# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=588 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 589 --- ## [Packetbeat: What are the databases/servers that we can listen to?](https://discuss.elastic.co/t/packetbeat-what-are-the-databases-servers-that-we-can-listen-to/44809)
**Author:** [@krushnat\_khawale](https://discuss.elastic.co/u/krushnat_khawale)\ **Replies:** 4\ **Last updated:** [March 22, 2016, 1:24pm UTC](https://discuss.elastic.co/t/packetbeat-what-are-the-databases-servers-that-we-can-listen-to/44809 "2016-03-22T13:24:36Z")
I am using packetbeat for monitoring servers, and I want to listen to the db-servers like oracle, mssql server and so. Does it support listening to them as well? I'd mentioned oracle under protocol and port no 1521 but i… --- ## [Filebeat doesn't resume transmission to logstash after connection interruption](https://discuss.elastic.co/t/filebeat-doesnt-resume-transmission-to-logstash-after-connection-interruption/45087)
**Author:** [@Qtax](https://discuss.elastic.co/u/Qtax)\ **Replies:** 3\ **Last updated:** [March 22, 2016, 12:17pm UTC](https://discuss.elastic.co/t/filebeat-doesnt-resume-transmission-to-logstash-after-connection-interruption/45087 "2016-03-22T12:17:34Z")
Reporting this here since https://github.com/elastic/beats/issues/new told me to. We have filebeat running on several (Ubuntu) servers and transmitting logs to logstash on another server (also Ubuntu) (logstash sends… --- ## [Pulling details of an event entry with Winlogbeat](https://discuss.elastic.co/t/pulling-details-of-an-event-entry-with-winlogbeat/43506)
**Author:** [@snbart1](https://discuss.elastic.co/u/snbart1)\ **Replies:** 5\ **Last updated:** [March 22, 2016, 11:44am UTC](https://discuss.elastic.co/t/pulling-details-of-an-event-entry-with-winlogbeat/43506 "2016-03-22T11:44:40Z")
Hello everybody, I'm new working with the ELK stack. Actually I realized that it seems to be impossible to get the details of events with Winlogbeat. Only the General (or System in XML view) section is parsed. Did I m… --- ## [Filebeats not shipping auth.log](https://discuss.elastic.co/t/filebeats-not-shipping-auth-log/45054)
**Author:** [@dach384](https://discuss.elastic.co/u/dach384)\ **Replies:** 1\ **Last updated:** [March 22, 2016, 6:49am UTC](https://discuss.elastic.co/t/filebeats-not-shipping-auth-log/45054 "2016-03-22T06:49:52Z")
Hi there, Filebeat version = 1.1.2 Operating System = Ubuntu 12.04 The problem I'm having is that my auth.log is being sent to logstash server. It might be that the auth.log is owned by user "syslog" and group "adm"… --- ## [Winlogbeat reports wrong event\_id on Windows Server 2003](https://discuss.elastic.co/t/winlogbeat-reports-wrong-event-id-on-windows-server-2003/44982)
**Author:** [@tuankun](https://discuss.elastic.co/u/tuankun)\ **Replies:** 2\ **Last updated:** [March 22, 2016, 6:22am UTC](https://discuss.elastic.co/t/winlogbeat-reports-wrong-event-id-on-windows-server-2003/44982 "2016-03-22T06:22:14Z")
Hi everyone, I run winlogbeat 1.1 on windows server 2003 sp2 32bit OS, and configure winlogbeat.yml as follows: event\_logs: - name: Application ignore\_older: 3h - name: Security ignore\_older: … --- ## [Controlling memory and cpu footprint of filebeat](https://discuss.elastic.co/t/controlling-memory-and-cpu-footprint-of-filebeat/44963)
