# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=558 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 559 --- ## [FileBeat Optimization](https://discuss.elastic.co/t/filebeat-optimization/63711)
**Author:** [@manojvenkat](https://discuss.elastic.co/u/manojvenkat)\ **Replies:** 4\ **Last updated:** [October 25, 2016, 7:14am UTC](https://discuss.elastic.co/t/filebeat-optimization/63711 "2016-10-25T07:14:19Z")
Dear All, I have Installed Filebeat on my application server and ELK stack on another server. I have configured filebeat output to Elasticsearch and I started seeing logs on Kibana. But in few minutes logs stopped ship… --- ## [Filebeat Memory Usage (Linux)](https://discuss.elastic.co/t/filebeat-memory-usage-linux/63772)
**Author:** [@flodense](https://discuss.elastic.co/u/flodense)\ **Replies:** 2\ **Last updated:** [October 24, 2016, 5:24pm UTC](https://discuss.elastic.co/t/filebeat-memory-usage-linux/63772 "2016-10-24T17:24:29Z")
I am experiencing a similar issue with filebeat-1.2.3 on centos7. The log file that is being tracked reaches a maximum size of about 9.6MB and rotates out every couple days. At startup, filebeat will start using 200-30… --- ## [Filebeat.exe high RAM usage](https://discuss.elastic.co/t/filebeat-exe-high-ram-usage/62254)
**Author:** [@Slava](https://discuss.elastic.co/u/Slava)\ **Replies:** 9\ **Last updated:** [October 24, 2016, 3:41pm UTC](https://discuss.elastic.co/t/filebeat-exe-high-ram-usage/62254 "2016-10-24T15:41:46Z")
Noticed on some servers (Windows Server 2012R2) that filebeat.exe process can use up to 1.5GB of RAM. Service restart solves the problem but I would like to know the reason and ways to troubleshoot. Many thanks. --- ## [Exclude\_files regex](https://discuss.elastic.co/t/exclude-files-regex/63692)
**Author:** [@Winfield\_Henry](https://discuss.elastic.co/u/Winfield_Henry)\ **Replies:** 3\ **Last updated:** [October 24, 2016, 12:07pm UTC](https://discuss.elastic.co/t/exclude-files-regex/63692 "2016-10-24T12:07:44Z")
Hello, We have some duplicated log entries and would like to exclude a particular log file. There is an 'exclude\_files:' directive in the .yml config file, but we are having difficulty making that work. Question: Is … --- ## [Filebeat slower than logstash default "file" input?](https://discuss.elastic.co/t/filebeat-slower-than-logstash-default-file-input/63640)
**Author:** [@remaselvi](https://discuss.elastic.co/u/remaselvi)\ **Replies:** 4\ **Last updated:** [October 24, 2016, 11:16am UTC](https://discuss.elastic.co/t/filebeat-slower-than-logstash-default-file-input/63640 "2016-10-24T11:16:46Z")
Hi, So far I have been using logstash's default "file" input plugin. I am giving filebeat a try with logstash. Filebeat gives me a significant performance boost when it comes to reading large logfiles, this is great. … --- ## [Beats dashboards for TopBeat not creating dashboard](https://discuss.elastic.co/t/beats-dashboards-for-topbeat-not-creating-dashboard/63308)
**Author:** [@rayc999](https://discuss.elastic.co/u/rayc999)\ **Replies:** 6\ **Last updated:** [October 24, 2016, 9:19am UTC](https://discuss.elastic.co/t/beats-dashboards-for-topbeat-not-creating-dashboard/63308 "2016-10-24T09:19:37Z")
I'm following the instruction on this page on a Windows machine: https://www.elastic.co/guide/en/beats/libbeat/1.3/load-kibana-dashboards.html When I try to load the dashboards using Powershell command: .\\load.ps1 All … --- ## [Filebeat missing log lines - resolved logstash version problem](https://discuss.elastic.co/t/filebeat-missing-log-lines-resolved-logstash-version-problem/62876)
