# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=572 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 573 --- ## [Map Files to specific Ingest Pipelines](https://discuss.elastic.co/t/map-files-to-specific-ingest-pipelines/55063)
**Author:** [@sirsteve](https://discuss.elastic.co/u/sirsteve)\ **Replies:** 2\ **Last updated:** [July 8, 2016, 3:32pm UTC](https://discuss.elastic.co/t/map-files-to-specific-ingest-pipelines/55063 "2016-07-08T15:32:17Z")
Hi, I'm playing around with the new Elastic5 products and am interested in using the ingest node feature with Filebeat as the agent. I have a server that runs several applications with different log files/formats and … --- ## [Metricbeat CPU](https://discuss.elastic.co/t/metricbeat-cpu/54987)
**Author:** [@Zfs](https://discuss.elastic.co/u/Zfs)\ **Replies:** 1\ **Last updated:** [July 8, 2016, 3:17pm UTC](https://discuss.elastic.co/t/metricbeat-cpu/54987 "2016-07-08T15:17:26Z")
I've been running the daily snapshot 5.0.0a5 for the past 24 hours. I've started to see the metricbeat.exe use a lot more cpu than I would like. I've been collecting the following: - module: system metricsets: -… --- ## [Index not creating](https://discuss.elastic.co/t/index-not-creating/55016)
**Author:** [@bala1](https://discuss.elastic.co/u/bala1)\ **Replies:** 5\ **Last updated:** [July 8, 2016, 11:35am UTC](https://discuss.elastic.co/t/index-not-creating/55016 "2016-07-08T11:35:46Z")
I have started ES and trying to fetch indices on kibana-4 but getting error while fire command on powershell command: Output: 2016/07/08 05:12:35.119557 client.go:302: DBG Ping request failed with: Head http://search… --- ## [What's the difference between beats and logstash](https://discuss.elastic.co/t/whats-the-difference-between-beats-and-logstash/55034)
**Author:** [@ronnie](https://discuss.elastic.co/u/ronnie)\ **Replies:** 1\ **Last updated:** [July 8, 2016, 11:23am UTC](https://discuss.elastic.co/t/whats-the-difference-between-beats-and-logstash/55034 "2016-07-08T11:23:58Z")
what's the difference between beats and logstash ? I don't know which one should i chose in my environment. --- ## [Packetbeat IPv6 support](https://discuss.elastic.co/t/packetbeat-ipv6-support/54941)
**Author:** [@raboof](https://discuss.elastic.co/u/raboof)\ **Replies:** 3\ **Last updated:** [July 8, 2016, 11:10am UTC](https://discuss.elastic.co/t/packetbeat-ipv6-support/54941 "2016-07-08T11:10:41Z")
It'd be nice to be able to support IPv6 addresses in packetbeat. https://github.com/elastic/beats/blob/master/packetbeat/procs/procs.go currently stores IP addresses in an uint32, where IPv6 addresses are 128 bits. W… --- ## [Can we make filebeat to read files in particular sequence](https://discuss.elastic.co/t/can-we-make-filebeat-to-read-files-in-particular-sequence/47090)
**Author:** [@rajkamalkool6](https://discuss.elastic.co/u/rajkamalkool6)\ **Replies:** 5\ **Last updated:** [July 8, 2016, 6:57am UTC](https://discuss.elastic.co/t/can-we-make-filebeat-to-read-files-in-particular-sequence/47090 "2016-07-08T06:57:03Z")
Hi, I am using filebeat 1.2.0 to fetch my log files. I have a pair of log files, request andresponse log files. In my logstash configuration I am doing some aggregation between request and response files. In my log dire… --- ## [Filebeat not sending any log files](https://discuss.elastic.co/t/filebeat-not-sending-any-log-files/41183)
**Author:** [@NekoNova](https://discuss.elastic.co/u/NekoNova)\ **Replies:** 4\ **Last updated:** [July 7, 2016, 3:48pm UTC](https://discuss.elastic.co/t/filebeat-not-sending-any-log-files/41183 "2016-07-07T15:48:14Z")
Hello, I'm encountering a weird issue with the Filebeat on one of our systems. I've configured it identical to all other systems, but for some reason this one box is not sending out any log files. I've also noticed tha… --- ## [CPU from Windows](https://discuss.elastic.co/t/cpu-from-windows/54952)
**Author:** [@qutach](https://discuss.elastic.co/u/qutach)\ **Replies:** 1\ **Last updated:** [July 7, 2016, 2:15pm UTC](https://discuss.elastic.co/t/cpu-from-windows/54952 "2016-07-07T14:15:01Z")
Hi, I'm trying to save CPU metric to elastic with using Topbeat. Is there any filed that match the "CPU % Utilization" from Task Manger (also same value as "% Processor Time" from Performance Monitor)? What I have fou… --- ## [Different poll periods for different stats](https://discuss.elastic.co/t/different-poll-periods-for-different-stats/54833)
