# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=591 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 592 --- ## [Unable to start Winlogbeat \[solved - corrupt exe file\]](https://discuss.elastic.co/t/unable-to-start-winlogbeat-solved-corrupt-exe-file/42960)
**Author:** [@aguida79](https://discuss.elastic.co/u/aguida79)\ **Replies:** 5\ **Last updated:** [March 1, 2016, 11:17am UTC](https://discuss.elastic.co/t/unable-to-start-winlogbeat-solved-corrupt-exe-file/42960 "2016-03-01T11:17:44Z")
Hello, I'm new to the ELK Stack, and I'm traing to make a lab environment to show to my employeer the beneficts of use this technology. I'm already installed ElasticSearch, Kibana and Logstash in a CentOS 7 Server. … --- ## [Anyone using execbeat?](https://discuss.elastic.co/t/anyone-using-execbeat/43071)
**Author:** [@allenmchan](https://discuss.elastic.co/u/allenmchan)\ **Replies:** 1\ **Last updated:** [March 1, 2016, 6:07am UTC](https://discuss.elastic.co/t/anyone-using-execbeat/43071 "2016-03-01T06:07:44Z")
Been testing execbeat but cannot get it to behave. It is running \[achan@lmc001.scl execbeat\]$ ps -ef | grep -i execbeat root 29786 15760 0 21:03 pts/0 00:00:00 sudo ./execbeat -c /etc/execbeat/execbeat.yml ro… --- ## [How to resolve !map \[\]ConfigProspector error?](https://discuss.elastic.co/t/how-to-resolve-map-configprospector-error/43007)
**Author:** [@chandni007](https://discuss.elastic.co/u/chandni007)\ **Replies:** 3\ **Last updated:** [March 1, 2016, 5:21am UTC](https://discuss.elastic.co/t/how-to-resolve-map-configprospector-error/43007 "2016-03-01T05:21:47Z")
Hi all, I am new to filebeat . I have install filebeat 1.2.0 and have created a file called filebeat\_consol.yml as .. filebeat: prospectors: input\_type: stdin output: console: pretty: true and when i … --- ## [Winlogbeat Installation - Getting Started](https://discuss.elastic.co/t/winlogbeat-installation-getting-started/43032)
**Author:** [@suzo](https://discuss.elastic.co/u/suzo)\ **Replies:** 1\ **Last updated:** [February 29, 2016, 6:49pm UTC](https://discuss.elastic.co/t/winlogbeat-installation-getting-started/43032 "2016-02-29T18:49:32Z")
Hi, I am new to ELK, Can any body please provide a link of how to configure Winlogbeat with logstash on windows 7. I have already configured ELK on ubuntu server. Thanks --- ## [Filebeats open files issues](https://discuss.elastic.co/t/filebeats-open-files-issues/41033)
**Author:** [@novice](https://discuss.elastic.co/u/novice)\ **Replies:** 1\ **Last updated:** [February 29, 2016, 8:23am UTC](https://discuss.elastic.co/t/filebeats-open-files-issues/41033 "2016-02-29T08:23:01Z")
I am using filebeats on my elk stack (recently migrated from logstash-forwarder). Filebeats doesn't releases the deleted log files which is a major concern for us. I have used the following config, still it holds up the… --- ## [Beat meta info how to show ip?](https://discuss.elastic.co/t/beat-meta-info-how-to-show-ip/42802)
**Author:** [@szcountryboy](https://discuss.elastic.co/u/szcountryboy)\ **Replies:** 4\ **Last updated:** [February 29, 2016, 5:48am UTC](https://discuss.elastic.co/t/beat-meta-info-how-to-show-ip/42802 "2016-02-29T05:48:17Z")
Elastic-2.2 version Every event sent to Logstash contains additional metadata for indexing and filtering: { ... "@metadata": { "beat": "", "type": "" } The beat-meta info : "@timestamp" =\> "… --- ## [Packetbeat not publishing events to remote tcp on windows](https://discuss.elastic.co/t/packetbeat-not-publishing-events-to-remote-tcp-on-windows/42925)
