# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=568 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 569 --- ## [How to config filebeat to listen on a cloud server](https://discuss.elastic.co/t/how-to-config-filebeat-to-listen-on-a-cloud-server/57024)
**Author:** [@daiyue](https://discuss.elastic.co/u/daiyue)\ **Replies:** 2\ **Last updated:** [August 3, 2016, 8:58am UTC](https://discuss.elastic.co/t/how-to-config-filebeat-to-listen-on-a-cloud-server/57024 "2016-08-03T08:58:51Z")
Hi, I have an ELK cloud server, which is also installed filebeat on it. I am wondering how to config filebeat to listen on another server (e.g. the internal ip: 192.168.xxx.xxx). Which section of filebeat.yml do I modify… --- ## [Is there a filebat multline filter for 'start xxxx end' string?](https://discuss.elastic.co/t/is-there-a-filebat-multline-filter-for-start-xxxx-end-string/56772)
**Author:** [@zoplex](https://discuss.elastic.co/u/zoplex)\ **Replies:** 10\ **Last updated:** [August 2, 2016, 11:12pm UTC](https://discuss.elastic.co/t/is-there-a-filebat-multline-filter-for-start-xxxx-end-string/56772 "2016-08-02T23:12:30Z")
Hi, if there is a filebeat multiline filter for the following input lines: " STARTOFSTRING .. .... .... ... ENDOFSTRING could that be captured with filebeat.yml? The number of lines in between is variable, and the … --- ## [Getting the IP address of the Winlogbeat host from Logstash](https://discuss.elastic.co/t/getting-the-ip-address-of-the-winlogbeat-host-from-logstash/55444)
**Author:** [@Aron\_Pedersen](https://discuss.elastic.co/u/Aron_Pedersen)\ **Replies:** 3\ **Last updated:** [August 2, 2016, 6:16pm UTC](https://discuss.elastic.co/t/getting-the-ip-address-of-the-winlogbeat-host-from-logstash/55444 "2016-08-02T18:16:36Z")
In the new upcoming Winlogbeat 5.0.0 will it be able to send the computers IP address to logstash, so that in logstash we can add a Geo Location? --- ## [Target my ES cluster with ~40 FileBeat instances](https://discuss.elastic.co/t/target-my-es-cluster-with-40-filebeat-instances/56824)
**Author:** [@Yarden\_Bar](https://discuss.elastic.co/u/Yarden_Bar)\ **Replies:** 5\ **Last updated:** [August 2, 2016, 6:02pm UTC](https://discuss.elastic.co/t/target-my-es-cluster-with-40-filebeat-instances/56824 "2016-08-02T18:02:20Z")
Hello, Last year I found that Logstash doesn't perform load balancing between inputs and 'prefer' inputs that doesn't have pushback mechanism or that pushback is not relevant for them (like syslog input) I'm thinking a… --- ## [Metricbeat on FreeBSD using a lot of resources](https://discuss.elastic.co/t/metricbeat-on-freebsd-using-a-lot-of-resources/55412)
**Author:** [@michbsd](https://discuss.elastic.co/u/michbsd)\ **Replies:** 20\ **Last updated:** [August 2, 2016, 2:34pm UTC](https://discuss.elastic.co/t/metricbeat-on-freebsd-using-a-lot-of-resources/55412 "2016-08-02T14:34:16Z")
Hi, I am running Metricbeat on FreeBSD. ❯ ./metricbeat -version \[3:42:34 PM\] metricbeat version 5.0.0-alpha4 (amd64), libbeat 5.0.0-alpha4 It seems to use a whole lot… --- ## [Filebeat Service fails with no error in log file](https://discuss.elastic.co/t/filebeat-service-fails-with-no-error-in-log-file/56592)
**Author:** [@ori.rubinfeld](https://discuss.elastic.co/u/ori.rubinfeld)\ **Replies:** 5\ **Last updated:** [August 2, 2016, 2:30pm UTC](https://discuss.elastic.co/t/filebeat-service-fails-with-no-error-in-log-file/56592 "2016-08-02T14:30:19Z")
Hi, I have Filebeat installed on Windows Servers. After a while the Service starts to fail, with Registry file of 70MB(+) I am using the log level of debug, and did not receive any error message. Do you know of any l… --- ## [Compiling and testing Packetbeat for protocol development](https://discuss.elastic.co/t/compiling-and-testing-packetbeat-for-protocol-development/56888)
