# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=590 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 591 --- ## [How to specified the target location to store the log file](https://discuss.elastic.co/t/how-to-specified-the-target-location-to-store-the-log-file/42831)
**Author:** [@wangxiangbill](https://discuss.elastic.co/u/wangxiangbill)\ **Replies:** 6\ **Last updated:** [March 7, 2016, 7:09am UTC](https://discuss.elastic.co/t/how-to-specified-the-target-location-to-store-the-log-file/42831 "2016-03-07T07:09:37Z")
Hi I installed the ELK with filebeat few days ago. I follow up with the blog https://www.digitalocean.com/community/tutorials/how-to-install-elasticsearch-logstash-and-kibana-elk-stack-on-ubuntu-14-04#set-up-filebea… --- ## [Not able to send data from Filebeat to Logstash](https://discuss.elastic.co/t/not-able-to-send-data-from-filebeat-to-logstash/42856)
**Author:** [@vivc](https://discuss.elastic.co/u/vivc)\ **Replies:** 4\ **Last updated:** [March 7, 2016, 2:51am UTC](https://discuss.elastic.co/t/not-able-to-send-data-from-filebeat-to-logstash/42856 "2016-03-07T02:51:27Z")
Filebeat o/p: ##logstash as output logstash: # The logstash hosts hosts:\["172.16.60.32:5044"\] Logstash Conf: input { beats { port =\> 5044 } } Getting the following Error in Log: Connectin… --- ## [Packetbeat on Heroku](https://discuss.elastic.co/t/packetbeat-on-heroku/43570)
**Author:** [@slocumro](https://discuss.elastic.co/u/slocumro)\ **Replies:** 1\ **Last updated:** [March 5, 2016, 11:16pm UTC](https://discuss.elastic.co/t/packetbeat-on-heroku/43570 "2016-03-05T23:16:39Z")
Hi, Is it possible to use Packetbeat on Heroku? I have a rails app running on Heroku that currently pushes log files to an EC2 instance running logstash. Logstash then forwards the logs to 2 EC2 hosts running ES. I have … --- ## [Why have different default index names for each beat?](https://discuss.elastic.co/t/why-have-different-default-index-names-for-each-beat/43560)
**Author:** [@jerrac](https://discuss.elastic.co/u/jerrac)\ **Replies:** 3\ **Last updated:** [March 4, 2016, 11:58pm UTC](https://discuss.elastic.co/t/why-have-different-default-index-names-for-each-beat/43560 "2016-03-04T23:58:04Z")
Topbeat has topbeat-, filebeat has filebeat-, etc. Is there a specific reason for that? As in, it's best to do it that way? Or is it just convenient to have the default set like that? My current practice is to shove ev… --- ## [Rollups similar to what graphite does](https://discuss.elastic.co/t/rollups-similar-to-what-graphite-does/43564)
**Author:** [@Jerry\_Hoffmeister](https://discuss.elastic.co/u/Jerry_Hoffmeister)\ **Replies:** 1\ **Last updated:** [March 4, 2016, 11:55pm UTC](https://discuss.elastic.co/t/rollups-similar-to-what-graphite-does/43564 "2016-03-04T23:55:50Z")
This looks interesting: https://www.elastic.co/blog/a-case-for-self-monitoring-systems but I'm wondering if there's an easy solution for rolling up the historical data as the storage will get very large otherwise if … --- ## [Exclude empty values from output](https://discuss.elastic.co/t/exclude-empty-values-from-output/43517)
**Author:** [@goonzie](https://discuss.elastic.co/u/goonzie)\ **Replies:** 4\ **Last updated:** [March 4, 2016, 9:44pm UTC](https://discuss.elastic.co/t/exclude-empty-values-from-output/43517 "2016-03-04T21:44:04Z")
Hello May be anybody know how can I exclude empty lines for disk usage stat? For example where average fs.total = 0 --- ## [Installing BEATS on a AARCH Linux Machine](https://discuss.elastic.co/t/installing-beats-on-a-aarch-linux-machine/43511)