**Author:** [@abhinavzspace](https://discuss.elastic.co/u/abhinavzspace)\ **Replies:** 1\ **Last updated:** [February 29, 2016, 4:16am UTC](https://discuss.elastic.co/t/packetbeat-not-publishing-events-to-remote-tcp-on-windows/42925 "2016-02-29T04:16:58Z")
I checked that TCP connection was established with mac machine where ELK setup is running. I am trying to output the logs to logstash. Following are my packetbeat.yml and logs I collected by running packetbeat.exe in deb… --- ## [Packetbeat sometimes miss captured packages](https://discuss.elastic.co/t/packetbeat-sometimes-miss-captured-packages/41922)
**Author:** [@Ricardo\_Lopes](https://discuss.elastic.co/u/Ricardo_Lopes)\ **Replies:** 1\ **Last updated:** [February 29, 2016, 2:54am UTC](https://discuss.elastic.co/t/packetbeat-sometimes-miss-captured-packages/41922 "2016-02-29T02:54:53Z")
Hi!, I'm using packetbeat to collect data about our billing, monitoring the numbers of inserts in a mysql database table, whatever sometimes it have differences between the numbers returned from elasticsearch and the tab… --- ## [Beats: Ansible Playbook](https://discuss.elastic.co/t/beats-ansible-playbook/41893)
**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 1\ **Last updated:** [February 29, 2016, 2:44am UTC](https://discuss.elastic.co/t/beats-ansible-playbook/41893 "2016-02-29T02:44:28Z")
Hi, I've seen reference to a beats playbook here: https://www.elastic.co/blog/deploying-elasticsearch-with-ansible What is the status of the beats ansible playbook and role(s)? Regards, David --- ## [\[solved\] Process names with semi colon not displayed correctly](https://discuss.elastic.co/t/solved-process-names-with-semi-colon-not-displayed-correctly/42871)
**Author:** [@MikeC](https://discuss.elastic.co/u/MikeC)\ **Replies:** 4\ **Last updated:** [February 27, 2016, 5:47pm UTC](https://discuss.elastic.co/t/solved-process-names-with-semi-colon-not-displayed-correctly/42871 "2016-02-27T17:47:18Z")
i've install topbeat and the related kibana graphs and i've noticed that the processes are not displayed correctly. For example, if i got this in the data proc.name:kworker/5:0, in the graphs im getting the zero at the … --- ## [2016/02/25 17:37:08.496727 transport.go:125: ERR SSL client failed to connect with: dial tcp 172.31.31.169:5044: getsockopt: no route to host](https://discuss.elastic.co/t/2016-02-25-17-37-08-496727-transport-go-125-err-ssl-client-failed-to-connect-with-dial-tcp-172-31-31-169-5044-getsockopt-no-route-to-host/42757)
**Author:** [@Mayur\_Patel](https://discuss.elastic.co/u/Mayur_Patel)\ **Replies:** 5\ **Last updated:** [February 26, 2016, 9:34pm UTC](https://discuss.elastic.co/t/2016-02-25-17-37-08-496727-transport-go-125-err-ssl-client-failed-to-connect-with-dial-tcp-172-31-31-169-5044-getsockopt-no-route-to-host/42757 "2016-02-26T21:34:10Z")
Hey I am using Amazon EC2 server for my app. I have follow this tutorial for setting ELK stack: https://www.digitalocean.com/community/tutorials/how-to-install-elasticsearch-logstash-and-kibana-elk-stack-on-ubuntu-14-04 … --- ## [Packetbeat not working in Linux (requires sudo)](https://discuss.elastic.co/t/packetbeat-not-working-in-linux-requires-sudo/42888)
**Author:** [@rbkumar88](https://discuss.elastic.co/u/rbkumar88)\ **Replies:** 3\ **Last updated:** [February 26, 2016, 7:13pm UTC](https://discuss.elastic.co/t/packetbeat-not-working-in-linux-requires-sudo/42888 "2016-02-26T19:13:35Z")
bash-4.1$ ./packetbeat devices -v -debug bash-4.1$ uname -a Linux xxxxxx 2.6.32-573.3.1.el6.x86\_64 #1 SMP Mon Aug 10 09:44:54 EDT 2015 x86\_64 x86\_64 x86\_64 GNU/Linux Packetbeat coming out immediately without executing/… --- ## [MongoDB Packetbeat frequent crashing - syslog shows frequent errors](https://discuss.elastic.co/t/mongodb-packetbeat-frequent-crashing-syslog-shows-frequent-errors/42796)
