# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=557 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 558 --- ## [Filebeat 5.0 with multiline, split event data to two events](https://discuss.elastic.co/t/filebeat-5-0-with-multiline-split-event-data-to-two-events/60380)
**Author:** [@ori.rubinfeld](https://discuss.elastic.co/u/ori.rubinfeld)\ **Replies:** 37\ **Last updated:** [October 30, 2016, 2:46pm UTC](https://discuss.elastic.co/t/filebeat-5-0-with-multiline-split-event-data-to-two-events/60380 "2016-10-30T14:46:00Z")
Hi, I am testing to use Filebeat against direct Ingest Node. The filebeat reads multiline events. Sometimes there is a cut in an event (A Java stack trace), which splits into two events. The first part, will suit the G… --- ## [No outputs are defined. Please define one under the output section](https://discuss.elastic.co/t/no-outputs-are-defined-please-define-one-under-the-output-section/38626)
**Author:** [@Ganesh2303](https://discuss.elastic.co/u/Ganesh2303)\ **Replies:** 11\ **Last updated:** [October 29, 2016, 5:56pm UTC](https://discuss.elastic.co/t/no-outputs-are-defined-please-define-one-under-the-output-section/38626 "2016-10-29T17:56:26Z")
Hi i'm very new to filebeat previously i had use log-courier to process my log. i have created the filebeat.yml like this filebeat: prospectors: - paths: - C:\\elkenter\\Data\\sample\*.csv docume… --- ## [SSL client failed to connect, Filebeat to ELK](https://discuss.elastic.co/t/ssl-client-failed-to-connect-filebeat-to-elk/64193)
**Author:** [@skeer](https://discuss.elastic.co/u/skeer)\ **Replies:** 4\ **Last updated:** [October 28, 2016, 9:52pm UTC](https://discuss.elastic.co/t/ssl-client-failed-to-connect-filebeat-to-elk/64193 "2016-10-28T21:52:28Z")
Virtual sandbox in ESXi 5.5, comprised of 3 x CentOS 7 minimal servers. 1 ELK, 2 clients w/Filebeats installed. Followed guide here: https://www.digitalocean.com/community/tutorials/how-to-install-elasticsearch-logstas… --- ## [Parsing Log4net with Filebeat](https://discuss.elastic.co/t/parsing-log4net-with-filebeat/64180)
**Author:** [@mmehraban](https://discuss.elastic.co/u/mmehraban)\ **Replies:** 7\ **Last updated:** [October 28, 2016, 9:29pm UTC](https://discuss.elastic.co/t/parsing-log4net-with-filebeat/64180 "2016-10-28T21:29:53Z")
Hi guys, I want to pars log4net Files which is shipping from filebeat to Logstash but I have difficulty with multiline in Filebeat? What is the best way to do it? Any help or suggestion would be appreciated --- ## ["x509: cannot verify signature: algorithm unimplemented" error when CA uses SHA2-512 signature](https://discuss.elastic.co/t/x509-cannot-verify-signature-algorithm-unimplemented-error-when-ca-uses-sha2-512-signature/63951)
**Author:** [@Daniel\_Salzedo\_SA](https://discuss.elastic.co/u/Daniel_Salzedo_SA)\ **Replies:** 6\ **Last updated:** [October 28, 2016, 9:16pm UTC](https://discuss.elastic.co/t/x509-cannot-verify-signature-algorithm-unimplemented-error-when-ca-uses-sha2-512-signature/63951 "2016-10-28T21:16:09Z")
I'm new to ELK Stack so I'm not sure if this issue is actually with Winlogbeat itself or with Logstash. Here is what is happening: I have an ELK stack server running on CentOS 7 in pretty much a default configuration. … --- ## [Filebeat vs. rsyslog imfile module](https://discuss.elastic.co/t/filebeat-vs-rsyslog-imfile-module/64257)