**Author:** [@techrawther](https://discuss.elastic.co/u/techrawther)\ **Replies:** 1\ **Last updated:** [March 4, 2016, 2:58pm UTC](https://discuss.elastic.co/t/installing-beats-on-a-aarch-linux-machine/43511 "2016-03-04T14:58:06Z")
I downloaded the Linux 64 bit topbeats.zip file extracted and tried to execute on a linux aarch machine . The binaries is not supported. -bash: ./topbeat: cannot execute binary file: Exec format error uname -a is Ub… --- ## [Packetbeat: libpcap](https://discuss.elastic.co/t/packetbeat-libpcap/43516)
**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 2\ **Last updated:** [March 4, 2016, 2:22pm UTC](https://discuss.elastic.co/t/packetbeat-libpcap/43516 "2016-03-04T14:22:40Z")
Hi, Is libpcap 0.8 still required for packet beat or is it now integrated into the distribution? Regards, David --- ## [Docker container logs and filebeat](https://discuss.elastic.co/t/docker-container-logs-and-filebeat/43510)
**Author:** [@Tess.Snow](https://discuss.elastic.co/u/Tess.Snow)\ **Replies:** 1\ **Last updated:** [March 4, 2016, 2:20pm UTC](https://discuss.elastic.co/t/docker-container-logs-and-filebeat/43510 "2016-03-04T14:20:51Z")
Hi, was looking forward to filebeats multiline support and shipping docker container logs to ELK. The only option seems to be to parse /var/lib/docker/containers for json logs. Json and multiline seems hard to do. Also… --- ## [How to get network status' from Dockerbeat from Containers using "host mode"?](https://discuss.elastic.co/t/how-to-get-network-status-from-dockerbeat-from-containers-using-host-mode/43467)
**Author:** [@Ted](https://discuss.elastic.co/u/Ted)\ **Replies:** 1\ **Last updated:** [March 4, 2016, 6:45am UTC](https://discuss.elastic.co/t/how-to-get-network-status-from-dockerbeat-from-containers-using-host-mode/43467 "2016-03-04T06:45:03Z")
Hi all Im trying to ship Docker containers status' by dockerbeat, but can't get network status(no cpu, memory) from some containers using 'Network: host mode'. How can I do this with dockerbeat? Thanks for the help! --- ## [How to output Filebeat logs to multiple hosts without load balancing?](https://discuss.elastic.co/t/how-to-output-filebeat-logs-to-multiple-hosts-without-load-balancing/43444)
**Author:** [@acarrasquillo](https://discuss.elastic.co/u/acarrasquillo)\ **Replies:** 6\ **Last updated:** [March 4, 2016, 12:08am UTC](https://discuss.elastic.co/t/how-to-output-filebeat-logs-to-multiple-hosts-without-load-balancing/43444 "2016-03-04T00:08:08Z")
Hello. I'm trying to send all the logs to multiple hosts, each host should receive all the logs being read by Filebeat. Is there a way to do this without having one Filebeat Service per host with a specific configuration… --- ## [Use wildcards in Channels with Winlogbeat](https://discuss.elastic.co/t/use-wildcards-in-channels-with-winlogbeat/43367)
**Author:** [@widhalmt](https://discuss.elastic.co/u/widhalmt)\ **Replies:** 1\ **Last updated:** [March 3, 2016, 11:54pm UTC](https://discuss.elastic.co/t/use-wildcards-in-channels-with-winlogbeat/43367 "2016-03-03T23:54:44Z")
If I want to watch all or almost all log channels on a Windows server the config file becomes quite bulky and defining all the channels is not a fun thing to do. Is there a way to define channels more easily like wit… --- ## [.filebeat file grows too big, how to rotate this file?](https://discuss.elastic.co/t/filebeat-file-grows-too-big-how-to-rotate-this-file/43438)
