# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=578 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 579 --- ## [How to get Windows Server DHCP logs](https://discuss.elastic.co/t/how-to-get-windows-server-dhcp-logs/51425)
**Author:** [@logger](https://discuss.elastic.co/u/logger)\ **Replies:** 2\ **Last updated:** [June 2, 2016, 7:08am UTC](https://discuss.elastic.co/t/how-to-get-windows-server-dhcp-logs/51425 "2016-06-02T07:08:42Z")
Hi. I have a problem with Windows Server 2008 r2 DHCP Logs. I used Filebeat to watch over the files in C:\\Windows\\System32\\dhcp\* folder. When a new IP got leased the file does not change its time. That means filebea… --- ## [Port Requirement](https://discuss.elastic.co/t/port-requirement/51529)
**Author:** [@Kennedy\_Kan1](https://discuss.elastic.co/u/Kennedy_Kan1)\ **Replies:** 6\ **Last updated:** [June 2, 2016, 4:40am UTC](https://discuss.elastic.co/t/port-requirement/51529 "2016-06-02T04:40:56Z")
It seems that when we start install and run the different kinds of beats, they will go smooth naturally. So is there any actual port opening requirement for beats? --- ## [Filebeat giving error on start - Unable to read file at end](https://discuss.elastic.co/t/filebeat-giving-error-on-start-unable-to-read-file-at-end/51407)
**Author:** [@Varun\_Kapoor](https://discuss.elastic.co/u/Varun_Kapoor)\ **Replies:** 6\ **Last updated:** [June 1, 2016, 9:56am UTC](https://discuss.elastic.co/t/filebeat-giving-error-on-start-unable-to-read-file-at-end/51407 "2016-06-01T09:56:55Z")
Hi Whenever I am starting the file beat it gives me following error 2016-05-31T09:24:09Z INFO Harvester started for file: - 2016-05-31T09:24:09Z ERR Unexpected state reading from /dev/stdin; error: read /dev/stdin: r… --- ## [Filebeat not harvesting new files](https://discuss.elastic.co/t/filebeat-not-harvesting-new-files/51437)
**Author:** [@kalapakim](https://discuss.elastic.co/u/kalapakim)\ **Replies:** 2\ **Last updated:** [June 1, 2016, 4:40am UTC](https://discuss.elastic.co/t/filebeat-not-harvesting-new-files/51437 "2016-06-01T04:40:32Z")
What is working? If I create my custom logs with the ruby logger class and start filebeats, it will harvest and send the data to kibana. This is not what we want with these logs, we are trying to spit out a log in json… --- ## [Filebeat JSON input](https://discuss.elastic.co/t/filebeat-json-input/51475)
**Author:** [@mregmi](https://discuss.elastic.co/u/mregmi)\ **Replies:** 1\ **Last updated:** [May 31, 2016, 7:33pm UTC](https://discuss.elastic.co/t/filebeat-json-input/51475 "2016-05-31T19:33:22Z")
Does Filebeat support JSON input ? I want to use filebeat to monitor one of my state file that's in JSON format. Thank you for any input. --- ## [Read regex from file](https://discuss.elastic.co/t/read-regex-from-file/51439)
**Author:** [@quimnuss](https://discuss.elastic.co/u/quimnuss)\ **Replies:** 2\ **Last updated:** [May 31, 2016, 5:37pm UTC](https://discuss.elastic.co/t/read-regex-from-file/51439 "2016-05-31T17:37:38Z")
@monicasarbu added regex include/exclude support for beats. How hard would it be to read those regex from file when we have a long list of regex? Is it already possible? I'd look forward to re-using the logcheck regex … --- ## [Winlogbeat v5 - Message not read fully](https://discuss.elastic.co/t/winlogbeat-v5-message-not-read-fully/51062)
