# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=586 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 587 --- ## [Migration of LSF to filebeat](https://discuss.elastic.co/t/migration-of-lsf-to-filebeat/46493)
**Author:** [@NiteshBarnwal](https://discuss.elastic.co/u/NiteshBarnwal)\ **Replies:** 2\ **Last updated:** [April 7, 2016, 9:18am UTC](https://discuss.elastic.co/t/migration-of-lsf-to-filebeat/46493 "2016-04-07T09:18:34Z")
I am trying to migrate logstash-forwarder to filebeat. getting certificate error in filebeat though same is being used in logstash-forwarder. I have changed the template and the index is good with %type. logstash version… --- ## [Topbeat: CPU/Memory usage per process](https://discuss.elastic.co/t/topbeat-cpu-memory-usage-per-process/43867)
**Author:** [@krushnat\_khawale](https://discuss.elastic.co/u/krushnat_khawale)\ **Replies:** 6\ **Last updated:** [April 7, 2016, 6:32am UTC](https://discuss.elastic.co/t/topbeat-cpu-memory-usage-per-process/43867 "2016-04-07T06:32:14Z")
Hello Elastic { World }, I am using topbeat, for high level monitoring. I've downloaded sample dashboards for topbeat and successfully able to load and use the amazing dashboards and widgets. The widget that I am int… --- ## [Packetbeat: http.content\_lenth fields is for request or response](https://discuss.elastic.co/t/packetbeat-http-content-lenth-fields-is-for-request-or-response/46468)
**Author:** [@krushnat\_khawale](https://discuss.elastic.co/u/krushnat_khawale)\ **Replies:** 3\ **Last updated:** [April 7, 2016, 6:01am UTC](https://discuss.elastic.co/t/packetbeat-http-content-lenth-fields-is-for-request-or-response/46468 "2016-04-07T06:01:21Z")
Hello { ES World }, The field, http.content\_length in HTTP field list, whether it is request content length or it is response content length? As we want to dashboard, Responses based on their sizes; we're gonna need … --- ## [New line in file beat for java stack trace](https://discuss.elastic.co/t/new-line-in-file-beat-for-java-stack-trace/46284)
**Author:** [@kasi](https://discuss.elastic.co/u/kasi)\ **Replies:** 7\ **Last updated:** [April 6, 2016, 6:05pm UTC](https://discuss.elastic.co/t/new-line-in-file-beat-for-java-stack-trace/46284 "2016-04-06T18:05:20Z")
The following is my multi-line config (from file beat example from guide). multiline: pattern: "^\[\[:space:\]\]+(at|...)|^Caused by:" negate: false match: after This is the output in the log file org.xml.… --- ## [Cannot make packetbeat work](https://discuss.elastic.co/t/cannot-make-packetbeat-work/46467)
**Author:** [@ageldenberg](https://discuss.elastic.co/u/ageldenberg)\ **Replies:** 2\ **Last updated:** [April 6, 2016, 5:19pm UTC](https://discuss.elastic.co/t/cannot-make-packetbeat-work/46467 "2016-04-06T17:19:48Z")
Hello, beats wizards. I will greatly appreciate help in making packetbeats work. I have the following configuration. An Ubuntu-based sensor with two interfaces (management and sniffing) is running packetbeat versi… --- ## [Can't figure out how to use certificates correctly](https://discuss.elastic.co/t/cant-figure-out-how-to-use-certificates-correctly/45949)
**Author:** [@muhamadli302](https://discuss.elastic.co/u/muhamadli302)\ **Replies:** 14\ **Last updated:** [April 6, 2016, 1:04pm UTC](https://discuss.elastic.co/t/cant-figure-out-how-to-use-certificates-correctly/45949 "2016-04-06T13:04:38Z")
Hello everyone, I need help with configuring filebeat on windows with tls. I created .crt file in my ELK server, and copied it to my windows client. Now I'm trying to configure the filebeat.yml file, I've tried this fe… --- ## [Bug - Regex parsing for procs setting in topbeat.yml](https://discuss.elastic.co/t/bug-regex-parsing-for-procs-setting-in-topbeat-yml/46422)
