# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=576 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 577 --- ## [How to configure using this force panel?](https://discuss.elastic.co/t/how-to-configure-using-this-force-panel/52528)
**Author:** [@zhaoxiaole](https://discuss.elastic.co/u/zhaoxiaole)\ **Replies:** 4\ **Last updated:** [June 15, 2016, 6:09am UTC](https://discuss.elastic.co/t/how-to-configure-using-this-force-panel/52528 "2016-06-15T06:09:33Z")
I have a question about your advice. I'm using packetbeat-1.0.0 + elasticsearch-1.3.9 + kibana-3.1.2-packetbeat, I want to draw the network topology, but do not know how to configure, and how to achieve the configuration… --- ## [Filebeat v5.0.0.0 availability](https://discuss.elastic.co/t/filebeat-v5-0-0-0-availability/52786)
**Author:** [@chengtaochen](https://discuss.elastic.co/u/chengtaochen)\ **Replies:** 1\ **Last updated:** [June 15, 2016, 3:01am UTC](https://discuss.elastic.co/t/filebeat-v5-0-0-0-availability/52786 "2016-06-15T03:01:18Z")
I was just wondering when is the official GA date for Filebeat V5.0.0.0? I am particularly interested in to know its support for Kafka output in v5.0.0.0 --- ## [Include\_lines problem](https://discuss.elastic.co/t/include-lines-problem/52723)
**Author:** [@Kryten](https://discuss.elastic.co/u/Kryten)\ **Replies:** 7\ **Last updated:** [June 14, 2016, 7:34pm UTC](https://discuss.elastic.co/t/include-lines-problem/52723 "2016-06-14T19:34:53Z")
Hi, I am trying to configure Filebeats to only process lines from my logs which match a couple of regexes. Nothing too complicated. I set it up like this: include\_lines: \[".\*returned\\sthe\\sstatus.\*",".\*information\\sf… --- ## [From logstash-forwarder to filebeat, how can use tags?](https://discuss.elastic.co/t/from-logstash-forwarder-to-filebeat-how-can-use-tags/52730)
**Author:** [@stefanocog](https://discuss.elastic.co/u/stefanocog)\ **Replies:** 1\ **Last updated:** [June 14, 2016, 3:09pm UTC](https://discuss.elastic.co/t/from-logstash-forwarder-to-filebeat-how-can-use-tags/52730 "2016-06-14T15:09:32Z")
Hi, i have converted my old configuration for logstash-forwarder to filebeat, in this way: filebeat: prospectors: - paths: - /var/log/httpd/access\_log input\_type: log document\_type: apache … --- ## [Protocol for ISO messages](https://discuss.elastic.co/t/protocol-for-iso-messages/52685)
**Author:** [@Julian\_3](https://discuss.elastic.co/u/Julian_3)\ **Replies:** 3\ **Last updated:** [June 14, 2016, 1:11pm UTC](https://discuss.elastic.co/t/protocol-for-iso-messages/52685 "2016-06-14T13:11:42Z")
has anyone started work on an a parser for ISO messages, more specifically ISO8583 ? im interested to use packetBeat for realtime transaction statistics and monitoring, just didn't want to re-invent the wheel if its alre… --- ## [Filebeat load balancing failing because of ssl certificate](https://discuss.elastic.co/t/filebeat-load-balancing-failing-because-of-ssl-certificate/52500)
**Author:** [@Sai\_Birada](https://discuss.elastic.co/u/Sai_Birada)\ **Replies:** 9\ **Last updated:** [June 14, 2016, 11:49am UTC](https://discuss.elastic.co/t/filebeat-load-balancing-failing-because-of-ssl-certificate/52500 "2016-06-14T11:49:04Z")
I set up SSL for filebeat and logstash connections following this link. https://www.digitalocean.com/community/tutorials/how-to-install-elasticsearch-logstash-and-kibana-elk-stack-on-ubuntu-14-04. Here i am creating a… --- ## [Need help with setting up "Multiple prospectors" in filebeat](https://discuss.elastic.co/t/need-help-with-setting-up-multiple-prospectors-in-filebeat/52315)
