# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=563 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 564 --- ## [Is filebeat able to index in elasticsearch with the date of the log line it reads, not the the date of the day?](https://discuss.elastic.co/t/is-filebeat-able-to-index-in-elasticsearch-with-the-date-of-the-log-line-it-reads-not-the-the-date-of-the-day/60619)
**Author:** [@Orsius](https://discuss.elastic.co/u/Orsius)\ **Replies:** 3\ **Last updated:** [September 16, 2016, 8:02am UTC](https://discuss.elastic.co/t/is-filebeat-able-to-index-in-elasticsearch-with-the-date-of-the-log-line-it-reads-not-the-the-date-of-the-day/60619 "2016-09-16T08:02:10Z")
Hello, I'm wondering if filebeat is able to index in elasticsearch with the date of the log line it reads, not the the date of the day? -- What I want to put in place: \*.log (from august 2016) \> filebeat \> elastisearc… --- ## [INFO Connecting error publishing events (retrying): 403 Forbidden?](https://discuss.elastic.co/t/info-connecting-error-publishing-events-retrying-403-forbidden/60485)
**Author:** [@poper](https://discuss.elastic.co/u/poper)\ **Replies:** 5\ **Last updated:** [September 16, 2016, 4:32am UTC](https://discuss.elastic.co/t/info-connecting-error-publishing-events-retrying-403-forbidden/60485 "2016-09-16T04:32:05Z")
Hi There, I have installed winlogbeat 5.0-alpha5 on my server 2003 64bit running cas role for exchange 2007. I'm install already but when I start the service I got message from winlogbeat said: 2016-09-14T17:14:08+07… --- ## [Winlogbeat does not have a proper timestamp field](https://discuss.elastic.co/t/winlogbeat-does-not-have-a-proper-timestamp-field/60513)
**Author:** [@pramod\_kumar](https://discuss.elastic.co/u/pramod_kumar)\ **Replies:** 5\ **Last updated:** [September 15, 2016, 2:03pm UTC](https://discuss.elastic.co/t/winlogbeat-does-not-have-a-proper-timestamp-field/60513 "2016-09-15T14:03:17Z")
Winlogbeat doesnot have a Proper timestamp filed, Please help me with this issue. thanks pramod --- ## [Filebeat - High CPU for windows machines](https://discuss.elastic.co/t/filebeat-high-cpu-for-windows-machines/58920)
**Author:** [@ori.rubinfeld](https://discuss.elastic.co/u/ori.rubinfeld)\ **Replies:** 25\ **Last updated:** [September 15, 2016, 6:08am UTC](https://discuss.elastic.co/t/filebeat-high-cpu-for-windows-machines/58920 "2016-09-15T06:08:20Z")
Hi, We are noticing the Filebeat consuming a lot of CPU on windows monitored machines. It can be above 20% and also above 40% all the time. The Filebeat suppose to be a light program which should not be felt at all. W… --- ## [Filebeat Need Restart To send Logs](https://discuss.elastic.co/t/filebeat-need-restart-to-send-logs/60266)
**Author:** [@Me\_Cloud](https://discuss.elastic.co/u/Me_Cloud)\ **Replies:** 9\ **Last updated:** [September 15, 2016, 6:07am UTC](https://discuss.elastic.co/t/filebeat-need-restart-to-send-logs/60266 "2016-09-15T06:07:34Z")
Hallo all, i was first using filebeat, i have a problem with my filebeat. i cannot send logs to logstash dynamically? because in my case, my filebeat not pushing the logs to logstash dynamically. so, i have to manually … --- ## [How to install filebeat on Linux 3.10.0-327.18.2.el7.ppc64 GNU/Linux OS running on Power8?](https://discuss.elastic.co/t/how-to-install-filebeat-on-linux-3-10-0-327-18-2-el7-ppc64-gnu-linux-os-running-on-power8/60529)
