# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=551 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 552 --- ## [Filebeat keeps open files forever](https://discuss.elastic.co/t/filebeat-keeps-open-files-forever/65548)
**Author:** [@Srinivas\_Chamarthi](https://discuss.elastic.co/u/Srinivas_Chamarthi)\ **Replies:** 8\ **Last updated:** [December 5, 2016, 3:39pm UTC](https://discuss.elastic.co/t/filebeat-keeps-open-files-forever/65548 "2016-12-05T15:39:30Z")
Hi, I have a similar issue like this and I have upgraded to latest version 5.0 to see if the issue goes away but I still see the same issue. below is the configuration and few debug lines where it mentions the file … --- ## [Multiple files from beats to logstash](https://discuss.elastic.co/t/multiple-files-from-beats-to-logstash/67966)
**Author:** [@bob-bza](https://discuss.elastic.co/u/bob-bza)\ **Replies:** 2\ **Last updated:** [December 5, 2016, 3:38pm UTC](https://discuss.elastic.co/t/multiple-files-from-beats-to-logstash/67966 "2016-12-05T15:38:30Z")
i have multiple files i was trying to index all those with different index's , i was wondering how can i manage those. filebeat i was forwarding to logstash and then output to elastic search. Example: /var/log/file1 /var… --- ## [Where in directory structure can collected metricbeat data be viewed?](https://discuss.elastic.co/t/where-in-directory-structure-can-collected-metricbeat-data-be-viewed/67681)
**Author:** [@rherr63](https://discuss.elastic.co/u/rherr63)\ **Replies:** 4\ **Last updated:** [December 5, 2016, 3:30pm UTC](https://discuss.elastic.co/t/where-in-directory-structure-can-collected-metricbeat-data-be-viewed/67681 "2016-12-05T15:30:01Z")
The documentation data indicates location for persistent data files is /var/lib/metricbeat. That directory is empty and i have searched other locations containing metricbeat and data in path. I am getting data because I … --- ## [Using beats and send logstash](https://discuss.elastic.co/t/using-beats-and-send-logstash/67699)
**Author:** [@bob-bza](https://discuss.elastic.co/u/bob-bza)\ **Replies:** 1\ **Last updated:** [December 5, 2016, 3:20pm UTC](https://discuss.elastic.co/t/using-beats-and-send-logstash/67699 "2016-12-05T15:20:19Z")
I was new not ELK, sending logs from multiple beats to single logstash with same tag, but was not able to see all the beats hosts in kibana. for ex: i was sending 5beats to 1logstash with same tag name. but can see only… --- ## [Filebeat send events to kafka repeatly](https://discuss.elastic.co/t/filebeat-send-events-to-kafka-repeatly/67615)
**Author:** [@vin](https://discuss.elastic.co/u/vin)\ **Replies:** 2\ **Last updated:** [December 5, 2016, 3:18pm UTC](https://discuss.elastic.co/t/filebeat-send-events-to-kafka-repeatly/67615 "2016-12-05T15:18:05Z")
Filebeat version : 5.0.2 OS : CentOS7 Filebeat Config: filebeat.prospectors: input\_type: log paths: /terminallogs/jhw/step/step.log\* document\_type: 'jhw-terminal-steplog' multiline.pattern: '^\[' multiline.nega… --- ## [Filebeat stops updating the registry](https://discuss.elastic.co/t/filebeat-stops-updating-the-registry/67553)
**Author:** [@tom.dewire](https://discuss.elastic.co/u/tom.dewire)\ **Replies:** 7\ **Last updated:** [December 5, 2016, 2:19pm UTC](https://discuss.elastic.co/t/filebeat-stops-updating-the-registry/67553 "2016-12-05T14:19:12Z")
UPDATE: This discussion is being tracked as bug #3098 UPDATE: Adding the affected OS as CentOS 6.x (2.6.32-642.3.1.el6.x86\_64) Per the title, Filebeat (5.0.0) appears to stop updating the registry, breaking state dur… --- ## [How to set the tls part in the filebeat.yml....alway wrong](https://discuss.elastic.co/t/how-to-set-the-tls-part-in-the-filebeat-yml-alway-wrong/67070)
