# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=547 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 548 --- ## [Is it safe to move a log file?](https://discuss.elastic.co/t/is-it-safe-to-move-a-log-file/70499)
**Author:** [@SolarBear](https://discuss.elastic.co/u/SolarBear)\ **Replies:** 2\ **Last updated:** [January 5, 2017, 12:27pm UTC](https://discuss.elastic.co/t/is-it-safe-to-move-a-log-file/70499 "2017-01-05T12:27:15Z")
Hello everyone! We've started using Filebeat very recently to monitor a certain log file and it's working all right. However I've been asked to move that file to a different location on disk as well as perform a daily … --- ## [Windows create beat fails with /build/python-env/bin/activate: No such file or directory](https://discuss.elastic.co/t/windows-create-beat-fails-with-build-python-env-bin-activate-no-such-file-or-directory/70203)
**Author:** [@mast](https://discuss.elastic.co/u/mast)\ **Replies:** 6\ **Last updated:** [January 5, 2017, 11:27am UTC](https://discuss.elastic.co/t/windows-create-beat-fails-with-build-python-env-bin-activate-no-such-file-or-directory/70203 "2017-01-05T11:27:52Z")
Hi, Trying to build a custom beat on windows but the command "make setup" fails with: \[path to custom beat folder\]/build/python-env/bin/activate: No such file or directory Seems like there is something wrong with th… --- ## [Filebeat Multiline publishing to Kibana as singlelines](https://discuss.elastic.co/t/filebeat-multiline-publishing-to-kibana-as-singlelines/70567)
**Author:** [@phillipgibb](https://discuss.elastic.co/u/phillipgibb)\ **Replies:** 2\ **Last updated:** [January 5, 2017, 6:45am UTC](https://discuss.elastic.co/t/filebeat-multiline-publishing-to-kibana-as-singlelines/70567 "2017-01-05T06:45:25Z")
Hi, I am using FileBeat 5.1.1 I have a portion of a log file: 2 2014-01-01 00:08:27.517 XML.Handler\[3\]: Received: \ \20140101\ \000827\ \ 2 2014-01-01 00:08:27.… --- ## [Beat Metrics to Redis](https://discuss.elastic.co/t/beat-metrics-to-redis/70590)
**Author:** [@Jeferson\_Martins](https://discuss.elastic.co/u/Jeferson_Martins)\ **Replies:** 1\ **Last updated:** [January 4, 2017, 7:24pm UTC](https://discuss.elastic.co/t/beat-metrics-to-redis/70590 "2017-01-04T19:24:13Z")
Hi, We have to get the number of events from FileBeat that are generated after read action and save the result in Redis. We used the logging.metrics.enabled configuration but this only output the statistics in FileBeat… --- ## [Question about creating Brobeat](https://discuss.elastic.co/t/question-about-creating-brobeat/70025)
**Author:** [@blacktop](https://discuss.elastic.co/u/blacktop)\ **Replies:** 11\ **Last updated:** [January 4, 2017, 7:17pm UTC](https://discuss.elastic.co/t/question-about-creating-brobeat/70025 "2017-01-04T19:17:02Z")
I am working on a new beat called brobeat here - https://github.com/blacktop/brobeat. However, it looks like what I want is to build a filebeat module? Does it make sense for me to create a copy/fork of filebeat and a… --- ## [How to add other \_types to the /etc/fields.yml in beats](https://discuss.elastic.co/t/how-to-add-other--types-to-the-etc-fields-yml-in-beats/70241)
**Author:** [@blacktop](https://discuss.elastic.co/u/blacktop)\ **Replies:** 8\ **Last updated:** [January 4, 2017, 7:10pm UTC](https://discuss.elastic.co/t/how-to-add-other--types-to-the-etc-fields-yml-in-beats/70241 "2017-01-04T19:10:56Z")
I have a beat that will have MANY different \_types. beats/libbeat/scripts/generate\_template.py doesn't seem to support that? Any help greatly appreciated. It looks like you can add more \_types with filebeat modle… --- ## [Nginx json logs + filebeat + elasticsearch but unwanted key: value order](https://discuss.elastic.co/t/nginx-json-logs-filebeat-elasticsearch-but-unwanted-key-value-order/70471)