**Author:** [@sharon.c](https://discuss.elastic.co/u/sharon.c)\ **Replies:** 1\ **Last updated:** [March 3, 2016, 8:52pm UTC](https://discuss.elastic.co/t/filebeat-file-grows-too-big-how-to-rotate-this-file/43438 "2016-03-03T20:52:26Z")
In filebeat’s configuration yml file, I set the registery file as .filebeat, so the file name and offset information is stored in this file for disaster recovery. When the .filebeat file grows bigger and bigger, is ther… --- ## [Windows cpu\_per\_core returns no results](https://discuss.elastic.co/t/windows-cpu-per-core-returns-no-results/43431)
**Author:** [@Drew\_Town](https://discuss.elastic.co/u/Drew_Town)\ **Replies:** 1\ **Last updated:** [March 3, 2016, 7:41pm UTC](https://discuss.elastic.co/t/windows-cpu-per-core-returns-no-results/43431 "2016-03-03T19:41:08Z")
When settings the cpu\_per\_core to true on windows hosts I get no results for individual cores, just total cpu details. Am I missing something here? stats: system: true proc: true filesystem: tru… --- ## [Topbeat \_p fields on Windows hosts](https://discuss.elastic.co/t/topbeat--p-fields-on-windows-hosts/42638)
**Author:** [@meons](https://discuss.elastic.co/u/meons)\ **Replies:** 2\ **Last updated:** [March 3, 2016, 6:34pm UTC](https://discuss.elastic.co/t/topbeat--p-fields-on-windows-hosts/42638 "2016-03-03T18:34:35Z")
Hi there, I have deployed Topbeat on some Windows 7 hosts but I see a problem when I analyse logs in Kibana: proc.mem.rss and proc.cpu.user fields recieve the correct data from hosts but proc.mem.rss\_p and proc.cpu.user\_… --- ## [Unexpected encoding line reader error when enabling multiline](https://discuss.elastic.co/t/unexpected-encoding-line-reader-error-when-enabling-multiline/43388)
**Author:** [@martkuper](https://discuss.elastic.co/u/martkuper)\ **Replies:** 2\ **Last updated:** [March 3, 2016, 1:59pm UTC](https://discuss.elastic.co/t/unexpected-encoding-line-reader-error-when-enabling-multiline/43388 "2016-03-03T13:59:33Z")
I've been trying to get Filebeat (v1.1.1 on centos7) to apply a multiline filter before outputting a java log (utf-8 encoded) into redis. The java log looks like this: 2016-03-03 09:47:13,690 INFO Wall-e-main Robot - … --- ## [Filebeat and CentOS 5](https://discuss.elastic.co/t/filebeat-and-centos-5/43308)
**Author:** [@Diggy](https://discuss.elastic.co/u/Diggy)\ **Replies:** 1\ **Last updated:** [March 3, 2016, 12:10pm UTC](https://discuss.elastic.co/t/filebeat-and-centos-5/43308 "2016-03-03T12:10:57Z")
As described in this post (https://discuss.elastic.co/t/logstash-forwarder-with-multiple-log-source-types/39801), neither filebeat nor logstash work with CentOS 5 kernel 2.6.18-408. I have several machines with this ker… --- ## [How set filebeat output logstash speed limit?](https://discuss.elastic.co/t/how-set-filebeat-output-logstash-speed-limit/43359)
**Author:** [@iyaozhen](https://discuss.elastic.co/u/iyaozhen)\ **Replies:** 4\ **Last updated:** [March 3, 2016, 9:58am UTC](https://discuss.elastic.co/t/how-set-filebeat-output-logstash-speed-limit/43359 "2016-03-03T09:58:33Z")
I use Filebeat and logshtash, But I worry most of message use high NET\_OUT\_BITPS, and affect online business. \[:sweat:\] --- ## [Rss usage \> a 4GB](https://discuss.elastic.co/t/rss-usage-a-4gb/43285)