**Author:** [@houfan](https://discuss.elastic.co/u/houfan)\ **Replies:** 4\ **Last updated:** [December 5, 2016, 2:14am UTC](https://discuss.elastic.co/t/how-to-set-the-tls-part-in-the-filebeat-yml-alway-wrong/67070 "2016-12-05T02:14:29Z")
here is my console output: and this setting in /etc/hosts did't work........... here is my filebeat.yml (on|in) 192.168.147.129: here is my logstash.conf (on|in) 192.168.147.128: here is the command I get the… --- ## [Winlogbeat: Logstash as forensic investigator](https://discuss.elastic.co/t/winlogbeat-logstash-as-forensic-investigator/67612)
**Author:** [@xsallowed](https://discuss.elastic.co/u/xsallowed)\ **Replies:** 2\ **Last updated:** [December 3, 2016, 11:18am UTC](https://discuss.elastic.co/t/winlogbeat-logstash-as-forensic-investigator/67612 "2016-12-03T11:18:12Z")
Hi I am trying to parse log files collected as part of forensic investigation from windows machine and wondering how can i make winlogbeat to parse logs from files and ship it to logstash server? Do we have a winlogbea… --- ## [Libbeat - C or C++ implementation?](https://discuss.elastic.co/t/libbeat-c-or-c-implementation/67453)
**Author:** [@paulkeogh](https://discuss.elastic.co/u/paulkeogh)\ **Replies:** 2\ **Last updated:** [December 2, 2016, 9:13pm UTC](https://discuss.elastic.co/t/libbeat-c-or-c-implementation/67453 "2016-12-02T21:13:54Z")
Any available or planned ? Thanks, --- ## [Error sending files from filebeat via logstash](https://discuss.elastic.co/t/error-sending-files-from-filebeat-via-logstash/67717)
**Author:** [@aparadka](https://discuss.elastic.co/u/aparadka)\ **Replies:** 1\ **Last updated:** [December 2, 2016, 3:39pm UTC](https://discuss.elastic.co/t/error-sending-files-from-filebeat-via-logstash/67717 "2016-12-02T15:39:33Z")
I tried sending the file from filebeat via logstash with the logstash output enabled in filebeat.yml files. After starting filebeat, it starts the harvester and gives the following error Can you suggest a soultion for… --- ## [Multi output for multi prospectors](https://discuss.elastic.co/t/multi-output-for-multi-prospectors/67861)
**Author:** [@YLombardi](https://discuss.elastic.co/u/YLombardi)\ **Replies:** 1\ **Last updated:** [December 2, 2016, 3:36pm UTC](https://discuss.elastic.co/t/multi-output-for-multi-prospectors/67861 "2016-12-02T15:36:03Z")
I use ELK 5.0.1 + Filebeat 5.0.1. On my server I have 2 kind of prospectors : - json logs - text logs Currently, I configure Filebeat to send the json logs directly to elasticsearch. This works fine. Now I want to… --- ## [Filebeat dashboard inversion 5.0.2](https://discuss.elastic.co/t/filebeat-dashboard-inversion-5-0-2/67769)
**Author:** [@ISMAELMARTINEZ](https://discuss.elastic.co/u/ISMAELMARTINEZ)\ **Replies:** 2\ **Last updated:** [December 2, 2016, 2:16pm UTC](https://discuss.elastic.co/t/filebeat-dashboard-inversion-5-0-2/67769 "2016-12-02T14:16:14Z")
Hi, I am trying import the filebeat dashboard using the import\_dashboards command. \[root@ip-172-31-27-124 scripts\]# ./import\_dashboards -es https://thatURLYouputhere.eu-west-1.aws.found.io:9243 -user myuserhere -pass… --- ## [Packetbeat 5.0 doesn't export http traffic or Kibana doesn't display it](https://discuss.elastic.co/t/packetbeat-5-0-doesnt-export-http-traffic-or-kibana-doesnt-display-it/67408)