**Author:** [@janwillemvd](https://discuss.elastic.co/u/janwillemvd)\ **Replies:** 4\ **Last updated:** [April 6, 2016, 6:51am UTC](https://discuss.elastic.co/t/bug-regex-parsing-for-procs-setting-in-topbeat-yml/46422 "2016-04-06T06:51:20Z")
Hi, It looks like there is a bug with respect to the 'procs' setting in topbeat.yml. We followed the instructions on https://www.elastic.co/guide/en/beats/topbeat/current/topbeat-configuration.html and we use the fo… --- ## [Winlogbeat Remote Desktop Connection Auditing](https://discuss.elastic.co/t/winlogbeat-remote-desktop-connection-auditing/46379)
**Author:** [@sawwinnnaung](https://discuss.elastic.co/u/sawwinnnaung)\ **Replies:** 7\ **Last updated:** [April 6, 2016, 6:30am UTC](https://discuss.elastic.co/t/winlogbeat-remote-desktop-connection-auditing/46379 "2016-04-06T06:30:59Z")
How can I extract remote desktop connection message from winlogbeat --- ## [Enabling Topology Map in Live Demo?](https://discuss.elastic.co/t/enabling-topology-map-in-live-demo/46439)
**Author:** [@sashank](https://discuss.elastic.co/u/sashank)\ **Replies:** 1\ **Last updated:** [April 5, 2016, 6:34pm UTC](https://discuss.elastic.co/t/enabling-topology-map-in-live-demo/46439 "2016-04-05T18:34:37Z")
Hi , How do we enable topology map view mentioned in the packetbeat documentation on website in live demo ? Regards Sashank --- ## [Filebeat 1.2.0. multiline](https://discuss.elastic.co/t/filebeat-1-2-0-multiline/46200)
**Author:** [@remco](https://discuss.elastic.co/u/remco)\ **Replies:** 11\ **Last updated:** [April 5, 2016, 11:46am UTC](https://discuss.elastic.co/t/filebeat-1-2-0-multiline/46200 "2016-04-05T11:46:05Z")
Hi, I new to the ELK, just learning the basics. Logstash (multiline implemented) =\> elasticsearch =\> kibana. This is working for me. However i want to start using filebeat =\> logstash =\> elastichsearch =\> kibana. No… --- ## [Packebeat: Unwanted 404 errors for styles, js like resources](https://discuss.elastic.co/t/packebeat-unwanted-404-errors-for-styles-js-like-resources/46243)
**Author:** [@krushnat\_khawale](https://discuss.elastic.co/u/krushnat_khawale)\ **Replies:** 3\ **Last updated:** [April 5, 2016, 9:25am UTC](https://discuss.elastic.co/t/packebeat-unwanted-404-errors-for-styles-js-like-resources/46243 "2016-04-05T09:25:38Z")
We are using Topbeat, and are able to successfully dashboard the info. But the 'HTTP codes for top queries' visualization is showing a lot of 404 errors for http request for resources like styles.css, jqu… --- ## [Formatting Windows DNS logs](https://discuss.elastic.co/t/formatting-windows-dns-logs/46231)
**Author:** [@Dave\_Foster](https://discuss.elastic.co/u/Dave_Foster)\ **Replies:** 4\ **Last updated:** [April 5, 2016, 1:07am UTC](https://discuss.elastic.co/t/formatting-windows-dns-logs/46231 "2016-04-05T01:07:06Z")
I'm successfully using filebeat to ship DNS debug logs from our Windows DC servers to elk. I've finally figured out turning off 'analyzed' on the domain name field so that the name isn't broken into chunks (ie Microsof… --- ## [Filebeat sending old logs on restart](https://discuss.elastic.co/t/filebeat-sending-old-logs-on-restart/46189)
