# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=546 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 547 --- ## [Reduce filebeat cpu cost](https://discuss.elastic.co/t/reduce-filebeat-cpu-cost/70914)
**Author:** [@ginger](https://discuss.elastic.co/u/ginger)\ **Replies:** 4\ **Last updated:** [January 10, 2017, 12:07pm UTC](https://discuss.elastic.co/t/reduce-filebeat-cpu-cost/70914 "2017-01-10T12:07:54Z")
Hi, I use FileBeat to read a large volume of log, and then send data to ElasticSearch directly. In my case, I found filebeat consume too much CPU resource. When sending 120,000 events/s, filebeat cost 320% CPU resou… --- ## [Filebeat ERR Failed to publish events caused by: EOF](https://discuss.elastic.co/t/filebeat-err-failed-to-publish-events-caused-by-eof/70893)
**Author:** [@Gude.ravi](https://discuss.elastic.co/u/Gude.ravi)\ **Replies:** 7\ **Last updated:** [January 10, 2017, 11:32am UTC](https://discuss.elastic.co/t/filebeat-err-failed-to-publish-events-caused-by-eof/70893 "2017-01-10T11:32:50Z")
The following is my filebeat yml. The error I am seeing is . Filebeat - ERR Failed to publish events caused by: EOF I understand its a connection closing issue by logstash. I do see the data in elasticsearch. what can b… --- ## [Why do i need Logstash if filebeat can send data to Elasticsearch](https://discuss.elastic.co/t/why-do-i-need-logstash-if-filebeat-can-send-data-to-elasticsearch/70965)
**Author:** [@sezanawa](https://discuss.elastic.co/u/sezanawa)\ **Replies:** 5\ **Last updated:** [January 10, 2017, 10:22am UTC](https://discuss.elastic.co/t/why-do-i-need-logstash-if-filebeat-can-send-data-to-elasticsearch/70965 "2017-01-10T10:22:29Z")
Hallo Everybody If i want to centralized the logs in my application Environment. I have installed ELK (Eleasticsearch, Logstash and Kibana) and using Grok file input filter which is working fine on my local machine. W… --- ## [Metricbeat](https://discuss.elastic.co/t/metricbeat/70790)
**Author:** [@Manuel\_Laesser](https://discuss.elastic.co/u/Manuel_Laesser)\ **Replies:** 5\ **Last updated:** [January 10, 2017, 10:20am UTC](https://discuss.elastic.co/t/metricbeat/70790 "2017-01-10T10:20:47Z")
Hello I'm pretty new to ELK and installed the whole stack one one machine. Filebeat and Metricbeat --\> Logstash --\> Elasticsearch \<-- Kibana Filebeat is working great but today I installed metricbeat. For me it seems… --- ## [Metricbeat system module filtering tips and tricks](https://discuss.elastic.co/t/metricbeat-system-module-filtering-tips-and-tricks/71051)
**Author:** [@heilaaks](https://discuss.elastic.co/u/heilaaks)\ **Replies:** 0\ **Last updated:** [January 10, 2017, 10:03am UTC](https://discuss.elastic.co/t/metricbeat-system-module-filtering-tips-and-tricks/71051 "2017-01-10T10:03:15Z")
Hello/FYI, I had problems using the Metricbeat filters but I finally figured this out with the help of responses from andrewkroh and monica. Here are few highlights that may be helpful. The instructions and comments ar… --- ## [Build of filebeat for ppc64el available?](https://discuss.elastic.co/t/build-of-filebeat-for-ppc64el-available/70995)
**Author:** [@wdirons](https://discuss.elastic.co/u/wdirons)\ **Replies:** 1\ **Last updated:** [January 10, 2017, 9:42am UTC](https://discuss.elastic.co/t/build-of-filebeat-for-ppc64el-available/70995 "2017-01-10T09:42:30Z")
I have downloaded go and the source for filebeat and will able to compile filebeat for powerpc little endian using the instructions for building code in CONTRIBUTING.md so I know it is possible to build filebeat for powe… --- ## [Filebeat tail not working when file timestamp is not updated](https://discuss.elastic.co/t/filebeat-tail-not-working-when-file-timestamp-is-not-updated/70993)