**Author:** [@Vasyl](https://discuss.elastic.co/u/Vasyl)\ **Replies:** 2\ **Last updated:** [December 2, 2016, 1:14pm UTC](https://discuss.elastic.co/t/packetbeat-5-0-doesnt-export-http-traffic-or-kibana-doesnt-display-it/67408 "2016-12-02T13:14:12Z")
Hello, I follow the configuration guideline, but seems I am missing something. I need to display http post/request in Kibana, but only thing that I can see is dest and source ip addresses. Any help is much appreciate… --- ## [Filebeat unable to send data to elastic search](https://discuss.elastic.co/t/filebeat-unable-to-send-data-to-elastic-search/67708)
**Author:** [@asparadkar](https://discuss.elastic.co/u/asparadkar)\ **Replies:** 4\ **Last updated:** [December 1, 2016, 12:53pm UTC](https://discuss.elastic.co/t/filebeat-unable-to-send-data-to-elastic-search/67708 "2016-12-01T12:53:47Z")
I'm trying to send a file using filebeat. When i start filebeat, it starts the harvester for the file and then gives the following error I sent a file yesterday the exact same way and it was sent successfully. --- ## [Filebeat-\* index can't be fetched in Kibana](https://discuss.elastic.co/t/filebeat-index-cant-be-fetched-in-kibana/67593)
**Author:** [@asparadkar](https://discuss.elastic.co/u/asparadkar)\ **Replies:** 11\ **Last updated:** [December 1, 2016, 8:50am UTC](https://discuss.elastic.co/t/filebeat-index-cant-be-fetched-in-kibana/67593 "2016-12-01T08:50:58Z")
I'm trying to send a log file. FB--\>ES--\>Kibana. All the configurations are done.When i try for filebeat-\* index pattern in kibana,it can't fetch the mapping.The screen is like this Can you suggest a solution to this? --- ## [Filebeat proxy permissions?](https://discuss.elastic.co/t/filebeat-proxy-permissions/67658)
**Author:** [@agonzalez](https://discuss.elastic.co/u/agonzalez)\ **Replies:** 9\ **Last updated:** [November 30, 2016, 6:48pm UTC](https://discuss.elastic.co/t/filebeat-proxy-permissions/67658 "2016-11-30T18:48:47Z")
I have a nginx proxy restricting access to ES to PUT/POST only, but i am getting Forbidden in filebeat.log. Does filebeat need access to other URL locations? I am allowing PUT and POST to /filebeat\* index and this work… --- ## [Upgrading filebeat from 1.2.3 to 1.3.1](https://discuss.elastic.co/t/upgrading-filebeat-from-1-2-3-to-1-3-1/67607)
**Author:** [@rashthedude](https://discuss.elastic.co/u/rashthedude)\ **Replies:** 2\ **Last updated:** [November 30, 2016, 3:39pm UTC](https://discuss.elastic.co/t/upgrading-filebeat-from-1-2-3-to-1-3-1/67607 "2016-11-30T15:39:46Z")
I was wondering if there are any backwards incompatibilities between those mentioned versions? Would a simple upgrade suffice? Regards, Rashid --- ## [Bleeding of separate log files into single event when using codec multiline](https://discuss.elastic.co/t/bleeding-of-separate-log-files-into-single-event-when-using-codec-multiline/67576)
**Author:** [@mitter1989](https://discuss.elastic.co/u/mitter1989)\ **Replies:** 4\ **Last updated:** [November 30, 2016, 2:47pm UTC](https://discuss.elastic.co/t/bleeding-of-separate-log-files-into-single-event-when-using-codec-multiline/67576 "2016-11-30T14:47:34Z")
Please bear with me as I am new to this. I am using ELK 5.0.1 I am trying to ship my app logs(stack traces multiple lines as well as single line) and syslogs(mostly single line), I am using codec multiline in input of … --- ## [How to configure Kafka Connect Group Id in Beats Kafka Output](https://discuss.elastic.co/t/how-to-configure-kafka-connect-group-id-in-beats-kafka-output/67334)