**Author:** [@Sai\_Birada](https://discuss.elastic.co/u/Sai_Birada)\ **Replies:** 4\ **Last updated:** [March 22, 2016, 5:59am UTC](https://discuss.elastic.co/t/controlling-memory-and-cpu-footprint-of-filebeat/44963 "2016-03-22T05:59:40Z")
Can we somehow control 1) No of threads used by filebeat. 2) CPU utilization, other than through scan\_frequency. 3) Memory utilization. --- ## [Filebeat fails? file.go:84: Fail to convert the event to JSON - reflect.Value.IsNil on zero Value](https://discuss.elastic.co/t/filebeat-fails-file-go-84-fail-to-convert-the-event-to-json-reflect-value-isnil-on-zero-value/44877)
**Author:** [@dromrell](https://discuss.elastic.co/u/dromrell)\ **Replies:** 4\ **Last updated:** [March 21, 2016, 10:40pm UTC](https://discuss.elastic.co/t/filebeat-fails-file-go-84-fail-to-convert-the-event-to-json-reflect-value-isnil-on-zero-value/44877 "2016-03-21T22:40:20Z")
I am trying to ingest some large log files into ELK. Recently setup Filebeat to monitor a watch folder that I drop logs into. This has been working great on my sample data. As I copy over a directory with a days worth… --- ## [Issues with packetbeat geo Location](https://discuss.elastic.co/t/issues-with-packetbeat-geo-location/44792)
**Author:** [@padmajav9](https://discuss.elastic.co/u/padmajav9)\ **Replies:** 10\ **Last updated:** [March 21, 2016, 9:30pm UTC](https://discuss.elastic.co/t/issues-with-packetbeat-geo-location/44792 "2016-03-21T21:30:46Z")
Hello, I have configured the host to push network traffic using packet beat. On kibana, I was able to see packet beat dashboard too. But in my dashboard, i was not able to see the geolocation. When I check what packet … --- ## [Winlogbeat and Reading Log Files](https://discuss.elastic.co/t/winlogbeat-and-reading-log-files/42035)
**Author:** [@Franck\_Strohmenger](https://discuss.elastic.co/u/Franck_Strohmenger)\ **Replies:** 4\ **Last updated:** [March 21, 2016, 8:27pm UTC](https://discuss.elastic.co/t/winlogbeat-and-reading-log-files/42035 "2016-03-21T20:27:48Z")
Hello, I'm working on a ELK server to monitor a windows server 2008 R2 farm. I installed Winlogbeat agent on my client servers and it works pretty good with windows event logs. I want to go further and ship logs from lo… --- ## [Error sending logs with filebeat](https://discuss.elastic.co/t/error-sending-logs-with-filebeat/45013)
**Author:** [@marcmga](https://discuss.elastic.co/u/marcmga)\ **Replies:** 1\ **Last updated:** [March 21, 2016, 6:21pm UTC](https://discuss.elastic.co/t/error-sending-logs-with-filebeat/45013 "2016-03-21T18:21:23Z")
Hello, Suddently my logstash server has stopped receiving logs from filebeat (whatever the server was, not just one but all). I think that the problem started when i had problems with my itnernet connection (where logs… --- ## [Filebeat log filename when using recursive \*.log filter](https://discuss.elastic.co/t/filebeat-log-filename-when-using-recursive-log-filter/45025)
**Author:** [@JakeDEvans](https://discuss.elastic.co/u/JakeDEvans)\ **Replies:** 2\ **Last updated:** [March 21, 2016, 5:51pm UTC](https://discuss.elastic.co/t/filebeat-log-filename-when-using-recursive-log-filter/45025 "2016-03-21T17:51:22Z")
I was wondering if there is a way to log the source filename of each file filebeat collects logs from without manually specifying fields for each file individually. Thank You -Jake --- ## [Beats Load Balancing Query](https://discuss.elastic.co/t/beats-load-balancing-query/44976)
**Author:** [@Chris\_Broll](https://discuss.elastic.co/u/Chris_Broll)\ **Replies:** 2\ **Last updated:** [March 21, 2016, 1:28pm UTC](https://discuss.elastic.co/t/beats-load-balancing-query/44976 "2016-03-21T13:28:12Z")
When I set up \*beat (v1.1) to forwarding to two logstash (v2.2.0) instances in a two node cluster using load balance in the yaml files and then stop the logstash service on host1 I am not seeing any metrics coming in. … --- ## [How to run beats in linux 64 bit machine](https://discuss.elastic.co/t/how-to-run-beats-in-linux-64-bit-machine/39873)
