# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=585 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 586 --- ## [Configuration of Filebeat pushing logs](https://discuss.elastic.co/t/configuration-of-filebeat-pushing-logs/47002)
**Author:** [@Atul\_Patel](https://discuss.elastic.co/u/Atul_Patel)\ **Replies:** 3\ **Last updated:** [April 12, 2016, 4:28pm UTC](https://discuss.elastic.co/t/configuration-of-filebeat-pushing-logs/47002 "2016-04-12T16:28:54Z")
We are using ELK stack with Filebeat pushing the logs to the Centeralized elastic search. Is anyone suggest how to inform filebeat to push the logs file based on the timestamp .How should i configure in the yml file so… --- ## [Conditional output](https://discuss.elastic.co/t/conditional-output/47014)
**Author:** [@canadatom](https://discuss.elastic.co/u/canadatom)\ **Replies:** 2\ **Last updated:** [April 12, 2016, 4:19pm UTC](https://discuss.elastic.co/t/conditional-output/47014 "2016-04-12T16:19:39Z")
I am trying to use prospector to include some log patterns and output it to file, and another prospector filter to include some other log patterns and output to logstash, is this doable? --- ## [Filebeat/Topbeat over AWS Peered VPC](https://discuss.elastic.co/t/filebeat-topbeat-over-aws-peered-vpc/47019)
**Author:** [@Randy\_Grolemund](https://discuss.elastic.co/u/Randy_Grolemund)\ **Replies:** 2\ **Last updated:** [April 12, 2016, 4:18pm UTC](https://discuss.elastic.co/t/filebeat-topbeat-over-aws-peered-vpc/47019 "2016-04-12T16:18:07Z")
I have 2 VPC's in AWS (aka old and new infrastructure). I am setting up my old VPC servers to use filebeat and topbeat on the new Elastic Monitoring server, which is located in the new VPC. I will first say that I have n… --- ## [Packetbeat is not sniffing the packets from a SPAN port](https://discuss.elastic.co/t/packetbeat-is-not-sniffing-the-packets-from-a-span-port/47064)
**Author:** [@Anantha\_Ravi](https://discuss.elastic.co/u/Anantha_Ravi)\ **Replies:** 2\ **Last updated:** [April 12, 2016, 2:17pm UTC](https://discuss.elastic.co/t/packetbeat-is-not-sniffing-the-packets-from-a-span-port/47064 "2016-04-12T14:17:15Z")
i have configured eth2 as my device in packetbeat . and eth2 is configured a span destination in my test configuration . tcpdump does show flow are recieved by interface , but i don't see same with packetbeat . i try… --- ## [FileBeat To Exit when it can't reach LogStash](https://discuss.elastic.co/t/filebeat-to-exit-when-it-cant-reach-logstash/47081)
**Author:** [@Johan\_Jordaan](https://discuss.elastic.co/u/Johan_Jordaan)\ **Replies:** 2\ **Last updated:** [April 12, 2016, 1:59pm UTC](https://discuss.elastic.co/t/filebeat-to-exit-when-it-cant-reach-logstash/47081 "2016-04-12T13:59:50Z")
Hi Is it possible to configure FileBeat to exit if it cannot connect to LogStash. I lookup my logstash ip from etcd and then startup filebeat using this IP. If however the ip of logstash changes (which it can and will)… --- ## [Winlogbeat - seems always start from oldest eventlog entry](https://discuss.elastic.co/t/winlogbeat-seems-always-start-from-oldest-eventlog-entry/42603)
**Author:** [@rthl](https://discuss.elastic.co/u/rthl)\ **Replies:** 2\ **Last updated:** [April 12, 2016, 1:58pm UTC](https://discuss.elastic.co/t/winlogbeat-seems-always-start-from-oldest-eventlog-entry/42603 "2016-04-12T13:58:25Z")
Right no i try to evaluate elk for Windows eventlogs using winlogbeat. no matter what i put in the "ignore\_older"-Var, winlogbeat seems always to start from the oldest available eventlog-entry. So it takes very long to c… --- ## [Generically named event\_data.paramN on Windows XP and 2003](https://discuss.elastic.co/t/generically-named-event-data-paramn-on-windows-xp-and-2003/46329)
