# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=561 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 562 --- ## [How to create a new filebeat index with a custom name?](https://discuss.elastic.co/t/how-to-create-a-new-filebeat-index-with-a-custom-name/61689)
**Author:** [@jinal.shah](https://discuss.elastic.co/u/jinal.shah)\ **Replies:** 3\ **Last updated:** [October 3, 2016, 2:04pm UTC](https://discuss.elastic.co/t/how-to-create-a-new-filebeat-index-with-a-custom-name/61689 "2016-10-03T14:04:12Z")
Hello What is the best way to create a new index for filebeat and output it to elastic elasticsearch/kibana? The filebeat logs will still be parsed through logstash. So far, I have enabled this on the filebeat cli… --- ## [Issues regarding metricsbeat 5.0.0 beta](https://discuss.elastic.co/t/issues-regarding-metricsbeat-5-0-0-beta/61900)
**Author:** [@macymin](https://discuss.elastic.co/u/macymin)\ **Replies:** 2\ **Last updated:** [October 3, 2016, 1:35pm UTC](https://discuss.elastic.co/t/issues-regarding-metricsbeat-5-0-0-beta/61900 "2016-10-03T13:35:43Z")
hi today i just start to explore metricbeat, all the way we are using topbeat for the metrics. there are few issues I notice. 1 The system.process.memory.rss.pct alwasy shows 0, please see the attached screenshot for t… --- ## [Documentation issue? Default path to Filebeat configuration (/filebeat.yml)](https://discuss.elastic.co/t/documentation-issue-default-path-to-filebeat-configuration-filebeat-yml/61831)
**Author:** [@strarsis](https://discuss.elastic.co/u/strarsis)\ **Replies:** 2\ **Last updated:** [October 3, 2016, 8:32am UTC](https://discuss.elastic.co/t/documentation-issue-default-path-to-filebeat-configuration-filebeat-yml/61831 "2016-10-03T08:32:05Z")
(Filebeat version 1.3.1) In Filebeat command line help (filebeat --help), the default configuration file path is indicated as "/filebeat.yml". However, practically testing this shows that it actually looks for the c… --- ## [Options to compress topbeat index](https://discuss.elastic.co/t/options-to-compress-topbeat-index/61894)
**Author:** [@talk2cshah](https://discuss.elastic.co/u/talk2cshah)\ **Replies:** 2\ **Last updated:** [October 3, 2016, 8:23am UTC](https://discuss.elastic.co/t/options-to-compress-topbeat-index/61894 "2016-10-03T08:23:58Z")
Hi Team, We have topbeat agent running on 10 systems and 10 second pulse. It is further configured for process, CPU and system logs. the average payload per 10s is 150KB ~300KB resulting in 300 MB per server per day re… --- ## [How to decode non-text logs](https://discuss.elastic.co/t/how-to-decode-non-text-logs/61796)
**Author:** [@harrytewkesbury](https://discuss.elastic.co/u/harrytewkesbury)\ **Replies:** 3\ **Last updated:** [October 3, 2016, 8:18am UTC](https://discuss.elastic.co/t/how-to-decode-non-text-logs/61796 "2016-10-03T08:18:48Z")
Hi, We have some logs in the "FixLog" format, for which users can generally use a tool called fixlog on the machine to read them as one would use the "less" command. http://www.fixtradingcommunity.org/ http://fixlogv… --- ## [Filebeat not publishing to logstash](https://discuss.elastic.co/t/filebeat-not-publishing-to-logstash/60468)
**Author:** [@gilisade](https://discuss.elastic.co/u/gilisade)\ **Replies:** 5\ **Last updated:** [October 3, 2016, 7:33am UTC](https://discuss.elastic.co/t/filebeat-not-publishing-to-logstash/60468 "2016-10-03T07:33:31Z")
hi there i have filebeat alpha 5.0 when i try to publish it directly to elasticsearch everythin works fine but when i change the output to logstash no data is comming through and i get the following errors 2016-09-14T… --- ## [Filebeat not closing deleted files redux](https://discuss.elastic.co/t/filebeat-not-closing-deleted-files-redux/60946)
