# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=595 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 596 --- ## [Producing Arm builds with beats packer](https://discuss.elastic.co/t/producing-arm-builds-with-beats-packer/39727)
**Author:** [@kai5263499](https://discuss.elastic.co/u/kai5263499)\ **Replies:** 2\ **Last updated:** [January 21, 2016, 1:34pm UTC](https://discuss.elastic.co/t/producing-arm-builds-with-beats-packer/39727 "2016-01-21T13:34:10Z")
Has anyone tried producing linux arm builds (deb or rpm) with the beats packer docker images? --- ## [Support for freebsd](https://discuss.elastic.co/t/support-for-freebsd/39654)
**Author:** [@ChuyenGiaSon](https://discuss.elastic.co/u/ChuyenGiaSon)\ **Replies:** 2\ **Last updated:** [January 21, 2016, 11:45am UTC](https://discuss.elastic.co/t/support-for-freebsd/39654 "2016-01-21T11:45:34Z")
Hi Is there any plan to support for freebsd ? I see that you guys have mac os version so please support freebsd and pfsense also. Thank you very much --- ## [Packetbeat's Dashboard issue](https://discuss.elastic.co/t/packetbeats-dashboard-issue/39724)
**Author:** [@xiaobai\_Ye](https://discuss.elastic.co/u/xiaobai_Ye)\ **Replies:** 3\ **Last updated:** [January 21, 2016, 9:45am UTC](https://discuss.elastic.co/t/packetbeats-dashboard-issue/39724 "2016-01-21T09:45:00Z")
when i use Packetbeat, i have this issue, the HTTP requests is not accurate， for example: the "Top 10 HTTP requests" is like this,in the visualize the path term became "/api" and "check\_permission"，not "GET /api/oaut… --- ## [Topbeat vs. SIGAR](https://discuss.elastic.co/t/topbeat-vs-sigar/39731)
**Author:** [@otisg](https://discuss.elastic.co/u/otisg)\ **Replies:** 1\ **Last updated:** [January 21, 2016, 7:11am UTC](https://discuss.elastic.co/t/topbeat-vs-sigar/39731 "2016-01-21T07:11:30Z")
Hi, Does Topbeat offer anything that one cannot get from SIGAR itself? In other words, does Topbeat add any other functionality/data that SIGAR doesn't provide? Or is Topbeat just a Go wrapper around SIGAR? Thanks, … --- ## [Disable field "count" in filebeat output](https://discuss.elastic.co/t/disable-field-count-in-filebeat-output/39568)
**Author:** [@kurromat](https://discuss.elastic.co/u/kurromat)\ **Replies:** 2\ **Last updated:** [January 20, 2016, 8:55am UTC](https://discuss.elastic.co/t/disable-field-count-in-filebeat-output/39568 "2016-01-20T08:55:28Z")
Hi, after switching from logstash-forwarder to filebeat, I noticed a new field named count in the output. Is it possible to disable or rename this field via configuration? (And out of interest, which meaning does thi… --- ## [Beat support for Message Queue output](https://discuss.elastic.co/t/beat-support-for-message-queue-output/39567)
**Author:** [@Nir\_Dothan](https://discuss.elastic.co/u/Nir_Dothan)\ **Replies:** 4\ **Last updated:** [January 20, 2016, 8:31am UTC](https://discuss.elastic.co/t/beat-support-for-message-queue-output/39567 "2016-01-20T08:31:12Z")
Documentation shows that Redis output is deprecated, and I didn't see Kafka at all. Is there an architectural reason why I would not want to use a message queue between Beat and the Logstash indexer? Are there any plans… --- ## [Filebeat not monitoring data](https://discuss.elastic.co/t/filebeat-not-monitoring-data/39500)
