# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=577 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 578 --- ## [Parsing python traceback in multiline mode](https://discuss.elastic.co/t/parsing-python-traceback-in-multiline-mode/52291)
**Author:** [@SergeyParamoshkin](https://discuss.elastic.co/u/SergeyParamoshkin)\ **Replies:** 2\ **Last updated:** [June 9, 2016, 2:06pm UTC](https://discuss.elastic.co/t/parsing-python-traceback-in-multiline-mode/52291 "2016-06-09T14:06:13Z")
Hi, maybe someone had a problem parsing the logs, where there is a python stacktrace. What should be the regex pattern filebeat configuration: multiline: pattern: ^\\\[ negate: false match:… --- ## [Add\_tag upon max\_lines reached in multiline](https://discuss.elastic.co/t/add-tag-upon-max-lines-reached-in-multiline/52254)
**Author:** [@whyapenny](https://discuss.elastic.co/u/whyapenny)\ **Replies:** 2\ **Last updated:** [June 9, 2016, 1:59pm UTC](https://discuss.elastic.co/t/add-tag-upon-max-lines-reached-in-multiline/52254 "2016-06-09T13:59:52Z")
So I am processing xml using filebeat. If an entry is longer than the allowed max\_lines, the xml is incomplete, and thus invalid xml. Therefore the xml parser filter fails on these records. I was hoping to add a tag t… --- ## [Filebeat Startup (version 1.2)](https://discuss.elastic.co/t/filebeat-startup-version-1-2/52216)
**Author:** [@Atul\_Patel](https://discuss.elastic.co/u/Atul_Patel)\ **Replies:** 1\ **Last updated:** [June 9, 2016, 10:32am UTC](https://discuss.elastic.co/t/filebeat-startup-version-1-2/52216 "2016-06-09T10:32:46Z")
Hi all, we are using version 1.2.while starting the filebeat using sudo service filebeat start|stop|restart from the command it is saying OK but when i greap for ps-ef | grep filebeat the process is not started. Pls … --- ## [Topbeat - Detailed flowchart or documentation on how it works](https://discuss.elastic.co/t/topbeat-detailed-flowchart-or-documentation-on-how-it-works/51924)
**Author:** [@talk2cshah](https://discuss.elastic.co/u/talk2cshah)\ **Replies:** 4\ **Last updated:** [June 9, 2016, 7:23am UTC](https://discuss.elastic.co/t/topbeat-detailed-flowchart-or-documentation-on-how-it-works/51924 "2016-06-09T07:23:58Z")
Dear Team, May I request you to let me know if there is a link to a detailed documentation on Topbeat addresssing below queries.. How it works? if process , system , file is all enabled? do the records for each sent … --- ## [Filbeat integrating with redis](https://discuss.elastic.co/t/filbeat-integrating-with-redis/51590)
**Author:** [@Atul\_Patel](https://discuss.elastic.co/u/Atul_Patel)\ **Replies:** 6\ **Last updated:** [June 8, 2016, 1:00pm UTC](https://discuss.elastic.co/t/filbeat-integrating-with-redis/51590 "2016-06-08T13:00:32Z")
Hi All, We are working with filebeat integrating with redis cache. When i start the filebeat it is not at all starting. after i issued the yml file with -configtest it is hanged.How to see whether it is sucess or f… --- ## [Filebeat host ip address in Logstash](https://discuss.elastic.co/t/filebeat-host-ip-address-in-logstash/37655)
**Author:** [@sqshq](https://discuss.elastic.co/u/sqshq)\ **Replies:** 5\ **Last updated:** [June 8, 2016, 11:28am UTC](https://discuss.elastic.co/t/filebeat-host-ip-address-in-logstash/37655 "2016-06-08T11:28:51Z")
Hello, I've configured Filebeat on application host and ELK stack on another. Everything working good, but i have just beat.hostname and beat.name fileds in Logstash. Is there a way to retrieve IP address of my appli… --- ## [Pb of increase memmory with Filebeat agent](https://discuss.elastic.co/t/pb-of-increase-memmory-with-filebeat-agent/52173)
