# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=554 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 555 --- ## [Redis INFO MetricSet should provide commandstats](https://discuss.elastic.co/t/redis-info-metricset-should-provide-commandstats/66125)
**Author:** [@SpoYler](https://discuss.elastic.co/u/SpoYler)\ **Replies:** 2\ **Last updated:** [November 15, 2016, 3:08pm UTC](https://discuss.elastic.co/t/redis-info-metricset-should-provide-commandstats/66125 "2016-11-15T15:08:06Z")
Hy, I'm looking for a good way to collecte redis stats. Packetbeat provide command's stats and metricbeat the redis-cli info. Have INFO ALL in metricbeat instead of INFO could make the job and let metricbeat alone … --- ## [Error publishing events (retrying): EOF](https://discuss.elastic.co/t/error-publishing-events-retrying-eof/65378)
**Author:** [@zoram](https://discuss.elastic.co/u/zoram)\ **Replies:** 4\ **Last updated:** [November 15, 2016, 11:44am UTC](https://discuss.elastic.co/t/error-publishing-events-retrying-eof/65378 "2016-11-15T11:44:26Z")
Dear All, File beat is not sending events to logstash after starting my this command. sudo ./filebeat -e -c filebeat-logstash.yml -d "publish" It thrown an error messages.. single.go:77: INFO Error publishing even… --- ## [onDropConnection](https://discuss.elastic.co/t/ondropconnection/66011)
**Author:** [@lonangel](https://discuss.elastic.co/u/lonangel)\ **Replies:** 2\ **Last updated:** [November 15, 2016, 11:21am UTC](https://discuss.elastic.co/t/ondropconnection/66011 "2016-11-15T11:21:02Z")
Hi, I'm trying to implement a protocol using the generator and I have some doubts about how the onDropConnection function works. What I'm trying to achieve is, even if I don't get a response back, I want to publish the t… --- ## [Log Rotation with two events depending on each other](https://discuss.elastic.co/t/log-rotation-with-two-events-depending-on-each-other/65645)
**Author:** [@guenther](https://discuss.elastic.co/u/guenther)\ **Replies:** 10\ **Last updated:** [November 15, 2016, 10:44am UTC](https://discuss.elastic.co/t/log-rotation-with-two-events-depending-on-each-other/65645 "2016-11-15T10:44:27Z")
Hi everybody, I have got a problem with file rotation and logging messages that depends on each other. Here my case: Usually events are written to the logfile in the correct order: my.log {id: "1", status: "Run… --- ## [Beats output to AWS Elasticsearch](https://discuss.elastic.co/t/beats-output-to-aws-elasticsearch/65985)
**Author:** [@lpetre](https://discuss.elastic.co/u/lpetre)\ **Replies:** 1\ **Last updated:** [November 15, 2016, 8:19am UTC](https://discuss.elastic.co/t/beats-output-to-aws-elasticsearch/65985 "2016-11-15T08:19:09Z")
We'd like to setup our beat to output to the AWS Elasticsearch offering. The ideal way to do this is to sign the HTTP request with the AWS credentials. I'm trying to figure out the best way to implement this in the beats… --- ## [ERR Connecting error publishing events (retrying): dial tcp {remote.logstash.host.ip}:5044: getsockopt: no route to host](https://discuss.elastic.co/t/err-connecting-error-publishing-events-retrying-dial-tcp-remote-logstash-host-ip-5044-getsockopt-no-route-to-host/66030)
**Author:** [@Sergey\_Grigorov](https://discuss.elastic.co/u/Sergey_Grigorov)\ **Replies:** 1\ **Last updated:** [November 15, 2016, 8:13am UTC](https://discuss.elastic.co/t/err-connecting-error-publishing-events-retrying-dial-tcp-remote-logstash-host-ip-5044-getsockopt-no-route-to-host/66030 "2016-11-15T08:13:14Z")
Hi there! I'm trying to send logs with filebeat to remote logstash host but receive the error on each attempt of filebeat to push to remote logstash host. Both hosts are running on linux. The logstash is up on remote h… --- ## [Monitoring metricbeat shippers](https://discuss.elastic.co/t/monitoring-metricbeat-shippers/66014)