**Author:** [@rhyse](https://discuss.elastic.co/u/rhyse)\ **Replies:** 9\ **Last updated:** [May 31, 2016, 10:27am UTC](https://discuss.elastic.co/t/winlogbeat-v5-message-not-read-fully/51062 "2016-05-31T10:27:40Z")
Hi I am testing the eventlog beat for file / folder auditing. There seems to be a problem with pulling out the Access request Information of the message. The error I am getting on the client side is 2016-05-24T20:… --- ## [Filebeat: filebeat.full.yml attribute duplication](https://discuss.elastic.co/t/filebeat-filebeat-full-yml-attribute-duplication/51110)
**Author:** [@Jaren](https://discuss.elastic.co/u/Jaren)\ **Replies:** 7\ **Last updated:** [May 31, 2016, 8:54am UTC](https://discuss.elastic.co/t/filebeat-filebeat-full-yml-attribute-duplication/51110 "2016-05-31T08:54:05Z")
It appears in the filebeat.full.yml that their is some duplication in the below attributes. fields: \* https://github.com/elastic/beats/blob/master/filebeat/filebeat.full.yml#L61 \* https://github.com/elastic/beats/… --- ## [File meta data fields](https://discuss.elastic.co/t/file-meta-data-fields/51356)
**Author:** [@wmcdonald](https://discuss.elastic.co/u/wmcdonald)\ **Replies:** 3\ **Last updated:** [May 31, 2016, 6:47am UTC](https://discuss.elastic.co/t/file-meta-data-fields/51356 "2016-05-31T06:47:43Z")
We have a file that contains information written by another application. It only has one line, but doesn't contain any timestamp information. I'd like to use the timestamp on the file itself. In general, since filebea… --- ## [Different file format in filebeat](https://discuss.elastic.co/t/different-file-format-in-filebeat/51302)
**Author:** [@Karthik\_B](https://discuss.elastic.co/u/Karthik_B)\ **Replies:** 5\ **Last updated:** [May 30, 2016, 11:49pm UTC](https://discuss.elastic.co/t/different-file-format-in-filebeat/51302 "2016-05-30T23:49:36Z")
Hi , i am new to filebeat..i like to send multiple format file(.log,txt,.db,etc) from filebeat to ElK..so can you send some example configuration for this ... --- ## [Runtime error: slice bounds out of range](https://discuss.elastic.co/t/runtime-error-slice-bounds-out-of-range/51249)
**Author:** [@lostcompasscn](https://discuss.elastic.co/u/lostcompasscn)\ **Replies:** 2\ **Last updated:** [May 30, 2016, 1:30pm UTC](https://discuss.elastic.co/t/runtime-error-slice-bounds-out-of-range/51249 "2016-05-30T13:30:51Z")
Hello, everyone, I run packetbeat-1.2.3 find a runtime error log. Real time network traffic is about 10MB/S, please help me,thanks very much! operating system:centos 7 The specific error log is as follows： 2016-05-26… --- ## [Message Audits](https://discuss.elastic.co/t/message-audits/51277)
**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 1\ **Last updated:** [May 30, 2016, 9:01am UTC](https://discuss.elastic.co/t/message-audits/51277 "2016-05-30T09:01:03Z")
Hi, Does filebeat keep track of how many messages it sends over a period? Can this be sent as metrics so that some kind of audit of message count received vs message count sent can be performed? Regards, David --- ## [Getting error while running main function in packetbeat](https://discuss.elastic.co/t/getting-error-while-running-main-function-in-packetbeat/51082)
**Author:** [@harshafrnd4u](https://discuss.elastic.co/u/harshafrnd4u)\ **Replies:** 3\ **Last updated:** [May 30, 2016, 8:48am UTC](https://discuss.elastic.co/t/getting-error-while-running-main-function-in-packetbeat/51082 "2016-05-30T08:48:56Z")
I am trying to build packetbeat from sources, and I tried running using command "go run main.go -c packetbeat.yml" It gives error Exiting: error initializing publisher: Error loading template /tmp/go-build318793343/co… --- ## [Filebeat configuration option 'tail\_files'](https://discuss.elastic.co/t/filebeat-configuration-option-tail-files/43084)
