# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=548 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 549 --- ## [Metricbeat WMI CPU usage](https://discuss.elastic.co/t/metricbeat-wmi-cpu-usage/69553)
**Author:** [@aalesh](https://discuss.elastic.co/u/aalesh)\ **Replies:** 7\ **Last updated:** [December 27, 2016, 11:39am UTC](https://discuss.elastic.co/t/metricbeat-wmi-cpu-usage/69553 "2016-12-27T11:39:38Z")
We want to use metricbeat to monitor processes on our Windows servers. The problem is that we have 200+ processes which seems to cause peformance issues: WmiPrvSE.exe consumes 90%+ of one CPU core. Metricbeat freezes … --- ## [Filebeat intermittently crashes during start up](https://discuss.elastic.co/t/filebeat-intermittently-crashes-during-start-up/69994)
**Author:** [@Sai\_Birada](https://discuss.elastic.co/u/Sai_Birada)\ **Replies:** 2\ **Last updated:** [December 27, 2016, 6:32am UTC](https://discuss.elastic.co/t/filebeat-intermittently-crashes-during-start-up/69994 "2016-12-27T06:32:27Z")
Hi, I am using filebeat-1.2.3 binary, built with go-1.7.1 in my freebsd box. When I am starting this binary in my freebsd boxes I am facing the error mentioned below. I am not facing this issue every time I start filebea… --- ## [How to visualize the Winlogbeat data in Kibana Dashboard](https://discuss.elastic.co/t/how-to-visualize-the-winlogbeat-data-in-kibana-dashboard/69975)
**Author:** [@prakash1243](https://discuss.elastic.co/u/prakash1243)\ **Replies:** 12\ **Last updated:** [December 27, 2016, 4:39am UTC](https://discuss.elastic.co/t/how-to-visualize-the-winlogbeat-data-in-kibana-dashboard/69975 "2016-12-27T04:39:06Z")
Hi- Am able to run the Winlogbeat successfully and able to create the .winlogbeat.yml file and logs shows succesffully sending the data to Elastic Search pointing to http://localhost:9200 Would you please let me know, … --- ## [How to parse all post params](https://discuss.elastic.co/t/how-to-parse-all-post-params/64335)
**Author:** [@shell.b2t](https://discuss.elastic.co/u/shell.b2t)\ **Replies:** 3\ **Last updated:** [November 6, 2016, 1:38am UTC](https://discuss.elastic.co/t/how-to-parse-all-post-params/64335 "2016-11-06T01:38:49Z")
I use packetbeat to capure http packet, but found some POST parameters can not be captured packetbeat info : \*\*\[root@localhost packetbeat\]# /usr/share/packetbeat/bin/packetbeat --version\*\* \*\*packetbeat version 5.0.… --- ## [Community Beat: Wrong version information in various make targets](https://discuss.elastic.co/t/community-beat-wrong-version-information-in-various-make-targets/69945)
**Author:** [@christiangalsterer](https://discuss.elastic.co/u/christiangalsterer)\ **Replies:** 4\ **Last updated:** [December 26, 2016, 4:58pm UTC](https://discuss.elastic.co/t/community-beat-wrong-version-information-in-various-make-targets/69945 "2016-12-26T16:58:56Z")
When executing make update or make package for a community beat, the wrong version is used. Instead if using the version information from some place in the community beat, the version is read from ${ES\_BEATS}/dev-tools/… --- ## [ERR Connecting error publishing events (retrying): Get https://localhost:9200: http: server gave HTTP response to HTTPS client](https://discuss.elastic.co/t/err-connecting-error-publishing-events-retrying-get-https-localhost-9200-http-server-gave-http-response-to-https-client/69973)
