# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=589 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 590 --- ## [FileBeat problem while conencting to logstash](https://discuss.elastic.co/t/filebeat-problem-while-conencting-to-logstash/44676)
**Author:** [@Muddassir](https://discuss.elastic.co/u/Muddassir)\ **Replies:** 1\ **Last updated:** [March 17, 2016, 12:01pm UTC](https://discuss.elastic.co/t/filebeat-problem-while-conencting-to-logstash/44676 "2016-03-17T12:01:20Z")
Hi concerns. I am having the following issue in ELK setup. can anyone help me. Thanks. /etc/init.d/filebeat start Starting filebeat: 2016/03/17 08:43:59.371599 transport.go:125: ERR SSL client failed to connect with… --- ## [Using Channel Names in Winlogbeat Config](https://discuss.elastic.co/t/using-channel-names-in-winlogbeat-config/44555)
**Author:** [@ArneO](https://discuss.elastic.co/u/ArneO)\ **Replies:** 4\ **Last updated:** [March 17, 2016, 8:02am UTC](https://discuss.elastic.co/t/using-channel-names-in-winlogbeat-config/44555 "2016-03-17T08:02:39Z")
Is it possible to use Winlogbeat for the "Application and Services Log" types in addition to the eventlog? --- ## [The bird view of the communication flows](https://discuss.elastic.co/t/the-bird-view-of-the-communication-flows/44399)
**Author:** [@Augustin\_Chen](https://discuss.elastic.co/u/Augustin_Chen)\ **Replies:** 1\ **Last updated:** [March 16, 2016, 10:15am UTC](https://discuss.elastic.co/t/the-bird-view-of-the-communication-flows/44399 "2016-03-16T10:15:59Z")
In the introduction page of the packet, I notice the following chart and the introduction: Sometimes you need the bird's eye view of how communications flow through your network. I install the beat dashboard, but the… --- ## [What is the best way to extract Syslog Fields with Beats Inputs](https://discuss.elastic.co/t/what-is-the-best-way-to-extract-syslog-fields-with-beats-inputs/44447)
**Author:** [@marius](https://discuss.elastic.co/u/marius)\ **Replies:** 3\ **Last updated:** [March 15, 2016, 8:15pm UTC](https://discuss.elastic.co/t/what-is-the-best-way-to-extract-syslog-fields-with-beats-inputs/44447 "2016-03-15T20:15:24Z")
Hi, I setup ELK and Logstash with a Beats input: input { beats { port =\> 5044 ssl =\> false # ssl\_certificate =\> "/etc/pki/tls/certs/logstash-beats.crt" # ssl\_key =\> "/etc/pki/tls/private/logstash-beat… --- ## [Search for IISLogs](https://discuss.elastic.co/t/search-for-iislogs/44109)
**Author:** [@Sameer\_Panicker](https://discuss.elastic.co/u/Sameer_Panicker)\ **Replies:** 11\ **Last updated:** [March 15, 2016, 4:01pm UTC](https://discuss.elastic.co/t/search-for-iislogs/44109 "2016-03-15T16:01:03Z")
How can I search for IISLogs ? What input\_type: ??? should I be using ? --- ## [Filtering Winlogbeat on Event ID](https://discuss.elastic.co/t/filtering-winlogbeat-on-event-id/43899)
**Author:** [@Sean\_Lamm](https://discuss.elastic.co/u/Sean_Lamm)\ **Replies:** 7\ **Last updated:** [March 14, 2016, 8:49pm UTC](https://discuss.elastic.co/t/filtering-winlogbeat-on-event-id/43899 "2016-03-14T20:49:54Z")
Is there a way to filter events in winlogbeat so I am only sending certain event id's? I am specifically looking to send only event id 8003 for now to limit the transmission of data to our ELK stack. I have around 20,000… --- ## [Moving away from logstash-forwarder, and missing a couple of options](https://discuss.elastic.co/t/moving-away-from-logstash-forwarder-and-missing-a-couple-of-options/44202)
**Author:** [@Don\_Pich](https://discuss.elastic.co/u/Don_Pich)\ **Replies:** 1\ **Last updated:** [March 11, 2016, 11:44pm UTC](https://discuss.elastic.co/t/moving-away-from-logstash-forwarder-and-missing-a-couple-of-options/44202 "2016-03-11T23:44:56Z")
I was able to get the installation and configuration of filebeats working fine with one exception. I am trying to set the output of my beats to follow the following logstash-forwarder configuration: "files": \[ … --- ## [Tried to start filebeat error was generated](https://discuss.elastic.co/t/tried-to-start-filebeat-error-was-generated/44194)