**Author:** [@Augustin\_Chen](https://discuss.elastic.co/u/Augustin_Chen)\ **Replies:** 12\ **Last updated:** [May 30, 2016, 8:29am UTC](https://discuss.elastic.co/t/filebeat-configuration-option-tail-files/43084 "2016-05-30T08:29:24Z")
I am working on the filebeat 1.1.1. The following is the snippet of the configuation file. I assume the filebeat reads from the end of the log files as the 'tail\_files' is true. But it seems the filebeat doesn't work as … --- ## [Logstash and filebeat are not working with my private CA system](https://discuss.elastic.co/t/logstash-and-filebeat-are-not-working-with-my-private-ca-system/51195)
**Author:** [@Sean\_Bollin](https://discuss.elastic.co/u/Sean_Bollin)\ **Replies:** 2\ **Last updated:** [May 27, 2016, 10:08pm UTC](https://discuss.elastic.co/t/logstash-and-filebeat-are-not-working-with-my-private-ca-system/51195 "2016-05-27T22:08:18Z")
I've created a root ca, and an intermediate ca. I signed my logstash server cert with the intermediate CA. I know my certificate system is working (as I'm using it on other software's and it's fine). Problem is - doe… --- ## [Add an additional information in HTTP header from filebeat to ElasticSearch](https://discuss.elastic.co/t/add-an-additional-information-in-http-header-from-filebeat-to-elasticsearch/51115)
**Author:** [@ramkchirra](https://discuss.elastic.co/u/ramkchirra)\ **Replies:** 1\ **Last updated:** [May 27, 2016, 9:39am UTC](https://discuss.elastic.co/t/add-an-additional-information-in-http-header-from-filebeat-to-elasticsearch/51115 "2016-05-27T09:39:51Z")
Hi, I want to add an additional information in HTTP header (for authentication on server) in http request from filebeat to ElasticSearch. Is it possible ? Please let me know. Thanks, RK --- ## [Topbeat change settings when to gather stats](https://discuss.elastic.co/t/topbeat-change-settings-when-to-gather-stats/50982)
**Author:** [@vikas\_J](https://discuss.elastic.co/u/vikas_J)\ **Replies:** 6\ **Last updated:** [May 26, 2016, 2:21pm UTC](https://discuss.elastic.co/t/topbeat-change-settings-when-to-gather-stats/50982 "2016-05-26T14:21:51Z")
I find a strange problem in my ELK setup. I have topbeat configured to gather statistics every 3600s using: input: # In seconds, defines how often to read server statistics period: 3600 And it sends output to log s… --- ## [Suggestion: libbeat to select between xxx.template,json and xxx.template-es2x.json](https://discuss.elastic.co/t/suggestion-libbeat-to-select-between-xxx-template-json-and-xxx-template-es2x-json/50887)
**Author:** [@cyrilleverrier](https://discuss.elastic.co/u/cyrilleverrier)\ **Replies:** 3\ **Last updated:** [May 26, 2016, 8:07am UTC](https://discuss.elastic.co/t/suggestion-libbeat-to-select-between-xxx-template-json-and-xxx-template-es2x-json/50887 "2016-05-26T08:07:38Z")
Hi Beat developers, May I suggest you to implement in libbeat a way to push the correct ES template file depending on the ES server. I believe it should not be difficult to query the ES version and select xxx.templat… --- ## [Packetbeat: Disable return\_value for Redis protocol](https://discuss.elastic.co/t/packetbeat-disable-return-value-for-redis-protocol/50418)