**Author:** [@Zfs](https://discuss.elastic.co/u/Zfs)\ **Replies:** 2\ **Last updated:** [July 6, 2016, 5:36pm UTC](https://discuss.elastic.co/t/different-poll-periods-for-different-stats/54833 "2016-07-06T17:36:51Z")
Running the daily build - filebeat-5.0.0-alpha5-SNAPSHOT-windows-x86 Is it possible to have multiple metricsets that support different polling periods? I would like to have the filesystem metric checked at a slower int… --- ## [Hsbeats compile error on debian](https://discuss.elastic.co/t/hsbeats-compile-error-on-debian/54412)
**Author:** [@guenther](https://discuss.elastic.co/u/guenther)\ **Replies:** 3\ **Last updated:** [July 6, 2016, 2:23pm UTC](https://discuss.elastic.co/t/hsbeats-compile-error-on-debian/54412 "2016-07-06T14:23:18Z")
Hi, i have a debian 7 and tried to compile the hsbeat with go 1.6 as described on the hsbeat-page. go get github.com/YaSuenag/hsbeat This statement fails with: # github.com/YaSuenag/hsbeat/hsbeat .go/src/github.com… --- ## [Error : invalid memory address or nil pointer dereference](https://discuss.elastic.co/t/error-invalid-memory-address-or-nil-pointer-dereference/54716)
**Author:** [@axil\_76](https://discuss.elastic.co/u/axil_76)\ **Replies:** 5\ **Last updated:** [July 6, 2016, 1:03pm UTC](https://discuss.elastic.co/t/error-invalid-memory-address-or-nil-pointer-dereference/54716 "2016-07-06T13:03:42Z")
Hello, when do I start the client filebeat in my container I have the following error message in my script the command to boot the client is as followsthe command to boot the client is as follows exec /usr/bin/filebea… --- ## [Metricbeat on FreeBSD](https://discuss.elastic.co/t/metricbeat-on-freebsd/54533)
**Author:** [@michbsd](https://discuss.elastic.co/u/michbsd)\ **Replies:** 5\ **Last updated:** [July 6, 2016, 7:53am UTC](https://discuss.elastic.co/t/metricbeat-on-freebsd/54533 "2016-07-06T07:53:59Z")
Hi, I am trying metricbeat - however network & diskio are the only metricsets (from the system module) that is working. When starting metricbeat with e.g. memory metricset enabled I get the following error: 2016/07/0… --- ## [ICMP setting ignored?](https://discuss.elastic.co/t/icmp-setting-ignored/54643)
**Author:** [@aros](https://discuss.elastic.co/u/aros)\ **Replies:** 3\ **Last updated:** [July 5, 2016, 8:31pm UTC](https://discuss.elastic.co/t/icmp-setting-ignored/54643 "2016-07-05T20:31:32Z")
Hi, I am trying to monitor my http traffic using packetbeat 5.0.0-alpha4 (something I did before with 1.x with good results). My problem is that I am receiving an increasing number of events, even when no http traffic … --- ## [Get website certificate log with Filebeats](https://discuss.elastic.co/t/get-website-certificate-log-with-filebeats/54628)
**Author:** [@Chanawit\_Onchoo](https://discuss.elastic.co/u/Chanawit_Onchoo)\ **Replies:** 4\ **Last updated:** [July 5, 2016, 4:40pm UTC](https://discuss.elastic.co/t/get-website-certificate-log-with-filebeats/54628 "2016-07-05T16:40:58Z")
Is it possible way to use Filebeats to get certificate log from website(or others beats) or I need to build my own beats(or script) to do it. Thank you for answer. --- ## [How to stop filebeat running under non-root account - other than kill](https://discuss.elastic.co/t/how-to-stop-filebeat-running-under-non-root-account-other-than-kill/54471)
**Author:** [@zoplex](https://discuss.elastic.co/u/zoplex)\ **Replies:** 7\ **Last updated:** [July 5, 2016, 4:40pm UTC](https://discuss.elastic.co/t/how-to-stop-filebeat-running-under-non-root-account-other-than-kill/54471 "2016-07-05T16:40:58Z")
Is there a way to send shutdown/reboot signal to filebeat running under non-root account? From root account service filebeat restart/stop/start works great - but from non-root account? Thanks, Zoran --- ## [Using the exclude\_lines option](https://discuss.elastic.co/t/using-the-exclude-lines-option/40779)
