# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=593 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 594 --- ## [Log formatting under lumberjack lost in filebeats](https://discuss.elastic.co/t/log-formatting-under-lumberjack-lost-in-filebeats/41296)
**Author:** [@bluethundr](https://discuss.elastic.co/u/bluethundr)\ **Replies:** 3\ **Last updated:** [February 10, 2016, 3:58am UTC](https://discuss.elastic.co/t/log-formatting-under-lumberjack-lost-in-filebeats/41296 "2016-02-10T03:58:27Z")
Hey all, Ok so filebeats are now using yaml and not json. A while back I followed the advice of the logstash book and formatted my apache logs like this: LogFormat "{ \\ \\"host\\":\\"ref.example.com.example.com\\… --- ## [Fielbeat only send line by line instead the whole new log entry at once](https://discuss.elastic.co/t/fielbeat-only-send-line-by-line-instead-the-whole-new-log-entry-at-once/41177)
**Author:** [@Pablo\_perez](https://discuss.elastic.co/u/Pablo_perez)\ **Replies:** 3\ **Last updated:** [February 9, 2016, 7:53pm UTC](https://discuss.elastic.co/t/fielbeat-only-send-line-by-line-instead-the-whole-new-log-entry-at-once/41177 "2016-02-09T19:53:32Z")
Let´s say that I have a cluster where I´m sending logs line from filebeat to logstash. My problem is that filebeat since send line by line, and in my logstash I have configure that the input codec is json, my logstash is… --- ## [Winlogbeat transport problem on port 80 through reverse proxy to Elasticsearch](https://discuss.elastic.co/t/winlogbeat-transport-problem-on-port-80-through-reverse-proxy-to-elasticsearch/40965)
**Author:** [@UnclePhil](https://discuss.elastic.co/u/UnclePhil)\ **Replies:** 14\ **Last updated:** [February 9, 2016, 2:31pm UTC](https://discuss.elastic.co/t/winlogbeat-transport-problem-on-port-80-through-reverse-proxy-to-elasticsearch/40965 "2016-02-09T14:31:43Z")
Hello, I've just installed winlogbeat on scripting server, and It seems that a transport to elasticsearch on another port than 9200 is impossible I tested it with our standard 80 (working with powershell scripting on … --- ## [Filebeat: Payload Format](https://discuss.elastic.co/t/filebeat-payload-format/41262)
**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 1\ **Last updated:** [February 9, 2016, 10:05am UTC](https://discuss.elastic.co/t/filebeat-payload-format/41262 "2016-02-09T10:05:33Z")
Hi, I'm testing out filebeat on our elastic search logs. However, when the logs hit elasticsearch an "\_jsonparsefailure" tag gets added by the beats input in logstash. Can I ask, what format does beats use for sending… --- ## [Filebeat only reporting on last prospector](https://discuss.elastic.co/t/filebeat-only-reporting-on-last-prospector/41237)
**Author:** [@bluethundr](https://discuss.elastic.co/u/bluethundr)\ **Replies:** 2\ **Last updated:** [February 9, 2016, 4:46am UTC](https://discuss.elastic.co/t/filebeat-only-reporting-on-last-prospector/41237 "2016-02-09T04:46:51Z")
Hey guys, I'm trying to recreate my lumberjack configuration in filebeats. My lumberjack configuration had been working great for me for a number of years! But I like the convenience of notating things in yaml way bet… --- ## [Connecting error publishing events](https://discuss.elastic.co/t/connecting-error-publishing-events/41148)
**Author:** [@Pablo\_perez](https://discuss.elastic.co/u/Pablo_perez)\ **Replies:** 3\ **Last updated:** [February 9, 2016, 12:47am UTC](https://discuss.elastic.co/t/connecting-error-publishing-events/41148 "2016-02-09T00:47:23Z")
I´m having similar issue when I try to connect to my logstash Logstash version 2.0.0 Filebeat 1.0.1 Here the error INFO Connecting error publishing events (retrying): dial tcp 192.168.50.5:14560: getsockopt: connec… --- ## [How to log additional data for a given process such as "Command Line"?](https://discuss.elastic.co/t/how-to-log-additional-data-for-a-given-process-such-as-command-line/39702)
**Author:** [@styfle](https://discuss.elastic.co/u/styfle)\ **Replies:** 3\ **Last updated:** [February 8, 2016, 7:53pm UTC](https://discuss.elastic.co/t/how-to-log-additional-data-for-a-given-process-such-as-command-line/39702 "2016-02-08T19:53:01Z")
I am using the latest topbeat 2.1.1 with elasticsearch 2.1.1 on Windows. My goal is to see CPU usage and Memory usage for several w3wp.exe processes (IIS App Pools) on the machine. The default topbeat.yml is logging th… --- ## [Is it possible to evaluate a field in runtime?](https://discuss.elastic.co/t/is-it-possible-to-evaluate-a-field-in-runtime/41178)
