# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=556 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 557 --- ## [Is it possible to drop some text with Filebeat](https://discuss.elastic.co/t/is-it-possible-to-drop-some-text-with-filebeat/64984)
**Author:** [@espogian](https://discuss.elastic.co/u/espogian)\ **Replies:** 1\ **Last updated:** [November 4, 2016, 3:07pm UTC](https://discuss.elastic.co/t/is-it-possible-to-drop-some-text-with-filebeat/64984 "2016-11-04T15:07:39Z")
Hello, just for confimation, would it be possible to tell Filebeat to drop some text in a line instead of the whole line? The exclude\_line configuration parameter works just fine when you need to drop an entire line from… --- ## [Pid file not found on Ubuntu 16.04](https://discuss.elastic.co/t/pid-file-not-found-on-ubuntu-16-04/64921)
**Author:** [@ElasticMartin](https://discuss.elastic.co/u/ElasticMartin)\ **Replies:** 4\ **Last updated:** [November 4, 2016, 12:03pm UTC](https://discuss.elastic.co/t/pid-file-not-found-on-ubuntu-16-04/64921 "2016-11-04T12:03:27Z")
Hi, I saw the other topic about the same issue but it's close. I got the same problem on Ubuntu. Same issue occur for Packetbeat and Filebeat. The init script looks ok but I the pid file is not created. The topbeat-… --- ## [Metricbeat vs Other Software](https://discuss.elastic.co/t/metricbeat-vs-other-software/65007)
**Author:** [@ralg](https://discuss.elastic.co/u/ralg)\ **Replies:** 0\ **Last updated:** [November 4, 2016, 12:19pm UTC](https://discuss.elastic.co/t/metricbeat-vs-other-software/65007 "2016-11-04T12:19:40Z")
Hi all. Considering that each software favours some features and there's no software that provides all of them, I'd love to see how metricbeat can be compared to existing solutions and how it tries to make a difference. … --- ## [Sending Json Logs from Filebeat 5.0.0\_alpha5-1 to Graylog 2.2.0](https://discuss.elastic.co/t/sending-json-logs-from-filebeat-5-0-0-alpha5-1-to-graylog-2-2-0/64809)
**Author:** [@onedaywillcome](https://discuss.elastic.co/u/onedaywillcome)\ **Replies:** 3\ **Last updated:** [November 4, 2016, 7:41am UTC](https://discuss.elastic.co/t/sending-json-logs-from-filebeat-5-0-0-alpha5-1-to-graylog-2-2-0/64809 "2016-11-04T07:41:56Z")
I am trying to send my json logs to Graylog. I've configured my filebeat.yml config file that similar to following post. However, I am not able to send my logs to Graylog properly and I get "null" message in Graylog that… --- ## [How does Filebeat handle log rotation](https://discuss.elastic.co/t/how-does-filebeat-handle-log-rotation/64959)
**Author:** [@DK\_3](https://discuss.elastic.co/u/DK_3)\ **Replies:** 1\ **Last updated:** [November 4, 2016, 7:36am UTC](https://discuss.elastic.co/t/how-does-filebeat-handle-log-rotation/64959 "2016-11-04T07:36:13Z")
How does Filebeat handle log rotation For example when app.log rolls over to app.1.log. Does it know to ignore app.1.log since it was already shipped? --- ## [Node Up / Down Monitoring](https://discuss.elastic.co/t/node-up-down-monitoring/64948)
**Author:** [@seth.yes](https://discuss.elastic.co/u/seth.yes)\ **Replies:** 2\ **Last updated:** [November 3, 2016, 10:25pm UTC](https://discuss.elastic.co/t/node-up-down-monitoring/64948 "2016-11-03T22:25:27Z")
I'm with a team that is migrating our monitoring stack to open source. I've implemented some fantastic performance and service-specific monitoring using the ELK stack. One key monitor I need to implement which isn't e… --- ## [\_grokparsefailure on file parsing](https://discuss.elastic.co/t/-grokparsefailure-on-file-parsing/64816)