**Author:** [@yammy](https://discuss.elastic.co/u/yammy)\ **Replies:** 5\ **Last updated:** [July 5, 2016, 10:01am UTC](https://discuss.elastic.co/t/using-the-exclude-lines-option/40779 "2016-07-05T10:01:01Z")
According to the documenation I should be able to use the "exclude\_lines" option to filter specific events. I've setup my filebeat.yml to exclude any entries that start with my load balancer IP, but they still forward … --- ## [Message Format problem for logstash](https://discuss.elastic.co/t/message-format-problem-for-logstash/54612)
**Author:** [@axil\_76](https://discuss.elastic.co/u/axil_76)\ **Replies:** 3\ **Last updated:** [July 5, 2016, 9:59am UTC](https://discuss.elastic.co/t/message-format-problem-for-logstash/54612 "2016-07-05T09:59:13Z")
hello, I installed filebeat in a container and another container I have installed logstash, and I put myself in debug mode, I perceive myself as the original message does not have the correct format, config entry into lo… --- ## [Not able to create an index of Metric beat in elasticsearch](https://discuss.elastic.co/t/not-able-to-create-an-index-of-metric-beat-in-elasticsearch/54648)
**Author:** [@vikas\_gopal](https://discuss.elastic.co/u/vikas_gopal)\ **Replies:** 3\ **Last updated:** [July 4, 2016, 3:05pm UTC](https://discuss.elastic.co/t/not-able-to-create-an-index-of-metric-beat-in-elasticsearch/54648 "2016-07-04T15:05:58Z")
Hi Experts, I have metricbeat-5.0.0-alpha4-linux-x86\_64 elasticsearch-2.3.3 kibana-4.5.1-linux-x64 Ubuntu So as suggested by the guide I have downloaded and configure metricbeat but unfortunately I am not able to c… --- ## [Beats: How to report an issue](https://discuss.elastic.co/t/beats-how-to-report-an-issue/38301)
**Author:** [@ruflin](https://discuss.elastic.co/u/ruflin)\ **Replies:** 0\ **Last updated:** [January 4, 2016, 9:50am UTC](https://discuss.elastic.co/t/beats-how-to-report-an-issue/38301 "2016-01-04T09:50:10Z")
This forum is intended for all discussions and issues related to the beats projects. Each Beat has its own subforum, so for beat specific issues, please use the specific forum. In case you have issue with the installat… --- ## [Some answers needed on the technical what/how of Filebeat](https://discuss.elastic.co/t/some-answers-needed-on-the-technical-what-how-of-filebeat/54616)
**Author:** [@JohnnyS](https://discuss.elastic.co/u/JohnnyS)\ **Replies:** 8\ **Last updated:** [July 4, 2016, 11:38am UTC](https://discuss.elastic.co/t/some-answers-needed-on-the-technical-what-how-of-filebeat/54616 "2016-07-04T11:38:12Z")
Hi As I'm still new on filebeat, can I ask somebody: Technical what/how ? • (1) Capture text in log file “error” • (2) Capture reg.exp in log file “\[A-Z\]+-\[0-9\]\*/ERR” • Logical operators : capture ( “pattern-1” || “p… --- ## [@timestamp in log file getting replaced by processing time](https://discuss.elastic.co/t/timestamp-in-log-file-getting-replaced-by-processing-time/54195)
**Author:** [@ttl](https://discuss.elastic.co/u/ttl)\ **Replies:** 6\ **Last updated:** [July 4, 2016, 7:06am UTC](https://discuss.elastic.co/t/timestamp-in-log-file-getting-replaced-by-processing-time/54195 "2016-07-04T07:06:39Z")
I recently switched over from using Logstash as my shipper to filebeat. The flow is Filebeat -\> Logstash -\> ES -\> Kibana 4. Previously, it was LS Shipper -\> Redis -\> LS -\> ES -\> K Log files themselves are json and con… --- ## [How to create filebeat index pattern in Kibana](https://discuss.elastic.co/t/how-to-create-filebeat-index-pattern-in-kibana/53489)
**Author:** [@ramanamohan](https://discuss.elastic.co/u/ramanamohan)\ **Replies:** 12\ **Last updated:** [July 4, 2016, 5:52am UTC](https://discuss.elastic.co/t/how-to-create-filebeat-index-pattern-in-kibana/53489 "2016-07-04T05:52:44Z")
Hi I am new to the ELK Stack. I have successfully installed the ELK services along with the shippers into my server. I was able to create the index patterns for topBeat, winlogBeat and packetBeat, which are of no use to … --- ## [Filebeat exclude lines that start with '+'](https://discuss.elastic.co/t/filebeat-exclude-lines-that-start-with/54466)