**Author:** [@Balaram](https://discuss.elastic.co/u/Balaram)\ **Replies:** 2\ **Last updated:** [November 14, 2016, 9:00pm UTC](https://discuss.elastic.co/t/monitoring-metricbeat-shippers/66014 "2016-11-14T21:00:18Z")
Hello, I wanted to monitor all my metricbeat shippers using Monitor module (X-Pack) in Kibana. Is it possible ? If yes, could someone explain how can I achieve this? your inputs are highly appreciated. Thanks Balaram … --- ## [Error while sending mongodb.status on mac os 10.11 using metricbeat 5.0](https://discuss.elastic.co/t/error-while-sending-mongodb-status-on-mac-os-10-11-using-metricbeat-5-0/65713)
**Author:** [@Zhomart](https://discuss.elastic.co/u/Zhomart)\ **Replies:** 4\ **Last updated:** [November 14, 2016, 3:14pm UTC](https://discuss.elastic.co/t/error-while-sending-mongodb-status-on-mac-os-10-11-using-metricbeat-5-0/65713 "2016-11-14T15:14:30Z")
I followed https://www.elastic.co/guide/en/beats/metricbeat/current/metricbeat-module-mongodb.html doc, still getting error. What could be the problem? Configuration and output is here --- ## [Winlogbeat @timestamp Field Problem](https://discuss.elastic.co/t/winlogbeat-timestamp-field-problem/65383)
**Author:** [@leantw1ce](https://discuss.elastic.co/u/leantw1ce)\ **Replies:** 1\ **Last updated:** [November 14, 2016, 2:09pm UTC](https://discuss.elastic.co/t/winlogbeat-timestamp-field-problem/65383 "2016-11-14T14:09:54Z")
Hi, first of all my english is not good enough so sorry about that. I have ELK on an Ubuntu server. Logstash version is 2.3.4, Elastichsearch 1.7.3, and Kibana 4.1.2. I could successfully obtain logs of another Ubuntu se… --- ## [Xgo-deb6-base docker image doesn't build on linux kernel 4.8.0](https://discuss.elastic.co/t/xgo-deb6-base-docker-image-doesnt-build-on-linux-kernel-4-8-0/65805)
**Author:** [@raboof](https://discuss.elastic.co/u/raboof)\ **Replies:** 1\ **Last updated:** [November 14, 2016, 1:15pm UTC](https://discuss.elastic.co/t/xgo-deb6-base-docker-image-doesnt-build-on-linux-kernel-4-8-0/65805 "2016-11-14T13:15:34Z")
When trying to package a beat, the xgo-image-deb6 docker images are built from dev-tools/packer/docker/xgo-image-deb6. Unfortunately this currently doesn't appear to work: ➜ xgo-image-deb6 git:(master) ✗ docker bui… --- ## [Beat name from file](https://discuss.elastic.co/t/beat-name-from-file/65707)
**Author:** [@lendoly](https://discuss.elastic.co/u/lendoly)\ **Replies:** 6\ **Last updated:** [November 14, 2016, 1:14pm UTC](https://discuss.elastic.co/t/beat-name-from-file/65707 "2016-11-14T13:14:44Z")
Hello to all, I already see that is possible to configure the beat name with Environment Variables, but I want to know if is possible to configure the beat name from a file. Explanation: I have 2 machines running on … --- ## [Filebeat keeps open files](https://discuss.elastic.co/t/filebeat-keeps-open-files/65817)
**Author:** [@Pablo\_Andres\_Santama](https://discuss.elastic.co/u/Pablo_Andres_Santama)\ **Replies:** 1\ **Last updated:** [November 11, 2016, 6:11pm UTC](https://discuss.elastic.co/t/filebeat-keeps-open-files/65817 "2016-11-11T18:11:22Z")
Morning I have this version of filebeat filebeat version 1.2.3 (amd64) this keeps open files and full disk I configure close\_older like this: close\_older: 5m but the problem is present again. --- ## [Grok not able to parse log data](https://discuss.elastic.co/t/grok-not-able-to-parse-log-data/65768)
