# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=566 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 567 --- ## [Topbeat Prospectors?](https://discuss.elastic.co/t/topbeat-prospectors/58038)
**Author:** [@Wikky](https://discuss.elastic.co/u/Wikky)\ **Replies:** 2\ **Last updated:** [August 16, 2016, 2:20pm UTC](https://discuss.elastic.co/t/topbeat-prospectors/58038 "2016-08-16T14:20:26Z")
Hey Everybody, I'm looking for some assistance here. I'm either missing something, or Topbeat just doesn't work the same as Filebeat. Can I install the Topbeat beat on the ELK Stack Host, without having to install the… --- ## [Piping Apache log line to stdin prospector panics Filebeat](https://discuss.elastic.co/t/piping-apache-log-line-to-stdin-prospector-panics-filebeat/58017)
**Author:** [@tobiassjosten](https://discuss.elastic.co/u/tobiassjosten)\ **Replies:** 2\ **Last updated:** [August 16, 2016, 2:16pm UTC](https://discuss.elastic.co/t/piping-apache-log-line-to-stdin-prospector-panics-filebeat/58017 "2016-08-16T14:16:13Z")
I want to collect logs from a remote service (Runnable.io) and send them onto our ELK stack using the Runnable CLI tool and Filebeat. The first part is easy but getting Filebeat to work has been trickier than I thought. … --- ## [Winlogbeat not outputting to Logstash](https://discuss.elastic.co/t/winlogbeat-not-outputting-to-logstash/57500)
**Author:** [@Diggy](https://discuss.elastic.co/u/Diggy)\ **Replies:** 13\ **Last updated:** [August 16, 2016, 2:10pm UTC](https://discuss.elastic.co/t/winlogbeat-not-outputting-to-logstash/57500 "2016-08-16T14:10:17Z")
All, I've read several posts here regarding getting Winlogbeat to send logs to an ELK server. However, these haven't helped me get it working. As I usually do, I probably am missing something simple. I already have… --- ## [Custom Eventlog Parsing](https://discuss.elastic.co/t/custom-eventlog-parsing/58009)
**Author:** [@rhyse](https://discuss.elastic.co/u/rhyse)\ **Replies:** 3\ **Last updated:** [August 16, 2016, 8:58am UTC](https://discuss.elastic.co/t/custom-eventlog-parsing/58009 "2016-08-16T08:58:29Z")
Hi I am trying to parse a custom windows Event log in to elasticsearch. This eventlog is generated from a powershell script Event Data: \`event\_data.param1 RunDate : 15/08/2016 08:29:58 Caller … --- ## [Pid file not found](https://discuss.elastic.co/t/pid-file-not-found/57659)
**Author:** [@Sai\_Birada](https://discuss.elastic.co/u/Sai_Birada)\ **Replies:** 7\ **Last updated:** [August 16, 2016, 4:10am UTC](https://discuss.elastic.co/t/pid-file-not-found/57659 "2016-08-16T04:10:40Z")
I installed topbeat in my centos box, and i am running topbeat by /etc/init.d/topbeat start. But i couldn't find /var/run/topbeat.pid file. I need that file to monit topbeat. I went through init script and it seems its w… --- ## [Filebeat on solaris amd 64 failing](https://discuss.elastic.co/t/filebeat-on-solaris-amd-64-failing/57761)
**Author:** [@vvg](https://discuss.elastic.co/u/vvg)\ **Replies:** 12\ **Last updated:** [August 12, 2016, 5:19pm UTC](https://discuss.elastic.co/t/filebeat-on-solaris-amd-64-failing/57761 "2016-08-12T17:19:11Z")
i picked up the library from here -https://beats-nightlies.s3.amazonaws.com/index.html?prefix=jenkins/filebeat/715-32446edc97bbfe933b1539a473e82a8b4a3a6942/ while running the svcadm i see the following exceptions in th… --- ## [How to find filebeat log files](https://discuss.elastic.co/t/how-to-find-filebeat-log-files/57939)