**Author:** [@cmartear](https://discuss.elastic.co/u/cmartear)\ **Replies:** 2\ **Last updated:** [January 4, 2017, 5:35pm UTC](https://discuss.elastic.co/t/nginx-json-logs-filebeat-elasticsearch-but-unwanted-key-value-order/70471 "2017-01-04T17:35:52Z")
Hello everyone... I'm using json config on my nginx logs, that's parsed ans shipped by filebeat to elasticshearch and works very fine. log\_format json '{ "time": "$time\_local", ' '"remo… --- ## [PacketBeat (Elasticsearch) mostly shows zero as response time for queries](https://discuss.elastic.co/t/packetbeat-elasticsearch-mostly-shows-zero-as-response-time-for-queries/70483)
**Author:** [@Akashi\_Seih](https://discuss.elastic.co/u/Akashi_Seih)\ **Replies:** 2\ **Last updated:** [January 4, 2017, 1:15pm UTC](https://discuss.elastic.co/t/packetbeat-elasticsearch-mostly-shows-zero-as-response-time-for-queries/70483 "2017-01-04T13:15:27Z")
I've installed PacketBeat & ElasticSearch on 1 WildFly server running some simple servlets. The problem that I have is that I see a lot of queries/http requests having "0" as responsetime. Not always, but very often. W… --- ## [Cannot go get github.com/elastic/beats/libbeat/beat go1.4.2](https://discuss.elastic.co/t/cannot-go-get-github-com-elastic-beats-libbeat-beat-go1-4-2/69815)
**Author:** [@zoidberg8e](https://discuss.elastic.co/u/zoidberg8e)\ **Replies:** 2\ **Last updated:** [January 4, 2017, 8:40am UTC](https://discuss.elastic.co/t/cannot-go-get-github-com-elastic-beats-libbeat-beat-go1-4-2/69815 "2017-01-04T08:40:33Z")
go get github.com/elastic/beats/libbeat/beat package context: unrecognized import path "context" go version go version go1.4.2 gccgo (GCC) 5.2.1 20150716 linux/amd64 With the go version of gcc 5.2.1 which is 1.4.2 … --- ## [OK to run Winlogbeat minor version older than Elasticsearch?](https://discuss.elastic.co/t/ok-to-run-winlogbeat-minor-version-older-than-elasticsearch/70506)
**Author:** [@jameswatson3](https://discuss.elastic.co/u/jameswatson3)\ **Replies:** 1\ **Last updated:** [January 4, 2017, 6:44am UTC](https://discuss.elastic.co/t/ok-to-run-winlogbeat-minor-version-older-than-elasticsearch/70506 "2017-01-04T06:44:44Z")
I have a few hundred Windows servers indexing directly to elasticsearch (ie not through logstash) and everything was originally installed at 5.0.0. I need to upgrade my elasticsearch cluster to 5.1.1 but I would rather… --- ## [Filebeat locking files](https://discuss.elastic.co/t/filebeat-locking-files/70501)
**Author:** [@Prathap\_Reddy](https://discuss.elastic.co/u/Prathap_Reddy)\ **Replies:** 2\ **Last updated:** [January 4, 2017, 3:27am UTC](https://discuss.elastic.co/t/filebeat-locking-files/70501 "2017-01-04T03:27:39Z")
Hi, I installed filebeat to monitor logs. Below are the environment details: OS: windows 7 filebeat version: 5.1.1 Config Details Prospectors config: - input\_type: log paths: - C:\\myfiles\\ELKStack\\Learning\*… --- ## [New filebeat/ELK stack user: trouble with Raspberry](https://discuss.elastic.co/t/new-filebeat-elk-stack-user-trouble-with-raspberry/70435)
**Author:** [@jarif](https://discuss.elastic.co/u/jarif)\ **Replies:** 17\ **Last updated:** [January 3, 2017, 5:01pm UTC](https://discuss.elastic.co/t/new-filebeat-elk-stack-user-trouble-with-raspberry/70435 "2017-01-03T17:01:35Z")
Hello all. I have an ELK stack running on a CentOS server. I also have logging satellites running CentOS, and those are sending logs using filebeat. Fine, and works nice. I'm also trying to set up my Raspberrys for f… --- ## [Regex multiline pattern with empty line](https://discuss.elastic.co/t/regex-multiline-pattern-with-empty-line/70324)
