# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=545 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 546 --- ## [Parsing multiline logs of various formats](https://discuss.elastic.co/t/parsing-multiline-logs-of-various-formats/71972)
**Author:** [@vld](https://discuss.elastic.co/u/vld)\ **Replies:** 1\ **Last updated:** [January 18, 2017, 12:54pm UTC](https://discuss.elastic.co/t/parsing-multiline-logs-of-various-formats/71972 "2017-01-18T12:54:51Z")
I have multiple multiline log files of various formats on the same machine. I ship them using one filebeat instance to logstash (deployed on another machine). My main issue is where/how to use the multiline option. In… --- ## [What would be the easiest way to hook into filebeat?](https://discuss.elastic.co/t/what-would-be-the-easiest-way-to-hook-into-filebeat/70834)
**Author:** [@blacktop](https://discuss.elastic.co/u/blacktop)\ **Replies:** 4\ **Last updated:** [January 17, 2017, 9:05am UTC](https://discuss.elastic.co/t/what-would-be-the-easiest-way-to-hook-into-filebeat/70834 "2017-01-17T09:05:59Z")
I would like to hook into Filebeat once it has a handle on a new file. I think what I need is to create my own reader that is tsv.go (tab separated value) and implement the Reader interface? The reason I want to do th… --- ## [FileBeat Sending Logs in binary format](https://discuss.elastic.co/t/filebeat-sending-logs-in-binary-format/70745)
**Author:** [@sarank](https://discuss.elastic.co/u/sarank)\ **Replies:** 4\ **Last updated:** [January 17, 2017, 7:12am UTC](https://discuss.elastic.co/t/filebeat-sending-logs-in-binary-format/70745 "2017-01-17T07:12:29Z")
Hi All, I am trying to set-up a centralized log management in my infra, for this I am using Graylog. I am pushing my component logs from clients to the Graylog Server using Filebeat ( Version - 5.1.1 ). I am not sure wh… --- ## [Unable to get rid off error: "Visualize: Fielddata is disabled on text fields by default."](https://discuss.elastic.co/t/unable-to-get-rid-off-error-visualize-fielddata-is-disabled-on-text-fields-by-default/71229)
**Author:** [@rootameen](https://discuss.elastic.co/u/rootameen)\ **Replies:** 2\ **Last updated:** [January 17, 2017, 7:07am UTC](https://discuss.elastic.co/t/unable-to-get-rid-off-error-visualize-fielddata-is-disabled-on-text-fields-by-default/71229 "2017-01-17T07:07:54Z")
Hi guys, I recently started a new setup of ELK stack based on version 5.1. Everything went smoothly except for the visualization section on Kibana. Whenever I try to create something (like a visual of beat.name), I get … --- ## [How do I add AWS metadata to Filebeat?](https://discuss.elastic.co/t/how-do-i-add-aws-metadata-to-filebeat/71505)
**Author:** [@tachyon](https://discuss.elastic.co/u/tachyon)\ **Replies:** 3\ **Last updated:** [January 17, 2017, 5:49am UTC](https://discuss.elastic.co/t/how-do-i-add-aws-metadata-to-filebeat/71505 "2017-01-17T05:49:20Z")
I want to include AWS Instance's tag information in each Filebeat document. I can think of two ways to do this - Modify the log output and include the info in there. This will require tweaking all the services whose l… --- ## [Processors are available in metricbeats only or available all beats?](https://discuss.elastic.co/t/processors-are-available-in-metricbeats-only-or-available-all-beats/71801)
