# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=573 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 574 --- ## [Question about path in filebeat configuration](https://discuss.elastic.co/t/question-about-path-in-filebeat-configuration/54186)
**Author:** [@nanshan](https://discuss.elastic.co/u/nanshan)\ **Replies:** 3\ **Last updated:** [June 30, 2016, 9:50am UTC](https://discuss.elastic.co/t/question-about-path-in-filebeat-configuration/54186 "2016-06-30T09:50:02Z")
for different services, I have different path of log files. Can I add all the paths of my log files to a single filebeat.yml? --- ## [Filebeat getting sent to syswow64 instead of system32 \[1.2.3\]](https://discuss.elastic.co/t/filebeat-getting-sent-to-syswow64-instead-of-system32-1-2-3/54323)
**Author:** [@arizonawayfarer](https://discuss.elastic.co/u/arizonawayfarer)\ **Replies:** 1\ **Last updated:** [June 30, 2016, 5:52am UTC](https://discuss.elastic.co/t/filebeat-getting-sent-to-syswow64-instead-of-system32-1-2-3/54323 "2016-06-30T05:52:50Z")
So, I've been trying to get filebeat to harvest DHCP logs in the system32 folder on windows. After making sure permissions and everything weren't the issue, I decided to run procmon to see what was holding it up. Turn… --- ## [Running filebeat as a non root user](https://discuss.elastic.co/t/running-filebeat-as-a-non-root-user/53753)
**Author:** [@Sai\_Birada](https://discuss.elastic.co/u/Sai_Birada)\ **Replies:** 2\ **Last updated:** [June 29, 2016, 8:01pm UTC](https://discuss.elastic.co/t/running-filebeat-as-a-non-root-user/53753 "2016-06-29T20:01:09Z")
I am planning to install filebeat on some client machines to monitor user login's on those boxes. But due to some strict security policy i need to run filebeat as a non root user. I read that its not yet possible to run… --- ## [Errors when using go get command to install Libbeat](https://discuss.elastic.co/t/errors-when-using-go-get-command-to-install-libbeat/54185)
**Author:** [@bklise](https://discuss.elastic.co/u/bklise)\ **Replies:** 4\ **Last updated:** [June 29, 2016, 3:05pm UTC](https://discuss.elastic.co/t/errors-when-using-go-get-command-to-install-libbeat/54185 "2016-06-29T15:05:09Z")
I am attempting to create a simple beat but am running into an issue when trying to install Libbeat. I typed the following command: $ go get "github.com/elastic/beats/libbeat" and received the following errors: # g… --- ## [Need help, filebeat doesn't seem working (beginner)](https://discuss.elastic.co/t/need-help-filebeat-doesnt-seem-working-beginner/54103)
**Author:** [@mhui](https://discuss.elastic.co/u/mhui)\ **Replies:** 3\ **Last updated:** [June 29, 2016, 6:31am UTC](https://discuss.elastic.co/t/need-help-filebeat-doesnt-seem-working-beginner/54103 "2016-06-29T06:31:06Z")
Filebeat is not picking up logs and there is no log generated in C:\\ProgramData\\filebeat\\Logs, any help is appreciated, thanks filebeat: prospectors: - paths: - "D:/Input-log-files/SUNMRZBK5X942ZZ… --- ## [Geo\_point not working](https://discuss.elastic.co/t/geo-point-not-working/54082)
**Author:** [@ALa](https://discuss.elastic.co/u/ALa)\ **Replies:** 3\ **Last updated:** [June 28, 2016, 3:45pm UTC](https://discuss.elastic.co/t/geo-point-not-working/54082 "2016-06-28T15:45:16Z")
I'm using the beats-dashboards and I was trying to make client locations works the problem is as following: geoip.location field in packetbeat index is from type number, however in logstash index is the type of geoip.loc… --- ## [Filebeat: output to 2 redis servers impossible](https://discuss.elastic.co/t/filebeat-output-to-2-redis-servers-impossible/54128)
