# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=565 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 566 --- ## [Filebeat not picking files from path](https://discuss.elastic.co/t/filebeat-not-picking-files-from-path/59010)
**Author:** [@Ganesh2303](https://discuss.elastic.co/u/Ganesh2303)\ **Replies:** 1\ **Last updated:** [August 28, 2016, 2:16pm UTC](https://discuss.elastic.co/t/filebeat-not-picking-files-from-path/59010 "2016-08-28T14:16:05Z")
HI Team, I'm picking my logs using filebeat when i hardcode my path beats pick it properly without any trouble instead of that if i define the path with regular expression it fail to pick the file and keep on posting sta… --- ## [Can filebeat decode embedded json string in a particular field](https://discuss.elastic.co/t/can-filebeat-decode-embedded-json-string-in-a-particular-field/59097)
**Author:** [@yanjun](https://discuss.elastic.co/u/yanjun)\ **Replies:** 2\ **Last updated:** [August 28, 2016, 4:18am UTC](https://discuss.elastic.co/t/can-filebeat-decode-embedded-json-string-in-a-particular-field/59097 "2016-08-28T04:18:31Z")
We have docker json-file logger produces this kind of log messages (docker meta data removed) {"log":"{\\"test\\":\\"test\\"}"} Is it possible to configure filebeat5.0 to also decode the string inside "log"? Or we have to … --- ## [System memory usuage in MBytes](https://discuss.elastic.co/t/system-memory-usuage-in-mbytes/58913)
**Author:** [@prem\_sompura](https://discuss.elastic.co/u/prem_sompura)\ **Replies:** 2\ **Last updated:** [August 26, 2016, 7:57am UTC](https://discuss.elastic.co/t/system-memory-usuage-in-mbytes/58913 "2016-08-26T07:57:49Z")
By default metricbeat generate system.memory.used in bytes. However I changed the system.memory.used.bytes to system.memory.used.mb in template and then reloaded the template but all in vain. It wasn't that easy. I wa… --- ## [Numbers being encoded as floats](https://discuss.elastic.co/t/numbers-being-encoded-as-floats/58872)
**Author:** [@jasonish](https://discuss.elastic.co/u/jasonish)\ **Replies:** 3\ **Last updated:** [August 26, 2016, 12:10am UTC](https://discuss.elastic.co/t/numbers-being-encoded-as-floats/58872 "2016-08-26T00:10:05Z")
I ran into an issue where the JSON sent to Elastic Search was being encoded as a float. This appears to a normal Golang solved by creating a json.NewDecoder and setting .UseNumber(). Fine enough, the JSON I'm parsing n… --- ## [Filebeat and Multiline Problem](https://discuss.elastic.co/t/filebeat-and-multiline-problem/58831)
**Author:** [@Kryten](https://discuss.elastic.co/u/Kryten)\ **Replies:** 2\ **Last updated:** [August 24, 2016, 3:49pm UTC](https://discuss.elastic.co/t/filebeat-and-multiline-problem/58831 "2016-08-24T15:49:34Z")
Hi, I'm using Filbeat 1.2.3 on Windows and seeing a problem with multiline and would appreciate someone pointing out what I must be doing wrong. I'm sending my Filebeat events to Logstash. Here are the relevant confi… --- ## [Anyone tried installing beats with managed AWS ES?](https://discuss.elastic.co/t/anyone-tried-installing-beats-with-managed-aws-es/43146)
**Author:** [@piyush](https://discuss.elastic.co/u/piyush)\ **Replies:** 10\ **Last updated:** [August 24, 2016, 2:33pm UTC](https://discuss.elastic.co/t/anyone-tried-installing-beats-with-managed-aws-es/43146 "2016-08-24T14:33:15Z")
Filebeat & Topbeat are getting connection error while trying to connect AWS ES. The logs says, it's adding port (9200) to the host address whereas managed ES endpoint doesn't have a port. --- ## [Loading config file error: YAML config parsing failed on /usr/local/etc/filebeat.yml](https://discuss.elastic.co/t/loading-config-file-error-yaml-config-parsing-failed-on-usr-local-etc-filebeat-yml/58755)