**Author:** [@iversond](https://discuss.elastic.co/u/iversond)\ **Replies:** 1\ **Last updated:** [January 10, 2017, 9:38am UTC](https://discuss.elastic.co/t/filebeat-tail-not-working-when-file-timestamp-is-not-updated/70993 "2017-01-10T09:38:58Z")
We have a Tuxedo application server that write logs files, but the log file timestamp is only updated when the file rolls over each night. The log file is actively written to and if you open the file you can see the new … --- ## [Filebeat.template.json](https://discuss.elastic.co/t/filebeat-template-json/70902)
**Author:** [@Arnaud\_Domard](https://discuss.elastic.co/u/Arnaud_Domard)\ **Replies:** 3\ **Last updated:** [January 10, 2017, 9:09am UTC](https://discuss.elastic.co/t/filebeat-template-json/70902 "2017-01-10T09:09:47Z")
Hi I am looking for a template matching access .log file (apache log file). I need to parse the message which is the raw apache log in kibana. Where can i find the documentation to build my own filebeat template ? Fiel… --- ## [Filebeat upgrade requiring multiple restarts](https://discuss.elastic.co/t/filebeat-upgrade-requiring-multiple-restarts/70414)
**Author:** [@Sai\_Birada](https://discuss.elastic.co/u/Sai_Birada)\ **Replies:** 9\ **Last updated:** [January 10, 2017, 8:40am UTC](https://discuss.elastic.co/t/filebeat-upgrade-requiring-multiple-restarts/70414 "2017-01-10T08:40:05Z")
I am using filebeat-1.2.3 version which stores info in .filebeat file. Now i am upgrading to 5.1.2 and when i copied .filebeat to data/registry and restarted filebeat filebeat doesnt send any old data as expected. But it… --- ## [Filebeats is failing to perform the bulk index](https://discuss.elastic.co/t/filebeats-is-failing-to-perform-the-bulk-index/70298)
**Author:** [@dubul](https://discuss.elastic.co/u/dubul)\ **Replies:** 6\ **Last updated:** [January 9, 2017, 7:22pm UTC](https://discuss.elastic.co/t/filebeats-is-failing-to-perform-the-bulk-index/70298 "2017-01-09T19:22:44Z")
File beat error: ERR Failed to perform any bulk index operations: Post http://dt1es01p02:9200/\_bulk: net/http: request canceled (Client.Timeout exceeded while awaiting headers) Elastic search log: \[DEBUG\]\[action.admin… --- ## [File Beat offset semantics](https://discuss.elastic.co/t/file-beat-offset-semantics/49678)
**Author:** [@Magnus\_Andersson](https://discuss.elastic.co/u/Magnus_Andersson)\ **Replies:** 9\ **Last updated:** [January 9, 2017, 6:23pm UTC](https://discuss.elastic.co/t/file-beat-offset-semantics/49678 "2017-01-09T18:23:46Z")
Hi The file beat offset value refers to the pointer of how much of the current log file have been read. My understanding of what happens i the following scenarios are: A log file is rotated (zipped) and archived -\>… --- ## [Filebeat does not exit on EOF (input\_type=stdin)](https://discuss.elastic.co/t/filebeat-does-not-exit-on-eof-input-type-stdin/69545)
**Author:** [@tokland](https://discuss.elastic.co/u/tokland)\ **Replies:** 17\ **Last updated:** [January 9, 2017, 4:12pm UTC](https://discuss.elastic.co/t/filebeat-does-not-exit-on-eof-input-type-stdin/69545 "2017-01-09T16:12:03Z")
I want to send logs to logstash from the command line, so I thought using filebeat with input\_type=stdin should work. Using ArchLinux, filebeat-5.1.1-1. My filebeat.yml: filebeat.prospectors: - input\_type: stdin out… --- ## [Winlogbeat 5.1.1 and event\_data.param as raw](https://discuss.elastic.co/t/winlogbeat-5-1-1-and-event-data-param-as-raw/70450)