**Author:** [@kaung](https://discuss.elastic.co/u/kaung)\ **Replies:** 2\ **Last updated:** [January 17, 2017, 2:13am UTC](https://discuss.elastic.co/t/processors-are-available-in-metricbeats-only-or-available-all-beats/71801 "2017-01-17T02:13:03Z")
Here, it says libbeat library provides processors - such as drop\_fields, drop\_event. But beats platform reference also says processors will be available in the future. I am confused. Do processors belong to libbeat and c… --- ## [Processes filtering](https://discuss.elastic.co/t/processes-filtering/71776)
**Author:** [@agonzalez](https://discuss.elastic.co/u/agonzalez)\ **Replies:** 2\ **Last updated:** [January 16, 2017, 11:49pm UTC](https://discuss.elastic.co/t/processes-filtering/71776 "2017-01-16T23:49:26Z")
I am trying to filter processes to just get postgress and httpd process and tried several way but didnt work. I am trying this and it doesnt work and collect everything: - process processes: \['postgres|httpd'\] Wha… --- ## [Winlogbeat displaying GUID in Windows events instead of object name](https://discuss.elastic.co/t/winlogbeat-displaying-guid-in-windows-events-instead-of-object-name/71442)
**Author:** [@Geezer](https://discuss.elastic.co/u/Geezer)\ **Replies:** 7\ **Last updated:** [January 16, 2017, 10:57pm UTC](https://discuss.elastic.co/t/winlogbeat-displaying-guid-in-windows-events-instead-of-object-name/71442 "2017-01-16T22:57:44Z")
Hello, We are using Winlogbeat 1.2.3 to ship Windows events via Logstash into Elasticsearch. When I look at a 4662 events in Kibi, for example, under ObjectType and ObjectName I see the GUIDs rather than "ObjectType… --- ## [Excluding bind mounts](https://discuss.elastic.co/t/excluding-bind-mounts/71509)
**Author:** [@abraxxa](https://discuss.elastic.co/u/abraxxa)\ **Replies:** 3\ **Last updated:** [January 16, 2017, 4:48pm UTC](https://discuss.elastic.co/t/excluding-bind-mounts/71509 "2017-01-16T16:48:14Z")
We'd like to exclude all bind mounts so they available and used space isn't counted multiple times but the filesystem type is currently not collected. Knowing the filesystem type is useful for more thing I'd like to open… --- ## [Testing custom plugin to Packetbeat](https://discuss.elastic.co/t/testing-custom-plugin-to-packetbeat/70677)
**Author:** [@sumit419](https://discuss.elastic.co/u/sumit419)\ **Replies:** 8\ **Last updated:** [January 16, 2017, 4:09pm UTC](https://discuss.elastic.co/t/testing-custom-plugin-to-packetbeat/70677 "2017-01-16T16:09:04Z")
Hi I have written a plugin for a TCP application the packets contain plain TCP data. I want to integrate with the packetbeat and use it in debug mode. To see if the new plugin is doing. I'm new to packetbeat. Thanks. --- ## [File Beat Consuming very high CPU](https://discuss.elastic.co/t/file-beat-consuming-very-high-cpu/71618)
**Author:** [@userguy](https://discuss.elastic.co/u/userguy)\ **Replies:** 1\ **Last updated:** [January 16, 2017, 4:01pm UTC](https://discuss.elastic.co/t/file-beat-consuming-very-high-cpu/71618 "2017-01-16T16:01:21Z")
Hello Team , This is my configuration filebeat version 5.0.0-1 with centos 7 and also it directly inserts into kafka These are the events in filebeat INFO Non-zero metrics in the last 30s: registrar.states.updat… --- ## [Filebeat 5.1.1 running on Red Hat 5 Enterprise](https://discuss.elastic.co/t/filebeat-5-1-1-running-on-red-hat-5-enterprise/71409)
**Author:** [@hailaeos.troy](https://discuss.elastic.co/u/hailaeos.troy)\ **Replies:** 1\ **Last updated:** [January 16, 2017, 3:11pm UTC](https://discuss.elastic.co/t/filebeat-5-1-1-running-on-red-hat-5-enterprise/71409 "2017-01-16T15:11:58Z")
We have a number of Red Hat 5 machines and wanted to run filebeat 1.3 and 5.1 but everywhere I looked the answer is no. Turns out the filebeat-god wrapper is what doesn't work. Its a hack job dont judge also if this hel… --- ## [Filebeat output.elasticsearch 4096-byte socket writes](https://discuss.elastic.co/t/filebeat-output-elasticsearch-4096-byte-socket-writes/71537)
