# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=587 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 588 --- ## [Docker overlay networks](https://discuss.elastic.co/t/docker-overlay-networks/45899)
**Author:** [@marco.gulino](https://discuss.elastic.co/u/marco.gulino)\ **Replies:** 1\ **Last updated:** [March 31, 2016, 12:38pm UTC](https://discuss.elastic.co/t/docker-overlay-networks/45899 "2016-03-31T12:38:27Z")
Hi! I'm trying to monitor packets (mainly http, mysql, redis, but it might be anything) using packetbeat on a Docker environment. Using a single docker instance everything works flawlessly, but when I try the same thing … --- ## [Use (FreeBSD) native log shipping instead of Filebeat?](https://discuss.elastic.co/t/use-freebsd-native-log-shipping-instead-of-filebeat/42975)
**Author:** [@gregoryo](https://discuss.elastic.co/u/gregoryo)\ **Replies:** 4\ **Last updated:** [March 31, 2016, 7:53am UTC](https://discuss.elastic.co/t/use-freebsd-native-log-shipping-instead-of-filebeat/42975 "2016-03-31T07:53:34Z")
I am looking at deploying ELK for some FreeBSD machines, and have reached the section of documentation suggesting I use Filebeat to get logs from source machines into Logstash. I immediately wondered whether I could use … --- ## [How to Setup FileBeat with Basic Auth for LogStash Output?](https://discuss.elastic.co/t/how-to-setup-filebeat-with-basic-auth-for-logstash-output/36937)
**Author:** [@kpcool](https://discuss.elastic.co/u/kpcool)\ **Replies:** 18\ **Last updated:** [March 30, 2016, 10:34pm UTC](https://discuss.elastic.co/t/how-to-setup-filebeat-with-basic-auth-for-logstash-output/36937 "2016-03-30T22:34:55Z")
I plan to use FileBeat for log monitoring and push out the logs to logstash on a central server, which has http basic auth setup, to prevent unauthorized inputs. Without auth, the setup works fine, no issues. However, w… --- ## [Filebeat only sends logs on service restart](https://discuss.elastic.co/t/filebeat-only-sends-logs-on-service-restart/45776)
**Author:** [@brayndasilva](https://discuss.elastic.co/u/brayndasilva)\ **Replies:** 1\ **Last updated:** [March 30, 2016, 11:26am UTC](https://discuss.elastic.co/t/filebeat-only-sends-logs-on-service-restart/45776 "2016-03-30T11:26:35Z")
Hi, A while back I set up my ELK Stack and it's working fine, but I noticed that if I want to check the logs from my Client Server I have to go over there and restart the filebeat service. Once restarted I can check … --- ## [No outputs are defined error is shown](https://discuss.elastic.co/t/no-outputs-are-defined-error-is-shown/45772)
**Author:** [@Roshan\_r](https://discuss.elastic.co/u/Roshan_r)\ **Replies:** 1\ **Last updated:** [March 30, 2016, 9:47am UTC](https://discuss.elastic.co/t/no-outputs-are-defined-error-is-shown/45772 "2016-03-30T09:47:27Z")
I am using filebeat for the first time and i could see an error while starting the filebeat. Error is as follows \[root@astropdl filebeat\]# service filebeat start Starting filebeat: Error Initialising publisher: No outp… --- ## [How to filebeat logs in all levels?](https://discuss.elastic.co/t/how-to-filebeat-logs-in-all-levels/45656)
**Author:** [@muhamadli302](https://discuss.elastic.co/u/muhamadli302)\ **Replies:** 5\ **Last updated:** [March 30, 2016, 9:23am UTC](https://discuss.elastic.co/t/how-to-filebeat-logs-in-all-levels/45656 "2016-03-30T09:23:54Z")
hello, I'm trying to have filebeat create logs in all the levels (info, error, debug etc) in order to debug it's work, but I don't understand how to edit the .yml config file correctly in order to make this happen. Can… --- ## [Winlogbeat and User sessions (parsing fields from message)](https://discuss.elastic.co/t/winlogbeat-and-user-sessions-parsing-fields-from-message/43003)