**Author:** [@rvaedex23](https://discuss.elastic.co/u/rvaedex23)\ **Replies:** 4\ **Last updated:** [March 11, 2016, 10:39pm UTC](https://discuss.elastic.co/t/tried-to-start-filebeat-error-was-generated/44194 "2016-03-11T22:39:35Z")
I installed the components of ELK and when I tried to start the service filebeat I received this error: outputs.go:113: ERR failed to initialize elasticsearch plugin as output: no host configuration found Error Initial… --- ## [Filebeat not steaming the sar logs](https://discuss.elastic.co/t/filebeat-not-steaming-the-sar-logs/43305)
**Author:** [@vgupta](https://discuss.elastic.co/u/vgupta)\ **Replies:** 4\ **Last updated:** [March 11, 2016, 2:45pm UTC](https://discuss.elastic.co/t/filebeat-not-steaming-the-sar-logs/43305 "2016-03-11T14:45:09Z")
I am getting following error when streaming the system sar log file 2016-03-01T00:24:08Z INFO Read line error: file inactive 2016-03-01T23:53:02Z INFO Harvester started for file: /var/log/sa/sar01 2016-03-02T00:23:07Z … --- ## [Differenciate processes by their arguments](https://discuss.elastic.co/t/differenciate-processes-by-their-arguments/44055)
**Author:** [@palmerabollo](https://discuss.elastic.co/u/palmerabollo)\ **Replies:** 2\ **Last updated:** [March 11, 2016, 1:51pm UTC](https://discuss.elastic.co/t/differenciate-processes-by-their-arguments/44055 "2016-03-11T13:51:57Z")
I know that topbet (gosigar) gets the process name from /proc/:pid/stat in Linux. I have different nodejs processes in the same box: $ ps -ef | grep node myuser 29334 29332 0 12:43 ? 00:00:00 /usr/bin/node /o… --- ## [FileBeat not picking up the updated file asap](https://discuss.elastic.co/t/filebeat-not-picking-up-the-updated-file-asap/43821)
**Author:** [@Sameer\_Panicker](https://discuss.elastic.co/u/Sameer_Panicker)\ **Replies:** 5\ **Last updated:** [March 11, 2016, 11:07am UTC](https://discuss.elastic.co/t/filebeat-not-picking-up-the-updated-file-asap/43821 "2016-03-11T11:07:19Z")
I have installed Elastic Search, FileBeat and Kibana on my Windows 7 machine. As of now my log path is C:\\LogFiles\\ and it contains 5 files(Log File 1.txt...2.txt....). I created it new and have some contents in it. I ed… --- ## [Not able to find Beats version 1.1.2](https://discuss.elastic.co/t/not-able-to-find-beats-version-1-1-2/43880)
**Author:** [@Sumantha\_Kannantha](https://discuss.elastic.co/u/Sumantha_Kannantha)\ **Replies:** 2\ **Last updated:** [March 11, 2016, 10:23am UTC](https://discuss.elastic.co/t/not-able-to-find-beats-version-1-1-2/43880 "2016-03-11T10:23:56Z")
I see Beats version 1.1.2 version in below URL: https://www.elastic.co/guide/en/beats/libbeat/current/release-notes.html However I am not able to find the download Link. We are facing issue similar to Fix registrar bug… --- ## [Beats not outputting to logstash like expected](https://discuss.elastic.co/t/beats-not-outputting-to-logstash-like-expected/43955)
**Author:** [@jcarapet](https://discuss.elastic.co/u/jcarapet)\ **Replies:** 5\ **Last updated:** [March 10, 2016, 10:56pm UTC](https://discuss.elastic.co/t/beats-not-outputting-to-logstash-like-expected/43955 "2016-03-10T22:56:04Z")
Trying to troubleshoot issue with filebeat outputting to logstash. Determined it is a config issue, though cannot determine where the config issue lies. the filebeat.yml passes yaml lint, configtest, and is showing in de… --- ## [Dashboard Kibana to beats](https://discuss.elastic.co/t/dashboard-kibana-to-beats/44050)
**Author:** [@daguero](https://discuss.elastic.co/u/daguero)\ **Replies:** 2\ **Last updated:** [March 10, 2016, 4:59pm UTC](https://discuss.elastic.co/t/dashboard-kibana-to-beats/44050 "2016-03-10T16:59:27Z")
I tried to use the dashboard Kibana to beat and I had problems. Using the https://github.com/elastic/beats-dashboards running this project and the result shown in console is: ........ Loading visualization Client-locat… --- ## [How does Filebeat crawls log files? Inotify?](https://discuss.elastic.co/t/how-does-filebeat-crawls-log-files-inotify/43668)
**Author:** [@Johannes](https://discuss.elastic.co/u/Johannes)\ **Replies:** 3\ **Last updated:** [March 10, 2016, 12:03pm UTC](https://discuss.elastic.co/t/how-does-filebeat-crawls-log-files-inotify/43668 "2016-03-10T12:03:32Z")
Hi \[:slightly\_smiling:\] how does Filebeat crawls log files? Is Filebeat using inotify? Or is Filebeat polling the logs? Thanks for your time and best wishes Johannes --- ## [Packetbeat on Kubernetes](https://discuss.elastic.co/t/packetbeat-on-kubernetes/43965)