**Author:** [@m0thra](https://discuss.elastic.co/u/m0thra)\ **Replies:** 9\ **Last updated:** [October 3, 2016, 7:21am UTC](https://discuss.elastic.co/t/filebeat-not-closing-deleted-files-redux/60946 "2016-10-03T07:21:39Z")
Apologies, I know this issue has been asked several times, but still not sure exactly how to configure my way out of it. We are running 1.3.0 on Linux. Our application rotates log files, and at times of major error, c… --- ## [How to deal with log archivation?](https://discuss.elastic.co/t/how-to-deal-with-log-archivation/61631)
**Author:** [@budm](https://discuss.elastic.co/u/budm)\ **Replies:** 1\ **Last updated:** [October 3, 2016, 7:20am UTC](https://discuss.elastic.co/t/how-to-deal-with-log-archivation/61631 "2016-10-03T07:20:27Z")
In our project we scheduled archiving of log-files so they do not get too large. But the problem is filebeat harvests files periodically depending on backoff and max\_backoff parameters. But what if some log entry is wr… --- ## [Will Beats replace Logstash Plugins?](https://discuss.elastic.co/t/will-beats-replace-logstash-plugins/62012)
**Author:** [@TWalter](https://discuss.elastic.co/u/TWalter)\ **Replies:** 1\ **Last updated:** [October 2, 2016, 11:06pm UTC](https://discuss.elastic.co/t/will-beats-replace-logstash-plugins/62012 "2016-10-02T23:06:36Z")
Hello there, Logstash has a lot of Input-Plugins. Will them replaced by a lot of Beats in the future? For instance in the future, you have no more a jdbc Plugin but a jdbc Beat? Is this one Aim of Beats? Thank… --- ## [Old file with new name found](https://discuss.elastic.co/t/old-file-with-new-name-found/41766)
**Author:** [@lwhitworth](https://discuss.elastic.co/u/lwhitworth)\ **Replies:** 30\ **Last updated:** [October 2, 2016, 7:48pm UTC](https://discuss.elastic.co/t/old-file-with-new-name-found/41766 "2016-10-02T19:48:19Z")
I'm seeing an issue where filebeat is detecting: "Old file with new name found" an awful lot for files are most certainly not renames. Full log of one instance is: 2016-02-15T11:03:00Z INFO Old file with new name foun… --- ## [Issue in filebeat when file got rollover and deleted](https://discuss.elastic.co/t/issue-in-filebeat-when-file-got-rollover-and-deleted/61369)
**Author:** [@santhu227](https://discuss.elastic.co/u/santhu227)\ **Replies:** 3\ **Last updated:** [October 2, 2016, 7:43pm UTC](https://discuss.elastic.co/t/issue-in-filebeat-when-file-got-rollover-and-deleted/61369 "2016-10-02T19:43:00Z")
Hi all., We are using filebeat to push log to elastic search via logstash. Under heavy load the log is rolling over for every half an hour later once it crossed the number of files specified in log4j ( for say max roll… --- ## [Canonical packer sources?](https://discuss.elastic.co/t/canonical-packer-sources/61925)
**Author:** [@raboof](https://discuss.elastic.co/u/raboof)\ **Replies:** 2\ **Last updated:** [October 1, 2016, 5:27pm UTC](https://discuss.elastic.co/t/canonical-packer-sources/61925 "2016-10-01T17:27:07Z")
I noticed we have a https://github.com/elastic/beats-packer repository, but also https://github.com/elastic/beats/tree/master/dev-tools/packer inside the beats repo. The beats repo seems to have more recent changes. Do… --- ## [Defining period of sending logs](https://discuss.elastic.co/t/defining-period-of-sending-logs/60793)