**Author:** [@plouf](https://discuss.elastic.co/u/plouf)\ **Replies:** 1\ **Last updated:** [January 8, 2017, 11:51pm UTC](https://discuss.elastic.co/t/winlogbeat-5-1-1-and-event-data-param-as-raw/70450 "2017-01-08T23:51:40Z")
Currently forwarding windows events to logstash 2.3.1and using elasticsearch 2.3.1 . I would like to get index as raw some of the event\_data.param fields (as they could contain reserved characters such as "\\") . How can … --- ## [Filebeat failed to load config file - no such file](https://discuss.elastic.co/t/filebeat-failed-to-load-config-file-no-such-file/70857)
**Author:** [@Rinat](https://discuss.elastic.co/u/Rinat)\ **Replies:** 13\ **Last updated:** [January 7, 2017, 6:53pm UTC](https://discuss.elastic.co/t/filebeat-failed-to-load-config-file-no-such-file/70857 "2017-01-07T18:53:41Z")
I've been trying to befriend Elastic Stack but so far it's not liking me, I guess. I've scrolled through the forum, however, I did not find any post with the same issue. I'm sure it's simple but I can't figure out. S… --- ## [Clustering filebeat 5.1.1](https://discuss.elastic.co/t/clustering-filebeat-5-1-1/70814)
**Author:** [@jstar](https://discuss.elastic.co/u/jstar)\ **Replies:** 1\ **Last updated:** [January 7, 2017, 4:50am UTC](https://discuss.elastic.co/t/clustering-filebeat-5-1-1/70814 "2017-01-07T04:50:11Z")
Hi Everyone, Please I wanted to know if it is possible to install filebeat as a cluster? Thanks. --- ## [Jenkins Monitoring using ELK](https://discuss.elastic.co/t/jenkins-monitoring-using-elk/70510)
**Author:** [@Dixon\_Almeida](https://discuss.elastic.co/u/Dixon_Almeida)\ **Replies:** 6\ **Last updated:** [January 6, 2017, 3:23pm UTC](https://discuss.elastic.co/t/jenkins-monitoring-using-elk/70510 "2017-01-06T15:23:10Z")
Is there any way i could monitor my jobs of jenkins using ELK? for example: I want to know no of jobs failed or errors in jenkins logs --- ## ["make package" broken for community beats?](https://discuss.elastic.co/t/make-package-broken-for-community-beats/70511)
**Author:** [@fjgal](https://discuss.elastic.co/u/fjgal)\ **Replies:** 3\ **Last updated:** [January 6, 2017, 3:21pm UTC](https://discuss.elastic.co/t/make-package-broken-for-community-beats/70511 "2017-01-06T15:21:30Z")
Hi, I'm trying to build a community beat based on metribeat and it fails. To reproduce the issue I created a dummy beat following these steps: $ cd $GOPATH/src/github.com/someuser $ cookiecutter $GOPATH/src/github.co… --- ## [Unable to read new records from same file after every 24 hours](https://discuss.elastic.co/t/unable-to-read-new-records-from-same-file-after-every-24-hours/70699)
**Author:** [@upendra](https://discuss.elastic.co/u/upendra)\ **Replies:** 1\ **Last updated:** [January 6, 2017, 3:18pm UTC](https://discuss.elastic.co/t/unable-to-read-new-records-from-same-file-after-every-24-hours/70699 "2017-01-06T15:18:59Z")
I am reading single txt file with the help of filebeat in windows environment (filebeat version “filebeat-1.3.0-windows”). My file get updated every 24 hrs. File is created at path 'E:\\Log\\Log2.txt' To avoid reading … --- ## [How to implement tcp state transition information with metricbeat](https://discuss.elastic.co/t/how-to-implement-tcp-state-transition-information-with-metricbeat/70632)