**Author:** [@matthieurobin](https://discuss.elastic.co/u/matthieurobin)\ **Replies:** 9\ **Last updated:** [March 21, 2016, 2:47pm UTC](https://discuss.elastic.co/t/winlogbeat-and-user-sessions-parsing-fields-from-message/43003 "2016-03-21T14:47:04Z")
Hello, I have installed winlogbeat on my Windows server, and it works fine, I have all data. Unfortunately, I would like to have the count of user logon and logoff and there arent' the data corresponding. All informat… --- ## [High CPU usage for filebeat under 9000+/sec logs](https://discuss.elastic.co/t/high-cpu-usage-for-filebeat-under-9000-sec-logs/45313)
**Author:** [@Chen\_Jian](https://discuss.elastic.co/u/Chen_Jian)\ **Replies:** 3\ **Last updated:** [March 29, 2016, 11:47am UTC](https://discuss.elastic.co/t/high-cpu-usage-for-filebeat-under-9000-sec-logs/45313 "2016-03-29T11:47:56Z")
I have use filebeats to collect logs and sent to kafka. 1000 /sec, the cpu usage is 4%. 9000+ /sec, the CPU usage reach to 500+%. AWS ec2 with 24 core. --- ## [Topbeat monitor heap etc](https://discuss.elastic.co/t/topbeat-monitor-heap-etc/45645)
**Author:** [@talk2cshah](https://discuss.elastic.co/u/talk2cshah)\ **Replies:** 0\ **Last updated:** [March 29, 2016, 5:36am UTC](https://discuss.elastic.co/t/topbeat-monitor-heap-etc/45645 "2016-03-29T05:36:07Z")
Can we use topbeat for monitoring JVM metrics like heap memory, active threads, garbage collection etc.?? --- ## [Redhat 5 or Centos 5 support](https://discuss.elastic.co/t/redhat-5-or-centos-5-support/45622)
**Author:** [@SuperBuster](https://discuss.elastic.co/u/SuperBuster)\ **Replies:** 1\ **Last updated:** [March 28, 2016, 8:24pm UTC](https://discuss.elastic.co/t/redhat-5-or-centos-5-support/45622 "2016-03-28T20:24:23Z")
Hi, any of you where able to install filebeat/packetbeat under centos 5 or redhat 5? Right now i have 400 machines under redhat 5 and a massive upgrade of those machines is not possible.... All my servers on redhat 6… --- ## [Multiple document- types in filebeat](https://discuss.elastic.co/t/multiple-document-types-in-filebeat/44897)
**Author:** [@valjohn1647](https://discuss.elastic.co/u/valjohn1647)\ **Replies:** 2\ **Last updated:** [March 28, 2016, 10:10am UTC](https://discuss.elastic.co/t/multiple-document-types-in-filebeat/44897 "2016-03-28T10:10:05Z")
Hi All I need to set the multiple document\_type for each log path, blow is the configuration that i used . After that filebeat only send lastly defined log files to the server ( document\_type with cucum-cdr) , not… --- ## [Multiple Paths for different Indexes](https://discuss.elastic.co/t/multiple-paths-for-different-indexes/44511)
**Author:** [@Sameer\_Panicker](https://discuss.elastic.co/u/Sameer_Panicker)\ **Replies:** 6\ **Last updated:** [March 27, 2016, 7:14pm UTC](https://discuss.elastic.co/t/multiple-paths-for-different-indexes/44511 "2016-03-27T19:14:01Z")
Can I configure multiple log path for multiple indexes. At present I have indexes named as IISLogs and ServiceLogs. I am using FB -\> ES -\> KB. Is it possible to configure C:\\My IIS LOGS\\\*.log -\> IISLOGS and C:\\My Serv… --- ## [Can the "field" property be used to extract a value from the message body, and why not?](https://discuss.elastic.co/t/can-the-field-property-be-used-to-extract-a-value-from-the-message-body-and-why-not/45510)
