# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=594 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 595 --- ## [Logstash input-beat not receiving @metadata field](https://discuss.elastic.co/t/logstash-input-beat-not-receiving-metadata-field/40365)
**Author:** [@Bruno\_Lavoie](https://discuss.elastic.co/u/Bruno_Lavoie)\ **Replies:** 3\ **Last updated:** [January 29, 2016, 3:21pm UTC](https://discuss.elastic.co/t/logstash-input-beat-not-receiving-metadata-field/40365 "2016-01-29T15:21:56Z")
Hello, I searched all over the web and on this forum but haven't found. I configured a filebeat to parse server logs and send it to logstash, when I want to refer to @metadata fields in filters and Elasticsearch-out… --- ## [FileBeat - Ship only Filtered log lines](https://discuss.elastic.co/t/filebeat-ship-only-filtered-log-lines/35622)
**Author:** [@mvenkat\_in](https://discuss.elastic.co/u/mvenkat_in)\ **Replies:** 5\ **Last updated:** [January 29, 2016, 8:05am UTC](https://discuss.elastic.co/t/filebeat-ship-only-filtered-log-lines/35622 "2016-01-29T08:05:46Z")
Hi Use Case: Real time application transactions logs metrics analysis & monitoring Environment: File Beat (1.0.0-rc2) --\> Log Stash (2.0.0)--\> Elastic Search (2.0.0)--\> Kibana (4.2.1) Description: The Filebeat capture… --- ## [Listen for MSSQL (1433) traffic?](https://discuss.elastic.co/t/listen-for-mssql-1433-traffic/40409)
**Author:** [@scrom](https://discuss.elastic.co/u/scrom)\ **Replies:** 1\ **Last updated:** [January 28, 2016, 9:42pm UTC](https://discuss.elastic.co/t/listen-for-mssql-1433-traffic/40409 "2016-01-28T21:42:18Z")
I found some older posts saying you planned on supporting MSSQL, but the last update I could find was around October. Is there an ETA yet? Unfortunately I can't get my company to move off MSSQL, which is funny because a… --- ## [Print response when finish reading a file](https://discuss.elastic.co/t/print-response-when-finish-reading-a-file/40054)
**Author:** [@sharon.c](https://discuss.elastic.co/u/sharon.c)\ **Replies:** 3\ **Last updated:** [January 28, 2016, 1:49pm UTC](https://discuss.elastic.co/t/print-response-when-finish-reading-a-file/40054 "2016-01-28T13:49:15Z")
When I use filebeat finish reading a file (the file does not change anymore), in command line filebeat will print out a response like this. It is normal to finish reading a file, it is not an error. Is there any way I… --- ## [Configure Filebeat for All Logs](https://discuss.elastic.co/t/configure-filebeat-for-all-logs/39514)
**Author:** [@naseerudeenmeeajane](https://discuss.elastic.co/u/naseerudeenmeeajane)\ **Replies:** 34\ **Last updated:** [January 28, 2016, 12:22pm UTC](https://discuss.elastic.co/t/configure-filebeat-for-all-logs/39514 "2016-01-28T12:22:12Z")
Hello, I have installed ELK on my server. So now, I ma trying to use and configure Filebeat to send somme informations to my ELK server, but when I configure filebeat from some tutorial, it does not work. Someone has… --- ## [How to use Multiline](https://discuss.elastic.co/t/how-to-use-multiline/39583)
**Author:** [@Aron\_Pedersen](https://discuss.elastic.co/u/Aron_Pedersen)\ **Replies:** 4\ **Last updated:** [January 28, 2016, 11:29am UTC](https://discuss.elastic.co/t/how-to-use-multiline/39583 "2016-01-28T11:29:13Z")
I am trying to use the new Multiline option in filebeat 1.2 but is having no success. I would like to take the logs that Ola Hallengren's (https://ola.hallengren.com) scripts makes. I have an example of one below. What I… --- ## [Data disparity between Kibana and database](https://discuss.elastic.co/t/data-disparity-between-kibana-and-database/40227)
**Author:** [@karlisson](https://discuss.elastic.co/u/karlisson)\ **Replies:** 2\ **Last updated:** [January 28, 2016, 10:33am UTC](https://discuss.elastic.co/t/data-disparity-between-kibana-and-database/40227 "2016-01-28T10:33:19Z")
Hello! I'm using packetbeat with pf\_ring to gather data from Mysql INSERT's and index it in ES, showing on Kibana. pf\_ring works on a machine which has 20k packets per second and in total sums 280GB per day. It is an… --- ## [Filebeat and Timezones](https://discuss.elastic.co/t/filebeat-and-timezones/40168)