**Author:** [@Tim\_Burt](https://discuss.elastic.co/u/Tim_Burt)\ **Replies:** 8\ **Last updated:** [October 24, 2016, 7:15am UTC](https://discuss.elastic.co/t/filebeat-missing-log-lines-resolved-logstash-version-problem/62876 "2016-10-24T07:15:28Z")
Here is an example: Logs are being processed through two pathways. ruby-app --\> TCP --\> OldLogstash --\> OldKibana ruby-app --\> /var/log/json/file.log --\> filebeats --\> kafka --\> NewLogstash --\> NewKibana Tracin… --- ## [Catching all lines between two lines (two lines included)](https://discuss.elastic.co/t/catching-all-lines-between-two-lines-two-lines-included/63150)
**Author:** [@Houss](https://discuss.elastic.co/u/Houss)\ **Replies:** 11\ **Last updated:** [October 24, 2016, 4:47am UTC](https://discuss.elastic.co/t/catching-all-lines-between-two-lines-two-lines-included/63150 "2016-10-24T04:47:29Z")
Hello, I have not found a way to do this with multiline. Basically what I want to do is take all lines between two specific lines, and make a single message out of it. Example : Line I don't want Line I don't want L… --- ## [Main config file as router gives error: No paths given. What files do you want me to watch?](https://discuss.elastic.co/t/main-config-file-as-router-gives-error-no-paths-given-what-files-do-you-want-me-to-watch/42030)
**Author:** [@michelecappelletti](https://discuss.elastic.co/u/michelecappelletti)\ **Replies:** 8\ **Last updated:** [October 21, 2016, 7:50pm UTC](https://discuss.elastic.co/t/main-config-file-as-router-gives-error-no-paths-given-what-files-do-you-want-me-to-watch/42030 "2016-10-21T19:50:58Z")
Hi, i got this error on filebeat startup: "No paths given. What files do you want me to watch" The config follow the idea to have the main .yml config with empty prospector section, which act as 'router' filebeat:… --- ## [YAML config parsing failed on /etc/filebeat/filebeat.yml: yaml:](https://discuss.elastic.co/t/yaml-config-parsing-failed-on-etc-filebeat-filebeat-yml-yaml/63316)
**Author:** [@Gurram\_Vinay](https://discuss.elastic.co/u/Gurram_Vinay)\ **Replies:** 2\ **Last updated:** [October 21, 2016, 3:31pm UTC](https://discuss.elastic.co/t/yaml-config-parsing-failed-on-etc-filebeat-filebeat-yml-yaml/63316 "2016-10-21T15:31:05Z")
Loading config file error: YAML config parsing failed on /etc/filebeat/filebeat.yml: yaml: line 15: found a tab character that violate indentation. Exiting. ...fail! Sorry , I could able to understand what to change… --- ## [Failed to load temp](https://discuss.elastic.co/t/failed-to-load-temp/63517)
**Author:** [@Idan](https://discuss.elastic.co/u/Idan)\ **Replies:** 2\ **Last updated:** [October 21, 2016, 2:42pm UTC](https://discuss.elastic.co/t/failed-to-load-temp/63517 "2016-10-21T14:42:42Z")
I'm attempting to load the template for the Metricbeat to the kibana And I'm getting this error: {"error":{"root\_cause":\[{"type":"mapper\_parsing\_exception","reason":"No handler for type \[keyword\] declared on field \[hostn… --- ## [Filebeat StartUp error](https://discuss.elastic.co/t/filebeat-startup-error/63477)