**Author:** [@VIJAYP](https://discuss.elastic.co/u/VIJAYP)\ **Replies:** 2\ **Last updated:** [September 14, 2016, 6:15pm UTC](https://discuss.elastic.co/t/how-to-install-filebeat-on-linux-3-10-0-327-18-2-el7-ppc64-gnu-linux-os-running-on-power8/60529 "2016-09-14T18:15:59Z")
Hi, I'm trying to install Filebeat on Linux 3.10.0-327.18.2.el7.ppc64 GNU/Linux OS which is running on Power 8 PC. I tried to install filebeats referring https://www.elastic.co/guide/en/beats/filebeat/current/fileb… --- ## [Mapper\_parsing\_exception with JSON event in custom Beat](https://discuss.elastic.co/t/mapper-parsing-exception-with-json-event-in-custom-beat/60454)
**Author:** [@raposa](https://discuss.elastic.co/u/raposa)\ **Replies:** 2\ **Last updated:** [September 14, 2016, 2:52pm UTC](https://discuss.elastic.co/t/mapper-parsing-exception-with-json-event-in-custom-beat/60454 "2016-09-14T14:52:54Z")
I am writing a Beat that generates the following event and sends to ES. I have included a sample event below. The data does not make it into ES - there is an error occurring: WARN Can not index event (status=400): {"t… --- ## [Force\_peer/peer option fails to validate client certificate](https://discuss.elastic.co/t/force-peer-peer-option-fails-to-validate-client-certificate/59929)
**Author:** [@Akshaykapoor](https://discuss.elastic.co/u/Akshaykapoor)\ **Replies:** 5\ **Last updated:** [September 14, 2016, 12:12am UTC](https://discuss.elastic.co/t/force-peer-peer-option-fails-to-validate-client-certificate/59929 "2016-09-14T00:12:01Z")
This is the following i tried, Had server cert enabled on logstash with sl\_verify\_mode: none. This worked fine and and filebeat was able to connect to server and send logs. Now, when i enable ssl\_verify\_mode: force\_… --- ## [How to replicate the packet to redis hosts?](https://discuss.elastic.co/t/how-to-replicate-the-packet-to-redis-hosts/60371)
**Author:** [@YuWatanabe](https://discuss.elastic.co/u/YuWatanabe)\ **Replies:** 2\ **Last updated:** [September 13, 2016, 9:06pm UTC](https://discuss.elastic.co/t/how-to-replicate-the-packet-to-redis-hosts/60371 "2016-09-13T21:06:37Z")
Latest filebeat has ability to loadbalance or send to either redis when multiple redis is configured. https://www.elastic.co/guide/en/beats/filebeat/5.x/redis-output.html#\_loadbalance However, is there any way to rep… --- ## [Filebeat hangs on starting - ubuntu:trusty](https://discuss.elastic.co/t/filebeat-hangs-on-starting-ubuntu-trusty/60370)
**Author:** [@myles-mcdonnell](https://discuss.elastic.co/u/myles-mcdonnell)\ **Replies:** 2\ **Last updated:** [September 13, 2016, 12:15pm UTC](https://discuss.elastic.co/t/filebeat-hangs-on-starting-ubuntu-trusty/60370 "2016-09-13T12:15:48Z")
I am building a docker image to run filebeat which will via a shared volume harvest all the log files output from the other services running in containers on the host. However, it appears to hang on startup. Relevant f… --- ## [About clean\_removed in Filebeat 5.0.0-alpha5](https://discuss.elastic.co/t/about-clean-removed-in-filebeat-5-0-0-alpha5/59949)
**Author:** [@vin](https://discuss.elastic.co/u/vin)\ **Replies:** 14\ **Last updated:** [September 13, 2016, 7:10am UTC](https://discuss.elastic.co/t/about-clean-removed-in-filebeat-5-0-0-alpha5/59949 "2016-09-13T07:10:07Z")
Filebeat config: filebeat: prospectors: - paths: - /var/log/applog/app\_\*.log input\_type: log document\_type: applog ignore\_older: 2m close\_eof: true clean\_inactive: 5m close\_removed: true clean\_removed: true … --- ## [Fielddata is disabled on text fields by default. Set fielddata=true on \[beat.name\]](https://discuss.elastic.co/t/fielddata-is-disabled-on-text-fields-by-default-set-fielddata-true-on-beat-name/60283)