**Author:** [@prakash1243](https://discuss.elastic.co/u/prakash1243)\ **Replies:** 6\ **Last updated:** [December 26, 2016, 6:38am UTC](https://discuss.elastic.co/t/err-connecting-error-publishing-events-retrying-get-https-localhost-9200-http-server-gave-http-response-to-https-client/69973 "2016-12-26T06:38:29Z")
I had installed Elastic Search , Kibana running with 5.1.1 version, And I tried to run the Win log beats, where I couldn't get any data, instead throws the error in the logs. ERR Connecting error publishing events (re… --- ## [Filebeat performance tuning](https://discuss.elastic.co/t/filebeat-performance-tuning/69456)
**Author:** [@ashwani](https://discuss.elastic.co/u/ashwani)\ **Replies:** 3\ **Last updated:** [December 23, 2016, 2:45pm UTC](https://discuss.elastic.co/t/filebeat-performance-tuning/69456 "2016-12-23T14:45:09Z")
Hi, We recently upgraded filebeat (1.0.1 to 5.0.1), logstash (2.1.1 to 2.4.0) versions on our rpm based 8 core cpu with 14 GB RAM in our filebeat -\> logstash -\> Elastic Search -\> Kibana application. All configurations ar… --- ## [Relative path to save filebeat logs](https://discuss.elastic.co/t/relative-path-to-save-filebeat-logs/69756)
**Author:** [@wenyao](https://discuss.elastic.co/u/wenyao)\ **Replies:** 1\ **Last updated:** [December 23, 2016, 12:56pm UTC](https://discuss.elastic.co/t/relative-path-to-save-filebeat-logs/69756 "2016-12-23T12:56:06Z")
In filebeat config file, there is a section regarding logging to files, namely: logging.to\_files: true logging.files: # Configure the path where the logs are written. The default is the logs directory # under the h… --- ## [Metricbeat 5.1.1 "unsupported parameters" es2x template](https://discuss.elastic.co/t/metricbeat-5-1-1-unsupported-parameters-es2x-template/69664)
**Author:** [@JPvRiel](https://discuss.elastic.co/u/JPvRiel)\ **Replies:** 1\ **Last updated:** [December 23, 2016, 7:50am UTC](https://discuss.elastic.co/t/metricbeat-5-1-1-unsupported-parameters-es2x-template/69664 "2016-12-23T07:50:07Z")
Metricbeat 5 is no longer working with ES 2.x. There are document mapping issues. Config (I also tried bare bone default, same issue) output.elasticsearch: enabled: true hosts: \['\'\] protocol: http 2… --- ## [Performance difference between af\_packet/libpcap?](https://discuss.elastic.co/t/performance-difference-between-af-packet-libpcap/69766)
**Author:** [@wofanli](https://discuss.elastic.co/u/wofanli)\ **Replies:** 4\ **Last updated:** [December 23, 2016, 1:58am UTC](https://discuss.elastic.co/t/performance-difference-between-af-packet-libpcap/69766 "2016-12-23T01:58:59Z")
Hi Guys, I'm looking at the packetbeat document, and it declares af\_packet has better performance than pcap. Do we have any number regarding this performance difference? As far as I know libpcap has leveraged af\_p… --- ## [Going through the Logstash tutorial - "connection refused" error](https://discuss.elastic.co/t/going-through-the-logstash-tutorial-connection-refused-error/69620)
**Author:** [@Josh\_A](https://discuss.elastic.co/u/Josh_A)\ **Replies:** 7\ **Last updated:** [December 22, 2016, 8:32pm UTC](https://discuss.elastic.co/t/going-through-the-logstash-tutorial-connection-refused-error/69620 "2016-12-22T20:32:23Z")
Hi all -- getting stuck during the Logstash tutorial on the Elastic site: https://www.elastic.co/guide/en/logstash/current/advanced-pipeline.html I'm trying to use FileBeat to load the specified sample logfile into ES.… --- ## [Path params problem](https://discuss.elastic.co/t/path-params-problem/69729)
**Author:** [@laywin](https://discuss.elastic.co/u/laywin)\ **Replies:** 2\ **Last updated:** [December 22, 2016, 7:42am UTC](https://discuss.elastic.co/t/path-params-problem/69729 "2016-12-22T07:42:45Z")
hello! we recently have a demand which is that we want to get matched path params. example: we config filebeat path like: /var/log/\*/\*.log, matched path is : /var/log/aa/bb.log we want to get 'aa' and 'bb' param… --- ## [Using variables in fields output](https://discuss.elastic.co/t/using-variables-in-fields-output/69559)
