# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=555 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 556 --- ## [Dynamic name in the path of filebeat](https://discuss.elastic.co/t/dynamic-name-in-the-path-of-filebeat/65600)
**Author:** [@Aditya\_Srivastava](https://discuss.elastic.co/u/Aditya_Srivastava)\ **Replies:** 1\ **Last updated:** [November 10, 2016, 11:58am UTC](https://discuss.elastic.co/t/dynamic-name-in-the-path-of-filebeat/65600 "2016-11-10T11:58:27Z")
I wanted to give dynamic name in the path section of filebeat ex. paths: - /var/log/ABC/{hostname}/\*.log can the hostname field be dynamic??? --- ## [Error while building Burrowbeat](https://discuss.elastic.co/t/error-while-building-burrowbeat/65647)
**Author:** [@elasticheart](https://discuss.elastic.co/u/elasticheart)\ **Replies:** 0\ **Last updated:** [November 10, 2016, 11:27am UTC](https://discuss.elastic.co/t/error-while-building-burrowbeat/65647 "2016-11-10T11:27:23Z")
Hi, I have downloaded Go lang 1.7 in my Linux machine and I am trying to build Burrowbeat as per this guide https://github.com/Goomzee/burrowbeat I have set ${GOPATH} using the command export GOPATH=/myfiles/gopath/ … --- ## [ERR Failed to publish events caused by: EOF](https://discuss.elastic.co/t/err-failed-to-publish-events-caused-by-eof/64518)
**Author:** [@Timothy](https://discuss.elastic.co/u/Timothy)\ **Replies:** 7\ **Last updated:** [November 10, 2016, 9:22am UTC](https://discuss.elastic.co/t/err-failed-to-publish-events-caused-by-eof/64518 "2016-11-10T09:22:13Z")
After reinstall all components, now the logs are written into ES by logstash, but the error message still exists. Not sure if it is safe to ignore it. ----------------- EDIT ----------------------- Hi, I am running ve… --- ## [Filebeat is not able to ship data after few scan cycles](https://discuss.elastic.co/t/filebeat-is-not-able-to-ship-data-after-few-scan-cycles/65227)
**Author:** [@Chaitra\_Kurdekar](https://discuss.elastic.co/u/Chaitra_Kurdekar)\ **Replies:** 3\ **Last updated:** [November 10, 2016, 8:59am UTC](https://discuss.elastic.co/t/filebeat-is-not-able-to-ship-data-after-few-scan-cycles/65227 "2016-11-10T08:59:08Z")
Hi, Issue 1) i have configured file beat (filebeat-5.0.0-rc1-linux-x86\_64) with elasticsearch (without logstash). Its observed after few scan cycles it is not able to ship the data from log files to elasticsearch engine. … --- ## [Interpolate list from environment variable in filebeats](https://discuss.elastic.co/t/interpolate-list-from-environment-variable-in-filebeats/65517)
**Author:** [@skade](https://discuss.elastic.co/u/skade)\ **Replies:** 2\ **Last updated:** [November 10, 2016, 8:39am UTC](https://discuss.elastic.co/t/interpolate-list-from-environment-variable-in-filebeats/65517 "2016-11-10T08:39:46Z")
Older Filebeat versions document a syntax for including a list of e.g. hosts from an environment variable into filebeat.yml. https://www.elastic.co/guide/en/beats/filebeat/1.2/using-environ-vars.html This feature see… --- ## [Windows service installation](https://discuss.elastic.co/t/windows-service-installation/49283)
**Author:** [@simonjefford](https://discuss.elastic.co/u/simonjefford)\ **Replies:** 3\ **Last updated:** [November 9, 2016, 3:26pm UTC](https://discuss.elastic.co/t/windows-service-installation/49283 "2016-11-09T15:26:25Z")
Would there be any interest in a patch to libbeats to allow beats to self install themselves as a Windows Service? My reasoning is two-fold: Removes the need to ship a Powershell script along with the binary. Instal… --- ## [Heavy Load due file beat service](https://discuss.elastic.co/t/heavy-load-due-file-beat-service/63571)
