# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=559 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 560 --- ## [Filebeat and truncated files](https://discuss.elastic.co/t/filebeat-and-truncated-files/63054)
**Author:** [@apelsina](https://discuss.elastic.co/u/apelsina)\ **Replies:** 1\ **Last updated:** [October 17, 2016, 11:35am UTC](https://discuss.elastic.co/t/filebeat-and-truncated-files/63054 "2016-10-17T11:35:49Z")
What strategy should I use for filebeat in case when specific log file is being constantly truncated from the beginning? I use log files which are produced by third-party log system and I cannot maintain it. Produced f… --- ## [How to verify filebeat parsed log data count](https://discuss.elastic.co/t/how-to-verify-filebeat-parsed-log-data-count/62055)
**Author:** [@sarathymv](https://discuss.elastic.co/u/sarathymv)\ **Replies:** 15\ **Last updated:** [October 17, 2016, 11:09am UTC](https://discuss.elastic.co/t/how-to-verify-filebeat-parsed-log-data-count/62055 "2016-10-17T11:09:37Z")
All, We are using logstash to parse our application log and index to elastic search. Following is the high level architecture Webserver with file beat -----\> Logstash ----\> Elastic search ------\> kibana. We instal… --- ## [Filebeat set default document\_type globally for all propectors?](https://discuss.elastic.co/t/filebeat-set-default-document-type-globally-for-all-propectors/62931)
**Author:** [@agonzalez](https://discuss.elastic.co/u/agonzalez)\ **Replies:** 1\ **Last updated:** [October 15, 2016, 6:16am UTC](https://discuss.elastic.co/t/filebeat-set-default-document-type-globally-for-all-propectors/62931 "2016-10-15T06:16:08Z")
I have more than 40 prospector in my filebeat.yml by default document\_type is "log". Is there anyway to change default type to something else whithout having to include document\_type in each one of my prospectors? --- ## [Migrating from 1.X to 5.X](https://discuss.elastic.co/t/migrating-from-1-x-to-5-x/63006)
**Author:** [@kpam](https://discuss.elastic.co/u/kpam)\ **Replies:** 2\ **Last updated:** [October 15, 2016, 5:37am UTC](https://discuss.elastic.co/t/migrating-from-1-x-to-5-x/63006 "2016-10-15T05:37:07Z")
Hi all, After updating from 1.x to 5.x, our logs don't seem to be pushed to ES/Kibana anymore. I ran the config migration script and restarted filebeat but I am still not seeing any output to ES, Also, the new config … --- ## [JSON parsing issue and mis-reported JSON\_ERROR](https://discuss.elastic.co/t/json-parsing-issue-and-mis-reported-json-error/63074)
**Author:** [@kpam](https://discuss.elastic.co/u/kpam)\ **Replies:** 2\ **Last updated:** [October 14, 2016, 7:57pm UTC](https://discuss.elastic.co/t/json-parsing-issue-and-mis-reported-json-error/63074 "2016-10-14T19:57:09Z")
Hi all, I am using Filebeat 5.0 rc and shipping logs directly to ES/Kibana. I am currently trying to use the JSON option to decode my JSON object log message. The behavior I'm seeing is that when I include the JSON con… --- ## [Latest stable filebeat version for freebsd missing](https://discuss.elastic.co/t/latest-stable-filebeat-version-for-freebsd-missing/62603)
**Author:** [@Sai\_Birada](https://discuss.elastic.co/u/Sai_Birada)\ **Replies:** 8\ **Last updated:** [October 14, 2016, 5:28pm UTC](https://discuss.elastic.co/t/latest-stable-filebeat-version-for-freebsd-missing/62603 "2016-10-14T17:28:06Z")
I am downloading filebeat freebsd binary from https://beats-nightlies.s3.amazonaws.com/index.html?prefix=jenkins/filebeat/ but from here i am getting alpha releases, but i want to use filebeat's latest stable version. Ca… --- ## [Filebeat communication with logstash](https://discuss.elastic.co/t/filebeat-communication-with-logstash/62947)
