# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=564 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 565 --- ## [Http output to logstash](https://discuss.elastic.co/t/http-output-to-logstash/33269)
**Author:** [@teampants](https://discuss.elastic.co/u/teampants)\ **Replies:** 15\ **Last updated:** [September 7, 2016, 1:56pm UTC](https://discuss.elastic.co/t/http-output-to-logstash/33269 "2016-09-07T13:56:22Z")
Hi, Is there any plan to implement output to logstash over http(s)? I am working on a project that will require all traffic to be over https, so lumberjack is not an option. At this point I believe my best option wi… --- ## [Filebeat installation on CentOS](https://discuss.elastic.co/t/filebeat-installation-on-centos/59821)
**Author:** [@srpatatas](https://discuss.elastic.co/u/srpatatas)\ **Replies:** 4\ **Last updated:** [September 6, 2016, 2:10pm UTC](https://discuss.elastic.co/t/filebeat-installation-on-centos/59821 "2016-09-06T14:10:38Z")
Hi guys, could you help me out with the installation of the beats repository on CentOS? I'm using version 6.7 32-bit. I followed the instructions from the docs https://www.elastic.co/guide/en/beats/filebeat/current/fileb… --- ## [Multiline breaks on empty line \\n\\n restarts new line](https://discuss.elastic.co/t/multiline-breaks-on-empty-line-n-n-restarts-new-line/59717)
**Author:** [@Tim\_Burt](https://discuss.elastic.co/u/Tim_Burt)\ **Replies:** 3\ **Last updated:** [September 6, 2016, 11:52am UTC](https://discuss.elastic.co/t/multiline-breaks-on-empty-line-n-n-restarts-new-line/59717 "2016-09-06T11:52:09Z")
The multiline filter in filebeats works well with the default config is used: multiline: pattern: ^\\\[ negate: true match: after And the log lines are consecutive following the pattern. However, if t… --- ## [Diskio documentation update](https://discuss.elastic.co/t/diskio-documentation-update/59601)
**Author:** [@voipoclay](https://discuss.elastic.co/u/voipoclay)\ **Replies:** 3\ **Last updated:** [September 6, 2016, 7:40am UTC](https://discuss.elastic.co/t/diskio-documentation-update/59601 "2016-09-06T07:40:01Z")
https://www.elastic.co/guide/en/beats/metricbeat/current/metricbeat-metricset-system-diskio.html metricset.name should be diskio and not disk. This is at least what I am seeing in my data. --- ## [Filebeat: sync.go:85: ERR Failed to publish events caused by: EOF](https://discuss.elastic.co/t/filebeat-sync-go-85-err-failed-to-publish-events-caused-by-eof/59700)
**Author:** [@muradm](https://discuss.elastic.co/u/muradm)\ **Replies:** 2\ **Last updated:** [September 5, 2016, 2:03pm UTC](https://discuss.elastic.co/t/filebeat-sync-go-85-err-failed-to-publish-events-caused-by-eof/59700 "2016-09-05T14:03:46Z")
Tried latest alpha filebeat 5.0.0-alpha5. Everything seems fine.. but logs on one of servers are flooded with at random periods: sync.go:85: ERR Failed to publish events caused by: EOF Any idea? --- ## [Windows metric counters](https://discuss.elastic.co/t/windows-metric-counters/59728)
**Author:** [@Zfs](https://discuss.elastic.co/u/Zfs)\ **Replies:** 2\ **Last updated:** [September 5, 2016, 11:24am UTC](https://discuss.elastic.co/t/windows-metric-counters/59728 "2016-09-05T11:24:14Z")
It would be great if metricbeat on windows accepted input for additional counters similar to how telegraf allows for it. This would allow measuring any metric available on windows. https://github.com/influxdata/telegra… --- ## [Beats config locks the log file which I cant edit in MacOS,pls help resolve](https://discuss.elastic.co/t/beats-config-locks-the-log-file-which-i-cant-edit-in-macos-pls-help-resolve/59737)
