# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=562 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 563 --- ## [Grabbing logs no older than X from randomly created logs](https://discuss.elastic.co/t/grabbing-logs-no-older-than-x-from-randomly-created-logs/61257)
**Author:** [@jziemba](https://discuss.elastic.co/u/jziemba)\ **Replies:** 0\ **Last updated:** [September 22, 2016, 1:02pm UTC](https://discuss.elastic.co/t/grabbing-logs-no-older-than-x-from-randomly-created-logs/61257 "2016-09-22T13:02:27Z")
I am new to the ELK stack and my issue is that I am using Filebeat to grab logs from one of the servers that we have, however we only want to see logs that are 14 days old or newer. The logs that we are looking at don't … --- ## [How to send just one response header in Packetbeat?](https://discuss.elastic.co/t/how-to-send-just-one-response-header-in-packetbeat/61213)
**Author:** [@KIVagant](https://discuss.elastic.co/u/KIVagant)\ **Replies:** 2\ **Last updated:** [September 22, 2016, 11:26am UTC](https://discuss.elastic.co/t/how-to-send-just-one-response-header-in-packetbeat/61213 "2016-09-22T11:26:34Z")
Hello. I want to catch the 'x-custom' header in logstash from packetbeat. In configuration I have "send\_headers" key, bit it is not working for response. http: ... # send\_all\_headers: true # with this opti… --- ## [Beats on Power AIX?](https://discuss.elastic.co/t/beats-on-power-aix/61218)
**Author:** [@AurelienB](https://discuss.elastic.co/u/AurelienB)\ **Replies:** 1\ **Last updated:** [September 22, 2016, 11:07am UTC](https://discuss.elastic.co/t/beats-on-power-aix/61218 "2016-09-22T11:07:47Z")
Hello, I'm wondering if an AIX Power versions of Beats (especially MetricBeats) is planned, and if not, how difficult it would be to compile it on an AIX Power version. This would make sense to connect as many system typ… --- ## [Filebeat5 alpha 5: multiline and procesor not work as expectation](https://discuss.elastic.co/t/filebeat5-alpha-5-multiline-and-procesor-not-work-as-expectation/60845)
**Author:** [@ptvi](https://discuss.elastic.co/u/ptvi)\ **Replies:** 3\ **Last updated:** [September 22, 2016, 10:59am UTC](https://discuss.elastic.co/t/filebeat5-alpha-5-multiline-and-procesor-not-work-as-expectation/60845 "2016-09-22T10:59:53Z")
Hi, I'm using filebeat alpha 5 installed in my Windows server to flushing log to my ELK. In filebeat.yml, I configure multiline and processor as below: #I only want to get log line containing ER or ERROR processors: … --- ## [Filebeat events in syslog despite setting to\_syslog: false](https://discuss.elastic.co/t/filebeat-events-in-syslog-despite-setting-to-syslog-false/60912)
**Author:** [@kelson.martins](https://discuss.elastic.co/u/kelson.martins)\ **Replies:** 4\ **Last updated:** [September 22, 2016, 7:56am UTC](https://discuss.elastic.co/t/filebeat-events-in-syslog-despite-setting-to-syslog-false/60912 "2016-09-22T07:56:19Z")
Hi all, Currently, one of my servers running filebeat is dumping debug level messages to /var/log/messages despite the filebeat.yml stating to not log events to syslog. Here is my configuration: logging: to\_sys… --- ## [Exclude data before multiline?](https://discuss.elastic.co/t/exclude-data-before-multiline/60978)
**Author:** [@YuWatanabe](https://discuss.elastic.co/u/YuWatanabe)\ **Replies:** 2\ **Last updated:** [September 22, 2016, 7:13am UTC](https://discuss.elastic.co/t/exclude-data-before-multiline/60978 "2016-09-22T07:13:32Z")
I use ELK stack + filebeat to collect logs. Log flows in below order. filebeat(1.3.0) -\> logstash(5.0.0 alpha5) -\> elasticsearch(5.0.0alpha5) I also use multiline in filebeat to group certain lines. Problem I am ha… --- ## [SImple direct from log file JSON to elasticsearch](https://discuss.elastic.co/t/simple-direct-from-log-file-json-to-elasticsearch/61192)