**Author:** [@max0x7ba](https://discuss.elastic.co/u/max0x7ba)\ **Replies:** 2\ **Last updated:** [January 16, 2017, 2:34pm UTC](https://discuss.elastic.co/t/filebeat-output-elasticsearch-4096-byte-socket-writes/71537 "2017-01-16T14:34:01Z")
I notice that Filebeat does 4096-byte socket writes when sending to ElasticSearch. I cannot find a configuration option that controls this number. Is there a way to increase the outgoing socket buffer in Filebeat, in o… --- ## [Version 6.0.0 when building from scratch](https://discuss.elastic.co/t/version-6-0-0-when-building-from-scratch/71253)
**Author:** [@zoidberg8e](https://discuss.elastic.co/u/zoidberg8e)\ **Replies:** 5\ **Last updated:** [January 16, 2017, 2:27pm UTC](https://discuss.elastic.co/t/version-6-0-0-when-building-from-scratch/71253 "2017-01-16T14:27:24Z")
Hi there, I just checked out the 5.1 branch of beats, and built filebeat there. The filebeat.template.json clearly says it is version 5.1.1, but filebeat, when started with the -version flag always says it is version 6… --- ## [Metricbeat is not working after i installed xpack](https://discuss.elastic.co/t/metricbeat-is-not-working-after-i-installed-xpack/71681)
**Author:** [@gutasaputra](https://discuss.elastic.co/u/gutasaputra)\ **Replies:** 1\ **Last updated:** [January 16, 2017, 11:33am UTC](https://discuss.elastic.co/t/metricbeat-is-not-working-after-i-installed-xpack/71681 "2017-01-16T11:33:53Z")
hi, recently i installed xpack and then suddenly my metricbeat doesnt work anymore. it should be send log to my elastic. but when i check it in my kibana, it throw me error msg like this. this is my metricbeat.yml s… --- ## [Loading a pcap file](https://discuss.elastic.co/t/loading-a-pcap-file/71524)
**Author:** [@PinXo](https://discuss.elastic.co/u/PinXo)\ **Replies:** 2\ **Last updated:** [January 16, 2017, 10:03am UTC](https://discuss.elastic.co/t/loading-a-pcap-file/71524 "2017-01-16T10:03:56Z")
I'm running packetbeat with my own pcap file. I have noticed that when I run it without options (just -I file.pcap) it works ok, with the corresponding delays. When I use -t flag (TopSpeed), i don't see any packet in t… --- ## [How do I ingest archived data (zip, tar.gz, etc)?](https://discuss.elastic.co/t/how-do-i-ingest-archived-data-zip-tar-gz-etc/71701)
**Author:** [@manbearpig](https://discuss.elastic.co/u/manbearpig)\ **Replies:** 0\ **Last updated:** [January 16, 2017, 9:01am UTC](https://discuss.elastic.co/t/how-do-i-ingest-archived-data-zip-tar-gz-etc/71701 "2017-01-16T09:01:02Z")
I am working on an archiving product and we have been looking to replace our indexing/search tool with Elasticsearch. Our current process is roughly like this: Processing Node 1. Incoming Data is processed 2. Dat… --- ## [How to split a long line into multiple events](https://discuss.elastic.co/t/how-to-split-a-long-line-into-multiple-events/71648)
**Author:** [@jchen.com](https://discuss.elastic.co/u/jchen.com)\ **Replies:** 1\ **Last updated:** [January 16, 2017, 2:57am UTC](https://discuss.elastic.co/t/how-to-split-a-long-line-into-multiple-events/71648 "2017-01-16T02:57:10Z")
I have a log file which only have one line. The records are separated by "^MAAA" within that single line record. Here is an example: ^MAAA20160711,111111,222222^MAAA20160712,33333,44444^MAAA20160713,55555,66666 Above lin… --- ## [How to separate Winlogbeat logs to different ES indexes](https://discuss.elastic.co/t/how-to-separate-winlogbeat-logs-to-different-es-indexes/71529)
