# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=579 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 580 --- ## [Can't build with beats-packer on Ubuntu 16.04: .../xgo: cannot download](https://discuss.elastic.co/t/cant-build-with-beats-packer-on-ubuntu-16-04-xgo-cannot-download/50460)
**Author:** [@dviljoen](https://discuss.elastic.co/u/dviljoen)\ **Replies:** 5\ **Last updated:** [May 23, 2016, 3:53pm UTC](https://discuss.elastic.co/t/cant-build-with-beats-packer-on-ubuntu-16-04-xgo-cannot-download/50460 "2016-05-23T15:53:04Z")
Trying to build filebeat for arm. Using beats-packer w/docker. Make images and make pull-images both succeed. Make deps fails: go get github.com/tsg/xgo package github.com/tsg/xgo: cannot download, $GOPATH not set. … --- ## [Packetbeat doesn't start on windonws](https://discuss.elastic.co/t/packetbeat-doesnt-start-on-windonws/50581)
**Author:** [@Maher\_Ben\_Taleb\_Ali](https://discuss.elastic.co/u/Maher_Ben_Taleb_Ali)\ **Replies:** 6\ **Last updated:** [May 23, 2016, 2:36pm UTC](https://discuss.elastic.co/t/packetbeat-doesnt-start-on-windonws/50581 "2016-05-23T14:36:50Z")
Hi, I just installed packetbeat on windows. and I tested it on ubutnu with the same configs and it worked fine. I am using the standard config. I when I use Start-Service packetbeat. it doesn't work, and there is no… --- ## [Error:control characters are not allowed](https://discuss.elastic.co/t/error-control-characters-are-not-allowed/50677)
**Author:** [@preehana](https://discuss.elastic.co/u/preehana)\ **Replies:** 2\ **Last updated:** [May 23, 2016, 2:19pm UTC](https://discuss.elastic.co/t/error-control-characters-are-not-allowed/50677 "2016-05-23T14:19:24Z")
Hello, I am using winlogbeat-1.1.2 in windows.I got the following error in the yml file of winlogbeat 2016/05/23 06:57:02.522652 beat.go:157: CRIT Setup returned an error: yaml: control characters are not allowed My … --- ## [Server 2003 - PID's not recognized](https://discuss.elastic.co/t/server-2003-pids-not-recognized/50450)
**Author:** [@Kevin\_Csuka](https://discuss.elastic.co/u/Kevin_Csuka)\ **Replies:** 3\ **Last updated:** [May 23, 2016, 1:42pm UTC](https://discuss.elastic.co/t/server-2003-pids-not-recognized/50450 "2016-05-23T13:42:29Z")
Hi, I'm not quite sure if Windows Server 2003 is supported. But XP is, so I thought server 2003 also is. The issue: The log in C:/programdata/logs/topbeat is showing these lines: Error getting process details pid… --- ## [Filebeat redis logstash](https://discuss.elastic.co/t/filebeat-redis-logstash/50671)
**Author:** [@Sandhya\_Rathinapandi](https://discuss.elastic.co/u/Sandhya_Rathinapandi)\ **Replies:** 1\ **Last updated:** [May 23, 2016, 10:23am UTC](https://discuss.elastic.co/t/filebeat-redis-logstash/50671 "2016-05-23T10:23:58Z")
Hi We are trying to configure Filebeat-\> redis-\> logstash-\> elasticsearch. But getting the following error. Redis connection problem {:exception=\>#\ **Author:** [@narenpalepu](https://discuss.elastic.co/u/narenpalepu)\ **Replies:** 2\ **Last updated:** [May 22, 2016, 1:55pm UTC](https://discuss.elastic.co/t/filebeat-to-send-data-to-scribe-server/50266 "2016-05-22T13:55:39Z") Hi All, I am trying to replace scribe infrastructure with filebeat. Is it supported . Do you see any issues? Starting with scribe\_log and than replacing scribed. Thanks, Naren --- ## [Winlogbeat issues shipping to Logstash](https://discuss.elastic.co/t/winlogbeat-issues-shipping-to-logstash/50557)