**Author:** [@jstangroome](https://discuss.elastic.co/u/jstangroome)\ **Replies:** 5\ **Last updated:** [August 2, 2016, 11:22am UTC](https://discuss.elastic.co/t/compiling-and-testing-packetbeat-for-protocol-development/56888 "2016-08-02T11:22:35Z")
Hi, I'm interested in developing new protocol support for Packetbeat. As such I've followed the beats "CONTRIBUTING.md" guide and the docs on "Adding a New Protocol". I've set up my Golang environment\* and I can succ… --- ## [Filebeat and busy files](https://discuss.elastic.co/t/filebeat-and-busy-files/55751)
**Author:** [@lkosz](https://discuss.elastic.co/u/lkosz)\ **Replies:** 16\ **Last updated:** [August 2, 2016, 10:52am UTC](https://discuss.elastic.co/t/filebeat-and-busy-files/55751 "2016-08-02T10:52:27Z")
I've noticed problem with logs shipping from heavily written files: 2016-07-18T13:15:24+02:00 DBG Not harvesting, file didn't change: /var/log/app.log 2016-07-18T13:15:24+02:00 DBG Update existing file for harvestin… --- ## [Filebeat crashes](https://discuss.elastic.co/t/filebeat-crashes/56813)
**Author:** [@ori.rubinfeld](https://discuss.elastic.co/u/ori.rubinfeld)\ **Replies:** 2\ **Last updated:** [August 2, 2016, 10:18am UTC](https://discuss.elastic.co/t/filebeat-crashes/56813 "2016-08-02T10:18:31Z")
Hi, We are encountering the following with Filebeat 1.2.3 Windows Machines. After the registry file reaches ~70MB The Service start to fail. When running manually with debug mode, accepting the following error: f… --- ## [Filebeat always read log from beginning - Linux](https://discuss.elastic.co/t/filebeat-always-read-log-from-beginning-linux/56858)
**Author:** [@caoping](https://discuss.elastic.co/u/caoping)\ **Replies:** 2\ **Last updated:** [August 2, 2016, 10:04am UTC](https://discuss.elastic.co/t/filebeat-always-read-log-from-beginning-linux/56858 "2016-08-02T10:04:12Z")
Hello, I'm finding filebeat always reads log information from the beginning, so there are many duplicated log events. This issue occurred in filebeat 1.2.3 and 5.0.0-alpha. My configuration for filebeat 5.0.0-alpha is a… --- ## [Filebeat 5.0.0-alpha3 multiple harvesters for same file sending the same messages over and over](https://discuss.elastic.co/t/filebeat-5-0-0-alpha3-multiple-harvesters-for-same-file-sending-the-same-messages-over-and-over/56913)
**Author:** [@dwhite5514](https://discuss.elastic.co/u/dwhite5514)\ **Replies:** 1\ **Last updated:** [August 2, 2016, 8:27am UTC](https://discuss.elastic.co/t/filebeat-5-0-0-alpha3-multiple-harvesters-for-same-file-sending-the-same-messages-over-and-over/56913 "2016-08-02T08:27:39Z")
Hi, I'm seeing something strange with filebeat 5.0.0-alpha3. I have prospectors configured on my mesos slave task stdout/stderr files and occasionally I see filebeat get stuck in a state where it's repeatedly sending … --- ## [Topbeat index name appends YYYY.MM.DD](https://discuss.elastic.co/t/topbeat-index-name-appends-yyyy-mm-dd/32908)
**Author:** [@Ross\_Draper](https://discuss.elastic.co/u/Ross_Draper)\ **Replies:** 5\ **Last updated:** [August 1, 2016, 6:19pm UTC](https://discuss.elastic.co/t/topbeat-index-name-appends-yyyy-mm-dd/32908 "2016-08-01T18:19:51Z")
Hi Chaps I've just started out with topbeats and imported the visualisations from github. Perhaps I've missed something, but as visualisations are tied to an index and topbeat automatically appends the date to each in… --- ## [Compiling on the Windows 2012 VM](https://discuss.elastic.co/t/compiling-on-the-windows-2012-vm/56380)