**Author:** [@Karol\_Stojek](https://discuss.elastic.co/u/Karol_Stojek)\ **Replies:** 1\ **Last updated:** [February 8, 2016, 3:43pm UTC](https://discuss.elastic.co/t/is-it-possible-to-evaluate-a-field-in-runtime/41178 "2016-02-08T15:43:09Z")
Hello, I'm preparing configuration files for my servers. Currently there is a hostname sent by filebeats. But I'd like to add another field - with IP. I thought the easiest would be to set the env. variable and evalu… --- ## [Which tool must be installed](https://discuss.elastic.co/t/which-tool-must-be-installed/40979)
**Author:** [@anasoid](https://discuss.elastic.co/u/anasoid)\ **Replies:** 6\ **Last updated:** [February 8, 2016, 12:17pm UTC](https://discuss.elastic.co/t/which-tool-must-be-installed/40979 "2016-02-08T12:17:44Z")
I want to monitor tomcat machine, so i have to monitor JMX, Log and CPU. I have to install three tools logstash (JMX), topbeat(CPU), filebeat (log file) in this machine? --- ## [Filebeat and Logstash in AIX](https://discuss.elastic.co/t/filebeat-and-logstash-in-aix/41077)
**Author:** [@mrehanb](https://discuss.elastic.co/u/mrehanb)\ **Replies:** 1\ **Last updated:** [February 6, 2016, 4:03am UTC](https://discuss.elastic.co/t/filebeat-and-logstash-in-aix/41077 "2016-02-06T04:03:29Z")
Few questions:- 1) Please advise how to start logstash service in AIX 2) Does Filebeat works in AIX? 3) Secondly i like to ship the logs from AIX to windows machine. Do i need SSL/TLS certificate to have handshake? T… --- ## [Tutorial Cannot Work](https://discuss.elastic.co/t/tutorial-cannot-work/41020)
**Author:** [@gringo](https://discuss.elastic.co/u/gringo)\ **Replies:** 4\ **Last updated:** [February 6, 2016, 3:21am UTC](https://discuss.elastic.co/t/tutorial-cannot-work/41020 "2016-02-06T03:21:54Z")
Tried the tutorial in https://www.elastic.co/guide/en/beats/topbeat/current/topbeat-getting-started.html Keep getting the error after Command: PS C:\\Users\\Admin\\Downloads\\topbeat-1.1.0-windows\> Invoke-WebRequest -M… --- ## [Cpu usage + segfaults](https://discuss.elastic.co/t/cpu-usage-segfaults/41100)
**Author:** [@Jayme](https://discuss.elastic.co/u/Jayme)\ **Replies:** 0\ **Last updated:** [February 5, 2016, 9:17pm UTC](https://discuss.elastic.co/t/cpu-usage-segfaults/41100 "2016-02-05T21:17:59Z")
Hi, I've been trying out packetbeat as a potential new relic replacement but I'm a bit afraid that CPU usage is a bit too high to use this in production. I've installed this on one of my webservers and it's the highest… --- ## [Filebeat for AIX?](https://discuss.elastic.co/t/filebeat-for-aix/34948)
**Author:** [@ssampati](https://discuss.elastic.co/u/ssampati)\ **Replies:** 3\ **Last updated:** [February 5, 2016, 3:13pm UTC](https://discuss.elastic.co/t/filebeat-for-aix/34948 "2016-02-05T15:13:49Z")
Im doing a project to replace Splunk \[:smile:\] using ELK Stack opensource. Im having tough time finding Logstash forwarder agent for AIX. Logstash forwarder java is not working as it is supposed to be, Does Filebeat supp… --- ## [Can't start filebeat with TLS configured](https://discuss.elastic.co/t/cant-start-filebeat-with-tls-configured/40594)
**Author:** [@bluethundr](https://discuss.elastic.co/u/bluethundr)\ **Replies:** 18\ **Last updated:** [February 5, 2016, 3:01pm UTC](https://discuss.elastic.co/t/cant-start-filebeat-with-tls-configured/40594 "2016-02-05T15:01:04Z")
Hey guys, I'm trying to setup my first filebeat forwarder after having used logstash-forwarder for quite a while. When I try to start up filebeat I'm getting this error: \`\[root@web1:/etc/filebeat\] #systemctl stat… --- ## [No log data arriving after update of filebeats (1.0.0-beta4 (386) -\> 1.0.1 (386))](https://discuss.elastic.co/t/no-log-data-arriving-after-update-of-filebeats-1-0-0-beta4-386-1-0-1-386/40764)
