# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=580 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 581 --- ## [Multiline sends unmatched multiline beginning of file #1611](https://discuss.elastic.co/t/multiline-sends-unmatched-multiline-beginning-of-file-1611/49772)
**Author:** [@Stuart\_Fraser](https://discuss.elastic.co/u/Stuart_Fraser)\ **Replies:** 7\ **Last updated:** [May 17, 2016, 11:32am UTC](https://discuss.elastic.co/t/multiline-sends-unmatched-multiline-beginning-of-file-1611/49772 "2016-05-17T11:32:36Z")
filebeat-1.2. Windows 2007 Steps to Reproduce: Extract sample.zip (attached)run filebeat -e -v -c filebeat.yml ----------------------------------- filebeat.yml # This is the main configuration file for this f… --- ## [Filebeat not keeping up with logs](https://discuss.elastic.co/t/filebeat-not-keeping-up-with-logs/48980)
**Author:** [@whyapenny](https://discuss.elastic.co/u/whyapenny)\ **Replies:** 7\ **Last updated:** [May 17, 2016, 11:02am UTC](https://discuss.elastic.co/t/filebeat-not-keeping-up-with-logs/48980 "2016-05-17T11:02:30Z")
config: filebeat: prospectors: - paths: - /apps/logs/All.log input\_type: log document\_type: prod scan\_frequency: 5s harvester\_buffer\_size: 32768 force\_close\_files: true … --- ## [Filebeat and journald?](https://discuss.elastic.co/t/filebeat-and-journald/49978)
**Author:** [@Devnull](https://discuss.elastic.co/u/Devnull)\ **Replies:** 2\ **Last updated:** [May 17, 2016, 10:52am UTC](https://discuss.elastic.co/t/filebeat-and-journald/49978 "2016-05-17T10:52:03Z")
Hi, I've recently been upgrading a few Ubuntu Servers to 16.04LTS and I notice they've been shifting towards systemd and its associated journald for logging. Does anything special need to be done with Filebeat (or in… --- ## [Filebeat Kafka output](https://discuss.elastic.co/t/filebeat-kafka-output/49950)
**Author:** [@anefassa](https://discuss.elastic.co/u/anefassa)\ **Replies:** 2\ **Last updated:** [May 17, 2016, 10:39am UTC](https://discuss.elastic.co/t/filebeat-kafka-output/49950 "2016-05-17T10:39:54Z")
Is it possible to specify a partition key when using filebeat to send to a Kafka topic? --- ## [Corrupted HTTP transactions data under heavy load](https://discuss.elastic.co/t/corrupted-http-transactions-data-under-heavy-load/49946)
**Author:** [@Vladimir\_Aleksandrov](https://discuss.elastic.co/u/Vladimir_Aleksandrov)\ **Replies:** 1\ **Last updated:** [May 17, 2016, 10:14am UTC](https://discuss.elastic.co/t/corrupted-http-transactions-data-under-heavy-load/49946 "2016-05-17T10:14:27Z")
Under heavy load (~100K tpm) I see various data corruption for HTTP transaction recorded: \* broken request methods names like GEGET, GETGET \* invalid response codes instead of 200 - 0, 1, 2, 65 etc \* missed forward slash… --- ## [Filebeat crashes on windows servers](https://discuss.elastic.co/t/filebeat-crashes-on-windows-servers/49652)
**Author:** [@ori.rubinfeld](https://discuss.elastic.co/u/ori.rubinfeld)\ **Replies:** 2\ **Last updated:** [May 17, 2016, 6:57am UTC](https://discuss.elastic.co/t/filebeat-crashes-on-windows-servers/49652 "2016-05-17T06:57:46Z")
Hi, We are encountering a lot of filebeat crashes on Windows 2008 machines. The Service starts and after a while it crashes. Trying to find the reason, activating the filebeat.exe from command line and redirect outpu… --- ## [Having trouble with filebeat not releasing rotated file](https://discuss.elastic.co/t/having-trouble-with-filebeat-not-releasing-rotated-file/49920)