**Author:** [@SDO](https://discuss.elastic.co/u/SDO)\ **Replies:** 1\ **Last updated:** [June 8, 2016, 10:41am UTC](https://discuss.elastic.co/t/pb-of-increase-memmory-with-filebeat-agent/52173 "2016-06-08T10:41:25Z")
Hello everyone, I installed a filebeat agent on a Windows server 2012 in service mode. The objective is to examine several directories and when a XML File comes into one of these directories, the filebeat agent sends… --- ## [Mapper parsing exception periods in field name](https://discuss.elastic.co/t/mapper-parsing-exception-periods-in-field-name/51811)
**Author:** [@mikesparr](https://discuss.elastic.co/u/mikesparr)\ **Replies:** 5\ **Last updated:** [June 8, 2016, 7:07am UTC](https://discuss.elastic.co/t/mapper-parsing-exception-periods-in-field-name/51811 "2016-06-08T07:07:05Z")
I have the latest version of packetbeat running and sending beats to Kafka. I then consume topics with Logstash and index in Elasticsearch 2.3.x I keep seeing in the logs the mapper\_parsing\_exception warning and since … --- ## [Metricbeat Nginx Plus metric set](https://discuss.elastic.co/t/metricbeat-nginx-plus-metric-set/52143)
**Author:** [@mrkschan](https://discuss.elastic.co/u/mrkschan)\ **Replies:** 1\ **Last updated:** [June 8, 2016, 6:48am UTC](https://discuss.elastic.co/t/metricbeat-nginx-plus-metric-set/52143 "2016-06-08T06:48:37Z")
Going to port the Nginx plus metrics from Nginxbeat to Metricbeat, I wonder if we need to split the nested metrics (see https://github.com/mrkschan/nginxbeat/#exported-fields) in Metricbeat as well. Does Kibnana support … --- ## [Filebeat-god process does not create filebeat registry file as mentioned in the filebeat.yml config](https://discuss.elastic.co/t/filebeat-god-process-does-not-create-filebeat-registry-file-as-mentioned-in-the-filebeat-yml-config/51730)
**Author:** [@kasi](https://discuss.elastic.co/u/kasi)\ **Replies:** 5\ **Last updated:** [June 7, 2016, 9:00am UTC](https://discuss.elastic.co/t/filebeat-god-process-does-not-create-filebeat-registry-file-as-mentioned-in-the-filebeat-yml-config/51730 "2016-06-07T09:00:41Z")
I have specified the registry file as registry\_file: .filebeat-registry and I have multiple file beat instances and i want to have individual file beat registry for each of my file beat instances, this is the command I … --- ## [Filebeat excluding lines](https://discuss.elastic.co/t/filebeat-excluding-lines/51925)
**Author:** [@Uros\_Meglic](https://discuss.elastic.co/u/Uros_Meglic)\ **Replies:** 2\ **Last updated:** [June 7, 2016, 6:15am UTC](https://discuss.elastic.co/t/filebeat-excluding-lines/51925 "2016-06-07T06:15:33Z")
Hello, what would be correct setting for "exclude\_lines". I would like to exclude every line that begins with "#". Currently I'm using "exclude\_lines: \["^#"\]". Is this ok? Thank you and kind regards, Uros --- ## [Beats Overhead Topbeat and Packetbeat](https://discuss.elastic.co/t/beats-overhead-topbeat-and-packetbeat/51903)
**Author:** [@talk2cshah](https://discuss.elastic.co/u/talk2cshah)\ **Replies:** 2\ **Last updated:** [June 7, 2016, 3:52am UTC](https://discuss.elastic.co/t/beats-overhead-topbeat-and-packetbeat/51903 "2016-06-07T03:52:00Z")
Dear Team, May I request you to help me understand what is the resource overhead of deploying topbeat and packetbeat with respect to default configurations.. impact on Storage space CPU utilization Memory utilizatio… --- ## [Is Filebeat ready for production](https://discuss.elastic.co/t/is-filebeat-ready-for-production/51962)