**Author:** [@Saurabh\_Jambhule](https://discuss.elastic.co/u/Saurabh_Jambhule)\ **Replies:** 4\ **Last updated:** [October 1, 2016, 4:52pm UTC](https://discuss.elastic.co/t/defining-period-of-sending-logs/60793 "2016-10-01T16:52:35Z")
How to define how often an event is sent to the output? I want to send logs after every 10 min. not continuously. Thank you. --- ## [Filebeat not publishing logs to KAFKA](https://discuss.elastic.co/t/filebeat-not-publishing-logs-to-kafka/61733)
**Author:** [@Tarini\_Dash](https://discuss.elastic.co/u/Tarini_Dash)\ **Replies:** 4\ **Last updated:** [September 29, 2016, 1:52pm UTC](https://discuss.elastic.co/t/filebeat-not-publishing-logs-to-kafka/61733 "2016-09-29T13:52:17Z")
Filebeat version: Filebeat-5.0.0-beta1 run with command : ./filebeat -c -e filebeat.yml -d "\*" Output logs 2016/09/28 18:03:11.714193 output.go:109: DBG output worker: publish 588 events 2016/09/28 18:03:11.714230 … --- ## [Filebeat custom scripts](https://discuss.elastic.co/t/filebeat-custom-scripts/61679)
**Author:** [@n1k](https://discuss.elastic.co/u/n1k)\ **Replies:** 1\ **Last updated:** [September 29, 2016, 9:53am UTC](https://discuss.elastic.co/t/filebeat-custom-scripts/61679 "2016-09-29T09:53:57Z")
Is there way to have some custom script running on beat server which will generate some data/logs and that we can ship to elasticsearch or logstash? --- ## [Using filename from filebeat in index pattern](https://discuss.elastic.co/t/using-filename-from-filebeat-in-index-pattern/61602)
**Author:** [@Anubhav\_Bimbisariye](https://discuss.elastic.co/u/Anubhav_Bimbisariye)\ **Replies:** 1\ **Last updated:** [September 29, 2016, 9:52am UTC](https://discuss.elastic.co/t/using-filename-from-filebeat-in-index-pattern/61602 "2016-09-29T09:52:16Z")
paths: - /var/log/\*.log The output is elasticsearch. the logs are already formatted in json, I just want index to reflect where the logs come from. In my scenario, anyone may put a file abcd.log in the logs folde… --- ## [Error setting 'packetbeat.protocols.http.ports' with environment variable](https://discuss.elastic.co/t/error-setting-packetbeat-protocols-http-ports-with-environment-variable/61559)
**Author:** [@gunzy83](https://discuss.elastic.co/u/gunzy83)\ **Replies:** 1\ **Last updated:** [September 29, 2016, 9:46am UTC](https://discuss.elastic.co/t/error-setting-packetbeat-protocols-http-ports-with-environment-variable/61559 "2016-09-29T09:46:58Z")
I have run into an issue with 5.0.0-beta1 that I would like to report or ensure it is not PEBCAK. I am configuring packetbeat to monitor a single service in a docker container that exposes itself on host port MONITORED\_P… --- ## [Filebeat not able to send log to different cloud](https://discuss.elastic.co/t/filebeat-not-able-to-send-log-to-different-cloud/60976)
**Author:** [@vsairam](https://discuss.elastic.co/u/vsairam)\ **Replies:** 13\ **Last updated:** [September 29, 2016, 9:38am UTC](https://discuss.elastic.co/t/filebeat-not-able-to-send-log-to-different-cloud/60976 "2016-09-29T09:38:08Z")
Hi Team, I have added a new node and installed the filebeat. It needs to send the logs from the node to the logstash server installed another cloud. Am not able to see the logs in the Kibana GUI. Here is the straight… --- ## [Monitor Network Traffic](https://discuss.elastic.co/t/monitor-network-traffic/61701)