**Author:** [@ssasporta](https://discuss.elastic.co/u/ssasporta)\ **Replies:** 6\ **Last updated:** [January 3, 2017, 1:03pm UTC](https://discuss.elastic.co/t/regex-multiline-pattern-with-empty-line/70324 "2017-01-03T13:03:29Z")
Looking for regex for the following lines: (Need to exlude the empty line) \<\\> \[Feb 24 14:36:19\] \[\[ACTIVE\] ExecuteThread: '6' for queue: 'weblogic.kernel.Default (self-tuning)'\] \[CM\] \[Asmsa1\] (MemoPublisherCreat… --- ## [How to know if file beat finished processing a set of log file?](https://discuss.elastic.co/t/how-to-know-if-file-beat-finished-processing-a-set-of-log-file/70207)
**Author:** [@Rahul\_Pradhan](https://discuss.elastic.co/u/Rahul_Pradhan)\ **Replies:** 1\ **Last updated:** [January 3, 2017, 9:08am UTC](https://discuss.elastic.co/t/how-to-know-if-file-beat-finished-processing-a-set-of-log-file/70207 "2017-01-03T09:08:02Z")
How to know if file beat finished processing a set of log file? Is there a way to push this information to elastic search index? --- ## [Unable to View Imported Dashboards/Visualizations for Metricbeat](https://discuss.elastic.co/t/unable-to-view-imported-dashboards-visualizations-for-metricbeat/69360)
**Author:** [@gupta.yuvraj](https://discuss.elastic.co/u/gupta.yuvraj)\ **Replies:** 5\ **Last updated:** [January 3, 2017, 7:44am UTC](https://discuss.elastic.co/t/unable-to-view-imported-dashboards-visualizations-for-metricbeat/69360 "2017-01-03T07:44:27Z")
I am using MetricBeat to capture statistics and send data to Logstash. Logstash then reads input from Beats and sends the data to Elasticsearch. Data is present in Elasticsearch & Kibana index shows the data read from El… --- ## [FileBeat - corrupt file on rotation](https://discuss.elastic.co/t/filebeat-corrupt-file-on-rotation/68964)
**Author:** [@hybrid](https://discuss.elastic.co/u/hybrid)\ **Replies:** 13\ **Last updated:** [January 3, 2017, 7:43am UTC](https://discuss.elastic.co/t/filebeat-corrupt-file-on-rotation/68964 "2017-01-03T07:43:49Z")
Hi, I'm using FileBeat to output to a file and then an ArcSight Regex file connector (usenonlockingwindowsfilereader=true, followexternalrotation=true ) pulls into ArcSight. I have the rotation set to 2 because I don't r… --- ## [64Bit alignment issue on ARM7 (Raspberry Pi)](https://discuss.elastic.co/t/64bit-alignment-issue-on-arm7-raspberry-pi/68785)
**Author:** [@kofi](https://discuss.elastic.co/u/kofi)\ **Replies:** 6\ **Last updated:** [January 2, 2017, 9:36pm UTC](https://discuss.elastic.co/t/64bit-alignment-issue-on-arm7-raspberry-pi/68785 "2017-01-02T21:36:54Z")
Hi, I tried to compile the latest code of filebeat on my Raspbarry Pi 3 (Arch ARM Linux, armv7h). The compilation was successful, however during runtime it crashed as follows panic: runtime error: invalid memory add… --- ## [Problem about create a own beats](https://discuss.elastic.co/t/problem-about-create-a-own-beats/69898)
**Author:** [@heiswade](https://discuss.elastic.co/u/heiswade)\ **Replies:** 5\ **Last updated:** [January 2, 2017, 6:55pm UTC](https://discuss.elastic.co/t/problem-about-create-a-own-beats/69898 "2017-01-02T18:55:02Z")
when I used cookiecutter follow the instructions to create the exaplebeat,but it seems losing some files. when do like this:make setup,problem comed: mkdir -p vendor/github.com/elastic/ cp -R /opt/bobo/work/src/githu… --- ## [What kind of special parameters can be used in filebeat.yml?](https://discuss.elastic.co/t/what-kind-of-special-parameters-can-be-used-in-filebeat-yml/70321)