**Author:** [@Brian\_G](https://discuss.elastic.co/u/Brian_G)\ **Replies:** 3\ **Last updated:** [September 22, 2016, 6:08am UTC](https://discuss.elastic.co/t/simple-direct-from-log-file-json-to-elasticsearch/61192 "2016-09-22T06:08:25Z")
Let's say I have code that is writing out tons of JSON documents to a log file. Consider these to be as is documents that should be in elasticsearch the same way they have been written to the log files. All I want to do … --- ## [Filebeat how to get stats of number of events/s, mb/s, etc send by filebeat?](https://discuss.elastic.co/t/filebeat-how-to-get-stats-of-number-of-events-s-mb-s-etc-send-by-filebeat/61023)
**Author:** [@agonzalez](https://discuss.elastic.co/u/agonzalez)\ **Replies:** 1\ **Last updated:** [September 21, 2016, 8:46am UTC](https://discuss.elastic.co/t/filebeat-how-to-get-stats-of-number-of-events-s-mb-s-etc-send-by-filebeat/61023 "2016-09-21T08:46:08Z")
It is possible to get some stats on filebeat about how many events/s, bandwith mb/s, size of logs is send by a server ever day etc ? --- ## [Filebeat stops harvesting (error file didn't change) but tail -f is ok!](https://discuss.elastic.co/t/filebeat-stops-harvesting-error-file-didnt-change-but-tail-f-is-ok/61082)
**Author:** [@hong\_zhou](https://discuss.elastic.co/u/hong_zhou)\ **Replies:** 0\ **Last updated:** [September 21, 2016, 6:52am UTC](https://discuss.elastic.co/t/filebeat-stops-harvesting-error-file-didnt-change-but-tail-f-is-ok/61082 "2016-09-21T06:52:00Z")
i'm pretty sure the monitor log file is busy (check by tail -f xxxx.log) but the filebeat stops harvesting and didn't send any newline log . i restart the filebeat and still not working . then star… --- ## [Sniffing error: Read Error - Installing Packebeat on Windows](https://discuss.elastic.co/t/sniffing-error-read-error-installing-packebeat-on-windows/61081)
**Author:** [@Sandre](https://discuss.elastic.co/u/Sandre)\ **Replies:** 0\ **Last updated:** [September 21, 2016, 6:48am UTC](https://discuss.elastic.co/t/sniffing-error-read-error-installing-packebeat-on-windows/61081 "2016-09-21T06:48:39Z")
Hi Community, I'm trying to install Packetbeat on Windows and I have followed all instruction from https://www.elastic.co/guide/en/beats/packetbeat/current/packetbeat-installation.html. It seems functioning of the packet… --- ## [Beats / Filebeat / Topbeat / packetbeat / SSL connections](https://discuss.elastic.co/t/beats-filebeat-topbeat-packetbeat-ssl-connections/61003)
**Author:** [@leoaraujo79](https://discuss.elastic.co/u/leoaraujo79)\ **Replies:** 5\ **Last updated:** [September 20, 2016, 11:58pm UTC](https://discuss.elastic.co/t/beats-filebeat-topbeat-packetbeat-ssl-connections/61003 "2016-09-20T23:58:36Z")
Hi, I installed all Filebeat - Topbeat and Packetbeat on 5 servers and they all connect back to my ELK server delivering the files to logs to logstash. Some how the connections keep droping. For example: Srv1 wi… --- ## [Kafkabeat - help](https://discuss.elastic.co/t/kafkabeat-help/60724)
**Author:** [@David\_McClain](https://discuss.elastic.co/u/David_McClain)\ **Replies:** 15\ **Last updated:** [September 20, 2016, 6:12pm UTC](https://discuss.elastic.co/t/kafkabeat-help/60724 "2016-09-20T18:12:56Z")
I am trying to follow the blog guide about Kafka: https://www.elastic.co/blog/just-enough-kafka-for-the-elastic-stack-part2 to start collecting some Kafka stats. I have basic experience with Beats via using the yum rep… --- ## [Filebeat not sending new logs to ELK server untill restart](https://discuss.elastic.co/t/filebeat-not-sending-new-logs-to-elk-server-untill-restart/60060)
