# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=583 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 584 --- ## [Filebeat 5.x : Dependencies](https://discuss.elastic.co/t/filebeat-5-x-dependencies/47394)
**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 6\ **Last updated:** [April 25, 2016, 7:51pm UTC](https://discuss.elastic.co/t/filebeat-5-x-dependencies/47394 "2016-04-25T19:51:46Z")
Hi, Does filebeat 5.0 require a minimum version of logstash? I'm using logstash 2.1.x... Regards, David --- ## [Distributed Packetbeats](https://discuss.elastic.co/t/distributed-packetbeats/48175)
**Author:** [@OucemaBellagha](https://discuss.elastic.co/u/OucemaBellagha)\ **Replies:** 3\ **Last updated:** [April 25, 2016, 2:29pm UTC](https://discuss.elastic.co/t/distributed-packetbeats/48175 "2016-04-25T14:29:54Z")
Hello everyone, I have a configuration of 3 servers: 1-ElaticSearch+kibana+logstash 2-Topbeat ,filebeat and Packetbeat with a (web server and a website connected to a remote MySQL DB in the 3rd server), and MySQL DB … --- ## [Logstash output load balancing and workers settings](https://discuss.elastic.co/t/logstash-output-load-balancing-and-workers-settings/48176)
**Author:** [@Bruno\_Lavoie](https://discuss.elastic.co/u/Bruno_Lavoie)\ **Replies:** 4\ **Last updated:** [April 25, 2016, 1:03pm UTC](https://discuss.elastic.co/t/logstash-output-load-balancing-and-workers-settings/48176 "2016-04-25T13:03:39Z")
Hello, I have a filebeat agent that will be sending quite a lot of access log data and our current setup have 4 receiving logstash hosts. I would like to benefit from these to gain a maximum throughput. When I read th… --- ## [Crashing 5.0.0-alpha1](https://discuss.elastic.co/t/crashing-5-0-0-alpha1/48212)
**Author:** [@LoungeFlyZ](https://discuss.elastic.co/u/LoungeFlyZ)\ **Replies:** 1\ **Last updated:** [April 25, 2016, 7:31am UTC](https://discuss.elastic.co/t/crashing-5-0-0-alpha1/48212 "2016-04-25T07:31:18Z")
I am hitting a problem where filebeat is crashing 5.0.0-alpha1 like this: panic: runtime error: invalid memory address or nil pointer dereference \[signal 0xb code=0x1 addr=0xa0 pc=0x4bb6a2\] goroutine 25 \[running\]: pa… --- ## [Beat Dashboard % change](https://discuss.elastic.co/t/beat-dashboard-change/48190)
**Author:** [@Zfs](https://discuss.elastic.co/u/Zfs)\ **Replies:** 0\ **Last updated:** [April 22, 2016, 4:41pm UTC](https://discuss.elastic.co/t/beat-dashboard-change/48190 "2016-04-22T16:41:20Z")
I was looking at the topbeats dashboard 1.2.1 and I noticed that for the first minute or so the CPU and Memory % were being displayed out of 100, I checked back later and now everything has scaled down to 1. So CPU usage… --- ## [Simplifying Filebeat JSON Output Format](https://discuss.elastic.co/t/simplifying-filebeat-json-output-format/48085)
**Author:** [@rzaakir](https://discuss.elastic.co/u/rzaakir)\ **Replies:** 2\ **Last updated:** [April 22, 2016, 1:56pm UTC](https://discuss.elastic.co/t/simplifying-filebeat-json-output-format/48085 "2016-04-22T13:56:44Z")
Hello, I am new working with Filebeat and think it is a wonderful tool. I am currently using it to replace a tool that pushes weblogs to Kafka, and I want to just pass the "message" through without the other values. Is… --- ## [Method to allow for Prometheus scraping?](https://discuss.elastic.co/t/method-to-allow-for-prometheus-scraping/48093)
**Author:** [@TimBanks](https://discuss.elastic.co/u/TimBanks)\ **Replies:** 1\ **Last updated:** [April 22, 2016, 12:29pm UTC](https://discuss.elastic.co/t/method-to-allow-for-prometheus-scraping/48093 "2016-04-22T12:29:33Z")
I would like to be able to use beats to push to logstash, as well as to post to http so that it could be scraped by prometheus. Looking through the docs, I see that beats has an http server for profiling. Would it be pos… --- ## [Optional fields in filebeat](https://discuss.elastic.co/t/optional-fields-in-filebeat/48048)