**Author:** [@tuankun](https://discuss.elastic.co/u/tuankun)\ **Replies:** 6\ **Last updated:** [April 12, 2016, 1:21pm UTC](https://discuss.elastic.co/t/generically-named-event-data-paramn-on-windows-xp-and-2003/46329 "2016-04-12T13:21:30Z")
Hi sir, I installed the winlogbeat 1.2 on windows server 2003 to collect security log,then transfer to ELK. But I found a problem,winlogbeat 1.2 will take the "Description" section data into the "message" field in… --- ## [Sending e-mail - condition expression](https://discuss.elastic.co/t/sending-e-mail-condition-expression/46840)
**Author:** [@rafaellamuniz](https://discuss.elastic.co/u/rafaellamuniz)\ **Replies:** 6\ **Last updated:** [April 12, 2016, 12:33pm UTC](https://discuss.elastic.co/t/sending-e-mail-condition-expression/46840 "2016-04-12T12:33:55Z")
Hello, I'm using the Topbeat to monitor the server resources. I need to configure the Logstash output to send e-mail when some file system is over than 70%. But I'm not sure about the sintax on the condition expressi… --- ## [Filebeat 1.1.2 does not record correct inode values of rotated logs on exit](https://discuss.elastic.co/t/filebeat-1-1-2-does-not-record-correct-inode-values-of-rotated-logs-on-exit/45749)
**Author:** [@jstangroome](https://discuss.elastic.co/u/jstangroome)\ **Replies:** 4\ **Last updated:** [April 12, 2016, 12:01pm UTC](https://discuss.elastic.co/t/filebeat-1-1-2-does-not-record-correct-inode-values-of-rotated-logs-on-exit/45749 "2016-04-12T12:01:13Z")
Hi, I am seeing filebeat re-ship rotated log files when the filebeat service restarts. I have created a basic configuration and bash script which starts filebeat, writes to a log file, rotates it a couple of times (… --- ## [Filebeats missing last line when used with multi line](https://discuss.elastic.co/t/filebeats-missing-last-line-when-used-with-multi-line/47053)
**Author:** [@sdaruna](https://discuss.elastic.co/u/sdaruna)\ **Replies:** 1\ **Last updated:** [April 12, 2016, 5:38am UTC](https://discuss.elastic.co/t/filebeats-missing-last-line-when-used-with-multi-line/47053 "2016-04-12T05:38:17Z")
I have set up filebeat and used multi line pattern to get the full file content as below. My requirement is to move whole file content of the file as a single event. I used multiline to achieve it. multiline: … --- ## [Can Elasticsearch extract fields from multiple log files? Can we write this code in a single file?](https://discuss.elastic.co/t/can-elasticsearch-extract-fields-from-multiple-log-files-can-we-write-this-code-in-a-single-file/40190)
**Author:** [@usahitya](https://discuss.elastic.co/u/usahitya)\ **Replies:** 3\ **Last updated:** [April 12, 2016, 5:29am UTC](https://discuss.elastic.co/t/can-elasticsearch-extract-fields-from-multiple-log-files-can-we-write-this-code-in-a-single-file/40190 "2016-04-12T05:29:04Z")
Hi Friends, I am monitoring /var/log/\* in my linux box through Filebeat. Every log file have it's own style. I am getting the event like below (sample log file) "message:b8tTpts/0��3T(:� pts/0ts/0SAHISD+jocktramen10.33… --- ## [Deleting Filebeat Registry File](https://discuss.elastic.co/t/deleting-filebeat-registry-file/46112)
**Author:** [@billmurrin](https://discuss.elastic.co/u/billmurrin)\ **Replies:** 6\ **Last updated:** [April 12, 2016, 12:22am UTC](https://discuss.elastic.co/t/deleting-filebeat-registry-file/46112 "2016-04-12T00:22:05Z")
Is it safe to delete the FileBeat registry file? I see entries in there going back from when I first started running filebeat. This has been causing inode reuse issues where Filebeat keeps thinking I am reusing files. … --- ## [Packetbeat performance](https://discuss.elastic.co/t/packetbeat-performance/46834)