**Author:** [@rajkamalkool6](https://discuss.elastic.co/u/rajkamalkool6)\ **Replies:** 5\ **Last updated:** [March 21, 2016, 11:57am UTC](https://discuss.elastic.co/t/how-to-run-beats-in-linux-64-bit-machine/39873 "2016-03-21T11:57:29Z")
I am trying to start the packet beat in my linux machine(64bit). I am using the below command , ./packetbeat -e -c packetbeat.yml. The system is waiting silently without throwing any error or any message. Am I doing … --- ## [\[Solved\] - Ignore\_older for infinite time](https://discuss.elastic.co/t/solved-ignore-older-for-infinite-time/44411)
**Author:** [@mikula](https://discuss.elastic.co/u/mikula)\ **Replies:** 2\ **Last updated:** [March 21, 2016, 11:24am UTC](https://discuss.elastic.co/t/solved-ignore-older-for-infinite-time/44411 "2016-03-21T11:24:13Z")
Is there any value of ignore\_older to disable this feature (I tried "0") but no luck. --- ## [Filebeat - received an event - has different character encoding](https://discuss.elastic.co/t/filebeat-received-an-event-has-different-character-encoding/40510)
**Author:** [@j123](https://discuss.elastic.co/u/j123)\ **Replies:** 20\ **Last updated:** [March 21, 2016, 11:21am UTC](https://discuss.elastic.co/t/filebeat-received-an-event-has-different-character-encoding/40510 "2016-03-21T11:21:28Z")
Hello, I am using filebeat (Linux box) to send logs to ELK - logstash., It is not sending UTF-8 (Linux) encoding. Looks like hexa-decimal. Help please. error message in logstash.log: {:timestamp=\>"2016-01-29T11:47… --- ## [Load balance the events between the Logstash hosts](https://discuss.elastic.co/t/load-balance-the-events-between-the-logstash-hosts/44952)
**Author:** [@Sumantha\_Kannantha](https://discuss.elastic.co/u/Sumantha_Kannantha)\ **Replies:** 2\ **Last updated:** [March 21, 2016, 10:48am UTC](https://discuss.elastic.co/t/load-balance-the-events-between-the-logstash-hosts/44952 "2016-03-21T10:48:15Z")
This is regarding load balancing option we have for filebeat. logstash: hosts: \["host1:5044","host2:5044"\] loadbalance: true What will be the algorithm it will be using if we enable load balance? We are using codec =\>… --- ## [How to generate init scripts for community beats?](https://discuss.elastic.co/t/how-to-generate-init-scripts-for-community-beats/44493)
**Author:** [@jerrac](https://discuss.elastic.co/u/jerrac)\ **Replies:** 3\ **Last updated:** [March 21, 2016, 7:39am UTC](https://discuss.elastic.co/t/how-to-generate-init-scripts-for-community-beats/44493 "2016-03-21T07:39:13Z")
I was just experimenting with apachebeat. I was able to get it working well on the test server. Then I was ready to add it to more server, but realized that it did not come with an init file. What is the best way to … --- ## [Topbeat doesn't send metrics to Logstash in client-server architecture](https://discuss.elastic.co/t/topbeat-doesnt-send-metrics-to-logstash-in-client-server-architecture/44881)
**Author:** [@jstar](https://discuss.elastic.co/u/jstar)\ **Replies:** 6\ **Last updated:** [March 19, 2016, 5:30pm UTC](https://discuss.elastic.co/t/topbeat-doesnt-send-metrics-to-logstash-in-client-server-architecture/44881 "2016-03-19T17:30:45Z")
Hi all, I just set up topbeat following the documentation. But I can't have metrics of my cluster in logstash. I use a client-server architecture (i.e a client with Topbeat configured and installed and a server with lo… --- ## [Missing "origin" field on filebeat & packetbeat deb packages](https://discuss.elastic.co/t/missing-origin-field-on-filebeat-packetbeat-deb-packages/44541)