**Author:** [@yammy](https://discuss.elastic.co/u/yammy)\ **Replies:** 4\ **Last updated:** [January 27, 2016, 10:46pm UTC](https://discuss.elastic.co/t/filebeat-and-timezones/40168 "2016-01-27T22:46:53Z")
Full disclosure, just getting started with my first ELK stack setup... When I use Filebeat to forward syslogs I have some hosts in UTC and some in EST. Once they go into Elastic Search it assumes everything is in UTC … --- ## [Not getting topbeat to show up in ES which is why there is nothing in Kibana](https://discuss.elastic.co/t/not-getting-topbeat-to-show-up-in-es-which-is-why-there-is-nothing-in-kibana/40293)
**Author:** [@kmroz](https://discuss.elastic.co/u/kmroz)\ **Replies:** 1\ **Last updated:** [January 27, 2016, 10:31pm UTC](https://discuss.elastic.co/t/not-getting-topbeat-to-show-up-in-es-which-is-why-there-is-nothing-in-kibana/40293 "2016-01-27T22:31:28Z")
I just installed beats with the most recent versions of ELK. my beats.yml is as shown in the example in the docs. top beat is running and i can see it going through logstashwhen I tail the logstash logs. Its the matter … --- ## [Using Logstash to ingest Topbeat data that is output in file mode](https://discuss.elastic.co/t/using-logstash-to-ingest-topbeat-data-that-is-output-in-file-mode/40278)
**Author:** [@redrise](https://discuss.elastic.co/u/redrise)\ **Replies:** 2\ **Last updated:** [January 27, 2016, 8:29pm UTC](https://discuss.elastic.co/t/using-logstash-to-ingest-topbeat-data-that-is-output-in-file-mode/40278 "2016-01-27T20:29:47Z")
I've setup Topbeat in a mixed environment where some nodes are configured to talk to Logstash directly using the logstash output mode, however I have some nodes that don't have direct connectivity and I am outputting the… --- ## [Filebeat nested 'fields' values](https://discuss.elastic.co/t/filebeat-nested-fields-values/40281)
**Author:** [@Bruno\_Lavoie](https://discuss.elastic.co/u/Bruno_Lavoie)\ **Replies:** 1\ **Last updated:** [January 27, 2016, 7:59pm UTC](https://discuss.elastic.co/t/filebeat-nested-fields-values/40281 "2016-01-27T19:59:15Z")
Hello, I'm looking to use Filebeat to ship logs to our ELK stack cluster. Editing the yml file, I tried this kind of configuration: fields: debug: true banana: split: chocolate but when starting the … --- ## [Expected date for Filebeat 1.1 release](https://discuss.elastic.co/t/expected-date-for-filebeat-1-1-release/39533)
**Author:** [@mguiwin](https://discuss.elastic.co/u/mguiwin)\ **Replies:** 5\ **Last updated:** [January 27, 2016, 7:37pm UTC](https://discuss.elastic.co/t/expected-date-for-filebeat-1-1-release/39533 "2016-01-27T19:37:49Z")
Hello, I'm particularly interested in the multi-line support which is expected to be in the 1.1 release. What is its expected date? Thanks a lot! MG --- ## [Which options are global?](https://discuss.elastic.co/t/which-options-are-global/40247)
**Author:** [@pcfens](https://discuss.elastic.co/u/pcfens)\ **Replies:** 3\ **Last updated:** [January 27, 2016, 4:27pm UTC](https://discuss.elastic.co/t/which-options-are-global/40247 "2016-01-27T16:27:47Z")
Under the config\_dir setting, there's a note that "All global options, such as spool\_size, are ignored." Individual options don't list whether or not they're global - is there a list somewhere that I've missed? --- ## [New Layer support - Wi-Fi (RadioTap)](https://discuss.elastic.co/t/new-layer-support-wi-fi-radiotap/40204)
**Author:** [@alm8i](https://discuss.elastic.co/u/alm8i)\ **Replies:** 2\ **Last updated:** [January 27, 2016, 11:20am UTC](https://discuss.elastic.co/t/new-layer-support-wi-fi-radiotap/40204 "2016-01-27T11:20:53Z")
I added limited radiotap layer (Wi-Fi) support to packetbeat, so that I am able to receive for example beacons, probes, etc... But when I am enabling other protocols (http, dns, ...) in yml file, no management frames are… --- ## [Edit filebeat mappings](https://discuss.elastic.co/t/edit-filebeat-mappings/39742)
**Author:** [@JSmith2412](https://discuss.elastic.co/u/JSmith2412)\ **Replies:** 6\ **Last updated:** [January 27, 2016, 10:53am UTC](https://discuss.elastic.co/t/edit-filebeat-mappings/39742 "2016-01-27T10:53:29Z")
I'm streaming data into SolR and I need to produce a JSON field in the FileBeat payload called event\_timestamp. Is there some way I can replicate the @timestamp field, or do I need to edit the FileBeat template? If so ho… --- ## [Index template for multi-level field](https://discuss.elastic.co/t/index-template-for-multi-level-field/40171)
