# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=582 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 583 --- ## [Doese a 'local' filebeat installation makes sense?](https://discuss.elastic.co/t/doese-a-local-filebeat-installation-makes-sense/47353)
**Author:** [@pat7](https://discuss.elastic.co/u/pat7)\ **Replies:** 5\ **Last updated:** [May 3, 2016, 11:14am UTC](https://discuss.elastic.co/t/doese-a-local-filebeat-installation-makes-sense/47353 "2016-05-03T11:14:11Z")
hi, i got a windows server on which i have a network share mounted with several logfiles I want to send to logstash. logstash (and actualy the whole elasticstack) is installed on that same server. I can use file input in… --- ## [Filebeat multiline by Queue ID](https://discuss.elastic.co/t/filebeat-multiline-by-queue-id/47406)
**Author:** [@Joey](https://discuss.elastic.co/u/Joey)\ **Replies:** 10\ **Last updated:** [May 3, 2016, 5:59am UTC](https://discuss.elastic.co/t/filebeat-multiline-by-queue-id/47406 "2016-05-03T05:59:13Z")
Hello Community, I want to filter Postfix log lines and tie them together by Postfix Queue ID. Currently for this purpose I am using Logstash multiline filter in combination with its parameter "stream\_identity". %{que… --- ## [Add set\_real\_ip\_from working with real\_ip\_header just like the nginx way](https://discuss.elastic.co/t/add-set-real-ip-from-working-with-real-ip-header-just-like-the-nginx-way/48496)
**Author:** [@hnlq715](https://discuss.elastic.co/u/hnlq715)\ **Replies:** 2\ **Last updated:** [May 3, 2016, 2:34am UTC](https://discuss.elastic.co/t/add-set-real-ip-from-working-with-real-ip-header-just-like-the-nginx-way/48496 "2016-05-03T02:34:11Z")
http://nginx.org/en/docs/http/ngx\_http\_realip\_module.html We nedd to define trusted addresses that are known to send correct replacement addresses. --- ## [Running multiple filebeat instances](https://discuss.elastic.co/t/running-multiple-filebeat-instances/48995)
**Author:** [@reinier](https://discuss.elastic.co/u/reinier)\ **Replies:** 2\ **Last updated:** [May 2, 2016, 11:55pm UTC](https://discuss.elastic.co/t/running-multiple-filebeat-instances/48995 "2016-05-02T23:55:36Z")
Hi, I am currently using Filebeat to send both NGINX and Syslog towards an ELK stack, which works perfectly. Nice! Now I am trying to add OSSEC to the equation. The OSSEC files are in JSON format, while the other logs … --- ## [Can filebeat buffer data for a second?](https://discuss.elastic.co/t/can-filebeat-buffer-data-for-a-second/48941)
**Author:** [@mathias](https://discuss.elastic.co/u/mathias)\ **Replies:** 2\ **Last updated:** [May 2, 2016, 11:03pm UTC](https://discuss.elastic.co/t/can-filebeat-buffer-data-for-a-second/48941 "2016-05-02T23:03:18Z")
Hi, I believe my performance problems with filebeat and logstash are due too many events in short time. I have notice in other systems that performance is improved when I buffer my events and upload the buffer once per… --- ## [Packet beat eats up 3GB of ram when running for a while](https://discuss.elastic.co/t/packet-beat-eats-up-3gb-of-ram-when-running-for-a-while/48333)
**Author:** [@MikeC](https://discuss.elastic.co/u/MikeC)\ **Replies:** 4\ **Last updated:** [May 2, 2016, 10:50pm UTC](https://discuss.elastic.co/t/packet-beat-eats-up-3gb-of-ram-when-running-for-a-while/48333 "2016-05-02T22:50:39Z")
Hi, i've got packetbeat installed on a server and it sends its measurements to an elastic cluster (4 nodes, 12GB ram). After a while (and on one particular server) packetbeat consumes 2-3GB RAM of memory and it makes t… --- ## [Pachetbeat: not deterministic src/dst assignment](https://discuss.elastic.co/t/pachetbeat-not-deterministic-src-dst-assignment/48851)
**Author:** [@kofemann](https://discuss.elastic.co/u/kofemann)\ **Replies:** 2\ **Last updated:** [May 2, 2016, 7:01pm UTC](https://discuss.elastic.co/t/pachetbeat-not-deterministic-src-dst-assignment/48851 "2016-05-02T19:01:04Z")
Hi folks, With NFS beat we have notice that some time client and server ip addresses are mixed up. My understanding is that roles are assigned when a first packet is seen btypacketbeat. If you are in the middle of th… --- ## [Mysterious 'offset' and 'count' fields](https://discuss.elastic.co/t/mysterious-offset-and-count-fields/48981)