**Author:** [@daiyue](https://discuss.elastic.co/u/daiyue)\ **Replies:** 1\ **Last updated:** [August 12, 2016, 3:20pm UTC](https://discuss.elastic.co/t/how-to-find-filebeat-log-files/57939 "2016-08-12T15:20:48Z")
Hi, I am wondering where does fileabeat store its log files? I have tried search something like filebeat.log, but couldn't find anything on Arch Linux. cheers --- ## [How to know if filebeat has read all the logs in the folder](https://discuss.elastic.co/t/how-to-know-if-filebeat-has-read-all-the-logs-in-the-folder/57899)
**Author:** [@sruthib](https://discuss.elastic.co/u/sruthib)\ **Replies:** 1\ **Last updated:** [August 12, 2016, 2:04pm UTC](https://discuss.elastic.co/t/how-to-know-if-filebeat-has-read-all-the-logs-in-the-folder/57899 "2016-08-12T14:04:52Z")
1) How log does it basically take to read a file of 1 MB size?? It is taking around 5 mins for me which is a long time. Is there any parameter that i should keep in mind to make the processing time better. 2) And suppo… --- ## [Can you configure filebeat to exit as soon as eof is reached?](https://discuss.elastic.co/t/can-you-configure-filebeat-to-exit-as-soon-as-eof-is-reached/57867)
**Author:** [@lin-zhao](https://discuss.elastic.co/u/lin-zhao)\ **Replies:** 2\ **Last updated:** [August 12, 2016, 2:01pm UTC](https://discuss.elastic.co/t/can-you-configure-filebeat-to-exit-as-soon-as-eof-is-reached/57867 "2016-08-12T14:01:45Z")
I'm trying to do benchmark on filebeat and elasticsearch and would like to time the time taken to publish and index a file. Closest configuration I can find is close\_eof, but it doesn't cause filebeat process to exit. --- ## [Filebeat send data to kafka](https://discuss.elastic.co/t/filebeat-send-data-to-kafka/46620)
**Author:** [@zhanght1](https://discuss.elastic.co/u/zhanght1)\ **Replies:** 2\ **Last updated:** [August 12, 2016, 1:56pm UTC](https://discuss.elastic.co/t/filebeat-send-data-to-kafka/46620 "2016-08-12T13:56:02Z")
After installed the filebeat filebeat-5.0.0-alpha1 with filebeat.yml. filebeat: prospectors: - paths: - /var/log/test.log input\_type: log output: kafka: hosts: \["10.120.31.78:9092"\] … --- ## [Adding fields containg a log-level?](https://discuss.elastic.co/t/adding-fields-containg-a-log-level/57840)
**Author:** [@budm](https://discuss.elastic.co/u/budm)\ **Replies:** 6\ **Last updated:** [August 12, 2016, 8:42am UTC](https://discuss.elastic.co/t/adding-fields-containg-a-log-level/57840 "2016-08-12T08:42:03Z")
In our project we use logback with the following log-back pattern: \%date{ISO8601} \[%thread\] %-5level %logger{25} - %message%n\ I.e. all log messages have a format like this: 2013-03-10 10:14:16,458 \[d… --- ## [Filebeat: recursively fetch all files in all subdirectories of a directory](https://discuss.elastic.co/t/filebeat-recursively-fetch-all-files-in-all-subdirectories-of-a-directory/47834)
**Author:** [@stecino](https://discuss.elastic.co/u/stecino)\ **Replies:** 12\ **Last updated:** [August 12, 2016, 8:33am UTC](https://discuss.elastic.co/t/filebeat-recursively-fetch-all-files-in-all-subdirectories-of-a-directory/47834 "2016-08-12T08:33:02Z")
I thought i read somewhere that filebeat 5.0.0 alpha has addressed this. But now after implementation it says it doesn't --- ## [Filebeat is not starting](https://discuss.elastic.co/t/filebeat-is-not-starting/57832)
