# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=581 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 582 --- ## [Filebeat Preprocess](https://discuss.elastic.co/t/filebeat-preprocess/49563)
**Author:** [@Tim\_Brammer](https://discuss.elastic.co/u/Tim_Brammer)\ **Replies:** 1\ **Last updated:** [May 9, 2016, 3:19pm UTC](https://discuss.elastic.co/t/filebeat-preprocess/49563 "2016-05-09T15:19:33Z")
Hi All, I've got some logs with sensitive data in them that I'd like to exclude before shipping them. I know I can remove entire lines, but the sensitive data is just a portion of the line, the rest of which I need. I… --- ## [How do I reset the "file pointer" in filebeats](https://discuss.elastic.co/t/how-do-i-reset-the-file-pointer-in-filebeats/49440)
**Author:** [@elastic1622](https://discuss.elastic.co/u/elastic1622)\ **Replies:** 2\ **Last updated:** [May 9, 2016, 3:16pm UTC](https://discuss.elastic.co/t/how-do-i-reset-the-file-pointer-in-filebeats/49440 "2016-05-09T15:16:52Z")
Hello I have filebeats forwarding logs to logstash/ELK. I have spent time developing, debugging, and getting visualizations up, and would now like to process all log files in their entirety once again. This is a simi… --- ## [File beat fails to send events to logstash](https://discuss.elastic.co/t/file-beat-fails-to-send-events-to-logstash/48885)
**Author:** [@sarathymv](https://discuss.elastic.co/u/sarathymv)\ **Replies:** 16\ **Last updated:** [May 9, 2016, 1:40pm UTC](https://discuss.elastic.co/t/file-beat-fails-to-send-events-to-logstash/48885 "2016-05-09T13:40:42Z")
File beat is not sending events to logstash after a while. Initially when i setup the filebeat (three instances) it was successfully sending the events to logstash after a couple of hours it thrown an error message "send… --- ## [Error Initialising publisher: No outputs are defined. Please define one under the output section](https://discuss.elastic.co/t/error-initialising-publisher-no-outputs-are-defined-please-define-one-under-the-output-section/49482)
**Author:** [@shubham\_deodia](https://discuss.elastic.co/u/shubham_deodia)\ **Replies:** 4\ **Last updated:** [May 9, 2016, 1:38pm UTC](https://discuss.elastic.co/t/error-initialising-publisher-no-outputs-are-defined-please-define-one-under-the-output-section/49482 "2016-05-09T13:38:19Z")
Hi, I am new to ELK Stack. I am trying to implement it Using Windows (ELK Server ) and Vagrant Unix CentOS VM ( Filebeat Shipper ) For starters, I am trying to ship Unix Syslog to ELK server and see how it works I ha… --- ## [How could winlogbeat 5.0 support chinese character?](https://discuss.elastic.co/t/how-could-winlogbeat-5-0-support-chinese-character/49524)
**Author:** [@zhanght1](https://discuss.elastic.co/u/zhanght1)\ **Replies:** 1\ **Last updated:** [May 9, 2016, 1:20pm UTC](https://discuss.elastic.co/t/how-could-winlogbeat-5-0-support-chinese-character/49524 "2016-05-09T13:20:03Z")
How could winlogbeat 5.0 support chinese character? BR --- ## [Filebeat to redis using multiple keys for different document types](https://discuss.elastic.co/t/filebeat-to-redis-using-multiple-keys-for-different-document-types/49526)
