# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=552 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 553 --- ## [Grok in filebeat?](https://discuss.elastic.co/t/grok-in-filebeat/66259)
**Author:** [@iamthealex](https://discuss.elastic.co/u/iamthealex)\ **Replies:** 7\ **Last updated:** [November 29, 2016, 4:21am UTC](https://discuss.elastic.co/t/grok-in-filebeat/66259 "2016-11-29T04:21:38Z")
I would love to try out filebeat as a replacement for my current use of LogStash. I like the idea of running a Go program instead of a JVM. Replacing my use of the "file" input plugin to use filebeat would be easy for … --- ## [Filebeat crashing repeatedly with out of error on first use](https://discuss.elastic.co/t/filebeat-crashing-repeatedly-with-out-of-error-on-first-use/67354)
**Author:** [@RicharddeJong](https://discuss.elastic.co/u/RicharddeJong)\ **Replies:** 4\ **Last updated:** [November 28, 2016, 11:14pm UTC](https://discuss.elastic.co/t/filebeat-crashing-repeatedly-with-out-of-error-on-first-use/67354 "2016-11-28T23:14:00Z")
Hi, I have a fresh ELK stack based on the containers from Elastic. I am using Filebeat to send logs to it. I have Filebeat monitor all files in /var/log. When it first tries to read all those files and send them to Lo… --- ## [\[filebeat\] no registry updates and high memory usage after changing tail\_files from true to false](https://discuss.elastic.co/t/filebeat-no-registry-updates-and-high-memory-usage-after-changing-tail-files-from-true-to-false/66908)
**Author:** [@shog](https://discuss.elastic.co/u/shog)\ **Replies:** 10\ **Last updated:** [November 28, 2016, 11:07pm UTC](https://discuss.elastic.co/t/filebeat-no-registry-updates-and-high-memory-usage-after-changing-tail-files-from-true-to-false/66908 "2016-11-28T23:07:12Z")
Unfortunately I've noticed yet another problem with registry file updates in my setup: Filebeat Version: 5.0.1 Steps to repro: 1) Start filebeat with tail\_files: true to get initial state of files. tail\_files: … --- ## [Metricbeat system.cpu vs system.core](https://discuss.elastic.co/t/metricbeat-system-cpu-vs-system-core/67388)
**Author:** [@bhoskins7](https://discuss.elastic.co/u/bhoskins7)\ **Replies:** 1\ **Last updated:** [November 28, 2016, 9:15pm UTC](https://discuss.elastic.co/t/metricbeat-system-cpu-vs-system-core/67388 "2016-11-28T21:15:42Z")
I am creating Kibana Visualilzations from metricbeat. I was looking at system.cpu fields and system.core fields but these two look very similar other than core includes the core.id can someone tell me the difference be… --- ## [How to calculate each IP address count,avg requests per day,bit size,byte size in packet beats](https://discuss.elastic.co/t/how-to-calculate-each-ip-address-count-avg-requests-per-day-bit-size-byte-size-in-packet-beats/67068)
**Author:** [@Gurram\_Vinay](https://discuss.elastic.co/u/Gurram_Vinay)\ **Replies:** 4\ **Last updated:** [November 28, 2016, 5:03pm UTC](https://discuss.elastic.co/t/how-to-calculate-each-ip-address-count-avg-requests-per-day-bit-size-byte-size-in-packet-beats/67068 "2016-11-28T17:03:47Z")
Hello everyone, Packet beats are really awesome, but I don't know how to calculate each IP address count per day,Avg requests per day,bit size,byte size with respect to IP in packet beats ? --- ## [Packetbeat on MIPS](https://discuss.elastic.co/t/packetbeat-on-mips/66997)
