# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=570 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 571 --- ## [Do we need to create new index for file beat?](https://discuss.elastic.co/t/do-we-need-to-create-new-index-for-file-beat/55663)
**Author:** [@dubul](https://discuss.elastic.co/u/dubul)\ **Replies:** 1\ **Last updated:** [July 20, 2016, 1:44pm UTC](https://discuss.elastic.co/t/do-we-need-to-create-new-index-for-file-beat/55663 "2016-07-20T13:44:30Z")
I'm using filebeat to ship logs from windows machine to Elasticsearch, with default filebeats setting. When i try to ship logs using filebeat from other server, i couldnt see any logs on elasticsearch. In the earlier… --- ## [ERR Fail to publish event to REDIS: write tcp sourceHost:sourcePort-\>redisHost:redisPort: i/o timeout](https://discuss.elastic.co/t/err-fail-to-publish-event-to-redis-write-tcp-sourcehost-sourceport-redishost-redisport-i-o-timeout/54399)
**Author:** [@mrunalgosar](https://discuss.elastic.co/u/mrunalgosar)\ **Replies:** 19\ **Last updated:** [July 20, 2016, 7:26am UTC](https://discuss.elastic.co/t/err-fail-to-publish-event-to-redis-write-tcp-sourcehost-sourceport-redishost-redisport-i-o-timeout/54399 "2016-07-20T07:26:33Z")
I have recently setup below ELK stack for one of my application: FileBeat --\> Redis --\> Logstash --\> Elasticsearch --\> Kibana My FileBeat config: filebeat: prospectors: - paths: - LogPath in… --- ## [Will Metricbeat 5.0 provide a module like httpbeat, hsbeat](https://discuss.elastic.co/t/will-metricbeat-5-0-provide-a-module-like-httpbeat-hsbeat/55507)
**Author:** [@owulff](https://discuss.elastic.co/u/owulff)\ **Replies:** 3\ **Last updated:** [July 20, 2016, 6:36am UTC](https://discuss.elastic.co/t/will-metricbeat-5-0-provide-a-module-like-httpbeat-hsbeat/55507 "2016-07-20T06:36:07Z")
Hi there IMHO, it would make sense to provide a metricbeat module for httpbeat or hsbeat. Is this already planned for 5.0? Thanks Oli --- ## [How to create a custom field in metricbeat?](https://discuss.elastic.co/t/how-to-create-a-custom-field-in-metricbeat/55434)
**Author:** [@rajkumar3v](https://discuss.elastic.co/u/rajkumar3v)\ **Replies:** 3\ **Last updated:** [July 20, 2016, 6:34am UTC](https://discuss.elastic.co/t/how-to-create-a-custom-field-in-metricbeat/55434 "2016-07-20T06:34:18Z")
Hello!! I have two queries, 1) I want to collect total count of CPU in a server but it is not available in metricbeat. so how can I collect total number of cpu? 2) Along with metricbeat data I need to send… --- ## [Filebeat repeatedly sending old entries in log file](https://discuss.elastic.co/t/filebeat-repeatedly-sending-old-entries-in-log-file/55796)
**Author:** [@jmtrachy](https://discuss.elastic.co/u/jmtrachy)\ **Replies:** 2\ **Last updated:** [July 20, 2016, 2:25am UTC](https://discuss.elastic.co/t/filebeat-repeatedly-sending-old-entries-in-log-file/55796 "2016-07-20T02:25:38Z")
Hello - just started using filebeat in a very simple setup and am seeing some odd behavior. My configuration is as follows: filebeat: prospectors: - paths: - /usr/src/app/\*.log input\_type: l… --- ## [Filebeat not indexing data correctly " %{\[@metadata\]\[beat\]}- "](https://discuss.elastic.co/t/filebeat-not-indexing-data-correctly-metadata-beat/55896)
**Author:** [@pip0](https://discuss.elastic.co/u/pip0)\ **Replies:** 1\ **Last updated:** [July 19, 2016, 10:15pm UTC](https://discuss.elastic.co/t/filebeat-not-indexing-data-correctly-metadata-beat/55896 "2016-07-19T22:15:13Z")
I have filebeat sending logs from syslog, nginx, php slow logs, and authlog. For some reason the metadata is being ripped and instead of the filebeat indexing beat-date. I'm getting a double output with this index name … --- ## [Elastic not indexing correctly. Showing "%{\[@metadata\]\[beat\]}-](https://discuss.elastic.co/t/elastic-not-indexing-correctly-showing-metadata-beat/55653)
