# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=560 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 561 --- ## [Filebeat configuration by giving multiple output log-stash host details](https://discuss.elastic.co/t/filebeat-configuration-by-giving-multiple-output-log-stash-host-details/62509)
**Author:** [@srikanth\_ramineni](https://discuss.elastic.co/u/srikanth_ramineni)\ **Replies:** 1\ **Last updated:** [October 7, 2016, 9:57pm UTC](https://discuss.elastic.co/t/filebeat-configuration-by-giving-multiple-output-log-stash-host-details/62509 "2016-10-07T21:57:09Z")
can we specify two host ids in file beat configuration? If we specify will data will distribute to different servers or same data will go different servers. In filebeat.yml file we have given configuration like below h… --- ## [Event messages are splitted in event\_data.param xy? How to fix that?](https://discuss.elastic.co/t/event-messages-are-splitted-in-event-data-param-xy-how-to-fix-that/61087)
**Author:** [@toasti](https://discuss.elastic.co/u/toasti)\ **Replies:** 4\ **Last updated:** [October 7, 2016, 4:21pm UTC](https://discuss.elastic.co/t/event-messages-are-splitted-in-event-data-param-xy-how-to-fix-that/61087 "2016-10-07T16:21:30Z")
Hello there, I have installed ELKwin from https://www.itefix.net/elkwin - very nice solution to get the ELK-Stack running in seconds. If I'm honest, I am very new to the ELK-Stack and it is not so easy to start... On… --- ## [Winlogbeat creates indexes based on dates from the past](https://discuss.elastic.co/t/winlogbeat-creates-indexes-based-on-dates-from-the-past/62403)
**Author:** [@gmourani](https://discuss.elastic.co/u/gmourani)\ **Replies:** 4\ **Last updated:** [October 7, 2016, 3:38pm UTC](https://discuss.elastic.co/t/winlogbeat-creates-indexes-based-on-dates-from-the-past/62403 "2016-10-07T15:38:44Z")
Hello, I've a strange problem with winlogbeat. I've installed winlogbeat 1.3 on servers and receive directly on elastic port 9200 corrupted log that create indexes starting from December 2015 through now! Event if I de… --- ## [Metricbeat - network usage data for dashboard](https://discuss.elastic.co/t/metricbeat-network-usage-data-for-dashboard/61906)
**Author:** [@mha](https://discuss.elastic.co/u/mha)\ **Replies:** 3\ **Last updated:** [October 7, 2016, 2:49pm UTC](https://discuss.elastic.co/t/metricbeat-network-usage-data-for-dashboard/61906 "2016-10-07T14:49:45Z")
Hi This one is already closed: but I still think that it would be really nice feature to have network usage stored also as not incremental values. It would make network dashboard usable (incremental one is useless), a… --- ## [Matching a word with filebeat multiline](https://discuss.elastic.co/t/matching-a-word-with-filebeat-multiline/62417)
**Author:** [@latiperneni](https://discuss.elastic.co/u/latiperneni)\ **Replies:** 2\ **Last updated:** [October 7, 2016, 12:07pm UTC](https://discuss.elastic.co/t/matching-a-word-with-filebeat-multiline/62417 "2016-10-07T12:07:39Z")
I am using Filebeat multiline pattern in filebeat.yml that is taking its input from a single file that has the following line indicating the start of a request 2016-10-06 09:40:01.775 DEBUG 10454 --- \[XNIO-2 task-9\] c.… --- ## [Missing a lot of logs sent via filebeats](https://discuss.elastic.co/t/missing-a-lot-of-logs-sent-via-filebeats/61185)
