: not: equals: … --- ## [Unable to use drop\_event to filter json](https://discuss.elastic.co/t/unable-to-use-drop-event-to-filter-json/72171)
**Author:** [@cabecada](https://discuss.elastic.co/u/cabecada)\ **Replies:** 4\ **Last updated:** [January 19, 2017, 6:11pm UTC](https://discuss.elastic.co/t/unable-to-use-drop-event-to-filter-json/72171 "2017-01-19T18:11:01Z")
i am unable to filter lines (json) based on json key value. wrt https://www.elastic.co/guide/en/beats/filebeat/current/configuration-processors.html i have the below file content that grows. root@ubuntu1404-4:… --- ## [About creating a metricset issue](https://discuss.elastic.co/t/about-creating-a-metricset-issue/71464)
**Author:** [@Pikachu\_TEX](https://discuss.elastic.co/u/Pikachu_TEX)\ **Replies:** 14\ **Last updated:** [January 19, 2017, 3:28pm UTC](https://discuss.elastic.co/t/about-creating-a-metricset-issue/71464 "2017-01-19T15:28:19Z")
i refer to metricbeat document Run the following command inside my beat directory: make create-metricset The results are as follows: \[elk@oam2 metricbeat-5.0.1-linux-x86\_64\]$ make create-metricset make: \*\*\* No rul… --- ## [Value too large to output](https://discuss.elastic.co/t/value-too-large-to-output/72129)
**Author:** [@phillipgibb](https://discuss.elastic.co/u/phillipgibb)\ **Replies:** 5\ **Last updated:** [January 19, 2017, 2:25pm UTC](https://discuss.elastic.co/t/value-too-large-to-output/72129 "2017-01-19T14:25:39Z")
Hi, FileBeat is outputting to logstash text like: Value too large to output (2939 bytes)! First 255 chars are: ... Yes the logline is actually 2939 bytes Yes I do want it sent to logstash I have looked at the max\_… --- ## [Filebeat won't send files cause ignore\_older reached](https://discuss.elastic.co/t/filebeat-wont-send-files-cause-ignore-older-reached/72086)
**Author:** [@Shadowraze](https://discuss.elastic.co/u/Shadowraze)\ **Replies:** 3\ **Last updated:** [January 19, 2017, 2:08pm UTC](https://discuss.elastic.co/t/filebeat-wont-send-files-cause-ignore-older-reached/72086 "2017-01-19T14:08:18Z")
Elasticsearch + kibana + logstash + filebeat all was downloaded 2 days ago from official site(.deb). Thats my filebeat.yml http://pastebin.com/ij18FMec. It's like every harvest in filebeat log looks like this 2017-01… --- ## [Permission to setting up Metricbeat on Windows](https://discuss.elastic.co/t/permission-to-setting-up-metricbeat-on-windows/72011)
**Author:** [@ronanluiz](https://discuss.elastic.co/u/ronanluiz)\ **Replies:** 5\ **Last updated:** [January 19, 2017, 2:08pm UTC](https://discuss.elastic.co/t/permission-to-setting-up-metricbeat-on-windows/72011 "2017-01-19T14:08:03Z")
I'm setting up Metricbeat (Version: 5.1.1) on a Windows Server 2008 R2 environment, but to be able to collect data from all the processes running on the server it was necessary to configure the service to run a user with… --- ## [Why packetbeat generates result of "libbeat.publisher.published\_events" changing every time](https://discuss.elastic.co/t/why-packetbeat-generates-result-of-libbeat-publisher-published-events-changing-every-time/71699)
**Author:** [@moooofly](https://discuss.elastic.co/u/moooofly)\ **Replies:** 9\ **Last updated:** [January 19, 2017, 11:07am UTC](https://discuss.elastic.co/t/why-packetbeat-generates-result-of-libbeat-publisher-published-events-changing-every-time/71699 "2017-01-19T11:07:54Z")
Hi,all: I use packetbeat to analyse pcap file for redis protocol. The command i use is ./packetbeat -c ./packetbeat.yml -e -I redis\_xg-bjdev-rediscluster-2\_prot-7101\_20161222110723\_20161222110733.pcap -E packetbea… --- ## [Elastic Stack shipped dashboards for Kibana](https://discuss.elastic.co/t/elastic-stack-shipped-dashboards-for-kibana/71975)