**Author:** [@pip0](https://discuss.elastic.co/u/pip0)\ **Replies:** 3\ **Last updated:** [July 19, 2016, 10:14pm UTC](https://discuss.elastic.co/t/elastic-not-indexing-correctly-showing-metadata-beat/55653 "2016-07-19T22:14:35Z")
My elastic node is not indexing my filebeat correctly. The index is showing up as "%{\[@metadata\]\[beat\]}- I have attached all my configs for further investigation. Any help is appreciate it! Input http://pastebin.co… --- ## [Specifying index name from filebeat to logstash](https://discuss.elastic.co/t/specifying-index-name-from-filebeat-to-logstash/55704)
**Author:** [@dal](https://discuss.elastic.co/u/dal)\ **Replies:** 8\ **Last updated:** [July 19, 2016, 2:06pm UTC](https://discuss.elastic.co/t/specifying-index-name-from-filebeat-to-logstash/55704 "2016-07-19T14:06:14Z")
I am trying to setup my ELK pipeline. I have filebeat monitoring on one VM and my logstash and elasticsearch instances running on another. When I make an update to the file which specified in filebeat.yml, I see that cha… --- ## [Topbeat json event, fieldname when sending to logstash](https://discuss.elastic.co/t/topbeat-json-event-fieldname-when-sending-to-logstash/55836)
**Author:** [@Arjun\_Agarwal](https://discuss.elastic.co/u/Arjun_Agarwal)\ **Replies:** 5\ **Last updated:** [July 19, 2016, 1:57pm UTC](https://discuss.elastic.co/t/topbeat-json-event-fieldname-when-sending-to-logstash/55836 "2016-07-19T13:57:38Z")
Plzz.. do let me know the name of the field which store the complete json event generated by topbeat when we are sending data from topbeat to logstash ?? or How can we store and get json events generated by topbeat in a … --- ## [Pipeline Not Working Filebeats -\> Elasticsearch (5.0.0 Alpha 3)](https://discuss.elastic.co/t/pipeline-not-working-filebeats-elasticsearch-5-0-0-alpha-3/54197)
**Author:** [@petercort](https://discuss.elastic.co/u/petercort)\ **Replies:** 13\ **Last updated:** [July 19, 2016, 12:12pm UTC](https://discuss.elastic.co/t/pipeline-not-working-filebeats-elasticsearch-5-0-0-alpha-3/54197 "2016-07-19T12:12:19Z")
I'm parsing IIS logs and am unable to get the 'message' field to parse in Elasticsearch. This is my filebeat.yml file (relevant lines) output: ### Elasticsearch as output elasticsearch: hosts: \["elk-0… --- ## [FIlebeat dropping connection to logstash](https://discuss.elastic.co/t/filebeat-dropping-connection-to-logstash/55822)
**Author:** [@Sai\_Birada](https://discuss.elastic.co/u/Sai_Birada)\ **Replies:** 5\ **Last updated:** [July 19, 2016, 10:01am UTC](https://discuss.elastic.co/t/filebeat-dropping-connection-to-logstash/55822 "2016-07-19T10:01:01Z")
In order to try filebeat on production, i launched 1.1k instances of filebeat on my production boxes, each monitoring a couple of files in its boxes and sending data to 3 central logstash servers, which are pushing those… --- ## [Topbeat index not propagating to Elasticsearch](https://discuss.elastic.co/t/topbeat-index-not-propagating-to-elasticsearch/55786)