**Author:** [@Zibby](https://discuss.elastic.co/u/Zibby)\ **Replies:** 3\ **Last updated:** [May 17, 2016, 6:43am UTC](https://discuss.elastic.co/t/having-trouble-with-filebeat-not-releasing-rotated-file/49920 "2016-05-17T06:43:33Z")
We're having some trouble with filebeat not releasing files after logrotate is run. Here is the filebeat conf: filebeat: prospectors: - paths: - /home/vhosts/XXXX/current/log/production.log d… --- ## [Facing difficulties in Installing Community Beat (Elasticbeat)](https://discuss.elastic.co/t/facing-difficulties-in-installing-community-beat-elasticbeat/50077)
**Author:** [@gupta.yuvraj](https://discuss.elastic.co/u/gupta.yuvraj)\ **Replies:** 4\ **Last updated:** [May 15, 2016, 7:57pm UTC](https://discuss.elastic.co/t/facing-difficulties-in-installing-community-beat-elasticbeat/50077 "2016-05-15T19:57:39Z")
Hi All I am facing difficulty while installing elasticbeat. I am using Ubuntu. I am mentioning the steps along with error while installing elasticbeat:- Installed Go using following command:- sudo apt-get install go… --- ## [PacketBeat Mongo DB](https://discuss.elastic.co/t/packetbeat-mongo-db/49610)
**Author:** [@vadimso](https://discuss.elastic.co/u/vadimso)\ **Replies:** 3\ **Last updated:** [May 15, 2016, 2:20pm UTC](https://discuss.elastic.co/t/packetbeat-mongo-db/49610 "2016-05-15T14:20:11Z")
Hi all, I have uploaded PacketBeat index pattern into Kibana but got error :Mapping conflict! A field is defined as several types (string, integer, etc) across the indices that match this pattern. You may still be able t… --- ## [Packet Beat MongoDB and Kibana](https://discuss.elastic.co/t/packet-beat-mongodb-and-kibana/49534)
**Author:** [@vadimso](https://discuss.elastic.co/u/vadimso)\ **Replies:** 4\ **Last updated:** [May 15, 2016, 12:06pm UTC](https://discuss.elastic.co/t/packet-beat-mongodb-and-kibana/49534 "2016-05-15T12:06:03Z")
Hello All, I am loaded packetbeat for Mongo DB index patterns to kibana , now how i link mongo db patterns to existing mongo db index ? Tnx in advance --- ## [CPU footprint of packetbeat is high](https://discuss.elastic.co/t/cpu-footprint-of-packetbeat-is-high/31553)
**Author:** [@5uraj](https://discuss.elastic.co/u/5uraj)\ **Replies:** 3\ **Last updated:** [May 13, 2016, 3:41pm UTC](https://discuss.elastic.co/t/cpu-footprint-of-packetbeat-is-high/31553 "2016-05-13T15:41:52Z")
I am using packetbeat in af\_paket traffic capturing mode, which give me about 30% CPU footprint on single core instance when I go for http and mysql monitoring only. As soon as I increase more header and cookie capture i… --- ## [Filebeat process holding deleted files](https://discuss.elastic.co/t/filebeat-process-holding-deleted-files/43967)
**Author:** [@slickrick](https://discuss.elastic.co/u/slickrick)\ **Replies:** 3\ **Last updated:** [May 13, 2016, 1:40pm UTC](https://discuss.elastic.co/t/filebeat-process-holding-deleted-files/43967 "2016-05-13T13:40:21Z")
There was alert regarding disk space on our filebeat server \[root@filebeat3 ~\]# df -h Filesystem Size Used Avail Use% Mounted on /dev/vda1 … --- ## [Logstash and Filebeat config for Logs count more 10,000](https://discuss.elastic.co/t/logstash-and-filebeat-config-for-logs-count-more-10-000/49902)