**Author:** [@Florin\_Andrei](https://discuss.elastic.co/u/Florin_Andrei)\ **Replies:** 2\ **Last updated:** [January 27, 2016, 9:40am UTC](https://discuss.elastic.co/t/index-template-for-multi-level-field/40171 "2016-01-27T09:40:49Z")
A while ago, I made a Logstash filter that extracts geolocation information from the client IP in Nginx logs, like this: geoip { source =\> "clientip" target =\> "geoip" database =\> "/etc/logstash/GeoLiteCity.dat" … --- ## [Packetbeat crashes](https://discuss.elastic.co/t/packetbeat-crashes/40024)
**Author:** [@ironbeast](https://discuss.elastic.co/u/ironbeast)\ **Replies:** 4\ **Last updated:** [January 26, 2016, 5:35am UTC](https://discuss.elastic.co/t/packetbeat-crashes/40024 "2016-01-26T05:35:51Z")
Hi All, I have an issue with packetbeat... I installed packetbeat and wanted to monitor my mysql traffic. From the moment packetbeat records a transaction. It crashed and stopped the service. No transactions where made… --- ## [Topbeat from master](https://discuss.elastic.co/t/topbeat-from-master/39804)
**Author:** [@biswajit86](https://discuss.elastic.co/u/biswajit86)\ **Replies:** 8\ **Last updated:** [January 26, 2016, 12:45am UTC](https://discuss.elastic.co/t/topbeat-from-master/39804 "2016-01-26T00:45:23Z")
Is there any documentation on how to build topbeat from master I am interested in testing out the feature for command line options and would like to build a new binary from the source If it helps, I usually download … --- ## [Filebeat in windows 2008 r2 - not sending data to logstash](https://discuss.elastic.co/t/filebeat-in-windows-2008-r2-not-sending-data-to-logstash/39878)
**Author:** [@vishnu.music](https://discuss.elastic.co/u/vishnu.music)\ **Replies:** 4\ **Last updated:** [January 25, 2016, 6:31pm UTC](https://discuss.elastic.co/t/filebeat-in-windows-2008-r2-not-sending-data-to-logstash/39878 "2016-01-25T18:31:02Z")
Hello, I installed filebeat 1.0.1 in my windows 2008 r2 server. I have configured the below path and logstash server output paths: - C:\\Documentum\\dba\\\*.log logstash: # The Logstash hosts hosts: \["10… --- ## [Filebeat load balance problem](https://discuss.elastic.co/t/filebeat-load-balance-problem/39898)
**Author:** [@baoxiao](https://discuss.elastic.co/u/baoxiao)\ **Replies:** 2\ **Last updated:** [January 25, 2016, 5:31pm UTC](https://discuss.elastic.co/t/filebeat-load-balance-problem/39898 "2016-01-25T17:31:32Z")
I try to set up filebeat to send log file to 2 logstash instances using load balance with this logstash: hosts: \["host1:5044","host2:5044"\] loadbalance: true but filebeat always send logs to hosts1 even afte… --- ## [Merging Configuration Files](https://discuss.elastic.co/t/merging-configuration-files/39990)
**Author:** [@pcfens](https://discuss.elastic.co/u/pcfens)\ **Replies:** 3\ **Last updated:** [January 25, 2016, 5:25pm UTC](https://discuss.elastic.co/t/merging-configuration-files/39990 "2016-01-25T17:25:24Z")
Is it possible to merge various configuration files and fields (like the input/procs field)? I'd like to distribute a default configuration file to all of my machines with output information, and add additional files … --- ## [Redis output replacement](https://discuss.elastic.co/t/redis-output-replacement/37949)
**Author:** [@bsam](https://discuss.elastic.co/u/bsam)\ **Replies:** 5\ **Last updated:** [January 25, 2016, 10:42am UTC](https://discuss.elastic.co/t/redis-output-replacement/37949 "2016-01-25T10:42:32Z")
Hi All! I've purchased the Logstash Book and try to configure a test farm. It is recommended at the Book using a Redis between shipper and logstash. Now I configure filebeat and read here that "Redis output for the Bea… --- ## [Filebeat not reading new logs changes when manually updated one of the logs](https://discuss.elastic.co/t/filebeat-not-reading-new-logs-changes-when-manually-updated-one-of-the-logs/37058)
**Author:** [@vivc](https://discuss.elastic.co/u/vivc)\ **Replies:** 16\ **Last updated:** [January 25, 2016, 6:55am UTC](https://discuss.elastic.co/t/filebeat-not-reading-new-logs-changes-when-manually-updated-one-of-the-logs/37058 "2016-01-25T06:55:51Z")
Manually update one of the logs in the logs directory but filebeat is not reading the logs unless filebeat service is restarted . I'm sending the logs to logstash once it's read. Using filebeat version filebeat-1.0.0-i… --- ## [Switching from Logstash to Beats](https://discuss.elastic.co/t/switching-from-logstash-to-beats/39957)