**Author:** [@Fuzzy66](https://discuss.elastic.co/u/Fuzzy66)\ **Replies:** 1\ **Last updated:** [July 19, 2016, 9:12am UTC](https://discuss.elastic.co/t/topbeat-index-not-propagating-to-elasticsearch/55786 "2016-07-19T09:12:17Z")
I currently downloaded all the current software for elasticsearch, logstash, redis and topbeats. I currently have my topbeats going into redis, that goes to my logstash, that goes into elasticsearch. Everything is wor… --- ## [Beats cant send data suddenly to ES with errors pop up](https://discuss.elastic.co/t/beats-cant-send-data-suddenly-to-es-with-errors-pop-up/55668)
**Author:** [@Kennedy\_Kan1](https://discuss.elastic.co/u/Kennedy_Kan1)\ **Replies:** 3\ **Last updated:** [July 19, 2016, 3:57am UTC](https://discuss.elastic.co/t/beats-cant-send-data-suddenly-to-es-with-errors-pop-up/55668 "2016-07-19T03:57:53Z")
I am using ES 5.0, Kibana 5.0 alpha4 and various beats to send data to ES. Everything runs fine and smooth at first. However, after a day, the beats suddenly cannot send the beats to the ES. I have been using different b… --- ## [Getting filebeat to process JSON logs from osquery](https://discuss.elastic.co/t/getting-filebeat-to-process-json-logs-from-osquery/54779)
**Author:** [@shauvik](https://discuss.elastic.co/u/shauvik)\ **Replies:** 4\ **Last updated:** [July 18, 2016, 6:44pm UTC](https://discuss.elastic.co/t/getting-filebeat-to-process-json-logs-from-osquery/54779 "2016-07-18T18:44:28Z")
I'm trying to use filebeat instead of logstash to aggregate osquery logs but the logs seem to be loaded as plain text instead. Here are the instructions I am referring to: http://lowlyadmin.com/mac/2016/06/02/deploying… --- ## [Filebeat and Structured Json logging](https://discuss.elastic.co/t/filebeat-and-structured-json-logging/55747)
**Author:** [@fatmanmclone90](https://discuss.elastic.co/u/fatmanmclone90)\ **Replies:** 1\ **Last updated:** [July 18, 2016, 2:03pm UTC](https://discuss.elastic.co/t/filebeat-and-structured-json-logging/55747 "2016-07-18T14:03:21Z")
We are using the Serilog library to log JSON formatted messages to disk and exporting these to Elasticsearch via Filebeat. In Filebeat Alpha 5 Alpha 4 is there a way to get Filebeat to export the logs in a way that Ela… --- ## [Missing logs with rotate log](https://discuss.elastic.co/t/missing-logs-with-rotate-log/54401)
**Author:** [@Amos\_Shahar](https://discuss.elastic.co/u/Amos_Shahar)\ **Replies:** 14\ **Last updated:** [July 18, 2016, 6:27am UTC](https://discuss.elastic.co/t/missing-logs-with-rotate-log/54401 "2016-07-18T06:27:10Z")
hi, I am using filebeat (version 1.2.3-1 on AWS linux AMI) to forward to logstash and I have missing logs (every time the file rotates I think). the specific file is rotating every 20M and in the peak time it is rotat… --- ## [Are there Filebeats Default Kibana Dashboards for 5.0 like there were for previous versions?](https://discuss.elastic.co/t/are-there-filebeats-default-kibana-dashboards-for-5-0-like-there-were-for-previous-versions/55580)
**Author:** [@David\_McClain](https://discuss.elastic.co/u/David_McClain)\ **Replies:** 9\ **Last updated:** [July 17, 2016, 10:30pm UTC](https://discuss.elastic.co/t/are-there-filebeats-default-kibana-dashboards-for-5-0-like-there-were-for-previous-versions/55580 "2016-07-17T22:30:07Z")
Simply the question in the title. In Filebeats 1.x and Kibana 4.x, there was a set of 'default' or demo dashboards that you could download and install from a repo that is now Deprecated and has a link to the new repo… --- ## [Multiple elasticsearch output configuration](https://discuss.elastic.co/t/multiple-elasticsearch-output-configuration/55698)