**Author:** [@rai](https://discuss.elastic.co/u/rai)\ **Replies:** 5\ **Last updated:** [August 11, 2016, 11:48pm UTC](https://discuss.elastic.co/t/filebeat-is-not-starting/57832 "2016-08-11T23:48:47Z")
I am new to ELK stack and trying make it work. First I tried to configure filebeat to display syslog on Kibana and able to get through but when I tried to get DOCS logs, Filebeat failed to start. Following is snippet … --- ## [How to send logs from different files to different logstash?](https://discuss.elastic.co/t/how-to-send-logs-from-different-files-to-different-logstash/57826)
**Author:** [@budm](https://discuss.elastic.co/u/budm)\ **Replies:** 1\ **Last updated:** [August 11, 2016, 1:56pm UTC](https://discuss.elastic.co/t/how-to-send-logs-from-different-files-to-different-logstash/57826 "2016-08-11T13:56:30Z")
I have two files which I need to send to logstash: /var/log/file1.log /var/log/file2.log and I'd like to send content of file1.log to host1:port1, but file2.log to host2:port2. Is it even possible to do somehow… --- ## [Multiple JVM log to send (wildfly)](https://discuss.elastic.co/t/multiple-jvm-log-to-send-wildfly/57665)
**Author:** [@fdlprod](https://discuss.elastic.co/u/fdlprod)\ **Replies:** 3\ **Last updated:** [August 11, 2016, 12:56pm UTC](https://discuss.elastic.co/t/multiple-jvm-log-to-send-wildfly/57665 "2016-08-11T12:56:05Z")
Hi, i have one issue, problem, question, indeed i have on the same host 3 differents JVM, before with logstash-Forwarder i can add a name on each log i send to logstash indexer... now in filebeat this is the configur… --- ## [Filebeat issue Rsource not availbale](https://discuss.elastic.co/t/filebeat-issue-rsource-not-availbale/57816)
**Author:** [@suprverm](https://discuss.elastic.co/u/suprverm)\ **Replies:** 0\ **Last updated:** [August 11, 2016, 12:55pm UTC](https://discuss.elastic.co/t/filebeat-issue-rsource-not-availbale/57816 "2016-08-11T12:55:24Z")
I have to do the bulk indexing using filebeat and logstash which is around of 2 months logs on hourly basis , counts to 207630 files. I am getting the below error. runtime/cgo: pthread\_create failed: Resource temporar… --- ## [Metricbeat 5.0.0-alpha5 processors range works other than documented](https://discuss.elastic.co/t/metricbeat-5-0-0-alpha5-processors-range-works-other-than-documented/57769)
**Author:** [@kaem2111](https://discuss.elastic.co/u/kaem2111)\ **Replies:** 2\ **Last updated:** [August 11, 2016, 11:45am UTC](https://discuss.elastic.co/t/metricbeat-5-0-0-alpha5-processors-range-works-other-than-documented/57769 "2016-08-11T11:45:41Z")
Hello, I use metricbeat 5.0.0-alpha5 with processors and range. I tried: processors: - drop\_event: when: range: lte: system.process.cpu.total.pct: 0.0001 which leads to configuration … --- ## [TLS connection failed because of certificate signed by unknown authority](https://discuss.elastic.co/t/tls-connection-failed-because-of-certificate-signed-by-unknown-authority/57064)
**Author:** [@caoping](https://discuss.elastic.co/u/caoping)\ **Replies:** 16\ **Last updated:** [August 11, 2016, 10:48am UTC](https://discuss.elastic.co/t/tls-connection-failed-because-of-certificate-signed-by-unknown-authority/57064 "2016-08-11T10:48:05Z")
Hello, I have spent two days in configuring filebeat TLS, and always encountered below error. Can anyone give me some tips on how to resolve this issue? The error message in filebeat side: Below is the steps and co… --- ## [Multiple hosts monitoring](https://discuss.elastic.co/t/multiple-hosts-monitoring/57225)