**Author:** [@kdawg14](https://discuss.elastic.co/u/kdawg14)\ **Replies:** 2\ **Last updated:** [February 26, 2016, 5:59pm UTC](https://discuss.elastic.co/t/mongodb-packetbeat-frequent-crashing-syslog-shows-frequent-errors/42796 "2016-02-26T17:59:32Z")
Potentially related to Slice bounds out of range? I have Packetbeat 1.1.1 running on Ubuntu 14.04 sniffing traffic on a MongoDB 3.2.1 node. I'm quite impressed with the results that I'm getting, but it's also crashing … --- ## [Increase filebeat worker threads?](https://discuss.elastic.co/t/increase-filebeat-worker-threads/42798)
**Author:** [@Vinu2903](https://discuss.elastic.co/u/Vinu2903)\ **Replies:** 1\ **Last updated:** [February 26, 2016, 7:49am UTC](https://discuss.elastic.co/t/increase-filebeat-worker-threads/42798 "2016-02-26T07:49:57Z")
Is there a way to increase Filebeat's worker threads and have it read multiple log files at the same time? --- ## [Not capturing MySQL Prepared Statements](https://discuss.elastic.co/t/not-capturing-mysql-prepared-statements/42683)
**Author:** [@ferrydg](https://discuss.elastic.co/u/ferrydg)\ **Replies:** 4\ **Last updated:** [February 26, 2016, 7:12am UTC](https://discuss.elastic.co/t/not-capturing-mysql-prepared-statements/42683 "2016-02-26T07:12:17Z")
Hi, I am trying to monitor the traffic to our Percona XtraDB cluster but packetbeat only catches the "start transaction" and "commit" statements of my laravel application. The rest result in "WARN Response from unknown… --- ## [Not able to start filebeat instance in windows](https://discuss.elastic.co/t/not-able-to-start-filebeat-instance-in-windows/42599)
**Author:** [@jayaram](https://discuss.elastic.co/u/jayaram)\ **Replies:** 6\ **Last updated:** [February 25, 2016, 6:05am UTC](https://discuss.elastic.co/t/not-able-to-start-filebeat-instance-in-windows/42599 "2016-02-25T06:05:38Z")
Hello, I am working in Windows with Filebeat --\> Logstash --\> Elasticsearch --\> kibana I am seeing below error while start Filebeat : filebeat.exe -c filebeat.yml -d \* panic: runtime error: invalid memory address or… --- ## [ERR SSL client failed to connect with: dial tcp x.x.x.x:5043: getsockopt: connection refused](https://discuss.elastic.co/t/err-ssl-client-failed-to-connect-with-dial-tcp-x-x-x-x-5043-getsockopt-connection-refused/42584)
**Author:** [@harsimran](https://discuss.elastic.co/u/harsimran)\ **Replies:** 3\ **Last updated:** [February 25, 2016, 10:40am UTC](https://discuss.elastic.co/t/err-ssl-client-failed-to-connect-with-dial-tcp-x-x-x-x-5043-getsockopt-connection-refused/42584 "2016-02-25T10:40:04Z")
I'm encounter a issue with the topbeat. I tried to ship the logs to logstash server on port 5043 and getting below on the client, while starting the topbeat. Both are rhel-6.5 virtual machines. logstash is running an… --- ## [Filebeat and logstash, merging logs and separating them](https://discuss.elastic.co/t/filebeat-and-logstash-merging-logs-and-separating-them/42582)
**Author:** [@dan.henning](https://discuss.elastic.co/u/dan.henning)\ **Replies:** 2\ **Last updated:** [February 24, 2016, 7:10pm UTC](https://discuss.elastic.co/t/filebeat-and-logstash-merging-logs-and-separating-them/42582 "2016-02-24T19:10:02Z")
Hello, I have multiple log txt files that have two separate logs inside that span multiple lines each. Here is an example: 13:43:58 Message loaded: D:\\mail\\heMail\\Drop\\ \\003.eml 13:43:58 Attempting to process message … --- ## [Winlogbeat - Event Tagging and Overriding 'type' in Logstash](https://discuss.elastic.co/t/winlogbeat-event-tagging-and-overriding-type-in-logstash/42539)