**Author:** [@xfournet](https://discuss.elastic.co/u/xfournet)\ **Replies:** 2\ **Last updated:** [June 6, 2016, 10:03pm UTC](https://discuss.elastic.co/t/is-filebeat-ready-for-production/51962 "2016-06-06T22:03:40Z")
Hi, we have designed a solution based on Filebeat. But one of your customer is insisting on using Logstash Forwarder instead of Filebeat because some ELK consultants told them to wait on Filebeat (until end of 2016) be… --- ## [Backoff is not reset correctly after a correct ack is sent](https://discuss.elastic.co/t/backoff-is-not-reset-correctly-after-a-correct-ack-is-sent/51816)
**Author:** [@adioss](https://discuss.elastic.co/u/adioss)\ **Replies:** 4\ **Last updated:** [June 6, 2016, 6:47pm UTC](https://discuss.elastic.co/t/backoff-is-not-reset-correctly-after-a-correct-ack-is-sent/51816 "2016-06-06T18:47:31Z")
Hello! Using Filebeat v1.2.3: In case of error (no correct ACK received), filebeat retries to send the frame but before, the process is stopped during a computed duration: backoff (that is exponential until 1min) . Bu… --- ## [How to configure filebeat to use a particular cipher suite](https://discuss.elastic.co/t/how-to-configure-filebeat-to-use-a-particular-cipher-suite/51790)
**Author:** [@Sai\_Birada](https://discuss.elastic.co/u/Sai_Birada)\ **Replies:** 2\ **Last updated:** [June 6, 2016, 2:26pm UTC](https://discuss.elastic.co/t/how-to-configure-filebeat-to-use-a-particular-cipher-suite/51790 "2016-06-06T14:26:35Z")
I want filebeat to send logs over tls using AES256-SHA cipher, I found cipher\_suites option in tls options page of filebeat configuration. But when i used it, I am getting the following error Exiting: error loading conf… --- ## [Beats input: the pipeline is blocked, temporary refusing new connection.",reconnect\_backoff\_sleep=\>0.5](https://discuss.elastic.co/t/beats-input-the-pipeline-is-blocked-temporary-refusing-new-connection-reconnect-backoff-sleep-0-5/43655)
**Author:** [@aryaray](https://discuss.elastic.co/u/aryaray)\ **Replies:** 5\ **Last updated:** [June 6, 2016, 2:13pm UTC](https://discuss.elastic.co/t/beats-input-the-pipeline-is-blocked-temporary-refusing-new-connection-reconnect-backoff-sleep-0-5/43655 "2016-06-06T14:13:45Z")
Hi , We Setup ELK stack it's running fine 2 days before. But now We facing that logs are coming delayed . We check logstash log for identify issue. There we getting that Beats input: The circuit breaker has detected … --- ## [How can I get data from Filebeat to Flume?](https://discuss.elastic.co/t/how-can-i-get-data-from-filebeat-to-flume/51734)
**Author:** [@ElastiCrank](https://discuss.elastic.co/u/ElastiCrank)\ **Replies:** 2\ **Last updated:** [June 6, 2016, 12:25pm UTC](https://discuss.elastic.co/t/how-can-i-get-data-from-filebeat-to-flume/51734 "2016-06-06T12:25:14Z")
I can't see a simple way to get data from Filebeat into Flume. Any ideas? Maybe due to Filebeat's youth, there just aren't very many generic ways (HTTP, TCP) to get data out of Filebeat? Filebeat looks like a rare co… --- ## [Packetbeat 5.0.0 alpha3 issues](https://discuss.elastic.co/t/packetbeat-5-0-0-alpha3-issues/51923)
**Author:** [@zozo6015](https://discuss.elastic.co/u/zozo6015)\ **Replies:** 1\ **Last updated:** [June 6, 2016, 10:38am UTC](https://discuss.elastic.co/t/packetbeat-5-0-0-alpha3-issues/51923 "2016-06-06T10:38:58Z")
Hello, When I restart the elasticsearch for various reasons the packetbeats is not trying to reconnect. Regards, Peter --- ## [How to collect logs from web browser?](https://discuss.elastic.co/t/how-to-collect-logs-from-web-browser/51585)
