# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=571 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 572 --- ## [Do we need to install filebeats on client and elk server](https://discuss.elastic.co/t/do-we-need-to-install-filebeats-on-client-and-elk-server/55454)
**Author:** [@dubul](https://discuss.elastic.co/u/dubul)\ **Replies:** 1\ **Last updated:** [July 14, 2016, 1:51am UTC](https://discuss.elastic.co/t/do-we-need-to-install-filebeats-on-client-and-elk-server/55454 "2016-07-14T01:51:09Z")
I want to send logs from windows machine. I'm having issues with path of input file and output for elk stack. Can you provide me some example config on client and elk server machine. --- ## [I want to send logs from a windows machine to windows elk server](https://discuss.elastic.co/t/i-want-to-send-logs-from-a-windows-machine-to-windows-elk-server/55452)
**Author:** [@dubul](https://discuss.elastic.co/u/dubul)\ **Replies:** 1\ **Last updated:** [July 14, 2016, 1:46am UTC](https://discuss.elastic.co/t/i-want-to-send-logs-from-a-windows-machine-to-windows-elk-server/55452 "2016-07-14T01:46:36Z")
my logs are located in d:\\app\\logs in a windows machine. i want to send logs to elk server. I tried using file beat. I dont see any errors and could'nt see any logs on elk server. Can anyone provide me configs for filebe… --- ## [Conflicted about Beats, Logstash and ES](https://discuss.elastic.co/t/conflicted-about-beats-logstash-and-es/55427)
**Author:** [@StianOvrevage](https://discuss.elastic.co/u/StianOvrevage)\ **Replies:** 2\ **Last updated:** [July 13, 2016, 9:06pm UTC](https://discuss.elastic.co/t/conflicted-about-beats-logstash-and-es/55427 "2016-07-13T21:06:22Z")
Hi all, I'm setting up Winlogbeat for collecting windows event logs and use ES and Kibana for analysis. In my log pipeline I have Logstash in the middle as that seems to be the best current practice and allows for a ce… --- ## [Install Filebeat on a different folder](https://discuss.elastic.co/t/install-filebeat-on-a-different-folder/55381)
**Author:** [@Dan2](https://discuss.elastic.co/u/Dan2)\ **Replies:** 5\ **Last updated:** [July 13, 2016, 12:36pm UTC](https://discuss.elastic.co/t/install-filebeat-on-a-different-folder/55381 "2016-07-13T12:36:41Z")
Hi, Is there any way to put and install Filebeat in another folder other than "C:\\Program Files\\Filebeat" on a Windows machine? --- ## [Include\_lines doesn't seem to work](https://discuss.elastic.co/t/include-lines-doesnt-seem-to-work/55299)
**Author:** [@Dan2](https://discuss.elastic.co/u/Dan2)\ **Replies:** 2\ **Last updated:** [July 13, 2016, 7:58am UTC](https://discuss.elastic.co/t/include-lines-doesnt-seem-to-work/55299 "2016-07-13T07:58:41Z")
Hi, I've configured the include\_lines to show only a line with the word "WARN" but I'm getting all the lines in the log file without any filter. this is my config file: ################### Filebeat Configuration E… --- ## [Packet Beat /mac address](https://discuss.elastic.co/t/packet-beat-mac-address/55314)
**Author:** [@zivn](https://discuss.elastic.co/u/zivn)\ **Replies:** 2\ **Last updated:** [July 13, 2016, 4:47am UTC](https://discuss.elastic.co/t/packet-beat-mac-address/55314 "2016-07-13T04:47:42Z")
Hi I am trying to record the traffic using the packet beat and Iwas expected to have the data of the unparsered traffic, within that field I was expected to see the MAC adress. yet I cannot. How can I ercord and then i… --- ## [Integration of Winlogbeat and Filebeat](https://discuss.elastic.co/t/integration-of-winlogbeat-and-filebeat/50510)
**Author:** [@xiaozhuqq48](https://discuss.elastic.co/u/xiaozhuqq48)\ **Replies:** 7\ **Last updated:** [July 13, 2016, 2:38am UTC](https://discuss.elastic.co/t/integration-of-winlogbeat-and-filebeat/50510 "2016-07-13T02:38:33Z")
The company IT wants to reduce the number of agents. So is there any way to put the fuctions of winlogbeat and filebeat together? Thanks! --- ## [Unable to get the whole query in dashboard](https://discuss.elastic.co/t/unable-to-get-the-whole-query-in-dashboard/2541)