**Author:** [@ametad](https://discuss.elastic.co/u/ametad)\ **Replies:** 4\ **Last updated:** [January 19, 2017, 10:32am UTC](https://discuss.elastic.co/t/elastic-stack-shipped-dashboards-for-kibana/71975 "2017-01-19T10:32:14Z")
Hi community, I am fairly new to Elastic Stack (or ELK) and I am a bit confused about the role of Logstash in conjunction with the Beats. Because Beats ships with dashboard you can import easily... But these dashboards… --- ## [Lsbeat blog instructions fail](https://discuss.elastic.co/t/lsbeat-blog-instructions-fail/72016)
**Author:** [@johnzachary](https://discuss.elastic.co/u/johnzachary)\ **Replies:** 2\ **Last updated:** [January 19, 2017, 10:07am UTC](https://discuss.elastic.co/t/lsbeat-blog-instructions-fail/72016 "2017-01-19T10:07:42Z")
Hello! The blog instructions at https://www.elastic.co/blog/build-your-own-beat need to be updated. First, the current directory structure of a skeleton Beat using cookiecutter is the following: . ├── CONTRI… --- ## [Metric Beat Service couldn't start](https://discuss.elastic.co/t/metric-beat-service-couldnt-start/71989)
**Author:** [@prakash1243](https://discuss.elastic.co/u/prakash1243)\ **Replies:** 2\ **Last updated:** [January 19, 2017, 4:09am UTC](https://discuss.elastic.co/t/metric-beat-service-couldnt-start/71989 "2017-01-19T04:09:03Z")
Hi- I want the System Load stats from a node, so I un-commented in the configuration yml file. After that the service isn't getting started. Below is the error message I get. If I comment out the Load parameter, then… --- ## [Filesystem pct/used not same as reported by df](https://discuss.elastic.co/t/filesystem-pct-used-not-same-as-reported-by-df/71795)
**Author:** [@agonzalez](https://discuss.elastic.co/u/agonzalez)\ **Replies:** 7\ **Last updated:** [January 18, 2017, 8:20pm UTC](https://discuss.elastic.co/t/filesystem-pct-used-not-same-as-reported-by-df/71795 "2017-01-18T20:20:16Z")
This is what i get in metricbeat. ( 0.29 used) Mount point Available disk space Total disk space Used disk space Used disk space (%) Files / 666,701,824 1,023,303,680 302,915,584 0.296 65,536 and this is df /d… --- ## [Packetbeat: publish an event with nested objects to elasticsearch in go](https://discuss.elastic.co/t/packetbeat-publish-an-event-with-nested-objects-to-elasticsearch-in-go/71957)
**Author:** [@sumit419](https://discuss.elastic.co/u/sumit419)\ **Replies:** 1\ **Last updated:** [January 18, 2017, 2:52pm UTC](https://discuss.elastic.co/t/packetbeat-publish-an-event-with-nested-objects-to-elasticsearch-in-go/71957 "2017-01-18T14:52:15Z")
Hi, I have a custom plugin that generates a list of struct objects. something like \[{field 1: value,field 2: value},{field 1: value,field 2: value},,,,\] for request field. I updated the elasticsearch template and set t… --- ## [Inconsistent Multiline Matches](https://discuss.elastic.co/t/inconsistent-multiline-matches/71369)
**Author:** [@stekin](https://discuss.elastic.co/u/stekin)\ **Replies:** 2\ **Last updated:** [January 18, 2017, 1:33pm UTC](https://discuss.elastic.co/t/inconsistent-multiline-matches/71369 "2017-01-18T13:33:43Z")
After days of trial and error I've found inconsistent RegEx pattern matches with filebeat that seem to work when tested elsewhere: golang and RegEx101 Filebeat configuration: filebeat: prospectors: - in… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=543) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=545)