**Author:** [@tetsuto](https://discuss.elastic.co/u/tetsuto)\ **Replies:** 5\ **Last updated:** [November 28, 2016, 3:20pm UTC](https://discuss.elastic.co/t/packetbeat-on-mips/66997 "2016-11-28T15:20:03Z")
Hi, I'm trying to get Packetbeat up and running on a MIPS device (and open-wrt router). Just wondering if anyone had managed to cross compile to mips before? It would seem that go does crosscompile to MIPs as does li… --- ## [Filebeat with Redis or just logstash?](https://discuss.elastic.co/t/filebeat-with-redis-or-just-logstash/66270)
**Author:** [@xon](https://discuss.elastic.co/u/xon)\ **Replies:** 6\ **Last updated:** [November 28, 2016, 2:57pm UTC](https://discuss.elastic.co/t/filebeat-with-redis-or-just-logstash/66270 "2016-11-28T14:57:50Z")
Hi there, I am planning to deploy filebeat (and some other beats such as the winlogbeat and maybe the packetbeat) with logstash and elasticsearch and I was thinking that it would make sense to have a queuing system so … --- ## [Topbeat to Elasticsearch - connection refused](https://discuss.elastic.co/t/topbeat-to-elasticsearch-connection-refused/67336)
**Author:** [@txisme](https://discuss.elastic.co/u/txisme)\ **Replies:** 3\ **Last updated:** [November 28, 2016, 2:27pm UTC](https://discuss.elastic.co/t/topbeat-to-elasticsearch-connection-refused/67336 "2016-11-28T14:27:25Z")
Hey, i have the following setup: (machine1) -\> (machine2) (Filebeat) -\> (Logstash-\>ElasticSearch) (Topbeat) -\> (ElasticSearch) Filebeat, logstash, elasticsearch setup is working fine. However, topbeat is not workin… --- ## [Error publishing events (EOF, broken pipe, i/o timeout, connection reset)](https://discuss.elastic.co/t/error-publishing-events-eof-broken-pipe-i-o-timeout-connection-reset/67005)
**Author:** [@knobli](https://discuss.elastic.co/u/knobli)\ **Replies:** 6\ **Last updated:** [November 28, 2016, 2:21pm UTC](https://discuss.elastic.co/t/error-publishing-events-eof-broken-pipe-i-o-timeout-connection-reset/67005 "2016-11-28T14:21:52Z")
Filebeat can't publish the data to logstash if there is a lot of traffic (~ 100-150 lines per second). I read a lot about discussions about the "Error publishing events" but nothing really matches my case. In the logstas… --- ## [Viewing Disk information per Metric Beat client](https://discuss.elastic.co/t/viewing-disk-information-per-metric-beat-client/67160)
**Author:** [@abhimanyunagrath](https://discuss.elastic.co/u/abhimanyunagrath)\ **Replies:** 1\ **Last updated:** [November 28, 2016, 8:50am UTC](https://discuss.elastic.co/t/viewing-disk-information-per-metric-beat-client/67160 "2016-11-28T08:50:21Z")
Hi , I have a Kibana and Elastic search installed on a server. and I have two metric beats running on two different clients now when I am going to Kibana and loading default metric beat template .On clicking File per h… --- ## [Missing metricset data in Metricbeat](https://discuss.elastic.co/t/missing-metricset-data-in-metricbeat/67203)
**Author:** [@markd](https://discuss.elastic.co/u/markd)\ **Replies:** 2\ **Last updated:** [November 25, 2016, 9:43pm UTC](https://discuss.elastic.co/t/missing-metricset-data-in-metricbeat/67203 "2016-11-25T21:43:21Z")
This is my metricbeat configuration file: metricbeat.modules: - module: system metricsets: - cpu - load - core - diskio - filesystem - fsstat - memory - network - process… --- ## [Filebeat locks file when logstash is not runnig](https://discuss.elastic.co/t/filebeat-locks-file-when-logstash-is-not-runnig/66719)