**Author:** [@lonangel](https://discuss.elastic.co/u/lonangel)\ **Replies:** 5\ **Last updated:** [August 1, 2016, 1:16pm UTC](https://discuss.elastic.co/t/compiling-on-the-windows-2012-vm/56380 "2016-08-01T13:16:15Z")
Hi, I've been trying to compile and run the packetbeat source on the win2012 vm that is on the repository but I can't seem to get it right. It compiles ok with the go build command but when I try to run packetbeat.exe -d… --- ## [How can I determine if Filebeat is being throttled?](https://discuss.elastic.co/t/how-can-i-determine-if-filebeat-is-being-throttled/56687)
**Author:** [@joshuaspence](https://discuss.elastic.co/u/joshuaspence)\ **Replies:** 2\ **Last updated:** [July 31, 2016, 7:51pm UTC](https://discuss.elastic.co/t/how-can-i-determine-if-filebeat-is-being-throttled/56687 "2016-07-31T19:51:10Z")
My understanding of Filebeat (which could be wrong) is that it will throttle its output if it detects that the output can't keep up. In my case, we have Filebeat sending to Logstash. Is there any way of determining whe… --- ## [Filebeat not taking files from directory and sending to Logstash](https://discuss.elastic.co/t/filebeat-not-taking-files-from-directory-and-sending-to-logstash/56742)
**Author:** [@Andrew\_Apple](https://discuss.elastic.co/u/Andrew_Apple)\ **Replies:** 1\ **Last updated:** [July 31, 2016, 7:47pm UTC](https://discuss.elastic.co/t/filebeat-not-taking-files-from-directory-and-sending-to-logstash/56742 "2016-07-31T19:47:07Z")
The filebeat instance I am running wont seem to send files in a directory to my logstash instance. Below is the filebeat.yml config file which I use a Shell Script to automatically change according to the type of file I … --- ## [\[ANNOUNCEMENT\] NagiosCheckBeat 0.6.0 Released](https://discuss.elastic.co/t/announcement-nagioscheckbeat-0-6-0-released/56801)
**Author:** [@PhaedrusTheGreek](https://discuss.elastic.co/u/PhaedrusTheGreek)\ **Replies:** 0\ **Last updated:** [July 30, 2016, 8:14pm UTC](https://discuss.elastic.co/t/announcement-nagioscheckbeat-0-6-0-released/56801 "2016-07-30T20:14:41Z")
NagiosCheckBeat 0.6.0 Released! Contains updated Libbeat for the Elastic Stack 5.x which includes numerous bug fixes and enhancements --- ## [Winlogbeat actively refused by target](https://discuss.elastic.co/t/winlogbeat-actively-refused-by-target/56752)
**Author:** [@Andrew\_Schulz](https://discuss.elastic.co/u/Andrew_Schulz)\ **Replies:** 13\ **Last updated:** [July 29, 2016, 10:11pm UTC](https://discuss.elastic.co/t/winlogbeat-actively-refused-by-target/56752 "2016-07-29T22:11:55Z")
Hi, I am very new to the ELK stack and Beats. I have a ELK stack setup on a Windows 2012 R2 server and am collecting winlogbeat, packetbeat and topbeat from the host of the ELK stack. I'm now trying to add winlogbeat … --- ## [No communication between Filebeat and Logstash](https://discuss.elastic.co/t/no-communication-between-filebeat-and-logstash/56317)
**Author:** [@Gisamark](https://discuss.elastic.co/u/Gisamark)\ **Replies:** 10\ **Last updated:** [July 29, 2016, 3:31pm UTC](https://discuss.elastic.co/t/no-communication-between-filebeat-and-logstash/56317 "2016-07-29T15:31:09Z")
Hi all ! I tried to install the ELK solution on a server and filebeat on my client, but it seems that there is no communication between the two... I tried beatname -c config.yml -e -d "\*" to help you but I get "comm… --- ## [Slow or stalled pipeline](https://discuss.elastic.co/t/slow-or-stalled-pipeline/56701)