**Author:** [@benkhlifafahmi](https://discuss.elastic.co/u/benkhlifafahmi)\ **Replies:** 1\ **Last updated:** [September 29, 2016, 9:10am UTC](https://discuss.elastic.co/t/monitor-network-traffic/61701 "2016-09-29T09:10:16Z")
Hi I want to monitor my network traffic ( Recived / Sent data per seconds) i have tried to use metricbeat and collectd but they failed to give me what i need they keep giving me accumulated data. Is there any suggestion … --- ## [How can I get Logstash host name in filbeat for ELK docker container](https://discuss.elastic.co/t/how-can-i-get-logstash-host-name-in-filbeat-for-elk-docker-container/61640)
**Author:** [@rai](https://discuss.elastic.co/u/rai)\ **Replies:** 2\ **Last updated:** [September 28, 2016, 6:25pm UTC](https://discuss.elastic.co/t/how-can-i-get-logstash-host-name-in-filbeat-for-elk-docker-container/61640 "2016-09-28T18:25:52Z")
I have created a docker container for ELK stack (mean ELK components are running on same container) and another docker container for filebeat and both containers are running on different physical machines. My question is… --- ## [Filebeat not sending logs to E.L.K server’s logstash](https://discuss.elastic.co/t/filebeat-not-sending-logs-to-e-l-k-server-s-logstash/61697)
**Author:** [@napoleon182](https://discuss.elastic.co/u/napoleon182)\ **Replies:** 4\ **Last updated:** [September 28, 2016, 5:44pm UTC](https://discuss.elastic.co/t/filebeat-not-sending-logs-to-e-l-k-server-s-logstash/61697 "2016-09-28T17:44:18Z")
Hi All, I recently installed filebeat to forward logs from ubuntu 14.04 server into my ELK's logstash, however i cannot see anything in kibana4's dashboards, I'm able to ping and telnet into logstash, Any help is much … --- ## [Winlogbeats 5 processors configuration question](https://discuss.elastic.co/t/winlogbeats-5-processors-configuration-question/61648)
**Author:** [@cord\_thomas](https://discuss.elastic.co/u/cord_thomas)\ **Replies:** 3\ **Last updated:** [September 28, 2016, 3:29pm UTC](https://discuss.elastic.co/t/winlogbeats-5-processors-configuration-question/61648 "2016-09-28T15:29:00Z")
We've been using winlogbeat 1.3 for months now and have wanted to be able to pre-process the data shipped by event and trim the fields sent. Seems like the new features in the Beta 5 would offer this. I am getting an e… --- ## [Error filebeast from Windows machine to vmware Ubuntu machine](https://discuss.elastic.co/t/error-filebeast-from-windows-machine-to-vmware-ubuntu-machine/39442)
**Author:** [@carmelom](https://discuss.elastic.co/u/carmelom)\ **Replies:** 7\ **Last updated:** [September 28, 2016, 12:43pm UTC](https://discuss.elastic.co/t/error-filebeast-from-windows-machine-to-vmware-ubuntu-machine/39442 "2016-09-28T12:43:46Z")
Good Morning, I am trying to send logs from filebeats (in a windows machine) to logstash (in a vmware ubuntu machine) but I got this error: Connecting error publishing events (retrying): dial tcp 192.168.220.130:5044: co… --- ## [Winlogbeat Redis Logstash Elasticsearch](https://discuss.elastic.co/t/winlogbeat-redis-logstash-elasticsearch/61511)
**Author:** [@NachoPerez](https://discuss.elastic.co/u/NachoPerez)\ **Replies:** 4\ **Last updated:** [September 27, 2016, 6:15am UTC](https://discuss.elastic.co/t/winlogbeat-redis-logstash-elasticsearch/61511 "2016-09-27T06:15:40Z")
Hi everybody, I have a cluster LS/ES of 6 Nodes (5 Data + 1 Kibana) LS-Version = 2.3.4 ES-Version = 2.4.0.1 I Send events from server linux with logstash-forwarder and send events with winlogbeat from windows serve… --- ## ["Beats input: unhandled exception", :exception=\>#RuntimeError: Unknown frame type: \`48\`](https://discuss.elastic.co/t/beats-input-unhandled-exception-exception-runtimeerror-unknown-frame-type-48/61399)