**Author:** [@Sai\_Theodore](https://discuss.elastic.co/u/Sai_Theodore)\ **Replies:** 4\ **Last updated:** [December 22, 2016, 4:14am UTC](https://discuss.elastic.co/t/using-variables-in-fields-output/69559 "2016-12-22T04:14:18Z")
I need to pass a field from filebeat to kafka viz. host which is nothing but the host name of the machine from the logs are read. Though Filebeat sends the hostname in the beat properties, I need this in a separate field… --- ## [Error publishing events from filebeat](https://discuss.elastic.co/t/error-publishing-events-from-filebeat/67759)
**Author:** [@aparadka](https://discuss.elastic.co/u/aparadka)\ **Replies:** 7\ **Last updated:** [December 21, 2016, 5:50pm UTC](https://discuss.elastic.co/t/error-publishing-events-from-filebeat/67759 "2016-12-21T17:50:30Z")
This is the error i'm encountering while sending the file from FB--\>LS--\>ES. This is what the LS console is showing --- ## [Set indices based on a field value](https://discuss.elastic.co/t/set-indices-based-on-a-field-value/69579)
**Author:** [@YLombardi](https://discuss.elastic.co/u/YLombardi)\ **Replies:** 4\ **Last updated:** [December 21, 2016, 1:12pm UTC](https://discuss.elastic.co/t/set-indices-based-on-a-field-value/69579 "2016-12-21T13:12:58Z")
I'm trying to send my logs to multiple indices based on a field value. The exemple in the documentation works fine : https://www.elastic.co/guide/en/beats/filebeat/5.0/elasticsearch-output.html#\_indices But it is based o… --- ## [Losing log data when forwarding from filebeat nodes](https://discuss.elastic.co/t/losing-log-data-when-forwarding-from-filebeat-nodes/69304)
**Author:** [@himaz.m](https://discuss.elastic.co/u/himaz.m)\ **Replies:** 5\ **Last updated:** [December 21, 2016, 12:55pm UTC](https://discuss.elastic.co/t/losing-log-data-when-forwarding-from-filebeat-nodes/69304 "2016-12-21T12:55:27Z")
Our production environment is setup to have 6 nodes running. We have setup filebeat on all of the 6 nodes. We have an ELK Stack running on a different node and all the filebeats are forwarding the logs to the logstash on… --- ## [Filebeat sending to Logstash AND Elasticsearch](https://discuss.elastic.co/t/filebeat-sending-to-logstash-and-elasticsearch/69650)
**Author:** [@ypereirareis](https://discuss.elastic.co/u/ypereirareis)\ **Replies:** 2\ **Last updated:** [December 21, 2016, 9:52am UTC](https://discuss.elastic.co/t/filebeat-sending-to-logstash-and-elasticsearch/69650 "2016-12-21T09:52:33Z")
Hello, Is it possible in the same filebeat configuration to tell filebeat to send some logs (prospectors) directly to elasticsearch (mysql, nginx) AND some other logs to logstash ? Because some log formats can direct… --- ## [Filebeat not excluding lines?](https://discuss.elastic.co/t/filebeat-not-excluding-lines/69238)
**Author:** [@hybrid](https://discuss.elastic.co/u/hybrid)\ **Replies:** 6\ **Last updated:** [December 21, 2016, 9:33am UTC](https://discuss.elastic.co/t/filebeat-not-excluding-lines/69238 "2016-12-21T09:33:48Z")
Running FileBeat 5.1 filebeat.prospectors: - input\_type: log paths: - c:\\\\DNSLogging\\\\trace.log include\_lines: \['^\[0-9\]{1,2}\\/\[0-9\]{1,2}\\/\[0-9\]{4}\\s{1,2}\[0-9\]{1,2}:\[0-9\]{1,2}:\[0-9\]{1,2}\\s{1,2}', '^\\\\s{2}Msg\\\\… --- ## [Filebeat to send containers logs](https://discuss.elastic.co/t/filebeat-to-send-containers-logs/69609)