**Author:** [@kunalpatil3017](https://discuss.elastic.co/u/kunalpatil3017)\ **Replies:** 12\ **Last updated:** [November 9, 2016, 2:32pm UTC](https://discuss.elastic.co/t/heavy-load-due-file-beat-service/63571 "2016-11-09T14:32:02Z")
Hello Im using Filebeat service in my graylog server (Graylog-Sidecar collector) But Due to some reason it is consuming too much resources on my linux server load is not due to data read it is due to filebeat debug mo… --- ## [Error while importing metricbeat dashboard](https://discuss.elastic.co/t/error-while-importing-metricbeat-dashboard/65469)
**Author:** [@elasticheart](https://discuss.elastic.co/u/elasticheart)\ **Replies:** 1\ **Last updated:** [November 9, 2016, 11:00am UTC](https://discuss.elastic.co/t/error-while-importing-metricbeat-dashboard/65469 "2016-11-09T11:00:36Z")
Hi, I am trying to import dashboard for metricbeat offline using the command ./scripts/import\_dashboards -dir /files/beats-dashboards-5.0.0/metricbeat and I am getting the error; -bash-4.1$ ./import\_dashboards -di… --- ## [Issues with process monitoration](https://discuss.elastic.co/t/issues-with-process-monitoration/64287)
**Author:** [@poiati](https://discuss.elastic.co/u/poiati)\ **Replies:** 2\ **Last updated:** [November 8, 2016, 8:28pm UTC](https://discuss.elastic.co/t/issues-with-process-monitoration/64287 "2016-11-08T20:28:35Z")
Hello, I'm using Metricbeat to collect processes data. While aggregating to show the avg. memory usage per process for example I could use one of the properties bellow to split the data per row (terms): system.proce… --- ## [Not able to multiline this Log on the basis of timestamp pattern](https://discuss.elastic.co/t/not-able-to-multiline-this-log-on-the-basis-of-timestamp-pattern/64833)
**Author:** [@NITIN-BHAISARE](https://discuss.elastic.co/u/NITIN-BHAISARE)\ **Replies:** 8\ **Last updated:** [November 8, 2016, 5:11pm UTC](https://discuss.elastic.co/t/not-able-to-multiline-this-log-on-the-basis-of-timestamp-pattern/64833 "2016-11-08T17:11:19Z")
Greetings, I was trying to handle following kind of logs with multiline. I am not able to get all events starting from timestamp. Could somebody please help me in making a good multiline pattern to get all the stack tr… --- ## [Filebeat rc1 resends full data set data upon random restart (registry file not updated properly)?](https://discuss.elastic.co/t/filebeat-rc1-resends-full-data-set-data-upon-random-restart-registry-file-not-updated-properly/63580)
**Author:** [@shog](https://discuss.elastic.co/u/shog)\ **Replies:** 19\ **Last updated:** [November 8, 2016, 4:17pm UTC](https://discuss.elastic.co/t/filebeat-rc1-resends-full-data-set-data-upon-random-restart-registry-file-not-updated-properly/63580 "2016-11-08T16:17:43Z")
Hi, Recently I've reported https://discuss.elastic.co/t/filebeat-beta1-resends-random-data-upon-every-restart-registry-file-not-updated-properly/61813/1 where we didn't really reach a clear conclusion, but I was able … --- ## [Filebeat compile on OpenBSD 6.0](https://discuss.elastic.co/t/filebeat-compile-on-openbsd-6-0/65145)
**Author:** [@Gordo](https://discuss.elastic.co/u/Gordo)\ **Replies:** 6\ **Last updated:** [November 8, 2016, 1:06pm UTC](https://discuss.elastic.co/t/filebeat-compile-on-openbsd-6-0/65145 "2016-11-08T13:06:33Z")
I would like to run Filebeat 5.0 on an OpenBSD 6.0 server. The current version of Go on OpenBSD is 1.6 and it would appear that there is a dependency on the Go 1.7 (specifically, a failing context import error, related… --- ## [Filebeat error. Returns unicode character code instead of symbol](https://discuss.elastic.co/t/filebeat-error-returns-unicode-character-code-instead-of-symbol/64827)