**Author:** [@bbach](https://discuss.elastic.co/u/bbach)\ **Replies:** 5\ **Last updated:** [April 4, 2016, 11:59pm UTC](https://discuss.elastic.co/t/filebeat-sending-old-logs-on-restart/46189 "2016-04-04T23:59:36Z")
I upgraded about 50 servers to filebeat 1.2. Two of the servers seem to be sending lines from old log files (from log files that are over a year old). I stopped filebeat and added an "ignore\_older: 24h" line to to the … --- ## [Filebeat - It is not creating index on Elasticsearch](https://discuss.elastic.co/t/filebeat-it-is-not-creating-index-on-elasticsearch/39913)
**Author:** [@rafaellamuniz](https://discuss.elastic.co/u/rafaellamuniz)\ **Replies:** 3\ **Last updated:** [April 4, 2016, 6:59pm UTC](https://discuss.elastic.co/t/filebeat-it-is-not-creating-index-on-elasticsearch/39913 "2016-04-04T18:59:21Z")
Hello! I'm trying to configure the FIlebeat. My configuration is Filebeat \> Logstash \> Elasticsearch \> Kibana. However there is something wrong and I couldn't figure it out. There are some errors in the log and the ind… --- ## [FIlebeat doesn't reparse logs](https://discuss.elastic.co/t/filebeat-doesnt-reparse-logs/46136)
**Author:** [@bronzelion](https://discuss.elastic.co/u/bronzelion)\ **Replies:** 10\ **Last updated:** [April 4, 2016, 4:48pm UTC](https://discuss.elastic.co/t/filebeat-doesnt-reparse-logs/46136 "2016-04-04T16:48:07Z")
Hey, I did read a couple of posts here but was not able to get the issue resolved. I'm using filebeat-1.2.0(downloaded tar) and Logstash2.2.2. I want to force re-parse the files provided in the path section, but that d… --- ## [Filebeat multiline ignores line if the newline doesn't exist](https://discuss.elastic.co/t/filebeat-multiline-ignores-line-if-the-newline-doesnt-exist/46098)
**Author:** [@danielmotaleite](https://discuss.elastic.co/u/danielmotaleite)\ **Replies:** 3\ **Last updated:** [April 4, 2016, 3:50pm UTC](https://discuss.elastic.co/t/filebeat-multiline-ignores-line-if-the-newline-doesnt-exist/46098 "2016-04-04T15:50:03Z")
Using filebeat 1.1.2, i have a log event that have 3 lines and starts with the date, but the last line have no newline character. After 5 seconds, filebeat sends the 2 first lines of the event... after 10 minutes i get t… --- ## [Error when connecting filebeat to logstash](https://discuss.elastic.co/t/error-when-connecting-filebeat-to-logstash/46099)
**Author:** [@aschwanb](https://discuss.elastic.co/u/aschwanb)\ **Replies:** 3\ **Last updated:** [April 4, 2016, 12:12pm UTC](https://discuss.elastic.co/t/error-when-connecting-filebeat-to-logstash/46099 "2016-04-04T12:12:10Z")
Hello everyone I have a docker container with logstash running behind an nginx proxy on ubuntu 15 and would like to send information via filebeat from an OS X 10.11 client to logstash. I can connect to logstash using… --- ## [FileNotFound not catched by file\_rotator](https://discuss.elastic.co/t/filenotfound-not-catched-by-file-rotator/45934)
**Author:** [@simonecottini](https://discuss.elastic.co/u/simonecottini)\ **Replies:** 5\ **Last updated:** [April 4, 2016, 11:56am UTC](https://discuss.elastic.co/t/filenotfound-not-catched-by-file-rotator/45934 "2016-04-04T11:56:39Z")
Hi all, I had configured Filebeat to write it's output to file on filesystem. During Filebeat execution if you delete the output file ( or obviously one of it's parent folders ) Filebeat keep running and doesn't throw … --- ## [Filebeat too many open files Error](https://discuss.elastic.co/t/filebeat-too-many-open-files-error/46118)