**Author:** [@VuokkoVuorinnen](https://discuss.elastic.co/u/VuokkoVuorinnen)\ **Replies:** 3\ **Last updated:** [June 28, 2016, 11:00am UTC](https://discuss.elastic.co/t/filebeat-output-to-2-redis-servers-impossible/54128 "2016-06-28T11:00:13Z")
OS: Centos 6.7 Filebeat: filebeat-1.2.3-x86\_64.rpm Configuration: output: redis: hosts: \["172.20.0.232:6379", "172.20.0.233:6379"\] index: logstash When starting filebeat with debug info, it gives me this: … --- ## [Filebeat 5.0.0-alpha3 not parsing the JSON messages, it shows up as a string](https://discuss.elastic.co/t/filebeat-5-0-0-alpha3-not-parsing-the-json-messages-it-shows-up-as-a-string/53679)
**Author:** [@keya](https://discuss.elastic.co/u/keya)\ **Replies:** 3\ **Last updated:** [June 28, 2016, 10:15am UTC](https://discuss.elastic.co/t/filebeat-5-0-0-alpha3-not-parsing-the-json-messages-it-shows-up-as-a-string/53679 "2016-06-28T10:15:05Z")
Hi, I am sending logs from Filebeat to Elasticsearch directly. My logs are in JSON format and some have nested JSON objects too. I am using Filebeat 5.0.0-alpha3 version for parsing the log files, but I still see the … --- ## [Starting Filebeat with large number of logs](https://discuss.elastic.co/t/starting-filebeat-with-large-number-of-logs/52938)
**Author:** [@avitash](https://discuss.elastic.co/u/avitash)\ **Replies:** 10\ **Last updated:** [June 28, 2016, 10:13am UTC](https://discuss.elastic.co/t/starting-filebeat-with-large-number-of-logs/52938 "2016-06-28T10:13:02Z")
I am trying to start using Filebeat and I have a huge number of log files. I have tried with option tail\_files to true but "too many files open" error comes. Then I tried setting ignore\_older to 2h and close\_older to 30m… --- ## [Packetbeat & MySQL](https://discuss.elastic.co/t/packetbeat-mysql/54042)
**Author:** [@Kevin\_Csuka](https://discuss.elastic.co/u/Kevin_Csuka)\ **Replies:** 6\ **Last updated:** [June 28, 2016, 8:46am UTC](https://discuss.elastic.co/t/packetbeat-mysql/54042 "2016-06-28T08:46:23Z")
Hi, I'm running an Ubuntu 14.04 machine in Vagrant / Virtualbox, i spinned up a scotchbox, acting as a LAMP server. Packetbeat 1.2.3 is sending data directly to Elasticsearch. Elasticsearch is successfully receiving da… --- ## [Sending logs as it is to Kafka](https://discuss.elastic.co/t/sending-logs-as-it-is-to-kafka/54129)
**Author:** [@treff7es1](https://discuss.elastic.co/u/treff7es1)\ **Replies:** 0\ **Last updated:** [June 28, 2016, 8:38am UTC](https://discuss.elastic.co/t/sending-logs-as-it-is-to-kafka/54129 "2016-06-28T08:38:44Z")
Hi All, I wanted to use filebeat for sending log message as it is to Kafka. We are doing the log enrichment from our service and we don't really need the beats provided one. I found a bit tricky to achieve this so I ad… --- ## [What would happend if filebeat couldn't reach elasticsearch](https://discuss.elastic.co/t/what-would-happend-if-filebeat-couldnt-reach-elasticsearch/53871)
**Author:** [@Arvin2015](https://discuss.elastic.co/u/Arvin2015)\ **Replies:** 4\ **Last updated:** [June 28, 2016, 4:19am UTC](https://discuss.elastic.co/t/what-would-happend-if-filebeat-couldnt-reach-elasticsearch/53871 "2016-06-28T04:19:17Z")
what would happend if filebeat couldn't reach elasticsearch? filebeat couldn't reach elasticsearch for a while, and then my server which is running filebeat reported CPU alert to me, filebeat used about 60% CPU usage, ho… --- ## [Filebeat doesn't update log file and limits file to 2048 lines](https://discuss.elastic.co/t/filebeat-doesnt-update-log-file-and-limits-file-to-2048-lines/53964)