**Author:** [@CraigFoote](https://discuss.elastic.co/u/CraigFoote)\ **Replies:** 3\ **Last updated:** [May 2, 2016, 5:18pm UTC](https://discuss.elastic.co/t/mysterious-offset-and-count-fields/48981 "2016-05-02T17:18:39Z")
I'm getting these two fields in my data but I don't know where they're coming from. Are they put there by filebeat? How can I get rid of them? --- ## [Calculating delay of sending/processing delay of events](https://discuss.elastic.co/t/calculating-delay-of-sending-processing-delay-of-events/48799)
**Author:** [@hartfordfive](https://discuss.elastic.co/u/hartfordfive)\ **Replies:** 3\ **Last updated:** [May 2, 2016, 4:53pm UTC](https://discuss.elastic.co/t/calculating-delay-of-sending-processing-delay-of-events/48799 "2016-05-02T16:53:19Z")
We currently have an ELK cluster which supports multiple tenants and each tenant sends their logs to our Logstash cluster via the Filebeat shipper. We try to provide our tenants with stats of what the average processin… --- ## [Reliability of Packetbeat Logs](https://discuss.elastic.co/t/reliability-of-packetbeat-logs/48880)
**Author:** [@Mohannad\_Saeed](https://discuss.elastic.co/u/Mohannad_Saeed)\ **Replies:** 2\ **Last updated:** [May 2, 2016, 4:46pm UTC](https://discuss.elastic.co/t/reliability-of-packetbeat-logs/48880 "2016-05-02T16:46:07Z")
Greetings, There is a setting in the configuration template of Packetbeat on Github, where one can instruct Packetbeat to output logs to a local file. Two questions regarding this setting: Is it guaranteed to have… --- ## [Introducing mysqlbeat](https://discuss.elastic.co/t/introducing-mysqlbeat/48890)
**Author:** [@adi.b](https://discuss.elastic.co/u/adi.b)\ **Replies:** 5\ **Last updated:** [May 2, 2016, 9:25am UTC](https://discuss.elastic.co/t/introducing-mysqlbeat/48890 "2016-05-02T09:25:17Z")
Hi Guys, I looked for something to expand the MySQL packetbeat dashboard with no luck so I decided to do it myself :grin: I wrote a new beat that can connect to a MySQL server and ship any result from the queries define… --- ## [Windows - packetbeat service failed to start](https://discuss.elastic.co/t/windows-packetbeat-service-failed-to-start/29523)
**Author:** [@inlikefletch](https://discuss.elastic.co/u/inlikefletch)\ **Replies:** 14\ **Last updated:** [May 2, 2016, 8:12am UTC](https://discuss.elastic.co/t/windows-packetbeat-service-failed-to-start/29523 "2016-05-02T08:12:33Z")
Hi, I am having trouble starting the packetbeat service on my application servers and local elk stack. Even if I install on my local elasticsearch server, windows server, keep the default yml file because those configura… --- ## [Filebeat harvesting issue](https://discuss.elastic.co/t/filebeat-harvesting-issue/48859)
**Author:** [@Ramesh\_Narasimhan](https://discuss.elastic.co/u/Ramesh_Narasimhan)\ **Replies:** 1\ **Last updated:** [May 2, 2016, 7:24am UTC](https://discuss.elastic.co/t/filebeat-harvesting-issue/48859 "2016-05-02T07:24:41Z")
My filebeat configuration has been working fine. But it suddenly stopped working now. I have updated to the latest version of filebeat, restarted filebeat instance, restarted my application instance. but still no luck.f… --- ## [Custom beat - re-use Filebeat log readers?](https://discuss.elastic.co/t/custom-beat-re-use-filebeat-log-readers/48868)
**Author:** [@jason26](https://discuss.elastic.co/u/jason26)\ **Replies:** 3\ **Last updated:** [April 30, 2016, 9:18pm UTC](https://discuss.elastic.co/t/custom-beat-re-use-filebeat-log-readers/48868 "2016-04-30T21:18:52Z")
I'm creating a new beat application, primarily to remove the logstash requirements for getting this data into Elastic Search. The file being read is new line delimited JSON, and gets rotated by logrotate. Anyone reusi… --- ## [Docker\[ELK+Filebeat\] =\> No logs](https://discuss.elastic.co/t/docker-elk-filebeat-no-logs/40946)