**Author:** [@thekrazy](https://discuss.elastic.co/u/thekrazy)\ **Replies:** 8\ **Last updated:** [May 22, 2016, 1:48pm UTC](https://discuss.elastic.co/t/winlogbeat-issues-shipping-to-logstash/50557 "2016-05-22T13:48:34Z")
I'm having trouble shipping logs from my client server to my ELK stack server. My client server winlogbeat.yml is: winlogbeat: registry\_file: C:/ProgramData/winlogbeat/.winlogbeat.yml event\_logs: - name: Ap… --- ## [Can I write grok expression to enrich log files in FileBeat before sending to Logstash / elastic search](https://discuss.elastic.co/t/can-i-write-grok-expression-to-enrich-log-files-in-filebeat-before-sending-to-logstash-elastic-search/50568)
**Author:** [@Rohit\_Shrivastava](https://discuss.elastic.co/u/Rohit_Shrivastava)\ **Replies:** 3\ **Last updated:** [May 21, 2016, 4:04pm UTC](https://discuss.elastic.co/t/can-i-write-grok-expression-to-enrich-log-files-in-filebeat-before-sending-to-logstash-elastic-search/50568 "2016-05-21T16:04:28Z")
Hi My use case is to ship log files from various applications to elastic search so that I can view them from kibana. I wanted to know can filebeat be configured for grok expression so that application team can mana… --- ## [Option for transferring log info from Filebeat to Logstash using https](https://discuss.elastic.co/t/option-for-transferring-log-info-from-filebeat-to-logstash-using-https/50515)
**Author:** [@ramkchirra](https://discuss.elastic.co/u/ramkchirra)\ **Replies:** 5\ **Last updated:** [May 20, 2016, 12:58pm UTC](https://discuss.elastic.co/t/option-for-transferring-log-info-from-filebeat-to-logstash-using-https/50515 "2016-05-20T12:58:12Z")
Hi, I am looking into an option where i can transfer the log information from FileBeat to Logstash using http(s).Currently the problem i am facing is that filebeat uses beat/lumberjack protocol which is being blocked… --- ## [Can you add custom/dynamic fields to topbeat output?](https://discuss.elastic.co/t/can-you-add-custom-dynamic-fields-to-topbeat-output/50269)
**Author:** [@Maxwell\_Flanders](https://discuss.elastic.co/u/Maxwell_Flanders)\ **Replies:** 3\ **Last updated:** [May 20, 2016, 4:28pm UTC](https://discuss.elastic.co/t/can-you-add-custom-dynamic-fields-to-topbeat-output/50269 "2016-05-20T16:28:05Z")
We are using topbeats across a ton of servers to track cpu, mem, etc, and alerting on those fields using elastalert. It would be really nice if I could also add in some of my own custom fields/checks, for example, if a m… --- ## [Trouble sending Winlogbeat data to Logstash](https://discuss.elastic.co/t/trouble-sending-winlogbeat-data-to-logstash/50438)
**Author:** [@dickepa](https://discuss.elastic.co/u/dickepa)\ **Replies:** 8\ **Last updated:** [May 20, 2016, 3:41pm UTC](https://discuss.elastic.co/t/trouble-sending-winlogbeat-data-to-logstash/50438 "2016-05-20T15:41:20Z")
After updating to Winlogbeat 5 Alpha 2 and finally updating the template on my ELK stack I have ran Winlogbeats using the ./winlogbeat -e -d "publish" command. Whilst I see a list of scrolling events I also see sync.… --- ## [Filebeat fails to harvest if a file and a symlink to that file is in the same directory](https://discuss.elastic.co/t/filebeat-fails-to-harvest-if-a-file-and-a-symlink-to-that-file-is-in-the-same-directory/49743)
**Author:** [@treff7es1](https://discuss.elastic.co/u/treff7es1)\ **Replies:** 4\ **Last updated:** [May 20, 2016, 11:35am UTC](https://discuss.elastic.co/t/filebeat-fails-to-harvest-if-a-file-and-a-symlink-to-that-file-is-in-the-same-directory/49743 "2016-05-20T11:35:08Z")
Hi, It seems to me if symlink exists in the directory where filebeat should work on then filebeat won't harvest. Our system is writing logs in a format where every hour we name the logfile with the actual hour in the f… --- ## [Filebeat vs syslog](https://discuss.elastic.co/t/filebeat-vs-syslog/50547)