**Author:** [@overip](https://discuss.elastic.co/u/overip)\ **Replies:** 1\ **Last updated:** [December 20, 2016, 9:47pm UTC](https://discuss.elastic.co/t/filebeat-to-send-containers-logs/69609 "2016-12-20T21:47:56Z")
Hello, I need to configure Filebeat tp send containers logs to Elasticsearch. Does anybody know how to do that? I guess I just need to forward STDOUT to Elasticsearch, but I can't figure out how to do it. Thanks! --- ## [System.fsstat filtering / processors](https://discuss.elastic.co/t/system-fsstat-filtering-processors/69029)
**Author:** [@slalomnut](https://discuss.elastic.co/u/slalomnut)\ **Replies:** 3\ **Last updated:** [December 20, 2016, 5:11pm UTC](https://discuss.elastic.co/t/system-fsstat-filtering-processors/69029 "2016-12-20T17:11:29Z")
More questions surrounding https://discuss.elastic.co/t/all-numbers-reported-by-metricbeat-too-high-bug/56094/6 and https://github.com/elastic/beats/issues/2079 Is there a way to use filters or processors to limit metr… --- ## [Issue with the indices field of elasticsearch output](https://discuss.elastic.co/t/issue-with-the-indices-field-of-elasticsearch-output/69554)
**Author:** [@YLombardi](https://discuss.elastic.co/u/YLombardi)\ **Replies:** 2\ **Last updated:** [December 20, 2016, 12:44pm UTC](https://discuss.elastic.co/t/issue-with-the-indices-field-of-elasticsearch-output/69554 "2016-12-20T12:44:33Z")
I'm trying to send my logs to multiple indices based on a field value. In the documentation, it says that I can do this by using the "indices" field in the elasticsearch output : https://www.elastic.co/guide/en/beats/fil… --- ## [Filebeat not closing file handle even after ignore\_older](https://discuss.elastic.co/t/filebeat-not-closing-file-handle-even-after-ignore-older/69472)
**Author:** [@Omar\_Al\_Zabir](https://discuss.elastic.co/u/Omar_Al_Zabir)\ **Replies:** 3\ **Last updated:** [December 20, 2016, 11:47am UTC](https://discuss.elastic.co/t/filebeat-not-closing-file-handle-even-after-ignore-older/69472 "2016-12-20T11:47:02Z")
I have the following filebeat config, where I do not want to monitor files older than an hour, as I need to delete files 30 mins older: close\_renamed: true close\_inactive: 15m close\_removed: true … --- ## [Regarding reading value of field variable in filebeat](https://discuss.elastic.co/t/regarding-reading-value-of-field-variable-in-filebeat/38511)
**Author:** [@vivc](https://discuss.elastic.co/u/vivc)\ **Replies:** 7\ **Last updated:** [December 20, 2016, 10:03am UTC](https://discuss.elastic.co/t/regarding-reading-value-of-field-variable-in-filebeat/38511 "2016-12-20T10:03:39Z")
I want to read a variable from a config file and assign it to filed variablet. Please suggest how can we do this. --- ## [Filebeat config for files that are never updated with new logs](https://discuss.elastic.co/t/filebeat-config-for-files-that-are-never-updated-with-new-logs/69197)
**Author:** [@Airn5475](https://discuss.elastic.co/u/Airn5475)\ **Replies:** 15\ **Last updated:** [December 20, 2016, 9:32am UTC](https://discuss.elastic.co/t/filebeat-config-for-files-that-are-never-updated-with-new-logs/69197 "2016-12-20T09:32:27Z")
I intend to drop .json files into a directory that Filebeat is monitoring (they eventually end up in Elasticsearch) The goal is to hit the data source for the latest changes every 15 minutes and output to a .json file. … --- ## [Question about logrotate with gzip](https://discuss.elastic.co/t/question-about-logrotate-with-gzip/69414)
