# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=574 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 575 --- ## [Reading .gz files with Filebeat](https://discuss.elastic.co/t/reading-gz-files-with-filebeat/53582)
**Author:** [@nanshan](https://discuss.elastic.co/u/nanshan)\ **Replies:** 2\ **Last updated:** [June 22, 2016, 6:09pm UTC](https://discuss.elastic.co/t/reading-gz-files-with-filebeat/53582 "2016-06-22T18:09:10Z")
My path to filebeat is /var/log/apache2 there are gz files like access.log.2016.06.12.gz will filebeat harvest them? --- ## [Filebeat Windows Config Help (filebeat.yml)](https://discuss.elastic.co/t/filebeat-windows-config-help-filebeat-yml/52656)
**Author:** [@filebeat\_win](https://discuss.elastic.co/u/filebeat_win)\ **Replies:** 13\ **Last updated:** [June 22, 2016, 3:54pm UTC](https://discuss.elastic.co/t/filebeat-windows-config-help-filebeat-yml/52656 "2016-06-22T15:54:49Z")
Trying to capture IIS logs in close to real time, but Kibana seems to only show old logs (the day before and older). Can anyone point me in the right direction to getting close to real-time logs displayed in Kibana? OS… --- ## [How to customize output format?](https://discuss.elastic.co/t/how-to-customize-output-format/53158)
**Author:** [@jiming](https://discuss.elastic.co/u/jiming)\ **Replies:** 8\ **Last updated:** [June 22, 2016, 3:39pm UTC](https://discuss.elastic.co/t/how-to-customize-output-format/53158 "2016-06-22T15:39:24Z")
Dear guys, I wanted to customize output format for filebeat, like logback or log4j does. Does filebeat support it? For example: "%m" means output origin message "%ip %m %t" means local ip, message and timestamp i… --- ## [IIS Logs Per Site](https://discuss.elastic.co/t/iis-logs-per-site/53536)
**Author:** [@filebeat\_win](https://discuss.elastic.co/u/filebeat_win)\ **Replies:** 2\ **Last updated:** [June 22, 2016, 3:24pm UTC](https://discuss.elastic.co/t/iis-logs-per-site/53536 "2016-06-22T15:24:17Z")
Does filebeat support IIS logs per site (not server)? For instance, filebeat is configured as such: C:\\inetpub\\logs\\LogFiles\*\*.log The LogFiles directory contains W3SVC1 and W3SVC2. Each subdirectory will have a log … --- ## [Cannot configure SSL connection between Filebeat and Logstash](https://discuss.elastic.co/t/cannot-configure-ssl-connection-between-filebeat-and-logstash/53039)
**Author:** [@Sully1](https://discuss.elastic.co/u/Sully1)\ **Replies:** 2\ **Last updated:** [June 22, 2016, 2:16pm UTC](https://discuss.elastic.co/t/cannot-configure-ssl-connection-between-filebeat-and-logstash/53039 "2016-06-22T14:16:44Z")
I'm having trouble configuring the SSL connection between the Filebeat client (Windows 2012 R2) and the Logstash server (RH7). Filebeat and Logstash communicates just find when I set ssl to 'false' in the beats config f… --- ## [Server 2012 R2 some metrics not send](https://discuss.elastic.co/t/server-2012-r2-some-metrics-not-send/51403)
**Author:** [@Kevin\_Csuka](https://discuss.elastic.co/u/Kevin_Csuka)\ **Replies:** 10\ **Last updated:** [June 22, 2016, 2:08pm UTC](https://discuss.elastic.co/t/server-2012-r2-some-metrics-not-send/51403 "2016-06-22T14:08:25Z")
Hi, I am running a Server 2012 R2, a Virtual Machine hosted by VMware, with Topbeat 1.2.3. It sends data to Logstash -\> Elasticsearch. I view the data in Kibana. The metrics are visualized from the most parts. But som… --- ## [Filebeat not working with 2 different log files](https://discuss.elastic.co/t/filebeat-not-working-with-2-different-log-files/53481)