**Author:** [@fbarbeira](https://discuss.elastic.co/u/fbarbeira)\ **Replies:** 4\ **Last updated:** [March 18, 2016, 1:51pm UTC](https://discuss.elastic.co/t/missing-origin-field-on-filebeat-packetbeat-deb-packages/44541 "2016-03-18T13:51:52Z")
I have the installation of debian packages automatized with the package "unattended-upgrades", which I think is the "debian & ubuntu way" to do the automatic upgrades. In the "unattended-upgrades" config you must select … --- ## [How do I route logs that coming through beats?](https://discuss.elastic.co/t/how-do-i-route-logs-that-coming-through-beats/44015)
**Author:** [@panda87](https://discuss.elastic.co/u/panda87)\ **Replies:** 3\ **Last updated:** [March 18, 2016, 1:43pm UTC](https://discuss.elastic.co/t/how-do-i-route-logs-that-coming-through-beats/44015 "2016-03-18T13:43:11Z")
I saw today that on v5 you implemented kafka as output which is great! My question is if I'll be able to route the logs to different topics with beats according fields in the log? --- ## [Unable to get PostgreSQL performance in packetbeat](https://discuss.elastic.co/t/unable-to-get-postgresql-performance-in-packetbeat/43477)
**Author:** [@abcfy2](https://discuss.elastic.co/u/abcfy2)\ **Replies:** 13\ **Last updated:** [March 18, 2016, 1:21pm UTC](https://discuss.elastic.co/t/unable-to-get-postgresql-performance-in-packetbeat/43477 "2016-03-18T13:21:49Z")
I install the PostgreSQL from official repo on Ubuntu 14.04 LTS. Here is the postgresql config(Almost keep the default, but remove the comment lines.) # cat /etc/postgresql/9.4/main/postgresql.conf data\_directory = '/v… --- ## [Reporting Windows Security Events in Kibana](https://discuss.elastic.co/t/reporting-windows-security-events-in-kibana/44748)
**Author:** [@dickepa](https://discuss.elastic.co/u/dickepa)\ **Replies:** 3\ **Last updated:** [March 18, 2016, 9:15am UTC](https://discuss.elastic.co/t/reporting-windows-security-events-in-kibana/44748 "2016-03-18T09:15:45Z")
Hi, I've been experimenting with ELK for reporting Windows security events. Whilst I'm able to get the data into logstash using Winlogbeats over TLS, I've yet to visualize the activity of users on servers. These are t… --- ## [Filebeat connection refused eof](https://discuss.elastic.co/t/filebeat-connection-refused-eof/43914)
**Author:** [@cernicb](https://discuss.elastic.co/u/cernicb)\ **Replies:** 6\ **Last updated:** [March 18, 2016, 8:37am UTC](https://discuss.elastic.co/t/filebeat-connection-refused-eof/43914 "2016-03-18T08:37:11Z")
We use filebeat -\> logstash to transport logs to graylog. As soon as filebeat logs: Error publishing events (retrying): EOF it is followed by: Connecting error publishing events (retrying): dial tcp y.y.y.y:5043: g… --- ## [Dashboard for Beats in containers docker](https://discuss.elastic.co/t/dashboard-for-beats-in-containers-docker/44450)
**Author:** [@daguero](https://discuss.elastic.co/u/daguero)\ **Replies:** 1\ **Last updated:** [March 18, 2016, 8:23am UTC](https://discuss.elastic.co/t/dashboard-for-beats-in-containers-docker/44450 "2016-03-18T08:23:57Z")
I am running a ELK using containers docker (elasticsearch 2.2.0, logstash 2.2.2, kibana 4.4.1) and I can not upload dashboard for Beats, I'm following the directions of this project GitHub - elastic/beats-dashboards: DEP… --- ## [GapInStream exception that specifies "please report this"](https://discuss.elastic.co/t/gapinstream-exception-that-specifies-please-report-this/44376)