**Author:** [@MatheusGuizolfi](https://discuss.elastic.co/u/MatheusGuizolfi)\ **Replies:** 1\ **Last updated:** [October 14, 2016, 10:56am UTC](https://discuss.elastic.co/t/filebeat-communication-with-logstash/62947 "2016-10-14T10:56:31Z")
I tried this way and did not work. Execute: "curl -v --cacert certificate.pem https://logstash:5044" retorna: \* Rebuilt URL to: https://logstash:5044/ https://logstash:5044/ \* Hostname was NOT found in DNS cache \* T… --- ## [How to disable analysis of beat.name and other starting issues](https://discuss.elastic.co/t/how-to-disable-analysis-of-beat-name-and-other-starting-issues/62822)
**Author:** [@knowncolor](https://discuss.elastic.co/u/knowncolor)\ **Replies:** 3\ **Last updated:** [October 14, 2016, 10:49am UTC](https://discuss.elastic.co/t/how-to-disable-analysis-of-beat-name-and-other-starting-issues/62822 "2016-10-14T10:49:32Z")
Hello TopBeat Community, I have configured topbeats to send metrics from my local Ubuntu machine to my Elastic Cloud cluster and installed the beats dashboards. However I see various "problems" with the beats dashboard… --- ## [Global fields not working](https://discuss.elastic.co/t/global-fields-not-working/62309)
**Author:** [@agonzalez](https://discuss.elastic.co/u/agonzalez)\ **Replies:** 8\ **Last updated:** [October 13, 2016, 9:49pm UTC](https://discuss.elastic.co/t/global-fields-not-working/62309 "2016-10-13T21:49:52Z")
I am using this sample on filebeat.yml to set global fields for all prospectors but is not working, i just see on my docs local fields but not this global fields. I am using fb 5.0-beta1 shipper: fields\_under\_root: t… --- ## [How can I expose new fields sourced from the log record?](https://discuss.elastic.co/t/how-can-i-expose-new-fields-sourced-from-the-log-record/62871)
**Author:** [@kpam](https://discuss.elastic.co/u/kpam)\ **Replies:** 2\ **Last updated:** [October 13, 2016, 5:00pm UTC](https://discuss.elastic.co/t/how-can-i-expose-new-fields-sourced-from-the-log-record/62871 "2016-10-13T17:00:20Z")
Hi all, I'm using a structured logging package (GitHub - sirupsen/logrus: Structured, pluggable logging for Go.) and then shipping with Filebeat directly to our ES cluster. Unfortunately, I'm losing queryability on the … --- ## [FileBeat file is falling under ignore older Part2](https://discuss.elastic.co/t/filebeat-file-is-falling-under-ignore-older-part2/62920)
**Author:** [@il.bert](https://discuss.elastic.co/u/il.bert)\ **Replies:** 2\ **Last updated:** [October 13, 2016, 12:18pm UTC](https://discuss.elastic.co/t/filebeat-file-is-falling-under-ignore-older-part2/62920 "2016-10-13T12:18:34Z")
@ruflin my old post has been closed if you reopen it I copy the answer there You're right I pasted the wrong logs, anyway there where nothing usefull in ther, right now I removed all those conf, but FB sizes in memo… --- ## [FIleBeat import csv file into elasticsearch,but each line was treated as a string, I want each line was spilit by comma](https://discuss.elastic.co/t/filebeat-import-csv-file-into-elasticsearch-but-each-line-was-treated-as-a-string-i-want-each-line-was-spilit-by-comma/62676)
**Author:** [@Liu\_Lantern](https://discuss.elastic.co/u/Liu_Lantern)\ **Replies:** 2\ **Last updated:** [October 13, 2016, 6:41am UTC](https://discuss.elastic.co/t/filebeat-import-csv-file-into-elasticsearch-but-each-line-was-treated-as-a-string-i-want-each-line-was-spilit-by-comma/62676 "2016-10-13T06:41:38Z")
I got a problem when I import csv file into elasticsearch here is my csv file looks like name,age,sex amy,18,girl tom,19,boy and I use the default template in /etc/filebeat/filebeat.template.json which is below … --- ## [Filebeat](https://discuss.elastic.co/t/filebeat/62596)