**Author:** [@eluppol](https://discuss.elastic.co/u/eluppol)\ **Replies:** 11\ **Last updated:** [November 25, 2016, 10:24am UTC](https://discuss.elastic.co/t/filebeat-locks-file-when-logstash-is-not-runnig/66719 "2016-11-25T10:24:27Z")
I'm using filebeat to ship logs created by log4cxx to ELK stack. When filebeat is running but logstash is not available, log4cxx cannot rotate log file, so it becomes large (log generation speed is about 4 MB per minute,… --- ## [Check file for harvesting: /var/log/syslog.log error again, Filebeat 5.0](https://discuss.elastic.co/t/check-file-for-harvesting-var-log-syslog-log-error-again-filebeat-5-0/66360)
**Author:** [@ndarkness](https://discuss.elastic.co/u/ndarkness)\ **Replies:** 11\ **Last updated:** [November 25, 2016, 10:16am UTC](https://discuss.elastic.co/t/check-file-for-harvesting-var-log-syslog-log-error-again-filebeat-5-0/66360 "2016-11-25T10:16:21Z")
Hello, I am having issues when restarting filebeat 5.0 , since it doesn't seem to see my syslog changes... My config is this lo@lo-VirtualBox:/etc/filebeat$ cat filebeat.yml filebeat.prospectors: - input\_type: log… --- ## [Filebeat connection error](https://discuss.elastic.co/t/filebeat-connection-error/67103)
**Author:** [@txisme](https://discuss.elastic.co/u/txisme)\ **Replies:** 3\ **Last updated:** [November 25, 2016, 10:10am UTC](https://discuss.elastic.co/t/filebeat-connection-error/67103 "2016-11-25T10:10:45Z")
Hey, using filebeat 5.0 for the first time. Using filebeat.yml that i used for version 2.4 but it s not working filebeatlog: 2016-11-24T11:24:40Z INFO Starting prospector of type: log 2016-11-24T11:24:40Z INFO Sta… --- ## [How to reduce / group repeating prospector configs](https://discuss.elastic.co/t/how-to-reduce-group-repeating-prospector-configs/67100)
**Author:** [@elasticheart](https://discuss.elastic.co/u/elasticheart)\ **Replies:** 1\ **Last updated:** [November 25, 2016, 10:08am UTC](https://discuss.elastic.co/t/how-to-reduce-group-repeating-prospector-configs/67100 "2016-11-25T10:08:43Z")
Hi, I have a filebeat config like below; filebeat.prospectors: - input\_type: log paths: - /logfolder/qwerty.txt include\_lines: \['^\[\[:digit:\]\]{4}'\] fields: logtype: log1 document\_type: logfile scan\_… --- ## [Packetbeat invalid\_index\_name](https://discuss.elastic.co/t/packetbeat-invalid-index-name/67152)
**Author:** [@james777](https://discuss.elastic.co/u/james777)\ **Replies:** 3\ **Last updated:** [November 25, 2016, 7:40am UTC](https://discuss.elastic.co/t/packetbeat-invalid-index-name/67152 "2016-11-25T07:40:55Z")
Hi, I am trying to run packetbeat 5.0.1 in centos 6, while running I am getting the below error log 2016-11-25T13:20:01+09:00 WARN Can not index event (status=400): {"type":"invalid\_index\_name\_exception","reason":"Invali… --- ## [How to omit filebeat fields such as source file path?](https://discuss.elastic.co/t/how-to-omit-filebeat-fields-such-as-source-file-path/66977)
**Author:** [@Oozza](https://discuss.elastic.co/u/Oozza)\ **Replies:** 2\ **Last updated:** [November 24, 2016, 7:13am UTC](https://discuss.elastic.co/t/how-to-omit-filebeat-fields-such-as-source-file-path/66977 "2016-11-24T07:13:41Z")
Hi, Can filebeat be configured to don't ship it's own fields such as beat.name, beat.version, source, offset? I have found older topic asking this thing here: https://discuss.elastic.co/t/simplifying-filebeat-json-outp… --- ## [Filebeat : Badly Stuck with Connection reset by peer error](https://discuss.elastic.co/t/filebeat-badly-stuck-with-connection-reset-by-peer-error/66878)
**Author:** [@jashwanth](https://discuss.elastic.co/u/jashwanth)\ **Replies:** 14\ **Last updated:** [November 23, 2016, 11:58pm UTC](https://discuss.elastic.co/t/filebeat-badly-stuck-with-connection-reset-by-peer-error/66878 "2016-11-23T23:58:12Z")
Hi, I'm badly stuck with connection reset by peer error even though all tcp ports are opened. Can anyone guide me here. 2016-11-22T13:32:39Z INFO Error publishing events (retrying): read tcp 10.3.2.20:35816-\>10.3.1.13:… --- ## [Pingbeat: you know, for pings](https://discuss.elastic.co/t/pingbeat-you-know-for-pings/28298)