**Author:** [@Ale](https://discuss.elastic.co/u/Ale)\ **Replies:** 1\ **Last updated:** [May 20, 2016, 10:34am UTC](https://discuss.elastic.co/t/filebeat-vs-syslog/50547 "2016-05-20T10:34:48Z")
Hi there! we are evaluating ES Stack at our company and one of the questions that came up was: while filebeat is a lightweight log shipper, what are the benefits over just pointing syslog to logstash server? One of … --- ## [Multiline syslogs group with the same PID?](https://discuss.elastic.co/t/multiline-syslogs-group-with-the-same-pid/50379)
**Author:** [@Shiekron](https://discuss.elastic.co/u/Shiekron)\ **Replies:** 3\ **Last updated:** [May 19, 2016, 5:05pm UTC](https://discuss.elastic.co/t/multiline-syslogs-group-with-the-same-pid/50379 "2016-05-19T17:05:39Z")
I'm curious on how would you attempt to create a multiline match on just the PID to put it on a single event? I'm currently using this: prospectors: - paths: - /usr/local/log/opensips.log encoding: plain input\_ty… --- ## [Packetbeat on i586 Alix Board with ArchLinux](https://discuss.elastic.co/t/packetbeat-on-i586-alix-board-with-archlinux/50216)
**Author:** [@LetMeSurf](https://discuss.elastic.co/u/LetMeSurf)\ **Replies:** 12\ **Last updated:** [May 19, 2016, 2:53pm UTC](https://discuss.elastic.co/t/packetbeat-on-i586-alix-board-with-archlinux/50216 "2016-05-19T14:53:13Z")
Hello, I installed ArchLinux on a Alix2d13 Board (http://www.pcengines.ch/alix2d13.htm) which runs with an i586 AMD Geode LX800 CPU. I also configured a bridge with two of the three nics. My goal is to use such devices… --- ## [Log rotate introduced blank offset entry in registry](https://discuss.elastic.co/t/log-rotate-introduced-blank-offset-entry-in-registry/50351)
**Author:** [@logilouis](https://discuss.elastic.co/u/logilouis)\ **Replies:** 3\ **Last updated:** [May 19, 2016, 2:37pm UTC](https://discuss.elastic.co/t/log-rotate-introduced-blank-offset-entry-in-registry/50351 "2016-05-19T14:37:39Z")
Hi, I noticed that when Filebeat detected a log rotation, it will create a new entry in registry. I discovered that the new entry will have blank offset. An example of the rotated log entry from my registry file (I expa… --- ## [Unable to install template to Elasticsearch](https://discuss.elastic.co/t/unable-to-install-template-to-elasticsearch/50425)
**Author:** [@dickepa](https://discuss.elastic.co/u/dickepa)\ **Replies:** 3\ **Last updated:** [May 19, 2016, 12:30pm UTC](https://discuss.elastic.co/t/unable-to-install-template-to-elasticsearch/50425 "2016-05-19T12:30:07Z")
Hello I have copied the 5 Alpha 2 template to my ELK stack and now trying to add it but when I do: curl -XPUT http://localhost:9200/\_template/winlogbeat -d winlogbeat.template.json in the same directory that holds the … --- ## [Question about the idle\_timeout option](https://discuss.elastic.co/t/question-about-the-idle-timeout-option/50002)
**Author:** [@ericpietro](https://discuss.elastic.co/u/ericpietro)\ **Replies:** 10\ **Last updated:** [May 19, 2016, 10:08am UTC](https://discuss.elastic.co/t/question-about-the-idle-timeout-option/50002 "2016-05-19T10:08:47Z")
hi, reading the documentation, i was thinking that the spooler is flushed every 'idle\_timeout' duration or if the spool\_size is reached. In my case (as u can see on my log below), I set these options : - spool\_size = 40… --- ## [Could filebeat support multipath for input and output separately?](https://discuss.elastic.co/t/could-filebeat-support-multipath-for-input-and-output-separately/50297)