**Author:** [@sunilmchaudhari](https://discuss.elastic.co/u/sunilmchaudhari)\ **Replies:** 3\ **Last updated:** [April 22, 2016, 5:46am UTC](https://discuss.elastic.co/t/optional-fields-in-filebeat/48048 "2016-04-22T05:46:16Z")
Hi, I was using LSF with below extra fields in LSF.conf type and Application as below. { "paths": \[ "C:/logs/user-mgmt/user-mgmt.log" \], "fields": { "type": "iam-logs","Application":"iam" } } And I was creating ti… --- ## [Can we have interface name also stamped on each event?](https://discuss.elastic.co/t/can-we-have-interface-name-also-stamped-on-each-event/48054)
**Author:** [@harshafrnd4u](https://discuss.elastic.co/u/harshafrnd4u)\ **Replies:** 2\ **Last updated:** [April 22, 2016, 5:42am UTC](https://discuss.elastic.co/t/can-we-have-interface-name-also-stamped-on-each-event/48054 "2016-04-22T05:42:25Z")
Hi, Is there any way to stamp interface name on each event generated by packetbeat ? Thanks Harsha --- ## [Winlogbeat not sending larger event message](https://discuss.elastic.co/t/winlogbeat-not-sending-larger-event-message/48053)
**Author:** [@jyothi.kadiri](https://discuss.elastic.co/u/jyothi.kadiri)\ **Replies:** 5\ **Last updated:** [April 21, 2016, 3:04pm UTC](https://discuss.elastic.co/t/winlogbeat-not-sending-larger-event-message/48053 "2016-04-21T15:04:03Z")
Receiving the below error message The data area passed to a system call is too small. is received in kibana in message\_error field. Any suggestions are apprecited. Is there any setting at winlogbeat to increase the m… --- ## [Documentation of filebeat](https://discuss.elastic.co/t/documentation-of-filebeat/48032)
**Author:** [@sunilmchaudhari](https://discuss.elastic.co/u/sunilmchaudhari)\ **Replies:** 1\ **Last updated:** [April 21, 2016, 2:21pm UTC](https://discuss.elastic.co/t/documentation-of-filebeat/48032 "2016-04-21T14:21:04Z")
Hi, Do we have documentation of filebeat in offline (Doc or PDF?) br, Sunil --- ## [FileBeat client failed to connect](https://discuss.elastic.co/t/filebeat-client-failed-to-connect/47745)
**Author:** [@Sumantha\_Kannantha](https://discuss.elastic.co/u/Sumantha_Kannantha)\ **Replies:** 4\ **Last updated:** [April 21, 2016, 12:51pm UTC](https://discuss.elastic.co/t/filebeat-client-failed-to-connect/47745 "2016-04-21T12:51:45Z")
We are frequently getting below error in filebeat Apr 19 04:14:56 c2t07851 /usr/bin/filebeat\[31476\]: transport.go:125: SSL client failed to connect with: dial tcp XX.XX.XX.XX:9700: i/o timeout It goes away when we rest… --- ## [How does filebeat react to files dumped at once](https://discuss.elastic.co/t/how-does-filebeat-react-to-files-dumped-at-once/48013)
**Author:** [@wokmichel](https://discuss.elastic.co/u/wokmichel)\ **Replies:** 2\ **Last updated:** [April 21, 2016, 12:21pm UTC](https://discuss.elastic.co/t/how-does-filebeat-react-to-files-dumped-at-once/48013 "2016-04-21T12:21:26Z")
Hello, I am trying to understand how filebeat reacts to files that are dumped at once every x hours (versus log files that are fed on the fly, line by line) For instance, I have a file /log/audit.dump that is recreate… --- ## [Running filebeat](https://discuss.elastic.co/t/running-filebeat/47766)
**Author:** [@sunilmchaudhari](https://discuss.elastic.co/u/sunilmchaudhari)\ **Replies:** 14\ **Last updated:** [April 21, 2016, 11:05am UTC](https://discuss.elastic.co/t/running-filebeat/47766 "2016-04-21T11:05:31Z")
Hi, I am running filebeat using PS C:\\Program Files\\Filebeat\> Start-Service filebeat However it just creates one file Start-Service in home directory and nothing happens. Please help. I am referring below link. https:… --- ## [Filebeat not seeing fileupdates](https://discuss.elastic.co/t/filebeat-not-seeing-fileupdates/47822)
**Author:** [@jiayo](https://discuss.elastic.co/u/jiayo)\ **Replies:** 2\ **Last updated:** [April 21, 2016, 8:19am UTC](https://discuss.elastic.co/t/filebeat-not-seeing-fileupdates/47822 "2016-04-21T08:19:23Z")
Hello all, My filebeat forwarder stops sending logs to my logstash instance once every half hour or so. I looked at the DBG logs and it essentially says that the file hasn't changed and there are no logs to send. Howev… --- ## [Port mirror client\_ip perseverance](https://discuss.elastic.co/t/port-mirror-client-ip-perseverance/47923)