**Author:** [@st1t](https://discuss.elastic.co/u/st1t)\ **Replies:** 4\ **Last updated:** [January 6, 2017, 3:09pm UTC](https://discuss.elastic.co/t/how-to-implement-tcp-state-transition-information-with-metricbeat/70632 "2017-01-06T15:09:12Z")
Hello everyone :slight\_smile: I'd like to display TCP state transitions on metricbeat using "/proc/net/tcp" on Linux. (Established, Listen, SYN-SENT ... etc.) example "system": { "network": { "in": { … --- ## [Questions about Self Monitoring Systems blog post](https://discuss.elastic.co/t/questions-about-self-monitoring-systems-blog-post/43542)
**Author:** [@jerrac](https://discuss.elastic.co/u/jerrac)\ **Replies:** 18\ **Last updated:** [January 6, 2017, 2:23pm UTC](https://discuss.elastic.co/t/questions-about-self-monitoring-systems-blog-post/43542 "2017-01-06T14:23:14Z")
I found A case for self monitoring systems | Elastic Blog very interesting. It's very close to what I really want to do here at work. The problem is that that setup relies on Watcher for sending alerts. There's no way we… --- ## [Query MetricBeat data from Elastic Search through API](https://discuss.elastic.co/t/query-metricbeat-data-from-elastic-search-through-api/70747)
**Author:** [@prakash1243](https://discuss.elastic.co/u/prakash1243)\ **Replies:** 0\ **Last updated:** [January 6, 2017, 4:07am UTC](https://discuss.elastic.co/t/query-metricbeat-data-from-elastic-search-through-api/70747 "2017-01-06T04:07:38Z")
Hi- I have a use case, to check the CPU usage of a server from the Elastic Search through the API, (I wouldn't able to use Kibana). Scenario: I'd check the CPU Usage of the server, if its normal then continue executing … --- ## [Require support for conditional statement within beats input section](https://discuss.elastic.co/t/require-support-for-conditional-statement-within-beats-input-section/37254)
**Author:** [@vinod8427](https://discuss.elastic.co/u/vinod8427)\ **Replies:** 4\ **Last updated:** [January 6, 2017, 3:06am UTC](https://discuss.elastic.co/t/require-support-for-conditional-statement-within-beats-input-section/37254 "2017-01-06T03:06:15Z")
I have a use case wherein I am running 2 different prospectors for 2 different file types and shipping the log events to logstash. Now in my logstash while I receive events from both file types, I would however want for … --- ## [Filebeat ship logs verbatim](https://discuss.elastic.co/t/filebeat-ship-logs-verbatim/69096)
**Author:** [@surajs](https://discuss.elastic.co/u/surajs)\ **Replies:** 10\ **Last updated:** [January 5, 2017, 6:53pm UTC](https://discuss.elastic.co/t/filebeat-ship-logs-verbatim/69096 "2017-01-05T18:53:31Z")
I'm configuring filebeat 5.1.1 to output to kafka. I would like filebeat to output to the kafka topic the lines in the log file verbatim. Or move these fields under the \> beat field? This would allow us to easily mig… --- ## [Multiline pattern filebeat](https://discuss.elastic.co/t/multiline-pattern-filebeat/70474)
**Author:** [@muralibala](https://discuss.elastic.co/u/muralibala)\ **Replies:** 6\ **Last updated:** [January 5, 2017, 6:42pm UTC](https://discuss.elastic.co/t/multiline-pattern-filebeat/70474 "2017-01-05T18:42:01Z")
I have the filebeat prospector setup for a custom log file. The errors are in multiple lines. Ex: ####\ \<\[ACTIVE\] ExecuteThread: '30' for queue: 'weblogic.kernel.Default (self-tuning)'\> \<\>… --- ## [Can metricbeat drill into svchost.exe process to get resource usage for specific services?](https://discuss.elastic.co/t/can-metricbeat-drill-into-svchost-exe-process-to-get-resource-usage-for-specific-services/69680)