**Author:** [@kumarhanu](https://discuss.elastic.co/u/kumarhanu)\ **Replies:** 5\ **Last updated:** [June 6, 2016, 10:03am UTC](https://discuss.elastic.co/t/how-to-collect-logs-from-web-browser/51585 "2016-06-06T10:03:29Z")
Is there any beats or any agent to collect logs generated by web application from web browser and feed into elastic search? Appreciate any help in this regard. --- ## [Filebeat CPU high](https://discuss.elastic.co/t/filebeat-cpu-high/51152)
**Author:** [@Atul\_Patel](https://discuss.elastic.co/u/Atul_Patel)\ **Replies:** 10\ **Last updated:** [June 6, 2016, 10:00am UTC](https://discuss.elastic.co/t/filebeat-cpu-high/51152 "2016-06-06T10:00:55Z")
HI We are using Filebeat to collect the logs from various folders.Example.A service is calling A1,A2 and A3. All the logs are written in their respective folders.Filbeat is pushing the logs to logstash.In the logstash … --- ## [Filebeat logstash output loadbalance not working properly (not random)](https://discuss.elastic.co/t/filebeat-logstash-output-loadbalance-not-working-properly-not-random/51541)
**Author:** [@XavierGattuso](https://discuss.elastic.co/u/XavierGattuso)\ **Replies:** 3\ **Last updated:** [June 6, 2016, 7:21am UTC](https://discuss.elastic.co/t/filebeat-logstash-output-loadbalance-not-working-properly-not-random/51541 "2016-06-06T07:21:55Z")
Hello, I'm currently using filebeat 1.2.3, on Debian Jessie and unless I do not understand properly the documentation about the use of a host list and loadbalance: false in the logstash output, it seems not working as… --- ## [Amazon Elasticsearch Service without port](https://discuss.elastic.co/t/amazon-elasticsearch-service-without-port/51845)
**Author:** [@shantanuo](https://discuss.elastic.co/u/shantanuo)\ **Replies:** 1\ **Last updated:** [June 5, 2016, 5:24pm UTC](https://discuss.elastic.co/t/amazon-elasticsearch-service-without-port/51845 "2016-06-05T17:24:40Z")
packetbeat configuration file adds the port 9200 to the URL. But Amazon Elasticsearch service does not use that port. In fact there is no port but https needs to be used. How do I configure packetbeat.yml file to connect… --- ## [Packetbeat-DNS index and template correction](https://discuss.elastic.co/t/packetbeat-dns-index-and-template-correction/51599)
**Author:** [@Hans](https://discuss.elastic.co/u/Hans)\ **Replies:** 6\ **Last updated:** [June 4, 2016, 4:04pm UTC](https://discuss.elastic.co/t/packetbeat-dns-index-and-template-correction/51599 "2016-06-04T16:04:07Z")
HI all, I am struggling to get the correct information into Elasticsearch. I am using BIND DNS server running Packetbeats direct output to logstash, thereafter to elasticsearch and Kibana. The two fields that are causing… --- ## [Shipping logs from multiple files](https://discuss.elastic.co/t/shipping-logs-from-multiple-files/48881)
**Author:** [@thyfere](https://discuss.elastic.co/u/thyfere)\ **Replies:** 23\ **Last updated:** [June 3, 2016, 3:28pm UTC](https://discuss.elastic.co/t/shipping-logs-from-multiple-files/48881 "2016-06-03T15:28:43Z")
Hi, I am using ELK stack on Windows box and configuring filebeat to ship logs from a computer's folder where logs have been generated everyday on a new file. How can I configure .yml conf to ship these logs to Elastics… --- ## [How do large organizations manage beats deployment?](https://discuss.elastic.co/t/how-do-large-organizations-manage-beats-deployment/51044)