**Author:** [@dandrestor](https://discuss.elastic.co/u/dandrestor)\ **Replies:** 5\ **Last updated:** [October 28, 2016, 4:57pm UTC](https://discuss.elastic.co/t/filebeat-vs-rsyslog-imfile-module/64257 "2016-10-28T16:57:55Z")
Hi there, In the context of a modern enterprise Linux environment, where rsyslog is pretty much omnipresent, I was wondering if there is any reason to prefer Filebeat vs. just using the imfile module of rsyslog. Has an… --- ## [Filebeat Error](https://discuss.elastic.co/t/filebeat-error/64072)
**Author:** [@admin1](https://discuss.elastic.co/u/admin1)\ **Replies:** 1\ **Last updated:** [October 28, 2016, 1:23pm UTC](https://discuss.elastic.co/t/filebeat-error/64072 "2016-10-28T13:23:30Z")
I am getting a similar kind of error. I am trying to monitor logs from different hosts using filebeats I get this error on some hosts 2016/10/26 17:28:48.159067 single.go:140: ERR Connecting error publishing events… --- ## [Puppet Module for Metricbeat?](https://discuss.elastic.co/t/puppet-module-for-metricbeat/64047)
**Author:** [@tarp](https://discuss.elastic.co/u/tarp)\ **Replies:** 1\ **Last updated:** [October 28, 2016, 1:11pm UTC](https://discuss.elastic.co/t/puppet-module-for-metricbeat/64047 "2016-10-28T13:11:22Z")
I use puppet to deploy all of my ELK stack components. Is there any plans to create a module for Metricbeat? --- ## [Beatfile doesn'f capture Docker's logs but others do, why? \[solved\]](https://discuss.elastic.co/t/beatfile-doesnf-capture-dockers-logs-but-others-do-why-solved/63435)
**Author:** [@ndarkness](https://discuss.elastic.co/u/ndarkness)\ **Replies:** 20\ **Last updated:** [October 28, 2016, 7:41am UTC](https://discuss.elastic.co/t/beatfile-doesnf-capture-dockers-logs-but-others-do-why-solved/63435 "2016-10-28T07:41:01Z")
Hello all, I am following this tutorial to set up a ELK stack (VPS B) that will receive some Docker/docker compose images logs (VPS A) using Beatfile as forwarder, my diagram is as shown below So far, I have managed … --- ## [Setup ELK 5.0 but Metribeat Not Working](https://discuss.elastic.co/t/setup-elk-5-0-but-metribeat-not-working/64076)
**Author:** [@elJoeyJojo](https://discuss.elastic.co/u/elJoeyJojo)\ **Replies:** 10\ **Last updated:** [October 27, 2016, 7:32pm UTC](https://discuss.elastic.co/t/setup-elk-5-0-but-metribeat-not-working/64076 "2016-10-27T19:32:22Z")
Hello, I have just installed a new ELK 5.0 Server on Ubuntu 15.04. Kibana/Elasticsearch/Logstash 5.0 I am able to login to Kibana and for a few minutes I saw some logs coming in but then they stopped. At the moment it'… --- ## [Sending filebeat data to AWS Elasticsearch service endpoint](https://discuss.elastic.co/t/sending-filebeat-data-to-aws-elasticsearch-service-endpoint/41974)
**Author:** [@pratik](https://discuss.elastic.co/u/pratik)\ **Replies:** 9\ **Last updated:** [October 27, 2016, 6:01pm UTC](https://discuss.elastic.co/t/sending-filebeat-data-to-aws-elasticsearch-service-endpoint/41974 "2016-10-27T18:01:39Z")
Hi, I have installed filebeat client on AWS EC2 which is configured to push messages to the AWS Elasticsearch service endpoint. Below is the detail of the filebeat yml file. ## Filebeat ### filebeat: # List o… --- ## [Rpm upgrade from rc1 to ga fails](https://discuss.elastic.co/t/rpm-upgrade-from-rc1-to-ga-fails/64156)
**Author:** [@agonzalez](https://discuss.elastic.co/u/agonzalez)\ **Replies:** 1\ **Last updated:** [October 27, 2016, 3:30pm UTC](https://discuss.elastic.co/t/rpm-upgrade-from-rc1-to-ga-fails/64156 "2016-10-27T15:30:09Z")
\[root@localhost script\]# rpm -Uvh https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-5.0.0-x86\_64.rpm Retrieving https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-5.0.0-x86\_64.rpm warning: /var/t… --- ## [FileBeat 5 - Parsing JSON - Why can't it parse the whole line](https://discuss.elastic.co/t/filebeat-5-parsing-json-why-cant-it-parse-the-whole-line/64021)
