# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=592 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 593 --- ## [Beats output to Logstash over HTTP?](https://discuss.elastic.co/t/beats-output-to-logstash-over-http/42185)
**Author:** [@plonka2000](https://discuss.elastic.co/u/plonka2000)\ **Replies:** 2\ **Last updated:** [February 19, 2016, 1:40pm UTC](https://discuss.elastic.co/t/beats-output-to-logstash-over-http/42185 "2016-02-19T13:40:03Z")
Hi, I've been looking around to find a way to ship events from various libbeat applications to Logstash, but I need to do it over HTTP using basic authentication. I have seen that libbeat is able to ship to Elasticse… --- ## [Beats with json support](https://discuss.elastic.co/t/beats-with-json-support/42149)
**Author:** [@Jeferson\_Martins](https://discuss.elastic.co/u/Jeferson_Martins)\ **Replies:** 8\ **Last updated:** [February 19, 2016, 7:29am UTC](https://discuss.elastic.co/t/beats-with-json-support/42149 "2016-02-19T07:29:11Z")
Hi, there's some plugin for this? I have all logs in JSON... --- ## [Winlogbeats](https://discuss.elastic.co/t/winlogbeats/42120)
**Author:** [@gringo](https://discuss.elastic.co/u/gringo)\ **Replies:** 2\ **Last updated:** [February 19, 2016, 12:44am UTC](https://discuss.elastic.co/t/winlogbeats/42120 "2016-02-19T00:44:10Z")
I am concern with the winlogbeats sending information in the uncompressed form. Is there a way to set it to apply compression for sending information to elastic search? --- ## [\[SOLVED\] Visualization shortens beats.name](https://discuss.elastic.co/t/solved-visualization-shortens-beats-name/41561)
**Author:** [@jerrac](https://discuss.elastic.co/u/jerrac)\ **Replies:** 10\ **Last updated:** [February 18, 2016, 5:28pm UTC](https://discuss.elastic.co/t/solved-visualization-shortens-beats-name/41561 "2016-02-18T17:28:43Z")
I've loaded the example beats dashboards/searches/visualizations into Kibana. They are definitely working. Except that a lot of beat.name data is truncated/abbreviated. This is only the Topbeat dashboard/etc. since I o… --- ## [Need a logical end of file definition for filebeat](https://discuss.elastic.co/t/need-a-logical-end-of-file-definition-for-filebeat/41099)
**Author:** [@tringuyen](https://discuss.elastic.co/u/tringuyen)\ **Replies:** 13\ **Last updated:** [February 18, 2016, 5:16pm UTC](https://discuss.elastic.co/t/need-a-logical-end-of-file-definition-for-filebeat/41099 "2016-02-18T17:16:22Z")
I have problem with the log that defines end of file by a string, the end of file can be in the middle of the log, So filebeat needs to stop reading log at that line instead of reading all the way down to physical end-of… --- ## [Plugin for bandwidth](https://discuss.elastic.co/t/plugin-for-bandwidth/42026)
**Author:** [@marcmga](https://discuss.elastic.co/u/marcmga)\ **Replies:** 4\ **Last updated:** [February 18, 2016, 5:01pm UTC](https://discuss.elastic.co/t/plugin-for-bandwidth/42026 "2016-02-18T17:01:12Z")
Hello, I searched but not found if theres a beat for sending information about bandwidth of a server. I found that collectd can take informaticon about traffic of an interface in octets, which i don't know what is actu… --- ## [Filebeat logs](https://discuss.elastic.co/t/filebeat-logs/41904)
**Author:** [@veve90](https://discuss.elastic.co/u/veve90)\ **Replies:** 2\ **Last updated:** [February 18, 2016, 12:52pm UTC](https://discuss.elastic.co/t/filebeat-logs/41904 "2016-02-18T12:52:05Z")
Hello, In my filebeat configuration I have: logging: to\_syslog: true files: path: /var/log/filebeat name: myfilebeat rotateeverybytes: 10485760 # = 10MB keepfiles: 7 level: info However, I hav… --- ## [Can't get logging to happen](https://discuss.elastic.co/t/cant-get-logging-to-happen/41837)
**Author:** [@bluethundr](https://discuss.elastic.co/u/bluethundr)\ **Replies:** 3\ **Last updated:** [February 17, 2016, 3:13pm UTC](https://discuss.elastic.co/t/cant-get-logging-to-happen/41837 "2016-02-17T15:13:19Z")
Hello, I'm trying to verify that both topbeat and packetbeat can connect to the logstash host over port 5000. I've enabled logging in the yaml files for both and for some reason the logging directories remain empty… --- ## [Visualize mongo query performance in Kibana](https://discuss.elastic.co/t/visualize-mongo-query-performance-in-kibana/42018)