**Author:** [@sahas](https://discuss.elastic.co/u/sahas)\ **Replies:** 1\ **Last updated:** [July 17, 2016, 9:17pm UTC](https://discuss.elastic.co/t/multiple-elasticsearch-output-configuration/55698 "2016-07-17T21:17:33Z")
Hi, I have a persistent volume where logs from multiple docker container processes will get dropped. Those logs are potentially from multiple applications (related to each other with respect to their domain context). F… --- ## [Reload if modification time changes in config files](https://discuss.elastic.co/t/reload-if-modification-time-changes-in-config-files/55556)
**Author:** [@lightkz](https://discuss.elastic.co/u/lightkz)\ **Replies:** 2\ **Last updated:** [July 15, 2016, 11:16am UTC](https://discuss.elastic.co/t/reload-if-modification-time-changes-in-config-files/55556 "2016-07-15T11:16:23Z")
Does filebeat process would be able to see changes in config files and reload with new settings without restarting process? --- ## [Not seeing Packetbeat info (no packetbeat data in Elasticsearch) for 5.0 Alpha 4](https://discuss.elastic.co/t/not-seeing-packetbeat-info-no-packetbeat-data-in-elasticsearch-for-5-0-alpha-4/55583)
**Author:** [@David\_McClain](https://discuss.elastic.co/u/David_McClain)\ **Replies:** 8\ **Last updated:** [July 15, 2016, 10:27am UTC](https://discuss.elastic.co/t/not-seeing-packetbeat-info-no-packetbeat-data-in-elasticsearch-for-5-0-alpha-4/55583 "2016-07-15T10:27:17Z")
I went through the newest Docs to install the Alpha 4 stack, and was just trying to populate it with some data. ES 5.0-4 works Kibana 5.0-4 works Filebeat 5.0-4 works But when I tried to install Packetbeat, everythin… --- ## [Couldn't see the logs in elasticsearch and kibana](https://discuss.elastic.co/t/couldnt-see-the-logs-in-elasticsearch-and-kibana/55546)
**Author:** [@dubul](https://discuss.elastic.co/u/dubul)\ **Replies:** 9\ **Last updated:** [July 15, 2016, 10:21am UTC](https://discuss.elastic.co/t/couldnt-see-the-logs-in-elasticsearch-and-kibana/55546 "2016-07-15T10:21:55Z")
when we send the logs using filebeat does it create a separate index for filebeat in elastic search and kibana. Or do we need to install the beats dashboard to create the index? --- ## [Can winlogbeat works with powershell version 2?](https://discuss.elastic.co/t/can-winlogbeat-works-with-powershell-version-2/55599)
**Author:** [@usahitya](https://discuss.elastic.co/u/usahitya)\ **Replies:** 2\ **Last updated:** [July 15, 2016, 9:38am UTC](https://discuss.elastic.co/t/can-winlogbeat-works-with-powershell-version-2/55599 "2016-07-15T09:38:10Z")
Hi Everyone, I am unable to start the winlogbeat in powershell version 2. is there any documentation about how to work winlogbeat with powershell version 2. cheers! sah --- ## [I'm getting error loading the filebeat template](https://discuss.elastic.co/t/im-getting-error-loading-the-filebeat-template/55544)
**Author:** [@dubul](https://discuss.elastic.co/u/dubul)\ **Replies:** 1\ **Last updated:** [July 15, 2016, 4:36am UTC](https://discuss.elastic.co/t/im-getting-error-loading-the-filebeat-template/55544 "2016-07-15T04:36:40Z")
ERR Could not load template: Template could not be loaded. Error: Put http://32.44.33.22:9200/\_template/filebeat: dial tcp: lookup 32.44.33.22: getaddrinfow: No such host is known --- ## [Will the total data gets shipped every time by filebeats?](https://discuss.elastic.co/t/will-the-total-data-gets-shipped-every-time-by-filebeats/55479)
**Author:** [@dubul](https://discuss.elastic.co/u/dubul)\ **Replies:** 2\ **Last updated:** [July 14, 2016, 11:49pm UTC](https://discuss.elastic.co/t/will-the-total-data-gets-shipped-every-time-by-filebeats/55479 "2016-07-14T23:49:22Z")
I want to ship the logs from a server to elk. I would like to know whether all the logs gets shipped everytime or only newly generated logs? for example logs at point are A+B, they get shipped to elastic search. after … --- ## [Upgrade filebeat from 1.1 to 1.2](https://discuss.elastic.co/t/upgrade-filebeat-from-1-1-to-1-2/55540)