**Author:** [@Yarden\_Bar](https://discuss.elastic.co/u/Yarden_Bar)\ **Replies:** 2\ **Last updated:** [October 27, 2016, 2:25pm UTC](https://discuss.elastic.co/t/filebeat-5-parsing-json-why-cant-it-parse-the-whole-line/64021 "2016-10-27T14:25:40Z")
Hi, As documented, in order to parse json line logs, the json object must contain a key to pull the message object from. Is there a particular reason that FB won't have the ability to parse the whole line (assuming tha… --- ## [Filebeat keeps files open forever](https://discuss.elastic.co/t/filebeat-keeps-files-open-forever/62802)
**Author:** [@ronny.lerch](https://discuss.elastic.co/u/ronny.lerch)\ **Replies:** 12\ **Last updated:** [October 27, 2016, 1:16pm UTC](https://discuss.elastic.co/t/filebeat-keeps-files-open-forever/62802 "2016-10-27T13:16:43Z")
I would like to join the discussion. I'm following and applying changes in "Filebeat keeps open files forever" topic the past week. Sadly I still experience the problem: filebeat 31 root 1r REG 253,16 10486094 4751403 /o… --- ## [Processing metric sets to reduce data amount](https://discuss.elastic.co/t/processing-metric-sets-to-reduce-data-amount/63372)
**Author:** [@heilaaks](https://discuss.elastic.co/u/heilaaks)\ **Replies:** 2\ **Last updated:** [October 27, 2016, 11:44am UTC](https://discuss.elastic.co/t/processing-metric-sets-to-reduce-data-amount/63372 "2016-10-27T11:44:08Z")
Has anyone succeeded to filter out metricbeat events with metricbeat-5.0.0-rc1-x86\_64.rpm? What I try to do is to get the memory and CPU load statistics only from few selected processes. How ever, I am not able to get th… --- ## [Filebeat 5.0 - stuck in "ERR Problem putting initial state: prospector outlet closed"](https://discuss.elastic.co/t/filebeat-5-0-stuck-in-err-problem-putting-initial-state-prospector-outlet-closed/64027)
**Author:** [@shog](https://discuss.elastic.co/u/shog)\ **Replies:** 7\ **Last updated:** [October 27, 2016, 7:24am UTC](https://discuss.elastic.co/t/filebeat-5-0-stuck-in-err-problem-putting-initial-state-prospector-outlet-closed/64027 "2016-10-27T07:24:23Z")
Hi, First of all congratz on 5.0 release! I've encountered a problem after upgrading from 5-0-rc1 to 5.0 with the same config that I used for 5.0-rc1. Filebeat does nothing now and only sends "ERR Problem putting … --- ## [Filebeat can not publishing events](https://discuss.elastic.co/t/filebeat-can-not-publishing-events/37349)
**Author:** [@Adria\_Garcia\_Alzorri](https://discuss.elastic.co/u/Adria_Garcia_Alzorri)\ **Replies:** 14\ **Last updated:** [October 26, 2016, 8:48pm UTC](https://discuss.elastic.co/t/filebeat-can-not-publishing-events/37349 "2016-10-26T20:48:12Z")
Howdy, I'm trying the ELK stack under CentOS 6 machines, following https://www.digitalocean.com/community/tutorials/how-to-install-elasticsearch-logstash-and-kibana-elk-stack-on-centos-7. Every service is running in … --- ## [Filebeat hold already deleted files](https://discuss.elastic.co/t/filebeat-hold-already-deleted-files/64019)
**Author:** [@aryaray](https://discuss.elastic.co/u/aryaray)\ **Replies:** 1\ **Last updated:** [October 26, 2016, 8:44pm UTC](https://discuss.elastic.co/t/filebeat-hold-already-deleted-files/64019 "2016-10-26T20:44:56Z")
I am using filebeat version 1.2.0 . I am checking that Filebeat hold already deleted process ,and that' create a disk space issue . when I kill those process then it's working but after 1-2 it's again occupied space by d… --- ## [Multiple configs in /etc/filebeat/\*.yml](https://discuss.elastic.co/t/multiple-configs-in-etc-filebeat-yml/63876)