**Author:** [@Maxwell\_Flanders](https://discuss.elastic.co/u/Maxwell_Flanders)\ **Replies:** 8\ **Last updated:** [October 7, 2016, 9:56am UTC](https://discuss.elastic.co/t/missing-a-lot-of-logs-sent-via-filebeats/61185 "2016-10-07T09:56:55Z")
We seem to be losing a lot of logs from just a couple of servers that we collect and send via filebeats. This is our basic configuration: filebeat: prospectors: \[\] registry\_file: "/var/lib/filebeat/registry" conf… --- ## [Packetbeat index not created and no info from Kibana](https://discuss.elastic.co/t/packetbeat-index-not-created-and-no-info-from-kibana/62197)
**Author:** [@Kernel\_Panic](https://discuss.elastic.co/u/Kernel_Panic)\ **Replies:** 17\ **Last updated:** [October 7, 2016, 6:56am UTC](https://discuss.elastic.co/t/packetbeat-index-not-created-and-no-info-from-kibana/62197 "2016-10-07T06:56:25Z")
Hi there guys, I'm new to ELK stack, I was able to install ELK, I can see some dashbords, topbeat for example, I can discover over filebeat index also but no luck with packet beat, this is what I've got. curl 'localho… --- ## [Can you test if Filebeat can read from a file?](https://discuss.elastic.co/t/can-you-test-if-filebeat-can-read-from-a-file/62435)
**Author:** [@jnpetty](https://discuss.elastic.co/u/jnpetty)\ **Replies:** 1\ **Last updated:** [October 6, 2016, 9:15pm UTC](https://discuss.elastic.co/t/can-you-test-if-filebeat-can-read-from-a-file/62435 "2016-10-06T21:15:27Z")
So I have Filebeat configured to check a few .log and a few .txt files. But no data is showing up in ElasticSearch. For testing purposes I reconfigured filebeat to output to a local file and no data is showing up within … --- ## [Packaging community beats](https://discuss.elastic.co/t/packaging-community-beats/61917)
**Author:** [@raboof](https://discuss.elastic.co/u/raboof)\ **Replies:** 6\ **Last updated:** [October 6, 2016, 2:48pm UTC](https://discuss.elastic.co/t/packaging-community-beats/61917 "2016-10-06T14:48:50Z")
Hello, I'm having some trouble getting 'make package' to work with my community beat. To rule out things specific to my beat, I've reproduced the problem with a freshly generated example beat. Below is a log of gener… --- ## [Filebeat log sending problem](https://discuss.elastic.co/t/filebeat-log-sending-problem/62244)
**Author:** [@abu.sayeed](https://discuss.elastic.co/u/abu.sayeed)\ **Replies:** 6\ **Last updated:** [October 6, 2016, 1:58pm UTC](https://discuss.elastic.co/t/filebeat-log-sending-problem/62244 "2016-10-06T13:58:12Z")
Server Side java -version java version "1.8.0\_101" elasticsearch version "5.0.0-beta1", bin/kibana --version 5.0.0-beta1 bin/logstash --version logstash 5.0.0-beta1 /etc/logstash/conf.d/02-beats-input.conf … --- ## [How to create a new Beats output?](https://discuss.elastic.co/t/how-to-create-a-new-beats-output/61074)
**Author:** [@Geetha\_Adinarayan](https://discuss.elastic.co/u/Geetha_Adinarayan)\ **Replies:** 9\ **Last updated:** [October 6, 2016, 12:47pm UTC](https://discuss.elastic.co/t/how-to-create-a-new-beats-output/61074 "2016-10-06T12:47:33Z")
Is there a standard interface/framework to create a new beats output. To be specific, we want to create a new output using which beats can send data to IBM Bluemix (logmet service). Currently we have taken logstash ou… --- ## [Filebeat and disk space](https://discuss.elastic.co/t/filebeat-and-disk-space/62246)
**Author:** [@orubin](https://discuss.elastic.co/u/orubin)\ **Replies:** 2\ **Last updated:** [October 6, 2016, 11:03am UTC](https://discuss.elastic.co/t/filebeat-and-disk-space/62246 "2016-10-06T11:03:58Z")
Hi, I'm using filebeat 1.2.3-1 and it generally works fine on most of our servers. Some of our servers log files using log4j and its log rotation mechanism. It looks like filebeat never closes the file handle for the las… --- ## [Problem in the configuaration file of topbeat.yml](https://discuss.elastic.co/t/problem-in-the-configuaration-file-of-topbeat-yml/49853)