**Author:** [@manojvenkat](https://discuss.elastic.co/u/manojvenkat)\ **Replies:** 6\ **Last updated:** [October 21, 2016, 11:25am UTC](https://discuss.elastic.co/t/filebeat-startup-error/63477 "2016-10-21T11:25:09Z")
Dear All, I have installed Filebeat on my application server and have updated filebeat.yml to ship logs to logstash. When I run the command to start the filebeat I get below error. Please advice. filebeat.service - f… --- ## [Topbeat on Windows has high CPU usage](https://discuss.elastic.co/t/topbeat-on-windows-has-high-cpu-usage/63495)
**Author:** [@parw](https://discuss.elastic.co/u/parw)\ **Replies:** 1\ **Last updated:** [October 21, 2016, 11:15am UTC](https://discuss.elastic.co/t/topbeat-on-windows-has-high-cpu-usage/63495 "2016-10-21T11:15:46Z")
I am evaluating TopBeat and have installed it (version 1.3.1) on a Windows Server 2012 and the TopBeat process consumes 20-25% of the CPU according to the windows recource monitor. Is this expected? Am I missing some co… --- ## [Kubernetes Integration](https://discuss.elastic.co/t/kubernetes-integration/63549)
**Author:** [@choused](https://discuss.elastic.co/u/choused)\ **Replies:** 1\ **Last updated:** [October 21, 2016, 11:00am UTC](https://discuss.elastic.co/t/kubernetes-integration/63549 "2016-10-21T11:00:50Z")
Hello, I am part of a Special Interest Group of the Kubernetes open source project and we are having discussions related to logging (aggregating, shipping, processing) and was hoping to get a beats rep to show up to the … --- ## [How to configure prospectors when files are rsynced?](https://discuss.elastic.co/t/how-to-configure-prospectors-when-files-are-rsynced/63590)
**Author:** [@Torsten\_Reinhard](https://discuss.elastic.co/u/Torsten_Reinhard)\ **Replies:** 1\ **Last updated:** [October 21, 2016, 10:38am UTC](https://discuss.elastic.co/t/how-to-configure-prospectors-when-files-are-rsynced/63590 "2016-10-21T10:38:57Z")
Hi, I´m new to ELK as well as to filebeat. Due to some restrictions we cannot install filebeat running on the source server(s), so we synchronize (rsync) all files regulary to the machine where filebeat is running. A… --- ## [Needs to restart everytime filebeat in order to send log to logstash](https://discuss.elastic.co/t/needs-to-restart-everytime-filebeat-in-order-to-send-log-to-logstash/63487)
**Author:** [@fferraro87](https://discuss.elastic.co/u/fferraro87)\ **Replies:** 2\ **Last updated:** [October 21, 2016, 7:01am UTC](https://discuss.elastic.co/t/needs-to-restart-everytime-filebeat-in-order-to-send-log-to-logstash/63487 "2016-10-21T07:01:37Z")
Hi i've same problem of this thread : Filebeat Need Restart To send Logs but i doesn't see solution on that thread, so i've this filebeat.yml : filebeat: prospectors: - paths: - /var/log/syslog -… --- ## [GO Panic with v1.3.1 pf\_ring support](https://discuss.elastic.co/t/go-panic-with-v1-3-1-pf-ring-support/63208)
**Author:** [@bugsfix](https://discuss.elastic.co/u/bugsfix)\ **Replies:** 1\ **Last updated:** [October 20, 2016, 1:03pm UTC](https://discuss.elastic.co/t/go-panic-with-v1-3-1-pf-ring-support/63208 "2016-10-20T13:03:46Z")
OS: RedHat 6.5 PF RING: pfring-6.5.0-931.x86\_64 GOLANG: go1.6.3 linux/amd64 Built packetbeat 1.3.1 with "make with\_pfring" When starting packetbeat I am getting the following error panic: runtime error: cgo argumen… --- ## [Beat to monitorize OpenStack](https://discuss.elastic.co/t/beat-to-monitorize-openstack/63387)
**Author:** [@zentolo](https://discuss.elastic.co/u/zentolo)\ **Replies:** 3\ **Last updated:** [October 20, 2016, 9:42am UTC](https://discuss.elastic.co/t/beat-to-monitorize-openstack/63387 "2016-10-20T09:42:28Z")
Hi, I'm just wondering how to monitorize OpenStack with beat (like metricbeat). I mean not the VMs status (CPU, RAM, etc), I want to monitorize OpenStack itself. Cluster status and so on. Any hint will be welcome. A… --- ## [Filebeat Drop Messages](https://discuss.elastic.co/t/filebeat-drop-messages/63478)