**Author:** [@meetyg](https://discuss.elastic.co/u/meetyg)\ **Replies:** 2\ **Last updated:** [January 1, 2017, 3:52am UTC](https://discuss.elastic.co/t/what-kind-of-special-parameters-can-be-used-in-filebeat-yml/70321 "2017-01-01T03:52:58Z")
Hello, Its a bit unclear what kind of special parameters can be used in filebeat.yml Specificly, I'm reffering to parameters of the elasticsearch output section. For example the index name can be set with date: index: 'f… --- ## [Using list environment variables in filebeat config](https://discuss.elastic.co/t/using-list-environment-variables-in-filebeat-config/70124)
**Author:** [@ApsOps](https://discuss.elastic.co/u/ApsOps)\ **Replies:** 4\ **Last updated:** [December 29, 2016, 7:04pm UTC](https://discuss.elastic.co/t/using-list-environment-variables-in-filebeat-config/70124 "2016-12-29T19:04:39Z")
Previous discussion at https://discuss.elastic.co/t/interpolate-list-from-environment-variable-in-filebeats/65517 and https://github.com/elastic/beats/pull/3045 I built from master, so this^ PR is included. I'm using… --- ## [Send logs on a specify output depending on the paths of the prospectors](https://discuss.elastic.co/t/send-logs-on-a-specify-output-depending-on-the-paths-of-the-prospectors/69911)
**Author:** [@jstar](https://discuss.elastic.co/u/jstar)\ **Replies:** 4\ **Last updated:** [December 29, 2016, 2:44pm UTC](https://discuss.elastic.co/t/send-logs-on-a-specify-output-depending-on-the-paths-of-the-prospectors/69911 "2016-12-29T14:44:20Z")
Hi Everyone, I'm playing around with filebeat and I wanted to sends logs to certain outputs in an intelligent way. That is I have a file in the /path/to/file2 which I want its logs to go to elasticsearch and another fi… --- ## [Filebeat output configuration to TCP ports](https://discuss.elastic.co/t/filebeat-output-configuration-to-tcp-ports/70038)
**Author:** [@siddhardhk](https://discuss.elastic.co/u/siddhardhk)\ **Replies:** 7\ **Last updated:** [December 29, 2016, 2:42pm UTC](https://discuss.elastic.co/t/filebeat-output-configuration-to-tcp-ports/70038 "2016-12-29T14:42:05Z")
Hi, Recently i started working on log forwarding to Kibana / ES and Apache NiFi thru logstash-forwarder and i am successfully finished the same. But, i came to know logstash-forwarder is deprecated and Filebeat is rep… --- ## [Does packetbeat handle reassembled packets?](https://discuss.elastic.co/t/does-packetbeat-handle-reassembled-packets/70177)
**Author:** [@billzy](https://discuss.elastic.co/u/billzy)\ **Replies:** 1\ **Last updated:** [December 29, 2016, 2:38pm UTC](https://discuss.elastic.co/t/does-packetbeat-handle-reassembled-packets/70177 "2016-12-29T14:38:04Z")
hello, I was encountered a problem that I saw 2 tcp segments which were actually 2parts of one data packet, I used packetbeat to monitor them and I eventually got two packets in packetbeat instead of one reassembled pa… --- ## [Multi file send from filebeat to logstash](https://discuss.elastic.co/t/multi-file-send-from-filebeat-to-logstash/70018)
**Author:** [@Tr\_ng\_Trang](https://discuss.elastic.co/u/Tr_ng_Trang)\ **Replies:** 12\ **Last updated:** [December 29, 2016, 7:45am UTC](https://discuss.elastic.co/t/multi-file-send-from-filebeat-to-logstash/70018 "2016-12-29T07:45:46Z")
i configured a filebeat.yml to get multi file log and create type fields for each file like this: filebeat.prospectors: - paths: - /var/log/access.log fields: {log\_type: access} - paths: … --- ## [Why packetbeat not capture this http request?](https://discuss.elastic.co/t/why-packetbeat-not-capture-this-http-request/70016)