**Author:** [@elasticheart](https://discuss.elastic.co/u/elasticheart)\ **Replies:** 7\ **Last updated:** [November 3, 2016, 2:59pm UTC](https://discuss.elastic.co/t/-grokparsefailure-on-file-parsing/64816 "2016-11-03T14:59:14Z")
Hi, I have a multi line log file structured something like; \ \ \ \ \ \ \ \ \ I have set multiline pattern in filebeat like; multiline.… --- ## [Filebeat 5.0 unable to send/publish logs to Logstash 5.0](https://discuss.elastic.co/t/filebeat-5-0-unable-to-send-publish-logs-to-logstash-5-0/64614)
**Author:** [@VIJAYP](https://discuss.elastic.co/u/VIJAYP)\ **Replies:** 4\ **Last updated:** [November 3, 2016, 2:41pm UTC](https://discuss.elastic.co/t/filebeat-5-0-unable-to-send-publish-logs-to-logstash-5-0/64614 "2016-11-03T14:41:02Z")
Hi, I am trying to monitor logs using Filebeat 5.0 from same host where ELK 5.0 is configured. I see i/o timeout errors in /var/log/filebeat/filebeat: This is happening on some hosts. I did verify the connectivity a… --- ## [Send beats from different prospectors to different outputs?](https://discuss.elastic.co/t/send-beats-from-different-prospectors-to-different-outputs/64773)
**Author:** [@Maxwell\_Flanders](https://discuss.elastic.co/u/Maxwell_Flanders)\ **Replies:** 1\ **Last updated:** [November 3, 2016, 6:07am UTC](https://discuss.elastic.co/t/send-beats-from-different-prospectors-to-different-outputs/64773 "2016-11-03T06:07:41Z")
We are using a configuration file with two prospectors, one for syslogs, and one for application logs. We'd like to send the syslogs to a logstash instance which does some processing, but to send the application logs to … --- ## [Winlogbeat 5.0 output.file data do not update after launching (false alarm)](https://discuss.elastic.co/t/winlogbeat-5-0-output-file-data-do-not-update-after-launching-false-alarm/64645)
**Author:** [@jojo.pornebo](https://discuss.elastic.co/u/jojo.pornebo)\ **Replies:** 2\ **Last updated:** [November 3, 2016, 3:47am UTC](https://discuss.elastic.co/t/winlogbeat-5-0-output-file-data-do-not-update-after-launching-false-alarm/64645 "2016-11-03T03:47:55Z")
Winlogbeat 5.0 config output.file Run winlogbeat updates the winlogbeat data from the Windows event log. Any new event log does not get captured onto the winlogbeat data. Using the same wnlogbeat.yml config file (sligh… --- ## [Metricbeat Error on field not found with Apache](https://discuss.elastic.co/t/metricbeat-error-on-field-not-found-with-apache/64574)
**Author:** [@Kernel\_Panic](https://discuss.elastic.co/u/Kernel_Panic)\ **Replies:** 7\ **Last updated:** [November 2, 2016, 8:08pm UTC](https://discuss.elastic.co/t/metricbeat-error-on-field-not-found-with-apache/64574 "2016-11-02T20:08:30Z")
Hi guys I recently installed metricbeat and while checking the logs I found the error below, is this a bug? As an additional info, I found also that only happens when I enable the apache module, for example on another se… --- ## [Kibana 5 Metribeat Dashboard/Servers Overview Won't Show More than 5 Servers](https://discuss.elastic.co/t/kibana-5-metribeat-dashboard-servers-overview-wont-show-more-than-5-servers/64331)
**Author:** [@elJoeyJojo](https://discuss.elastic.co/u/elJoeyJojo)\ **Replies:** 5\ **Last updated:** [November 2, 2016, 4:31pm UTC](https://discuss.elastic.co/t/kibana-5-metribeat-dashboard-servers-overview-wont-show-more-than-5-servers/64331 "2016-11-02T16:31:43Z")
Hello ELK Users: I recently installed and setup my new EK Server and everything works fine but I did notice that the "Servers Overview" filter on Kibana doesn't list more than 5 servers. So I thought I'd go in and edit … --- ## [Multiple logstash servers need to be ache](https://discuss.elastic.co/t/multiple-logstash-servers-need-to-be-ache/64154)