**Author:** [@ada\_pozo](https://discuss.elastic.co/u/ada_pozo)\ **Replies:** 6\ **Last updated:** [April 11, 2016, 4:57pm UTC](https://discuss.elastic.co/t/packetbeat-performance/46834 "2016-04-11T16:57:07Z")
Hi, I'm looking into how many packets can packetbeat capture before it starts dropping them doing tcpreplay in loopback, With speeds up to 1 Gbps I only get approximately 50 packets per second. Is this normal? Is there… --- ## [What kind of init script support will we get?](https://discuss.elastic.co/t/what-kind-of-init-script-support-will-we-get/32810)
**Author:** [@jerrac](https://discuss.elastic.co/u/jerrac)\ **Replies:** 7\ **Last updated:** [April 11, 2016, 2:43pm UTC](https://discuss.elastic.co/t/what-kind-of-init-script-support-will-we-get/32810 "2016-04-11T14:43:14Z")
One of the biggest issues I have with LSF is getting "service logstash-forwarder " to work on all my servers. Ubuntu is easy, but CentOS and OES/SLES were painful. On OES/SLES I ended up just using monit to make it work. … --- ## [Packetbeat fails to start](https://discuss.elastic.co/t/packetbeat-fails-to-start/46813)
**Author:** [@Shaun\_Wells](https://discuss.elastic.co/u/Shaun_Wells)\ **Replies:** 2\ **Last updated:** [April 11, 2016, 12:55pm UTC](https://discuss.elastic.co/t/packetbeat-fails-to-start/46813 "2016-04-11T12:55:07Z")
Hi - Wondering what permissions are required to sniff the local network adapter. I work in an environment where access is restricted on Linux servers - I do not have Sudo rights. I get the following error: CRIT Ini… --- ## [Generating filebeat dynamic custom fields](https://discuss.elastic.co/t/generating-filebeat-dynamic-custom-fields/46749)
**Author:** [@Shachar\_Ashkenazi](https://discuss.elastic.co/u/Shachar_Ashkenazi)\ **Replies:** 1\ **Last updated:** [April 11, 2016, 11:29am UTC](https://discuss.elastic.co/t/generating-filebeat-dynamic-custom-fields/46749 "2016-04-11T11:29:19Z")
I have an elasticsearch cluster (ELK) and some nodes sending logs to the logstash using filebeat. All the servers in my environment are CentOS 6.5. The filebeat.yml file in each server is enforced by a Puppet module (b… --- ## [Filebeat throwing error while run the files](https://discuss.elastic.co/t/filebeat-throwing-error-while-run-the-files/46540)
**Author:** [@Ganesh2303](https://discuss.elastic.co/u/Ganesh2303)\ **Replies:** 3\ **Last updated:** [April 11, 2016, 8:53am UTC](https://discuss.elastic.co/t/filebeat-throwing-error-while-run-the-files/46540 "2016-04-11T08:53:47Z")
Hi, when i run my filebeat file im getting following error plz help to resolve it, goroutine 49260 \[runnable\]: syscall.Syscall(0x0, 0x6028, 0xc8e08a8000, 0x4000, 0x1826, 0x4000, 0x0) /usr/local/go/src/syscall… --- ## [Filebeat multiline question](https://discuss.elastic.co/t/filebeat-multiline-question/46455)
**Author:** [@mregmi](https://discuss.elastic.co/u/mregmi)\ **Replies:** 6\ **Last updated:** [April 11, 2016, 3:31am UTC](https://discuss.elastic.co/t/filebeat-multiline-question/46455 "2016-04-11T03:31:54Z")
My application maintains its state by persisting some info on a file within an interval of time. This file is not more than 10 lines at a time. The format of the data that's inside the file would be something like th… --- ## [Packectbeat: Windows with multiple network interfaces](https://discuss.elastic.co/t/packectbeat-windows-with-multiple-network-interfaces/46836)