**Author:** [@mt.michael](https://discuss.elastic.co/u/mt.michael)\ **Replies:** 2\ **Last updated:** [July 14, 2016, 5:53pm UTC](https://discuss.elastic.co/t/upgrade-filebeat-from-1-1-to-1-2/55540 "2016-07-14T17:53:59Z")
Hi I'm currently have filebeat version 1.1.1 (amd64) on ubuntu 12.04. I installed the older version by this page https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-installation.html I wonder if I need to… --- ## [Logstash lost eventlog from winlogbeat](https://discuss.elastic.co/t/logstash-lost-eventlog-from-winlogbeat/55360)
**Author:** [@orsa](https://discuss.elastic.co/u/orsa)\ **Replies:** 9\ **Last updated:** [July 14, 2016, 3:17pm UTC](https://discuss.elastic.co/t/logstash-lost-eventlog-from-winlogbeat/55360 "2016-07-14T15:17:43Z")
Hi i dont undestend where i wrong (. on my server (Ubuntu) install ELK logstash recive syslog and netflow messages from network devices - all work all right. Install on some windows server Winlogbeat use send log to ela… --- ## [Can packetbeat send out packets to test servers](https://discuss.elastic.co/t/can-packetbeat-send-out-packets-to-test-servers/55495)
**Author:** [@Kennedy\_Kan1](https://discuss.elastic.co/u/Kennedy_Kan1)\ **Replies:** 1\ **Last updated:** [July 14, 2016, 11:06am UTC](https://discuss.elastic.co/t/can-packetbeat-send-out-packets-to-test-servers/55495 "2016-07-14T11:06:32Z")
I have several servers in monitoring. I would like to know if packetbeat can send out some packets to the servers to test if the server is still alive, just like what ping do. Is that possible? --- ## [Logging MySQL query with username](https://discuss.elastic.co/t/logging-mysql-query-with-username/55400)
**Author:** [@ChuyenGiaSon](https://discuss.elastic.co/u/ChuyenGiaSon)\ **Replies:** 2\ **Last updated:** [July 14, 2016, 10:57am UTC](https://discuss.elastic.co/t/logging-mysql-query-with-username/55400 "2016-07-14T10:57:23Z")
Hi, I see that packetbeat can log mysql query with performance data but not user name. It's not good because I want to use packetbeat for audit purpose. Can you tell me if packetbeat can log username along with the que… --- ## [Timeout setting on filebeat.yml logstash output](https://discuss.elastic.co/t/timeout-setting-on-filebeat-yml-logstash-output/55443)
**Author:** [@sharon.c](https://discuss.elastic.co/u/sharon.c)\ **Replies:** 2\ **Last updated:** [July 14, 2016, 10:45am UTC](https://discuss.elastic.co/t/timeout-setting-on-filebeat-yml-logstash-output/55443 "2016-07-14T10:45:39Z")
In my application, Filebeat1.1+ Logstash2.1 + Elasticsearch2.3, there are duplicated messages. I want to adjust timeout parameters in filebeat.yml , the default timeout is 30. but when I set timeout: 40 Filebeat stop… --- ## [One prospector stops](https://discuss.elastic.co/t/one-prospector-stops/54410)
**Author:** [@Uros\_Meglic](https://discuss.elastic.co/u/Uros_Meglic)\ **Replies:** 13\ **Last updated:** [July 12, 2016, 12:28pm UTC](https://discuss.elastic.co/t/one-prospector-stops/54410 "2016-07-12T12:28:45Z")
Hello, I have a filebeat config with two prospectors and one stops working after a couple days. The other one keeps on working normally. Is there any way to debug why this is happening. I checked the log files and i… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=569) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=571)