**Author:** [@JPvRiel](https://discuss.elastic.co/u/JPvRiel)\ **Replies:** 5\ **Last updated:** [January 5, 2017, 6:23pm UTC](https://discuss.elastic.co/t/can-metricbeat-drill-into-svchost-exe-process-to-get-resource-usage-for-specific-services/69680 "2017-01-05T18:23:41Z")
On windows, many and multiple processes are run under svchost.exe. Sometimes a seperate excutable is run, but other times it's a windows internal component like a DLL. Currently, it's not documented if it's possible to g… --- ## [Tutorial Documentation on Filebeat for Windows](https://discuss.elastic.co/t/tutorial-documentation-on-filebeat-for-windows/70504)
**Author:** [@gringo](https://discuss.elastic.co/u/gringo)\ **Replies:** 8\ **Last updated:** [January 5, 2017, 2:08pm UTC](https://discuss.elastic.co/t/tutorial-documentation-on-filebeat-for-windows/70504 "2017-01-05T14:08:08Z")
Is there other web pages that have tutorial on how to operate Filebeat on Windows with Kafka output? The official document is very confusing and useless --- ## [Beats (Metricbeat) config not accepting environment variables](https://discuss.elastic.co/t/beats-metricbeat-config-not-accepting-environment-variables/69574)
**Author:** [@leigh](https://discuss.elastic.co/u/leigh)\ **Replies:** 3\ **Last updated:** [January 5, 2017, 2:06pm UTC](https://discuss.elastic.co/t/beats-metricbeat-config-not-accepting-environment-variables/69574 "2017-01-05T14:06:55Z")
Hi, We are using Env Vars in our metricbeat.yml file but they are not getting picked up when restarting the service. Metricbeat 5.1.1. This is basically the same question as answered here: But...we are exporting the … --- ## [What are differences between Beats and jdbc plugin?](https://discuss.elastic.co/t/what-are-differences-between-beats-and-jdbc-plugin/70654)
**Author:** [@Viven7512](https://discuss.elastic.co/u/Viven7512)\ **Replies:** 1\ **Last updated:** [January 5, 2017, 2:06pm UTC](https://discuss.elastic.co/t/what-are-differences-between-beats-and-jdbc-plugin/70654 "2017-01-05T14:06:12Z")
Hi everybody , I am a newbie in the ES's wonderful world so please be indulgent. I am thinking about a import and sync strategy for a microsoft sql data source and if I did not misunderstand, I can use the input plugi… --- ## [Beats (Metricbeat) unable to change settings via commandline](https://discuss.elastic.co/t/beats-metricbeat-unable-to-change-settings-via-commandline/69576)
**Author:** [@leigh](https://discuss.elastic.co/u/leigh)\ **Replies:** 6\ **Last updated:** [January 5, 2017, 1:59pm UTC](https://discuss.elastic.co/t/beats-metricbeat-unable-to-change-settings-via-commandline/69576 "2017-01-05T13:59:23Z")
Hi, We need to dynamically change the value of a field. Following this pattern does not work: in beats 5.0 one can also overwrite any setting from command line via -E flag. For example: ./countbeat -c countbeat.yml… --- ## [Filebeat is not shipping the entire log file](https://discuss.elastic.co/t/filebeat-is-not-shipping-the-entire-log-file/70604)
**Author:** [@dubul](https://discuss.elastic.co/u/dubul)\ **Replies:** 1\ **Last updated:** [January 5, 2017, 1:26pm UTC](https://discuss.elastic.co/t/filebeat-is-not-shipping-the-entire-log-file/70604 "2017-01-05T13:26:29Z")
I'm new to filebeat and elastic search, I'm trying to ship the iis logs from a remote machine to elastic search. How can we make filebeat to ship all the lines from a log file at time, I see its shipping only one line f… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=545) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=547)