**Author:** [@krushnat\_khawale](https://discuss.elastic.co/u/krushnat_khawale)\ **Replies:** 1\ **Last updated:** [April 8, 2016, 9:33pm UTC](https://discuss.elastic.co/t/packectbeat-windows-with-multiple-network-interfaces/46836 "2016-04-08T21:33:00Z")
packetbeat -devices listing multiple network interfaces, 0: \\Device\\NPF\_{2EB816F1-6B79-4A9A-AE86-2222FEE25ECB} (Microsoft) 1: \\Device\\NPF\_{FEAD6AD3-D7BF-4738-AA20-12222C6ECA6CF} (Microsoft) 2: \\Device\\NPF\_{287BF3DC-F… --- ## [\[SOLVED\] Visualize: Fielddata is disabled on text fields by default. (Testing ELK 5.0 alpha)](https://discuss.elastic.co/t/solved-visualize-fielddata-is-disabled-on-text-fields-by-default-testing-elk-5-0-alpha/46817)
**Author:** [@marcello.mezzanotti](https://discuss.elastic.co/u/marcello.mezzanotti)\ **Replies:** 2\ **Last updated:** [April 8, 2016, 4:55pm UTC](https://discuss.elastic.co/t/solved-visualize-fielddata-is-disabled-on-text-fields-by-default-testing-elk-5-0-alpha/46817 "2016-04-08T16:55:30Z")
Hi all, I'm new on ELK world, just playing around with ELK stack, did some tests wth latest stable ELK stack, including integration with suricata (ids) and cowrie (ssh honeypot) without any problem. Then i decided to p… --- ## [Unknown error in Filebeat](https://discuss.elastic.co/t/unknown-error-in-filebeat/46028)
**Author:** [@rajkamalkool6](https://discuss.elastic.co/u/rajkamalkool6)\ **Replies:** 6\ **Last updated:** [April 8, 2016, 12:05pm UTC](https://discuss.elastic.co/t/unknown-error-in-filebeat/46028 "2016-04-08T12:05:17Z")
I am using Filebeats to fetch my Log files(XML log file). It was fetching the logs and after some time I am getting this below error and my Filebeats stops automatically. goroutine 51620 \[semacquire\]: sync.runtime\_Semac… --- ## [Filebeat is resending all data](https://discuss.elastic.co/t/filebeat-is-resending-all-data/46652)
**Author:** [@NiteshBarnwal](https://discuss.elastic.co/u/NiteshBarnwal)\ **Replies:** 3\ **Last updated:** [April 8, 2016, 10:57am UTC](https://discuss.elastic.co/t/filebeat-is-resending-all-data/46652 "2016-04-08T10:57:48Z")
I have one query regarding the data pushed by filebeat to logstash. When I am opening and saving the log file, filebeat is resending all the data from the begining of the log. Is this the expected behaviour ? How can w… --- ## [Multiline POSIX regexp pattern - mindmelting not working java stack trace pattern](https://discuss.elastic.co/t/multiline-posix-regexp-pattern-mindmelting-not-working-java-stack-trace-pattern/46686)
**Author:** [@dsa](https://discuss.elastic.co/u/dsa)\ **Replies:** 5\ **Last updated:** [April 8, 2016, 7:39am UTC](https://discuss.elastic.co/t/multiline-posix-regexp-pattern-mindmelting-not-working-java-stack-trace-pattern/46686 "2016-04-08T07:39:50Z")
Hey Folks, im currently on the horizon of make a switch from: logstash 1.4.x using lumberjack as shipper =\> logstash 2.x and filebeat as shipper so i try to catch JAVA Stack traces as one message with filebeat mult… --- ## [ERR Failed opening: too many open files](https://discuss.elastic.co/t/err-failed-opening-too-many-open-files/46733)
**Author:** [@rajkamalkool6](https://discuss.elastic.co/u/rajkamalkool6)\ **Replies:** 1\ **Last updated:** [April 7, 2016, 10:17pm UTC](https://discuss.elastic.co/t/err-failed-opening-too-many-open-files/46733 "2016-04-07T22:17:04Z")
Hi, I am using logstash 2.3.0 and Filebeat 1.2.0. I have upgraded logstash-input-beats to 2.2.7. I ran filebeat using the below command /bin/filebeat -c /config/filebeat.yml -e -v "\*". I am getting below error. 2016… --- ## [Filebeat Protocol and Load Balancer](https://discuss.elastic.co/t/filebeat-protocol-and-load-balancer/46689)