**Author:** [@shubham\_deodia](https://discuss.elastic.co/u/shubham_deodia)\ **Replies:** 1\ **Last updated:** [May 13, 2016, 1:25pm UTC](https://discuss.elastic.co/t/logstash-and-filebeat-config-for-logs-count-more-10-000/49902 "2016-05-13T13:25:22Z")
I am trying to configure my BELK server for large log count( more than 20,000). Currently my config is Logstash: input{ beats{ port =\> 27080 congestion\_threshold =\> 1500 } Filebeat filebeat: … --- ## [Filebeats not rescanning if Elasticsearch index deleted](https://discuss.elastic.co/t/filebeats-not-rescanning-if-elasticsearch-index-deleted/49972)
**Author:** [@James\_Tighe](https://discuss.elastic.co/u/James_Tighe)\ **Replies:** 3\ **Last updated:** [May 13, 2016, 8:47am UTC](https://discuss.elastic.co/t/filebeats-not-rescanning-if-elasticsearch-index-deleted/49972 "2016-05-13T08:47:38Z")
Hi People, Apologies if this has been asked, I did search but couldn't find this issue. I am currently testing a build of the ELK stack to monitor some of our servers. I have decided to use Beats for the log shipping… --- ## [\-httpprof host:port gets me a tcp listen, but always a 404](https://discuss.elastic.co/t/httpprof-host-port-gets-me-a-tcp-listen-but-always-a-404/49917)
**Author:** [@kwmullet](https://discuss.elastic.co/u/kwmullet)\ **Replies:** 2\ **Last updated:** [May 12, 2016, 8:45pm UTC](https://discuss.elastic.co/t/httpprof-host-port-gets-me-a-tcp-listen-but-always-a-404/49917 "2016-05-12T20:45:05Z")
What page do I request to get the profiling information? I'm using filebeat, but as I understand it, the -httpprof switch is available to all the beats. --- ## [Transport.go:125: ERR SSL client failed to connect with: EOF](https://discuss.elastic.co/t/transport-go-125-err-ssl-client-failed-to-connect-with-eof/35272)
**Author:** [@Marco](https://discuss.elastic.co/u/Marco)\ **Replies:** 13\ **Last updated:** [May 12, 2016, 5:00pm UTC](https://discuss.elastic.co/t/transport-go-125-err-ssl-client-failed-to-connect-with-eof/35272 "2016-05-12T17:00:44Z")
I want to migrate from Logstash Forwarder to Filebeat. In my filebeat.yml filebeat: prospectors: - paths: - /var/log/nginxlog/access.20151102.log field: type: nginxaccesslog inpu… --- ## [Analysis logs for security events](https://discuss.elastic.co/t/analysis-logs-for-security-events/48893)
**Author:** [@Kennedy\_Kan1](https://discuss.elastic.co/u/Kennedy_Kan1)\ **Replies:** 9\ **Last updated:** [May 12, 2016, 2:48pm UTC](https://discuss.elastic.co/t/analysis-logs-for-security-events/48893 "2016-05-12T14:48:18Z")
I am new to winlogbeat. How can I analyse Windows Event (espacially in Security , e.g. AD Login, Logout error) with winlogbeat and visualize it? --- ## [How to add custom fields with eventlog on winlogbeat](https://discuss.elastic.co/t/how-to-add-custom-fields-with-eventlog-on-winlogbeat/49855)
**Author:** [@Muhasin\_Cm](https://discuss.elastic.co/u/Muhasin_Cm)\ **Replies:** 1\ **Last updated:** [May 12, 2016, 2:43pm UTC](https://discuss.elastic.co/t/how-to-add-custom-fields-with-eventlog-on-winlogbeat/49855 "2016-05-12T14:43:30Z")
Hi, I have added custom fields for eventlog security but the custom fields are not showing when it send to the logstash server. AM sending the data using winlogbeat from windows 10 home edition. --- ## [Logstash beats input - a lot of 'input: unhandled exception' errors](https://discuss.elastic.co/t/logstash-beats-input-a-lot-of-input-unhandled-exception-errors/49166)