**Author:** [@kd5dbl](https://discuss.elastic.co/u/kd5dbl)\ **Replies:** 2\ **Last updated:** [July 1, 2016, 1:55pm UTC](https://discuss.elastic.co/t/filebeat-exclude-lines-that-start-with/54466 "2016-07-01T13:55:58Z")
Hi all... i'm trying to use Filebeat (v1.2.3) to exclude all log lines that start with a '+' (plus sign)... I've tried; exclude\_lines: \["^\\+"\] I get the error; Loading config file error: YAML config parsing fail… --- ## [How to replace the value of beat.hostname?](https://discuss.elastic.co/t/how-to-replace-the-value-of-beat-hostname/54485)
**Author:** [@virtual](https://discuss.elastic.co/u/virtual)\ **Replies:** 1\ **Last updated:** [July 1, 2016, 9:47am UTC](https://discuss.elastic.co/t/how-to-replace-the-value-of-beat-hostname/54485 "2016-07-01T09:47:13Z")
I want to send the external IP address to Logstash instead of what Filebeat is currently sending as beat.hostname. I tried the following: fields: beat.hostname: 44.112.44.112 fields\_under\_root: true But that di… --- ## [Configuring packetbeat to monitor traffic from remote server](https://discuss.elastic.co/t/configuring-packetbeat-to-monitor-traffic-from-remote-server/54361)
**Author:** [@rresol](https://discuss.elastic.co/u/rresol)\ **Replies:** 3\ **Last updated:** [July 1, 2016, 9:10am UTC](https://discuss.elastic.co/t/configuring-packetbeat-to-monitor-traffic-from-remote-server/54361 "2016-07-01T09:10:43Z")
Hello everyone I am new to packetbeat . I wanted to monitor traffic on a remote host whose ip address is 192.168.0.122 . How should I configure so that I can monitor the traffic on ports 80 and 27017. Here is my configur… --- ## [Filebeat sends old logs after reboot](https://discuss.elastic.co/t/filebeat-sends-old-logs-after-reboot/54517)
**Author:** [@lkosz](https://discuss.elastic.co/u/lkosz)\ **Replies:** 0\ **Last updated:** [July 1, 2016, 8:15am UTC](https://discuss.elastic.co/t/filebeat-sends-old-logs-after-reboot/54517 "2016-07-01T08:15:59Z")
I'm having problem with filebeat - filebeat send old logs after service restart. I've turned on debugging and got: 2016-07-01T09:42:45+02:00 INFO Additional configs loaded from: /etc/filebeat/conf.d/maillog.yml 2016-0… --- ## [Which pattern to choose for Stack trace](https://discuss.elastic.co/t/which-pattern-to-choose-for-stack-trace/54377)
**Author:** [@JohnnyS](https://discuss.elastic.co/u/JohnnyS)\ **Replies:** 3\ **Last updated:** [June 30, 2016, 1:10pm UTC](https://discuss.elastic.co/t/which-pattern-to-choose-for-stack-trace/54377 "2016-06-30T13:10:30Z")
Hi Can somebody please assist me a bit to know which pattern I should use for the following stack trace: \ \2016/06/30 00:00:02\\ERROR\\\\Thread-429878\ **Author:** [@roccodelux](https://discuss.elastic.co/u/roccodelux)\ **Replies:** 2\ **Last updated:** [June 30, 2016, 12:31pm UTC](https://discuss.elastic.co/t/packet-beat-support-protocol-https/54383 "2016-06-30T12:31:01Z") I would like to know if packet beat supports https of which I possess the private key. I have to monitor soap calls and rest over https on my server. --- ## [Is there a way to to use Beats (topbeat) to monitor Docker containers in an easy way?](https://discuss.elastic.co/t/is-there-a-way-to-to-use-beats-topbeat-to-monitor-docker-containers-in-an-easy-way/54325)
**Author:** [@marcopas](https://discuss.elastic.co/u/marcopas)\ **Replies:** 1\ **Last updated:** [June 30, 2016, 10:15am UTC](https://discuss.elastic.co/t/is-there-a-way-to-to-use-beats-topbeat-to-monitor-docker-containers-in-an-easy-way/54325 "2016-06-30T10:15:36Z")
Hi there, we are currently experimenting with Beats to monitor our docker containers. Currently we have a setup so that we need to install Beats in every Docker Container that we create. This gives overhead per container… --- ## [How to add hostname to logs that normally do not contain hostname?](https://discuss.elastic.co/t/how-to-add-hostname-to-logs-that-normally-do-not-contain-hostname/54173)
**Author:** [@Michael1](https://discuss.elastic.co/u/Michael1)\ **Replies:** 13\ **Last updated:** [June 30, 2016, 9:54am UTC](https://discuss.elastic.co/t/how-to-add-hostname-to-logs-that-normally-do-not-contain-hostname/54173 "2016-06-30T09:54:52Z")
I am trying to send SharePoint logs to Logstash and the typical SharePoint logs do not contain the server name. Would I have to do this somewhere in the Beats config, or? [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=571) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=573)