**Author:** [@Sumantha\_Kannantha](https://discuss.elastic.co/u/Sumantha_Kannantha)\ **Replies:** 2\ **Last updated:** [April 4, 2016, 9:16am UTC](https://discuss.elastic.co/t/filebeat-too-many-open-files-error/46118 "2016-04-04T09:16:15Z")
I have installed latest version of filebeat (Version: 1.2.0). I am getting below error in /var/log/messages /usr/bin/filebeat\[22662\]: log.go:103: Stop Harvesting. Unexpected file opening error: open /opt/mount1/sa-st… --- ## [How to extract filename from file path in filebeat](https://discuss.elastic.co/t/how-to-extract-filename-from-file-path-in-filebeat/46073)
**Author:** [@sdaruna](https://discuss.elastic.co/u/sdaruna)\ **Replies:** 2\ **Last updated:** [April 3, 2016, 1:55am UTC](https://discuss.elastic.co/t/how-to-extract-filename-from-file-path-in-filebeat/46073 "2016-04-03T01:55:45Z")
I am looking to set the output to redis from filebeat. I need to extract date and name of the file from file path. I knew how to do it using filters in logstash. But, how can i do that with filebeat.? --- ## [How to set filebeat to look into folder with current date.?](https://discuss.elastic.co/t/how-to-set-filebeat-to-look-into-folder-with-current-date/46076)
**Author:** [@sdaruna](https://discuss.elastic.co/u/sdaruna)\ **Replies:** 1\ **Last updated:** [April 2, 2016, 6:52pm UTC](https://discuss.elastic.co/t/how-to-set-filebeat-to-look-into-folder-with-current-date/46076 "2016-04-02T18:52:20Z")
I want to configure filebeat to look into folders with current date. Base Path: /user/srini/inputs/ For Eg: if current date is 01-01-2016, then it has to get files from below path. /user/srini/inputs/01-01-2016/\*.… --- ## [Collecting Windows Logs from NAS/CIFS Sever](https://discuss.elastic.co/t/collecting-windows-logs-from-nas-cifs-sever/45728)
**Author:** [@Jim\_Jepson](https://discuss.elastic.co/u/Jim_Jepson)\ **Replies:** 6\ **Last updated:** [April 1, 2016, 5:57pm UTC](https://discuss.elastic.co/t/collecting-windows-logs-from-nas-cifs-sever/45728 "2016-04-01T17:57:23Z")
We would like to pull windows logs from a remote computer -- actually it is a NAS/CIFS server running on an EMC storage server -- so no way to run winlogbeat locally. From the event viewer on a windows computer I ca… --- ## [Filebeat Error: "Writing of registry returned error"](https://discuss.elastic.co/t/filebeat-error-writing-of-registry-returned-error/45458)
**Author:** [@matt.koivisto](https://discuss.elastic.co/u/matt.koivisto)\ **Replies:** 2\ **Last updated:** [April 1, 2016, 3:40pm UTC](https://discuss.elastic.co/t/filebeat-error-writing-of-registry-returned-error/45458 "2016-04-01T15:40:25Z")
Hi, I noticed these errors coming out of filebeat: 2016/03/25 15:34:30.198179 file\_other.go:39: ERR Rotate error: rename /root/.filebeat.new /root/.filebeat: no such file or directory 2016/03/25 15:34:30.198234 regis… --- ## [File beat multiline is not working for XML type of files](https://discuss.elastic.co/t/file-beat-multiline-is-not-working-for-xml-type-of-files/45067)
**Author:** [@rajkamalkool6](https://discuss.elastic.co/u/rajkamalkool6)\ **Replies:** 8\ **Last updated:** [April 1, 2016, 11:37am UTC](https://discuss.elastic.co/t/file-beat-multiline-is-not-working-for-xml-type-of-files/45067 "2016-04-01T11:37:40Z")
Hi, I am using logstash 2.2.1 ,logstash-input beats-2.1.3 and filebeat 1.1.2 . I have some XML type of log files. I have written beats config. I am facing the following issue Issue 1: The xml log file multiline event… --- ## [Failed to start Beats services, including filebeat, topbeat](https://discuss.elastic.co/t/failed-to-start-beats-services-including-filebeat-topbeat/45925)