**Author:** [@Joshua\_Rich](https://discuss.elastic.co/u/Joshua_Rich)\ **Replies:** 6\ **Last updated:** [November 23, 2016, 11:21pm UTC](https://discuss.elastic.co/t/pingbeat-you-know-for-pings/28298 "2016-11-23T23:21:44Z")
Hi all, I've created a new project, pingbeat that sends sends ICMP pings to a list of targets and stores the round trip time (RTT) in Elasticsearch (or elsewhere). It uses tatsushid/go-fastping for sending/recieving pi… --- ## [Close\_removed behavior](https://discuss.elastic.co/t/close-removed-behavior/66894)
**Author:** [@jigsaw1079](https://discuss.elastic.co/u/jigsaw1079)\ **Replies:** 3\ **Last updated:** [November 23, 2016, 2:28pm UTC](https://discuss.elastic.co/t/close-removed-behavior/66894 "2016-11-23T14:28:35Z")
Hi All, I am new to filebeat. Recently I had a scenario that one of the log files was deleted, I could not see it using ls, but the disk space by this file was not released. After I reset filebeat, then disk space was re… --- ## [Log entries gets truncated on file rotation](https://discuss.elastic.co/t/log-entries-gets-truncated-on-file-rotation/66725)
**Author:** [@dr\_rock](https://discuss.elastic.co/u/dr_rock)\ **Replies:** 9\ **Last updated:** [November 23, 2016, 10:56am UTC](https://discuss.elastic.co/t/log-entries-gets-truncated-on-file-rotation/66725 "2016-11-23T10:56:47Z")
Hi there, We are using Filebeat 5.0.0 to parse log files. Log rotate on a daily basis (we are using Log4J's DailyRollingFileAppender to produce our log files). Log rotates every day at 00:00 and we get a truncated event… --- ## [Packetbeat not running](https://discuss.elastic.co/t/packetbeat-not-running/66953)
**Author:** [@kumar21000](https://discuss.elastic.co/u/kumar21000)\ **Replies:** 1\ **Last updated:** [November 23, 2016, 10:01am UTC](https://discuss.elastic.co/t/packetbeat-not-running/66953 "2016-11-23T10:01:16Z")
I am trying to run packetbeat in centos 7, while running I am getting the below error \[root@packetbeat\]# cat /var/log/packetbeat/packetbeat 2016-11-23T11:50:50+04:00 INFO Setup Beat: packetbeat; Version: 5.0.1 2016-11-… --- ## [File template overriding not working](https://discuss.elastic.co/t/file-template-overriding-not-working/66957)
**Author:** [@kozdincer](https://discuss.elastic.co/u/kozdincer)\ **Replies:** 1\ **Last updated:** [November 23, 2016, 9:15am UTC](https://discuss.elastic.co/t/file-template-overriding-not-working/66957 "2016-11-23T09:15:21Z")
Hi, I 've change default filebeat-template to make "message" property type as "object". But not shown as "object" in index. Shown as default "string". Log says; "2016/11/21 15:43:30.532659 output.go:164: INFO Loading… --- ## [Repackaging beats .deb files - service won't start](https://discuss.elastic.co/t/repackaging-beats-deb-files-service-wont-start/37898)
**Author:** [@ceekay](https://discuss.elastic.co/u/ceekay)\ **Replies:** 19\ **Last updated:** [November 23, 2016, 1:33am UTC](https://discuss.elastic.co/t/repackaging-beats-deb-files-service-wont-start/37898 "2016-11-23T01:33:40Z")
Hi all, I've extracted and repackaged the official .deb files for filebeat, packetbeat, and topbeat, so I can include my own configs and certs and deploy via puppet. I've also added my own postinst and prerm files to up… --- ## [Kibana complaining that "metricbeat-\*" is not indexed](https://discuss.elastic.co/t/kibana-complaining-that-metricbeat-is-not-indexed/66783)