**Author:** [@swapnil-jaiswal](https://discuss.elastic.co/u/swapnil-jaiswal)\ **Replies:** 1\ **Last updated:** [February 17, 2016, 2:58pm UTC](https://discuss.elastic.co/t/visualize-mongo-query-performance-in-kibana/42018 "2016-02-17T14:58:37Z")
Hi, I have successfully configured filebeat clients to stream data to centralized ELK server. Now i want to to visualize the mongo query performance data in various dashboards. For this is followed the instructions as… --- ## [Grok pattern with multiline management in filebeat](https://discuss.elastic.co/t/grok-pattern-with-multiline-management-in-filebeat/41903)
**Author:** [@michelecappelletti](https://discuss.elastic.co/u/michelecappelletti)\ **Replies:** 6\ **Last updated:** [February 17, 2016, 9:24am UTC](https://discuss.elastic.co/t/grok-pattern-with-multiline-management-in-filebeat/41903 "2016-02-17T09:24:35Z")
HI.. i was used to use grok pattern even in multiline 'pattern' section.. it was very useful.. any tip to compensate this on filebeat multiline side?? --- ## [Filebeat multiline filter and unknown escape character](https://discuss.elastic.co/t/filebeat-multiline-filter-and-unknown-escape-character/40872)
**Author:** [@incogniro](https://discuss.elastic.co/u/incogniro)\ **Replies:** 10\ **Last updated:** [February 17, 2016, 7:57am UTC](https://discuss.elastic.co/t/filebeat-multiline-filter-and-unknown-escape-character/40872 "2016-02-17T07:57:33Z")
I'm configuring filebeat to multiline any line not containing a date in 3 formats as shown below in the configuration snippet. # Date with hyphen seperator. pattern: "^(19|20)\\d\\d(\[- /.\])(0\[1-9\]|1\[012\])\\2(0\[1-9… --- ## [Tag applied to every document](https://discuss.elastic.co/t/tag-applied-to-every-document/41675)
**Author:** [@Jerry\_Hoffmeister](https://discuss.elastic.co/u/Jerry_Hoffmeister)\ **Replies:** 2\ **Last updated:** [February 16, 2016, 7:31pm UTC](https://discuss.elastic.co/t/tag-applied-to-every-document/41675 "2016-02-16T19:31:36Z")
I've updated everything to the latest versions (logstash, elasticsearch, filebeat, kibana) and I see this tag added to every document: beats\_input\_codec\_plain\_applied Everything looks to be working but what does this … --- ## [Following developper's guide, beats won't compile](https://discuss.elastic.co/t/following-developpers-guide-beats-wont-compile/41592)
**Author:** [@rvlander](https://discuss.elastic.co/u/rvlander)\ **Replies:** 3\ **Last updated:** [February 16, 2016, 5:26pm UTC](https://discuss.elastic.co/t/following-developpers-guide-beats-wont-compile/41592 "2016-02-16T17:26:53Z")
Disclaimer: I am a total noob in Go. When running from Getting Ready section in Developpers's guide: go get github.com/elastic/beats I have the following error: package github.com/elastic/beats: no buildable … --- ## [Filebeat install fails ubuntu 12.04 with chai-solo package missing](https://discuss.elastic.co/t/filebeat-install-fails-ubuntu-12-04-with-chai-solo-package-missing/41876)
**Author:** [@jcoetsie](https://discuss.elastic.co/u/jcoetsie)\ **Replies:** 1\ **Last updated:** [February 16, 2016, 12:37pm UTC](https://discuss.elastic.co/t/filebeat-install-fails-ubuntu-12-04-with-chai-solo-package-missing/41876 "2016-02-16T12:37:39Z")
Hi, dpkg -i filebeat\_1.1.1\_amd64.deb (Reading database ... 693957 files and directories currently installed.) Preparing to replace filebeat 1.1.1 (using filebeat\_1.1.1\_amd64.deb) ... Unpacking replacement filebeat ... … --- ## [Regexp pattern not working](https://discuss.elastic.co/t/regexp-pattern-not-working/41812)
**Author:** [@marcmga](https://discuss.elastic.co/u/marcmga)\ **Replies:** 6\ **Last updated:** [February 16, 2016, 9:53am UTC](https://discuss.elastic.co/t/regexp-pattern-not-working/41812 "2016-02-16T09:53:16Z")
Hi, I'm using this configuration to multiline all logs till a timestamp or an ip is found. I started with timestamp, but it ignores the pattern. filebeat: # List of prospectors to fetch data. prospectors: - pat… --- ## [Delete treated files](https://discuss.elastic.co/t/delete-treated-files/41854)