**Author:** [@vsairam](https://discuss.elastic.co/u/vsairam)\ **Replies:** 12\ **Last updated:** [September 20, 2016, 11:53am UTC](https://discuss.elastic.co/t/filebeat-not-sending-new-logs-to-elk-server-untill-restart/60060 "2016-09-20T11:53:24Z")
Hi, My filebeat version : filebeat version 1.2.3 My Filebeat.yml is pretty straighforward : filebeat: prospectors: - paths: - /var/log/messages - /var/log/mesos/\* input\_type: log… --- ## [Filebeat will output dumplication when logrotate happened](https://discuss.elastic.co/t/filebeat-will-output-dumplication-when-logrotate-happened/60799)
**Author:** [@haha](https://discuss.elastic.co/u/haha)\ **Replies:** 8\ **Last updated:** [September 20, 2016, 11:52am UTC](https://discuss.elastic.co/t/filebeat-will-output-dumplication-when-logrotate-happened/60799 "2016-09-20T11:52:26Z")
Hi, when I use filebeat to collect the log data. I found that the output file have many dumplications of a log entry. The log data is generated by a python script. Every log entry has a unique number and every 300 entrie… --- ## [Filebeat and logs on remote server](https://discuss.elastic.co/t/filebeat-and-logs-on-remote-server/60959)
**Author:** [@ori.rubinfeld](https://discuss.elastic.co/u/ori.rubinfeld)\ **Replies:** 2\ **Last updated:** [September 20, 2016, 8:25am UTC](https://discuss.elastic.co/t/filebeat-and-logs-on-remote-server/60959 "2016-09-20T08:25:26Z")
Hi, I am testing the Filebeat version 5.0 Alpha 5. I need to read 22 different logs from one server, when Filebeat runs on the same machine, it consumes a lot of CPU (reaches 50%-60%) constantly. The application server… --- ## [Loading iostat.disk, iostat.cpu, sar.disk, sar.cpu, etc file to Elasticsearch](https://discuss.elastic.co/t/loading-iostat-disk-iostat-cpu-sar-disk-sar-cpu-etc-file-to-elasticsearch/60944)
**Author:** [@Vara](https://discuss.elastic.co/u/Vara)\ **Replies:** 1\ **Last updated:** [September 20, 2016, 7:09am UTC](https://discuss.elastic.co/t/loading-iostat-disk-iostat-cpu-sar-disk-sar-cpu-etc-file-to-elasticsearch/60944 "2016-09-20T07:09:12Z")
I got iostat.disk, iostat.cpu, sar.disk, sar.cpu, etc files captured from testing/production servers and I would like to analyze these data offline by loading into elasticsearch. But I don't find option to load these fil… --- ## [Filebeat 5 error when sending to redis](https://discuss.elastic.co/t/filebeat-5-error-when-sending-to-redis/60742)
**Author:** [@Alexander\_Fichel](https://discuss.elastic.co/u/Alexander_Fichel)\ **Replies:** 4\ **Last updated:** [September 20, 2016, 6:57am UTC](https://discuss.elastic.co/t/filebeat-5-error-when-sending-to-redis/60742 "2016-09-20T06:57:33Z")
Getting the following errors when having filebeats send to redis: Filebeats version: filebeat-5.0.0-alpha5-windows-x86\_64 Windows where filebeats is installed: 64 bit win server 2008 Redis version in AWS (Worked with o… --- ## [Building packetbeat for the raspberry pi](https://discuss.elastic.co/t/building-packetbeat-for-the-raspberry-pi/60224)
**Author:** [@Steinar\_Bang](https://discuss.elastic.co/u/Steinar_Bang)\ **Replies:** 14\ **Last updated:** [September 20, 2016, 6:55am UTC](https://discuss.elastic.co/t/building-packetbeat-for-the-raspberry-pi/60224 "2016-09-20T06:55:45Z")
I'm trying to build packagebeat for a raspberry Pi 2 with raspbian jessie. I'm trying to build it on the rPi itself. So far I've done : 1. As root installed required software (python 2.7.9, and GNU make was already i… --- ## [Topbeat/metricbeat is not showing correct value for proc.cpu.user\_p](https://discuss.elastic.co/t/topbeat-metricbeat-is-not-showing-correct-value-for-proc-cpu-user-p/60812)