**Author:** [@preehana](https://discuss.elastic.co/u/preehana)\ **Replies:** 6\ **Last updated:** [October 6, 2016, 8:45am UTC](https://discuss.elastic.co/t/problem-in-the-configuaration-file-of-topbeat-yml/49853 "2016-10-06T08:45:13Z")
I am new to topbeat and had made the following changes in the configuration file of topbeat. input: # In seconds, defines how often to read server statistics period: 1 # Regular expression to match the processe… --- ## [Accessing environment variable in config file in a custom made beats](https://discuss.elastic.co/t/accessing-environment-variable-in-config-file-in-a-custom-made-beats/62241)
**Author:** [@wing999](https://discuss.elastic.co/u/wing999)\ **Replies:** 2\ **Last updated:** [October 6, 2016, 2:36am UTC](https://discuss.elastic.co/t/accessing-environment-variable-in-config-file-in-a-custom-made-beats/62241 "2016-10-06T02:36:54Z")
I have built a custom made beats based on libbeat and I want to use environment variable as a value in the config file. However, if I type ${VAR} in the config file and I run config test, I got: ./countbeat -c countbeat… --- ## [Filebeat Regex problem - Escape pipe and colon](https://discuss.elastic.co/t/filebeat-regex-problem-escape-pipe-and-colon/62288)
**Author:** [@neuronring](https://discuss.elastic.co/u/neuronring)\ **Replies:** 1\ **Last updated:** [October 6, 2016, 1:21am UTC](https://discuss.elastic.co/t/filebeat-regex-problem-escape-pipe-and-colon/62288 "2016-10-06T01:21:07Z")
I have configured filebeat on my windows server where i need to look for the lines matching the below pattern. Since the line itself has a pipe symbol "|" and a colon ":" the filebeat is considering it as OR condition an… --- ## [Filebeat missing files](https://discuss.elastic.co/t/filebeat-missing-files/61028)
**Author:** [@bbach](https://discuss.elastic.co/u/bbach)\ **Replies:** 18\ **Last updated:** [October 6, 2016, 12:17am UTC](https://discuss.elastic.co/t/filebeat-missing-files/61028 "2016-10-06T00:17:11Z")
Hi, filebeat version 1.3.1 (amd64) logstash 2.3.4 elasticsearch Version: 2.3.5, Build: 90f439f/2016-07-27T10:36:52Z, JVM: 1.8.0\_101 all running on Ubuntu 14.04 I have 40 or so servers feeding application logs wit… --- ## [Metricset 'postgresql/bgwriter' is not registered, module not found](https://discuss.elastic.co/t/metricset-postgresql-bgwriter-is-not-registered-module-not-found/61020)
**Author:** [@agonzalez](https://discuss.elastic.co/u/agonzalez)\ **Replies:** 22\ **Last updated:** [October 5, 2016, 9:36pm UTC](https://discuss.elastic.co/t/metricset-postgresql-bgwriter-is-not-registered-module-not-found/61020 "2016-10-05T21:36:19Z")
I have configure metricbeat to send postgresql metric but get this error when starting filebeat: 2016/09/20 13:54:29.102566 metricbeat.go:26: INFO Register \[ModuleFactory:\[\], MetricSetFactory:\[apache/status, mongodb/st… --- ## [Missing core fields in index](https://discuss.elastic.co/t/missing-core-fields-in-index/61946)
**Author:** [@ejether](https://discuss.elastic.co/u/ejether)\ **Replies:** 6\ **Last updated:** [October 5, 2016, 7:39pm UTC](https://discuss.elastic.co/t/missing-core-fields-in-index/61946 "2016-10-05T19:39:28Z")
I'm having an odd issue where some of my log events getting shipped are missing the normal fields like beats.hostname, source etc. I'm not sure where to start to troubleshoot. I have a mix of Cento6 and Centos7 all run… --- ## [Filebeat Not Resuming Rotated File(s)](https://discuss.elastic.co/t/filebeat-not-resuming-rotated-file-s/62278)