**Author:** [@reo7189](https://discuss.elastic.co/u/reo7189)\ **Replies:** 6\ **Last updated:** [August 24, 2016, 2:03pm UTC](https://discuss.elastic.co/t/loading-config-file-error-yaml-config-parsing-failed-on-usr-local-etc-filebeat-yml/58755 "2016-08-24T14:03:59Z")
FreeBSD 10.3, filebeat 1.2.3, when trying "service filbert start" I got endless error "Loading config file error: YAML config parsing failed on /usr/local/etc/filebeat.yml: yaml: line 7: found character that cannot start… --- ## [Filebeat Vulenerability - Logjam attack](https://discuss.elastic.co/t/filebeat-vulenerability-logjam-attack/58572)
**Author:** [@vienodp](https://discuss.elastic.co/u/vienodp)\ **Replies:** 5\ **Last updated:** [August 24, 2016, 10:40am UTC](https://discuss.elastic.co/t/filebeat-vulenerability-logjam-attack/58572 "2016-08-24T10:40:37Z")
Hi , Background - ELK 2,3, Shield 2.x, Filebeat latest stable. Configuration done - We are trying to configure Filebeat with TLS V1.2 Filebeat sending data to logstash , so logstash output is configured. For that w… --- ## [Import\_dashboards (golang) fails to find zip file for download](https://discuss.elastic.co/t/import-dashboards-golang-fails-to-find-zip-file-for-download/58759)
**Author:** [@Tim\_Burt](https://discuss.elastic.co/u/Tim_Burt)\ **Replies:** 1\ **Last updated:** [August 24, 2016, 7:22am UTC](https://discuss.elastic.co/t/import-dashboards-golang-fails-to-find-zip-file-for-download/58759 "2016-08-24T07:22:04Z")
The newly minted golang version of the import\_dashboards command found in the repo libbeat/dashboards directory tries to download the zip file.... Create temporary directory /tmp/tmp399753025 Downloading https://downlo… --- ## [Ship kubernetes containers Logs using filebeat](https://discuss.elastic.co/t/ship-kubernetes-containers-logs-using-filebeat/58630)
**Author:** [@nanshan](https://discuss.elastic.co/u/nanshan)\ **Replies:** 2\ **Last updated:** [August 23, 2016, 9:56pm UTC](https://discuss.elastic.co/t/ship-kubernetes-containers-logs-using-filebeat/58630 "2016-08-23T21:56:25Z")
Where to find the containers logs? --- ## [Multiple filebeat instances or not?](https://discuss.elastic.co/t/multiple-filebeat-instances-or-not/58487)
**Author:** [@Akshaykapoor](https://discuss.elastic.co/u/Akshaykapoor)\ **Replies:** 5\ **Last updated:** [August 23, 2016, 8:42am UTC](https://discuss.elastic.co/t/multiple-filebeat-instances-or-not/58487 "2016-08-23T08:42:49Z")
I have a use-case where i can have multiple ES clusters running. I want to be able to send logs from multiple sources to 2 ES clusters. 1st gets business critical logs 2nd gets all common logs, VM specific This way… --- ## [Detect DNS tunneling](https://discuss.elastic.co/t/detect-dns-tunneling/56587)
**Author:** [@pfe](https://discuss.elastic.co/u/pfe)\ **Replies:** 12\ **Last updated:** [August 22, 2016, 3:54pm UTC](https://discuss.elastic.co/t/detect-dns-tunneling/56587 "2016-08-22T15:54:59Z")
It\`s the first time that i used Packetbeat, and I wanted to know How can we use packetbeat ,elasticsearch to capture DNS traffic and to detect DNS tunneling from my iodine ? Thank you Regards --- ## [Adding .raw to winlogbeat messages](https://discuss.elastic.co/t/adding-raw-to-winlogbeat-messages/58159)