**Author:** [@Dan2](https://discuss.elastic.co/u/Dan2)\ **Replies:** 5\ **Last updated:** [June 27, 2016, 1:16pm UTC](https://discuss.elastic.co/t/filebeat-doesnt-update-log-file-and-limits-file-to-2048-lines/53964 "2016-06-27T13:16:57Z")
Hi, I'm new to this. I want Filebeat to update the output file each time the log gets updated. What's happening now is that Filebeat creates a file with only the existing lines that fit "inclued\_lines" that I've ente… --- ## [Filebeat and Logstash certificate and key](https://discuss.elastic.co/t/filebeat-and-logstash-certificate-and-key/53990)
**Author:** [@fjiang212](https://discuss.elastic.co/u/fjiang212)\ **Replies:** 1\ **Last updated:** [June 27, 2016, 10:09am UTC](https://discuss.elastic.co/t/filebeat-and-logstash-certificate-and-key/53990 "2016-06-27T10:09:00Z")
I follow the doc (https://www.digitalocean.com/community/tutorials/how-to-install-elasticsearch-logstash-and-kibana-elk-stack-on-ubuntu-14-04) to generate certificate and private key, then use them in both filebeat and l… --- ## [Duplicate documents using Filebeat](https://discuss.elastic.co/t/duplicate-documents-using-filebeat/53905)
**Author:** [@vitgou](https://discuss.elastic.co/u/vitgou)\ **Replies:** 2\ **Last updated:** [June 27, 2016, 9:21am UTC](https://discuss.elastic.co/t/duplicate-documents-using-filebeat/53905 "2016-06-27T09:21:20Z")
Hi, I'm using Filebeat to send data to Logstash + Elasticsearch server. I noticed that if the Logstash+Elasticsearch server is not fast enough I start to see duplicate entries in elasticsearch. Is this a bug? What opti… --- ## [Different output for different hosts](https://discuss.elastic.co/t/different-output-for-different-hosts/53776)
**Author:** [@f3rdy](https://discuss.elastic.co/u/f3rdy)\ **Replies:** 3\ **Last updated:** [June 26, 2016, 9:32pm UTC](https://discuss.elastic.co/t/different-output-for-different-hosts/53776 "2016-06-26T21:32:01Z")
Hi, I'm not sure, if beats is the right place to put my question here, maybe it's also logstash or elasticsearch or kibana... For explanation: I run top beat on two different hosts and an ELK stack on another host. I… --- ## [Limiting Initial Scope of Winlogbeat](https://discuss.elastic.co/t/limiting-initial-scope-of-winlogbeat/53847)
**Author:** [@rgibson](https://discuss.elastic.co/u/rgibson)\ **Replies:** 2\ **Last updated:** [June 26, 2016, 8:06am UTC](https://discuss.elastic.co/t/limiting-initial-scope-of-winlogbeat/53847 "2016-06-26T08:06:01Z")
Is there a configuration option to restrict the initial ingestion of Winlogbeat to something less than the entirety of the logs, perhaps by date? For example, I am trying to onboard about 350 Windows servers, and when … --- ## [Topbeat configuration documentation](https://discuss.elastic.co/t/topbeat-configuration-documentation/53938)
**Author:** [@matanster](https://discuss.elastic.co/u/matanster)\ **Replies:** 1\ **Last updated:** [June 25, 2016, 9:03pm UTC](https://discuss.elastic.co/t/topbeat-configuration-documentation/53938 "2016-06-25T21:03:15Z")
Hi, I am trying to fathom whether topbeat (until deprecated by something from version 5 or otherwise), can monitor free disk space. The marketing page at https://www.elastic.co/products/beats/topbeat refers to a rather… --- ## [Can the beats stack send to other systems or protocols?](https://discuss.elastic.co/t/can-the-beats-stack-send-to-other-systems-or-protocols/53945)