**Author:** [@elasticheart](https://discuss.elastic.co/u/elasticheart)\ **Replies:** 4\ **Last updated:** [November 8, 2016, 8:12am UTC](https://discuss.elastic.co/t/filebeat-error-returns-unicode-character-code-instead-of-symbol/64827 "2016-11-08T08:12:02Z")
I have a multiline log file, in which entries are nested using xml like markup, inside \< and \> tags. I have defined multiline pattern and it works fine. It was working fine with filebeat 5.0.0 alpha. But in new 5.0 GA ve… --- ## [Metricbeat not showing in kibana](https://discuss.elastic.co/t/metricbeat-not-showing-in-kibana/65310)
**Author:** [@Elias\_Lim](https://discuss.elastic.co/u/Elias_Lim)\ **Replies:** 1\ **Last updated:** [November 8, 2016, 8:06am UTC](https://discuss.elastic.co/t/metricbeat-not-showing-in-kibana/65310 "2016-11-08T08:06:41Z")
Hello, I am using ELK ver 5.0 on a server and filebeat ver 5.0 on my client server, and want to use metricbeat ver 5.0. So I've installed and configured it accordingly. When i run status on metricbeat, it shows that it i… --- ## [How to install and use a community beat?](https://discuss.elastic.co/t/how-to-install-and-use-a-community-beat/65189)
**Author:** [@elasticheart](https://discuss.elastic.co/u/elasticheart)\ **Replies:** 3\ **Last updated:** [November 8, 2016, 7:32am UTC](https://discuss.elastic.co/t/how-to-install-and-use-a-community-beat/65189 "2016-11-08T07:32:52Z")
Hi, I would like to try elasticbeat available here https://github.com/radoondas/elasticbeat I have downloaded the zip package. I use ES in Linux. I have made changes in the elasticbeat.yml file. But there is no appli… --- ## [Extract elasticsearch "index" field from event field](https://discuss.elastic.co/t/extract-elasticsearch-index-field-from-event-field/64503)
**Author:** [@surajs](https://discuss.elastic.co/u/surajs)\ **Replies:** 8\ **Last updated:** [November 8, 2016, 1:34am UTC](https://discuss.elastic.co/t/extract-elasticsearch-index-field-from-event-field/64503 "2016-11-08T01:34:11Z")
In filebeat for Kafka output, we are able to dynamically select the topic-name using data from the an event field using something like %{\[type\]}. In a similar fashion, is it possible to dynamically select the index nam… --- ## [Filtering events by message contents / Custom Processor](https://discuss.elastic.co/t/filtering-events-by-message-contents-custom-processor/64795)
**Author:** [@jojo.pornebo](https://discuss.elastic.co/u/jojo.pornebo)\ **Replies:** 7\ **Last updated:** [November 7, 2016, 7:22pm UTC](https://discuss.elastic.co/t/filtering-events-by-message-contents-custom-processor/64795 "2016-11-07T19:22:53Z")
I'd like to ask for help on writing a processor configuration to do the following: filter on keyword from the event log message (example the application event log message has the word(s)/phrase - "forcibly closed")inc… --- ## [Monitor a set of JSON files in Filebeat](https://discuss.elastic.co/t/monitor-a-set-of-json-files-in-filebeat/65198)
**Author:** [@addy](https://discuss.elastic.co/u/addy)\ **Replies:** 1\ **Last updated:** [November 7, 2016, 4:53pm UTC](https://discuss.elastic.co/t/monitor-a-set-of-json-files-in-filebeat/65198 "2016-11-07T16:53:20Z")
I want to use Filebeat to monitor my JSON files to read and forward it to Logstash/ElasticSearch. In my use case, there are a set of JSON files created with a JSON object. After a period of time, the same set of files wi… --- ## [Filebeat Multiline log lines are not matching with logstash and kibana](https://discuss.elastic.co/t/filebeat-multiline-log-lines-are-not-matching-with-logstash-and-kibana/65018)