**Author:** [@Aditya\_Srivastava](https://discuss.elastic.co/u/Aditya_Srivastava)\ **Replies:** 3\ **Last updated:** [November 11, 2016, 12:44pm UTC](https://discuss.elastic.co/t/grok-not-able-to-parse-log-data/65768 "2016-11-11T12:44:21Z")
I want to write a grok in logstash filter Input string is {"@timestamp":"2016-11-11T13:16:20.447Z","beat":{"hostname":"ip-1-2-3-4","name":"ip-1-2-3-4","version":"5.0.0"},"input\_type":"log","message":"Nov 11 13:17:23 ip… --- ## [Beat not creating index on start](https://discuss.elastic.co/t/beat-not-creating-index-on-start/65696)
**Author:** [@tostasqb](https://discuss.elastic.co/u/tostasqb)\ **Replies:** 4\ **Last updated:** [November 11, 2016, 12:34pm UTC](https://discuss.elastic.co/t/beat-not-creating-index-on-start/65696 "2016-11-11T12:34:26Z")
Just started using Beats and Version 5. After installing filebeat and metricbeat on my mac, when starting either one I'm getting the following systematic error: 2016/11/10 15:50:37.490503 client.go:420: WARN Can not … --- ## [Topbeat monitor specific java process](https://discuss.elastic.co/t/topbeat-monitor-specific-java-process/65594)
**Author:** [@mrunalgosar](https://discuss.elastic.co/u/mrunalgosar)\ **Replies:** 3\ **Last updated:** [November 11, 2016, 12:03pm UTC](https://discuss.elastic.co/t/topbeat-monitor-specific-java-process/65594 "2016-11-11T12:03:35Z")
Hi I would like to use topbeat to monitor certain specific java processes. For example: If i set procs: \["java"\] Then it is showing me all the processes running as java. But in my use case on that server there are mu… --- ## [Not getting all mntr fields from Zookeeper module](https://discuss.elastic.co/t/not-getting-all-mntr-fields-from-zookeeper-module/65779)
**Author:** [@elasticheart](https://discuss.elastic.co/u/elasticheart)\ **Replies:** 1\ **Last updated:** [November 11, 2016, 11:52am UTC](https://discuss.elastic.co/t/not-getting-all-mntr-fields-from-zookeeper-module/65779 "2016-11-11T11:52:47Z")
Hi, I am using Zookeeper module of Metricbeat to monitor my Kafka Zookeeper. I have made settings as per this guide https://www.elastic.co/guide/en/beats/metricbeat/current/metricbeat-module-zookeeper.html and its work… --- ## [Collectd agent ethstat error](https://discuss.elastic.co/t/collectd-agent-ethstat-error/65501)
**Author:** [@Kernel\_Panic](https://discuss.elastic.co/u/Kernel_Panic)\ **Replies:** 5\ **Last updated:** [November 11, 2016, 9:58am UTC](https://discuss.elastic.co/t/collectd-agent-ethstat-error/65501 "2016-11-11T09:58:51Z")
Hi there guys, Do not know if I should ask this question in here or in the docker forum, please advice. I'm trying to gather stats from a container iface and I get this error: \[error\] ethstat plugin: Reading statist… --- ## [How to create template for burrowbeat template file?](https://discuss.elastic.co/t/how-to-create-template-for-burrowbeat-template-file/65749)
**Author:** [@elasticheart](https://discuss.elastic.co/u/elasticheart)\ **Replies:** 0\ **Last updated:** [November 11, 2016, 4:41am UTC](https://discuss.elastic.co/t/how-to-create-template-for-burrowbeat-template-file/65749 "2016-11-11T04:41:15Z")
Hi, I have downloaded burrowbeat from https://github.com/Goomzee/burrowbeat and I built it. But it requires a template json file https://github.com/Goomzee/burrowbeat/blob/master/burrowbeat.template.json , which is emp… --- ## [ERR File is falling under ignore\_older before harvesting is finished. Adjust your close\_\* settings: api\_1.log](https://discuss.elastic.co/t/err-file-is-falling-under-ignore-older-before-harvesting-is-finished-adjust-your-close--settings-api-1-log/65495)