**Author:** [@adimarco](https://discuss.elastic.co/u/adimarco)\ **Replies:** 1\ **Last updated:** [March 18, 2016, 8:18am UTC](https://discuss.elastic.co/t/gapinstream-exception-that-specifies-please-report-this/44376 "2016-03-18T08:18:31Z")
I installed packetbeat with the default protocols configuration, and my /var/log/messages immediately starts filling up with tons of errors like the following. The error asks me to report it, so here's the report. Let… --- ## [Connecting Logstash to Filebeats](https://discuss.elastic.co/t/connecting-logstash-to-filebeats/44639)
**Author:** [@nateuni](https://discuss.elastic.co/u/nateuni)\ **Replies:** 1\ **Last updated:** [March 18, 2016, 4:51am UTC](https://discuss.elastic.co/t/connecting-logstash-to-filebeats/44639 "2016-03-18T04:51:33Z")
The post is in the Logstash Thread located here.. Help needed please! --- ## [TOPBEAT \> WINDOWS : Topbeat starting but showing error in log](https://discuss.elastic.co/t/topbeat-windows-topbeat-starting-but-showing-error-in-log/44428)
**Author:** [@krushnat\_khawale](https://discuss.elastic.co/u/krushnat_khawale)\ **Replies:** 14\ **Last updated:** [March 18, 2016, 3:03am UTC](https://discuss.elastic.co/t/topbeat-windows-topbeat-starting-but-showing-error-in-log/44428 "2016-03-18T03:03:33Z")
Hi, I am using Topbeat for monitoring. I've downloaded and followed process as per instructions. I am using WINDOWS and I want to post my logs to a the computer in my network(10.77.240116) After running topbeat power… --- ## [Packetbeat have problems with sniffer.go:297: DBG Interrupted](https://discuss.elastic.co/t/packetbeat-have-problems-with-sniffer-go-297-dbg-interrupted/44054)
**Author:** [@daguero](https://discuss.elastic.co/u/daguero)\ **Replies:** 5\ **Last updated:** [March 17, 2016, 9:25pm UTC](https://discuss.elastic.co/t/packetbeat-have-problems-with-sniffer-go-297-dbg-interrupted/44054 "2016-03-17T21:25:08Z")
I tried to use Packetbeat for network monitoring and have problems. I followed the recommended configuration on the official site, but when you run: ok@ok-VirtualBox1:~/Desktop/packetbeat$ packetbeat -e -c packetbeat.y… --- ## [Topbeat sometimes returns an invalid value for cpu.system\_p on Windows](https://discuss.elastic.co/t/topbeat-sometimes-returns-an-invalid-value-for-cpu-system-p-on-windows/43706)
**Author:** [@MarcoPonton](https://discuss.elastic.co/u/MarcoPonton)\ **Replies:** 9\ **Last updated:** [March 17, 2016, 3:29pm UTC](https://discuss.elastic.co/t/topbeat-sometimes-returns-an-invalid-value-for-cpu-system-p-on-windows/43706 "2016-03-17T15:29:21Z")
Hi, I've been running Topbeats on servers for a PoC at a client for about 3 weeks. Every now and then, Topbeat returns an invalid cpu.system\_p value. This of course does not look very good on a graph... So far I've see… --- ## [How does the dynamic typing work in filebeat](https://discuss.elastic.co/t/how-does-the-dynamic-typing-work-in-filebeat/44569)
**Author:** [@jclose](https://discuss.elastic.co/u/jclose)\ **Replies:** 1\ **Last updated:** [March 17, 2016, 2:41pm UTC](https://discuss.elastic.co/t/how-does-the-dynamic-typing-work-in-filebeat/44569 "2016-03-17T14:41:39Z")
We are looking to send a plethora of different logs into a downstream logstash cluster. How exactly does the type setting work within filebeat, so that I can appropriately tag incoming data in logstash in order to grok… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=587) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=589)