**Author:** [@abu.sayeed](https://discuss.elastic.co/u/abu.sayeed)\ **Replies:** 2\ **Last updated:** [October 13, 2016, 6:30am UTC](https://discuss.elastic.co/t/filebeat/62596 "2016-10-13T06:30:10Z")
/etc/filebeat/filebeat.yml filebeat: prospectors: - paths: - /var/log/auth.log - /var/log/syslog # - /var/log/\*.log input\_type: log document\_type: syslog registry\_file: /var… --- ## [All numbers reported by Metricbeat too high (bug?)](https://discuss.elastic.co/t/all-numbers-reported-by-metricbeat-too-high-bug/56094)
**Author:** [@pkrueger](https://discuss.elastic.co/u/pkrueger)\ **Replies:** 6\ **Last updated:** [October 12, 2016, 8:19pm UTC](https://discuss.elastic.co/t/all-numbers-reported-by-metricbeat-too-high-bug/56094 "2016-10-12T20:19:12Z")
I was wondering why the numbers reported for free disk space were way too high and went to investigate. Switched on debug log and found this in the log: 2016-07-21T14:33:34+02:00 DBG Publish: { "@timestamp": "2016-… --- ## [Missing event\_data fields in Winlogbeat 1.x](https://discuss.elastic.co/t/missing-event-data-fields-in-winlogbeat-1-x/62511)
**Author:** [@gmourani](https://discuss.elastic.co/u/gmourani)\ **Replies:** 4\ **Last updated:** [October 12, 2016, 1:40pm UTC](https://discuss.elastic.co/t/missing-event-data-fields-in-winlogbeat-1-x/62511 "2016-10-12T13:40:38Z")
Hello, winlogbeat 1.3 is installed and successful send event log directly to elastic on port 9200. Index is created in Kibana and I can see fields related to winlogbeat except all the "event\_data fields.\*" ! --- ## [How to disable logrotate?](https://discuss.elastic.co/t/how-to-disable-logrotate/62714)
**Author:** [@voelzmo](https://discuss.elastic.co/u/voelzmo)\ **Replies:** 2\ **Last updated:** [October 12, 2016, 12:22pm UTC](https://discuss.elastic.co/t/how-to-disable-logrotate/62714 "2016-10-12T12:22:30Z")
Hi, Following the documentation at https://www.elastic.co/guide/en/beats/packetbeat/master/configuration-logging.html I was looking for a way to disable logrotate. Is that even possible at all? How well would packetbea… --- ## [\[SOLVED\] Filebeat keeps open files forever](https://discuss.elastic.co/t/solved-filebeat-keeps-open-files-forever/40098)
**Author:** [@hamelg](https://discuss.elastic.co/u/hamelg)\ **Replies:** 22\ **Last updated:** [October 11, 2016, 6:43pm UTC](https://discuss.elastic.co/t/solved-filebeat-keeps-open-files-forever/40098 "2016-10-11T18:43:56Z")
Here is our setup : filebeat: prospectors: - paths: - "/var/log/apache2/\*access.log" document\_type: accesslog ignore\_older: 5m tail\_files: true Every day, logrotate rotates these f… --- ## [ERR Failed to RPUSH to redis list (read tcp 10.50.12.200:48343-\>172.27.30.102:6379: i/o timeout) with %!v(MISSING)](https://discuss.elastic.co/t/err-failed-to-rpush-to-redis-list-read-tcp-10-50-12-200-48343-172-27-30-102-6379-i-o-timeout-with-v-missing/62636)
**Author:** [@ivten](https://discuss.elastic.co/u/ivten)\ **Replies:** 2\ **Last updated:** [October 11, 2016, 2:09pm UTC](https://discuss.elastic.co/t/err-failed-to-rpush-to-redis-list-read-tcp-10-50-12-200-48343-172-27-30-102-6379-i-o-timeout-with-v-missing/62636 "2016-10-11T14:09:00Z")
Hi, I'm running filebeat version 5.0.0-beta1 on my local machine, with Redis output. Redis is running on an EC2 instance in AWS. I get the following errors in the filebeat log: ERR Failed to RPUSH to redis list (read… --- ## [Filebeat beta1 resends random data upon every restart (registry file not updated properly?)](https://discuss.elastic.co/t/filebeat-beta1-resends-random-data-upon-every-restart-registry-file-not-updated-properly/61813)