**Author:** [@YuWatanabe](https://discuss.elastic.co/u/YuWatanabe)\ **Replies:** 4\ **Last updated:** [September 12, 2016, 9:19pm UTC](https://discuss.elastic.co/t/fielddata-is-disabled-on-text-fields-by-default-set-fielddata-true-on-beat-name/60283 "2016-09-12T21:19:12Z")
Hi. I have imported dashboard template using import\_dashboards.sh for metricbeat. But below errors appears when I select any of the imported dashhboard. My Environemnt metricbeat-5.0.0 alpha5 kibana-5.0.0 alpha5 D… --- ## [FileBeat Connection reset by peer](https://discuss.elastic.co/t/filebeat-connection-reset-by-peer/60153)
**Author:** [@Lego](https://discuss.elastic.co/u/Lego)\ **Replies:** 3\ **Last updated:** [September 12, 2016, 3:04pm UTC](https://discuss.elastic.co/t/filebeat-connection-reset-by-peer/60153 "2016-09-12T15:04:38Z")
Hello. I'm trying to get some log files from windows pc. And I can observe the following log message every time when I restart FileBeat service on Windows PC {:timestamp=\>"2016-09-09T04:59:41.233000-0400", :message=\>"B… --- ## [Monitoring ES queries from Transport clients?](https://discuss.elastic.co/t/monitoring-es-queries-from-transport-clients/60298)
**Author:** [@CliveL](https://discuss.elastic.co/u/CliveL)\ **Replies:** 1\ **Last updated:** [September 12, 2016, 2:17pm UTC](https://discuss.elastic.co/t/monitoring-es-queries-from-transport-clients/60298 "2016-09-12T14:17:06Z")
Hi all, I think I already know the answer to this one, but I wanted to check if it is possible to use Packetbeat to monitor ES queries being made to an ES 1.7 cluster from Transport clients (Java API servers) ? They ar… --- ## [Filebeat not reading outputs from YAML](https://discuss.elastic.co/t/filebeat-not-reading-outputs-from-yaml/60284)
**Author:** [@Paul\_D\_Ambra](https://discuss.elastic.co/u/Paul_D_Ambra)\ **Replies:** 1\ **Last updated:** [September 12, 2016, 1:20pm UTC](https://discuss.elastic.co/t/filebeat-not-reading-outputs-from-yaml/60284 "2016-09-12T13:20:37Z")
I'm sure this will be a problem in my yaml but I can't see what it is. I'm trying to run filebeat 1.3.0 on windows server 2012/ my config is in a file in the same directory as filebeat.exe called filebeat.yml --- … --- ## [Dashboard importing fails for metricbeat when security (x-pack) is configured](https://discuss.elastic.co/t/dashboard-importing-fails-for-metricbeat-when-security-x-pack-is-configured/60249)
**Author:** [@YuWatanabe](https://discuss.elastic.co/u/YuWatanabe)\ **Replies:** 4\ **Last updated:** [September 12, 2016, 11:34am UTC](https://discuss.elastic.co/t/dashboard-importing-fails-for-metricbeat-when-security-x-pack-is-configured/60249 "2016-09-12T11:34:39Z")
Hi ! I would like to ask question regarding to sample dashboard importing for metricbeat. My environment is elasticsearch 5.0.0-alpha5 Xpack Security configured Metricbeat 5.0.0-alpha5 Kibana 5.0.0-alpha5 Problem … --- ## [Indexes with FileBeat](https://discuss.elastic.co/t/indexes-with-filebeat/59873)
**Author:** [@Apurv\_Jain](https://discuss.elastic.co/u/Apurv_Jain)\ **Replies:** 7\ **Last updated:** [September 12, 2016, 9:15am UTC](https://discuss.elastic.co/t/indexes-with-filebeat/59873 "2016-09-12T09:15:56Z")
Hi, I am using file beat to transfer logs to elastic. Everything is working fine, the only issue is that filebeat adds date to the ES index, so if my index name is "Test", how filebeat creates it on ES is "Test-YYYY.MM.… --- ## [Filebeat needs to be restarted in order to send logs to logstash dynamically](https://discuss.elastic.co/t/filebeat-needs-to-be-restarted-in-order-to-send-logs-to-logstash-dynamically/39994)