**Author:** [@mjadhav](https://discuss.elastic.co/u/mjadhav)\ **Replies:** 11\ **Last updated:** [June 14, 2016, 10:43am UTC](https://discuss.elastic.co/t/need-help-with-setting-up-multiple-prospectors-in-filebeat/52315 "2016-06-14T10:43:09Z")
Hello Folks, I have a requirement to parse different type of log files (own Java application's log file) and catalina log files. Both of these have a different type of logging system, for which I have to use differen… --- ## [Problem multiline logs](https://discuss.elastic.co/t/problem-multiline-logs/52412)
**Author:** [@yde](https://discuss.elastic.co/u/yde)\ **Replies:** 5\ **Last updated:** [June 13, 2016, 2:56pm UTC](https://discuss.elastic.co/t/problem-multiline-logs/52412 "2016-06-13T14:56:13Z")
Hello everybody, I am trying to send to logstack some lines from an event generate in my log file, I don't know how to do that. Below is an exemple of the event which is generate in my log, what i am trying to send t… --- ## [Memcached error saturate the syslog](https://discuss.elastic.co/t/memcached-error-saturate-the-syslog/52487)
**Author:** [@dfaropennetwork](https://discuss.elastic.co/u/dfaropennetwork)\ **Replies:** 2\ **Last updated:** [June 14, 2016, 5:53am UTC](https://discuss.elastic.co/t/memcached-error-saturate-the-syslog/52487 "2016-06-14T05:53:55Z")
Hi eveyone, I need some help, i'm experimenting problems with packetbeat, i've the following error: Jun 11 03:16:43 nombrehost /usr/bin/packetbeat\[29569\]: log.go:114: Stacktrace: /go/src/github.com/elastic/beats/libb… --- ## [Creating client location data for packetbeat](https://discuss.elastic.co/t/creating-client-location-data-for-packetbeat/52551)
**Author:** [@Kennedy\_Kan1](https://discuss.elastic.co/u/Kennedy_Kan1)\ **Replies:** 3\ **Last updated:** [June 13, 2016, 10:11pm UTC](https://discuss.elastic.co/t/creating-client-location-data-for-packetbeat/52551 "2016-06-13T22:11:32Z")
I have been using packetbeat to collect network transfer packets data, however, I discover that there is a client location field, however, seems that there isn't any data coming out from that. Is there anyway that I can … --- ## [Topbeats and Physical volume](https://discuss.elastic.co/t/topbeats-and-physical-volume/51731)
**Author:** [@daguero](https://discuss.elastic.co/u/daguero)\ **Replies:** 4\ **Last updated:** [June 13, 2016, 9:44pm UTC](https://discuss.elastic.co/t/topbeats-and-physical-volume/51731 "2016-06-13T21:44:08Z")
I have ELK with: 1. Elasticsearch 2.1 2. Logstash 2.3 3. Kibana 4.3 I have too a virtual machine with topbeats1.2.3 and many disk partitions. This agent is setting to send only Filesystem information (filesystem: true)… --- ## [Some packets are not getting captured on heavy load](https://discuss.elastic.co/t/some-packets-are-not-getting-captured-on-heavy-load/52448)
**Author:** [@harshafrnd4u](https://discuss.elastic.co/u/harshafrnd4u)\ **Replies:** 3\ **Last updated:** [June 13, 2016, 5:20pm UTC](https://discuss.elastic.co/t/some-packets-are-not-getting-captured-on-heavy-load/52448 "2016-06-13T17:20:45Z")
I am load testing packetbeat with 2 nginx servers at load of 2000 requests per second per server. And I see that only half were getting captured. When I tried with logging I can see these plenty of similar warning logs … --- ## [Filebeat panics on CentOS 7.2 when stdin is defined as an input](https://discuss.elastic.co/t/filebeat-panics-on-centos-7-2-when-stdin-is-defined-as-an-input/52450)