**Author:** [@tuankun](https://discuss.elastic.co/u/tuankun)\ **Replies:** 7\ **Last updated:** [May 19, 2016, 7:45am UTC](https://discuss.elastic.co/t/could-filebeat-support-multipath-for-input-and-output-separately/50297 "2016-05-19T07:45:52Z")
Hi anybody, I would like to capture some logs with totally different fields using filebeat on windows 2008 server,and then send logs to different index in elasticsearch. Could filebeat support multipath like this (i… --- ## [Understanding PacketBeat transfer data](https://discuss.elastic.co/t/understanding-packetbeat-transfer-data/50105)
**Author:** [@vadimso](https://discuss.elastic.co/u/vadimso)\ **Replies:** 2\ **Last updated:** [May 18, 2016, 8:22am UTC](https://discuss.elastic.co/t/understanding-packetbeat-transfer-data/50105 "2016-05-18T08:22:37Z")
Hello , I have 2 machines , on first machine i have logstash conf file that points to the 2nd machine and PacketBeat services running on both machines. On 1st machine i have ElasticSearch engine and do i realy need it … --- ## [How many processes are used to transfer the files from file beat to log stash?](https://discuss.elastic.co/t/how-many-processes-are-used-to-transfer-the-files-from-file-beat-to-log-stash/50187)
**Author:** [@karuneshupadhyay](https://discuss.elastic.co/u/karuneshupadhyay)\ **Replies:** 2\ **Last updated:** [May 18, 2016, 5:58am UTC](https://discuss.elastic.co/t/how-many-processes-are-used-to-transfer-the-files-from-file-beat-to-log-stash/50187 "2016-05-18T05:58:34Z")
Hi, How many processes are used to transfer the files from file beat to log stash ? Is it only 1 process or we have multiple processes? How can I check the details information on this ? Thanks and Regards, Karunesh U… --- ## [FileBeat ignore\_older behavior](https://discuss.elastic.co/t/filebeat-ignore-older-behavior/50226)
**Author:** [@logilouis](https://discuss.elastic.co/u/logilouis)\ **Replies:** 2\ **Last updated:** [May 17, 2016, 10:24pm UTC](https://discuss.elastic.co/t/filebeat-ignore-older-behavior/50226 "2016-05-17T22:24:54Z")
Hi, I am using FileBeat 1.2.2 and would like to confirm my understanding with the usage of ignore\_older. The Setup: FileBeat is configured with ignore\_older of 1h, and it is harvesting /var/log/apache.log. FileBeat … --- ## [How to parse JSON with nested field name "source"](https://discuss.elastic.co/t/how-to-parse-json-with-nested-field-name-source/50083)
**Author:** [@a\_acev](https://discuss.elastic.co/u/a_acev)\ **Replies:** 2\ **Last updated:** [May 17, 2016, 7:39pm UTC](https://discuss.elastic.co/t/how-to-parse-json-with-nested-field-name-source/50083 "2016-05-17T19:39:25Z")
Hi, I am new to ELK. I am trying to parse JSON strings that contain field name "source". Here is an example: {"feed": {"name": "AlienVault", "accuracy": 100.0, "url": "https://reputation.alienvault.com/reputation.data"},… --- ## [NLog integration with Beats](https://discuss.elastic.co/t/nlog-integration-with-beats/49982)
**Author:** [@Vik](https://discuss.elastic.co/u/Vik)\ **Replies:** 3\ **Last updated:** [May 17, 2016, 7:06pm UTC](https://discuss.elastic.co/t/nlog-integration-with-beats/49982 "2016-05-17T19:06:24Z")
Hi, In my current application i am looking to get the application logs which use NLog into elasticsearch using logstash, There seems to have been quite a few changes around lumberjack now been replaced by beats etc. So … --- ## [Topbeat: identifying applications from processes](https://discuss.elastic.co/t/topbeat-identifying-applications-from-processes/50097)