**Author:** [@selvamalar](https://discuss.elastic.co/u/selvamalar)\ **Replies:** 2\ **Last updated:** [November 7, 2016, 1:56pm UTC](https://discuss.elastic.co/t/filebeat-multiline-log-lines-are-not-matching-with-logstash-and-kibana/65018 "2016-11-07T13:56:10Z")
Hi I have Filebeat -\> Logstash -\> Kibana stack . Am using the multiline logs as i have my typical java logs generated in my application. While the File beat is receiving , it is a single log file having 10MB… --- ## [Filebeat EOF - And then succeeds at second try](https://discuss.elastic.co/t/filebeat-eof-and-then-succeeds-at-second-try/65015)
**Author:** [@Christian\_Norskov](https://discuss.elastic.co/u/Christian_Norskov)\ **Replies:** 1\ **Last updated:** [November 7, 2016, 1:46pm UTC](https://discuss.elastic.co/t/filebeat-eof-and-then-succeeds-at-second-try/65015 "2016-11-07T13:46:17Z")
Hello, I'm having some issues with filebeats and an error message. (Almost) everytime my filebeat instances tries to send data to logstash, the following logs are written. So it looks like it fails first try to send to … --- ## [\[SOLVED\] Multiline config online takes the first line](https://discuss.elastic.co/t/solved-multiline-config-online-takes-the-first-line/65187)
**Author:** [@Alban\_Lemaire](https://discuss.elastic.co/u/Alban_Lemaire)\ **Replies:** 1\ **Last updated:** [November 7, 2016, 10:26am UTC](https://discuss.elastic.co/t/solved-multiline-config-online-takes-the-first-line/65187 "2016-11-07T10:26:50Z")
Hello everyone, We moved from very old version of ELK stack to the 5.0 and the multiline config only takes the first one, even though the test on go playground seems OK. We parse OpenAS2 logs, where we added the tag \ **Author:** [@Rajat\_Singh](https://discuss.elastic.co/u/Rajat_Singh)\ **Replies:** 10\ **Last updated:** [November 7, 2016, 6:07am UTC](https://discuss.elastic.co/t/data-getting-duplicated-rsyncing-output-to-logstash-file-input/64886 "2016-11-07T06:07:18Z") i am pulling logs from remote server using rsync command in every 5 minutes and then feeding it to the logstash what is happening that it is just creating the duplicate logs of it --- ## [Winlogbeat and huge Windows Security Log](https://discuss.elastic.co/t/winlogbeat-and-huge-windows-security-log/64877)
**Author:** [@jameswatson3](https://discuss.elastic.co/u/jameswatson3)\ **Replies:** 2\ **Last updated:** [November 7, 2016, 1:53am UTC](https://discuss.elastic.co/t/winlogbeat-and-huge-windows-security-log/64877 "2016-11-07T01:53:34Z")
I'm on latest 5.0 Elastic version of Elastic/Logstash/Kibana/Beats and successfully using Winlogbeat to send multiple Windows server security logs to Logstash which outputs to Elasticsearch which are successfully viewabl… --- ## [Filebeats errors and 100% CPU with stand alone Kafka](https://discuss.elastic.co/t/filebeats-errors-and-100-cpu-with-stand-alone-kafka/64657)
**Author:** [@nelg](https://discuss.elastic.co/u/nelg)\ **Replies:** 4\ **Last updated:** [November 6, 2016, 10:24pm UTC](https://discuss.elastic.co/t/filebeats-errors-and-100-cpu-with-stand-alone-kafka/64657 "2016-11-06T22:24:28Z")
When filebeats is configured to output to kafka, and kafka + zookeeper are running stand alone (single server), Filebeats starts spewing errors because it can't figure out which kafka is the leader, because the topic ha… --- ## [Filebeat unable to connect to logstash](https://discuss.elastic.co/t/filebeat-unable-to-connect-to-logstash/65085)