**Author:** [@Johannes](https://discuss.elastic.co/u/Johannes)\ **Replies:** 1\ **Last updated:** [April 7, 2016, 4:25pm UTC](https://discuss.elastic.co/t/filebeat-protocol-and-load-balancer/46689 "2016-04-07T16:25:37Z")
Hi guys, we are planing to use Logstash behind a load balancer. As a source we want to use Filebeat. Therefore we want to know if Filebeat uses a stateless or statefull protocol. Thanks for your time. Regards Johanne… --- ## [Encoding utf-8 doesn't honor BOM](https://discuss.elastic.co/t/encoding-utf-8-doesnt-honor-bom/46671)
**Author:** [@prehor](https://discuss.elastic.co/u/prehor)\ **Replies:** 3\ **Last updated:** [April 7, 2016, 4:19pm UTC](https://discuss.elastic.co/t/encoding-utf-8-doesnt-honor-bom/46671 "2016-04-07T16:19:56Z")
Hi, Windows often prepend UTF-8 BOM to text files, which is legal - see Can a UTF-8 data stream contain the BOM character (in UTF-8 form)?. In my case it happens in Exchange 2010 Message Tracking logs. Filebeat must … --- ## [Can I filter the logs using event IDs?](https://discuss.elastic.co/t/can-i-filter-the-logs-using-event-ids/46639)
**Author:** [@thyfere](https://discuss.elastic.co/u/thyfere)\ **Replies:** 2\ **Last updated:** [April 7, 2016, 3:51pm UTC](https://discuss.elastic.co/t/can-i-filter-the-logs-using-event-ids/46639 "2016-04-07T15:51:45Z")
Hi, I am shipping auditing logs from Windows boxes to Elasticsearch server. I want to ship only auditing logs from the computer, how can I do it using Winlogbeat? --- ## [Can I tag the events using Winlogbeat?](https://discuss.elastic.co/t/can-i-tag-the-events-using-winlogbeat/46635)
**Author:** [@thyfere](https://discuss.elastic.co/u/thyfere)\ **Replies:** 2\ **Last updated:** [April 7, 2016, 3:47pm UTC](https://discuss.elastic.co/t/can-i-tag-the-events-using-winlogbeat/46635 "2016-04-07T15:47:46Z")
Hi, I am shipping auditing logs from Windows machines, I am already using a different index for auditing logs which is different than Windows Domain Controller logs. Can I tag the logs using Winlogbeats? --- ## [Send to Logstash localhost and remote hosts](https://discuss.elastic.co/t/send-to-logstash-localhost-and-remote-hosts/46659)
**Author:** [@gromit](https://discuss.elastic.co/u/gromit)\ **Replies:** 1\ **Last updated:** [April 7, 2016, 11:53am UTC](https://discuss.elastic.co/t/send-to-logstash-localhost-and-remote-hosts/46659 "2016-04-07T11:53:29Z")
If Filebeat is configured to send to Logstash localhost only it works fine. This is with any version. If Filebeat is configured to send to localhost and remote host then nothing is sent to localhost. To re-create the out… --- ## [Unifiedbeat fails to start with configuration error, although --checkconfig doesn't find any errors](https://discuss.elastic.co/t/unifiedbeat-fails-to-start-with-configuration-error-although-checkconfig-doesnt-find-any-errors/46585)
**Author:** [@utilitynerd](https://discuss.elastic.co/u/utilitynerd)\ **Replies:** 1\ **Last updated:** [April 7, 2016, 11:30am UTC](https://discuss.elastic.co/t/unifiedbeat-fails-to-start-with-configuration-error-although-checkconfig-doesnt-find-any-errors/46585 "2016-04-07T11:30:35Z")
If you get the following error while trying to start unifiedbeat, with a valid YML config file, I 2016/04/06 18:20:40.501879 u2beat.go:97: CRIT Setup: ERROR: required path to 'gen\_msg\_map\_path' not specified in YAML co… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=584) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=586)