**Author:** [@Mitesh\_Jaiswal](https://discuss.elastic.co/u/Mitesh_Jaiswal)\ **Replies:** 4\ **Last updated:** [June 22, 2016, 6:29am UTC](https://discuss.elastic.co/t/filebeat-not-working-with-2-different-log-files/53481 "2016-06-22T06:29:10Z")
Hi, I am using file-beat with different different log files, but only last one log files is seding data. why it is happening, also please find my configuration over filebeat.yml paths: - /FirstKannel/opt/kan… --- ## [How to configure different types of logs](https://discuss.elastic.co/t/how-to-configure-different-types-of-logs/53356)
**Author:** [@keya](https://discuss.elastic.co/u/keya)\ **Replies:** 3\ **Last updated:** [June 22, 2016, 6:17am UTC](https://discuss.elastic.co/t/how-to-configure-different-types-of-logs/53356 "2016-06-22T06:17:34Z")
I want to configure two different logs in FIlebeat. I have system logs and JSON logs from my application. Can I configure both these in a single config file? If yes, what would be the configuration required for it? In t… --- ## [Regarding Filebeat Ouput to a File in Remote Server or NFS](https://discuss.elastic.co/t/regarding-filebeat-ouput-to-a-file-in-remote-server-or-nfs/46038)
**Author:** [@vivc](https://discuss.elastic.co/u/vivc)\ **Replies:** 37\ **Last updated:** [June 22, 2016, 6:07am UTC](https://discuss.elastic.co/t/regarding-filebeat-ouput-to-a-file-in-remote-server-or-nfs/46038 "2016-06-22T06:07:26Z")
I want to output data from filebeat to a file in NFS on remote server. Please suggest how we can do that. I have found the option to forward data using following configuration . But how we can we forward the data to fi… --- ## [Filebeat connection error while publishing events to Logstash](https://discuss.elastic.co/t/filebeat-connection-error-while-publishing-events-to-logstash/53578)
**Author:** [@bhawanaus](https://discuss.elastic.co/u/bhawanaus)\ **Replies:** 2\ **Last updated:** [June 22, 2016, 3:46am UTC](https://discuss.elastic.co/t/filebeat-connection-error-while-publishing-events-to-logstash/53578 "2016-06-22T03:46:08Z")
I set up Filebeat on Windows 10 and trying to ship logs from my local to Logstash. Configuration in filebeat.yml file paths: #- /var/log/\*.log - C:\\http\_log\* #logstash: # The Logstash hosts … --- ## [Metricbeat vs Topbeat](https://discuss.elastic.co/t/metricbeat-vs-topbeat/53569)
**Author:** [@dhollinger](https://discuss.elastic.co/u/dhollinger)\ **Replies:** 1\ **Last updated:** [June 21, 2016, 10:37pm UTC](https://discuss.elastic.co/t/metricbeat-vs-topbeat/53569 "2016-06-21T22:37:00Z")
Reading through the Metricbeat alpha, can someone summarize the differences between Topbeat and the Metricbeat System Module? Would you use them both on one system or not? If they both provide the same/similar feature … --- ## [Getting Topbeat stats from a remote server](https://discuss.elastic.co/t/getting-topbeat-stats-from-a-remote-server/53551)
**Author:** [@aadiwarden](https://discuss.elastic.co/u/aadiwarden)\ **Replies:** 4\ **Last updated:** [June 21, 2016, 8:50pm UTC](https://discuss.elastic.co/t/getting-topbeat-stats-from-a-remote-server/53551 "2016-06-21T20:50:03Z")
Hi, A little new to topbeat and didnt see any related article so I thought I'd ask. Is it possible to gather the stats from a set of remote servers by installing topbeat only in the main server? If its something eas… --- ## [How can i stop filebeat without killing the process?](https://discuss.elastic.co/t/how-can-i-stop-filebeat-without-killing-the-process/53560)