**Author:** [@Elias\_Lim](https://discuss.elastic.co/u/Elias_Lim)\ **Replies:** 3\ **Last updated:** [November 5, 2016, 6:55am UTC](https://discuss.elastic.co/t/filebeat-unable-to-connect-to-logstash/65085 "2016-11-05T06:55:26Z")
Hello, I'm using ELK ver.5.0 on a server and Filebeat ver.5.0 on my client server. I've followed the setup and config tutorials and managed to get everything running. However, it seems like I'm unable to connect fileb… --- ## [Multiline troubleshooting](https://discuss.elastic.co/t/multiline-troubleshooting/65009)
**Author:** [@benpolzin](https://discuss.elastic.co/u/benpolzin)\ **Replies:** 2\ **Last updated:** [November 5, 2016, 1:27am UTC](https://discuss.elastic.co/t/multiline-troubleshooting/65009 "2016-11-05T01:27:41Z")
I'm using Filebeat 5.0 and having some trouble with multiline for one particular logtype. The same multiline config is working well for some other logs on the same box. Here is my multiline config: multiline.pattern: '… --- ## [Winlogbeat 5.0.0 stops sending data to Logstash (EOF)](https://discuss.elastic.co/t/winlogbeat-5-0-0-stops-sending-data-to-logstash-eof/64898)
**Author:** [@hailaeos.troy](https://discuss.elastic.co/u/hailaeos.troy)\ **Replies:** 5\ **Last updated:** [November 4, 2016, 7:50pm UTC](https://discuss.elastic.co/t/winlogbeat-5-0-0-stops-sending-data-to-logstash-eof/64898 "2016-11-04T19:50:04Z")
Winlogbeat stops sending data to logstash 5 or 2.4, I have been been able to reproduce this consistently and haven't ruled out user error. What I have done is the following: write an event log every 2 minutes using pow… --- ## [Monitoring Disk/CPU/RAM on Windows Nodes](https://discuss.elastic.co/t/monitoring-disk-cpu-ram-on-windows-nodes/65034)
**Author:** [@seth.yes](https://discuss.elastic.co/u/seth.yes)\ **Replies:** 3\ **Last updated:** [November 4, 2016, 7:40pm UTC](https://discuss.elastic.co/t/monitoring-disk-cpu-ram-on-windows-nodes/65034 "2016-11-04T19:40:38Z")
Is there a known solution for monitoring disk/memory/cpu usage on Windows boxes? Ideally this could be monitored through winlogbeat, however if I need to install a similar beat, that is fine. In order to attempt this … --- ## [Set beat.name/any custom field based on source](https://discuss.elastic.co/t/set-beat-name-any-custom-field-based-on-source/64988)
**Author:** [@manojvenkat](https://discuss.elastic.co/u/manojvenkat)\ **Replies:** 5\ **Last updated:** [November 4, 2016, 4:56pm UTC](https://discuss.elastic.co/t/set-beat-name-any-custom-field-based-on-source/64988 "2016-11-04T16:56:00Z")
Hi , Is it possible to set the beat.name using if condition based on source field value. Eg. if source: /user1/logs, then beat.name=USER1\_LOGS else if source:/user2/logs, then beat.name=USER2\_LOGS I need this to di… --- ## [Contribute on Windows](https://discuss.elastic.co/t/contribute-on-windows/64251)
**Author:** [@maddin2016](https://discuss.elastic.co/u/maddin2016)\ **Replies:** 6\ **Last updated:** [November 4, 2016, 3:29pm UTC](https://discuss.elastic.co/t/contribute-on-windows/64251 "2016-11-04T15:29:53Z")
Hi there, i would like to contribute to beats, especially for winlogbeats on my windows machine (WIN 10). Is there something special i have to note. Steps i have yet created install golang -\> fork your repo -\> cloned i… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=554) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=556)