**Author:** [@abinay](https://discuss.elastic.co/u/abinay)\ **Replies:** 40\ **Last updated:** [September 12, 2016, 8:56am UTC](https://discuss.elastic.co/t/filebeat-needs-to-be-restarted-in-order-to-send-logs-to-logstash-dynamically/39994 "2016-09-12T08:56:42Z")
Hii I was first using logstash-forwarder to ship my logs to logstash but unfortunately logstash- forwarder was not tailing the file. It used to start reading the file from the beginning which was not a good architectu… --- ## [Filebeat use (deleted) files](https://discuss.elastic.co/t/filebeat-use-deleted-files/59172)
**Author:** [@zakabluk](https://discuss.elastic.co/u/zakabluk)\ **Replies:** 12\ **Last updated:** [September 12, 2016, 8:36am UTC](https://discuss.elastic.co/t/filebeat-use-deleted-files/59172 "2016-09-12T08:36:35Z")
filebeat-1.2.3-x86\_64 - conf: filebeat: prospectors: - paths: - /var/opt/tibco/logs/\*.log input\_type: log close\_older: 5m document\_type: tibco\_6 multiline: pattern… --- ## [Filebeat: Persist processed logs if docker container crashes](https://discuss.elastic.co/t/filebeat-persist-processed-logs-if-docker-container-crashes/60089)
**Author:** [@dantze](https://discuss.elastic.co/u/dantze)\ **Replies:** 4\ **Last updated:** [September 9, 2016, 5:33pm UTC](https://discuss.elastic.co/t/filebeat-persist-processed-logs-if-docker-container-crashes/60089 "2016-09-09T17:33:12Z")
I'm running Filebeat on several docker containers using this Dockerfile: https://github.com/primait/docker-filebeat/blob/master/1.2/Dockerfile When the container for some reason crashes or goes down I need to make sure… --- ## [Beats - Adding the File Version resource to the Windows exe](https://discuss.elastic.co/t/beats-adding-the-file-version-resource-to-the-windows-exe/60125)
**Author:** [@TimoHar](https://discuss.elastic.co/u/TimoHar)\ **Replies:** 3\ **Last updated:** [September 9, 2016, 12:17pm UTC](https://discuss.elastic.co/t/beats-adding-the-file-version-resource-to-the-windows-exe/60125 "2016-09-09T12:17:52Z")
Prior to rolling out on a large scale, we would like to be able to monitor the version of the particular beat installed. The beat exe's do not report any file version or product version. It is logged, but it can be pro… --- ## [TLS for Filebeat Kafka Output](https://discuss.elastic.co/t/tls-for-filebeat-kafka-output/58756)
**Author:** [@anefassa](https://discuss.elastic.co/u/anefassa)\ **Replies:** 11\ **Last updated:** [September 8, 2016, 11:58pm UTC](https://discuss.elastic.co/t/tls-for-filebeat-kafka-output/58756 "2016-09-08T23:58:32Z")
Has anyone been successful configuring the Filebeat Kafka output to use TLS and client/server certificates to connect to Kafka? I am able to use SSL to connect to the same Kafka cluster from logstash and also other clien… --- ## [Option to send local server timezone using filebeat](https://discuss.elastic.co/t/option-to-send-local-server-timezone-using-filebeat/60081)
**Author:** [@Steve\_McDuff](https://discuss.elastic.co/u/Steve_McDuff)\ **Replies:** 3\ **Last updated:** [September 8, 2016, 11:44pm UTC](https://discuss.elastic.co/t/option-to-send-local-server-timezone-using-filebeat/60081 "2016-09-08T23:44:02Z")
Filebeat version : 5.0.0. Alpha 5. Logstash version : 2.3.2 OS : Red Hat 7.x I'm currently using filebeat to parse log files for an application that writes log entries using this format : \[2016-09-08 08:26:06.242\] ALL… --- ## [Filebeat is not logging anything](https://discuss.elastic.co/t/filebeat-is-not-logging-anything/59911)
**Author:** [@sgoetz](https://discuss.elastic.co/u/sgoetz)\ **Replies:** 8\ **Last updated:** [September 8, 2016, 9:46pm UTC](https://discuss.elastic.co/t/filebeat-is-not-logging-anything/59911 "2016-09-08T21:46:43Z")
I am unable to get filebeats to create a log file and log anything. My Configuration is a little different. I have the main configuration file filebeat.yml. Than I have a different config file for each type of log im … --- ## [Negative HTTP responsetime](https://discuss.elastic.co/t/negative-http-responsetime/59988)