**Author:** [@dal](https://discuss.elastic.co/u/dal)\ **Replies:** 1\ **Last updated:** [June 21, 2016, 7:43pm UTC](https://discuss.elastic.co/t/how-can-i-stop-filebeat-without-killing-the-process/53560 "2016-06-21T19:43:08Z")
I did an rpm install and ran my filebeat process with /etc/init.d/filebeat start. i want to change filebeat.yml, so i am trying to stop and restart filebeat. How can I stop filebeat without manually killing the process? … --- ## [How to uninstall Filebeat using Yum](https://discuss.elastic.co/t/how-to-uninstall-filebeat-using-yum/53555)
**Author:** [@keya](https://discuss.elastic.co/u/keya)\ **Replies:** 2\ **Last updated:** [June 21, 2016, 6:43pm UTC](https://discuss.elastic.co/t/how-to-uninstall-filebeat-using-yum/53555 "2016-06-21T18:43:18Z")
Hi, I am trying to install Filebeat-alpha version on a machine which already had an older version of filebeat running. How can I upgrade to Filebeat-alpha. I tried to follow install instructions for alpha version but I … --- ## [Windows DNS Diagnostic Logs](https://discuss.elastic.co/t/windows-dns-diagnostic-logs/53344)
**Author:** [@Geezer](https://discuss.elastic.co/u/Geezer)\ **Replies:** 6\ **Last updated:** [June 21, 2016, 5:49pm UTC](https://discuss.elastic.co/t/windows-dns-diagnostic-logs/53344 "2016-06-21T17:49:22Z")
Hello I have enabled DNS Debug Logging on our domain controllers and am using Filebeat to ship these logs, but the problem is the logs do not contain the ip address returned by a DNS query. To get that level of logg… --- ## [Filebeat config error: YAML config parsing failed](https://discuss.elastic.co/t/filebeat-config-error-yaml-config-parsing-failed/53519)
**Author:** [@dal](https://discuss.elastic.co/u/dal)\ **Replies:** 6\ **Last updated:** [June 21, 2016, 5:29pm UTC](https://discuss.elastic.co/t/filebeat-config-error-yaml-config-parsing-failed/53519 "2016-06-21T17:29:27Z")
Below is my filebeat configuration file. I am trying to test my config file. The only changes I made were adding the paths to the log, commenting out elastic search output and outputting to logstash. The ... represents t… --- ## [Topbeat from Windows not sending logs to ELK stack](https://discuss.elastic.co/t/topbeat-from-windows-not-sending-logs-to-elk-stack/53281)
**Author:** [@iqbal\_nazir](https://discuss.elastic.co/u/iqbal_nazir)\ **Replies:** 10\ **Last updated:** [June 21, 2016, 3:42pm UTC](https://discuss.elastic.co/t/topbeat-from-windows-not-sending-logs-to-elk-stack/53281 "2016-06-21T15:42:40Z")
Hello, I have a working ELK stack running on Ubuntu 16.04. Filebeat and Topbeat from another Ubuntu client are successfully shipping logs to that ELK server. Even Winlogbeat is shipping events from a Windows machine. … --- ## [Filebeat is not reading updated logfile](https://discuss.elastic.co/t/filebeat-is-not-reading-updated-logfile/53379)
**Author:** [@andressa](https://discuss.elastic.co/u/andressa)\ **Replies:** 5\ **Last updated:** [June 21, 2016, 2:07pm UTC](https://discuss.elastic.co/t/filebeat-is-not-reading-updated-logfile/53379 "2016-06-21T14:07:45Z")
Hello, we are using ELK stack and we are trying to read a .log file and pass that log information to our elasticsearch so we can manipulate it on Kibana. To do that we decided to use Filebeat, but we encountered an incon… --- ## [Compilation dockerbeat](https://discuss.elastic.co/t/compilation-dockerbeat/43393)