**Author:** [@jvdm](https://discuss.elastic.co/u/jvdm)\ **Replies:** 5\ **Last updated:** [October 26, 2016, 8:34pm UTC](https://discuss.elastic.co/t/multiple-configs-in-etc-filebeat-yml/63876 "2016-10-26T20:34:08Z")
Greetings all, I'm trying to use multiple config files located in /etc/filebeat. The default config is stored as filebeat.yml, with additional configs stored as $service.yml. I've verified that all the configs are wor… --- ## [Filebeat lock monitored files?](https://discuss.elastic.co/t/filebeat-lock-monitored-files/39660)
**Author:** [@djvidov](https://discuss.elastic.co/u/djvidov)\ **Replies:** 5\ **Last updated:** [October 26, 2016, 2:18pm UTC](https://discuss.elastic.co/t/filebeat-lock-monitored-files/39660 "2016-10-26T14:18:53Z")
Hello, Can filebeat lock some monitored files for some reasons (Windows Server 2008 R2)? Regards, Ovidiu --- ## [FIlebeat from a Windows Network Share](https://discuss.elastic.co/t/filebeat-from-a-windows-network-share/36966)
**Author:** [@jamesleech](https://discuss.elastic.co/u/jamesleech)\ **Replies:** 7\ **Last updated:** [October 26, 2016, 11:54am UTC](https://discuss.elastic.co/t/filebeat-from-a-windows-network-share/36966 "2016-10-26T11:54:41Z")
Hi, Today I was trying to get FileBeat up and running. I have logstash, elasticsearch and kibana all setup but i'm new to FileBeat. Previously I had logstash running on an ubuntu VM, smb mounting windows shares, and… --- ## [Filebeat - don't add meta information](https://discuss.elastic.co/t/filebeat-dont-add-meta-information/63984)
**Author:** [@lolovarga](https://discuss.elastic.co/u/lolovarga)\ **Replies:** 2\ **Last updated:** [October 26, 2016, 10:48am UTC](https://discuss.elastic.co/t/filebeat-dont-add-meta-information/63984 "2016-10-26T10:48:46Z")
I'm configuring filebeat 5.0-RC1 to output to kafka. I would like filebeat to output to the kafka topic the lines in the log file verbatim, but some meta tags are added, such as: @timestamp and type. Is there any way to … --- ## [\[suggestion\] Filebeat prospector configuration template](https://discuss.elastic.co/t/suggestion-filebeat-prospector-configuration-template/62687)
**Author:** [@fld](https://discuss.elastic.co/u/fld)\ **Replies:** 4\ **Last updated:** [October 26, 2016, 7:25am UTC](https://discuss.elastic.co/t/suggestion-filebeat-prospector-configuration-template/62687 "2016-10-26T07:25:53Z")
We are heavily starting to use filebeat (to push to kafka) and we have a configuration with 100+ prospectors (100+ kafka topics) For each prospector we repeat some parameters like encoding, ignore\_older, scan\_frequency, … --- ## [My "need to restart filebeat for it to send logs" problem](https://discuss.elastic.co/t/my-need-to-restart-filebeat-for-it-to-send-logs-problem/63702)
**Author:** [@Houss](https://discuss.elastic.co/u/Houss)\ **Replies:** 7\ **Last updated:** [October 26, 2016, 3:41am UTC](https://discuss.elastic.co/t/my-need-to-restart-filebeat-for-it-to-send-logs-problem/63702 "2016-10-26T03:41:06Z")
Hello, I'm sorry because this have been brought up before, but none of the solutions seemed to apply to my case so I'm opening this topic. So basically, what happens is that filebeat sends logs after starting, but th… --- ## [Rename event fields](https://discuss.elastic.co/t/rename-event-fields/63873)