**Author:** [@cikenerd](https://discuss.elastic.co/u/cikenerd)\ **Replies:** 2\ **Last updated:** [September 8, 2016, 1:16pm UTC](https://discuss.elastic.co/t/negative-http-responsetime/59988 "2016-09-08T13:16:29Z")
Hi, I install packetbeat 1.3 ,I notice the negative response time in the kibana. Version: packetbeat version 1.3.0 (amd64) Operating System: CentOS release 6.5 (Final) , 2.6.32-431.23.3.el6.x86\_64 packetbeat.yml int… --- ## [Filebeat too many open files error when number of log files bigger than 1024](https://discuss.elastic.co/t/filebeat-too-many-open-files-error-when-number-of-log-files-bigger-than-1024/59518)
**Author:** [@vin](https://discuss.elastic.co/u/vin)\ **Replies:** 4\ **Last updated:** [September 8, 2016, 10:55am UTC](https://discuss.elastic.co/t/filebeat-too-many-open-files-error-when-number-of-log-files-bigger-than-1024/59518 "2016-09-08T10:55:26Z")
Filebeat Version : 1.2.3 OS: CentOS 7 (Docker) Error Msg: 2016-09-01T08:20:48Z ERR Stop Harvesting. Unexpected file opening error: open xxx: too many open files ulimit -a | grep "open files" open files … --- ## [Mysql exports](https://discuss.elastic.co/t/mysql-exports/59899)
**Author:** [@voipoclay](https://discuss.elastic.co/u/voipoclay)\ **Replies:** 3\ **Last updated:** [September 8, 2016, 10:52am UTC](https://discuss.elastic.co/t/mysql-exports/59899 "2016-09-08T10:52:24Z")
Would it be possible to add threads\_connected to the exported fields for mysql plugin? https://www.elastic.co/guide/en/beats/metricbeat/current/metricbeat-metricset-mysql-status.html Thanks! --- ## [Setting Filebeat 5 with Kafka 0.10 over TLS](https://discuss.elastic.co/t/setting-filebeat-5-with-kafka-0-10-over-tls/59550)
**Author:** [@Tsury](https://discuss.elastic.co/u/Tsury)\ **Replies:** 4\ **Last updated:** [September 4, 2016, 12:25pm UTC](https://discuss.elastic.co/t/setting-filebeat-5-with-kafka-0-10-over-tls/59550 "2016-09-04T12:25:24Z")
I have a perfectly working Filebeat 5.0.0-alpha5 and Kafka 0.10 setup. They reside in different physical servers, each as a Docker container. I am trying to set them up to use SSL(TLS) instead of PLAINTEXT. I am just… --- ## [Collecting log files in addition to Windows event logs](https://discuss.elastic.co/t/collecting-log-files-in-addition-to-windows-event-logs/59998)
**Author:** [@Diggy](https://discuss.elastic.co/u/Diggy)\ **Replies:** 2\ **Last updated:** [September 7, 2016, 8:16pm UTC](https://discuss.elastic.co/t/collecting-log-files-in-addition-to-windows-event-logs/59998 "2016-09-07T20:16:07Z")
Hi, all. I'm tasked with trying to get certain application logs captured by ELK. I have Winlogbeat working on a test server, and it's forwarding Event Logs. Is there a way (as with Filebeat) to capture logs from, say… --- ## [Filebeats can overwhelm target (kafka,logstash,esearch) on recovery](https://discuss.elastic.co/t/filebeats-can-overwhelm-target-kafka-logstash-esearch-on-recovery/59892)
**Author:** [@Tim\_Burt](https://discuss.elastic.co/u/Tim_Burt)\ **Replies:** 5\ **Last updated:** [September 7, 2016, 8:08pm UTC](https://discuss.elastic.co/t/filebeats-can-overwhelm-target-kafka-logstash-esearch-on-recovery/59892 "2016-09-07T20:08:13Z")
Our config is: filebeats -\> Kafka Approx 1000 aws instances running mostly rails logging approx 10 million lines per day into a 3 node Kafka - 3 node Zookeeper cluster behind an ELB. A few days ago, we lost Kafka in … [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=562) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=564)