**Author:** [@sderungs](https://discuss.elastic.co/u/sderungs)\ **Replies:** 2\ **Last updated:** [July 29, 2016, 12:36pm UTC](https://discuss.elastic.co/t/slow-or-stalled-pipeline/56701 "2016-07-29T12:36:46Z")
Hi We are using the ELK Stack (ES, LS, Kibana, Filebeat) for a big customer project. Currently we're still using it with an hourly-scheduled file-input configuration (where we read from the logfiles over network shares… --- ## [How to connect Filebeat to Datapower?](https://discuss.elastic.co/t/how-to-connect-filebeat-to-datapower/56712)
**Author:** [@sunilmchaudhari](https://discuss.elastic.co/u/sunilmchaudhari)\ **Replies:** 2\ **Last updated:** [July 29, 2016, 11:58am UTC](https://discuss.elastic.co/t/how-to-connect-filebeat-to-datapower/56712 "2016-07-29T11:58:34Z")
Hi, I want to send some logs to Shipper strictly through datapower. However in FB i have only 2 outputs, Logstash and Elasticsearch. How can I transport logs to LS-Shipper through datapower? br, Sunil --- ## [Issue with filebeat & logstash "Beats input: unhandled exception"](https://discuss.elastic.co/t/issue-with-filebeat-logstash-beats-input-unhandled-exception/33934)
**Author:** [@Matthew\_Prinvale](https://discuss.elastic.co/u/Matthew_Prinvale)\ **Replies:** 19\ **Last updated:** [July 29, 2016, 11:41am UTC](https://discuss.elastic.co/t/issue-with-filebeat-logstash-beats-input-unhandled-exception/33934 "2016-07-29T11:41:56Z")
OS: Ubuntu 14.094 filebeat: filebeat version 1.0.0-rc1 (amd64) logstash: 2.0.0-1 Current ELK user in production. Building a test Filebeat =\> Logstash =\> Elasticsearch stack to try out filebeat. After installing lostas… --- ## [Logstash Beats input lumberjack protocol v1 support lifetime](https://discuss.elastic.co/t/logstash-beats-input-lumberjack-protocol-v1-support-lifetime/56334)
**Author:** [@CVTJNII](https://discuss.elastic.co/u/CVTJNII)\ **Replies:** 7\ **Last updated:** [July 29, 2016, 11:39am UTC](https://discuss.elastic.co/t/logstash-beats-input-lumberjack-protocol-v1-support-lifetime/56334 "2016-07-29T11:39:32Z")
Currently the Beats input supports the Lumberjack v1 protocol, which is documented in the PROTOCOL.md file in the logstash-input-beats repository. I'm currently using this to test the beats input and am interested in ex… --- ## [Multiple filebeat outputs of same type (e.g., logstash) to different destinations (no loadbalancing)](https://discuss.elastic.co/t/multiple-filebeat-outputs-of-same-type-e-g-logstash-to-different-destinations-no-loadbalancing/56670)
**Author:** [@wdienst](https://discuss.elastic.co/u/wdienst)\ **Replies:** 1\ **Last updated:** [July 29, 2016, 11:27am UTC](https://discuss.elastic.co/t/multiple-filebeat-outputs-of-same-type-e-g-logstash-to-different-destinations-no-loadbalancing/56670 "2016-07-29T11:27:07Z")
Is it possible to have multiple filebeat outputs of same type (e.g., logstash) sent to different destinations (no loadbalancing)? --- ## [What's the status of topbeat](https://discuss.elastic.co/t/whats-the-status-of-topbeat/56629)
**Author:** [@Dmitry\_Belyakov](https://discuss.elastic.co/u/Dmitry_Belyakov)\ **Replies:** 2\ **Last updated:** [July 29, 2016, 8:57am UTC](https://discuss.elastic.co/t/whats-the-status-of-topbeat/56629 "2016-07-29T08:57:26Z")
Hi! Can someone please tell me what is the status of this beat? Will it make it into v.5? Because I currently don't see it in 5.0 branch on github.... Is there an alpha version of this beat somewhere? Also there used… --- ## [Filebeat output to console not work](https://discuss.elastic.co/t/filebeat-output-to-console-not-work/56692)