**Author:** [@RdrgPorto](https://discuss.elastic.co/u/RdrgPorto)\ **Replies:** 1\ **Last updated:** [October 20, 2016, 9:27am UTC](https://discuss.elastic.co/t/filebeat-drop-messages/63478 "2016-10-20T09:27:12Z")
Hi everyone, I have a doubt about Filebeat. For example, we have a Filebeat which is send several logs to Redis. If there is a problem with Redis, such as memory problems or Redis is down, what Filebeat will do? will i… --- ## [Not transferring Multiline messages](https://discuss.elastic.co/t/not-transferring-multiline-messages/63212)
**Author:** [@gdkge](https://discuss.elastic.co/u/gdkge)\ **Replies:** 9\ **Last updated:** [October 19, 2016, 7:31pm UTC](https://discuss.elastic.co/t/not-transferring-multiline-messages/63212 "2016-10-19T19:31:38Z")
It seems my multiline filter in Filebeat is not working I was looking at the log file for the multiline messages and found that they were not being transferred to Elastisearch. My config file is filebeat: # Lis… --- ## [No output defined error in filebeat](https://discuss.elastic.co/t/no-output-defined-error-in-filebeat/63417)
**Author:** [@rai](https://discuss.elastic.co/u/rai)\ **Replies:** 2\ **Last updated:** [October 19, 2016, 4:42pm UTC](https://discuss.elastic.co/t/no-output-defined-error-in-filebeat/63417 "2016-10-19T16:42:39Z")
I have downloaded filebeat 5.0.0.rc and trying to configure kafka as output. Even though I have configured kafka as output but keep getting . I have tried but kee Error Initialising publisher: No outputs are defined. P… --- ## [Http output for filebeat?](https://discuss.elastic.co/t/http-output-for-filebeat/62137)
**Author:** [@sunilmchaudhari](https://discuss.elastic.co/u/sunilmchaudhari)\ **Replies:** 7\ **Last updated:** [October 19, 2016, 11:09am UTC](https://discuss.elastic.co/t/http-output-for-filebeat/62137 "2016-10-19T11:09:01Z")
Hello, We have some need where we need to send logs from FB to datapower. We cant send filebeat output directly to ES or logstash. Our LS and ES components are inside secure zone. Some clients are outside secure zone, wh… --- ## [Remote IIS logs into ELK Stack?](https://discuss.elastic.co/t/remote-iis-logs-into-elk-stack/47157)
**Author:** [@Phil\_Austin](https://discuss.elastic.co/u/Phil_Austin)\ **Replies:** 4\ **Last updated:** [October 19, 2016, 11:06am UTC](https://discuss.elastic.co/t/remote-iis-logs-into-elk-stack/47157 "2016-10-19T11:06:08Z")
Hi, I have to first apologize for my ignorance as i JUST configured my ELK setup and am getting familiar with the technology, Here is my issue... I would like to ship logs from a dozen or so IIS servers to my Log serve… --- ## [Document all possible event\_data.\* fields?](https://discuss.elastic.co/t/document-all-possible-event-data-fields/63301)
**Author:** [@rivaanbechan](https://discuss.elastic.co/u/rivaanbechan)\ **Replies:** 3\ **Last updated:** [October 18, 2016, 3:04pm UTC](https://discuss.elastic.co/t/document-all-possible-event-data-fields/63301 "2016-10-18T15:04:26Z")
Hi, Is there any list out there with all the current fields that is possible to receive within "event\_data". I would like to further filter the subfields. Although I need the list to get a baseline. Please assist m… --- ## [Filebeat 5.x can't send logs to Logstash (SSL and EOF)](https://discuss.elastic.co/t/filebeat-5-x-cant-send-logs-to-logstash-ssl-and-eof/63216)