**Author:** [@Huy\_Hoang](https://discuss.elastic.co/u/Huy_Hoang)\ **Replies:** 3\ **Last updated:** [September 20, 2016, 6:28am UTC](https://discuss.elastic.co/t/topbeat-metricbeat-is-not-showing-correct-value-for-proc-cpu-user-p/60812 "2016-09-20T06:28:03Z")
Hi, I am using elk stack version 5.0 and 1.3/5.0 for topbeat on centos 7. The problem is that the proc.cpu.user\_p is always \< 0.9. Normally, the values are showed as 0.0xx (0.001, 0,003 .v..v), I tried to run a heavy ta… --- ## [Configuring filebeat to send specified logs to E.L.K server's logstash HELP!](https://discuss.elastic.co/t/configuring-filebeat-to-send-specified-logs-to-e-l-k-servers-logstash-help/44830)
**Author:** [@brayndasilva](https://discuss.elastic.co/u/brayndasilva)\ **Replies:** 15\ **Last updated:** [September 20, 2016, 12:59am UTC](https://discuss.elastic.co/t/configuring-filebeat-to-send-specified-logs-to-e-l-k-servers-logstash-help/44830 "2016-09-20T00:59:11Z")
Hi there, About two days ago I started looking into ELK and decided to try it out on a few machines. My set-up is the following: 1 E.L.K server, 2 Client servers and 1 Laptop to access Kibana. I have followed the o… --- ## [Filebeat fails to start with filebeat-god but works with filebeat directly](https://discuss.elastic.co/t/filebeat-fails-to-start-with-filebeat-god-but-works-with-filebeat-directly/60853)
**Author:** [@Stanislav\_Antic](https://discuss.elastic.co/u/Stanislav_Antic)\ **Replies:** 2\ **Last updated:** [September 19, 2016, 1:22pm UTC](https://discuss.elastic.co/t/filebeat-fails-to-start-with-filebeat-god-but-works-with-filebeat-directly/60853 "2016-09-19T13:22:10Z")
I'm using CentOS 6.8 and have installed filebeat (version 1.3.1). My configuration is: --- filebeat: prospectors: \[{"paths": \["/var/log/\*.log"\], "input\_type": "log"}\] registry\_file: /var/lib/filebeat/registry ou… --- ## [Beats encodes angle brackets ("\<" and "\>") as \\u003c and \\u003e in JSON output](https://discuss.elastic.co/t/beats-encodes-angle-brackets-and-as-u003c-and-u003e-in-json-output/60667)
**Author:** [@justintime32](https://discuss.elastic.co/u/justintime32)\ **Replies:** 6\ **Last updated:** [September 19, 2016, 8:18am UTC](https://discuss.elastic.co/t/beats-encodes-angle-brackets-and-as-u003c-and-u003e-in-json-output/60667 "2016-09-19T08:18:43Z")
I'm in the process of setting up filebeat to ship out logs on some of my servers. One of my logs has angle brackets in it ("\<" and "\>"). Once filebeat processes it and outputs its JSON representation, those angle bracket… --- ## [Filebeat 5.0.0-alpha apt repo?](https://discuss.elastic.co/t/filebeat-5-0-0-alpha-apt-repo/60824)
**Author:** [@bradenwright](https://discuss.elastic.co/u/bradenwright)\ **Replies:** 1\ **Last updated:** [September 19, 2016, 8:17am UTC](https://discuss.elastic.co/t/filebeat-5-0-0-alpha-apt-repo/60824 "2016-09-19T08:17:27Z")
is there an apt repo with this deb file. Essentially I'm using a chef cookbook to install and it installs off of repos. If there is an existing apt repo it will make my life awesome and simple. If not then I'll have … --- ## [Custom Beats vs. Scripts](https://discuss.elastic.co/t/custom-beats-vs-scripts/60791)
**Author:** [@DefensiveDepth](https://discuss.elastic.co/u/DefensiveDepth)\ **Replies:** 3\ **Last updated:** [September 19, 2016, 7:44am UTC](https://discuss.elastic.co/t/custom-beats-vs-scripts/60791 "2016-09-19T07:44:48Z")
Working on a project that will be querying a number of data sources and inserting the resulting data into ES. The data sources include: Bing API, Twitter, Instagram, Facebook, and more social media platforms. Thoughts … --- ## [Filebeat not sending to logstash](https://discuss.elastic.co/t/filebeat-not-sending-to-logstash/60743)