**Author:** [@fdlprod](https://discuss.elastic.co/u/fdlprod)\ **Replies:** 9\ **Last updated:** [August 11, 2016, 10:28am UTC](https://discuss.elastic.co/t/multiple-hosts-monitoring/57225 "2016-08-11T10:28:11Z")
Hi i have 2 hosts with topbeat configured to send to another host (third) the problem is i can't disting 2 hosts on kibana dashboard, furthermore it takes all "-" in name as a new machine so i have 2 hosts to monitor, bu… --- ## [How to reimport logs after deleting them with XDELETE?](https://discuss.elastic.co/t/how-to-reimport-logs-after-deleting-them-with-xdelete/57195)
**Author:** [@Gisamark](https://discuss.elastic.co/u/Gisamark)\ **Replies:** 2\ **Last updated:** [August 11, 2016, 8:14am UTC](https://discuss.elastic.co/t/how-to-reimport-logs-after-deleting-them-with-xdelete/57195 "2016-08-11T08:14:10Z")
My config is : - ELK server - Filebeat server I made tests with old logs and wanted to delete them all by doing sudo curl -XDELETE localhost:9200/index on the ELK server. It works fine. But now, I want to reimport t… --- ## [Link between Kibana filebeat and logstash not done](https://discuss.elastic.co/t/link-between-kibana-filebeat-and-logstash-not-done/57676)
**Author:** [@fdlprod](https://discuss.elastic.co/u/fdlprod)\ **Replies:** 2\ **Last updated:** [August 11, 2016, 6:53am UTC](https://discuss.elastic.co/t/link-between-kibana-filebeat-and-logstash-not-done/57676 "2016-08-11T06:53:16Z")
Hi, I use Filebeat, logstash and Kibana on the same host but in KIbana i see nothing here is logstash logs 2016-08-10T10:22:53+02:00 DBG End of file reached: C:\\dev\\servers\\wildfly-9.0.2.Final\\domain\\servers\\server-… --- ## [Filebeats and multiple files](https://discuss.elastic.co/t/filebeats-and-multiple-files/57295)
**Author:** [@jamesl](https://discuss.elastic.co/u/jamesl)\ **Replies:** 4\ **Last updated:** [August 10, 2016, 1:29pm UTC](https://discuss.elastic.co/t/filebeats-and-multiple-files/57295 "2016-08-10T13:29:03Z")
Hi. I have a requirement to pull in multiple files from the same host, but in Logstash they need to follow different input/filter and output paths. I was going to setup 2 Filebeats on this Unix hosts but that doesn't see… --- ## [Tons of formats, one path structure mesos/marathon](https://discuss.elastic.co/t/tons-of-formats-one-path-structure-mesos-marathon/57618)
**Author:** [@liammac](https://discuss.elastic.co/u/liammac)\ **Replies:** 1\ **Last updated:** [August 10, 2016, 12:13pm UTC](https://discuss.elastic.co/t/tons-of-formats-one-path-structure-mesos-marathon/57618 "2016-08-10T12:13:01Z")
I'm trying to sort out the best way to go about this, I have a mesos/marathon cluster I'm trying to setup comprehensive logging on, Requirements, -new applications must be logged even if all fields are not extracted p… --- ## [Create field in Filebeat as Logstash](https://discuss.elastic.co/t/create-field-in-filebeat-as-logstash/57680)
**Author:** [@fdlprod](https://discuss.elastic.co/u/fdlprod)\ **Replies:** 6\ **Last updated:** [August 10, 2016, 12:04pm UTC](https://discuss.elastic.co/t/create-field-in-filebeat-as-logstash/57680 "2016-08-10T12:04:02Z")
HI, i have now logs read from filebeat and they are less cut than logstash , indeed in logstash for example i have the LOG LEVEL field and not in filebeat, how can i proceed to have it please ? and the new --- ## [Multiline configuration](https://discuss.elastic.co/t/multiline-configuration/57450)