**Author:** [@Yarden\_Bar](https://discuss.elastic.co/u/Yarden_Bar)\ **Replies:** 1\ **Last updated:** [October 25, 2016, 3:11pm UTC](https://discuss.elastic.co/t/rename-event-fields/63873 "2016-10-25T15:11:40Z")
Hi all, I'm want to ship Rails' requests to ES but rename certain fields so it will match other indexes field names, mainly is the ip to true\_ip. Is there a configuration option for this in Filebeat? I believe that r… --- ## [Collecting port scans -- "Ignore empty non-FIN packet"](https://discuss.elastic.co/t/collecting-port-scans-ignore-empty-non-fin-packet/63884)
**Author:** [@tipene](https://discuss.elastic.co/u/tipene)\ **Replies:** 1\ **Last updated:** [October 25, 2016, 2:40pm UTC](https://discuss.elastic.co/t/collecting-port-scans-ignore-empty-non-fin-packet/63884 "2016-10-25T14:40:29Z")
How can I collect the opening packet in a port scan (ie, the SYN before the handshake is completed) using Packetbeat? I'm using pcap with bpf\_filter to select all TCP/IP traffic from a variety of ports. Unfortunately t… --- ## [Insufficient throughput from Filebeat](https://discuss.elastic.co/t/insufficient-throughput-from-filebeat/39564)
**Author:** [@tom.dewire](https://discuss.elastic.co/u/tom.dewire)\ **Replies:** 17\ **Last updated:** [October 25, 2016, 2:09pm UTC](https://discuss.elastic.co/t/insufficient-throughput-from-filebeat/39564 "2016-10-25T14:09:25Z")
We recently deployed Filebeat as part of an ELK deployment in our production environment. Generally, things have gone well, but Filebeat appears to be having a very difficult time keeping up with some of our highest, poi… --- ## [Packetbeat Dashboard not displaying Client locations](https://discuss.elastic.co/t/packetbeat-dashboard-not-displaying-client-locations/63608)
**Author:** [@napoleon182](https://discuss.elastic.co/u/napoleon182)\ **Replies:** 8\ **Last updated:** [October 25, 2016, 2:08pm UTC](https://discuss.elastic.co/t/packetbeat-dashboard-not-displaying-client-locations/63608 "2016-10-25T14:08:03Z")
Hi All, I'm having problems with PacketBeat dashboard not displaying Client Locations correctly, (see screenshot attached)- although saved search is returning results from query correctly. --- ## [Filebeat 5.0 beta 1 is not closing deleted files](https://discuss.elastic.co/t/filebeat-5-0-beta-1-is-not-closing-deleted-files/62759)
**Author:** [@chris.mcdermott](https://discuss.elastic.co/u/chris.mcdermott)\ **Replies:** 13\ **Last updated:** [October 25, 2016, 7:23am UTC](https://discuss.elastic.co/t/filebeat-5-0-beta-1-is-not-closing-deleted-files/62759 "2016-10-25T07:23:35Z")
Hello, I am having an issue with beta1. It is holding open a lot of deleted files even though the files have not been updated for a time much greater than close\_older. I am not setting close\_after so it should be defa… --- ## [Filebeat is not sending data to logstash](https://discuss.elastic.co/t/filebeat-is-not-sending-data-to-logstash/63029)
**Author:** [@adimania](https://discuss.elastic.co/u/adimania)\ **Replies:** 10\ **Last updated:** [October 25, 2016, 7:16am UTC](https://discuss.elastic.co/t/filebeat-is-not-sending-data-to-logstash/63029 "2016-10-25T07:16:42Z")
Hello, I am using filebeat to send logs to logstash. The logs get written all the time from the application but filebeat is not able to detect it. Here is the filebeat version # filebeat --version filebeat version … [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=556) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=558)