**Author:** [@rlonberg](https://discuss.elastic.co/u/rlonberg)\ **Replies:** 2\ **Last updated:** [September 23, 2016, 8:39pm UTC](https://discuss.elastic.co/t/beats-input-unhandled-exception-exception-runtimeerror-unknown-frame-type-48/61399 "2016-09-23T20:39:16Z")
Hi All, I've been running the ELK stack successfully for a few weeks now, my setup is: filebeat+winlogbeat+topbeat on remote windows servers --to--\> logstash on a linux env. However, recently my logstash instance has… --- ## [Elastic Beats as a superior log shipping service to NXlog?](https://discuss.elastic.co/t/elastic-beats-as-a-superior-log-shipping-service-to-nxlog/60324)
**Author:** [@rlonberg](https://discuss.elastic.co/u/rlonberg)\ **Replies:** 4\ **Last updated:** [September 23, 2016, 3:48pm UTC](https://discuss.elastic.co/t/elastic-beats-as-a-superior-log-shipping-service-to-nxlog/60324 "2016-09-23T15:48:59Z")
I am currently evaluating the benefits of replacing NXlog with winlogbeat as my primary service for remotely shipping logs from various windows servers to a linux logstash instance. Could someone help me understand why… --- ## [Filebeat no more working - Can not index event (status=400)](https://discuss.elastic.co/t/filebeat-no-more-working-can-not-index-event-status-400/61227)
**Author:** [@toasti](https://discuss.elastic.co/u/toasti)\ **Replies:** 8\ **Last updated:** [September 23, 2016, 1:50pm UTC](https://discuss.elastic.co/t/filebeat-no-more-working-can-not-index-event-status-400/61227 "2016-09-23T13:50:31Z")
Hello there, Since today at 2am my filebat was working well, now I got no more data and the following error messages: 2016-09-22T11:53:04+02:00 WARN Can not index event (status=400): "MapperParsingException\[mapping \[… --- ## [Beta-1 packages in yum repository are not signed?](https://discuss.elastic.co/t/beta-1-packages-in-yum-repository-are-not-signed/61346)
**Author:** [@cero-t](https://discuss.elastic.co/u/cero-t)\ **Replies:** 3\ **Last updated:** [September 23, 2016, 10:32am UTC](https://discuss.elastic.co/t/beta-1-packages-in-yum-repository-are-not-signed/61346 "2016-09-23T10:32:12Z")
Hi, I tried to install Elasticsearch / Kibana / Beats on Amazon Linux by yum command following the document. https://www.elastic.co/guide/en/beats/libbeat/master/setup-repositories.html But I could not finish yum comma… --- ## [Filebeat - send a full config file every time is modified?](https://discuss.elastic.co/t/filebeat-send-a-full-config-file-every-time-is-modified/61318)
**Author:** [@agonzalez](https://discuss.elastic.co/u/agonzalez)\ **Replies:** 2\ **Last updated:** [September 23, 2016, 6:54am UTC](https://discuss.elastic.co/t/filebeat-send-a-full-config-file-every-time-is-modified/61318 "2016-09-23T06:54:08Z")
How can i configure filebeat prospector to send the full content of a config file every time is modified? Per example i want to send the full /etc/httpd/conf/httpd.conf file as a document everytime it is modified, not… --- ## [Build your own beat](https://discuss.elastic.co/t/build-your-own-beat/61186)
**Author:** [@overip](https://discuss.elastic.co/u/overip)\ **Replies:** 3\ **Last updated:** [September 22, 2016, 6:19pm UTC](https://discuss.elastic.co/t/build-your-own-beat/61186 "2016-09-22T18:19:22Z")
Hello everybody, I am following the tutorial on how to build your own beat from https://www.elastic.co/blog/build-your-own-beat and I can't see where to put my go code. The whole process described in the tutorial is pret… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=560) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=562)