**Author:** [@cshuman](https://discuss.elastic.co/u/cshuman)\ **Replies:** 1\ **Last updated:** [March 10, 2016, 11:46am UTC](https://discuss.elastic.co/t/packetbeat-on-kubernetes/43965 "2016-03-10T11:46:58Z")
Does anyone have experience running Packetbeat on Kubernetes? --- ## [I have configured Elasticsearch , KIbana and logstash in separate machine . While trying to config filebeat .File beat is not shipping the logs .Attached Conf files of filebeat and logstash](https://discuss.elastic.co/t/i-have-configured-elasticsearch-kibana-and-logstash-in-separate-machine-while-trying-to-config-filebeat-file-beat-is-not-shipping-the-logs-attached-conf-files-of-filebeat-and-logstash/43971)
**Author:** [@Sudharsankotti](https://discuss.elastic.co/u/Sudharsankotti)\ **Replies:** 1\ **Last updated:** [March 10, 2016, 11:44am UTC](https://discuss.elastic.co/t/i-have-configured-elasticsearch-kibana-and-logstash-in-separate-machine-while-trying-to-config-filebeat-file-beat-is-not-shipping-the-logs-attached-conf-files-of-filebeat-and-logstash/43971 "2016-03-10T11:44:55Z")
--- ## [Multiline config for filebeat](https://discuss.elastic.co/t/multiline-config-for-filebeat/43458)
**Author:** [@kasi](https://discuss.elastic.co/u/kasi)\ **Replies:** 10\ **Last updated:** [March 10, 2016, 11:43am UTC](https://discuss.elastic.co/t/multiline-config-for-filebeat/43458 "2016-03-10T11:43:40Z")
what will be the multiline config for the following stack trace, I have tried everything nothing seems to work. Any help much appreciated Stack Trace: TID: \[0\] \[BAM\] \[2015-11-27 23:51:19,549\] ERROR {org.wso2.carbon.… --- ## [Filebeat multiline help](https://discuss.elastic.co/t/filebeat-multiline-help/43827)
**Author:** [@nradonicich](https://discuss.elastic.co/u/nradonicich)\ **Replies:** 3\ **Last updated:** [March 10, 2016, 11:21am UTC](https://discuss.elastic.co/t/filebeat-multiline-help/43827 "2016-03-10T11:21:45Z")
I am running filebeat v1.1.1 and can't seem to get multiline to work unless the input timeout passes. my data is from NNMi (trying to forward audit to ELK), the data/log looks like... 2016-03-08 14:31:49,744 INFO \[… --- ## [Custom fields are not stored in the message root](https://discuss.elastic.co/t/custom-fields-are-not-stored-in-the-message-root/33585)
**Author:** [@ceekay](https://discuss.elastic.co/u/ceekay)\ **Replies:** 11\ **Last updated:** [March 9, 2016, 9:27am UTC](https://discuss.elastic.co/t/custom-fields-are-not-stored-in-the-message-root/33585 "2016-03-09T09:27:00Z")
Hi there, As per filebeat: prospectors: paths: - /var/log/foo.log field - Pastebin.com Adding custom fields under prospectors: fields: does not give the expected result. Any custom fields are added under a field named… --- ## [Winlogbeat TLS Connection to Logstash](https://discuss.elastic.co/t/winlogbeat-tls-connection-to-logstash/41905)
**Author:** [@doremon](https://discuss.elastic.co/u/doremon)\ **Replies:** 13\ **Last updated:** [March 8, 2016, 4:59pm UTC](https://discuss.elastic.co/t/winlogbeat-tls-connection-to-logstash/41905 "2016-03-08T16:59:43Z")
Hi, I've configured winlogbeat on a Windows Server 2012. However it doesn't work if I enable the tls option. I've tried turning off tls on both client side (winlogbeat config) and on server side (logstash beats input) … --- ## [Packetbeat: monitoring elasticsearch](https://discuss.elastic.co/t/packetbeat-monitoring-elasticsearch/43521)
**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 2\ **Last updated:** [March 8, 2016, 3:50pm UTC](https://discuss.elastic.co/t/packetbeat-monitoring-elasticsearch/43521 "2016-03-08T15:50:15Z")
Hi, Can I ask, is packetbeat able to monitor inter-node communications in an elasticsearch cluster? Regards, David --- ## [Packetbeat support for DB2 database?](https://discuss.elastic.co/t/packetbeat-support-for-db2-database/27886)
