# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=549 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 550 --- ## [Logs are not getting parsed?](https://discuss.elastic.co/t/logs-are-not-getting-parsed/69355)
**Author:** [@sohimankotia](https://discuss.elastic.co/u/sohimankotia)\ **Replies:** 1\ **Last updated:** [December 18, 2016, 12:12pm UTC](https://discuss.elastic.co/t/logs-are-not-getting-parsed/69355 "2016-12-18T12:12:59Z")
Hi , I have log file containing logs in format 127.0.0.1 - - \[16/Dec/2016:17:38:39 +0530\] "GET /feed/user/785400761?q.l.m=en&debug=enabled HTTP/1.1" 200 - "-" "Jersey/2.25 (HttpUrlConnection 1.8.0\_111)" 1041 But… --- ## [Starting filebeat documentation is really confusing](https://discuss.elastic.co/t/starting-filebeat-documentation-is-really-confusing/69067)
**Author:** [@Elhanan\_Maayan](https://discuss.elastic.co/u/Elhanan_Maayan)\ **Replies:** 2\ **Last updated:** [December 17, 2016, 4:01pm UTC](https://discuss.elastic.co/t/starting-filebeat-documentation-is-really-confusing/69067 "2016-12-17T16:01:26Z")
hi.. the docs in filebeat can be really confusing for example: https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-command-line.html "To start Filebeat, you must use the -c config/path option to specify th… --- ## [Can metricbeat support run command?](https://discuss.elastic.co/t/can-metricbeat-support-run-command/69103)
**Author:** [@sitanxin](https://discuss.elastic.co/u/sitanxin)\ **Replies:** 4\ **Last updated:** [December 17, 2016, 2:44pm UTC](https://discuss.elastic.co/t/can-metricbeat-support-run-command/69103 "2016-12-17T14:44:52Z")
Hi all, Is there any way to run small command in the metricbeat? fields: os\_version: "cat /etc/redhat-release" But in result, we can see this command did not run. Is there any way we can run it? --- ## [Parsing logback log files with filebeat and sending them to Elasticsearch](https://discuss.elastic.co/t/parsing-logback-log-files-with-filebeat-and-sending-them-to-elasticsearch/49302)
**Author:** [@Jemli\_Fathi](https://discuss.elastic.co/u/Jemli_Fathi)\ **Replies:** 14\ **Last updated:** [December 16, 2016, 6:00pm UTC](https://discuss.elastic.co/t/parsing-logback-log-files-with-filebeat-and-sending-them-to-elasticsearch/49302 "2016-12-16T18:00:42Z")
Hi, i have a java application with logback for the log configuration and i want to parse my application log files, so they become more useful and to send them to ES, log files will be stored in a directory called logs an… --- ## [How to define multiline.pattern for complex pattern](https://discuss.elastic.co/t/how-to-define-multiline-pattern-for-complex-pattern/68924)
**Author:** [@ssasporta](https://discuss.elastic.co/u/ssasporta)\ **Replies:** 20\ **Last updated:** [December 16, 2016, 12:49pm UTC](https://discuss.elastic.co/t/how-to-define-multiline-pattern-for-complex-pattern/68924 "2016-12-16T12:49:54Z")
I need to define the multiline.pattern field in my prospectors, instead of doing it in the logstash filter. The first pattern looks like that: \ The second pattern looks like that: \<\\> … --- ## [Filebeat sends json to kafka instead of raw content of log file](https://discuss.elastic.co/t/filebeat-sends-json-to-kafka-instead-of-raw-content-of-log-file/68984)