**Author:** [@gaahrdner](https://discuss.elastic.co/u/gaahrdner)\ **Replies:** 3\ **Last updated:** [June 13, 2016, 5:06pm UTC](https://discuss.elastic.co/t/filebeat-panics-on-centos-7-2-when-stdin-is-defined-as-an-input/52450 "2016-06-13T17:06:59Z")
I can't seem to get stdin working as an input for filebeat when it's running as service under systemd. \[root@x.x.x.x log\]# hostnamectl Static hostname:xxxx Transient hostname:xxxx Icon name: computer-vm … --- ## [Writing fields.yml](https://discuss.elastic.co/t/writing-fields-yml/44336)
**Author:** [@rvlander](https://discuss.elastic.co/u/rvlander)\ **Replies:** 11\ **Last updated:** [June 13, 2016, 4:41pm UTC](https://discuss.elastic.co/t/writing-fields-yml/44336 "2016-06-13T16:41:20Z")
Is there a documentation on how to write fields.yml when writing a new beat? Especially some Elastic types seem to be ignored when generating index template. Also how do you describe arrays? Thanks, --- ## [Topbeat / top command line discrepancies](https://discuss.elastic.co/t/topbeat-top-command-line-discrepancies/52241)
**Author:** [@vchav73](https://discuss.elastic.co/u/vchav73)\ **Replies:** 6\ **Last updated:** [June 13, 2016, 3:12pm UTC](https://discuss.elastic.co/t/topbeat-top-command-line-discrepancies/52241 "2016-06-13T15:12:07Z")
I am using Topbeat with ELK to monitor CentOS 6.8 server performance. I am trying to recreate the % idle value reported from the top command: Cpu(s): 2.7%us, 1.0%sy, 2.8%ni, 90.5%id, 2.5%wa, 0.0%hi, 0.2%si, 0.3%… --- ## [Beats : Error decoding JSON: json: cannot unmarshal array](https://discuss.elastic.co/t/beats-error-decoding-json-json-cannot-unmarshal-array/52545)
**Author:** [@sahas](https://discuss.elastic.co/u/sahas)\ **Replies:** 3\ **Last updated:** [June 13, 2016, 11:43am UTC](https://discuss.elastic.co/t/beats-error-decoding-json-json-cannot-unmarshal-array/52545 "2016-06-13T11:43:30Z")
I'm trying out the latest beta (filebeat-5.0.0-alpha3-darwin-x64). Its working as expected for simple .json object. However, getting below error when I try to ship an array \[{"name":"first","count":100},{"name":"second",… --- ## [Filebeat is not sending complete logs](https://discuss.elastic.co/t/filebeat-is-not-sending-complete-logs/52219)
**Author:** [@sinwar](https://discuss.elastic.co/u/sinwar)\ **Replies:** 4\ **Last updated:** [June 13, 2016, 7:08am UTC](https://discuss.elastic.co/t/filebeat-is-not-sending-complete-logs/52219 "2016-06-13T07:08:30Z")
I am using docker elk for logs and forwarding logs using filebeat but some logs were sent or some not? my filebeat.yml -\> https://ghostbin.com/paste/rrjeh filebeat logs in debug mode -\> https://ghostbin.com/paste/fm2… --- ## [Filebeat Not harvesting, file didn't change - do not use modification time](https://discuss.elastic.co/t/filebeat-not-harvesting-file-didnt-change-do-not-use-modification-time/49834)
**Author:** [@wmcdonald](https://discuss.elastic.co/u/wmcdonald)\ **Replies:** 10\ **Last updated:** [June 13, 2016, 6:57am UTC](https://discuss.elastic.co/t/filebeat-not-harvesting-file-didnt-change-do-not-use-modification-time/49834 "2016-06-13T06:57:59Z")
My understanding is that filebeat will look at the modification timestamp provided by the OS to determine if the file has been modified and then the harvester will try and read from where it left off, correct? There is… --- ## [Metricbeat - Can't graph network I/O](https://discuss.elastic.co/t/metricbeat-cant-graph-network-i-o/52387)