**Author:** [@overip](https://discuss.elastic.co/u/overip)\ **Replies:** 3\ **Last updated:** [September 19, 2016, 7:33am UTC](https://discuss.elastic.co/t/filebeat-not-sending-to-logstash/60743 "2016-09-19T07:33:06Z")
Hello everybody. I am a total newbie. I am having problem sending logs to Logstash from Filebeat. Actually I don't see anything coming out the port 5044 with sudo tcpdump port 5044 and '(tcp-syn|tcp-ack)!=0' Here is th… --- ## [Hi i'm trying to harvest the docker logs of one of our application and configured outputs to Elasticsearch and File. Its neither harvesting any . I'm sharing the filebeat logs for reference](https://discuss.elastic.co/t/hi-im-trying-to-harvest-the-docker-logs-of-one-of-our-application-and-configured-outputs-to-elasticsearch-and-file-its-neither-harvesting-any-im-sharing-the-filebeat-logs-for-reference/60652)
**Author:** [@niharvarma](https://discuss.elastic.co/u/niharvarma)\ **Replies:** 5\ **Last updated:** [September 19, 2016, 7:29am UTC](https://discuss.elastic.co/t/hi-im-trying-to-harvest-the-docker-logs-of-one-of-our-application-and-configured-outputs-to-elasticsearch-and-file-its-neither-harvesting-any-im-sharing-the-filebeat-logs-for-reference/60652 "2016-09-19T07:29:34Z")
2016/09/15 22:13:01.859214 outputs.go:126: INFO Activated elasticsearch as output plugin. 2016/09/15 22:13:01.859242 file.go:39: INFO File output base filename set to: filebeat\_log 2016/09/15 22:13:01.859252 file.go:50: … --- ## [Packetbeats all wifi Traffic Analysis](https://discuss.elastic.co/t/packetbeats-all-wifi-traffic-analysis/42884)
**Author:** [@tyler\_burge](https://discuss.elastic.co/u/tyler_burge)\ **Replies:** 7\ **Last updated:** [September 18, 2016, 9:42pm UTC](https://discuss.elastic.co/t/packetbeats-all-wifi-traffic-analysis/42884 "2016-09-18T21:42:04Z")
I am trying to get Packetbeats to log all wifi traffic. I see traffic that is broadcast but not traffic from other hosts like my cellphone trying to access an http page. How can I enable packetbeats in promiscious mode… --- ## [Filebeat doesn't send logs to logstash in client server architecture](https://discuss.elastic.co/t/filebeat-doesnt-send-logs-to-logstash-in-client-server-architecture/44932)
**Author:** [@jstar](https://discuss.elastic.co/u/jstar)\ **Replies:** 10\ **Last updated:** [September 16, 2016, 6:49pm UTC](https://discuss.elastic.co/t/filebeat-doesnt-send-logs-to-logstash-in-client-server-architecture/44932 "2016-09-16T18:49:01Z")
Hi all, I just set up filebeat following the documentation. But I can't have logs of my cluster in logstash. I use a client-server architecture (i.e a client with Filebeat configured and installed and a server with log… --- ## [TLS not being used between Winlogbeat and Logstash - No errors](https://discuss.elastic.co/t/tls-not-being-used-between-winlogbeat-and-logstash-no-errors/60630)
**Author:** [@gamaier](https://discuss.elastic.co/u/gamaier)\ **Replies:** 1\ **Last updated:** [September 16, 2016, 12:58pm UTC](https://discuss.elastic.co/t/tls-not-being-used-between-winlogbeat-and-logstash-no-errors/60630 "2016-09-16T12:58:18Z")
So I'm wondering if anyone has run into this issue before. I've created a self signed cert on my elastic/logstash box and deployed this to a dev box as well. After thinking this was working since I get no errors regardi… --- ## [Filebeat throws ERR failed to initialize console plugin as output error](https://discuss.elastic.co/t/filebeat-throws-err-failed-to-initialize-console-plugin-as-output-error/60481)
**Author:** [@sruthib](https://discuss.elastic.co/u/sruthib)\ **Replies:** 3\ **Last updated:** [September 16, 2016, 10:52am UTC](https://discuss.elastic.co/t/filebeat-throws-err-failed-to-initialize-console-plugin-as-output-error/60481 "2016-09-16T10:52:25Z")
c:\\Program Files\\Filebeat\>filebeat -c filebeat\_user.yml -e -v -d "\*" 2016/09/14 09:13:53.783830 beat.go:156: DBG Initializing output plugins 2016/09/14 09:13:53.785331 geolite.go:24: INFO GeoIP disabled: No paths were s… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=561) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=563)