**Author:** [@cord\_thomas](https://discuss.elastic.co/u/cord_thomas)\ **Replies:** 2\ **Last updated:** [February 24, 2016, 2:20am UTC](https://discuss.elastic.co/t/winlogbeat-event-tagging-and-overriding-type-in-logstash/42539 "2016-02-24T02:20:12Z")
I have setup winlogbeat to forward windows events to logstash. I am quite new to ELK / Beats, but finding it quite intuitive and well documented - really enjoying it all. Problem - my data was not getting indexed as … --- ## [Winlogbeat to Logstash - Dashboard Issue](https://discuss.elastic.co/t/winlogbeat-to-logstash-dashboard-issue/41434)
**Author:** [@shanecentreedu](https://discuss.elastic.co/u/shanecentreedu)\ **Replies:** 4\ **Last updated:** [February 11, 2016, 3:58am UTC](https://discuss.elastic.co/t/winlogbeat-to-logstash-dashboard-issue/41434 "2016-02-11T03:58:29Z")
I'm testing the new Winlogbeat and I've been able to get events in my test ELK. I loaded the beats-dashboards-master using the load command from the readme and pieces succeeded with "created":true. I can see the dashbo… --- ## [\[SOLVED\] Filebeat creating high CPU usage](https://discuss.elastic.co/t/solved-filebeat-creating-high-cpu-usage/42419)
**Author:** [@Diggy](https://discuss.elastic.co/u/Diggy)\ **Replies:** 3\ **Last updated:** [February 24, 2016, 1:51pm UTC](https://discuss.elastic.co/t/solved-filebeat-creating-high-cpu-usage/42419 "2016-02-24T13:51:56Z")
All, I have filebeat installed on a handful of CentOS servers. Most installations are behaving well. However, one server constatntly reports extremely high CPU usage, as in the following from top: 30459 root 2… --- ## [Possible to add to @metadata?](https://discuss.elastic.co/t/possible-to-add-to-metadata/42592)
**Author:** [@whitej](https://discuss.elastic.co/u/whitej)\ **Replies:** 4\ **Last updated:** [February 24, 2016, 1:49pm UTC](https://discuss.elastic.co/t/possible-to-add-to-metadata/42592 "2016-02-24T13:49:24Z")
Is it possible to add information to the @metadata field? Or perhaps there's a better way to accomplish what I'm trying to do. I have multiple prospectors set up on each machine. Each prospector is consuming logs fro… --- ## [Winlogbeat and Logstash Input Codec](https://discuss.elastic.co/t/winlogbeat-and-logstash-input-codec/42527)
**Author:** [@cord\_thomas](https://discuss.elastic.co/u/cord_thomas)\ **Replies:** 4\ **Last updated:** [February 24, 2016, 12:30am UTC](https://discuss.elastic.co/t/winlogbeat-and-logstash-input-codec/42527 "2016-02-24T00:30:03Z")
We are evaluating ELK as a distributed monitoring system. I have installed ELK and have some syslogs shipping from various systems. I have just tried installing winlogbeat 1.1.1 on a Windows 8 VM in Parallels. Logst… --- ## [Filebeat: Configuring Bind Port](https://discuss.elastic.co/t/filebeat-configuring-bind-port/42484)
**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 2\ **Last updated:** [February 23, 2016, 11:44am UTC](https://discuss.elastic.co/t/filebeat-configuring-bind-port/42484 "2016-02-23T11:44:17Z")
Hi, Is it possible to configure filebeat so that it binds to a port other than 5044? Regards, David --- ## [Filebeat seems stop send information to logstash](https://discuss.elastic.co/t/filebeat-seems-stop-send-information-to-logstash/42133)