**Author:** [@patrick.vonsteht](https://discuss.elastic.co/u/patrick.vonsteht)\ **Replies:** 5\ **Last updated:** [November 30, 2016, 12:49pm UTC](https://discuss.elastic.co/t/how-to-configure-kafka-connect-group-id-in-beats-kafka-output/67334 "2016-11-30T12:49:13Z")
The Beats Kafka Output plugin seems to be based on Kafka Connect and seems to use the standard group.id Kafka Connect setting (group.id=connect-cluster). I have looked into the documentation if there was an option to cha… --- ## [\`make setup\` fails on new generated beat](https://discuss.elastic.co/t/make-setup-fails-on-new-generated-beat/67582)
**Author:** [@phenomenes](https://discuss.elastic.co/u/phenomenes)\ **Replies:** 2\ **Last updated:** [November 30, 2016, 8:05am UTC](https://discuss.elastic.co/t/make-setup-fails-on-new-generated-beat/67582 "2016-11-30T08:05:07Z")
Hi there, When generating a new beat make setup fails with the following error: $ cookiecutter $GOPATH/src/github.com/elastic/beats/generate/beat $ cd foobar/ $ make setup mkdir -p vendor/github.com/elastic/ cp -R … --- ## [Winlogbeat stops working after a while with errors](https://discuss.elastic.co/t/winlogbeat-stops-working-after-a-while-with-errors/67027)
**Author:** [@syunusic](https://discuss.elastic.co/u/syunusic)\ **Replies:** 5\ **Last updated:** [November 30, 2016, 4:02am UTC](https://discuss.elastic.co/t/winlogbeat-stops-working-after-a-while-with-errors/67027 "2016-11-30T04:02:19Z")
Hi, I just install winlogbeat in a Windows 2003 Server and sent the logs to Logstash 2.3.1. This is my Winlogbeat conf: output.logstash: hosts: \["192.168.70.110:5044"\] (complete file: http://pastebin.com/KdTTPEu2) My… --- ## [Filebeat 5.1 vs 5.0.2?](https://discuss.elastic.co/t/filebeat-5-1-vs-5-0-2/67548)
**Author:** [@profiler](https://discuss.elastic.co/u/profiler)\ **Replies:** 2\ **Last updated:** [November 29, 2016, 10:12pm UTC](https://discuss.elastic.co/t/filebeat-5-1-vs-5-0-2/67548 "2016-11-29T22:12:58Z")
Hi there. It seems you released filebeat 5.1 today, then pulled it out, and pushed 5.0.2? I have 5.1 on some machines now, 5.0.2 on most others, what's the advice here? Thanks! --- ## [Pipeline is full, she can't take much more captain!](https://discuss.elastic.co/t/pipeline-is-full-she-cant-take-much-more-captain/67536)
**Author:** [@gchampion](https://discuss.elastic.co/u/gchampion)\ **Replies:** 2\ **Last updated:** [November 29, 2016, 9:41pm UTC](https://discuss.elastic.co/t/pipeline-is-full-she-cant-take-much-more-captain/67536 "2016-11-29T21:41:07Z")
Everything was going fine until I doubled the amount of log forwarders. I went from around 5,000/minute to 5/minute (not kidding). I've since cut the amount of log forwarders down to the original amount however I can't s… --- ## [MongoDB Packetbeat - Multiple beats for same operation](https://discuss.elastic.co/t/mongodb-packetbeat-multiple-beats-for-same-operation/67375)
**Author:** [@Peter\_Kalkman](https://discuss.elastic.co/u/Peter_Kalkman)\ **Replies:** 1\ **Last updated:** [November 29, 2016, 8:26pm UTC](https://discuss.elastic.co/t/mongodb-packetbeat-multiple-beats-for-same-operation/67375 "2016-11-29T20:26:00Z")
Hi, I've configured Packetbeat (5.0.1) to send MongoDB information via Logstash (5.0.1) to the current Cloud version of Elasticsearch (5.0.1). It works great, but the thing is that I get multiple beats for the same M… --- ## [Meaning of some log lines of filebeat](https://discuss.elastic.co/t/meaning-of-some-log-lines-of-filebeat/67057)