**Author:** [@Stuart\_Cracraft](https://discuss.elastic.co/u/Stuart_Cracraft)\ **Replies:** 3\ **Last updated:** [January 24, 2016, 4:10am UTC](https://discuss.elastic.co/t/switching-from-logstash-to-beats/39957 "2016-01-24T04:10:54Z")
I currently have Logstash 1.5.5 shipper installed on all my boxes. For the most part, no issues. They all go into a largish Elasticsearch cluster and are fronted by Kibana. No problem collecting a bunch of files with log… --- ## [Filebeat not able to establish connection with my elk host machine](https://discuss.elastic.co/t/filebeat-not-able-to-establish-connection-with-my-elk-host-machine/39956)
**Author:** [@Akash\_Katakam](https://discuss.elastic.co/u/Akash_Katakam)\ **Replies:** 6\ **Last updated:** [January 23, 2016, 8:58pm UTC](https://discuss.elastic.co/t/filebeat-not-able-to-establish-connection-with-my-elk-host-machine/39956 "2016-01-23T20:58:25Z")
I installed filebeat on my dev server and wanted to fetch log files from there to another machine but when i try to run logstash.bat -f config.json on my elk machine it shows error in my console ←\[31mAttempted to send a… --- ## [Bug for PR 749](https://discuss.elastic.co/t/bug-for-pr-749/39921)
**Author:** [@biswajit86](https://discuss.elastic.co/u/biswajit86)\ **Replies:** 4\ **Last updated:** [January 22, 2016, 9:20pm UTC](https://discuss.elastic.co/t/bug-for-pr-749/39921 "2016-01-22T21:20:00Z")
Hi All, PR 749 recently got merged to master . This PR implements support for command line options in topbeat. However, I am unable to see command line options for child proceses. Some of our ancient perl scripts use… --- ## [No debugging data returning after restarting beat with debugging/logging turned on](https://discuss.elastic.co/t/no-debugging-data-returning-after-restarting-beat-with-debugging-logging-turned-on/39807)
**Author:** [@adron](https://discuss.elastic.co/u/adron)\ **Replies:** 3\ **Last updated:** [January 22, 2016, 9:14pm UTC](https://discuss.elastic.co/t/no-debugging-data-returning-after-restarting-beat-with-debugging-logging-turned-on/39807 "2016-01-22T21:14:53Z")
I'm using elasticsearch w/ Kibana 4.0 w/ the AWS managed setup. I'm working on figuring out if all my beats are actually reporting so I'm checking as I install topbeat on each new system throughout my environment. I have… --- ## [Not able to load template file, Invoke-WebRequest is not recognized command](https://discuss.elastic.co/t/not-able-to-load-template-file-invoke-webrequest-is-not-recognized-command/39664)
**Author:** [@jayaram](https://discuss.elastic.co/u/jayaram)\ **Replies:** 4\ **Last updated:** [January 22, 2016, 7:38pm UTC](https://discuss.elastic.co/t/not-able-to-load-template-file-invoke-webrequest-is-not-recognized-command/39664 "2016-01-22T19:38:15Z")
Hello, I am trying to install Topbeat on windows machine, As per https://www.elastic.co/guide/en/beats/topbeat/current/topbeat-getting-started.html I have downloaded and executed … --- ## [TopBeat ignore some filesystems](https://discuss.elastic.co/t/topbeat-ignore-some-filesystems/39763)
**Author:** [@mikula](https://discuss.elastic.co/u/mikula)\ **Replies:** 1\ **Last updated:** [January 22, 2016, 1:54am UTC](https://discuss.elastic.co/t/topbeat-ignore-some-filesystems/39763 "2016-01-22T01:54:52Z")
How to make topbeat to ignore some filesystem type (eg. nfs)? --- ## [Understanding & Testing Installation & Setup of Topbeats/Beats](https://discuss.elastic.co/t/understanding-testing-installation-setup-of-topbeats-beats/39176)
**Author:** [@adron](https://discuss.elastic.co/u/adron)\ **Replies:** 2\ **Last updated:** [January 14, 2016, 7:42pm UTC](https://discuss.elastic.co/t/understanding-testing-installation-setup-of-topbeats-beats/39176 "2016-01-14T19:42:05Z")
I've just setup Elastic with Amazon Web Services hosted feature. Once I set that up I setup a Topbeats on a Windows EC2 instance and started the service (after setting the template, etc). After all this I navigate to the… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=593) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=595)