**Author:** [@NekoNova](https://discuss.elastic.co/u/NekoNova)\ **Replies:** 6\ **Last updated:** [August 10, 2016, 11:57am UTC](https://discuss.elastic.co/t/multiline-configuration/57450 "2016-08-10T11:57:30Z")
Hello, I'm currently trying to get our Filebeat to recognize proper rails logging messages, and I'm using the following configuration for the multiline part: multiline: pattern: '^\[0-9\]{4}-\[0-9\]{2}-\[0-9\]{2}T\[0-9\]… --- ## [Merge multiple lines into one with Filebeat](https://discuss.elastic.co/t/merge-multiple-lines-into-one-with-filebeat/57352)
**Author:** [@theopiboubes](https://discuss.elastic.co/u/theopiboubes)\ **Replies:** 2\ **Last updated:** [August 10, 2016, 8:59am UTC](https://discuss.elastic.co/t/merge-multiple-lines-into-one-with-filebeat/57352 "2016-08-10T08:59:51Z")
Hi! I have a Filebeat instance running along with a Logstash server, to which Filebeat data is forwarded. Before sending data to Logstash, I want to merge certain lines of the watched log file together. For example, … --- ## [Winlogbeat Mapping Template](https://discuss.elastic.co/t/winlogbeat-mapping-template/57554)
**Author:** [@rhyse](https://discuss.elastic.co/u/rhyse)\ **Replies:** 5\ **Last updated:** [August 10, 2016, 8:08am UTC](https://discuss.elastic.co/t/winlogbeat-mapping-template/57554 "2016-08-10T08:08:45Z")
Hi I am having the following issue https://discuss.elastic.co/t/query-help-search-for/57429 I have loaded the default winlogbeat template (I'm using v5 Alpha 4 agents) { "mappings": { "\_default\_": { … --- ## [FileBeat not sending info to elastic](https://discuss.elastic.co/t/filebeat-not-sending-info-to-elastic/56516)
**Author:** [@alvaroca1](https://discuss.elastic.co/u/alvaroca1)\ **Replies:** 5\ **Last updated:** [August 9, 2016, 9:15pm UTC](https://discuss.elastic.co/t/filebeat-not-sending-info-to-elastic/56516 "2016-08-09T21:15:15Z")
Good day, I'm new to Elastic and I have a single node cluster of elastic running with winlog beat sending data to elastic but when I try to configure a filebeat to send data to elastic it does not seem to communicate. se… --- ## [Memory metrics](https://discuss.elastic.co/t/memory-metrics/57490)
**Author:** [@MarkGavalda](https://discuss.elastic.co/u/MarkGavalda)\ **Replies:** 1\ **Last updated:** [August 9, 2016, 2:05pm UTC](https://discuss.elastic.co/t/memory-metrics/57490 "2016-08-09T14:05:35Z")
On Linux (and probably other Unix based) machines it would be great to see more details about the memory metrics: instead of just used/free plus swap it would be good to see buff&caches, shared and available, just like f… --- ## [Filebeat 5 decoding json probrom](https://discuss.elastic.co/t/filebeat-5-decoding-json-probrom/57559)
**Author:** [@Andy\_Young](https://discuss.elastic.co/u/Andy_Young)\ **Replies:** 1\ **Last updated:** [August 9, 2016, 10:48am UTC](https://discuss.elastic.co/t/filebeat-5-decoding-json-probrom/57559 "2016-08-09T10:48:47Z")
Hi,guys I test the filebeat-5.0.0\_alpha4-1 and found it show many logs like that: " 2016/08/09 07:28:35.013208 json.go:38: ERR Error decoding JSON: invalid character ',' in numeric literal 2016/08/09 07:28:35.013277 js… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=565) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=567)