**Author:** [@VijayKarthikeyan](https://discuss.elastic.co/u/VijayKarthikeyan)\ **Replies:** 5\ **Last updated:** [November 29, 2016, 8:21pm UTC](https://discuss.elastic.co/t/meaning-of-some-log-lines-of-filebeat/67057 "2016-11-29T20:21:32Z")
What exactly these lines meant for? "2016-11-23T21:50:43-08:00 INFO Loading Prospectors completed. Number of prospectors: 1 2016-11-23T21:50:43-08:00 INFO All prospectors are initialised and running with 0 states to p… --- ## [How to identify different ip address of different hosts with Metricbeat?](https://discuss.elastic.co/t/how-to-identify-different-ip-address-of-different-hosts-with-metricbeat/67301)
**Author:** [@qhlHelo](https://discuss.elastic.co/u/qhlHelo)\ **Replies:** 3\ **Last updated:** [November 29, 2016, 8:20pm UTC](https://discuss.elastic.co/t/how-to-identify-different-ip-address-of-different-hosts-with-metricbeat/67301 "2016-11-29T20:20:51Z")
I am using metricbeat to collect system metrics of linux and windows, just like the useage of cpu,memory and so on. Metricbeat currently only recognizes different hostnames of different hosts but I want to identify the s… --- ## [Handling cookies in HTTP parser](https://discuss.elastic.co/t/handling-cookies-in-http-parser/67335)
**Author:** [@PinXo](https://discuss.elastic.co/u/PinXo)\ **Replies:** 2\ **Last updated:** [November 29, 2016, 8:15pm UTC](https://discuss.elastic.co/t/handling-cookies-in-http-parser/67335 "2016-11-29T20:15:49Z")
There are several errors parsing Cookies in HTTP protocol. 1. If split\_cookies is enabled, all the other request headers are lost. 2. If a response has two or more cookies, the json is not correctly composed. This cou… --- ## [Metricbeat: Apache 2.4.23 field not found errors](https://discuss.elastic.co/t/metricbeat-apache-2-4-23-field-not-found-errors/67518)
**Author:** [@profiler](https://discuss.elastic.co/u/profiler)\ **Replies:** 3\ **Last updated:** [November 29, 2016, 5:06pm UTC](https://discuss.elastic.co/t/metricbeat-apache-2-4-23-field-not-found-errors/67518 "2016-11-29T17:06:26Z")
Hi there... I'm getting: metricbeat\[6664\]: schema.go:36: Error on field 'total': Key ConnsTotal not found metricbeat\[6664\]: schema.go:36: Error on field 'closing': Key ConnsAsyncClosing not found metricbeat\[6664\]: sc… --- ## [Load test log stash through file beat](https://discuss.elastic.co/t/load-test-log-stash-through-file-beat/50483)
**Author:** [@kasi](https://discuss.elastic.co/u/kasi)\ **Replies:** 4\ **Last updated:** [November 29, 2016, 2:22pm UTC](https://discuss.elastic.co/t/load-test-log-stash-through-file-beat/50483 "2016-11-29T14:22:39Z")
I would like to stress test our logstash environment, through filebeat, the idea is to generate log files with different sizes intervals and call filebeat programmatically to send logs to log stash, any ideas? How peop… --- ## [How to setup Kafka output in Filebeat](https://discuss.elastic.co/t/how-to-setup-kafka-output-in-filebeat/67154)
**Author:** [@elasticheart](https://discuss.elastic.co/u/elasticheart)\ **Replies:** 2\ **Last updated:** [November 29, 2016, 5:14am UTC](https://discuss.elastic.co/t/how-to-setup-kafka-output-in-filebeat/67154 "2016-11-29T05:14:07Z")
Hi, I have the following Filebeat configuration; output.kafka: enabled: true hosts: \["192.168.0.1:\"\] topic: testtopic What port should I provide here? I am entirely new to Kafka. I have Kafka installed a… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=550) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=552)