**Author:** [@agonzalez](https://discuss.elastic.co/u/agonzalez)\ **Replies:** 2\ **Last updated:** [November 10, 2016, 10:30pm UTC](https://discuss.elastic.co/t/err-file-is-falling-under-ignore-older-before-harvesting-is-finished-adjust-your-close--settings-api-1-log/65495 "2016-11-10T22:30:21Z")
I am using filebeat 5.0 I am getting these error on filebeat log: 2016-11-09T14:17:32+01:00 ERR Failed to publish events caused by: read tcp 192.168.11.21:42549-\>: read: connection reset by peer 2016-11-09T14:17:32+0… --- ## [What is "lock-step" in load balancing mode?](https://discuss.elastic.co/t/what-is-lock-step-in-load-balancing-mode/65602)
**Author:** [@YuWatanabe](https://discuss.elastic.co/u/YuWatanabe)\ **Replies:** 2\ **Last updated:** [November 10, 2016, 6:14pm UTC](https://discuss.elastic.co/t/what-is-lock-step-in-load-balancing-mode/65602 "2016-11-10T18:14:09Z")
I am setting up load balancing configuration referencing the document I found lock step mode but due to lack of my knowledge , I dont understand what this do. I have tested comparing with the regular mode by sending … --- ## [\[UNSUPPORTED\] Extract fields from syslog messages](https://discuss.elastic.co/t/unsupported-extract-fields-from-syslog-messages/65402)
**Author:** [@Andrrrey](https://discuss.elastic.co/u/Andrrrey)\ **Replies:** 4\ **Last updated:** [November 10, 2016, 2:43pm UTC](https://discuss.elastic.co/t/unsupported-extract-fields-from-syslog-messages/65402 "2016-11-10T14:43:22Z")
There was similar question about JSON messages before... Setup: txt file--------\> filebeat----------\>elasticsearch File has syslog formatted and not formatted messages from different devices (sometimes format diffe… --- ## [Java stack traces in example at elastic dosn't work Multiline java type log](https://discuss.elastic.co/t/java-stack-traces-in-example-at-elastic-dosnt-work-multiline-java-type-log/65598)
**Author:** [@alex88](https://discuss.elastic.co/u/alex88)\ **Replies:** 5\ **Last updated:** [November 10, 2016, 1:17pm UTC](https://discuss.elastic.co/t/java-stack-traces-in-example-at-elastic-dosnt-work-multiline-java-type-log/65598 "2016-11-10T13:17:54Z")
I have log: 2016-11-10 06:52:09.868+0000 ERROR The RuntimeException could not be mapped to a response java.lang.ArrayIndexOutOfBoundsException: 1 at org.neo4j.server.rest.repr.formats.UrlFormFormat.rea… --- ## [Filebeat unable to send data](https://discuss.elastic.co/t/filebeat-unable-to-send-data/65656)
**Author:** [@kunalpatil3017](https://discuss.elastic.co/u/kunalpatil3017)\ **Replies:** 1\ **Last updated:** [November 10, 2016, 1:14pm UTC](https://discuss.elastic.co/t/filebeat-unable-to-send-data/65656 "2016-11-10T13:14:18Z")
Agent is unable to send data if i restarting the service it work ohk data is huge we are sending scalar query log to graylog server with help of beat agent data is approx 500,000 messages per 10 mins it is getting s… --- ## [Is "include\_lines" case sensitive?](https://discuss.elastic.co/t/is-include-lines-case-sensitive/65618)
**Author:** [@msr](https://discuss.elastic.co/u/msr)\ **Replies:** 2\ **Last updated:** [November 10, 2016, 1:13pm UTC](https://discuss.elastic.co/t/is-include-lines-case-sensitive/65618 "2016-11-10T13:13:37Z")
I have just installed ElasticStack 5.0 as a proof of concept and I am playing with the Filebeat config to only output the data I'm interested in. Are the "include\_lines" search strings case sensitive? I initially c… --- ## [Parsing JSON in JSON (docker logs)](https://discuss.elastic.co/t/parsing-json-in-json-docker-logs/65663)