**Author:** [@usahitya](https://discuss.elastic.co/u/usahitya)\ **Replies:** 5\ **Last updated:** [April 1, 2016, 11:16am UTC](https://discuss.elastic.co/t/failed-to-start-beats-services-including-filebeat-topbeat/45925 "2016-04-01T11:16:16Z")
HI Team, I am working on Beats especially with Topbeat and Filebeat. when I am installing services running successfully, but if I modify in configuration file and restart it, then giving the below error. \[root@Vinee… --- ## [Index param is not working in topbeat.yml](https://discuss.elastic.co/t/index-param-is-not-working-in-topbeat-yml/45891)
**Author:** [@linrongfu26](https://discuss.elastic.co/u/linrongfu26)\ **Replies:** 2\ **Last updated:** [April 1, 2016, 9:42am UTC](https://discuss.elastic.co/t/index-param-is-not-working-in-topbeat-yml/45891 "2016-04-01T09:42:58Z")
Hi : i'm using topbeat 1.1.2, and i see the config param like this: Optional index name. The default is "topbeat" and generates # \[topbeat-\]YYYY.MM.DD keys. # index: "topbeat" after i change index param to my ow… --- ## [How can i see the redis output from beats.?](https://discuss.elastic.co/t/how-can-i-see-the-redis-output-from-beats/46005)
**Author:** [@sdaruna](https://discuss.elastic.co/u/sdaruna)\ **Replies:** 1\ **Last updated:** [April 1, 2016, 5:09am UTC](https://discuss.elastic.co/t/how-can-i-see-the-redis-output-from-beats/46005 "2016-04-01T05:09:59Z")
I have pushed the data from filebeats to redis. output: redis: host: "localhost" port: 6379 save\_topology: true index: "filebeat" db: 0 db\_topology: 1 timeout: 5 reconnect\_interval: 1 … --- ## [Start/Stop pattern for multiline](https://discuss.elastic.co/t/start-stop-pattern-for-multiline/45861)
**Author:** [@erikstephens](https://discuss.elastic.co/u/erikstephens)\ **Replies:** 4\ **Last updated:** [March 31, 2016, 9:55pm UTC](https://discuss.elastic.co/t/start-stop-pattern-for-multiline/45861 "2016-03-31T21:55:40Z")
I can't figure out how to use the filebeat multiline functionality to aggregate output with a start & stop pattern: 2016-03-29T09:45:01 process-A starting 2016-03-29T09:45:02 process-A foo 2016-03-29T09:45:03 process… --- ## [How to transfer whole file instead of line by line.?](https://discuss.elastic.co/t/how-to-transfer-whole-file-instead-of-line-by-line/45965)
**Author:** [@sdaruna](https://discuss.elastic.co/u/sdaruna)\ **Replies:** 1\ **Last updated:** [March 31, 2016, 9:37pm UTC](https://discuss.elastic.co/t/how-to-transfer-whole-file-instead-of-line-by-line/45965 "2016-03-31T21:37:04Z")
Hi, I configured file beats to look into a folder and push the data to logstash. How to use multiline to move whole file once.? --- ## [Sending topbeat events to kafka](https://discuss.elastic.co/t/sending-topbeat-events-to-kafka/45988)
**Author:** [@jstar](https://discuss.elastic.co/u/jstar)\ **Replies:** 1\ **Last updated:** [March 31, 2016, 8:03pm UTC](https://discuss.elastic.co/t/sending-topbeat-events-to-kafka/45988 "2016-03-31T20:03:12Z")
Hi all, I'm trying to send topbeat's events to kafka. This is what I have done so far, download the nightly version with wget https://beats-nightlies.s3.amazonaws.com/topbeat/topbeat\_5.0.0-nightlylatest\_amd64.deb th… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=585) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=587)