**Author:** [@veve90](https://discuss.elastic.co/u/veve90)\ **Replies:** 1\ **Last updated:** [February 16, 2016, 8:41am UTC](https://discuss.elastic.co/t/delete-treated-files/41854 "2016-02-16T08:41:17Z")
Hello, I would like to know if filebeat can delete treated files ... Thank you, --- ## [What is the Filebeat multiline regex library?](https://discuss.elastic.co/t/what-is-the-filebeat-multiline-regex-library/41847)
**Author:** [@Augustin\_Chen](https://discuss.elastic.co/u/Augustin_Chen)\ **Replies:** 1\ **Last updated:** [February 16, 2016, 6:59am UTC](https://discuss.elastic.co/t/what-is-the-filebeat-multiline-regex-library/41847 "2016-02-16T06:59:29Z")
I am migrating the logstash multiline to the Filebeat multiline. I am wondering what is the Filebeat multiline regex library? Is it same to the one of the logstash multiline codec? --- ## [Topbeat beat.hostname analyzed](https://discuss.elastic.co/t/topbeat-beat-hostname-analyzed/36930)
**Author:** [@jderieg](https://discuss.elastic.co/u/jderieg)\ **Replies:** 10\ **Last updated:** [February 13, 2016, 1:41am UTC](https://discuss.elastic.co/t/topbeat-beat-hostname-analyzed/36930 "2016-02-13T01:41:12Z")
Hi there, I noticed that after I load in the topbeat template, and create an index pattern for topbeat, the 'beat.hostname' field is analyzed. I'm kind of a noob with beats/elasticsearch... could someone help me to cha… --- ## [Can filebeat be configured to send to different ES or logstash servers?](https://discuss.elastic.co/t/can-filebeat-be-configured-to-send-to-different-es-or-logstash-servers/41503)
**Author:** [@skynardo](https://discuss.elastic.co/u/skynardo)\ **Replies:** 2\ **Last updated:** [February 12, 2016, 9:49pm UTC](https://discuss.elastic.co/t/can-filebeat-be-configured-to-send-to-different-es-or-logstash-servers/41503 "2016-02-12T21:49:42Z")
I have a request to send Database logs to one ES server and tomcat logs to another ES server. Can this be configured in filebeat version 1.1.0-1 ? --- ## [\[Solved\] Possible bug? filebeat multiline regexp](https://discuss.elastic.co/t/solved-possible-bug-filebeat-multiline-regexp/40953)
**Author:** [@mikula](https://discuss.elastic.co/u/mikula)\ **Replies:** 7\ **Last updated:** [February 12, 2016, 5:04pm UTC](https://discuss.elastic.co/t/solved-possible-bug-filebeat-multiline-regexp/40953 "2016-02-12T17:04:18Z")
Hi again, I have possible bug in filebeat multiline regexp pattern matching. "^\\\[?\[0-9\]\[0-9\]:?\[0-9\]\[0-9\]|^\[\[:graph:\]\]+" (note quotes) Fails with unknown escape character But: ^\\\[?\[0-9\]\[0-9\]:?\[0-9\]\[0-9\]|^\[\[:graph:\]\]+ work… --- ## [Filebeat missing some log lines](https://discuss.elastic.co/t/filebeat-missing-some-log-lines/41487)
**Author:** [@astro](https://discuss.elastic.co/u/astro)\ **Replies:** 3\ **Last updated:** [February 11, 2016, 1:57pm UTC](https://discuss.elastic.co/t/filebeat-missing-some-log-lines/41487 "2016-02-11T13:57:21Z")
Hi Everyone , I had been in situation where I m sending logs to logstash shipper using filebeat , It seems filebeat is skipping some events , especially event at around 23:59 to 00:01 . I am not sure anyone else faci… --- ## [Kibana is not showing all the logfiles from the path, shows only one file](https://discuss.elastic.co/t/kibana-is-not-showing-all-the-logfiles-from-the-path-shows-only-one-file/39747)
**Author:** [@chaitanyap](https://discuss.elastic.co/u/chaitanyap)\ **Replies:** 22\ **Last updated:** [February 11, 2016, 9:33am UTC](https://discuss.elastic.co/t/kibana-is-not-showing-all-the-logfiles-from-the-path-shows-only-one-file/39747 "2016-02-11T09:33:40Z")
Hi All, We have newly installed logstash and started exploring the features. We have given a path in beats configuration where we have number of log files(may be 10) but when we checked in kibana it is only showing o… --- ## [Client\_server and server fields in packetbeat showing empty](https://discuss.elastic.co/t/client-server-and-server-fields-in-packetbeat-showing-empty/41111)