**Author:** [@axil\_76](https://discuss.elastic.co/u/axil_76)\ **Replies:** 16\ **Last updated:** [June 21, 2016, 1:16pm UTC](https://discuss.elastic.co/t/compilation-dockerbeat/43393 "2016-06-21T13:16:19Z")
Hello, I have a client compilation problem dockerbeat make first make sure we have godep go get github.com/tools/godep /usr/bin/godep go build github.com/elastic/beats/libbeat/logp Godeps/\_workspace/src/github.com… --- ## [Filebeat Affecting Elasticsearch Dynamic Mapping](https://discuss.elastic.co/t/filebeat-affecting-elasticsearch-dynamic-mapping/53368)
**Author:** [@cb2015](https://discuss.elastic.co/u/cb2015)\ **Replies:** 2\ **Last updated:** [June 21, 2016, 11:22am UTC](https://discuss.elastic.co/t/filebeat-affecting-elasticsearch-dynamic-mapping/53368 "2016-06-21T11:22:46Z")
Hi Everyone, I am using filebeat to send logs to logstash for processing, and finally, sending them to elasticsearch for graphing in kibana. My question is: Does filebeat affect how elasticsearch makes a dynamic m… --- ## [Filebeat not connecting directly to Elasticsearch from particular machine](https://discuss.elastic.co/t/filebeat-not-connecting-directly-to-elasticsearch-from-particular-machine/51999)
**Author:** [@Michael1](https://discuss.elastic.co/u/Michael1)\ **Replies:** 23\ **Last updated:** [June 21, 2016, 11:09am UTC](https://discuss.elastic.co/t/filebeat-not-connecting-directly-to-elasticsearch-from-particular-machine/51999 "2016-06-21T11:09:18Z")
Beats: latest OS: Windows Server 2012 R2 Datacenter I am able to get other machines working fine but for some reason, I ran into issues with one particular machine. Here is the filebeat.yml ################### Fil… --- ## [Error creating sniffer on OS X - permission denied](https://discuss.elastic.co/t/error-creating-sniffer-on-os-x-permission-denied/32622)
**Author:** [@Prerna\_Manaktala](https://discuss.elastic.co/u/Prerna_Manaktala)\ **Replies:** 15\ **Last updated:** [June 21, 2016, 10:07am UTC](https://discuss.elastic.co/t/error-creating-sniffer-on-os-x-permission-denied/32622 "2016-06-21T10:07:34Z")
I am trying to run packetbeat on mac with packetbeat.yml configured to have mac settings and http port changes from default: # Select the network interfaces to sniff the data. You can use the "any" # keyword to sniff … --- ## [Packetbeat processing packets but not sending them to Elasticsearch](https://discuss.elastic.co/t/packetbeat-processing-packets-but-not-sending-them-to-elasticsearch/53333)
**Author:** [@apomerenk](https://discuss.elastic.co/u/apomerenk)\ **Replies:** 3\ **Last updated:** [June 20, 2016, 8:04pm UTC](https://discuss.elastic.co/t/packetbeat-processing-packets-but-not-sending-them-to-elasticsearch/53333 "2016-06-20T20:04:49Z")
I am using the ELK stack in an attempt to send a PCAP file down the pipeline to Kibana. I am running Packetbeat with './packetbeat -e -c packetbeat.yml -I test.pcap -d -t "publish". The PCAP file is 306 packets long, and… --- ## [Server 2008 R2 Access Denied for PIDs](https://discuss.elastic.co/t/server-2008-r2-access-denied-for-pids/53232)
**Author:** [@jezeling](https://discuss.elastic.co/u/jezeling)\ **Replies:** 6\ **Last updated:** [June 20, 2016, 2:57pm UTC](https://discuss.elastic.co/t/server-2008-r2-access-denied-for-pids/53232 "2016-06-20T14:57:27Z")
Hi, I've recently deployed topbeat to a single Windows 2008 R2 server and when running it starts without issue, however, I don't get any process information and no matter what admin logon as account I use, local or dom… --- ## [High CPU Usage - Windows](https://discuss.elastic.co/t/high-cpu-usage-windows/53141)