**Author:** [@ceekay](https://discuss.elastic.co/u/ceekay)\ **Replies:** 2\ **Last updated:** [June 13, 2016, 2:47am UTC](https://discuss.elastic.co/t/metricbeat-cant-graph-network-i-o/52387 "2016-06-13T02:47:18Z")
Hi there, I'm not sure what to do with the network stats from metricbeat. As it's an incrementing byte counter there's no way I can see to graph this sensibly in Kibana4 - as far as I know there is no derivative graph … --- ## [Problems with parsing multiline](https://discuss.elastic.co/t/problems-with-parsing-multiline/52176)
**Author:** [@SergeyParamoshkin](https://discuss.elastic.co/u/SergeyParamoshkin)\ **Replies:** 2\ **Last updated:** [June 12, 2016, 11:16am UTC](https://discuss.elastic.co/t/problems-with-parsing-multiline/52176 "2016-06-12T11:16:35Z")
Hi. I have a problem, I use a multiline parsing with this configuration. multiline: pattern: ^\\\[ negate: true match: after INFO 2016-06-08 10:11:08,241 Controller.py:265 - Heartbeat response… --- ## [Dynamic configuration for filebeat?](https://discuss.elastic.co/t/dynamic-configuration-for-filebeat/52480)
**Author:** [@matanster](https://discuss.elastic.co/u/matanster)\ **Replies:** 1\ **Last updated:** [June 11, 2016, 12:40am UTC](https://discuss.elastic.co/t/dynamic-configuration-for-filebeat/52480 "2016-06-11T00:40:13Z")
I wonder what am I doing wrong as per http://stackoverflow.com/questions/37756864/how-to-make-filebeat-pick-up-project-specific-configuration-file? as it is a dev box, I would find it more practical dynamically controlli… --- ## [Filebeat -\> Kafka How to best define list of hosts (IPs vs DNS vs Zookeeper)](https://discuss.elastic.co/t/filebeat-kafka-how-to-best-define-list-of-hosts-ips-vs-dns-vs-zookeeper/51492)
**Author:** [@Jaren](https://discuss.elastic.co/u/Jaren)\ **Replies:** 4\ **Last updated:** [June 11, 2016, 12:31am UTC](https://discuss.elastic.co/t/filebeat-kafka-how-to-best-define-list-of-hosts-ips-vs-dns-vs-zookeeper/51492 "2016-06-11T00:31:18Z")
After a quick look into the open issues, it doesn't look like there is any direction of having Filebeat talk directly to Zookeeper instead of listing all IPs to the cluster. (Since Zookeeper is the source of truth for ho… --- ## [Lots of Beats input: The circuit breaker has detected a slowdown or stall in the pipeline](https://discuss.elastic.co/t/lots-of-beats-input-the-circuit-breaker-has-detected-a-slowdown-or-stall-in-the-pipeline/52310)
**Author:** [@MikeC](https://discuss.elastic.co/u/MikeC)\ **Replies:** 5\ **Last updated:** [June 10, 2016, 11:06am UTC](https://discuss.elastic.co/t/lots-of-beats-input-the-circuit-breaker-has-detected-a-slowdown-or-stall-in-the-pipeline/52310 "2016-06-10T11:06:56Z")
Hi, my setup is filebeat -\> logstash(localhost) -\> elasticsearch (remote host) and im expiriencing a lot of missing packages from filebeat. The filebeat logs report back 2016-06-09T10:34:00+01:00 INFO backoff retry:… --- ## [Safely publish an event using libbeat](https://discuss.elastic.co/t/safely-publish-an-event-using-libbeat/52395)
**Author:** [@lukejolly](https://discuss.elastic.co/u/lukejolly)\ **Replies:** 2\ **Last updated:** [June 10, 2016, 10:52am UTC](https://discuss.elastic.co/t/safely-publish-an-event-using-libbeat/52395 "2016-06-10T10:52:51Z")
So I'm at a loss on how to go about publishing an event and being sure it was a success. If I use publisher.Client.PublishEvent(m, publisher.Sync) and the output (in my test case logstash) isn't up, it blocks forever i… --- ## [Filebeat, Logstash, Elasticsearch robustness and duplicated documents](https://discuss.elastic.co/t/filebeat-logstash-elasticsearch-robustness-and-duplicated-documents/42711)