**Author:** [@Akhilesh\_Anb](https://discuss.elastic.co/u/Akhilesh_Anb)\ **Replies:** 6\ **Last updated:** [July 12, 2016, 5:30pm UTC](https://discuss.elastic.co/t/unable-to-get-the-whole-query-in-dashboard/2541 "2016-07-12T17:30:33Z")
In Mysql or Http, i'm not getting whole path or query. That query is dividing into different lines. Can you please help me for this. --- ## [Metricbeat Dynamic Top Level Fields](https://discuss.elastic.co/t/metricbeat-dynamic-top-level-fields/55313)
**Author:** [@icozamiz](https://discuss.elastic.co/u/icozamiz)\ **Replies:** 2\ **Last updated:** [July 12, 2016, 4:15pm UTC](https://discuss.elastic.co/t/metricbeat-dynamic-top-level-fields/55313 "2016-07-12T16:15:18Z")
Hello! I am new to beats and am currently working on a module in metricbeat that polls a system through a webservice call and gets a usage summary of the system and it's subsystems in the form a nested json object. In… --- ## [Registry 60MB and increasing causes high cpu and stops sending events](https://discuss.elastic.co/t/registry-60mb-and-increasing-causes-high-cpu-and-stops-sending-events/54305)
**Author:** [@Zfs](https://discuss.elastic.co/u/Zfs)\ **Replies:** 11\ **Last updated:** [July 12, 2016, 12:21pm UTC](https://discuss.elastic.co/t/registry-60mb-and-increasing-causes-high-cpu-and-stops-sending-events/54305 "2016-07-12T12:21:00Z")
Hi, I have many servers using filebeat 1.2.3 on windows. It's monitoring about 16 directories with rotating logs in each. Some logs can be rotated within a few seconds others can take longer. The issue I face is that th… --- ## [The Pipeline is blocked](https://discuss.elastic.co/t/the-pipeline-is-blocked/55221)
**Author:** [@mits](https://discuss.elastic.co/u/mits)\ **Replies:** 4\ **Last updated:** [July 12, 2016, 10:42am UTC](https://discuss.elastic.co/t/the-pipeline-is-blocked/55221 "2016-07-12T10:42:12Z")
Having some trouble resolving this issue on my own. Here is the error at the end of my logstash.log {:timestamp=\>"2016-07-11T14:20:06.631000-0400", :message=\>"Beats input: The circuit breaker has detected a slowdown o… --- ## [Beats protocol](https://discuss.elastic.co/t/beats-protocol/54296)
**Author:** [@ravitandur](https://discuss.elastic.co/u/ravitandur)\ **Replies:** 6\ **Last updated:** [July 12, 2016, 10:34am UTC](https://discuss.elastic.co/t/beats-protocol/54296 "2016-07-12T10:34:18Z")
what is the protocol used for beat input in logstash \[tcp or udp\]? Can I configure the protocol used i.e. TCP or UDP? --- ## [Filebeat log monitoring/alerting](https://discuss.elastic.co/t/filebeat-log-monitoring-alerting/53350)
**Author:** [@maheshraju](https://discuss.elastic.co/u/maheshraju)\ **Replies:** 11\ **Last updated:** [July 11, 2016, 8:47am UTC](https://discuss.elastic.co/t/filebeat-log-monitoring-alerting/53350 "2016-07-11T08:47:07Z")
I'm looking for a way to monitor Filebeat (running on windows) log and generate alerts in case of errors. Is there a way Filebeat can send events/log to windows event log? --- ## [Filebeat Not Capturing "hostname" as full FQDN on Windows](https://discuss.elastic.co/t/filebeat-not-capturing-hostname-as-full-fqdn-on-windows/55204)
**Author:** [@l33man24](https://discuss.elastic.co/u/l33man24)\ **Replies:** 2\ **Last updated:** [July 11, 2016, 9:06pm UTC](https://discuss.elastic.co/t/filebeat-not-capturing-hostname-as-full-fqdn-on-windows/55204 "2016-07-11T21:06:58Z")
Hello, I am having an issue with Filebeat v 1.2.3 (but probably others as well as an older one had the same issue) where the host value returns only the hostname and not the full FQDN on Windows clients (E.g. server01 … --- ## [File open mode](https://discuss.elastic.co/t/file-open-mode/54840)
**Author:** [@Bruno\_Lavoie](https://discuss.elastic.co/u/Bruno_Lavoie)\ **Replies:** 3\ **Last updated:** [July 11, 2016, 7:05pm UTC](https://discuss.elastic.co/t/file-open-mode/54840 "2016-07-11T19:05:43Z")
Hello, While troubleshooting an issue on our Windows servers, we saw that Filebeat is opening files in read/write mode. Should it be read only mode? There's no reason to be other than readonly. O:\\Outils\\Sysinterna… --- ## [Doubts in Filebeat](https://discuss.elastic.co/t/doubts-in-filebeat/55079)