**Author:** [@shog](https://discuss.elastic.co/u/shog)\ **Replies:** 13\ **Last updated:** [October 11, 2016, 1:42pm UTC](https://discuss.elastic.co/t/filebeat-beta1-resends-random-data-upon-every-restart-registry-file-not-updated-properly/61813 "2016-10-11T13:42:42Z")
Hi, Filebeat Version: beta1 Logstash Version: alpha2 System: CentOS6 In my test scenario filebeat's processing around 1k files that are something around 40GB a day in total. The problem is that upon every restart of… --- ## [Path setting for rolling files](https://discuss.elastic.co/t/path-setting-for-rolling-files/62656)
**Author:** [@DavidL](https://discuss.elastic.co/u/DavidL)\ **Replies:** 1\ **Last updated:** [October 11, 2016, 12:11pm UTC](https://discuss.elastic.co/t/path-setting-for-rolling-files/62656 "2016-10-11T12:11:48Z")
Hi, I'm trying to decide for path setting, whether I should be specifying the exact file using the current file name or should I set it as a glob pattern using wild card. For exmaple: if I know my log file name is mylog.… --- ## [Filebeat rotation issue (windows)](https://discuss.elastic.co/t/filebeat-rotation-issue-windows/61671)
**Author:** [@h0nIg](https://discuss.elastic.co/u/h0nIg)\ **Replies:** 3\ **Last updated:** [October 11, 2016, 12:04pm UTC](https://discuss.elastic.co/t/filebeat-rotation-issue-windows/61671 "2016-10-11T12:04:15Z")
Hey, i'm experiencing an rotation issue on my windows machines. machine: Windows 2012 R2 version: 1.3.1 configurations: global config: https://nopaste.me/view/9ef7645a prospector config: https://nopaste.me/view/cf17461… --- ## [Where configure custom ElasticSearch host](https://discuss.elastic.co/t/where-configure-custom-elasticsearch-host/62685)
**Author:** [@Premislauer](https://discuss.elastic.co/u/Premislauer)\ **Replies:** 1\ **Last updated:** [October 11, 2016, 11:00am UTC](https://discuss.elastic.co/t/where-configure-custom-elasticsearch-host/62685 "2016-10-11T11:00:58Z")
Hi, I'm new to libbeat and i'm trying to prepare some example to working with my elasticsearch host. But i don't know where is the right place to configure host. I thought that it should be etc/beat.yml but when i do "m… --- ## [VOIP Monitoring with ELK](https://discuss.elastic.co/t/voip-monitoring-with-elk/62372)
**Author:** [@Raj\_Kumar](https://discuss.elastic.co/u/Raj_Kumar)\ **Replies:** 6\ **Last updated:** [October 11, 2016, 8:19am UTC](https://discuss.elastic.co/t/voip-monitoring-with-elk/62372 "2016-10-11T08:19:09Z")
Hi All, Am using Elastic stack for the past few months.Found it really cool and fantastic combination. But am now more concerned with VOIP monitoring .Is it possible to monitor the call quality and other factors like… --- ## [Add New Ports to Packetbeat dynamically](https://discuss.elastic.co/t/add-new-ports-to-packetbeat-dynamically/62557)
**Author:** [@s8sg](https://discuss.elastic.co/u/s8sg)\ **Replies:** 2\ **Last updated:** [October 11, 2016, 7:08am UTC](https://discuss.elastic.co/t/add-new-ports-to-packetbeat-dynamically/62557 "2016-10-11T07:08:47Z")
Currently I have packetbeat http port configuration as below: ports: \[80, 8080, 8585\] My requirement is to update the the list of port dynamically. Currently I'm doing the same by Updating the conf file packetbea… --- ## [Filebeat | Ordering Messages](https://discuss.elastic.co/t/filebeat-ordering-messages/62617)