**Author:** [@nagendrababug](https://discuss.elastic.co/u/nagendrababug)\ **Replies:** 5\ **Last updated:** [November 2, 2016, 10:43am UTC](https://discuss.elastic.co/t/multiple-logstash-servers-need-to-be-ache/64154 "2016-11-02T10:43:41Z")
Hi, can i use multiple logstash servers in filebeat.My requirement is, if one logstash server gets down another server needs to be take responsibilty with out loss and duplicate of logs data. will it be done with filebea… --- ## [Multiple prospector path](https://discuss.elastic.co/t/multiple-prospector-path/64271)
**Author:** [@txisme](https://discuss.elastic.co/u/txisme)\ **Replies:** 4\ **Last updated:** [November 2, 2016, 10:16am UTC](https://discuss.elastic.co/t/multiple-prospector-path/64271 "2016-11-02T10:16:34Z")
Hey, i want to use 2 prospectors, filebeal.yml is working perfect with just one; However, if i uncomment the 2nd prospector, the filebeat fails to start: After some trial and error i figured out that if i change … --- ## [Disable automatic rotation Filebeat](https://discuss.elastic.co/t/disable-automatic-rotation-filebeat/63972)
**Author:** [@Clement\_Ros](https://discuss.elastic.co/u/Clement_Ros)\ **Replies:** 6\ **Last updated:** [November 2, 2016, 9:48am UTC](https://discuss.elastic.co/t/disable-automatic-rotation-filebeat/63972 "2016-11-02T09:48:30Z")
Hi, I use logrotate to rotate le log, and i wanted to know how can i disable the automatic rotation of Filebeat ? I already try to change the rotateeverybytes parameters : # Configure log file size limit. If limit i… --- ## [Searching subdirectories](https://discuss.elastic.co/t/searching-subdirectories/64648)
**Author:** [@Sankar\_Sundaresan](https://discuss.elastic.co/u/Sankar_Sundaresan)\ **Replies:** 1\ **Last updated:** [November 2, 2016, 9:21am UTC](https://discuss.elastic.co/t/searching-subdirectories/64648 "2016-11-02T09:21:39Z")
I am trying to setup filebeat to collect all the files within a folder. Here is the folder structure Main ├───subdir1A │ ├───subdir1B | │ ├───subdir1C | | | ├───file1 | | | ├───file2 | | | … --- ## [Logstash/Beats Issue - Logs not being published](https://discuss.elastic.co/t/logstash-beats-issue-logs-not-being-published/64601)
**Author:** [@Danxx6](https://discuss.elastic.co/u/Danxx6)\ **Replies:** 3\ **Last updated:** [November 1, 2016, 11:30pm UTC](https://discuss.elastic.co/t/logstash-beats-issue-logs-not-being-published/64601 "2016-11-01T23:30:36Z")
Hi I've recently followed a couple of guides to get a ELK stack up and working however I'm having some issues transporting my logs via filebeat to logstash. Errors: 2016-11-01T18:11:19Z ERR Failed to publish even… --- ## [Different output per prospector](https://discuss.elastic.co/t/different-output-per-prospector/64619)
**Author:** [@danm](https://discuss.elastic.co/u/danm)\ **Replies:** 3\ **Last updated:** [November 1, 2016, 8:17pm UTC](https://discuss.elastic.co/t/different-output-per-prospector/64619 "2016-11-01T20:17:29Z")
Apologies if this has already been established. We are using Filebeat in association with our Graylog cluster. We're shipping multiple files across to Graylog, however one problem we're having is using different 'inp… --- ## [How to configure Filebeat -\> ELK Docker Container correctly?](https://discuss.elastic.co/t/how-to-configure-filebeat-elk-docker-container-correctly/63769)