**Author:** [@Pedro\_Lopes](https://discuss.elastic.co/u/Pedro_Lopes)\ **Replies:** 6\ **Last updated:** [July 11, 2016, 4:39pm UTC](https://discuss.elastic.co/t/doubts-in-filebeat/55079 "2016-07-11T16:39:05Z")
Hello guys, I have a filebeat.yml that works perfectly sending csv files to logstash, and then logstash to elastic. If I add a new file to any of the folders filebeats starts it's magic. But if I add data to the end … --- ## [Beats input: the pipeline is blocked, temporary refusing new connection](https://discuss.elastic.co/t/beats-input-the-pipeline-is-blocked-temporary-refusing-new-connection/38764)
**Author:** [@sharon.c](https://discuss.elastic.co/u/sharon.c)\ **Replies:** 5\ **Last updated:** [July 11, 2016, 3:13pm UTC](https://discuss.elastic.co/t/beats-input-the-pipeline-is-blocked-temporary-refusing-new-connection/38764 "2016-07-11T15:13:06Z")
I am using elasticsearch 1.7.1, logstash 1.5.4, and testing filebeat. It runs perfectly if I use filebeat to scan log files and use filebeat to output log data directly to elasticsearch as follows: logfiles -\> filebeat… --- ## [Filebeats not working](https://discuss.elastic.co/t/filebeats-not-working/54972)
**Author:** [@rocky4bmw](https://discuss.elastic.co/u/rocky4bmw)\ **Replies:** 8\ **Last updated:** [July 11, 2016, 2:05pm UTC](https://discuss.elastic.co/t/filebeats-not-working/54972 "2016-07-11T14:05:44Z")
@andrewkroh Step1: I have installed Elastic search 2.3 , Kibana 4.5, Logastash 2.3 and shield 2.3 on single server. created using esusers command line I have created one admin user with admin role and another user … --- ## [Packetbeat http responsetimes in either 0,1 and why not decimals?](https://discuss.elastic.co/t/packetbeat-http-responsetimes-in-either-0-1-and-why-not-decimals/55168)
**Author:** [@harshafrnd4u](https://discuss.elastic.co/u/harshafrnd4u)\ **Replies:** 1\ **Last updated:** [July 11, 2016, 1:42pm UTC](https://discuss.elastic.co/t/packetbeat-http-responsetimes-in-either-0-1-and-why-not-decimals/55168 "2016-07-11T13:42:33Z")
I see that http responsetimes in either 0,1 and why not decimals? Is it rounding off? --- ## [Filebeat Rabbitmq plugin](https://discuss.elastic.co/t/filebeat-rabbitmq-plugin/55189)
**Author:** [@Dan2](https://discuss.elastic.co/u/Dan2)\ **Replies:** 3\ **Last updated:** [July 11, 2016, 12:37pm UTC](https://discuss.elastic.co/t/filebeat-rabbitmq-plugin/55189 "2016-07-11T12:37:57Z")
Hi, I'm trying to configure Filebeat to send logs to rabbitmq. I saw there is a Rabbitmq plugin for Filebeat but I can't figure out how to integrate it. Is there a guide on how to integrate/install a Filebeat plugin? t… --- ## [Cant publish but harverst with 27w files](https://discuss.elastic.co/t/cant-publish-but-harverst-with-27w-files/55007)
**Author:** [@xiongzhichaoelk](https://discuss.elastic.co/u/xiongzhichaoelk)\ **Replies:** 1\ **Last updated:** [July 11, 2016, 9:51am UTC](https://discuss.elastic.co/t/cant-publish-but-harverst-with-27w-files/55007 "2016-07-11T09:51:44Z")
when start filebeat （1.2.3） whith the path which have 270000 files but the size only 3G,it just harvester no publish. the dug log: below is the config: filebeat: paths: prospectors: - /data1/logs/\*\*/\*… --- ## [Example files for sending nginx, tomcat, postgresql files (from server A) to ELK server (server B)](https://discuss.elastic.co/t/example-files-for-sending-nginx-tomcat-postgresql-files-from-server-a-to-elk-server-server-b/54745)
**Author:** [@ghx](https://discuss.elastic.co/u/ghx)\ **Replies:** 13\ **Last updated:** [July 11, 2016, 9:38am UTC](https://discuss.elastic.co/t/example-files-for-sending-nginx-tomcat-postgresql-files-from-server-a-to-elk-server-server-b/54745 "2016-07-11T09:38:12Z")
Hello, I just installed ELK server (on server B) and want to send log file for tomcat (catalina.out), nginx (access.log, error.log) and posgresql logs (from server A) using filebeat I tested it with logs like syslog … --- ## [Error compiling packetbeat on OS X EI Capitan](https://discuss.elastic.co/t/error-compiling-packetbeat-on-os-x-ei-capitan/55148)
**Author:** [@billzy](https://discuss.elastic.co/u/billzy)\ **Replies:** 3\ **Last updated:** [July 11, 2016, 9:13am UTC](https://discuss.elastic.co/t/error-compiling-packetbeat-on-os-x-ei-capitan/55148 "2016-07-11T09:13:57Z")
I'm running into a weird situation here, hope someone could help me out ! While I was compiling packetbeat source code, I got the following error, go build # github.com/elastic/beats/vendor/github.com/tsg/gopacket/pc… --- ## [Need to migrate a logstash shipper config to filebeat config](https://discuss.elastic.co/t/need-to-migrate-a-logstash-shipper-config-to-filebeat-config/54870)