**Author:** [@Kryten](https://discuss.elastic.co/u/Kryten)\ **Replies:** 5\ **Last updated:** [June 20, 2016, 2:47pm UTC](https://discuss.elastic.co/t/high-cpu-usage-windows/53141 "2016-06-20T14:47:11Z")
Hi, I am trying to use Filebeat to extract lines which contain a particular string and send those lines to Elasticsearch (or Logstash). I'm now able to use either "include\_lines" or "exclude\_lines" to grab the relev… --- ## [Filebeat and bufferring](https://discuss.elastic.co/t/filebeat-and-bufferring/53225)
**Author:** [@sahas](https://discuss.elastic.co/u/sahas)\ **Replies:** 2\ **Last updated:** [June 20, 2016, 1:03pm UTC](https://discuss.elastic.co/t/filebeat-and-bufferring/53225 "2016-06-20T13:03:08Z")
Sorry, if its a naive question. Filebeat is configured to ship data to ES directly. Just incase ES is office and filebeat harvester found a log to ship, would it buffer, retry and ship? here is what I tried, my docker … --- ## [Field data loading is forbidden on \[message\]](https://discuss.elastic.co/t/field-data-loading-is-forbidden-on-message/53134)
**Author:** [@Kennedy\_Kan1](https://discuss.elastic.co/u/Kennedy_Kan1)\ **Replies:** 5\ **Last updated:** [June 20, 2016, 12:20pm UTC](https://discuss.elastic.co/t/field-data-loading-is-forbidden-on-message/53134 "2016-06-20T12:20:38Z")
I am using winlogbeat to monitor windows log event. However, when I tried to use message field to do some visulaization, it pops out the message as shown in the topic. Is there any ways to solve it. I am using winlogbe… --- ## [File beat monitor only recent log files](https://discuss.elastic.co/t/file-beat-monitor-only-recent-log-files/52306)
**Author:** [@JohnnyS](https://discuss.elastic.co/u/JohnnyS)\ **Replies:** 8\ **Last updated:** [June 20, 2016, 10:20am UTC](https://discuss.elastic.co/t/file-beat-monitor-only-recent-log-files/52306 "2016-06-20T10:20:45Z")
I'm new with filebeat and want to know if it is possible to only monitor the log file of the day? LSB Version: :base-4.0-amd64:base-4.0-noarch:core-4.0-amd64:core-4.0-noarch Distributor ID: RedHatEnterpriseServer De… --- ## [Can not make TLS/SSL connection to kafka v0,9 using filebeat v5](https://discuss.elastic.co/t/can-not-make-tls-ssl-connection-to-kafka-v0-9-using-filebeat-v5/53219)
**Author:** [@chengtaochen](https://discuss.elastic.co/u/chengtaochen)\ **Replies:** 1\ **Last updated:** [June 20, 2016, 9:31am UTC](https://discuss.elastic.co/t/can-not-make-tls-ssl-connection-to-kafka-v0-9-using-filebeat-v5/53219 "2016-06-20T09:31:54Z")
Hi: I am trying to figure out how to make TLS/SSL connection from filebeat v5. I have enabled TLS and client authentication on a Kafka v0.9 server, and configure filebeat with TLS enabled, but I am getting tons of T… --- ## ["Not resuming rotated file" and filebeat doesn't close rotated file](https://discuss.elastic.co/t/not-resuming-rotated-file-and-filebeat-doesnt-close-rotated-file/52923)
**Author:** [@roberto.alcini](https://discuss.elastic.co/u/roberto.alcini)\ **Replies:** 4\ **Last updated:** [June 20, 2016, 9:05am UTC](https://discuss.elastic.co/t/not-resuming-rotated-file-and-filebeat-doesnt-close-rotated-file/52923 "2016-06-20T09:05:59Z")
Hi, i'm using filebeat 1.2.3 and i do not understand a behavior on rotated files that lead my monitoring system to be unreliable from two point of view: events are not sent properly and rotated files are not closed pro… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=573) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=575)