**Author:** [@Fedele\_Mantuano](https://discuss.elastic.co/u/Fedele_Mantuano)\ **Replies:** 1\ **Last updated:** [December 20, 2016, 8:53am UTC](https://discuss.elastic.co/t/question-about-logrotate-with-gzip/69414 "2016-12-20T08:53:08Z")
Hi, I have a question about the behavior of filebeat with logrotate and gzip. I had a problem with my logstash server that takes all filebeats events. This logstash was stopped so all filebeats could send logs to it. … --- ## [Compile packetbeat as 32 bits in a 64 bits environment (Linux)](https://discuss.elastic.co/t/compile-packetbeat-as-32-bits-in-a-64-bits-environment-linux/69174)
**Author:** [@PinXo](https://discuss.elastic.co/u/PinXo)\ **Replies:** 6\ **Last updated:** [December 20, 2016, 8:02am UTC](https://discuss.elastic.co/t/compile-packetbeat-as-32-bits-in-a-64-bits-environment-linux/69174 "2016-12-20T08:02:57Z")
How can I compile packetbeat in a 64 bits environment (linux) to generate a 32 bits executable? I have tried "make crosscompile", which worked me on Winlogbeat. Then I read Build packetbeat on windows, so I downloaded … --- ## [Can a Beat read from the ES database and is message queuing built into the Beats architecture?](https://discuss.elastic.co/t/can-a-beat-read-from-the-es-database-and-is-message-queuing-built-into-the-beats-architecture/69342)
**Author:** [@baden0x1](https://discuss.elastic.co/u/baden0x1)\ **Replies:** 3\ **Last updated:** [December 19, 2016, 7:39pm UTC](https://discuss.elastic.co/t/can-a-beat-read-from-the-es-database-and-is-message-queuing-built-into-the-beats-architecture/69342 "2016-12-19T19:39:53Z")
From what I have read so far, Beats executes a cron job based on file-based configuration parameters. 1) Is there a way for a Beat to read from the ElasticSearch database to determine what to do - i.e. what URL to cr… --- ## [Beats prospector- No paths defined](https://discuss.elastic.co/t/beats-prospector-no-paths-defined/69471)
**Author:** [@iyerabhi07](https://discuss.elastic.co/u/iyerabhi07)\ **Replies:** 2\ **Last updated:** [December 19, 2016, 5:09pm UTC](https://discuss.elastic.co/t/beats-prospector-no-paths-defined/69471 "2016-12-19T17:09:38Z")
Hi, I installed filbeat on ubuntu 16.04 to send logs to my logstash server. I am looking to send auth.log to it. prospector text: filebeat.prospectors: - input\_type: log # Paths that should be crawled and fetc… --- ## [Can Winlogbeat output to Kafka?](https://discuss.elastic.co/t/can-winlogbeat-output-to-kafka/69465)
**Author:** [@ernestgwilsonii](https://discuss.elastic.co/u/ernestgwilsonii)\ **Replies:** 2\ **Last updated:** [December 19, 2016, 3:23pm UTC](https://discuss.elastic.co/t/can-winlogbeat-output-to-kafka/69465 "2016-12-19T15:23:48Z")
I am reviewing a solution where everything goes to Kafka first. Then from Kafka to Logstash then to GrayLog then to Elasticsearch then viewable by Kibana. Can Winlogbeat output to Kafka? Thank you. Ernie --- ## [Can someone please explain the Beat architecture - Can a Beat be used to pull data from a list of sources?](https://discuss.elastic.co/t/can-someone-please-explain-the-beat-architecture-can-a-beat-be-used-to-pull-data-from-a-list-of-sources/69294)
**Author:** [@baden0x1](https://discuss.elastic.co/u/baden0x1)\ **Replies:** 6\ **Last updated:** [December 19, 2016, 3:10pm UTC](https://discuss.elastic.co/t/can-someone-please-explain-the-beat-architecture-can-a-beat-be-used-to-pull-data-from-a-list-of-sources/69294 "2016-12-19T15:10:27Z")
I am trying to understand exactly how beats work under the hood. From what I have read, they are mini daemons that run on a client that will ship data to an ElasticSearch endpoint. In our current platform, we have a W… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=547) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=549)