**Author:** [@zoram](https://discuss.elastic.co/u/zoram)\ **Replies:** 4\ **Last updated:** [November 1, 2016, 3:32pm UTC](https://discuss.elastic.co/t/how-to-configure-filebeat-elk-docker-container-correctly/63769 "2016-11-01T15:32:39Z")
Dear All, I have already installed on my local computer ELK Docker Container and Filebeat. I could read my local glassfish log directly from Kibana dashboard. But I want that the log file should be forwarding to ELK… --- ## [Topbeat ssl error](https://discuss.elastic.co/t/topbeat-ssl-error/64511)
**Author:** [@admin1](https://discuss.elastic.co/u/admin1)\ **Replies:** 1\ **Last updated:** [November 1, 2016, 11:58am UTC](https://discuss.elastic.co/t/topbeat-ssl-error/64511 "2016-11-01T11:58:14Z")
Hi I am trying to start topbeat on my machine, but I am getting this error Manage-test:/home/admin/beats/topbeat-1.3.1-x86\_64# ./topbeat -e topbeat.yml 2016/11/01 03:09:41.819791 transport.go:125: ERR SSL client … --- ## [Winlogbeat - how to change path for where to look for files](https://discuss.elastic.co/t/winlogbeat-how-to-change-path-for-where-to-look-for-files/64492)
**Author:** [@jeriel20](https://discuss.elastic.co/u/jeriel20)\ **Replies:** 2\ **Last updated:** [November 1, 2016, 12:28am UTC](https://discuss.elastic.co/t/winlogbeat-how-to-change-path-for-where-to-look-for-files/64492 "2016-11-01T00:28:40Z")
Does any one know what configuration if any I can put in the YAML file to specify a location for where my windows event logs reside. I have a folder with archived data that i need winlogbeat to index into elasticsearch..… --- ## [Problem with logstash filter to parser logs from apache reverse proxy (Solved)](https://discuss.elastic.co/t/problem-with-logstash-filter-to-parser-logs-from-apache-reverse-proxy-solved/64380)
**Author:** [@Lonck](https://discuss.elastic.co/u/Lonck)\ **Replies:** 6\ **Last updated:** [October 31, 2016, 10:14pm UTC](https://discuss.elastic.co/t/problem-with-logstash-filter-to-parser-logs-from-apache-reverse-proxy-solved/64380 "2016-10-31T22:14:12Z")
Hi for all I have an Apache server with mod\_proxy enabled that makes the reverse proxy function. For each domain thare are 3 log files (in /var/log/apache2/) that records the access, errors and transfers. See the examp… --- ## [Filtering Winlogbeat Events](https://discuss.elastic.co/t/filtering-winlogbeat-events/41116)
**Author:** [@renevdm](https://discuss.elastic.co/u/renevdm)\ **Replies:** 6\ **Last updated:** [October 31, 2016, 8:45pm UTC](https://discuss.elastic.co/t/filtering-winlogbeat-events/41116 "2016-10-31T20:45:29Z")
Is it possible to filter the Windows Event Logs on severity? I couldn't find anything about it in the Winlogbeat documentation. I know I can filter it in logstash, but I'd like to filter before sending it over the wire. --- ## [Upgrading to 5.0 Logstash - large number of beats to upgrade](https://discuss.elastic.co/t/upgrading-to-5-0-logstash-large-number-of-beats-to-upgrade/64171)
**Author:** [@djohnson](https://discuss.elastic.co/u/djohnson)\ **Replies:** 5\ **Last updated:** [October 31, 2016, 8:18pm UTC](https://discuss.elastic.co/t/upgrading-to-5-0-logstash-large-number-of-beats-to-upgrade/64171 "2016-10-31T20:18:18Z")
I'm planning the upgrade of my production system to 5.0. If I upgrade logstash before I upgrade my \*beats, will logstash continue to receive logs as I upgrade each beat? --- ## [Failed to publish events caused by: EOF](https://discuss.elastic.co/t/failed-to-publish-events-caused-by-eof/64356)