**Author:** [@spa-87](https://discuss.elastic.co/u/spa-87)\ **Replies:** 2\ **Last updated:** [May 26, 2016, 7:43am UTC](https://discuss.elastic.co/t/packetbeat-disable-return-value-for-redis-protocol/50418 "2016-05-26T07:43:44Z")
Hi, in my usecase Redis is used as a cache-server and stores big bunches of data. All that data is returned at redis.return\_value field for each request what can lead to high resources consumption at ElasticSearch server… --- ## [How to insert file,when my file is continuously updating](https://discuss.elastic.co/t/how-to-insert-file-when-my-file-is-continuously-updating/50639)
**Author:** [@prakashkumar](https://discuss.elastic.co/u/prakashkumar)\ **Replies:** 17\ **Last updated:** [May 26, 2016, 7:29am UTC](https://discuss.elastic.co/t/how-to-insert-file-when-my-file-is-continuously-updating/50639 "2016-05-26T07:29:23Z")
Hi, I am having 5 files, names of those files are xyz0.log ,xyz1.log,.....xyz4.log and in that file there is a text :"my name is tom". now I am runing filebeat its only give one output to me ,but it harvest to all file a… --- ## [One file come five times in output](https://discuss.elastic.co/t/one-file-come-five-times-in-output/50938)
**Author:** [@prakashkumar](https://discuss.elastic.co/u/prakashkumar)\ **Replies:** 3\ **Last updated:** [May 26, 2016, 7:23am UTC](https://discuss.elastic.co/t/one-file-come-five-times-in-output/50938 "2016-05-26T07:23:20Z")
HI, I have 10 log files in folder. And i get output: 2016/05/25 12:53:11.061273 output.go:87: DBG output worker: publish 38 events 2016/05/25 12:53:11.267406 publish.go:104: INFO Events sent: 38 2016/05/25 12:53:11.26… --- ## [Filebeat do not see file updates after a while](https://discuss.elastic.co/t/filebeat-do-not-see-file-updates-after-a-while/34914)
**Author:** [@ogauchard](https://discuss.elastic.co/u/ogauchard)\ **Replies:** 32\ **Last updated:** [May 26, 2016, 7:21am UTC](https://discuss.elastic.co/t/filebeat-do-not-see-file-updates-after-a-while/34914 "2016-05-26T07:21:43Z")
Hello, I am facing a strange issue with Filebeat on Windows : I use it to consume log files generated with log4net. These files are configures to rotate every day. Filebeat is only watching the current file. Everyt… --- ## [\[SOLVED\] Where to set log pattern?](https://discuss.elastic.co/t/solved-where-to-set-log-pattern/50956)
**Author:** [@cbismuth](https://discuss.elastic.co/u/cbismuth)\ **Replies:** 2\ **Last updated:** [May 25, 2016, 6:36pm UTC](https://discuss.elastic.co/t/solved-where-to-set-log-pattern/50956 "2016-05-25T18:36:23Z")
Hi, I've successfully managed to ship JSON structured logs to Kibana 4.5.1 with Filebeat 5.0.0-alpha2. I've created second prospector in my filebeat.yml to parse simple traditional log lines stored in others log file… --- ## [Trouble getting multiline working](https://discuss.elastic.co/t/trouble-getting-multiline-working/50869)
**Author:** [@vchav73](https://discuss.elastic.co/u/vchav73)\ **Replies:** 2\ **Last updated:** [May 24, 2016, 10:25pm UTC](https://discuss.elastic.co/t/trouble-getting-multiline-working/50869 "2016-05-24T22:25:41Z")
I have this in a log file: 2016-05-24 08:39:14 18083 \[Note\] /usr/sbin/mysqld: ready for connections. Version: '5.6.29-76.2-log' socket: '/var/lib/mysql/mysql.sock' port: 3306 Percona Server (GPL), Release 76.2, Revi… --- ## [Redis not working](https://discuss.elastic.co/t/redis-not-working/50813)