**Author:** [@vishnuprasadh](https://discuss.elastic.co/u/vishnuprasadh)\ **Replies:** 2\ **Last updated:** [September 5, 2016, 10:44am UTC](https://discuss.elastic.co/t/beats-config-locks-the-log-file-which-i-cant-edit-in-macos-pls-help-resolve/59737 "2016-09-05T10:44:43Z")
OS used is as follows: Version:Macbook OSX Operating System: 10.10.5 filebeat-1.2.3-darwin is version am using with logstash-2.3.4 and elasticsearch-2.4.0 with kibana-4.6.0 I got the configuration for filebeat going for … --- ## [Service Filebeat failed to start](https://discuss.elastic.co/t/service-filebeat-failed-to-start/59738)
**Author:** [@ashraf1390](https://discuss.elastic.co/u/ashraf1390)\ **Replies:** 1\ **Last updated:** [September 5, 2016, 5:48am UTC](https://discuss.elastic.co/t/service-filebeat-failed-to-start/59738 "2016-09-05T05:48:14Z")
Installed filebeat on Centos7 client, edit yaml file and filebeat fails to start.. below is error message kindly help.. \[x201@localhost ~\]$ sudo systemctl status filebeat -l â filebeat.service - filebeat Loaded: loa… --- ## [Combine indices into new index](https://discuss.elastic.co/t/combine-indices-into-new-index/58940)
**Author:** [@Diggy](https://discuss.elastic.co/u/Diggy)\ **Replies:** 4\ **Last updated:** [September 2, 2016, 9:58pm UTC](https://discuss.elastic.co/t/combine-indices-into-new-index/58940 "2016-09-02T21:58:15Z")
Hey, all. The subject of my post probably isn't clear; here's what I'd like to at least try: I have a logstash-\* and filebeat-\* index. In Kibana, depending on which I choose to view, of course, I'll set either logs … --- ## [Topbeat memory not monitored \> 4GB](https://discuss.elastic.co/t/topbeat-memory-not-monitored-4gb/59648)
**Author:** [@asp](https://discuss.elastic.co/u/asp)\ **Replies:** 2\ **Last updated:** [September 2, 2016, 1:18pm UTC](https://discuss.elastic.co/t/topbeat-memory-not-monitored-4gb/59648 "2016-09-02T13:18:23Z")
Hi all, I am running topbeat on windows machines to monitor memory, cpu (system wide and per process). I am using the file output and deliver that one via nxlog to logstash and parse it there, because I am currently ja… --- ## [Filebeat missing events because of Detected rename of a previously harvested file](https://discuss.elastic.co/t/filebeat-missing-events-because-of-detected-rename-of-a-previously-harvested-file/59519)
**Author:** [@vin](https://discuss.elastic.co/u/vin)\ **Replies:** 3\ **Last updated:** [September 2, 2016, 1:14pm UTC](https://discuss.elastic.co/t/filebeat-missing-events-because-of-detected-rename-of-a-previously-harvested-file/59519 "2016-09-02T13:14:33Z")
Filebeat version : 1.2.3 OS : CentOS 7 (Docker) I have two type of log in path /cudetect/, and they are rotated to /cudetect/old/ at the same time. In /var/log/filebeat/filebeat : 2016-08-30T09:20:08Z INFO Old fi… --- ## [Filebeat Stop Cleaning Registry](https://discuss.elastic.co/t/filebeat-stop-cleaning-registry/58902)
**Author:** [@Gabry993](https://discuss.elastic.co/u/Gabry993)\ **Replies:** 9\ **Last updated:** [September 2, 2016, 7:44am UTC](https://discuss.elastic.co/t/filebeat-stop-cleaning-registry/58902 "2016-09-02T07:44:28Z")
Hi, I've got a problem related to log rotation and registry clean up. This is how the rotation works: after reaching a certain size, the file "logxxx.log" get renamed in "logxxx-timestamp.log" and a new "logxxx.log" is… --- ## [Customizing source field](https://discuss.elastic.co/t/customizing-source-field/59423)