**Author:** [@krushnat\_khawale](https://discuss.elastic.co/u/krushnat_khawale)\ **Replies:** 1\ **Last updated:** [May 17, 2016, 1:31pm UTC](https://discuss.elastic.co/t/topbeat-identifying-applications-from-processes/50097 "2016-05-17T13:31:57Z")
I am using Elasticsearch 2.1.0 , topbeat 1.1 on windows 7. I am monitoring one of the servers where web applications running. So there are multiple applications running on tomcat. Last week our server was down due … --- ## [On restart Harversters are opened for ignored files](https://discuss.elastic.co/t/on-restart-harversters-are-opened-for-ignored-files/50038)
**Author:** [@Stuart\_Fraser](https://discuss.elastic.co/u/Stuart_Fraser)\ **Replies:** 6\ **Last updated:** [May 17, 2016, 12:57pm UTC](https://discuss.elastic.co/t/on-restart-harversters-are-opened-for-ignored-files/50038 "2016-05-17T12:57:14Z")
Impact Unable to restart filebeat as expected after ignoring a lot of files. Description When filebeat is restarted Harversters open every file even if they should be ignored by the ignore\_older setting. Environm… --- ## [Packetbeat/MySQL Reliability](https://discuss.elastic.co/t/packetbeat-mysql-reliability/49924)
**Author:** [@nizz](https://discuss.elastic.co/u/nizz)\ **Replies:** 3\ **Last updated:** [May 17, 2016, 12:13pm UTC](https://discuss.elastic.co/t/packetbeat-mysql-reliability/49924 "2016-05-17T12:13:32Z")
Hi, I've setup Packetbeat to sniff MySQL traffic. My problem is that for most queries, I get a response of 0 and for some an extremely large value of a few thousands. I've cross checked the lengthy queries with the API… --- ## [Kafka output, CPU spikes if Kafka Cluster Unavailable](https://discuss.elastic.co/t/kafka-output-cpu-spikes-if-kafka-cluster-unavailable/48892)
**Author:** [@landonix](https://discuss.elastic.co/u/landonix)\ **Replies:** 6\ **Last updated:** [May 17, 2016, 11:45am UTC](https://discuss.elastic.co/t/kafka-output-cpu-spikes-if-kafka-cluster-unavailable/48892 "2016-05-17T11:45:46Z")
I have been testing Winlogbeat by dropping event log output directly into a Kafka cluster queue. It works very well with uninterrupted/reliable network connectivity. However in my test case I wanted to see the impact if … --- ## [Regarding Data transfer from Filebeat to Logstash](https://discuss.elastic.co/t/regarding-data-transfer-from-filebeat-to-logstash/50189)
**Author:** [@karuneshupadhyay](https://discuss.elastic.co/u/karuneshupadhyay)\ **Replies:** 1\ **Last updated:** [May 17, 2016, 11:40am UTC](https://discuss.elastic.co/t/regarding-data-transfer-from-filebeat-to-logstash/50189 "2016-05-17T11:40:36Z")
Hi Filebeat is sending files to logstash and transfer got stopped because of connection break then when will happen? Data will be processed form starting or it will continue from same point? Ex- We have 5 file… --- ## [Not able to see the log file after Logging configuration in Filebeat](https://discuss.elastic.co/t/not-able-to-see-the-log-file-after-logging-configuration-in-filebeat/50185)
**Author:** [@karuneshupadhyay](https://discuss.elastic.co/u/karuneshupadhyay)\ **Replies:** 1\ **Last updated:** [May 17, 2016, 11:35am UTC](https://discuss.elastic.co/t/not-able-to-see-the-log-file-after-logging-configuration-in-filebeat/50185 "2016-05-17T11:35:28Z")
Hi, I am trying the generate the logs file in FileBeat. I changed the filebeat.yml and added the configuration to generate log files, but I am not able see the log files. Configuration - \> logging: \> to\_syslog… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=578) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=580)