**Author:** [@ben-10](https://discuss.elastic.co/u/ben-10)\ **Replies:** 1\ **Last updated:** [October 5, 2016, 6:57pm UTC](https://discuss.elastic.co/t/filebeat-not-resuming-rotated-file-s/62278 "2016-10-05T18:57:55Z")
Lots of messages (765 so far today) with the following in my filebeats log file: filebeat version 1.3.0 (amd64) Description: Oracle Linux Server release 6.7 VM with 4vCPU and 8G RAM Four prospectors with 2-9 indi… --- ## [Problem in building libbeat according to the developer guide](https://discuss.elastic.co/t/problem-in-building-libbeat-according-to-the-developer-guide/61069)
**Author:** [@wing999](https://discuss.elastic.co/u/wing999)\ **Replies:** 3\ **Last updated:** [October 5, 2016, 6:29pm UTC](https://discuss.elastic.co/t/problem-in-building-libbeat-according-to-the-developer-guide/61069 "2016-10-05T18:29:24Z")
Hello All, I am following the "Developer Guide: Creating a New Beat" and trying to develop my own beat. However, I have encountered a problem in the step "Building and Running the Beat". After I execute "make", I get t… --- ## [Log files that dont exist](https://discuss.elastic.co/t/log-files-that-dont-exist/62202)
**Author:** [@jnpetty](https://discuss.elastic.co/u/jnpetty)\ **Replies:** 2\ **Last updated:** [October 4, 2016, 9:32pm UTC](https://discuss.elastic.co/t/log-files-that-dont-exist/62202 "2016-10-04T21:32:01Z")
Lets say I want to maintain a single filebeat.yml file for all of our servers. Obviously all of the servers server different applications. What what would happen if a filebeat.yml had 50 input log files, but only one or … --- ## [Multiple document type index](https://discuss.elastic.co/t/multiple-document-type-index/62181)
**Author:** [@gentitope](https://discuss.elastic.co/u/gentitope)\ **Replies:** 1\ **Last updated:** [October 4, 2016, 8:35pm UTC](https://discuss.elastic.co/t/multiple-document-type-index/62181 "2016-10-04T20:35:49Z")
Hi, I want to send log to logstash from different path to seperate indices. filebeat: prospectors: - paths: - /data/\*.log input\_type: log document\_type: firstlog - paths: … --- ## [Help with Filebeat for Windows](https://discuss.elastic.co/t/help-with-filebeat-for-windows/62109)
**Author:** [@jnpetty](https://discuss.elastic.co/u/jnpetty)\ **Replies:** 5\ **Last updated:** [October 4, 2016, 4:47pm UTC](https://discuss.elastic.co/t/help-with-filebeat-for-windows/62109 "2016-10-04T16:47:40Z")
I am trying to test out filebeat on a Windows server. Currently I am echoing into a test file that filebeat is monitoring and then output to another file to see what the output looks like. I am writing to the test file w… --- ## [Loadbalance duplicating the events using logstash](https://discuss.elastic.co/t/loadbalance-duplicating-the-events-using-logstash/61342)
**Author:** [@avinash](https://discuss.elastic.co/u/avinash)\ **Replies:** 7\ **Last updated:** [October 4, 2016, 1:51pm UTC](https://discuss.elastic.co/t/loadbalance-duplicating-the-events-using-logstash/61342 "2016-10-04T13:51:30Z")
I have configuration as filebeat with loadbalance true & two logstash hosts i.e. logstash1 & logstash2 which are input to elasticsearch. The filebeat configurtion for logstash is as below prospectors: - paths… --- ## [Filebeat beta1: Insane memory footprint](https://discuss.elastic.co/t/filebeat-beta1-insane-memory-footprint/61998)