**Author:** [@Jeff](https://discuss.elastic.co/u/Jeff)\ **Replies:** 1\ **Last updated:** [November 10, 2016, 1:12pm UTC](https://discuss.elastic.co/t/parsing-json-in-json-docker-logs/65663 "2016-11-10T13:12:05Z")
We are parsing docker logs using filebeat 5. We parse the JSON using the following options: json.message\_key: log json.keys\_under\_root: true json.add\_error\_key: true However, the log messages from the docker co… --- ## [ERR - Failed to publish events caused by: EOF](https://discuss.elastic.co/t/err-failed-to-publish-events-caused-by-eof/65563)
**Author:** [@agonzalez](https://discuss.elastic.co/u/agonzalez)\ **Replies:** 3\ **Last updated:** [November 10, 2016, 1:08pm UTC](https://discuss.elastic.co/t/err-failed-to-publish-events-caused-by-eof/65563 "2016-11-10T13:08:38Z")
filebeat 5.0. Filebeat stop sending logs and i get these errors. Restart doesnt work and same errors again. The only solution is to remove registry file and start again. 2016-11-09T20:52:21+01:00 INFO Non-zero metri… --- ## [Libbeat.kafka.published\_but\_not\_acked\_events](https://discuss.elastic.co/t/libbeat-kafka-published-but-not-acked-events/65446)
**Author:** [@Aditya\_Srivastava](https://discuss.elastic.co/u/Aditya_Srivastava)\ **Replies:** 4\ **Last updated:** [November 10, 2016, 12:54pm UTC](https://discuss.elastic.co/t/libbeat-kafka-published-but-not-acked-events/65446 "2016-11-10T12:54:19Z")
my filebeat config file: filebeat: prospectors: - paths: - /var/log/xyz.log document\_type: log fields: {log\_type: log1} - paths: - /var/log/abc.log document\_type: l… --- ## [EREG in input to apply in tags value](https://discuss.elastic.co/t/ereg-in-input-to-apply-in-tags-value/65328)
**Author:** [@mcortinas](https://discuss.elastic.co/u/mcortinas)\ **Replies:** 3\ **Last updated:** [November 10, 2016, 12:52pm UTC](https://discuss.elastic.co/t/ereg-in-input-to-apply-in-tags-value/65328 "2016-11-10T12:52:03Z")
Hi, I'm starting working with filebeat and I want add tag with the value of regular expression in path filebeat.prospectors: - paths: - /mnt/ssd/(.\*).log --\> EREG to obtain the application name tags: \[$app\]… --- ## [Packetbeat flows - start\_time vs last\_time](https://discuss.elastic.co/t/packetbeat-flows-start-time-vs-last-time/64904)
**Author:** [@sge1](https://discuss.elastic.co/u/sge1)\ **Replies:** 5\ **Last updated:** [November 10, 2016, 12:47pm UTC](https://discuss.elastic.co/t/packetbeat-flows-start-time-vs-last-time/64904 "2016-11-10T12:47:38Z")
Hi everyone, I am currently in the process of deploying Packetbeat to capture flow data of udp as well as tcp flows. Thereby, Packetbeat instances are running on the receiving side as well as the sending side of the ge… --- ## [FIlebeat Alpha latest version ERR Failed to publish events caused by: read tcp](https://discuss.elastic.co/t/filebeat-alpha-latest-version-err-failed-to-publish-events-caused-by-read-tcp/63930)
**Author:** [@Ravikumar\_G](https://discuss.elastic.co/u/Ravikumar_G)\ **Replies:** 14\ **Last updated:** [November 10, 2016, 12:45pm UTC](https://discuss.elastic.co/t/filebeat-alpha-latest-version-err-failed-to-publish-events-caused-by-read-tcp/63930 "2016-11-10T12:45:26Z")
filebeat can not publish events can some one advice me to proceed further fIlebeat.yml # Deleted actual paths in post filebeat: prospectors: - paths: - /var/log/t.log - /var/log/puppet/puppe… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=553) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=555)