**Author:** [@joshablett](https://discuss.elastic.co/u/joshablett)\ **Replies:** 10\ **Last updated:** [August 22, 2016, 3:36pm UTC](https://discuss.elastic.co/t/adding-raw-to-winlogbeat-messages/58159 "2016-08-22T15:36:25Z")
Hi - I'm using the default winlogbeat.template.json file that downloaded with winlogbeat. I've made some modifications to the mapping in an attempt to get .raw not-analyzed results to show up for key string fields in W… --- ## [Filebeat config/TestReadConfig2](https://discuss.elastic.co/t/filebeat-config-testreadconfig2/58293)
**Author:** [@csdrane](https://discuss.elastic.co/u/csdrane)\ **Replies:** 1\ **Last updated:** [August 22, 2016, 10:23am UTC](https://discuss.elastic.co/t/filebeat-config-testreadconfig2/58293 "2016-08-22T10:23:57Z")
I'm new to the beats codebase and am wondering whether test TestReadConfig2 in filebeat/config is working as intended. Namely, it seems that cfgfile.Read() on line 23 isn't working correctly. A println reveals that confi… --- ## [Filebeat Multiline Weblogic//Java Stacktrace](https://discuss.elastic.co/t/filebeat-multiline-weblogic-java-stacktrace/58348)
**Author:** [@JensK](https://discuss.elastic.co/u/JensK)\ **Replies:** 10\ **Last updated:** [August 22, 2016, 10:13am UTC](https://discuss.elastic.co/t/filebeat-multiline-weblogic-java-stacktrace/58348 "2016-08-22T10:13:25Z")
Hello guys :slight\_smile: im testing ELK with Weblogic Application Server and want to parse the server.out file with filebeat. This ist my Example file.... \<18.08.2016 14:00 Uhr MESZ\> \ \ \ \<… --- ## [Filebeat exclude\_linex regex to exclude all lines not containing error](https://discuss.elastic.co/t/filebeat-exclude-linex-regex-to-exclude-all-lines-not-containing-error/58388)
**Author:** [@agonzalez](https://discuss.elastic.co/u/agonzalez)\ **Replies:** 5\ **Last updated:** [August 22, 2016, 9:54am UTC](https://discuss.elastic.co/t/filebeat-exclude-linex-regex-to-exclude-all-lines-not-containing-error/58388 "2016-08-22T09:54:20Z")
Anyone can help me with the regex to ignore all lines that doesnt contain error or Error at any position of the line? --- ## [Filebeat with JSON logs](https://discuss.elastic.co/t/filebeat-with-json-logs/58556)
**Author:** [@Douglas\_Ribas](https://discuss.elastic.co/u/Douglas_Ribas)\ **Replies:** 1\ **Last updated:** [August 22, 2016, 8:25am UTC](https://discuss.elastic.co/t/filebeat-with-json-logs/58556 "2016-08-22T08:25:56Z")
Hi people. I have this situation, all import dates stay in message space I have logs in format JSON line by line {'date':'2016-08-22','time':'04:42:59', 'user':'joana','busca':'uol.com','servidor':'Node-03'} {'date':'20… --- ## [Loading config file error: open filebeat.yml: function not implemented](https://discuss.elastic.co/t/loading-config-file-error-open-filebeat-yml-function-not-implemented/46708)
**Author:** [@iyaozhen](https://discuss.elastic.co/u/iyaozhen)\ **Replies:** 6\ **Last updated:** [August 21, 2016, 5:07pm UTC](https://discuss.elastic.co/t/loading-config-file-error-open-filebeat-yml-function-not-implemented/46708 "2016-08-21T17:07:16Z")
$ ./filebeat -c filebeat.yml -e Loading config file error: Failed to read filebeat.yml: open filebeat.yml: function not implemented. Exiting. my system: LSB Version: :core-3.0-amd64:core-3.0-noarch:graphics-3.0-amd64:g… --- ## [Deleting all beats indices with Curator](https://discuss.elastic.co/t/deleting-all-beats-indices-with-curator/58464)