**Author:** [@s.vin](https://discuss.elastic.co/u/s.vin)\ **Replies:** 5\ **Last updated:** [October 31, 2016, 6:05pm UTC](https://discuss.elastic.co/t/failed-to-publish-events-caused-by-eof/64356 "2016-10-31T18:05:55Z")
Hello, I am running filebeat v5 and logstash version 5 as well. I have the pretty much identical filebeat config files on the local server (the one with the rest of the ELK stack) as a remote server. I am getting logs … --- ## [FileBeat file is falling under ignore older](https://discuss.elastic.co/t/filebeat-file-is-falling-under-ignore-older/61210)
**Author:** [@il.bert](https://discuss.elastic.co/u/il.bert)\ **Replies:** 27\ **Last updated:** [October 31, 2016, 5:16pm UTC](https://discuss.elastic.co/t/filebeat-file-is-falling-under-ignore-older/61210 "2016-10-31T17:16:44Z")
Hi, I am getting tons of this errors in filebeat 2016-09-22T06:56:22+02:00 ERR File is falling under ignore\_older before harvesting is finished. Adjust your close\_\* settings: d:Logger\\LoggerDw11\\LOG1.lOG 2016-09-22T06… --- ## [Alter how filebeats send data to output](https://discuss.elastic.co/t/alter-how-filebeats-send-data-to-output/64362)
**Author:** [@kalapakim](https://discuss.elastic.co/u/kalapakim)\ **Replies:** 3\ **Last updated:** [October 31, 2016, 5:10pm UTC](https://discuss.elastic.co/t/alter-how-filebeats-send-data-to-output/64362 "2016-10-31T17:10:41Z")
We are created custom logs in json format and appending as a string, such as: {"host": "Kawika\_DevServer","app\_name": "Kafka Test Client","log\_level": "Info","event\_name": "MessageSend","extended\_properties": {"kawika\_… --- ## [Winlogbeat v5 Dashboard Error (Fielddata is disabled on text fields)](https://discuss.elastic.co/t/winlogbeat-v5-dashboard-error-fielddata-is-disabled-on-text-fields/64342)
**Author:** [@somerandomguy](https://discuss.elastic.co/u/somerandomguy)\ **Replies:** 3\ **Last updated:** [October 31, 2016, 3:53pm UTC](https://discuss.elastic.co/t/winlogbeat-v5-dashboard-error-fielddata-is-disabled-on-text-fields/64342 "2016-10-31T15:53:02Z")
Hi. Just setup my windows 2012 server to send eventlogs to ES (via winlogbeat and LS). I also uploaded the dashboard as per document here - https://www.elastic.co/guide/en/beats/winlogbeat/current/winlogbeat-sample-da… --- ## [Filebeat on solaris sparc](https://discuss.elastic.co/t/filebeat-on-solaris-sparc/64434)
**Author:** [@Ollm4c](https://discuss.elastic.co/u/Ollm4c)\ **Replies:** 2\ **Last updated:** [October 31, 2016, 2:05pm UTC](https://discuss.elastic.co/t/filebeat-on-solaris-sparc/64434 "2016-10-31T14:05:02Z")
Hi there, I want to install filebeat on solaris sparc. Could you help me? --- ## [Filebeat stops processing files after 1 or 2 days issue](https://discuss.elastic.co/t/filebeat-stops-processing-files-after-1-or-2-days-issue/64402)
**Author:** [@elasticheart](https://discuss.elastic.co/u/elasticheart)\ **Replies:** 4\ **Last updated:** [October 31, 2016, 9:05am UTC](https://discuss.elastic.co/t/filebeat-stops-processing-files-after-1-or-2-days-issue/64402 "2016-10-31T09:05:33Z")
Hi, I have Filebeat configured to fetch data from log files in a folder. I have log files, which is sliced to 10 mb log fies in my linux box, and so I configured filebeat to scan the entire folder. There will be approx… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=555) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=557)