**Author:** [@Kryten](https://discuss.elastic.co/u/Kryten)\ **Replies:** 2\ **Last updated:** [October 10, 2016, 5:56pm UTC](https://discuss.elastic.co/t/filebeat-ordering-messages/62617 "2016-10-10T17:56:23Z")
Hi, Would appreciate any advice on how the following problem might be overcome using the available options. We are sending logs using Filebeat and all is working well apart from the timestamp of the log message. The … --- ## [Filebeat 5.0beta1 with kafka output: multiplication of log lines](https://discuss.elastic.co/t/filebeat-5-0beta1-with-kafka-output-multiplication-of-log-lines/62513)
**Author:** [@psychonaut](https://discuss.elastic.co/u/psychonaut)\ **Replies:** 13\ **Last updated:** [October 10, 2016, 12:12pm UTC](https://discuss.elastic.co/t/filebeat-5-0beta1-with-kafka-output-multiplication-of-log-lines/62513 "2016-10-10T12:12:12Z")
Followup-to https://discuss.elastic.co/t/filebeat-5-0-0-alpha5-multiple-harvesters-for-same-file-sending-the-same-messages-over-and-over/59866 I have the same problems. After some time messages are marked as un-acked a… --- ## [Filebeat 5.0.0-alpha5 multiple harvesters for same file sending the same messages over and over](https://discuss.elastic.co/t/filebeat-5-0-0-alpha5-multiple-harvesters-for-same-file-sending-the-same-messages-over-and-over/59866)
**Author:** [@Tim\_Burt](https://discuss.elastic.co/u/Tim_Burt)\ **Replies:** 30\ **Last updated:** [October 10, 2016, 12:02pm UTC](https://discuss.elastic.co/t/filebeat-5-0-0-alpha5-multiple-harvesters-for-same-file-sending-the-same-messages-over-and-over/59866 "2016-10-10T12:02:27Z")
I am re opening this subject because it is also still an issue in alpha5. Using filebeat witb Kafka. Very happy with performance. Kafka disk filled up and Kafka stopped ack of lines received. Filebeats continued to… --- ## [Cross-package code coverage in golang](https://discuss.elastic.co/t/cross-package-code-coverage-in-golang/62627)
**Author:** [@kwk](https://discuss.elastic.co/u/kwk)\ **Replies:** 1\ **Last updated:** [October 10, 2016, 11:04am UTC](https://discuss.elastic.co/t/cross-package-code-coverage-in-golang/62627 "2016-10-10T11:04:23Z")
I've read the article https://www.elastic.co/blog/code-coverage-for-your-golang-system-tests and wondered, if you have managed to get cross-package coverage? To explain what I mean: Suppose you have a package A and you… --- ## [Optimal way for monitoring host and docker containers metrics](https://discuss.elastic.co/t/optimal-way-for-monitoring-host-and-docker-containers-metrics/62478)
**Author:** [@jbh6](https://discuss.elastic.co/u/jbh6)\ **Replies:** 7\ **Last updated:** [October 10, 2016, 6:56am UTC](https://discuss.elastic.co/t/optimal-way-for-monitoring-host-and-docker-containers-metrics/62478 "2016-10-10T06:56:44Z")
Hi I am trying my hands on MetricBeat and have been able to send the host system metrics to an Elastic Search cluster. But, I am facing issues with sending docker containers metrics by metric beat. Also, I am not reall… --- ## [Filebeat dynamically add new field](https://discuss.elastic.co/t/filebeat-dynamically-add-new-field/62589)
**Author:** [@ywang](https://discuss.elastic.co/u/ywang)\ **Replies:** 1\ **Last updated:** [October 10, 2016, 5:39am UTC](https://discuss.elastic.co/t/filebeat-dynamically-add-new-field/62589 "2016-10-10T05:39:22Z")
Hi expert here, I need to add a field dynamically based on a conf file locally on the host. It needs to be added for a subset of log entries based on the certain pattern of the log entry content. I read the filebeat tu… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=558) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=560)