**Author:** [@pollux](https://discuss.elastic.co/u/pollux)\ **Replies:** 5\ **Last updated:** [March 3, 2016, 7:36am UTC](https://discuss.elastic.co/t/rss-usage-a-4gb/43285 "2016-03-03T07:36:45Z")
Hi, I test it on Windows Server 2008 R2 and Win7, with topbeat 1.1.1 from the download page of elastic. I run a special .exe (TestLimit from sysinternal) that allocate 15 GB of RAM on my machine. In the global memory… --- ## [Filebeat memory leak?](https://discuss.elastic.co/t/filebeat-memory-leak/43215)
**Author:** [@zpp](https://discuss.elastic.co/u/zpp)\ **Replies:** 3\ **Last updated:** [March 3, 2016, 7:43am UTC](https://discuss.elastic.co/t/filebeat-memory-leak/43215 "2016-03-03T07:43:40Z")
Hi, I've set up a filebeat service running on windows 2012 to ingest some application log files to elasticsearch. Feeding path is like this: filebeat -\> logstash -\> ElasticSearch. After running about 2-3 days, from per… --- ## [How to use Filebeats for collecting Windows events and Microsoft Exchange Logs](https://discuss.elastic.co/t/how-to-use-filebeats-for-collecting-windows-events-and-microsoft-exchange-logs/43338)
**Author:** [@thyfere](https://discuss.elastic.co/u/thyfere)\ **Replies:** 1\ **Last updated:** [March 3, 2016, 6:33am UTC](https://discuss.elastic.co/t/how-to-use-filebeats-for-collecting-windows-events-and-microsoft-exchange-logs/43338 "2016-03-03T06:33:51Z")
Hi, Currently, we are using NXLOG to ship Windows events and Exchange logs in a Windows environment. How can we replace NXLOG with Filebeats. Is it matured enough? --- ## [Beat dont' ship log to ES when ES restart (ES died)](https://discuss.elastic.co/t/beat-dont-ship-log-to-es-when-es-restart-es-died/43189)
**Author:** [@tatdat](https://discuss.elastic.co/u/tatdat)\ **Replies:** 3\ **Last updated:** [March 3, 2016, 12:16am UTC](https://discuss.elastic.co/t/beat-dont-ship-log-to-es-when-es-restart-es-died/43189 "2016-03-03T00:16:02Z")
I'm using ES 2.0. My cluster is full storage \>85% (Status Red). i try to Remove some indices and restart cluster, status healthy is green. But filebeat and winlogbeat installed in server don't ship log to LS and ES. I … --- ## [Windows Topbeat Causes High CPU Utilization in WMI Provider Host \[Solved\]](https://discuss.elastic.co/t/windows-topbeat-causes-high-cpu-utilization-in-wmi-provider-host-solved/42649)
**Author:** [@MikeR](https://discuss.elastic.co/u/MikeR)\ **Replies:** 7\ **Last updated:** [March 2, 2016, 9:47pm UTC](https://discuss.elastic.co/t/windows-topbeat-causes-high-cpu-utilization-in-wmi-provider-host-solved/42649 "2016-03-02T21:47:02Z")
We are in the process of trying to deploy Topbeat, Filebeat, and WinLogBeat in our Windows-based web hosting environment. When the Topbeat service is running, one core of our servers is completely consumed by the WMI Pr… --- ## [Processing IIS logs in filebeat - regxp? documentation?](https://discuss.elastic.co/t/processing-iis-logs-in-filebeat-regxp-documentation/42244)
**Author:** [@plonka2000](https://discuss.elastic.co/u/plonka2000)\ **Replies:** 6\ **Last updated:** [March 2, 2016, 9:22pm UTC](https://discuss.elastic.co/t/processing-iis-logs-in-filebeat-regxp-documentation/42244 "2016-03-02T21:22:52Z")
Hi all, I've been trying to find a functional method to process IIS logs and send them to elasticsearch without using Logstash. I have seen mention of using regxp to pre-process inputs, and I'm trying to develop patt… --- ## [Beats and Topology Maps](https://discuss.elastic.co/t/beats-and-topology-maps/43259)