**Author:** [@chagara](https://discuss.elastic.co/u/chagara)\ **Replies:** 1\ **Last updated:** [June 25, 2016, 9:00pm UTC](https://discuss.elastic.co/t/can-the-beats-stack-send-to-other-systems-or-protocols/53945 "2016-06-25T21:00:02Z")
helo, Just started using this software and wanted to see if there was a way to make filebeat or the others send to another procol or system that is not logstash or elasticsearch? or if that is supported? --- ## [Beats to post JSON to elasticsearch](https://discuss.elastic.co/t/beats-to-post-json-to-elasticsearch/53651)
**Author:** [@Rohit\_Shrivastava](https://discuss.elastic.co/u/Rohit_Shrivastava)\ **Replies:** 4\ **Last updated:** [June 24, 2016, 11:44am UTC](https://discuss.elastic.co/t/beats-to-post-json-to-elasticsearch/53651 "2016-06-24T11:44:18Z")
Hi I was following https://www.elastic.co/blog/structured-logging-filebeat I am using Folebeat 1.2.3. Is there any requirement of any specifc version of ElasticSearch also to make it work. I am posting to AWS Elastic… --- ## [Filebeat not setting index name even though configured](https://discuss.elastic.co/t/filebeat-not-setting-index-name-even-though-configured/53793)
**Author:** [@whyapenny](https://discuss.elastic.co/u/whyapenny)\ **Replies:** 4\ **Last updated:** [June 24, 2016, 11:39am UTC](https://discuss.elastic.co/t/filebeat-not-setting-index-name-even-though-configured/53793 "2016-06-24T11:39:29Z")
In filebeat.yml i have set: index: filebeat-app yet in the json output there is nothing for index, and it still receives teh default logstash-$date index when inserted into elasticsearch. --- ## [Remote log file](https://discuss.elastic.co/t/remote-log-file/53725)
**Author:** [@franzwong](https://discuss.elastic.co/u/franzwong)\ **Replies:** 3\ **Last updated:** [June 24, 2016, 7:19am UTC](https://discuss.elastic.co/t/remote-log-file/53725 "2016-06-24T07:19:49Z")
I have a URL pointing to a log file. I can write a cron job to download (http get) this log file periodically. But I am just thinking whether filebeat will reset its cursor to the file after download. Also will it send d… --- ## [\[Solved\] Using the Kafka output the Development Build of Filebeat](https://discuss.elastic.co/t/solved-using-the-kafka-output-the-development-build-of-filebeat/42742)
**Author:** [@Bibeleuh](https://discuss.elastic.co/u/Bibeleuh)\ **Replies:** 5\ **Last updated:** [June 24, 2016, 3:47am UTC](https://discuss.elastic.co/t/solved-using-the-kafka-output-the-development-build-of-filebeat/42742 "2016-06-24T03:47:35Z")
Hello, I have problems to communicate with my broker as output. My actually working configuration is : Filebeat -\> Logstash 1 -\> RabbitMQ -\> Logstash 2 -\> Elasticsearch Logstash1 is only an intermediate between FB an… --- ## [Cross compile Topbeat for Windows on Linux](https://discuss.elastic.co/t/cross-compile-topbeat-for-windows-on-linux/53102)
**Author:** [@arunachala](https://discuss.elastic.co/u/arunachala)\ **Replies:** 7\ **Last updated:** [June 23, 2016, 4:32pm UTC](https://discuss.elastic.co/t/cross-compile-topbeat-for-windows-on-linux/53102 "2016-06-23T16:32:52Z")
Hi, I want to compile topbeat for Windows on my Linux desktop. I have the following installed: \* docker \* go \* beats-packer (from github.com/elastic/beats-packer) Now, when try to cross compile Topbeat for Windo… --- ## [Topbeat immediately exiting](https://discuss.elastic.co/t/topbeat-immediately-exiting/53706)