**Author:** [@shickmo](https://discuss.elastic.co/u/shickmo)\ **Replies:** 1\ **Last updated:** [July 11, 2016, 8:43am UTC](https://discuss.elastic.co/t/need-to-migrate-a-logstash-shipper-config-to-filebeat-config/54870 "2016-07-11T08:43:38Z")
Below is the config I am currently using with logstash to ship logs to the logstash processing servers. I haven't been able to get the below working in the filebeat.yml config on a test centos 7 server (though I imagine … --- ## [Execbeat-master Installation](https://discuss.elastic.co/t/execbeat-master-installation/54724)
**Author:** [@Ravi\_Shanker\_Reddy](https://discuss.elastic.co/u/Ravi_Shanker_Reddy)\ **Replies:** 11\ **Last updated:** [July 11, 2016, 8:35am UTC](https://discuss.elastic.co/t/execbeat-master-installation/54724 "2016-07-11T08:35:15Z")
I am using Red Hat Enterprise Linux Server release 6.4 (Santiago) . I want to install exec beats. I downloaded the exec beat master zip file from https://github.com/christiangalsterer/execbeat. I installed go version of g… --- ## [Duplicates events when file rotation occurs - Windows](https://discuss.elastic.co/t/duplicates-events-when-file-rotation-occurs-windows/53315)
**Author:** [@Bruno\_Lavoie](https://discuss.elastic.co/u/Bruno_Lavoie)\ **Replies:** 17\ **Last updated:** [July 11, 2016, 8:30am UTC](https://discuss.elastic.co/t/duplicates-events-when-file-rotation-occurs-windows/53315 "2016-07-11T08:30:59Z")
Hello, We're in some strange behavior with our Filebeat. Here the facts: filebeat 1.2.3 windows server (2012 r2 I think) we use log4j2 for logging current/active logging file is named like this: acces.log, audit.log,… --- ## [What about flexible ports?](https://discuss.elastic.co/t/what-about-flexible-ports/54940)
**Author:** [@lindsayshow](https://discuss.elastic.co/u/lindsayshow)\ **Replies:** 4\ **Last updated:** [July 11, 2016, 2:01am UTC](https://discuss.elastic.co/t/what-about-flexible-ports/54940 "2016-07-11T02:01:45Z")
I have developed a new protocol in packetbeat. But in the packetbeat.yml file,I found we must set the ports\[\] item? cause，plugin interface has a function named GetPorts（）. --- ## [Filebeat JSON Index Fields](https://discuss.elastic.co/t/filebeat-json-index-fields/55120)
**Author:** [@sirsteve](https://discuss.elastic.co/u/sirsteve)\ **Replies:** 0\ **Last updated:** [July 9, 2016, 7:54pm UTC](https://discuss.elastic.co/t/filebeat-json-index-fields/55120 "2016-07-09T19:54:45Z")
Hi, I'm trying out Filebeat for processing JSON logs and forwarding to Elasticsearch with the hope of visualising in Kibana. I can see the parsed JSON as fields in Kibana discovery just fine, but it warns that they ar… --- ## [Merge lines in filebeat + logstash](https://discuss.elastic.co/t/merge-lines-in-filebeat-logstash/41993)
**Author:** [@viren](https://discuss.elastic.co/u/viren)\ **Replies:** 11\ **Last updated:** [July 9, 2016, 10:57am UTC](https://discuss.elastic.co/t/merge-lines-in-filebeat-logstash/41993 "2016-07-09T10:57:29Z")
Hello everyone, It seem to me that filebeat is sending entry to logstash for every line individually . What we want ( if it is possible ) is to club the lines or groups them and then sent them to logstash. So ... , I… --- ## [Metricbeart as a windows service is too slow to start](https://discuss.elastic.co/t/metricbeart-as-a-windows-service-is-too-slow-to-start/55084)
**Author:** [@Zfs](https://discuss.elastic.co/u/Zfs)\ **Replies:** 1\ **Last updated:** [July 8, 2016, 8:02pm UTC](https://discuss.elastic.co/t/metricbeart-as-a-windows-service-is-too-slow-to-start/55084 "2016-07-08T20:02:32Z")
On windows, there is a delay on service start. If the server CPU is running at 100% the metricbeat service will never start. Filebeat does not have this issue. Event ID 7000 The metricbeat service failed to start due t… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=570) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=572)