**Author:** [@shell.b2t](https://discuss.elastic.co/u/shell.b2t)\ **Replies:** 4\ **Last updated:** [December 29, 2016, 2:59am UTC](https://discuss.elastic.co/t/why-packetbeat-not-capture-this-http-request/70016 "2016-12-29T02:59:56Z")
Hi : my env is packetbeat 5.1.1,include\_body\_for config as as follows： include\_body\_for: \['image/webp','application/x-javascript','\*/\*','application/octet-stream','text/xml','application/xml','application/xhtml+x… --- ## [Nginx and Mysql fields directly to Elasticsearch without Logstash](https://discuss.elastic.co/t/nginx-and-mysql-fields-directly-to-elasticsearch-without-logstash/70148)
**Author:** [@ypereirareis](https://discuss.elastic.co/u/ypereirareis)\ **Replies:** 1\ **Last updated:** [December 29, 2016, 12:30am UTC](https://discuss.elastic.co/t/nginx-and-mysql-fields-directly-to-elasticsearch-without-logstash/70148 "2016-12-29T00:30:13Z")
Hi, In the documentation I can see that Filebeat seems to offer a way to log directly data to elasticsearch without Logstash. https://www.elastic.co/guide/en/beats/filebeat/master/exported-fields-mysql.html and https:/… --- ## [Docker logs to ES with FileBeat](https://discuss.elastic.co/t/docker-logs-to-es-with-filebeat/70006)
**Author:** [@gilcoh](https://discuss.elastic.co/u/gilcoh)\ **Replies:** 4\ **Last updated:** [December 28, 2016, 6:05pm UTC](https://discuss.elastic.co/t/docker-logs-to-es-with-filebeat/70006 "2016-12-28T18:05:09Z")
Hi, I need help to parse my docker logs to ES with FileBeat - without using logstash. The main issue is that my "log" line transfers to the ES as a string instead of being parsed. Versions: FileBeat - 5.1.1 ES - 2.3 … --- ## [Metrticbeat does not output processes metrics on Win 2003](https://discuss.elastic.co/t/metrticbeat-does-not-output-processes-metrics-on-win-2003/70051)
**Author:** [@gilisade](https://discuss.elastic.co/u/gilisade)\ **Replies:** 2\ **Last updated:** [December 28, 2016, 5:25pm UTC](https://discuss.elastic.co/t/metrticbeat-does-not-output-processes-metrics-on-win-2003/70051 "2016-12-28T17:25:33Z")
Hi We have 3 - 2003 r2 windows (64X) - servers i have intalled metricbeat 5.0.0 on all three. Now the service works fine and metric sets are getting to elasticsearch - all but processes metrics. This only happens on the… --- ## [Latest filebeat binary failing](https://discuss.elastic.co/t/latest-filebeat-binary-failing/70001)
**Author:** [@Sai\_Birada](https://discuss.elastic.co/u/Sai_Birada)\ **Replies:** 4\ **Last updated:** [December 27, 2016, 2:10pm UTC](https://discuss.elastic.co/t/latest-filebeat-binary-failing/70001 "2016-12-27T14:10:58Z")
Logs are flowing fine to logstash-2.4.1 if I am using filebeat-1.2.3 binary. However as part of upgradation when I am trying latest filebeat binary 5.1.2. Filebeat is failing with error 2016-12-26T03:42:46-08:00 DBG c… --- ## [Why my packetbeat capture too much fields?](https://discuss.elastic.co/t/why-my-packetbeat-capture-too-much-fields/70017)
**Author:** [@shell.b2t](https://discuss.elastic.co/u/shell.b2t)\ **Replies:** 4\ **Last updated:** [December 27, 2016, 11:45am UTC](https://discuss.elastic.co/t/why-my-packetbeat-capture-too-much-fields/70017 "2016-12-27T11:45:45Z")
Hi: my env is packetbeat 5.5.1, in kibana management-index patterns,there is about 3000 fields,like this http.request.headers.hcxrwnivhh http.request.headers.ehzayscxyp http.request.headers.cqddzwwqrx http… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=546) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=548)