**Author:** [@harshafrnd4u](https://discuss.elastic.co/u/harshafrnd4u)\ **Replies:** 2\ **Last updated:** [February 11, 2016, 8:24am UTC](https://discuss.elastic.co/t/client-server-and-server-fields-in-packetbeat-showing-empty/41111 "2016-02-11T08:24:11Z")
I am using packetbeat for http and mysql, these services are running inside a virtual machine. "client\_server" and "server" fields are coming empty in output events. Can anyone suggest what might be the cause or any conf… --- ## [Lots of Blank Values](https://discuss.elastic.co/t/lots-of-blank-values/41027)
**Author:** [@gringo](https://discuss.elastic.co/u/gringo)\ **Replies:** 2\ **Last updated:** [February 11, 2016, 12:50am UTC](https://discuss.elastic.co/t/lots-of-blank-values/41027 "2016-02-11T00:50:19Z")
I have followed the steps in https://www.elastic.co/guide/en/beats/topbeat/current/topbeat-getting-started.html http://www.elastic.co/guide/en/beats/libbeat/1.1/getting-started.html#load-kibana-dashboards There seems … --- ## [Run filebeat with output log](https://discuss.elastic.co/t/run-filebeat-with-output-log/41428)
**Author:** [@Pablo\_perez](https://discuss.elastic.co/u/Pablo_perez)\ **Replies:** 4\ **Last updated:** [February 10, 2016, 9:17pm UTC](https://discuss.elastic.co/t/run-filebeat-with-output-log/41428 "2016-02-10T21:17:54Z")
I´ve been using filebeat, and I´m trying to resolve an issue when I start it in background. I would like to start it to throwing log information for the startup and shutdown but I cannot find a way to make it works. Thi… --- ## [Filebeat stopped working](https://discuss.elastic.co/t/filebeat-stopped-working/41401)
**Author:** [@bluethundr](https://discuss.elastic.co/u/bluethundr)\ **Replies:** 5\ **Last updated:** [February 10, 2016, 6:28pm UTC](https://discuss.elastic.co/t/filebeat-stopped-working/41401 "2016-02-10T18:28:43Z")
Hey guys, I noticed that I stopped receiving logs in logstash from the one host I have running filebeat. If I tail the logs for filebeat and I'm seeing these messages repeating over and over again: 2016-02-10T11… --- ## [Parse / ship JSON file with filebeat](https://discuss.elastic.co/t/parse-ship-json-file-with-filebeat/34540)
**Author:** [@rummages](https://discuss.elastic.co/u/rummages)\ **Replies:** 5\ **Last updated:** [February 10, 2016, 4:31pm UTC](https://discuss.elastic.co/t/parse-ship-json-file-with-filebeat/34540 "2016-02-10T16:31:12Z")
Is it possible to directly parse a json file from filebeats into elasticsearch? I have a small json file and I would like to have filebeats read in and ship directly to elasticsearch in json. json file -\> filebeats =\> … --- ## [Add 'multiline' to tags field](https://discuss.elastic.co/t/add-multiline-to-tags-field/41285)
**Author:** [@incogniro](https://discuss.elastic.co/u/incogniro)\ **Replies:** 4\ **Last updated:** [February 10, 2016, 12:58pm UTC](https://discuss.elastic.co/t/add-multiline-to-tags-field/41285 "2016-02-10T12:58:17Z")
The logstash multiline plugin adds the value 'multiline' to tags. Then it is possible to perform additional processing of such events: if 'multiline' in \[tags\] { .... } Are there plans to add this into Filebeat? --- ## [Backfilling old logs with filebeat](https://discuss.elastic.co/t/backfilling-old-logs-with-filebeat/38428)
**Author:** [@lminaudier](https://discuss.elastic.co/u/lminaudier)\ **Replies:** 11\ **Last updated:** [February 10, 2016, 11:41am UTC](https://discuss.elastic.co/t/backfilling-old-logs-with-filebeat/38428 "2016-02-10T11:41:50Z")
Hi there, I have a question. I am trying to backfill some old logs into our ELK stack. In order to do that, I created a simple configuration file like this : filebeat: prospectors: - paths: - "-… --- ## [Working with filebeat](https://discuss.elastic.co/t/working-with-filebeat/40944)
**Author:** [@Anmol\_Garg](https://discuss.elastic.co/u/Anmol_Garg)\ **Replies:** 13\ **Last updated:** [February 10, 2016, 9:25am UTC](https://discuss.elastic.co/t/working-with-filebeat/40944 "2016-02-10T09:25:15Z")
When should we use a single prospector and when multiple? Like I can include multiple files in a single prospector. What are the pros and cons of using multiple prospectors? [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=591) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=593)