**Author:** [@discuss03](https://discuss.elastic.co/u/discuss03)\ **Replies:** 1\ **Last updated:** [March 26, 2016, 12:26pm UTC](https://discuss.elastic.co/t/can-the-field-property-be-used-to-extract-a-value-from-the-message-body-and-why-not/45510 "2016-03-26T12:26:20Z")
I have been trying to figure out how to extract from an apache/nginx log with combined format the fields for: client IP, agent-type, HTTP error code, etc. I have noticed that Filebeat has regex support for multiline re… --- ## [Dockerizing TopBeat and get host Metrics](https://discuss.elastic.co/t/dockerizing-topbeat-and-get-host-metrics/45489)
**Author:** [@shanmuga\_karna](https://discuss.elastic.co/u/shanmuga_karna)\ **Replies:** 1\ **Last updated:** [March 25, 2016, 11:24pm UTC](https://discuss.elastic.co/t/dockerizing-topbeat-and-get-host-metrics/45489 "2016-03-25T23:24:12Z")
Hi All, I'm trying to dockerize all the beats, to make deployments ease, and still get Host specific data and not docker specific. FileBeat --\> I can mount files from the host machine PacketBeat --\> By running on th… --- ## [Topbeat not talking to Logstash](https://discuss.elastic.co/t/topbeat-not-talking-to-logstash/45406)
**Author:** [@Patrick\_Barker](https://discuss.elastic.co/u/Patrick_Barker)\ **Replies:** 10\ **Last updated:** [March 25, 2016, 4:18pm UTC](https://discuss.elastic.co/t/topbeat-not-talking-to-logstash/45406 "2016-03-25T16:18:04Z")
Hey, I am just getting going with Topbeat and am having trouble getting it to talk to logstash. I have installed to plugin and followed all the instructions, but am still not getting data. Topbeat says it is connected an… --- ## [Selected windows log events](https://discuss.elastic.co/t/selected-windows-log-events/45441)
**Author:** [@zen.xen](https://discuss.elastic.co/u/zen.xen)\ **Replies:** 2\ **Last updated:** [March 25, 2016, 2:56pm UTC](https://discuss.elastic.co/t/selected-windows-log-events/45441 "2016-03-25T14:56:02Z")
Hello, I am looking for an information but I haven't found it, is it possible to exclude some events from sending to ELK installed and configured on Windows server? --- ## [What happens when I stop the Winlogbeat service?](https://discuss.elastic.co/t/what-happens-when-i-stop-the-winlogbeat-service/45389)
**Author:** [@Kevin-Valle](https://discuss.elastic.co/u/Kevin-Valle)\ **Replies:** 1\ **Last updated:** [March 24, 2016, 10:57pm UTC](https://discuss.elastic.co/t/what-happens-when-i-stop-the-winlogbeat-service/45389 "2016-03-24T22:57:27Z")
Hi, just a quick question regarding what happens when the Winlogbeat service is stopped: Is there a possibility of losing unsent events? Or does the service wait until all unsent messages are sent before shutting down? W… --- ## [Filebeats on ElasticBean Stalk](https://discuss.elastic.co/t/filebeats-on-elasticbean-stalk/35171)
**Author:** [@Mathew\_Mathew](https://discuss.elastic.co/u/Mathew_Mathew)\ **Replies:** 2\ **Last updated:** [March 24, 2016, 6:33pm UTC](https://discuss.elastic.co/t/filebeats-on-elasticbean-stalk/35171 "2016-03-24T18:33:42Z")
Trying to setup filebeats on elastic bean stalk to forward to the AWS Elasticsearch service. Getting this error when I try to start filebeats. Starting filebeat: 2015/11/20 17:01:23.891713 main.go:42: CRIT Config err… --- ## [Trouble getting topbeat data into elasticsearch via logstash](https://discuss.elastic.co/t/trouble-getting-topbeat-data-into-elasticsearch-via-logstash/45062)