**Author:** [@antimion](https://discuss.elastic.co/u/antimion)\ **Replies:** 3\ **Last updated:** [December 16, 2016, 12:34pm UTC](https://discuss.elastic.co/t/filebeat-sends-json-to-kafka-instead-of-raw-content-of-log-file/68984 "2016-12-16T12:34:25Z")
Hi , i have installed filebeat but i have problem. I need to send only raw content of log file to kafka/logstash without additional information from beats. How to do that? filebeat config file filebeat.prospectors: -… --- ## [Set/get version number of community beats](https://discuss.elastic.co/t/set-get-version-number-of-community-beats/68990)
**Author:** [@cyrilleverrier](https://discuss.elastic.co/u/cyrilleverrier)\ **Replies:** 5\ **Last updated:** [December 16, 2016, 11:02am UTC](https://discuss.elastic.co/t/set-get-version-number-of-community-beats/68990 "2016-12-16T11:02:05Z")
The current implementation of libbeat does not fully support setting a version number for the community beat apps. If you are happy with the following changes, I am going to implement them right away Suggested change… --- ## [Packetbeat windows - all\_headers not working?](https://discuss.elastic.co/t/packetbeat-windows-all-headers-not-working/68841)
**Author:** [@andrew\_crow](https://discuss.elastic.co/u/andrew_crow)\ **Replies:** 8\ **Last updated:** [December 16, 2016, 8:31am UTC](https://discuss.elastic.co/t/packetbeat-windows-all-headers-not-working/68841 "2016-12-16T08:31:17Z")
Sorry guys - I'm a newbie to ELK. So I've got packetbeat working (sort of) fine on Win 10. Local copy of Elasticsearch receiving direct docuemts from the beat. Kibana displaying everything - sort of. Having edited the… --- ## [How to get the filesystem utilization via metricbeat?](https://discuss.elastic.co/t/how-to-get-the-filesystem-utilization-via-metricbeat/68676)
**Author:** [@sitanxin](https://discuss.elastic.co/u/sitanxin)\ **Replies:** 9\ **Last updated:** [December 16, 2016, 8:16am UTC](https://discuss.elastic.co/t/how-to-get-the-filesystem-utilization-via-metricbeat/68676 "2016-12-16T08:16:59Z")
Hi team, May I know how to get the filesystem utilization in Linux? Really don't know what does these 2 information means? system.filesystem.total system.filesystem.used.pct --- ## [Metricbeat MongoDB: Report DB Stats](https://discuss.elastic.co/t/metricbeat-mongodb-report-db-stats/69218)
**Author:** [@scottcrespo](https://discuss.elastic.co/u/scottcrespo)\ **Replies:** 0\ **Last updated:** [December 15, 2016, 9:25pm UTC](https://discuss.elastic.co/t/metricbeat-mongodb-report-db-stats/69218 "2016-12-15T21:25:45Z")
Currently, Metricbeat monitors MongoDB instances using Mongo's serverStatus() report. This is the primary "data dump" of information regarding a particular Mongo instance. In addition, Mongo has other useful reporting … --- ## [Filebeat paths logic](https://discuss.elastic.co/t/filebeat-paths-logic/68687)
**Author:** [@Arthur\_Francis](https://discuss.elastic.co/u/Arthur_Francis)\ **Replies:** 5\ **Last updated:** [December 15, 2016, 1:32pm UTC](https://discuss.elastic.co/t/filebeat-paths-logic/68687 "2016-12-15T13:32:50Z")
Hi, Are there any other alternatives to using a wildcard (\*) in filebeat when defining a log path. My application generates a numeric directory tree based on its activity lifecycle 34..35..36 etc The amount of direc… --- ## [How to draw simple xy chart using filebeat + Kibana + Elasticsearch](https://discuss.elastic.co/t/how-to-draw-simple-xy-chart-using-filebeat-kibana-elasticsearch/68935)
**Author:** [@jantoth](https://discuss.elastic.co/u/jantoth)\ **Replies:** 1\ **Last updated:** [December 15, 2016, 11:56am UTC](https://discuss.elastic.co/t/how-to-draw-simple-xy-chart-using-filebeat-kibana-elasticsearch/68935 "2016-12-15T11:56:36Z")
Hi guys, currently I am trying to read the output from my customized log files which look like: for i in {1..50} ; do awk 'BEGIN {"date +'%Y.%m.%d-%T'"|getline d;"curl -sI some\_web\_page/" | getline; printf "{\\"times… --- ## [Install old beats version from repository](https://discuss.elastic.co/t/install-old-beats-version-from-repository/69073)