**Author:** [@budm](https://discuss.elastic.co/u/budm)\ **Replies:** 3\ **Last updated:** [September 2, 2016, 7:34am UTC](https://discuss.elastic.co/t/customizing-source-field/59423 "2016-09-02T07:34:28Z")
I use filebeat with Graylog and noticed that in there source is always set to admin even if I override it with fields: source: srcm I also tried to set it in the top-level prospector configuration as - #some c… --- ## [Winlogbeat v5 fail to start after upgrade](https://discuss.elastic.co/t/winlogbeat-v5-fail-to-start-after-upgrade/47483)
**Author:** [@tuankun](https://discuss.elastic.co/u/tuankun)\ **Replies:** 11\ **Last updated:** [September 1, 2016, 9:06pm UTC](https://discuss.elastic.co/t/winlogbeat-v5-fail-to-start-after-upgrade/47483 "2016-09-01T21:06:27Z")
Hi Sir, I installed winlogbeat 1.1.2 on windows server 2012 R2, since it could not generate event\_data field ,I uninstalled the winlogbeat service using uninstall-service-winlogbeat.ps1,and replaced it with winlogbeat v… --- ## [Filbeat, Fields and Multiline](https://discuss.elastic.co/t/filbeat-fields-and-multiline/59526)
**Author:** [@Kryten](https://discuss.elastic.co/u/Kryten)\ **Replies:** 3\ **Last updated:** [September 1, 2016, 1:27pm UTC](https://discuss.elastic.co/t/filbeat-fields-and-multiline/59526 "2016-09-01T13:27:21Z")
Hi, I'm testing out some configurations with Filebeat and one thing which I am struggling to accomplish is having Filebeat add some form of indication to the event if it has been handled by multiline. The events are … --- ## [Filebeat + Redis multi-hosts](https://discuss.elastic.co/t/filebeat-redis-multi-hosts/59499)
**Author:** [@Clement\_Ros](https://discuss.elastic.co/u/Clement_Ros)\ **Replies:** 1\ **Last updated:** [September 1, 2016, 11:41am UTC](https://discuss.elastic.co/t/filebeat-redis-multi-hosts/59499 "2016-09-01T11:41:53Z")
Hi, i currently using filebeat to communicate with Logstash directly, but my beat input in Logstash crash when the number of host is too important. I try an other solution to add new hosts logs in my cluster, with the… --- ## [Logstash output: shrinkWindow is unexpectedly called twice?](https://discuss.elastic.co/t/logstash-output-shrinkwindow-is-unexpectedly-called-twice/59408)
**Author:** [@spacewander](https://discuss.elastic.co/u/spacewander)\ **Replies:** 3\ **Last updated:** [September 1, 2016, 11:31am UTC](https://discuss.elastic.co/t/logstash-output-shrinkwindow-is-unexpectedly-called-twice/59408 "2016-09-01T11:31:33Z")
Hey guys: I have just read the code in: , and find something strange here: Once c.publishWindowed returns an err, the send window will be shrinked by this line: However, there will be an asynchronous call i… --- ## [Architecturally should filebeat handle nested json parsing or should it be moved to logstash?](https://discuss.elastic.co/t/architecturally-should-filebeat-handle-nested-json-parsing-or-should-it-be-moved-to-logstash/59385)
**Author:** [@surajs](https://discuss.elastic.co/u/surajs)\ **Replies:** 4\ **Last updated:** [September 1, 2016, 11:19am UTC](https://discuss.elastic.co/t/architecturally-should-filebeat-handle-nested-json-parsing-or-should-it-be-moved-to-logstash/59385 "2016-09-01T11:19:38Z")
We're trying to parse docker json file logger produces logs in the following format : {"log":"{\\"msg\\":\\"Event started\\", \\"ts\\":\\"2016-08-30:01:02:03.000\\"}"} If you have 1000s of docker containers all writing logs i… --- ## [Fatal error: runtime: cannot map pages in arena address space](https://discuss.elastic.co/t/fatal-error-runtime-cannot-map-pages-in-arena-address-space/51250)