**Author:** [@velvetpixel](https://discuss.elastic.co/u/velvetpixel)\ **Replies:** 6\ **Last updated:** [March 24, 2016, 4:03pm UTC](https://discuss.elastic.co/t/trouble-getting-topbeat-data-into-elasticsearch-via-logstash/45062 "2016-03-24T16:03:48Z")
Newbie here so bash lightly \[:slight\_smile:\] I have a host server with ELK installed and able to view filebeat data sent from a client server to logstash on the host. I want to also view topbeat data from that same … --- ## [How to configure a Beat to log to the console](https://discuss.elastic.co/t/how-to-configure-a-beat-to-log-to-the-console/44537)
**Author:** [@marminthibaut](https://discuss.elastic.co/u/marminthibaut)\ **Replies:** 2\ **Last updated:** [March 24, 2016, 1:48pm UTC](https://discuss.elastic.co/t/how-to-configure-a-beat-to-log-to-the-console/44537 "2016-03-24T13:48:15Z")
Hi, I'm trying to configure a Beat in a Docker container, that's why I need my beat to log to stdout/stderr. In the logging section of the configuration file, it is written: # There are three options for the log oupu… --- ## [Kafka output and ssl support](https://discuss.elastic.co/t/kafka-output-and-ssl-support/42642)
**Author:** [@owulff](https://discuss.elastic.co/u/owulff)\ **Replies:** 4\ **Last updated:** [March 24, 2016, 12:16pm UTC](https://discuss.elastic.co/t/kafka-output-and-ssl-support/42642 "2016-03-24T12:16:00Z")
Hi there I appreciate the simplification of the architecture described here Is it planned to support SSL for the Kafka output? Thanks Oli --- ## [Loadbalance: false - filebeat doesn't take random host to connect to](https://discuss.elastic.co/t/loadbalance-false-filebeat-doesnt-take-random-host-to-connect-to/43451)
**Author:** [@Karol\_Stojek](https://discuss.elastic.co/u/Karol_Stojek)\ **Replies:** 10\ **Last updated:** [March 24, 2016, 9:03am UTC](https://discuss.elastic.co/t/loadbalance-false-filebeat-doesnt-take-random-host-to-connect-to/43451 "2016-03-24T09:03:55Z")
the loadbalance: false option doesn't take random endpoint to connect to. I have a list in hosts that consists of 30 endpoints. I run 18 instances of filebeat with this configuration. They all try to connect to exactly… --- ## [Filebeat & kafka integration not working](https://discuss.elastic.co/t/filebeat-kafka-integration-not-working/45207)
**Author:** [@rkarra](https://discuss.elastic.co/u/rkarra)\ **Replies:** 5\ **Last updated:** [March 23, 2016, 5:36pm UTC](https://discuss.elastic.co/t/filebeat-kafka-integration-not-working/45207 "2016-03-23T17:36:49Z")
Hello, I have probleme to communicate filebeat with Kafka. My working configuration is : Filebeat -\> Kafka -\> Logstash -\> Elasticsearch her is my filebeat.yml filebeat: prospectors: - paths: - /appli/okad/logs/… --- ## [Packetbeat: Packetbeat on Windows Server 2008, running but not logging](https://discuss.elastic.co/t/packetbeat-packetbeat-on-windows-server-2008-running-but-not-logging/44970)
**Author:** [@krushnat\_khawale](https://discuss.elastic.co/u/krushnat_khawale)\ **Replies:** 7\ **Last updated:** [March 23, 2016, 1:19pm UTC](https://discuss.elastic.co/t/packetbeat-packetbeat-on-windows-server-2008-running-but-not-logging/44970 "2016-03-23T13:19:12Z")
Hello {Elastic} World, I am able to run Packetbeat successfully on one of staging server(windows server 2008), but it is not sending data to ES of remote computers. I've packetbeat logs for 3 days, and I am only seeing… --- ## [Filebeat -\> Logstash "write: broken pipe"](https://discuss.elastic.co/t/filebeat-logstash-write-broken-pipe/45077)