**Author:** [@mr\_caos](https://discuss.elastic.co/u/mr_caos)\ **Replies:** 10\ **Last updated:** [June 10, 2016, 10:20am UTC](https://discuss.elastic.co/t/filebeat-logstash-elasticsearch-robustness-and-duplicated-documents/42711 "2016-06-10T10:20:39Z")
For logging in AWS EC2, I'm testing the robustness of the chain Filebeat, Logstash, Elasticsearch. I have one AMI with an appplication + Filebeat, one with Logstash and one with Elastisearch + Kibana. With the applicatio… --- ## [Beats behaviour](https://discuss.elastic.co/t/beats-behaviour/51875)
**Author:** [@Igor\_Dementyeff](https://discuss.elastic.co/u/Igor_Dementyeff)\ **Replies:** 10\ **Last updated:** [June 10, 2016, 10:18am UTC](https://discuss.elastic.co/t/beats-behaviour/51875 "2016-06-10T10:18:58Z")
Hello all. I got a very strange problem with the Kibana and I honestly don't know where to search... So the overview is this: Kibana server with topbeat, packetbeat and filebeat running Once in a day, or 2 days, filebeat… --- ## [Will filebeat lock files?](https://discuss.elastic.co/t/will-filebeat-lock-files/52190)
**Author:** [@zpp](https://discuss.elastic.co/u/zpp)\ **Replies:** 6\ **Last updated:** [June 10, 2016, 7:59am UTC](https://discuss.elastic.co/t/will-filebeat-lock-files/52190 "2016-06-10T07:59:51Z")
Hi, I met a situation where it seemed that filebeat locked the application logs. The application generates log file like appx.log, after some time or certain size is hit, it will rename the existing appx.log to appx\_ba… --- ## [Exclude a log line that matches an exclude\_line](https://discuss.elastic.co/t/exclude-a-log-line-that-matches-an-exclude-line/52349)
**Author:** [@Zfs](https://discuss.elastic.co/u/Zfs)\ **Replies:** 1\ **Last updated:** [June 10, 2016, 6:23am UTC](https://discuss.elastic.co/t/exclude-a-log-line-that-matches-an-exclude-line/52349 "2016-06-10T06:23:57Z")
I have a more complex use case for include and exlude lines. I'd like to log all lines not matched by exclude\_lines but also have the ability to over ride an exclude\_line. Example: exclude\_lines: \["^\[0-9\]\\/\[0-9\]\\/\[… --- ## [Beats Forwarder](https://discuss.elastic.co/t/beats-forwarder/52248)
**Author:** [@maltman](https://discuss.elastic.co/u/maltman)\ **Replies:** 2\ **Last updated:** [June 9, 2016, 2:22pm UTC](https://discuss.elastic.co/t/beats-forwarder/52248 "2016-06-09T14:22:18Z")
Hi all, I am new to beats and cannot figure out how to forward Winlogbeats data from multiple servers to my master server. The master is running Elastic, Kibana, and Winlogbeats I have installed Winlogbeats on anoth… --- ## [Filebeat on Windows 2012 R2, Error Sending logs to Logstash](https://discuss.elastic.co/t/filebeat-on-windows-2012-r2-error-sending-logs-to-logstash/52025)
**Author:** [@smitjainsj](https://discuss.elastic.co/u/smitjainsj)\ **Replies:** 8\ **Last updated:** [June 9, 2016, 2:13pm UTC](https://discuss.elastic.co/t/filebeat-on-windows-2012-r2-error-sending-logs-to-logstash/52025 "2016-06-09T14:13:38Z")
Team, I am using Filebeat \> Logstash \> Elasticsearch \> Kibana to parse and analyse logs basically Java Stack Trace and other Tomcat Logs. Here is YML for Filebeat filebeat: prospectors: - p… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=575) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=577)