**Author:** [@mathias](https://discuss.elastic.co/u/mathias)\ **Replies:** 1\ **Last updated:** [December 14, 2016, 9:50pm UTC](https://discuss.elastic.co/t/install-old-beats-version-from-repository/69073 "2016-12-14T21:50:02Z")
Hi, I wonder if it is possible to install the beats of a specific version from the repository? I have tried: wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo apt-key add - echo "deb https://artifact… --- ## [Winlogbeat to syslog](https://discuss.elastic.co/t/winlogbeat-to-syslog/69048)
**Author:** [@qutach](https://discuss.elastic.co/u/qutach)\ **Replies:** 1\ **Last updated:** [December 14, 2016, 4:51pm UTC](https://discuss.elastic.co/t/winlogbeat-to-syslog/69048 "2016-12-14T16:51:59Z")
Hi, Is it possible to send windows event logs with winlogbeats direct to logstash syslog service (or other syslog servers udp/tcp 514)? I can't find how to specifiy the server hostname/ip. Only how to enable logging s… --- ## [Filebeat SSL to logstash issue](https://discuss.elastic.co/t/filebeat-ssl-to-logstash-issue/69025)
**Author:** [@xon](https://discuss.elastic.co/u/xon)\ **Replies:** 0\ **Last updated:** [December 14, 2016, 1:56pm UTC](https://discuss.elastic.co/t/filebeat-ssl-to-logstash-issue/69025 "2016-12-14T13:56:18Z")
I am using the 5.0.x versions of both filebeat and logstash. My filebeat config is as follows: filebeat.prospectors: input\_type: log paths: /var/log/apache2/access.log output.logstash: hosts: \["192.168.0.4:5… --- ## [Filebeat does not set the index for logstash output even after providing index name in filebeat](https://discuss.elastic.co/t/filebeat-does-not-set-the-index-for-logstash-output-even-after-providing-index-name-in-filebeat/68537)
**Author:** [@Rupesh\_Ranjan](https://discuss.elastic.co/u/Rupesh_Ranjan)\ **Replies:** 3\ **Last updated:** [December 14, 2016, 3:13pm UTC](https://discuss.elastic.co/t/filebeat-does-not-set-the-index-for-logstash-output-even-after-providing-index-name-in-filebeat/68537 "2016-12-14T15:13:39Z")
In my filebeat.full.yml file, i have set the following configuration output.logstash: enabled: true hosts: \["localhost:5043"\] index: "testing-%{+yyyy.MM.dd}" Even after this, the index name appears as "logstash… --- ## [Filebeat sends garbled messages \\u0000](https://discuss.elastic.co/t/filebeat-sends-garbled-messages-u0000/68871)
**Author:** [@Alexik](https://discuss.elastic.co/u/Alexik)\ **Replies:** 4\ **Last updated:** [December 14, 2016, 3:06pm UTC](https://discuss.elastic.co/t/filebeat-sends-garbled-messages-u0000/68871 "2016-12-14T15:06:41Z")
Filebeat sends garbled messages \\u0000 Hi guys, I'm having problem with Filebeat. From time to time I'm receiving an event which looks like this: { "\_index": "uat1-access-ws", "\_type": "log", "\_id": "AVj4Nau7dy5nH… --- ## [Error while importing packetbeat dashboard 5.1.1](https://discuss.elastic.co/t/error-while-importing-packetbeat-dashboard-5-1-1/69022)
**Author:** [@kanekotky](https://discuss.elastic.co/u/kanekotky)\ **Replies:** 1\ **Last updated:** [December 14, 2016, 2:28pm UTC](https://discuss.elastic.co/t/error-while-importing-packetbeat-dashboard-5-1-1/69022 "2016-12-14T14:28:56Z")
Hi, I tried to import the packetbeat dashboard. But it stopped this step. Is this a known issue? Import search /tmp/tmp879753515/beats-dashboards-5.1.1/packetbeat/search/Thrift-transactions.json Import vizualization … --- ## [Windows filebeat SSL to Logstash](https://discuss.elastic.co/t/windows-filebeat-ssl-to-logstash/68557)