**Author:** [@shog](https://discuss.elastic.co/u/shog)\ **Replies:** 3\ **Last updated:** [October 4, 2016, 1:31pm UTC](https://discuss.elastic.co/t/filebeat-beta1-insane-memory-footprint/61998 "2016-10-04T13:31:03Z")
Hi, Version: Filebeat beta1 System: CentOS6 I observe an insane memory footprint of filebeat beta1. PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 23818 filebeat 15 -5 3… --- ## [Pingbeat: Recommended architectures?](https://discuss.elastic.co/t/pingbeat-recommended-architectures/62019)
**Author:** [@viztastic](https://discuss.elastic.co/u/viztastic)\ **Replies:** 2\ **Last updated:** [October 4, 2016, 1:15pm UTC](https://discuss.elastic.co/t/pingbeat-recommended-architectures/62019 "2016-10-04T13:15:11Z")
Usecase My use case involves 200,000+ network assets and Pingbeat seems like a good tool to monitor their availability and round trip time. Constraint The issue is that our client expects continuous monitoring as th… --- ## [Filebeat best way to secure credentials?](https://discuss.elastic.co/t/filebeat-best-way-to-secure-credentials/61704)
**Author:** [@agonzalez](https://discuss.elastic.co/u/agonzalez)\ **Replies:** 17\ **Last updated:** [October 4, 2016, 4:36am UTC](https://discuss.elastic.co/t/filebeat-best-way-to-secure-credentials/61704 "2016-10-04T04:36:45Z")
What is best way to secure credentials on filebeat configuration? If i put username/password on yml file, anyone customer can login and read them and login into elasticsearch. --- ## [Filebeat multiline - escaping curly parenthesis](https://discuss.elastic.co/t/filebeat-multiline-escaping-curly-parenthesis/62092)
**Author:** [@zoplex](https://discuss.elastic.co/u/zoplex)\ **Replies:** 5\ **Last updated:** [October 3, 2016, 6:25pm UTC](https://discuss.elastic.co/t/filebeat-multiline-escaping-curly-parenthesis/62092 "2016-10-03T18:25:10Z")
We have filebeat.yml that processes multiline filter as: multiline: pattern: '^\\{Heap before' negate: true match: after we want to start new record whenever the pattern "{Heap before" is encountered; we see… --- ## [Winlogbeat beta 5 - not dropping fields](https://discuss.elastic.co/t/winlogbeat-beta-5-not-dropping-fields/62096)
**Author:** [@cord\_thomas](https://discuss.elastic.co/u/cord_thomas)\ **Replies:** 1\ **Last updated:** [October 3, 2016, 6:16pm UTC](https://discuss.elastic.co/t/winlogbeat-beta-5-not-dropping-fields/62096 "2016-10-03T18:16:01Z")
We are trying to anonymize some data by dropping some identifying data using the drop\_fields feature of winlogbeat 5. As I write this post, i think i am understanding the problem - does anyone have a suggestion? We… --- ## [Filebeat beta1 not working for my prospectors .yml file that was working on alpha 5](https://discuss.elastic.co/t/filebeat-beta1-not-working-for-my-prospectors-yml-file-that-was-working-on-alpha-5/61832)
**Author:** [@agonzalez](https://discuss.elastic.co/u/agonzalez)\ **Replies:** 7\ **Last updated:** [October 3, 2016, 3:48pm UTC](https://discuss.elastic.co/t/filebeat-beta1-not-working-for-my-prospectors-yml-file-that-was-working-on-alpha-5/61832 "2016-10-03T15:48:28Z")
I have a large prospector list that was working fine on 5.0-alpha5. If i upgrade filebeat to beta1 no logs are seen in kibana. I dont see any error on /var/log. If i downgrade to alpha5 logs can be seen on kibana agai… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=559) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=561)