**Author:** [@tsegal](https://discuss.elastic.co/u/tsegal)\ **Replies:** 1\ **Last updated:** [May 9, 2016, 10:26am UTC](https://discuss.elastic.co/t/filebeat-to-redis-using-multiple-keys-for-different-document-types/49526 "2016-05-09T10:26:09Z")
Hi all, I am using filebeat to ship logs from a centralized log server. In the prospectors section, I defined multiple files, each with its own type, for example: paths: -/tmp/manager.log input\_type:log document\_… --- ## [Filebeats is not detecting new log entries](https://discuss.elastic.co/t/filebeats-is-not-detecting-new-log-entries/49371)
**Author:** [@kpocalypse](https://discuss.elastic.co/u/kpocalypse)\ **Replies:** 4\ **Last updated:** [May 9, 2016, 9:45am UTC](https://discuss.elastic.co/t/filebeats-is-not-detecting-new-log-entries/49371 "2016-05-09T09:45:50Z")
OS: CENTOS 6 kernel 2.6.32-573.12.1.el6.x86\_64 Filebeats: filebeat-5.0.0-alpha2-x86\_64 I am trying to run filebeats with the kafka output, and have run into issues. When I start filebeats, it will harvest the files u… --- ## [Is FileBeat Alive?](https://discuss.elastic.co/t/is-filebeat-alive/49121)
**Author:** [@ori.rubinfeld](https://discuss.elastic.co/u/ori.rubinfeld)\ **Replies:** 13\ **Last updated:** [May 9, 2016, 8:31am UTC](https://discuss.elastic.co/t/is-filebeat-alive/49121 "2016-05-09T08:31:16Z")
Hi, I am having Filebeat running on Windows Servers Reading many log files on each server. The data is being sent to RHEL Servers running the Logstash and Elasticsearch. I would like to have a way in which I will be … --- ## [Filebeat locking Files older than IGNORE\_OLDER value](https://discuss.elastic.co/t/filebeat-locking-files-older-than-ignore-older-value/49276)
**Author:** [@ori.rubinfeld](https://discuss.elastic.co/u/ori.rubinfeld)\ **Replies:** 2\ **Last updated:** [May 9, 2016, 8:27am UTC](https://discuss.elastic.co/t/filebeat-locking-files-older-than-ignore-older-value/49276 "2016-05-09T08:27:51Z")
Hi, We have filebeat version 1.1.2 installed on windows servers. Monitoring Logs from Weblogic applications. The IGNORE\_OLDER value for the prospectors is 2h But, however it seems that Filebeat is locking even older … --- ## [Additional fields using FileBeat Configuration](https://discuss.elastic.co/t/additional-fields-using-filebeat-configuration/49519)
**Author:** [@ramkchirra](https://discuss.elastic.co/u/ramkchirra)\ **Replies:** 1\ **Last updated:** [May 9, 2016, 7:48am UTC](https://discuss.elastic.co/t/additional-fields-using-filebeat-configuration/49519 "2016-05-09T07:48:52Z")
I have my log message something like this 16:43:47 || INFO : ROTS Machine runup to 220kV @ 200µA I want to plot the Voltage(kV) and Current (micro Ampere) on Y Axis in 2 different charts in Kibana. So i need the Volt… --- ## [Filebeat Inserts \\t in place of tabs](https://discuss.elastic.co/t/filebeat-inserts-t-in-place-of-tabs/49242)
**Author:** [@sghosh](https://discuss.elastic.co/u/sghosh)\ **Replies:** 3\ **Last updated:** [May 9, 2016, 5:55am UTC](https://discuss.elastic.co/t/filebeat-inserts-t-in-place-of-tabs/49242 "2016-05-09T05:55:57Z")
Hi All, I am trying to ship logs from servers via filebeat. I faced an issue like this: Whenever FB forwards log events to remote LS it inserts the literal string \\t in place of tab characters. This messes up the l… --- ## [Add Winlogbeat option to truncate Security 'message' field to just first line](https://discuss.elastic.co/t/add-winlogbeat-option-to-truncate-security-message-field-to-just-first-line/49409)