**Author:** [@dasteven86](https://discuss.elastic.co/u/dasteven86)\ **Replies:** 7\ **Last updated:** [December 14, 2016, 1:13pm UTC](https://discuss.elastic.co/t/windows-filebeat-ssl-to-logstash/68557 "2016-12-14T13:13:15Z")
hi i have a linux vm with theELK stack installed and a windows machine with the filebeat Agent running. everything runs great but it uses an unsecure connection no i wanted to secure the connection between those two m… --- ## [Filebeat.exe high RAM usage!](https://discuss.elastic.co/t/filebeat-exe-high-ram-usage/68071)
**Author:** [@Slava](https://discuss.elastic.co/u/Slava)\ **Replies:** 6\ **Last updated:** [December 14, 2016, 10:22am UTC](https://discuss.elastic.co/t/filebeat-exe-high-ram-usage/68071 "2016-12-14T10:22:00Z")
Original topic - https://discuss.elastic.co/t/filebeat-exe-high-ram-usage/62254 Can anyone advise? Regards, --- ## [Metricbeat counter logstash API](https://discuss.elastic.co/t/metricbeat-counter-logstash-api/68650)
**Author:** [@Jo\_De\_Troy](https://discuss.elastic.co/u/Jo_De_Troy)\ **Replies:** 3\ **Last updated:** [December 14, 2016, 8:29am UTC](https://discuss.elastic.co/t/metricbeat-counter-logstash-api/68650 "2016-12-14T08:29:26Z")
Hello, I was wondering if metricbeat can pull in metrics from logstash instances which are available though the logstash API (e.g. node stats API) ? Or is there another way to get insight on the performance/throughput … --- ## [Filter: drop\_event.when.regexp.device\_name](https://discuss.elastic.co/t/filter-drop-event-when-regexp-device-name/68898)
**Author:** [@slalomnut](https://discuss.elastic.co/u/slalomnut)\ **Replies:** 2\ **Last updated:** [December 14, 2016, 12:03am UTC](https://discuss.elastic.co/t/filter-drop-event-when-regexp-device-name/68898 "2016-12-14T00:03:48Z")
I'm attempting to drop duplicates (i.e. only match /dev/mapper/xxx). Is there a limitation to regex expression for the filter? I've tried multiple variations to drop fdqn matches in attempt to drop all nfs shares and … --- ## [How does Metricbeat define "Used Memory"?](https://discuss.elastic.co/t/how-does-metricbeat-define-used-memory/68786)
**Author:** [@coder-98103](https://discuss.elastic.co/u/coder-98103)\ **Replies:** 2\ **Last updated:** [December 13, 2016, 10:30pm UTC](https://discuss.elastic.co/t/how-does-metricbeat-define-used-memory/68786 "2016-12-13T22:30:36Z")
I am considering using Metricbeat to track my server capacity, but I'm confused by the memory reports. My test server has this output: root@sandbox:/etc/metricbeat# free -m total used fre… --- ## [Filebeat vs log4j TCP vs logstash as a shipper](https://discuss.elastic.co/t/filebeat-vs-log4j-tcp-vs-logstash-as-a-shipper/68925)
**Author:** [@Fuzzy66](https://discuss.elastic.co/u/Fuzzy66)\ **Replies:** 1\ **Last updated:** [December 13, 2016, 8:02pm UTC](https://discuss.elastic.co/t/filebeat-vs-log4j-tcp-vs-logstash-as-a-shipper/68925 "2016-12-13T20:02:06Z")
Our team is discussing what what method to send files to a Data Buffer like Redis or Kafka. What is the pros/cons for using Filebeat vs log4j socketappender vs logstash?? I know filebeat is a light weight log shipper… --- ## [Kafka module metricbeat](https://discuss.elastic.co/t/kafka-module-metricbeat/68559)