**Author:** [@gregoryo](https://discuss.elastic.co/u/gregoryo)\ **Replies:** 8\ **Last updated:** [March 23, 2016, 2:43am UTC](https://discuss.elastic.co/t/filebeat-logstash-write-broken-pipe/45077 "2016-03-23T02:43:14Z")
I'm having trouble getting TLS communication working between Filebeat and Logstash. I have followed @andrewkroh 's advice and got this far: $ curl -v --cacert ca.crt https://logs.andrewkroh.com:5044 $ curl: (52) Empty … --- ## [Xgo not found when running the make step in a beat-generator generated beat](https://discuss.elastic.co/t/xgo-not-found-when-running-the-make-step-in-a-beat-generator-generated-beat/45052)
**Author:** [@jerrac](https://discuss.elastic.co/u/jerrac)\ **Replies:** 3\ **Last updated:** [March 22, 2016, 8:07pm UTC](https://discuss.elastic.co/t/xgo-not-found-when-running-the-make-step-in-a-beat-generator-generated-beat/45052 "2016-03-22T20:07:20Z")
After making a test beat with beat-generator, I tried building it with the dev-tools/packer scripts. The readme has this section: Package To cross-compile and package Davidbeat for all supported platforms, run the f… --- ## [Beats 1.2.0 availability](https://discuss.elastic.co/t/beats-1-2-0-availability/45148)
**Author:** [@owulff](https://discuss.elastic.co/u/owulff)\ **Replies:** 1\ **Last updated:** [March 22, 2016, 8:02pm UTC](https://discuss.elastic.co/t/beats-1-2-0-availability/45148 "2016-03-22T20:02:03Z")
Hi there Do you have already a rough estimate by when beats 1.2.0 will be released? Thanks Oli --- ## [Beat's newfound love for kafka should (also) be synchronous](https://discuss.elastic.co/t/beats-newfound-love-for-kafka-should-also-be-synchronous/45113)
**Author:** [@trixpan](https://discuss.elastic.co/u/trixpan)\ **Replies:** 3\ **Last updated:** [March 22, 2016, 3:50pm UTC](https://discuss.elastic.co/t/beats-newfound-love-for-kafka-should-also-be-synchronous/45113 "2016-03-22T15:50:59Z")
I didn't raise a github issue but I was reviewing beats newly implemented kafka output and noticed its use of Sarama's async producer. This is great but I have the strong suspicion it will cause message loss when agent… --- ## [Filebeat output all events to multiple logstash instances](https://discuss.elastic.co/t/filebeat-output-all-events-to-multiple-logstash-instances/45123)
**Author:** [@herron](https://discuss.elastic.co/u/herron)\ **Replies:** 1\ **Last updated:** [March 22, 2016, 3:30pm UTC](https://discuss.elastic.co/t/filebeat-output-all-events-to-multiple-logstash-instances/45123 "2016-03-22T15:30:46Z")
Hi There, I'm trying to send all log events ("tee") to two separate logstash instances using filebeat. This is not to accomplish HA, but rather to send all log events to my logstash cluster and my customer's logstash … --- ## [Beats for Solaris Platform](https://discuss.elastic.co/t/beats-for-solaris-platform/44722)
**Author:** [@techrawther](https://discuss.elastic.co/u/techrawther)\ **Replies:** 7\ **Last updated:** [March 22, 2016, 2:39pm UTC](https://discuss.elastic.co/t/beats-for-solaris-platform/44722 "2016-03-22T14:39:08Z")
I am trying to install beats for Solaris and some ARM platforms so I am compiling from source code. As first step I tried to compile from source code for Solaris platform . Following are the steps I followed. Instal… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=586) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=588)