**Author:** [@ufomen](https://discuss.elastic.co/u/ufomen)\ **Replies:** 2\ **Last updated:** [January 13, 2017, 8:59pm UTC](https://discuss.elastic.co/t/how-to-separate-winlogbeat-logs-to-different-es-indexes/71529 "2017-01-13T20:59:00Z")
Hello all! And sorry for my english... I have tons of security logs on my elasticsearch. Now I wanna store Windows security logs for 2 weeks, and other (app, system) logs for 3-6 month. So, I think easiest way to do th… --- ## [Processors drop\_event - no worky](https://discuss.elastic.co/t/processors-drop-event-no-worky/70970)
**Author:** [@panaman](https://discuss.elastic.co/u/panaman)\ **Replies:** 7\ **Last updated:** [January 12, 2017, 7:53pm UTC](https://discuss.elastic.co/t/processors-drop-event-no-worky/70970 "2017-01-12T19:53:25Z")
running metricbeat on centos7 package name = metricbeat-5.1.1-1.x86\_64 The documentation says to use processors: https://www.elastic.co/guide/en/beats/metricbeat/current/configuration-processors.html#conditions If I… --- ## [Monitor Filebeat Activity](https://discuss.elastic.co/t/monitor-filebeat-activity/71356)
**Author:** [@muhamadli302](https://discuss.elastic.co/u/muhamadli302)\ **Replies:** 1\ **Last updated:** [January 12, 2017, 11:16am UTC](https://discuss.elastic.co/t/monitor-filebeat-activity/71356 "2017-01-12T11:16:12Z")
Hello, I'm using filebeat to ship logs to logstash, and I want to know when it has finished shipping logs. Is there a way to check when: a) Filebeat has finished reading the log file (it's a static file, meaning it do… --- ## [Connection marked as failed because the onConnect callback failed](https://discuss.elastic.co/t/connection-marked-as-failed-because-the-onconnect-callback-failed/71224)
**Author:** [@Sebastian\_Busek](https://discuss.elastic.co/u/Sebastian_Busek)\ **Replies:** 2\ **Last updated:** [January 12, 2017, 8:03am UTC](https://discuss.elastic.co/t/connection-marked-as-failed-because-the-onconnect-callback-failed/71224 "2017-01-12T08:03:34Z")
Hello, I'm trying use Filebeat to send json log to elasticsearch, but without success. By Structured logging with Filebeat blog post, I'd saved sample json and used following configuration in filebeat.yml filebeat.pros… --- ## [LS Beat not capturing new files](https://discuss.elastic.co/t/ls-beat-not-capturing-new-files/71239)
**Author:** [@brandonkaplan](https://discuss.elastic.co/u/brandonkaplan)\ **Replies:** 1\ **Last updated:** [January 11, 2017, 11:02pm UTC](https://discuss.elastic.co/t/ls-beat-not-capturing-new-files/71239 "2017-01-11T23:02:31Z")
I'm running LSBeat on a virtual machine for testing. I can see that it ships the correct information for whatever is in the folder structure when i kick off the beat, but if i edit the folders or add new files within it,… --- ## [Filebeat sends logs, but only at the second try](https://discuss.elastic.co/t/filebeat-sends-logs-but-only-at-the-second-try/70082)
**Author:** [@Gamer](https://discuss.elastic.co/u/Gamer)\ **Replies:** 7\ **Last updated:** [January 11, 2017, 3:17pm UTC](https://discuss.elastic.co/t/filebeat-sends-logs-but-only-at-the-second-try/70082 "2017-01-11T15:17:04Z")
Hello! So. It seems our case's similar to that (https://discuss.elastic.co/t/filebeat-eof-and-then-succeeds-at-second-try/65015). We have errors in filebeat stating that: 2016-12-27T18:25:51+03:00 DBG Try to publish… --- ## [Use regex in path definition](https://discuss.elastic.co/t/use-regex-in-path-definition/71201)