**Author:** [@Mohammad\_Mahzoun](https://discuss.elastic.co/u/Mohammad_Mahzoun)\ **Replies:** 8\ **Last updated:** [October 18, 2016, 1:27pm UTC](https://discuss.elastic.co/t/filebeat-5-x-cant-send-logs-to-logstash-ssl-and-eof/63216 "2016-10-18T13:27:46Z")
I Have filebeat on one server and logstash on another server. I checked the certificates and they are correct. also logstash is running on 5044. but filebeat can't send anything and this is the log: 2016-10-17T14:50:0… --- ## [How packetbeat to work with pf\_ring](https://discuss.elastic.co/t/how-packetbeat-to-work-with-pf-ring/63121)
**Author:** [@shell.b2t](https://discuss.elastic.co/u/shell.b2t)\ **Replies:** 11\ **Last updated:** [October 18, 2016, 1:16pm UTC](https://discuss.elastic.co/t/how-packetbeat-to-work-with-pf-ring/63121 "2016-10-18T13:16:42Z")
I have set as follows : interfaces: device: any type: pf\_ring but error as follows: 2016/10/16 05:16:37.012239 packetbeat.go:215: CRIT Initializing sniffer failed: Error creating sniffer: Pfring sniffing is no… --- ## [FileBeat EOF Error](https://discuss.elastic.co/t/filebeat-eof-error/60882)
**Author:** [@il.bert](https://discuss.elastic.co/u/il.bert)\ **Replies:** 42\ **Last updated:** [October 18, 2016, 11:08am UTC](https://discuss.elastic.co/t/filebeat-eof-error/60882 "2016-10-18T11:08:33Z")
Hi guys, I am running a ELK on a cluster of machine, 3 ES, 2-4LS and 12 FB I have a problem with Filebeat: sometimes it write this error in the log 2016-09-19T14:31:21+02:00 ERR Failed to publish events caused by: EO… --- ## [Remote control and configure the topbeat agents](https://discuss.elastic.co/t/remote-control-and-configure-the-topbeat-agents/63247)
**Author:** [@talk2cshah](https://discuss.elastic.co/u/talk2cshah)\ **Replies:** 2\ **Last updated:** [October 18, 2016, 9:57am UTC](https://discuss.elastic.co/t/remote-control-and-configure-the-topbeat-agents/63247 "2016-10-18T09:57:54Z")
Team, is there a feature or external utility to remote control and configure multiple topbeat agents? Regards, --- ## [Cannot verify signature: insecure algorithm MD5-RSA"](https://discuss.elastic.co/t/cannot-verify-signature-insecure-algorithm-md5-rsa/63214)
**Author:** [@Sai\_Birada](https://discuss.elastic.co/u/Sai_Birada)\ **Replies:** 4\ **Last updated:** [October 17, 2016, 7:14pm UTC](https://discuss.elastic.co/t/cannot-verify-signature-insecure-algorithm-md5-rsa/63214 "2016-10-17T19:14:29Z")
openssl genrsa -out cakey.pem 2048 openssl req -x509 -new -nodes -key cakey.pem -sha256 -days 3650 -out cacert.pem openssl req -newkey rsa:2048 -keyout server.key -nodes -config openssl.cnf -out server.csr openssl ca -co… --- ## [Running filebeat as a different user or service account on Centos 6.5](https://discuss.elastic.co/t/running-filebeat-as-a-different-user-or-service-account-on-centos-6-5/63200)
**Author:** [@jinal.shah](https://discuss.elastic.co/u/jinal.shah)\ **Replies:** 2\ **Last updated:** [October 17, 2016, 4:19pm UTC](https://discuss.elastic.co/t/running-filebeat-as-a-different-user-or-service-account-on-centos-6-5/63200 "2016-10-17T16:19:47Z")
Hello What is the best way to run / start filebeat as a different user or service account on Centos 6.5? Thanks [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=557) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=559)