**Author:** [@daniilyar-confyrm](https://discuss.elastic.co/u/daniilyar-confyrm)\ **Replies:** 7\ **Last updated:** [May 12, 2016, 12:19pm UTC](https://discuss.elastic.co/t/logstash-beats-input-a-lot-of-input-unhandled-exception-errors/49166 "2016-05-12T12:19:34Z")
Hello, Logstash guru's, I am using Logstash 2.3.2, filebeat 1.2.2 and logstash-beats-input 2.2.8. I am sending logs with filebeat from 50 servers to a single Logstash server (using beats input). At half servers I … --- ## [Filebeat Installation 0 hits? Troubleshoot](https://discuss.elastic.co/t/filebeat-installation-0-hits-troubleshoot/49784)
**Author:** [@Leonard\_Larios\_Chan](https://discuss.elastic.co/u/Leonard_Larios_Chan)\ **Replies:** 3\ **Last updated:** [May 12, 2016, 11:58am UTC](https://discuss.elastic.co/t/filebeat-installation-0-hits-troubleshoot/49784 "2016-05-12T11:58:43Z")
Hi! I'm new to using the ELK stack and after configuring, installing the ELK stack and finally coming to filebeat, I can't seem to get a hit after running curl -XGET 'http://localhost:9200/filebeat-\*/\_search?pretty' … --- ## [What are the advantages of filebeat 1.2.2 over logstash 2.1.1?](https://discuss.elastic.co/t/what-are-the-advantages-of-filebeat-1-2-2-over-logstash-2-1-1/49593)
**Author:** [@Stuart\_Cracraft1](https://discuss.elastic.co/u/Stuart_Cracraft1)\ **Replies:** 16\ **Last updated:** [May 12, 2016, 11:54am UTC](https://discuss.elastic.co/t/what-are-the-advantages-of-filebeat-1-2-2-over-logstash-2-1-1/49593 "2016-05-12T11:54:39Z")
I get a fair number of crashes of the latter which I have always assumed is because of bugs and the java runtime and that one of the advantages I might enjoy with filebeat is that it is written in Go and perhaps has bett… --- ## [How to match Event ID, Knowledge Base DB with winlogbeat](https://discuss.elastic.co/t/how-to-match-event-id-knowledge-base-db-with-winlogbeat/48891)
**Author:** [@Kennedy\_Kan1](https://discuss.elastic.co/u/Kennedy_Kan1)\ **Replies:** 2\ **Last updated:** [May 12, 2016, 1:38am UTC](https://discuss.elastic.co/t/how-to-match-event-id-knowledge-base-db-with-winlogbeat/48891 "2016-05-12T01:38:55Z")
I am new to Winlogbeat and would like to know how to match Event ID, Knowledge Base DB (https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/default.aspx) with winlogbeat Thanks. --- ## [Topbeats: mem.used\_p vs mem.actual\_used\_p](https://discuss.elastic.co/t/topbeats-mem-used-p-vs-mem-actual-used-p/49341)
**Author:** [@Maxwell\_Flanders](https://discuss.elastic.co/u/Maxwell_Flanders)\ **Replies:** 5\ **Last updated:** [May 11, 2016, 4:40pm UTC](https://discuss.elastic.co/t/topbeats-mem-used-p-vs-mem-actual-used-p/49341 "2016-05-11T16:40:27Z")
What is the difference between these two?? I am seeing some crazy variation between these two numbers, 95% vs. .37, (I presumed meant 37%). Why are these two numbers so out of sync?? --- ## [Moving @timestamp in an optionnal new field](https://discuss.elastic.co/t/moving-timestamp-in-an-optionnal-new-field/49628)
**Author:** [@ericpietro](https://discuss.elastic.co/u/ericpietro)\ **Replies:** 4\ **Last updated:** [May 11, 2016, 2:33pm UTC](https://discuss.elastic.co/t/moving-timestamp-in-an-optionnal-new-field/49628 "2016-05-11T14:33:29Z")
hi, i want to add a new field in my config filebeat and put in it the @timestamp value : fields: harvest\_timestamp: @timestamp but it doesn't work ... my goal, at the end, is to delete the field @timestamp a… --- ## [Filebeat get big log file](https://discuss.elastic.co/t/filebeat-get-big-log-file/49736)