**Author:** [@Sandhya\_Rathinapandi](https://discuss.elastic.co/u/Sandhya_Rathinapandi)\ **Replies:** 1\ **Last updated:** [May 24, 2016, 8:59pm UTC](https://discuss.elastic.co/t/redis-not-working/50813 "2016-05-24T20:59:12Z")
Hi, I am using Filebeat -\> redis-\>logstash-\>Elasticsearch. Now I am getting the below error in the filebeat(1.2.3) log. ERR Fail to publish event to REDIS: write tcp 127.0.0.1:48979-\>127.0.0.1:6379: write: broken … --- ## [Filebeat multiline patterns not working](https://discuss.elastic.co/t/filebeat-multiline-patterns-not-working/50478)
**Author:** [@lalu](https://discuss.elastic.co/u/lalu)\ **Replies:** 10\ **Last updated:** [May 24, 2016, 8:53pm UTC](https://discuss.elastic.co/t/filebeat-multiline-patterns-not-working/50478 "2016-05-24T20:53:34Z")
filebeat v1.2.2 (64 bit) OS: centos 6.7 multiline: --\> patterns: --\> '-' --\> pattern: (not working) multiline: --\> pattern: (working) Found detail here: (Enhanced LS Config) Is this supposed to work or feature no… --- ## [Is there any way to do data sampling at client side?](https://discuss.elastic.co/t/is-there-any-way-to-do-data-sampling-at-client-side/50428)
**Author:** [@harshafrnd4u](https://discuss.elastic.co/u/harshafrnd4u)\ **Replies:** 7\ **Last updated:** [May 24, 2016, 8:41pm UTC](https://discuss.elastic.co/t/is-there-any-way-to-do-data-sampling-at-client-side/50428 "2016-05-24T20:41:05Z")
Hi, Packetbeat is sending too much data to server, Is there any way to reduce data transmission to server either by aggregation or some sampling techniques in packebeat itself? Any suggestions or pointers will be he… --- ## [Filebeat service hangs on first start amazon ec2](https://discuss.elastic.co/t/filebeat-service-hangs-on-first-start-amazon-ec2/46436)
**Author:** [@bmiramont](https://discuss.elastic.co/u/bmiramont)\ **Replies:** 33\ **Last updated:** [May 24, 2016, 7:50am UTC](https://discuss.elastic.co/t/filebeat-service-hangs-on-first-start-amazon-ec2/46436 "2016-05-24T07:50:56Z")
Hi, I have a java app on elastic beanstalk. I have a ./ebextensions/filebeat.config deployed to my ec2 instances upon EB deployement. Problem is : the first time the filebeat process is started, it hangs. I have to e… --- ## [How do i make sure that logstash received data from filebeat?](https://discuss.elastic.co/t/how-do-i-make-sure-that-logstash-received-data-from-filebeat/49666)
**Author:** [@Roshan\_r](https://discuss.elastic.co/u/Roshan_r)\ **Replies:** 25\ **Last updated:** [May 23, 2016, 4:11pm UTC](https://discuss.elastic.co/t/how-do-i-make-sure-that-logstash-received-data-from-filebeat/49666 "2016-05-23T16:11:42Z")
I am trying to use the filebeat and ELK for the first time. I have my components running on RHEL5 server. Filebeat is running on another server with RHEL6 as OS and ELK is running in a 3rd server with RHEL6 as OS. As s… --- ## [Beats SSL question](https://discuss.elastic.co/t/beats-ssl-question/50316)
**Author:** [@Uros\_Meglic](https://discuss.elastic.co/u/Uros_Meglic)\ **Replies:** 9\ **Last updated:** [May 23, 2016, 4:07pm UTC](https://discuss.elastic.co/t/beats-ssl-question/50316 "2016-05-23T16:07:52Z")
Hello all, I would just like to clarify if I understand this correctly. In the documentation it states that to use client certificate validation the SSL certificates need to be signed directly by the root ca. So, if… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=577) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=579)