**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 3\ **Last updated:** [March 2, 2016, 6:23pm UTC](https://discuss.elastic.co/t/beats-and-topology-maps/43259 "2016-03-02T18:23:55Z")
Hi, In the docs it says that for topology mapping to work elasticsearch must be enabled as an output. In most circumstances users will need to send logs via logstash for sanitisation. So, will it not be that enabling … --- ## [Data sent by Filebeat looks garbled](https://discuss.elastic.co/t/data-sent-by-filebeat-looks-garbled/37647)
**Author:** [@renevdm](https://discuss.elastic.co/u/renevdm)\ **Replies:** 9\ **Last updated:** [March 2, 2016, 8:17am UTC](https://discuss.elastic.co/t/data-sent-by-filebeat-looks-garbled/37647 "2016-03-02T08:17:57Z")
I recently set up Filebeat on a Windows 2008 (R1) machine, to send my Exchange Server Message Tracking Logs to ELK. These are CSV files, which are split by logstash. However, the data only shows garbled lines, like this: … --- ## [Dash character in hostnames and filesystem mount points](https://discuss.elastic.co/t/dash-character-in-hostnames-and-filesystem-mount-points/36790)
**Author:** [@Chris\_Clifton](https://discuss.elastic.co/u/Chris_Clifton)\ **Replies:** 19\ **Last updated:** [March 2, 2016, 8:04am UTC](https://discuss.elastic.co/t/dash-character-in-hostnames-and-filesystem-mount-points/36790 "2016-03-02T08:04:40Z")
topbeat dashboard seems not to like hostnames with "-" character or in filesystem mount points, there's a warning about "-" not being supported because those fields are analyzed fields. Is there a way to change the topbe… --- ## [Where to install packetbeat for mongodb](https://discuss.elastic.co/t/where-to-install-packetbeat-for-mongodb/43093)
**Author:** [@palmerabollo](https://discuss.elastic.co/u/palmerabollo)\ **Replies:** 6\ **Last updated:** [March 1, 2016, 3:45pm UTC](https://discuss.elastic.co/t/where-to-install-packetbeat-for-mongodb/43093 "2016-03-01T15:45:08Z")
In an app with 2 nodejs services that connect to a 3-node mongodb replicaset, where is the best place to install packetbeat? On the nodejs boxes of on the mongodb boxes? Are there any pros/cons? Thank you very much. --- ## [Regex as packet matching logic](https://discuss.elastic.co/t/regex-as-packet-matching-logic/43120)
**Author:** [@bf31415](https://discuss.elastic.co/u/bf31415)\ **Replies:** 1\ **Last updated:** [March 1, 2016, 2:56pm UTC](https://discuss.elastic.co/t/regex-as-packet-matching-logic/43120 "2016-03-01T14:56:25Z")
I'm new to packetbeats so not sure what's supported today. I'd like to build regular expressions as a means to match packets. So think of the types of expressions one can build in wireshark -- eg match on TCP traffi… --- ## [Logserver in AWS not receiving any logs](https://discuss.elastic.co/t/logserver-in-aws-not-receiving-any-logs/42463)
**Author:** [@babeesh](https://discuss.elastic.co/u/babeesh)\ **Replies:** 18\ **Last updated:** [March 1, 2016, 12:48pm UTC](https://discuss.elastic.co/t/logserver-in-aws-not-receiving-any-logs/42463 "2016-03-01T12:48:50Z")
I have setup logserver using ELK in aws ubuntu instance. And I need to send syslogs from my production server to logserver. For that filebeat is installed in production server. Contents of configuration files are given… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=589) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=591)