**Author:** [@apomerenk](https://discuss.elastic.co/u/apomerenk)\ **Replies:** 3\ **Last updated:** [June 23, 2016, 2:50pm UTC](https://discuss.elastic.co/t/topbeat-immediately-exiting/53706 "2016-06-23T14:50:19Z")
I am trying to send topbeat logs from a Centos7 on virtualbox to an ELK stack running on the local machine. When I run sudo /etc/init.d/topbeat start from the terminal, I get the message: Starting topbeat (via systemct… --- ## [Can filebeat push the Windows Event logs to logstash](https://discuss.elastic.co/t/can-filebeat-push-the-windows-event-logs-to-logstash/52830)
**Author:** [@disalassalyjose](https://discuss.elastic.co/u/disalassalyjose)\ **Replies:** 9\ **Last updated:** [June 23, 2016, 9:51am UTC](https://discuss.elastic.co/t/can-filebeat-push-the-windows-event-logs-to-logstash/52830 "2016-06-23T09:51:52Z")
Can we push Event logs from Windows server 2012 r2 to logststash which is installed on ubuntu using filebeat. Server : Ubuntu 14.04 Client : Windows server 2012 r2 --- ## [Windows server is almost not generating logs after winlogbeat installation](https://discuss.elastic.co/t/windows-server-is-almost-not-generating-logs-after-winlogbeat-installation/53275)
**Author:** [@sumeshms](https://discuss.elastic.co/u/sumeshms)\ **Replies:** 6\ **Last updated:** [June 23, 2016, 9:42am UTC](https://discuss.elastic.co/t/windows-server-is-almost-not-generating-logs-after-winlogbeat-installation/53275 "2016-06-23T09:42:48Z")
Hello Am facing a wired issue, After the installation of winlogbeat on two servers , both of them are generating only a few number of logs. Most of the time the servers are not logging anything. Any idea ? Regards S… --- ## [Filebeat Error publishing events (retrying): EOF](https://discuss.elastic.co/t/filebeat-error-publishing-events-retrying-eof/53484)
**Author:** [@sunilmchaudhari](https://discuss.elastic.co/u/sunilmchaudhari)\ **Replies:** 4\ **Last updated:** [June 23, 2016, 6:41am UTC](https://discuss.elastic.co/t/filebeat-error-publishing-events-retrying-eof/53484 "2016-06-23T06:41:39Z")
Hi, I am getitng below logs in filebeat log file. 2016-06-21T14:04:31+03:00 DBG Not harvesting, file didn't change: /opt/apache-tomee-jaxrs-1.6.0/logs/localhost\_access\_log.2016-06-17.txt 2016-06-21T14:04:31+03:00 DB… --- ## [Can I add loadbalance to filebeat config for hosts in logstash output?](https://discuss.elastic.co/t/can-i-add-loadbalance-to-filebeat-config-for-hosts-in-logstash-output/53378)
**Author:** [@nanshan](https://discuss.elastic.co/u/nanshan)\ **Replies:** 5\ **Last updated:** [June 22, 2016, 9:31pm UTC](https://discuss.elastic.co/t/can-i-add-loadbalance-to-filebeat-config-for-hosts-in-logstash-output/53378 "2016-06-22T21:31:07Z")
https://www.elastic.co/guide/en/beats/filebeat/current/logstash-output.html It says I can add a list of hosts in logstash output and enable loadbalancer but I am not sure if I can just add the loadbalancer like : log… --- ## [Should I run filebeat from bin or etc?](https://discuss.elastic.co/t/should-i-run-filebeat-from-bin-or-etc/53702)
**Author:** [@dal](https://discuss.elastic.co/u/dal)\ **Replies:** 2\ **Last updated:** [June 22, 2016, 7:36pm UTC](https://discuss.elastic.co/t/should-i-run-filebeat-from-bin-or-etc/53702 "2016-06-22T19:36:43Z")
I did an rpm install of filebeat. When I run filebeat from /usr/bin/filebeat with /usr/bin/filebeat start or /usr/bin/filebeat -c /path/to/filebeat.yml, the shell just hangs. When I run etc/init.d/filebeat start, i get a… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=572) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=574)