**Author:** [@Diggy](https://discuss.elastic.co/u/Diggy)\ **Replies:** 2\ **Last updated:** [August 19, 2016, 4:13pm UTC](https://discuss.elastic.co/t/deleting-all-beats-indices-with-curator/58464 "2016-08-19T16:13:21Z")
Hope this is the right place to post this: I've installed Curator 4.0.1, and am using it to delete indices older than 14 days. It works fine if I'm only trying to delete a single index like logstash or filebeat. Howe… --- ## [\[bug\] filebeat can't send data to kafka cluster when one kafka can't connect because of network](https://discuss.elastic.co/t/bug-filebeat-cant-send-data-to-kafka-cluster-when-one-kafka-cant-connect-because-of-network/56184)
**Author:** [@WangXiangUSTC](https://discuss.elastic.co/u/WangXiangUSTC)\ **Replies:** 5\ **Last updated:** [August 19, 2016, 3:57pm UTC](https://discuss.elastic.co/t/bug-filebeat-cant-send-data-to-kafka-cluster-when-one-kafka-cant-connect-because-of-network/56184 "2016-08-19T15:57:17Z")
Filebeat version: 5.0.0-alpha4 Operating System: debian 8 I use filebeat get log from computer A, and then send to a kafka cluster group by two kafka run at two computers named B and C. Today, I test the high avaliabi… --- ## [Output beat events as plain HTTP POST](https://discuss.elastic.co/t/output-beat-events-as-plain-http-post/57923)
**Author:** [@raboof](https://discuss.elastic.co/u/raboof)\ **Replies:** 6\ **Last updated:** [August 19, 2016, 2:46pm UTC](https://discuss.elastic.co/t/output-beat-events-as-plain-http-post/57923 "2016-08-19T14:46:28Z")
The current suite of output modules doesn't include a publisher that simply POST's the events to some generic HTTP endpoint, without having to go through e.g. logstash. I've made a PoC of this idea at https://github.co… --- ## [ParseMemcache(UDP) exception: invalid memory address or nil pointer dereference](https://discuss.elastic.co/t/parsememcache-udp-exception-invalid-memory-address-or-nil-pointer-dereference/57956)
**Author:** [@codekoala](https://discuss.elastic.co/u/codekoala)\ **Replies:** 7\ **Last updated:** [August 19, 2016, 2:39pm UTC](https://discuss.elastic.co/t/parsememcache-udp-exception-invalid-memory-address-or-nil-pointer-dereference/57956 "2016-08-19T14:39:40Z")
Using packetbeat version 1.2.3 (amd64) on Arch Linux with the default configuration, I received the following output: 2016/08/12 20:00:46.305470 log.go:113: ERR ParseMemcache(UDP) exception. Recovering, but please repo… --- ## [Add additional windows counters](https://discuss.elastic.co/t/add-additional-windows-counters/58372)
**Author:** [@Zfs](https://discuss.elastic.co/u/Zfs)\ **Replies:** 1\ **Last updated:** [August 19, 2016, 6:42am UTC](https://discuss.elastic.co/t/add-additional-windows-counters/58372 "2016-08-19T06:42:03Z")
Is it possible to add additional windows counters to metricbeat? I'm wanting to add the Virtual Bytes counter to the metricset "process". Thanks --- ## [Corrupt winlogbeat.yml checkpoint file](https://discuss.elastic.co/t/corrupt-winlogbeat-yml-checkpoint-file/58417)
**Author:** [@mcgrew](https://discuss.elastic.co/u/mcgrew)\ **Replies:** 7\ **Last updated:** [August 19, 2016, 2:06am UTC](https://discuss.elastic.co/t/corrupt-winlogbeat-yml-checkpoint-file/58417 "2016-08-19T02:06:02Z")
I'm using 5.0.0-alpha4 and I noticed that on some users the service was not able to start up. The following error was in the log file: 2016-08-18T18:22:56-07:00 CRIT Exiting: yaml: control characters are not allowed I… --- ## [Filebeat on Windows xp forcibly closed by the remote host](https://discuss.elastic.co/t/filebeat-on-windows-xp-forcibly-closed-by-the-remote-host/58270)