**Author:** [@cknz](https://discuss.elastic.co/u/cknz)\ **Replies:** 1\ **Last updated:** [May 6, 2016, 2:30pm UTC](https://discuss.elastic.co/t/add-winlogbeat-option-to-truncate-security-message-field-to-just-first-line/49409 "2016-05-06T14:30:04Z")
I'm currently sending the Active Directory audit logs for our large network to my ELK stack (currently 4 VMs, but I have new hardware to deploy and an opportunity to do things better), which works fairly nicely, but boy,… --- ## [Filebeat Output error while using file](https://discuss.elastic.co/t/filebeat-output-error-while-using-file/49268)
**Author:** [@prakashkumar](https://discuss.elastic.co/u/prakashkumar)\ **Replies:** 9\ **Last updated:** [May 6, 2016, 1:04pm UTC](https://discuss.elastic.co/t/filebeat-output-error-while-using-file/49268 "2016-05-06T13:04:12Z")
PS C:\\Program Files\\Filebeat\> ./filebeat -e -c filebeat0.yml -d "publish" 2016/05/05 07:26:16.287762 geolite.go:24: INFO GeoIP disabled: No paths were set under output.geoip.paths 2016/05/05 07:26:16.287762 logstash.go:1… --- ## [How to monitor Elasticsearch?](https://discuss.elastic.co/t/how-to-monitor-elasticsearch/49044)
**Author:** [@john\_6](https://discuss.elastic.co/u/john_6)\ **Replies:** 2\ **Last updated:** [May 6, 2016, 9:58am UTC](https://discuss.elastic.co/t/how-to-monitor-elasticsearch/49044 "2016-05-06T09:58:44Z")
I can't see any way to monitor Elasticsearch network traffic with Packetbeat. Is this possible? I don't mean the ES instance that logstash uses, but other instances in our application. It seems like the most obvious us… --- ## [Filebeat Windows support](https://discuss.elastic.co/t/filebeat-windows-support/49258)
**Author:** [@sunilmchaudhari](https://discuss.elastic.co/u/sunilmchaudhari)\ **Replies:** 1\ **Last updated:** [May 5, 2016, 7:29am UTC](https://discuss.elastic.co/t/filebeat-windows-support/49258 "2016-05-05T07:29:11Z")
Hi, I was referring to below page. ES-Suport matrix Here I saw, filebeat and windows matrix. it says \*2 ( Binary provided but not supported) Please explain meaning of not supported. br, Sunil --- ## [Mac hostname showing as 'localhost'](https://discuss.elastic.co/t/mac-hostname-showing-as-localhost/48878)
**Author:** [@DPattee](https://discuss.elastic.co/u/DPattee)\ **Replies:** 4\ **Last updated:** [May 5, 2016, 3:57am UTC](https://discuss.elastic.co/t/mac-hostname-showing-as-localhost/48878 "2016-05-05T03:57:14Z")
Two Mac OS X machines set up to report statistics via TopBeat 1.2.1 (amd64). One of those machines is the one that Elastic runs on. Same topbeat config file on both machines. The elastic search: hosts: line is set to … --- ## [DNS lookup failure: host in /etchosts](https://discuss.elastic.co/t/dns-lookup-failure-host-in-etchosts/49111)
**Author:** [@carrot](https://discuss.elastic.co/u/carrot)\ **Replies:** 2\ **Last updated:** [May 4, 2016, 3:55pm UTC](https://discuss.elastic.co/t/dns-lookup-failure-host-in-etchosts/49111 "2016-05-04T15:55:01Z")
I provisioned the destination hostname in /etc/hosts for testing, but looks like filebeat doesn't honor /etc/hosts entries... Just asking first before putting a bug. Seems like it's not using the normal Linux resolvers. … --- ## [Filebeat Multiline problem](https://discuss.elastic.co/t/filebeat-multiline-problem/49178)
**Author:** [@sunilmchaudhari](https://discuss.elastic.co/u/sunilmchaudhari)\ **Replies:** 1\ **Last updated:** [May 4, 2016, 2:27pm UTC](https://discuss.elastic.co/t/filebeat-multiline-problem/49178 "2016-05-04T14:27:15Z")
Hi, I am facing problem in multiline handling in Fileebeat. below is the Error statcktrace: 2016-05-04 16:14:04,376 \[http-bio-8443-exec-16\] \[username 87527E1A8A32B2F0CE4955E6598CC98D\] ERROR com.tieto.its.sb.service.A… --- ## [Filebeat not pushing on Logstash,](https://discuss.elastic.co/t/filebeat-not-pushing-on-logstash/49073)