**Author:** [@Jo\_De\_Troy](https://discuss.elastic.co/u/Jo_De_Troy)\ **Replies:** 11\ **Last updated:** [December 13, 2016, 7:43pm UTC](https://discuss.elastic.co/t/kafka-module-metricbeat/68559 "2016-12-13T19:43:54Z")
Hello, I'm pretty new to the Elastic stack. I've just setup Elastic 5.1.1 and I'm trying to use the experimental kafka metrics included in metricbeat. I've already bumped up the logging level of the metricbeat to debu… --- ## [Metricbeat Tx and Rx Rates](https://discuss.elastic.co/t/metricbeat-tx-and-rx-rates/68731)
**Author:** [@Vivek\_Raj](https://discuss.elastic.co/u/Vivek_Raj)\ **Replies:** 6\ **Last updated:** [December 13, 2016, 6:55pm UTC](https://discuss.elastic.co/t/metricbeat-tx-and-rx-rates/68731 "2016-12-13T18:55:45Z")
Hi Guys, I'm having some issue while pulling the network stats, we want to capture TX and RX values and we able to pull the values to Elasticsearch but on kibana its showing larger values compare to value on the server… --- ## [Statsd module for metricbeat](https://discuss.elastic.co/t/statsd-module-for-metricbeat/68355)
**Author:** [@eduardohl](https://discuss.elastic.co/u/eduardohl)\ **Replies:** 7\ **Last updated:** [December 13, 2016, 1:06pm UTC](https://discuss.elastic.co/t/statsd-module-for-metricbeat/68355 "2016-12-13T13:06:20Z")
I've been using statsd, telegraf (when using InfluxDB) and datadog agent (when using datadog) with great results for metric collection, but now that I'm trying to use elastic search as the tsdb for my metrics I'm having … --- ## [Need to know Topbeat & Filebeat using which protocol & which port number should be open to deploy filebeat & topbeat on linux server](https://discuss.elastic.co/t/need-to-know-topbeat-filebeat-using-which-protocol-which-port-number-should-be-open-to-deploy-filebeat-topbeat-on-linux-server/68828)
**Author:** [@priti](https://discuss.elastic.co/u/priti)\ **Replies:** 4\ **Last updated:** [December 13, 2016, 11:40am UTC](https://discuss.elastic.co/t/need-to-know-topbeat-filebeat-using-which-protocol-which-port-number-should-be-open-to-deploy-filebeat-topbeat-on-linux-server/68828 "2016-12-13T11:40:12Z")
Need to know Topbeat & Filebeat using which protocol & which port number should be open to deploy filebeat & topbeat on linux server --- ## [Connecting DMZ ENV to ELK in the LAN](https://discuss.elastic.co/t/connecting-dmz-env-to-elk-in-the-lan/68643)
**Author:** [@gilisade](https://discuss.elastic.co/u/gilisade)\ **Replies:** 8\ **Last updated:** [December 13, 2016, 11:04am UTC](https://discuss.elastic.co/t/connecting-dmz-env-to-elk-in-the-lan/68643 "2016-12-13T11:04:19Z")
Hi there we have an ELK STACK in our LAN env (internal environment) we also have a DMZ env in the organization we want to install beats (metric winlog file...) on every server in the DMZ env and we want the output to get… --- ## [Can filebeat be configured to output dynamic file names?](https://discuss.elastic.co/t/can-filebeat-be-configured-to-output-dynamic-file-names/68615)
**Author:** [@kklemmick](https://discuss.elastic.co/u/kklemmick)\ **Replies:** 4\ **Last updated:** [December 13, 2016, 10:34am UTC](https://discuss.elastic.co/t/can-filebeat-be-configured-to-output-dynamic-file-names/68615 "2016-12-13T10:34:23Z")
I suspect the answer to this is that "filebeat can't do that", but figured I'd ask anyway in case I'm missing some feature. What I'm trying to do is harvest docker container logs and redirect them to different files ba… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=548) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=550)