**Author:** [@pjhu](https://discuss.elastic.co/u/pjhu)\ **Replies:** 4\ **Last updated:** [August 19, 2016, 1:52am UTC](https://discuss.elastic.co/t/filebeat-on-windows-xp-forcibly-closed-by-the-remote-host/58270 "2016-08-19T01:52:07Z")
I am using Filebeat on windows xp ship log to logstash Filebeat DEBUG log 2016-08-17T19:34:31+08:00 DBG output worker: publish 1 events 2016-08-17T19:34:31+08:00 DBG Try to publish 1 events to logstash with window s… --- ## [Does Filebeat need logstash to process syslog headers?](https://discuss.elastic.co/t/does-filebeat-need-logstash-to-process-syslog-headers/58313)
**Author:** [@PandKing](https://discuss.elastic.co/u/PandKing)\ **Replies:** 2\ **Last updated:** [August 18, 2016, 4:27pm UTC](https://discuss.elastic.co/t/does-filebeat-need-logstash-to-process-syslog-headers/58313 "2016-08-18T16:27:42Z")
On my second day of searching for a minimalist solution. I can get syslog data directly into ES using filebeat but none of the syslog headers are getting parsed so it's kind of useless. Do I need to use logstash fo… --- ## [Filebeat 32-bit crash in Windows environment](https://discuss.elastic.co/t/filebeat-32-bit-crash-in-windows-environment/58083)
**Author:** [@allenz](https://discuss.elastic.co/u/allenz)\ **Replies:** 6\ **Last updated:** [August 18, 2016, 10:27am UTC](https://discuss.elastic.co/t/filebeat-32-bit-crash-in-windows-environment/58083 "2016-08-18T10:27:11Z")
It seems the filebeat I installed in Window environment keep crashing before send any log files into logstash. currently I am using filebeat version 1.1.1 and later tested with 1.2.3 however the results are the same. … --- ## [Can Filebeat watch for new files created in a directory?](https://discuss.elastic.co/t/can-filebeat-watch-for-new-files-created-in-a-directory/57811)
**Author:** [@dooblem](https://discuss.elastic.co/u/dooblem)\ **Replies:** 8\ **Last updated:** [August 18, 2016, 5:46am UTC](https://discuss.elastic.co/t/can-filebeat-watch-for-new-files-created-in-a-directory/57811 "2016-08-18T05:46:56Z")
Hello all, Magento is a PHP ecommerce application. In case of severe problems, Magento crashes, generating a file for each crash in a var/report directory. The file contains informations about the crash (db unreachable… --- ## [Poll remote hosts for metrics from a central Metricbeat installation](https://discuss.elastic.co/t/poll-remote-hosts-for-metrics-from-a-central-metricbeat-installation/57546)
**Author:** [@rahulswaminathan](https://discuss.elastic.co/u/rahulswaminathan)\ **Replies:** 5\ **Last updated:** [August 18, 2016, 5:44am UTC](https://discuss.elastic.co/t/poll-remote-hosts-for-metrics-from-a-central-metricbeat-installation/57546 "2016-08-18T05:44:23Z")
Hi, Does (or will) Metricbeat support polling remote hosts like routers,switches,etc. for metrics from a central server (where Metricbeat would be installed)? The reason for this is most routers and switches do not p… --- ## [Filebeat failed to send message to logstash with SSL enabled](https://discuss.elastic.co/t/filebeat-failed-to-send-message-to-logstash-with-ssl-enabled/58125)
**Author:** [@Zou\_Panxia](https://discuss.elastic.co/u/Zou_Panxia)\ **Replies:** 5\ **Last updated:** [August 17, 2016, 5:08pm UTC](https://discuss.elastic.co/t/filebeat-failed-to-send-message-to-logstash-with-ssl-enabled/58125 "2016-08-17T17:08:03Z")
I downloaded the latest logstash(2.3.4) and filebeat (1.2.3) for some testing. It works when ssl is not enabled. When it is enabled with ssl, curl verification works as well. However filebeat keeps to report "ERR SSL cli… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=564) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=566)