**Author:** [@ori.rubinfeld](https://discuss.elastic.co/u/ori.rubinfeld)\ **Replies:** 26\ **Last updated:** [September 1, 2016, 6:10am UTC](https://discuss.elastic.co/t/fatal-error-runtime-cannot-map-pages-in-arena-address-space/51250 "2016-09-01T06:10:46Z")
Hi all, I am getting the following error on windows servers, when the filebeat starts. fatal error: runtime: cannot map pages in arena address space Filebeat is 32bit Any idea, how to solve ? Thanks, Ori --- ## [Topbeat index not found](https://discuss.elastic.co/t/topbeat-index-not-found/59191)
**Author:** [@Jozsef](https://discuss.elastic.co/u/Jozsef)\ **Replies:** 5\ **Last updated:** [August 31, 2016, 9:31am UTC](https://discuss.elastic.co/t/topbeat-index-not-found/59191 "2016-08-31T09:31:08Z")
Hello, I'm using the 14 day Elastic Cloud free trial and I'm trying to monitor a remote server using Kibana + Topbeat. Since the Topbeat dashboard was not included by default in Kibana, I loaded them in using the offic… --- ## [Filebeat tls: oversized record received with length 20527](https://discuss.elastic.co/t/filebeat-tls-oversized-record-received-with-length-20527/59312)
**Author:** [@mha](https://discuss.elastic.co/u/mha)\ **Replies:** 3\ **Last updated:** [August 31, 2016, 6:44am UTC](https://discuss.elastic.co/t/filebeat-tls-oversized-record-received-with-length-20527/59312 "2016-08-31T06:44:30Z")
Hi I'm trying to use filebeat to push logs from centos 7 to AWS ElasticSearch service. AWS forces me to use https: hosts: \["https://search-.....-west-1.es.amazonaws.com:80/"\] filebeat fails with: 2016-08-30T12:43:28Z … --- ## [Metricbeat Kibana dashboard](https://discuss.elastic.co/t/metricbeat-kibana-dashboard/58725)
**Author:** [@Crai](https://discuss.elastic.co/u/Crai)\ **Replies:** 8\ **Last updated:** [August 31, 2016, 5:14am UTC](https://discuss.elastic.co/t/metricbeat-kibana-dashboard/58725 "2016-08-31T05:14:05Z")
After I updated to 5 alpha 5 for ES, Kibana, and Metricbeat I've noticed the metrics being collected from servers output has changed and look very wrong in comparison to what they were prior to the update. I even went … --- ## [Filebeat as a non-root user](https://discuss.elastic.co/t/filebeat-as-a-non-root-user/58946)
**Author:** [@lrem006](https://discuss.elastic.co/u/lrem006)\ **Replies:** 13\ **Last updated:** [August 31, 2016, 1:42am UTC](https://discuss.elastic.co/t/filebeat-as-a-non-root-user/58946 "2016-08-31T01:42:42Z")
Trying to get filebeat to run as a non-root user on a rpm distro. So far this is what I have: created a user useradd filebeat -u 5044 -c "Filebeat Service Account" -d /dev/null -s /sbin/nologin edited the filebe… --- ## [Filebeat forwarding to Logstash running in Mesos](https://discuss.elastic.co/t/filebeat-forwarding-to-logstash-running-in-mesos/59238)
**Author:** [@surajs](https://discuss.elastic.co/u/surajs)\ **Replies:** 4\ **Last updated:** [August 30, 2016, 9:32pm UTC](https://discuss.elastic.co/t/filebeat-forwarding-to-logstash-running-in-mesos/59238 "2016-08-30T21:32:25Z")
In my current organization, we are planning to run our ELK stack on Mesos. For log-forwarding, we plan on having filebeat instance running on each of the hosts that run a backend service. Is there a recommended way to… --- ## [Filebeat skipping log files](https://discuss.elastic.co/t/filebeat-skipping-log-files/59232)