**Author:** [@Moxl](https://discuss.elastic.co/u/Moxl)\ **Replies:** 12\ **Last updated:** [February 5, 2016, 9:04am UTC](https://discuss.elastic.co/t/no-log-data-arriving-after-update-of-filebeats-1-0-0-beta4-386-1-0-1-386/40764 "2016-02-05T09:04:29Z")
Hi everyone, i was having trouble with file locks with filebeat 1.0.0-beta4. Thus, i updated to 1.0.1 but now my Logstash server does not receive any logs anymore... \[:frowning:\] My setting: I am running ELK on a deb… --- ## [Index tag in Logstash output doesn't seem to work](https://discuss.elastic.co/t/index-tag-in-logstash-output-doesnt-seem-to-work/41008)
**Author:** [@rawill](https://discuss.elastic.co/u/rawill)\ **Replies:** 4\ **Last updated:** [February 4, 2016, 11:36pm UTC](https://discuss.elastic.co/t/index-tag-in-logstash-output-doesnt-seem-to-work/41008 "2016-02-04T23:36:33Z")
While testing Winlogbeat we set the index in the Logstash output but never see it getting passed. Anyone else seeing similar to this? What I have set in my yml: Optional index name. The default index name depends on… --- ## [Filebeat Multiline eats up the entire log file](https://discuss.elastic.co/t/filebeat-multiline-eats-up-the-entire-log-file/40982)
**Author:** [@mguiwin](https://discuss.elastic.co/u/mguiwin)\ **Replies:** 1\ **Last updated:** [February 4, 2016, 5:03pm UTC](https://discuss.elastic.co/t/filebeat-multiline-eats-up-the-entire-log-file/40982 "2016-02-04T17:03:57Z")
Hello, I'm trying out the new multiline feature by running FB on an existing log file and having an issue: FB pushes the entire file contents to Logstash as one single message. Here is my setup: OS: Windows 7 64 F… --- ## [Protos/http/http.go are packets in disorder handled?](https://discuss.elastic.co/t/protos-http-http-go-are-packets-in-disorder-handled/40899)
**Author:** [@patricio.dorantes](https://discuss.elastic.co/u/patricio.dorantes)\ **Replies:** 3\ **Last updated:** [February 4, 2016, 4:50pm UTC](https://discuss.elastic.co/t/protos-http-http-go-are-packets-in-disorder-handled/40899 "2016-02-04T16:50:00Z")
I'm trying to understand packetbeat http code to monitor fcgi. I'm new in go language but the code below suggests me that streams are not separated by tcptuples just by dir. So if tcp packets are in disorder from differe… --- ## [Ignore\_older option in filebeat not working as expected](https://discuss.elastic.co/t/ignore-older-option-in-filebeat-not-working-as-expected/40437)
**Author:** [@Kartik\_Ramachandran](https://discuss.elastic.co/u/Kartik_Ramachandran)\ **Replies:** 6\ **Last updated:** [February 3, 2016, 3:28pm UTC](https://discuss.elastic.co/t/ignore-older-option-in-filebeat-not-working-as-expected/40437 "2016-02-03T15:28:43Z")
I just started using filebeat. I have set ignore\_older options to 5s. There are a lot of old files in the directory which gets scanned (which cannot be deleted). I see that the old files are opened which causes filebeat … --- ## [Filebeat registry update](https://discuss.elastic.co/t/filebeat-registry-update/40836)
**Author:** [@Harvii\_Dent](https://discuss.elastic.co/u/Harvii_Dent)\ **Replies:** 1\ **Last updated:** [February 3, 2016, 9:07am UTC](https://discuss.elastic.co/t/filebeat-registry-update/40836 "2016-02-03T09:07:32Z")
Hello, How often does the registry file get updated? is it periodic (every few minutes)? or is updated after each log line is acknowledged? Thanks --- ## [Topbeat not showing process data](https://discuss.elastic.co/t/topbeat-not-showing-process-data/40759)
**Author:** [@kmroz](https://discuss.elastic.co/u/kmroz)\ **Replies:** 3\ **Last updated:** [February 2, 2016, 9:18pm UTC](https://discuss.elastic.co/t/topbeat-not-showing-process-data/40759 "2016-02-02T21:18:41Z")
Top beat is running fine except my process data is showing as this Any idea what is causing this? Thanks!! --- ## [Winlogbeat release](https://discuss.elastic.co/t/winlogbeat-release/39282)
**Author:** [@Philip\_Kobezak](https://discuss.elastic.co/u/Philip_Kobezak)\ **Replies:** 5\ **Last updated:** [February 2, 2016, 9:15pm UTC](https://discuss.elastic.co/t/winlogbeat-release/39282 "2016-02-02T21:15:22Z")
I believe I read somewhere that Winlogbeat will be released with Beats version 1.1, is that correct? If so, what does the timeline look like for 1.1? --- ## [Deletion of logs of filebeat client side](https://discuss.elastic.co/t/deletion-of-logs-of-filebeat-client-side/40671)