**Author:** [@nitesh](https://discuss.elastic.co/u/nitesh)\ **Replies:** 19\ **Last updated:** [May 4, 2016, 12:57pm UTC](https://discuss.elastic.co/t/filebeat-not-pushing-on-logstash/49073 "2016-05-04T12:57:36Z")
I am trying to provide logs from filebeat to logstash. But they are not sent and at server side if I try : curl -XGET 'http://localhost:9200/filebeat-\*/\_search?pretty' { "took" : 1, "timed\_out" : false, "\_shards… --- ## [Regarding reading the filebeat output to a file as input to logstash](https://discuss.elastic.co/t/regarding-reading-the-filebeat-output-to-a-file-as-input-to-logstash/48955)
**Author:** [@vivc](https://discuss.elastic.co/u/vivc)\ **Replies:** 7\ **Last updated:** [May 4, 2016, 5:34am UTC](https://discuss.elastic.co/t/regarding-reading-the-filebeat-output-to-a-file-as-input-to-logstash/48955 "2016-05-04T05:34:00Z")
when we store filebeat data to logstash and apply filters and then ouput into a file & again pass file data as input to logstash and then to elasticsearch, all the fields will be merged into one field w. How can we … --- ## [Custom fields posibility](https://discuss.elastic.co/t/custom-fields-posibility/48575)
**Author:** [@Bruno\_Lavoie](https://discuss.elastic.co/u/Bruno_Lavoie)\ **Replies:** 3\ **Last updated:** [May 4, 2016, 2:28am UTC](https://discuss.elastic.co/t/custom-fields-posibility/48575 "2016-05-04T02:28:40Z")
Hello, We're using a lot filebeat to scrape log files and send them to our ELK infrastructure. We're sending logs from many systems, and want them isolated by their own indices. With filebeat, it's easy: we use the f… --- ## [TOPBEAT: Does not show fields sometime](https://discuss.elastic.co/t/topbeat-does-not-show-fields-sometime/49067)
**Author:** [@krushnat\_khawale](https://discuss.elastic.co/u/krushnat_khawale)\ **Replies:** 1\ **Last updated:** [May 3, 2016, 10:49pm UTC](https://discuss.elastic.co/t/topbeat-does-not-show-fields-sometime/49067 "2016-05-03T22:49:11Z")
Hi { ELK WORLD }, I am using topbeat for monitoring server health. It successfully sends the data of a remote server and I'm also able to use dashboard on it. However it is observed that, It doesn't show some of th… --- ## [Help with Filebeat RegEx Match](https://discuss.elastic.co/t/help-with-filebeat-regex-match/48494)
**Author:** [@gcherneski](https://discuss.elastic.co/u/gcherneski)\ **Replies:** 3\ **Last updated:** [May 3, 2016, 9:34pm UTC](https://discuss.elastic.co/t/help-with-filebeat-regex-match/48494 "2016-05-03T21:34:17Z")
Version: Filebeat 1.2.0-x86-64 I'm new to ELK and Filebeat and read online that it is preferable to do your multiline parsing in Filebeat as opposed to Logstash. I could use help with a RegEx parsing match for Filebeat m… --- ## [Not harvesting, file didn't change](https://discuss.elastic.co/t/not-harvesting-file-didnt-change/49021)
**Author:** [@thyfere](https://discuss.elastic.co/u/thyfere)\ **Replies:** 1\ **Last updated:** [May 3, 2016, 9:00pm UTC](https://discuss.elastic.co/t/not-harvesting-file-didnt-change/49021 "2016-05-03T21:00:32Z")
I was not getting replies on my older thread https://discuss.elastic.co/t/shipping-logs-from-multiple-files/48881/15; therefore, opening a new one. I am seeing these logs: Check file for harvesting Update existing f… --- ## [Topbeat - Email Alerts](https://discuss.elastic.co/t/topbeat-email-alerts/49003)