**Author:** [@Rachit\_Puri](https://discuss.elastic.co/u/Rachit_Puri)\ **Replies:** 2\ **Last updated:** [April 21, 2016, 5:21am UTC](https://discuss.elastic.co/t/port-mirror-client-ip-perseverance/47923 "2016-04-21T05:21:28Z")
Hi, If, i do port mirroring and then dump logs to packetbeat. Will i, be able to preserbe the client\_ip of the mirrored port. Wanted to know about the outcome before trying it on my own. --- ## [Packetbeat not generating logs for port mirrored traffic](https://discuss.elastic.co/t/packetbeat-not-generating-logs-for-port-mirrored-traffic/47927)
**Author:** [@kirann42](https://discuss.elastic.co/u/kirann42)\ **Replies:** 1\ **Last updated:** [April 20, 2016, 4:51pm UTC](https://discuss.elastic.co/t/packetbeat-not-generating-logs-for-port-mirrored-traffic/47927 "2016-04-20T16:51:12Z")
Hi, This might be a silly question but we are facing few issues with packetbeat when using port mirroring. We have 2 hosts Host1 and Host2 and we are mirroring the traffic between these hosts on to the host3(Packetbeat… --- ## [To listen for amqp events packetbeat](https://discuss.elastic.co/t/to-listen-for-amqp-events-packetbeat/47869)
**Author:** [@Rachit\_Puri](https://discuss.elastic.co/u/Rachit_Puri)\ **Replies:** 5\ **Last updated:** [April 20, 2016, 2:35pm UTC](https://discuss.elastic.co/t/to-listen-for-amqp-events-packetbeat/47869 "2016-04-20T14:35:17Z")
Hi, Is it possible to use amqp protocol and dump the logs to elasticsearch using packetbeat --- ## [Why response time for packetbeat memcache protocol is always zero](https://discuss.elastic.co/t/why-response-time-for-packetbeat-memcache-protocol-is-always-zero/47497)
**Author:** [@kirann42](https://discuss.elastic.co/u/kirann42)\ **Replies:** 4\ **Last updated:** [April 20, 2016, 11:56am UTC](https://discuss.elastic.co/t/why-response-time-for-packetbeat-memcache-protocol-is-always-zero/47497 "2016-04-20T11:56:41Z")
We are using packetbeat to measure memcache flows.Somehow the response time field in the packetbeat logs is always zero for any memcache request-response flow. What could be the reason ? --- ## [How do I build a beat to work as a service on linux](https://discuss.elastic.co/t/how-do-i-build-a-beat-to-work-as-a-service-on-linux/47682)
**Author:** [@adi.b](https://discuss.elastic.co/u/adi.b)\ **Replies:** 5\ **Last updated:** [April 20, 2016, 8:53am UTC](https://discuss.elastic.co/t/how-do-i-build-a-beat-to-work-as-a-service-on-linux/47682 "2016-04-20T08:53:51Z")
Hi, I'm writing a new beat (will be posted when done) and I was wondering how do I build the beat as a service on Linux system? In windows I just used the PS script to create a service - easy. But for Linux I see that … --- ## [Filebeat TLS connect to Logstash fails](https://discuss.elastic.co/t/filebeat-tls-connect-to-logstash-fails/47761)
**Author:** [@cs1](https://discuss.elastic.co/u/cs1)\ **Replies:** 4\ **Last updated:** [April 19, 2016, 2:23pm UTC](https://discuss.elastic.co/t/filebeat-tls-connect-to-logstash-fails/47761 "2016-04-19T14:23:03Z")
Hi all! We've set up Logstash to collect Filebeat data via the beats plugin: input { beats { port =\> 5044 ssl =\> true ssl\_certificate\_authorities =\> \["/etc/logstash/certs/ca.cert.pem"\] ssl\_certifica… --- ## [Filebeat loses connection to Kafka](https://discuss.elastic.co/t/filebeat-loses-connection-to-kafka/47660)
**Author:** [@gossu](https://discuss.elastic.co/u/gossu)\ **Replies:** 3\ **Last updated:** [April 19, 2016, 12:41pm UTC](https://discuss.elastic.co/t/filebeat-loses-connection-to-kafka/47660 "2016-04-19T12:41:24Z")
I am using the latest nightly build of Filebeat to output logs from /var/log/messages to Kafka (single node). The whole thing is working fine for about 30mins and after that Filebeat suddenly stops being able to commun… --- ## [Detect filebeat retries to remove duplicates in the server side](https://discuss.elastic.co/t/detect-filebeat-retries-to-remove-duplicates-in-the-server-side/47754)
**Author:** [@palmerabollo](https://discuss.elastic.co/u/palmerabollo)\ **Replies:** 2\ **Last updated:** [April 19, 2016, 12:35pm UTC](https://discuss.elastic.co/t/detect-filebeat-retries-to-remove-duplicates-in-the-server-side/47754 "2016-04-19T12:35:37Z")
I'm using filebeat to send logs to a remote logstash endpoint. Is there a flag or any way to detect if a log has already been sent? That is, detect if it is a retry. I think filebeat adds a @timestamp field (I could … --- ## [Best way to manage a bunch of beats](https://discuss.elastic.co/t/best-way-to-manage-a-bunch-of-beats/46830)