**Author:** [@rafaellamuniz](https://discuss.elastic.co/u/rafaellamuniz)\ **Replies:** 13\ **Last updated:** [February 23, 2016, 11:02am UTC](https://discuss.elastic.co/t/filebeat-seems-stop-send-information-to-logstash/42133 "2016-02-23T11:02:09Z")
I have Filebeat installed on three servers. It sends information to the logstash than send to the Elastic Search. It should create a index for each day like the example bellow: health status index … --- ## [Messages from different files are combined as one document](https://discuss.elastic.co/t/messages-from-different-files-are-combined-as-one-document/42095)
**Author:** [@zpp](https://discuss.elastic.co/u/zpp)\ **Replies:** 2\ **Last updated:** [February 22, 2016, 9:58am UTC](https://discuss.elastic.co/t/messages-from-different-files-are-combined-as-one-document/42095 "2016-02-22T09:58:56Z")
Hi, I'm trying to ingest log files to elasticsearch through filebeat, the flow is like this: log file -\> filebeat -\> logstash (indexer) -\> elasticsearch. filebeat is setup to monitor a few files from the same folder… --- ## [Monitor beat's publisher request to Elastic Search](https://discuss.elastic.co/t/monitor-beats-publisher-request-to-elastic-search/42220)
**Author:** [@rvlander](https://discuss.elastic.co/u/rvlander)\ **Replies:** 6\ **Last updated:** [February 21, 2016, 5:08pm UTC](https://discuss.elastic.co/t/monitor-beats-publisher-request-to-elastic-search/42220 "2016-02-21T17:08:57Z")
Hi, I am writing a new beat for a corporate service. I have generated the index template, added it to ElasticSearch. I have my beat running publishing event, everything seem to be ok with no error in debug level lo… --- ## [Connection not established between logstash and filebeat](https://discuss.elastic.co/t/connection-not-established-between-logstash-and-filebeat/42168)
**Author:** [@Akash\_Katakam](https://discuss.elastic.co/u/Akash_Katakam)\ **Replies:** 6\ **Last updated:** [February 19, 2016, 7:55pm UTC](https://discuss.elastic.co/t/connection-not-established-between-logstash-and-filebeat/42168 "2016-02-19T19:55:44Z")
FIlebeat running on ubuntu 14.04 Elk is installed in windows 2008 server Logs are in ubuntu machine and i want to send my remote machine. my filebeat config and logstash configs are attached. input { beats { p… --- ## [Remove Harvester From input File(s) - Filebeat](https://discuss.elastic.co/t/remove-harvester-from-input-file-s-filebeat/42179)
**Author:** [@bhoskins7](https://discuss.elastic.co/u/bhoskins7)\ **Replies:** 2\ **Last updated:** [February 19, 2016, 6:44pm UTC](https://discuss.elastic.co/t/remove-harvester-from-input-file-s-filebeat/42179 "2016-02-19T18:44:17Z")
I would like to re-send input path data to Elasticsearch. The data was initially sent but I deleted the filebeat-\* index and would like to output the log file information to Elasticsearch again. What are the steps/… --- ## [Error setting up Filebeat on Windows](https://discuss.elastic.co/t/error-setting-up-filebeat-on-windows/42169)
**Author:** [@Vishesh](https://discuss.elastic.co/u/Vishesh)\ **Replies:** 3\ **Last updated:** [February 19, 2016, 5:20pm UTC](https://discuss.elastic.co/t/error-setting-up-filebeat-on-windows/42169 "2016-02-19T17:20:07Z")
After starting the service, I am constantly facing a connection error: SSL Client failed to connect with: dial tcp x.x.x.x:5044 No connection could be made because the target machine actively refused it. Here is my f… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=590) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=592)