**Author:** [@walterfore](https://discuss.elastic.co/u/walterfore)\ **Replies:** 13\ **Last updated:** [November 22, 2016, 10:43pm UTC](https://discuss.elastic.co/t/kibana-complaining-that-metricbeat-is-not-indexed/66783 "2016-11-22T22:43:02Z")
Hi - although I have created an index manually called metricbeat, when I try to bring up any visualizations associated with metricbeat or perform a discovery on metricbeat-\* I received the following error in Kibana (4.4.… --- ## [Filebeat - ERR Failed to publish events caused by: EOF](https://discuss.elastic.co/t/filebeat-err-failed-to-publish-events-caused-by-eof/65105)
**Author:** [@alexus](https://discuss.elastic.co/u/alexus)\ **Replies:** 16\ **Last updated:** [November 22, 2016, 6:33pm UTC](https://discuss.elastic.co/t/filebeat-err-failed-to-publish-events-caused-by-eof/65105 "2016-11-22T18:33:58Z")
I'm using Elasticsearch, Logstash, Kibana (ELK) Docker image (elk-docker) @ following environment: # cat /etc/redhat-release CentOS Linux release 7.2.1511 (Core) # uname -a Linux X 3.10.0-327.36.3.el7.x86\_64 #1 SMP Mo… --- ## [Failed to parse \[system.filesystem.files\]: Numeric value (18446744073709551615) out of range of long](https://discuss.elastic.co/t/failed-to-parse-system-filesystem-files-numeric-value-18446744073709551615-out-of-range-of-long/66860)
**Author:** [@max0x7ba](https://discuss.elastic.co/u/max0x7ba)\ **Replies:** 4\ **Last updated:** [November 22, 2016, 4:28pm UTC](https://discuss.elastic.co/t/failed-to-parse-system-filesystem-files-numeric-value-18446744073709551615-out-of-range-of-long/66860 "2016-11-22T16:28:21Z")
Elasticsearch version: elasticsearch-5.0.0 metricbeat-5.0.1 Plugins installed: None JVM version: java version "1.8.0\_45" Java(TM) SE Runtime Environment (build 1.8.0\_45-b14) Java HotSpot(TM) 64-Bit Server VM (build 2… --- ## [Install winlogbeat.template.json](https://discuss.elastic.co/t/install-winlogbeat-template-json/65746)
**Author:** [@MSAdmin](https://discuss.elastic.co/u/MSAdmin)\ **Replies:** 3\ **Last updated:** [November 22, 2016, 4:28pm UTC](https://discuss.elastic.co/t/install-winlogbeat-template-json/65746 "2016-11-22T16:28:13Z")
I've been trying to setup monitoring for failed logins. I have winlogbeat running on my server and its feeding event logs over to my elastic server. When I loaded the JSON file (winlogbeat-account-usage-dashboard.json) f… --- ## [Filebeat 5.0 not processing files after restart](https://discuss.elastic.co/t/filebeat-5-0-not-processing-files-after-restart/65464)
**Author:** [@ori.rubinfeld](https://discuss.elastic.co/u/ori.rubinfeld)\ **Replies:** 21\ **Last updated:** [November 22, 2016, 4:03pm UTC](https://discuss.elastic.co/t/filebeat-5-0-not-processing-files-after-restart/65464 "2016-11-22T16:03:10Z")
Hi, I have Filebeat 5.0 (GA) installed on Windows machine. After doing a restart to Filebeat, it is not processing any log files. It has a registry and registry.old files. After deleting those files and restarting serv… --- ## [Log Rotation](https://discuss.elastic.co/t/log-rotation/66174)
**Author:** [@phil.ireland](https://discuss.elastic.co/u/phil.ireland)\ **Replies:** 2\ **Last updated:** [November 22, 2016, 3:07pm UTC](https://discuss.elastic.co/t/log-rotation/66174 "2016-11-22T15:07:26Z")
Is there a way in the beats config to rotate the log files. Running out of storage daily. [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=551) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=553)