**Author:** [@tatdat](https://discuss.elastic.co/u/tatdat)\ **Replies:** 1\ **Last updated:** [May 11, 2016, 2:13pm UTC](https://discuss.elastic.co/t/filebeat-get-big-log-file/49736 "2016-05-11T14:13:47Z")
I'm using filebeat 1.2.1 I have one fie log iis (6Gb) and many file log (~2000 file/day, 10MB/file). example : In this time, i check in kibana and i saw newest log of the 7 hours ago. I'm using rabbitMQ, I checkd in … --- ## [FIlebeat multiline pattern for Elasticsearch logs?](https://discuss.elastic.co/t/filebeat-multiline-pattern-for-elasticsearch-logs/45398)
**Author:** [@jeffkirk1](https://discuss.elastic.co/u/jeffkirk1)\ **Replies:** 4\ **Last updated:** [May 10, 2016, 9:04pm UTC](https://discuss.elastic.co/t/filebeat-multiline-pattern-for-elasticsearch-logs/45398 "2016-05-10T21:04:33Z")
I managed to puzzle out a multiline filter for Filebeat to parse PostgreSQL CSV replication logs, but I find the docs on multiline pretty lacking in examples. Right now I'm trying to figure out a pattern for merging erro… --- ## [I have ran filebeat but not showing up anything on kibana](https://discuss.elastic.co/t/i-have-ran-filebeat-but-not-showing-up-anything-on-kibana/48046)
**Author:** [@GSL10019](https://discuss.elastic.co/u/GSL10019)\ **Replies:** 18\ **Last updated:** [May 10, 2016, 1:00pm UTC](https://discuss.elastic.co/t/i-have-ran-filebeat-but-not-showing-up-anything-on-kibana/48046 "2016-05-10T13:00:19Z")
Hi, I just ran filebeat with the typical commands of filebeat start within the directory of filebeat. But when i open Kibana with my configured yml, i dont see anything too it but I see my previous defaulted filebeat… --- ## [How to collect performance data related to disk](https://discuss.elastic.co/t/how-to-collect-performance-data-related-to-disk/48615)
**Author:** [@tuankun](https://discuss.elastic.co/u/tuankun)\ **Replies:** 5\ **Last updated:** [May 10, 2016, 1:59am UTC](https://discuss.elastic.co/t/how-to-collect-performance-data-related-to-disk/48615 "2016-05-10T01:59:51Z")
Hi, I want to collect performance data related to disk into ELK,especially physical disk read/write,IOPs,Does anybody know which software or beat could work? thanks so much. --- ## [Duplicate Winlogbeat Events - (Logstash publishing events twice)](https://discuss.elastic.co/t/duplicate-winlogbeat-events-logstash-publishing-events-twice/49271)
**Author:** [@Alexey\_Khudyakov](https://discuss.elastic.co/u/Alexey_Khudyakov)\ **Replies:** 14\ **Last updated:** [May 10, 2016, 6:36am UTC](https://discuss.elastic.co/t/duplicate-winlogbeat-events-logstash-publishing-events-twice/49271 "2016-05-10T06:36:17Z")
Dear Community, I'm evaluating Winlogbeat-5.0.0 alpha 1 and noticed that all events shipped to elasticsearch were duplicated. This issue appears on all events shipped from my Windows servers. I don't know if it bug of … --- ## [Filebeat only goes to one of the Logstash Servers that is behind an ELB](https://discuss.elastic.co/t/filebeat-only-goes-to-one-of-the-logstash-servers-that-is-behind-an-elb/48875)
**Author:** [@gcherneski](https://discuss.elastic.co/u/gcherneski)\ **Replies:** 8\ **Last updated:** [May 9, 2016, 7:15pm UTC](https://discuss.elastic.co/t/filebeat-only-goes-to-one-of-the-logstash-servers-that-is-behind-an-elb/48875 "2016-05-09T19:15:32Z")
I have the following test scenario: Filebeat --\> AWS ELB --\> (2) Logstash servers. Both logstash servers have the exact same configuration. The log output from a single Filebeat server only hit one of the Logstash serve… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=579) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=581)