**Author:** [@tcaudrey](https://discuss.elastic.co/u/tcaudrey)\ **Replies:** 3\ **Last updated:** [August 30, 2016, 2:44pm UTC](https://discuss.elastic.co/t/filebeat-skipping-log-files/59232 "2016-08-30T14:44:07Z")
Hello, Recently I have noticed filebeat has been skipping some log files completely. From the logs it seems as if logbeat thinks it's already consumed the log in question. Which is impossible, as the log didn't even ex… --- ## [Filebeat on pfSense (freebsd-386) only reads logs at startup](https://discuss.elastic.co/t/filebeat-on-pfsense-freebsd-386-only-reads-logs-at-startup/58476)
**Author:** [@CleanCut](https://discuss.elastic.co/u/CleanCut)\ **Replies:** 6\ **Last updated:** [August 29, 2016, 10:58pm UTC](https://discuss.elastic.co/t/filebeat-on-pfsense-freebsd-386-only-reads-logs-at-startup/58476 "2016-08-29T22:58:18Z")
On pfSense 2.2 (32-bit), filebeat will only read the log files once when it starts up. It appears everything works correctly for the first read -- everything reaches the stack like I expect. After that, no additional l… --- ## [Ensure Client Flushed Before Exit](https://discuss.elastic.co/t/ensure-client-flushed-before-exit/59137)
**Author:** [@blachniet](https://discuss.elastic.co/u/blachniet)\ **Replies:** 2\ **Last updated:** [August 29, 2016, 10:56am UTC](https://discuss.elastic.co/t/ensure-client-flushed-before-exit/59137 "2016-08-29T10:56:19Z")
I'm trying to create a custom beat that accepts input log input via stdin. For example you might feed a single completed log file into this beat like this: cat myapp.log | mybeat The problem that I'm having is that my… --- ## [Jmx module - Jolokia metric set](https://discuss.elastic.co/t/jmx-module-jolokia-metric-set/59102)
**Author:** [@vas78](https://discuss.elastic.co/u/vas78)\ **Replies:** 2\ **Last updated:** [August 29, 2016, 7:23am UTC](https://discuss.elastic.co/t/jmx-module-jolokia-metric-set/59102 "2016-08-29T07:23:57Z")
Hi there! I´ve developed a Jmx module for the metricbeat that polls data using Jolokia: https://github.com/vas78/beats/tree/master/metricbeat/module/jmx/jolokia. It already runs in some test environments and seems to b… --- ## [Filebeat s3 output?](https://discuss.elastic.co/t/filebeat-s3-output/59058)
**Author:** [@tmarthal](https://discuss.elastic.co/u/tmarthal)\ **Replies:** 3\ **Last updated:** [August 29, 2016, 4:48am UTC](https://discuss.elastic.co/t/filebeat-s3-output/59058 "2016-08-29T04:48:07Z")
Hi, I was looking to setup a log shipping system from our servers to s3 for storage. However, looking at the current (5.0/master) version of filebeat, it seems that there is no output mechanism to load the logs into s3 d… --- ## [About registry file](https://discuss.elastic.co/t/about-registry-file/58999)
**Author:** [@Elastic3150](https://discuss.elastic.co/u/Elastic3150)\ **Replies:** 2\ **Last updated:** [August 29, 2016, 12:13am UTC](https://discuss.elastic.co/t/about-registry-file/58999 "2016-08-29T00:13:14Z")
I'm using filebeat version 5.0.0-alpha5 (amd64), libbeat 5.0.0-alpha5 in following config: paths: - /pasth/to/access.log.\* clean\_removed: true close\_inactive: 2m (snip) I launch filebeat at '2016/8/26 11:30'. Th… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=563) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=565)