**Author:** [@Ragnar](https://discuss.elastic.co/u/Ragnar)\ **Replies:** 10\ **Last updated:** [April 29, 2016, 2:48pm UTC](https://discuss.elastic.co/t/docker-elk-filebeat-no-logs/40946 "2016-04-29T14:48:42Z")
Hi everyone, I'm learning how to use ELK so I decided to do my own Hello world. I planned to make some graph with my syslog/auth.log I also decided to put every services in a Docker's container. I set up everything… --- ## [Warning on Packetbeats](https://discuss.elastic.co/t/warning-on-packetbeats/48754)
**Author:** [@Kennedy\_Kan](https://discuss.elastic.co/u/Kennedy_Kan)\ **Replies:** 1\ **Last updated:** [April 29, 2016, 9:25am UTC](https://discuss.elastic.co/t/warning-on-packetbeats/48754 "2016-04-29T09:25:27Z")
up vote 0 down vote favorite I have set up packetbeats in grepping MYSQL server but it keeps prompt up warning when running packetbeats. Does anyone have any measures for it? Here is the warning: 2016/04/29 01:20:41.… --- ## [Flowbeats fails in go build](https://discuss.elastic.co/t/flowbeats-fails-in-go-build/48601)
**Author:** [@tbernhardson](https://discuss.elastic.co/u/tbernhardson)\ **Replies:** 4\ **Last updated:** [April 28, 2016, 10:11pm UTC](https://discuss.elastic.co/t/flowbeats-fails-in-go-build/48601 "2016-04-28T22:11:51Z")
working on getting flowbeats installed to collect sflow data. working through the install steps listed in github when I get to the step of "go build" it returns: beater/flowbeat.go:52: b.Events undefined (type \*beat.Beat… --- ## [PacketBeat: responsetime is being set 0](https://discuss.elastic.co/t/packetbeat-responsetime-is-being-set-0/48194)
**Author:** [@Rachit\_Puri](https://discuss.elastic.co/u/Rachit_Puri)\ **Replies:** 6\ **Last updated:** [April 28, 2016, 9:47pm UTC](https://discuss.elastic.co/t/packetbeat-responsetime-is-being-set-0/48194 "2016-04-28T21:47:40Z")
Hi, I am using packetbeat to dump mysql,http and redis request using a port mirror. I can see a lot of variation in the response time being set and many of my packets are getting lost. Can, some one guide me to use the… --- ## [Specify a Reverse proxy endpoint in FileBeat configuration](https://discuss.elastic.co/t/specify-a-reverse-proxy-endpoint-in-filebeat-configuration/48652)
**Author:** [@ramkchirra](https://discuss.elastic.co/u/ramkchirra)\ **Replies:** 2\ **Last updated:** [April 28, 2016, 1:09pm UTC](https://discuss.elastic.co/t/specify-a-reverse-proxy-endpoint-in-filebeat-configuration/48652 "2016-04-28T13:09:53Z")
Hi, I am very new to ELK stack. Actually i want to configure Filebeat(Client) in a way that it can directly talk to ElasticSearch present on a WebServer and whose endpoint is exposed through a Reverse proxy. If i… --- ## [Multiple beats input ports](https://discuss.elastic.co/t/multiple-beats-input-ports/48589)
**Author:** [@tbernhardson](https://discuss.elastic.co/u/tbernhardson)\ **Replies:** 3\ **Last updated:** [April 27, 2016, 9:31pm UTC](https://discuss.elastic.co/t/multiple-beats-input-ports/48589 "2016-04-27T21:31:00Z")
due to needing to support some old systems that do not support TLS 1.1 or 1.2, I would like to have 2 separate Ports defined for beats (1 for SSL/TLS, 1 with no encryption). I have tried a couple of things (2 inputs de… --- ## [Certificate issue for filebeat](https://discuss.elastic.co/t/certificate-issue-for-filebeat/48556)
**Author:** [@sunilmchaudhari](https://discuss.elastic.co/u/sunilmchaudhari)\ **Replies:** 1\ **Last updated:** [April 27, 2016, 2:33pm UTC](https://discuss.elastic.co/t/certificate-issue-for-filebeat/48556 "2016-04-27T14:33:16Z")
Hi, I am migrating from LSF to filebeat. In LSF, I used to put only my-issuing.cer.pem file. However in FB, there are three options given under TLS prospector in output-logsatsh. Which is required? --- ## [Unable to filter more than 22 eventIDs](https://discuss.elastic.co/t/unable-to-filter-more-than-22-eventids/48358)
**Author:** [@Alreanaes](https://discuss.elastic.co/u/Alreanaes)\ **Replies:** 2\ **Last updated:** [April 27, 2016, 12:53pm UTC](https://discuss.elastic.co/t/unable-to-filter-more-than-22-eventids/48358 "2016-04-27T12:53:08Z")
The relevant output from -e -d "\*" DBG WinEventLog\[ForwardedEvents\] using subscription query=\ \ \