**Author:** [@Akhilesh\_Anb](https://discuss.elastic.co/u/Akhilesh_Anb)\ **Replies:** 3\ **Last updated:** [March 8, 2016, 3:45pm UTC](https://discuss.elastic.co/t/packetbeat-support-for-db2-database/27886 "2016-03-08T15:45:34Z")
We want packetbeat support for db2 database. Please tell me whether it supports or not? If not is there any chances of supporting db2 in future? --- ## [How to add custom field in Topbeat](https://discuss.elastic.co/t/how-to-add-custom-field-in-topbeat/40588)
**Author:** [@ponmoh](https://discuss.elastic.co/u/ponmoh)\ **Replies:** 4\ **Last updated:** [March 8, 2016, 8:43am UTC](https://discuss.elastic.co/t/how-to-add-custom-field-in-topbeat/40588 "2016-03-08T08:43:58Z")
Hello, How to add custom fields in Topbeat yml as it is in filebeat prospectors fields ? thanks, Mohan. --- ## [Packetbeat refuses to start - yaml error](https://discuss.elastic.co/t/packetbeat-refuses-to-start-yaml-error/43608)
**Author:** [@bluethundr](https://discuss.elastic.co/u/bluethundr)\ **Replies:** 2\ **Last updated:** [March 8, 2016, 4:37am UTC](https://discuss.elastic.co/t/packetbeat-refuses-to-start-yaml-error/43608 "2016-03-08T04:37:07Z")
Hey guys, I've had a decent set of beats configs distributed by puppet and running well for oh about a month at this point. When suddenly packetbeat as of yesterday stopped functioning. There were know known changes. … --- ## [Filebeats to logstash \_grokparsefailure, direct to ES is fine](https://discuss.elastic.co/t/filebeats-to-logstash--grokparsefailure-direct-to-es-is-fine/43703)
**Author:** [@jwh](https://discuss.elastic.co/u/jwh)\ **Replies:** 1\ **Last updated:** [March 7, 2016, 9:42pm UTC](https://discuss.elastic.co/t/filebeats-to-logstash--grokparsefailure-direct-to-es-is-fine/43703 "2016-03-07T21:42:46Z")
I'm having issues sending syslog to logstash using filebeat, when logstash received the entry it produces a \_grokparsefailure. However if I send directly to ES everything works fine. My logstash config is http://pasteb… --- ## [How to format memory number to show](https://discuss.elastic.co/t/how-to-format-memory-number-to-show/43612)
**Author:** [@szcountryboy](https://discuss.elastic.co/u/szcountryboy)\ **Replies:** 3\ **Last updated:** [March 7, 2016, 9:00pm UTC](https://discuss.elastic.co/t/how-to-format-memory-number-to-show/43612 "2016-03-07T21:00:47Z")
How to format the digital display. For example: memory beat, 8GB acquisition is 8504496128, I want to show as 8GB, so that it looks more intuitive. Thanks --- ## [Domain name missing in Http fields in packetbeat](https://discuss.elastic.co/t/domain-name-missing-in-http-fields-in-packetbeat/31421)
**Author:** [@tarunsapra](https://discuss.elastic.co/u/tarunsapra)\ **Replies:** 3\ **Last updated:** [March 7, 2016, 3:35pm UTC](https://discuss.elastic.co/t/domain-name-missing-in-http-fields-in-packetbeat/31421 "2016-03-07T15:35:52Z")
Hi, I am using packetbeat for network monitoring, in the JSON o/p of http requests I noticed that in the Http sniffing, the fields only contain the json data like - "method": "GET", "params": "… --- ## [Filebeat logging directly to elasticsearch](https://discuss.elastic.co/t/filebeat-logging-directly-to-elasticsearch/43638)
**Author:** [@mbst83r](https://discuss.elastic.co/u/mbst83r)\ **Replies:** 2\ **Last updated:** [March 7, 2016, 1:10pm UTC](https://discuss.elastic.co/t/filebeat-logging-directly-to-elasticsearch/43638 "2016-03-07T13:10:09Z")
Hi guys, i am trying to log from filebeat directly to elasticsearch. Could it be possible that this feature isn't working properly at all? I get no erros on startup, during the run and on shutdown, even not in debug… --- ## [Topbeat and logstash error](https://discuss.elastic.co/t/topbeat-and-logstash-error/43213)
**Author:** [@gabe](https://discuss.elastic.co/u/gabe)\ **Replies:** 23\ **Last updated:** [March 7, 2016, 7:10am UTC](https://discuss.elastic.co/t/topbeat-and-logstash-error/43213 "2016-03-07T07:10:50Z")
HI There, First time using these products, working through the installation procedure and all was going well until the config file /etc/topbeat/topbeat.yml all looks good but getting a strange error about a key in line… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=588) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=590)