**Author:** [@sd\_karthik](https://discuss.elastic.co/u/sd_karthik)\ **Replies:** 2\ **Last updated:** [February 2, 2016, 6:11am UTC](https://discuss.elastic.co/t/deletion-of-logs-of-filebeat-client-side/40671 "2016-02-02T06:11:45Z")
Is there a way where, logs on the source server are deleted after getting streamed. Like-- currently we have hourly logs on the source, which keeps rotating every hour. And currently I have Filebeats installed on these s… --- ## [Deploying Filebeat on MacOS X](https://discuss.elastic.co/t/deploying-filebeat-on-macos-x/37785)
**Author:** [@dirkhschulz](https://discuss.elastic.co/u/dirkhschulz)\ **Replies:** 14\ **Last updated:** [February 1, 2016, 10:00pm UTC](https://discuss.elastic.co/t/deploying-filebeat-on-macos-x/37785 "2016-02-01T22:00:20Z")
Hi all, I am looking into deploying filebeat on Mac OS X (10.11). The package does not contain the wrapper binary filebeat-god, so the question is how to daemonize filebeat properly. Starting it manually I can use … --- ## [Logstash File Handler w/ Partially Read Files](https://discuss.elastic.co/t/logstash-file-handler-w-partially-read-files/40418)
**Author:** [@NikolaeVarius](https://discuss.elastic.co/u/NikolaeVarius)\ **Replies:** 5\ **Last updated:** [February 1, 2016, 8:13am UTC](https://discuss.elastic.co/t/logstash-file-handler-w-partially-read-files/40418 "2016-02-01T08:13:48Z")
I'm trying to figure out an official answer as to how filebeat handles this hypothetical scenario, because I can't seem to find an answer in the documentation. Presume we have an hourly log that filebeat reads and send… --- ## [Ignore\_older](https://discuss.elastic.co/t/ignore-older/40526)
**Author:** [@sd\_karthik](https://discuss.elastic.co/u/sd_karthik)\ **Replies:** 1\ **Last updated:** [February 1, 2016, 8:11am UTC](https://discuss.elastic.co/t/ignore-older/40526 "2016-02-01T08:11:37Z")
HI Folks, What is exactly ignore\_older. I have hourly log files on my server where filebeat is running and streaming logs to logstash. I have ignore\_older set to 30m. I stopped logstash process on destination at 12 10P… --- ## [Lumberjack input not working with beats input](https://discuss.elastic.co/t/lumberjack-input-not-working-with-beats-input/40478)
**Author:** [@abinay](https://discuss.elastic.co/u/abinay)\ **Replies:** 3\ **Last updated:** [January 30, 2016, 7:19am UTC](https://discuss.elastic.co/t/lumberjack-input-not-working-with-beats-input/40478 "2016-01-30T07:19:15Z")
Hii I was using lumberjack input to receive logs from Logstash Forwarder . Then I also used Filebeat and liked some of its properties . Now I have one server that sends logs to Logstash using Filebeat and another server … --- ## [Filebeats on windows](https://discuss.elastic.co/t/filebeats-on-windows/40490)
**Author:** [@sd\_karthik](https://discuss.elastic.co/u/sd_karthik)\ **Replies:** 3\ **Last updated:** [January 29, 2016, 9:34pm UTC](https://discuss.elastic.co/t/filebeats-on-windows/40490 "2016-01-29T21:34:51Z")
Can someone please explain me how to get Filebeats working on Windows. I have uploaded whatever I have in my windows server. Also I have configs ready on filebeat.yml. I tried to execute filebeat.exe from command line … --- ## [How to install and run filebeats without root access - red hat](https://discuss.elastic.co/t/how-to-install-and-run-filebeats-without-root-access-red-hat/40494)
**Author:** [@whyapenny](https://discuss.elastic.co/u/whyapenny)\ **Replies:** 2\ **Last updated:** [January 29, 2016, 5:14pm UTC](https://discuss.elastic.co/t/how-to-install-and-run-filebeats-without-root-access-red-hat/40494 "2016-01-29T17:14:49Z")
So I am trying to have my application log into logstash --\> elasticsearch as well as straight to elasticsearch. problem is, i do not have root access. This wasn't an issue with logshipper as i could run logstash instan… --- ## [Filebeat 1.0.1: Field Definitions](https://discuss.elastic.co/t/filebeat-1-0-1-field-definitions/40454)
**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 1\ **Last updated:** [January 29, 2016, 3:24pm UTC](https://discuss.elastic.co/t/filebeat-1-0-1-field-definitions/40454 "2016-01-29T15:24:49Z")
Hi, I have noticed that I cannot define a custom field as an array in the filebeat config. For example: custom\_field: - field 1 - field 2 ...doesn't throw an error, but the definition is ignored. How does filebea… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=592) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=594)