**Author:** [@caoping](https://discuss.elastic.co/u/caoping)\ **Replies:** 4\ **Last updated:** [July 29, 2016, 6:59am UTC](https://discuss.elastic.co/t/filebeat-output-to-console-not-work/56692 "2016-07-29T06:59:46Z")
I found there was a similar question here posted last year, and a guy answered that filebeat didn't support that feature yet. But now, I suppose it does. So why I'm still encountering the same error? Below is filebeat ou… --- ## [Couldn't get HTTP POST content](https://discuss.elastic.co/t/couldnt-get-http-post-content/56684)
**Author:** [@junhuih](https://discuss.elastic.co/u/junhuih)\ **Replies:** 1\ **Last updated:** [July 29, 2016, 12:11am UTC](https://discuss.elastic.co/t/couldnt-get-http-post-content/56684 "2016-07-29T00:11:11Z")
when i'm trying to use packetbeat, but couldn't get the http post content, from the official demo site, it have the post content. not sure how to set it up, anybody can help? tried open following: send\_all\_headers:… --- ## [DNS traffic](https://discuss.elastic.co/t/dns-traffic/56617)
**Author:** [@pfe](https://discuss.elastic.co/u/pfe)\ **Replies:** 3\ **Last updated:** [July 28, 2016, 7:37pm UTC](https://discuss.elastic.co/t/dns-traffic/56617 "2016-07-28T19:37:43Z")
Hello everyone ! Please could you explain to me how can I use Packetbeat to monitor DNS traffic Thank you Ragards --- ## [Filebeat service looses track of files (restart required)](https://discuss.elastic.co/t/filebeat-service-looses-track-of-files-restart-required/56162)
**Author:** [@Dmitry\_Belyakov](https://discuss.elastic.co/u/Dmitry_Belyakov)\ **Replies:** 7\ **Last updated:** [July 28, 2016, 1:13pm UTC](https://discuss.elastic.co/t/filebeat-service-looses-track-of-files-restart-required/56162 "2016-07-28T13:13:16Z")
Hi! I'm having somewhat similar issue to other people here in discussions. Here's what happens: When run manually with sudo filebeat -c /etc/filebeat/filemeat.yml all works fine and filebeat continuously ships new e… --- ## [Not getting logs from filebeat at logstash](https://discuss.elastic.co/t/not-getting-logs-from-filebeat-at-logstash/56402)
**Author:** [@Saurabh\_Jambhule](https://discuss.elastic.co/u/Saurabh_Jambhule)\ **Replies:** 4\ **Last updated:** [July 27, 2016, 2:17pm UTC](https://discuss.elastic.co/t/not-getting-logs-from-filebeat-at-logstash/56402 "2016-07-27T14:17:47Z")
There are some sample apache logs in folder listed in paths, but still they not going to logstash Here is my configuration, filebeat: filebeat: prospectors: - paths: - /home/saurabh/sample-log/\*… --- ## [Filebeat seems not interact with Logstash - Windows](https://discuss.elastic.co/t/filebeat-seems-not-interact-with-logstash-windows/38720)
**Author:** [@john22122015](https://discuss.elastic.co/u/john22122015)\ **Replies:** 11\ **Last updated:** [July 27, 2016, 12:27pm UTC](https://discuss.elastic.co/t/filebeat-seems-not-interact-with-logstash-windows/38720 "2016-07-27T12:27:42Z")
Hi, Colleagues! I have installed ELK in Windows and runs successfully, creatings all indexes. But it need to be integrate with Filebeat. Then, the structure is FB \> LS \> ES. But, despite of promt says "2016/01/08 11:08… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=567) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=569)