**Author:** [@Sameer\_Panicker](https://discuss.elastic.co/u/Sameer_Panicker)\ **Replies:** 4\ **Last updated:** [May 3, 2016, 12:57pm UTC](https://discuss.elastic.co/t/topbeat-email-alerts/49003 "2016-05-03T12:57:36Z")
Can anyone let me know how can I set email alerts if "fs.free" or my HDD free space is less than 5GB? Also, I would like to get one email per every 30mins, rather getting bulk emails? --- ## [Indexing on the basis of fields in filebeat.yml](https://discuss.elastic.co/t/indexing-on-the-basis-of-fields-in-filebeat-yml/48684)
**Author:** [@sunilmchaudhari](https://discuss.elastic.co/u/sunilmchaudhari)\ **Replies:** 12\ **Last updated:** [May 3, 2016, 11:59am UTC](https://discuss.elastic.co/t/indexing-on-the-basis-of-fields-in-filebeat-yml/48684 "2016-05-03T11:59:10Z")
Hi, I am using FB to send logs to LS-Shipper. Event processing pipeline is FB-LS-Shipper-\>Redis-\>LS-Indexer-\>nGinx--\>ES Below is FB configuration. Note: I have created one field Application with 'A' in uppercase. f… --- ## [How can I monitor MSSQL with network traffic the same time with packetbeat?](https://discuss.elastic.co/t/how-can-i-monitor-mssql-with-network-traffic-the-same-time-with-packetbeat/49038)
**Author:** [@Kennedy\_Kan1](https://discuss.elastic.co/u/Kennedy_Kan1)\ **Replies:** 1\ **Last updated:** [May 3, 2016, 11:58am UTC](https://discuss.elastic.co/t/how-can-i-monitor-mssql-with-network-traffic-the-same-time-with-packetbeat/49038 "2016-05-03T11:58:20Z")
I would wonder how can I do that. Is it a must for me to install logstash in order to do that or I can just directly communicate with elasticsearch? The folowing is my json file for packetbeat { "mappings": { "defa… --- ## [Multiline isn't working](https://discuss.elastic.co/t/multiline-isnt-working/48172)
**Author:** [@jervdv](https://discuss.elastic.co/u/jervdv)\ **Replies:** 5\ **Last updated:** [May 3, 2016, 11:53am UTC](https://discuss.elastic.co/t/multiline-isnt-working/48172 "2016-05-03T11:53:08Z")
I honestly have no idea why my multiline isn't working and here is a sample of my multiline config multiline: pattern: ^INFO \\| jvm 1 \\| main \\| \[0-9\]{4}\\/\[0-9\]{2}\\/\[0-9\]{2} \[0-9\]{2}:\[0-9\]{2}:\[0-9\]{2}.\[0-9\]… --- ## [Filebeat Multiline Tutorial](https://discuss.elastic.co/t/filebeat-multiline-tutorial/49034)
**Author:** [@jervdv](https://discuss.elastic.co/u/jervdv)\ **Replies:** 1\ **Last updated:** [May 3, 2016, 11:25am UTC](https://discuss.elastic.co/t/filebeat-multiline-tutorial/49034 "2016-05-03T11:25:14Z")
I'm trying out the filebeat tutorial ( https://www.elastic.co/guide/en/beats/filebeat/current/configuration-filebeat-options.html ) again after i was stuck with my own pattern. Filebeat still sends the logs as different … --- ## [Pgsql invalid column\_length](https://discuss.elastic.co/t/pgsql-invalid-column-length/48624)
**Author:** [@ceekay](https://discuss.elastic.co/u/ceekay)\ **Replies:** 3\ **Last updated:** [May 3, 2016, 11:24am UTC](https://discuss.elastic.co/t/pgsql-invalid-column-length/48624 "2016-05-03T11:24:46Z")
Hi there, I'm running Packetbeat 5.0.0~alpha1, and getting a lot of entries like the following in syslog: Apr 28 16:04:08 cat-pg92 /usr/bin/packetbeat\[30951\]: parse.go:531: Pgsql invalid column\_length=4294967295, buff… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=580) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=582)