**Author:** [@dwjvaughan](https://discuss.elastic.co/u/dwjvaughan)\ **Replies:** 2\ **Last updated:** [January 11, 2017, 10:46am UTC](https://discuss.elastic.co/t/use-regex-in-path-definition/71201 "2017-01-11T10:46:16Z")
Is it possible to use regex when defining the path? I see the documentation states it uses Golang Glob which seems to indicate that it's possible, but I can't seem to get it to work. I have the following: filebeat.p… --- ## [Filebeat refuse the connection with logstash](https://discuss.elastic.co/t/filebeat-refuse-the-connection-with-logstash/71038)
**Author:** [@shubhrant](https://discuss.elastic.co/u/shubhrant)\ **Replies:** 11\ **Last updated:** [January 11, 2017, 9:57am UTC](https://discuss.elastic.co/t/filebeat-refuse-the-connection-with-logstash/71038 "2017-01-11T09:57:15Z")
while shipping the log filebeat give an error i.e. INFO Connecting error publishing events (retrying): dial tcp 10.228.13.59:5044: getsockopt: connection refused my logstash configuration file is input { beats { … --- ## [Role settings for logging user (Beats)](https://discuss.elastic.co/t/role-settings-for-logging-user-beats/71083)
**Author:** [@Cylindric](https://discuss.elastic.co/u/Cylindric)\ **Replies:** 3\ **Last updated:** [January 11, 2017, 9:46am UTC](https://discuss.elastic.co/t/role-settings-for-logging-user-beats/71083 "2017-01-11T09:46:37Z")
I'm trying to configure our new cloud cluster (1e7502) and I would like to create a user that only has access to create indices and log data to them. Basically, for my FileBeat/MetricBeat/anyBeat agents. I created a new… --- ## [Filebeat not shipping logs from specific host](https://discuss.elastic.co/t/filebeat-not-shipping-logs-from-specific-host/70962)
**Author:** [@Rahul\_Ghanate](https://discuss.elastic.co/u/Rahul_Ghanate)\ **Replies:** 6\ **Last updated:** [January 11, 2017, 6:43am UTC](https://discuss.elastic.co/t/filebeat-not-shipping-logs-from-specific-host/70962 "2017-01-11T06:43:05Z")
Filebeat is not shipping logs from specific hosts, whereas everything is identical compared to another hosts where it is successfully shipping the logs. I have 3 hosts from where filebeat is shipping logs to logstash se… --- ## [Import dashboards with different index name than .kibana](https://discuss.elastic.co/t/import-dashboards-with-different-index-name-than-kibana/71146)
**Author:** [@Maxwell\_Flanders](https://discuss.elastic.co/u/Maxwell_Flanders)\ **Replies:** 1\ **Last updated:** [January 10, 2017, 11:13pm UTC](https://discuss.elastic.co/t/import-dashboards-with-different-index-name-than-kibana/71146 "2017-01-10T23:13:42Z")
I am trying to set up metricbeat and import the sample dashboards provided here: https://www.elastic.co/guide/en/beats/metricbeat/current/metricbeat-sample-dashboards.html However, we use a different index name to stor… --- ## [Recently upgraded to filebeat 5.0 for beat--\>kafka output. Topbeat has the same?](https://discuss.elastic.co/t/recently-upgraded-to-filebeat-5-0-for-beat-kafka-output-topbeat-has-the-same/71113)
**Author:** [@Maxwell\_Flanders](https://discuss.elastic.co/u/Maxwell_Flanders)\ **Replies:** 2\ **Last updated:** [January 10, 2017, 4:02pm UTC](https://discuss.elastic.co/t/recently-upgraded-to-filebeat-5-0-for-beat-kafka-output-topbeat-has-the-same/71113 "2017-01-10T16:02:07Z")
Says it in the title. I'd like to send my topbeat metrics through kafka, is this something that we can do at this time?? [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=544) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=546)