**Author:** [@szhem](https://discuss.elastic.co/u/szhem)\ **Replies:** 3\ **Last updated:** [April 19, 2016, 9:47am UTC](https://discuss.elastic.co/t/best-way-to-manage-a-bunch-of-beats/46830 "2016-04-19T09:47:01Z")
Hi there! Looking at the available beats https://www.elastic.co/products/beats https://www.elastic.co/guide/en/beats/libbeat/current/community-beats.html it seems that the trend is to create a single beat for eve… --- ## [Exclude lines starting hash not working](https://discuss.elastic.co/t/exclude-lines-starting-hash-not-working/47719)
**Author:** [@bara](https://discuss.elastic.co/u/bara)\ **Replies:** 1\ **Last updated:** [April 19, 2016, 7:56am UTC](https://discuss.elastic.co/t/exclude-lines-starting-hash-not-working/47719 "2016-04-19T07:56:58Z")
I'm running filebeat on Windows (v1.2.1) and trying to get it to exclude lines starting with hashes. I believe I have configured it correctly but it still seems to send through lines beginning with hash to LogStash. I'… --- ## [APT Repositories are failing with 404](https://discuss.elastic.co/t/apt-repositories-are-failing-with-404/47713)
**Author:** [@Bill\_Clark](https://discuss.elastic.co/u/Bill_Clark)\ **Replies:** 14\ **Last updated:** [April 18, 2016, 10:50pm UTC](https://discuss.elastic.co/t/apt-repositories-are-failing-with-404/47713 "2016-04-18T22:50:16Z")
Following the instructions to setup apt repository at: https://www.elastic.co/guide/en/beats/libbeat/current/setup-repositories.html. $ curl https://packages.elasticsearch.org/GPG-KEY-elasticsearch | sudo apt-key add - … --- ## [Filebeat ssl connection fail with CERT using Subject Alternative Name](https://discuss.elastic.co/t/filebeat-ssl-connection-fail-with-cert-using-subject-alternative-name/47616)
**Author:** [@Jakub\_Juraszek](https://discuss.elastic.co/u/Jakub_Juraszek)\ **Replies:** 4\ **Last updated:** [April 18, 2016, 9:23pm UTC](https://discuss.elastic.co/t/filebeat-ssl-connection-fail-with-cert-using-subject-alternative-name/47616 "2016-04-18T21:23:39Z")
Hello. I am using filebeat version 1.2.1 (amd64). I've setup logstash with input beats and ssl (ssl\_verify\_mode =\> force\_peer) and self signed certificate containing additional Subject Alternative Name. I am able to conn… --- ## [Filebeat 1.2.1 on ubuntu linux does not support kafka output](https://discuss.elastic.co/t/filebeat-1-2-1-on-ubuntu-linux-does-not-support-kafka-output/47688)
**Author:** [@kasi](https://discuss.elastic.co/u/kasi)\ **Replies:** 4\ **Last updated:** [April 18, 2016, 8:42pm UTC](https://discuss.elastic.co/t/filebeat-1-2-1-on-ubuntu-linux-does-not-support-kafka-output/47688 "2016-04-18T20:42:07Z")
I have installed filebeat 1.2.1, when I start filebeat with kafka as the output I am seeing no outouts defined error message the followings is the filebeat config. output: kafka: hosts: \["localhost:6667"\] … --- ## [Elastic Search Beat](https://discuss.elastic.co/t/elastic-search-beat/47427)
**Author:** [@GSL10019](https://discuss.elastic.co/u/GSL10019)\ **Replies:** 7\ **Last updated:** [April 18, 2016, 5:35pm UTC](https://discuss.elastic.co/t/elastic-search-beat/47427 "2016-04-18T17:35:02Z")
I was wondering how to customize the beats that are already available and how to direct the logs and what extremes can we customize the beats? --- ## [Tracing mysql error to http call](https://discuss.elastic.co/t/tracing-mysql-error-to-http-call/47666)
**Author:** [@Rachit\_Puri](https://discuss.elastic.co/u/Rachit_Puri)\ **Replies:** 0\ **Last updated:** [April 18, 2016, 2:03pm UTC](https://discuss.elastic.co/t/tracing-mysql-error-to-http-call/47666 "2016-04-18T14:03:25Z")
Hi, Is it possible to trace the mysql error to the http call that might have invoked the mysql command, using packetbeat. If, not is there a way, i can achieve this. [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=582) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=584)