**Author:** [@fetchmelogs](https://discuss.elastic.co/u/fetchmelogs)\ **Replies:** 3\ **Last updated:** [June 3, 2016, 12:35pm UTC](https://discuss.elastic.co/t/how-do-large-organizations-manage-beats-deployment/51044 "2016-06-03T12:35:11Z")
Suppose I had to deploy Winlogbeat to 100 Windows servers and 1000 Windows workstations ; what is the best way to proceed with deploying winlogbeat to all these end-points? Suppose I had to make a change to the config… --- ## [Adding file descriptor metrics to topbeat and gosigar](https://discuss.elastic.co/t/adding-file-descriptor-metrics-to-topbeat-and-gosigar/50997)
**Author:** [@lukejolly](https://discuss.elastic.co/u/lukejolly)\ **Replies:** 7\ **Last updated:** [June 3, 2016, 7:16am UTC](https://discuss.elastic.co/t/adding-file-descriptor-metrics-to-topbeat-and-gosigar/50997 "2016-06-03T07:16:56Z")
I really like the metrics topbeat grabs per process but I feel it is missing a two key metric which is the file descriptor limit for the process and the amount currently used by it. Along with CPU and Memory resource I … --- ## [Windows Eventlogs are not recieved at Elasticsearch via Filebeat](https://discuss.elastic.co/t/windows-eventlogs-are-not-recieved-at-elasticsearch-via-filebeat/51672)
**Author:** [@HasanJamal](https://discuss.elastic.co/u/HasanJamal)\ **Replies:** 3\ **Last updated:** [June 3, 2016, 6:18am UTC](https://discuss.elastic.co/t/windows-eventlogs-are-not-recieved-at-elasticsearch-via-filebeat/51672 "2016-06-03T06:18:57Z")
I have setup filebeat at my client machine Windows 8.1 to send Windows Event logs to Elasticsearch for analysis in Kibana The configuration of filebeat.yml is seemed to be OK but I an not receiving any logs at elastic… --- ## [It doesn't seem to be doing anything](https://discuss.elastic.co/t/it-doesnt-seem-to-be-doing-anything/51722)
**Author:** [@BanksySan](https://discuss.elastic.co/u/BanksySan)\ **Replies:** 1\ **Last updated:** [June 2, 2016, 9:46pm UTC](https://discuss.elastic.co/t/it-doesnt-seem-to-be-doing-anything/51722 "2016-06-02T21:46:03Z")
I have FileBeat installed as a service and I've set the following config: filebeat: prospectors: - paths: - C:\\LogFiles\\log.log input\_type: filebeat registry\_file: "C:/ProgramData/filebeat… --- ## [Winlogbeat can't start the service (Solved)](https://discuss.elastic.co/t/winlogbeat-cant-start-the-service-solved/51687)
**Author:** [@suresh](https://discuss.elastic.co/u/suresh)\ **Replies:** 4\ **Last updated:** [June 2, 2016, 6:10pm UTC](https://discuss.elastic.co/t/winlogbeat-cant-start-the-service-solved/51687 "2016-06-02T18:10:25Z")
i am getting the following error PS C:\\Program Files\\winlogbeat\> Start-Service winlogbeat Start-Service : Service 'winlogbeat (winlogbeat)' cannot be started due to the following error: Cannot start service winlogbeat … --- ## [REDIS configuration](https://discuss.elastic.co/t/redis-configuration/51432)
**Author:** [@Sandhya\_Rathinapandi](https://discuss.elastic.co/u/Sandhya_Rathinapandi)\ **Replies:** 8\ **Last updated:** [June 2, 2016, 9:02am UTC](https://discuss.elastic.co/t/redis-configuration/51432 "2016-06-02T09:02:48Z")
I am trying to restrict the redis access to only few ip's My configurations below: bind 10.xx.xx.xx1 10.xx.xx.xx2 protected-mode yes And I am getting the error: Creating Server TCP listening socket 10.xx.xx.xx1… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=576) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=578)