**Author:** [@usahitya](https://discuss.elastic.co/u/usahitya)\ **Replies:** 6\ **Last updated:** [January 20, 2016, 5:41am UTC](https://discuss.elastic.co/t/filebeat-not-monitoring-data/39500 "2016-01-20T05:41:43Z")
Hi Friends, I set up Elasticsearch in our Lab, there in filebeat.yml I given the following configuration filebeat: paths: - /var/log/\* document\_type: syslog scan\_frequency: 10s logstash: # The Logstash h… --- ## [\[new beat\]Panic with the beat code](https://discuss.elastic.co/t/new-beat-panic-with-the-beat-code/39482)
**Author:** [@pollux](https://discuss.elastic.co/u/pollux)\ **Replies:** 4\ **Last updated:** [January 19, 2016, 11:27am UTC](https://discuss.elastic.co/t/new-beat-panic-with-the-beat-code/39482 "2016-01-19T11:27:01Z")
Hi, I would monitor file and folder size. So I said "ok I saw all this community beat, it must be not so hard :D". At first I'm trying using filepath.Walk with a custom (simple) callback function like that : p… --- ## [Filebeat not reading apache logs?](https://discuss.elastic.co/t/filebeat-not-reading-apache-logs/39419)
**Author:** [@tomiford](https://discuss.elastic.co/u/tomiford)\ **Replies:** 8\ **Last updated:** [January 19, 2016, 7:22am UTC](https://discuss.elastic.co/t/filebeat-not-reading-apache-logs/39419 "2016-01-19T07:22:20Z")
Hi I am new to filebeat and have set up the syslog files of our servers to be sent to logstash by filebeat. I am now trying to get apache logs into logstash but it does not seem to be reading the log. When starting u… --- ## [How to use filebeat to filter the tomcate log?](https://discuss.elastic.co/t/how-to-use-filebeat-to-filter-the-tomcate-log/38372)
**Author:** [@Mohamed\_Ibrahim](https://discuss.elastic.co/u/Mohamed_Ibrahim)\ **Replies:** 11\ **Last updated:** [January 18, 2016, 6:06pm UTC](https://discuss.elastic.co/t/how-to-use-filebeat-to-filter-the-tomcate-log/38372 "2016-01-18T18:06:19Z")
i installed Logstash and elasticsearch from the below tutorial https://www.digitalocean.com/community/tutorials/how-to-install-elasticsearch-logstash-and-kibana-elk-stack-on-centos-7 and tomcat logs successfully appe… --- ## [Not able to setup filebeat on windows server 2012 R2](https://discuss.elastic.co/t/not-able-to-setup-filebeat-on-windows-server-2012-r2/39304)
**Author:** [@babeesh](https://discuss.elastic.co/u/babeesh)\ **Replies:** 6\ **Last updated:** [January 16, 2016, 9:52am UTC](https://discuss.elastic.co/t/not-able-to-setup-filebeat-on-windows-server-2012-r2/39304 "2016-01-16T09:52:56Z")
I am trying to setup filebeat on windows server. filebeat version : filebeat-1.2.0-nightlylatest-windows I will brieg the steps I did.. 1. PS C:\\Scripts\\filebeat\> ./install-service-filebeat.ps1 Here I got some exec… --- ## [Beats on SuSE 10/11](https://discuss.elastic.co/t/beats-on-suse-10-11/34654)
**Author:** [@Samuel\_Piedagnel](https://discuss.elastic.co/u/Samuel_Piedagnel)\ **Replies:** 5\ **Last updated:** [January 15, 2016, 6:51pm UTC](https://discuss.elastic.co/t/beats-on-suse-10-11/34654 "2016-01-15T18:51:06Z")
Is there any installation package or image of Beats (topbeat) available for SuSE 10 and SuSE 11? --- ## [In what order are the options processed](https://discuss.elastic.co/t/in-what-order-are-the-options-processed/39341)
**Author:** [@Aron\_Pedersen](https://discuss.elastic.co/u/Aron_Pedersen)\ **Replies:** 2\ **Last updated:** [January 15, 2016, 4:54pm UTC](https://discuss.elastic.co/t/in-what-order-are-the-options-processed/39341 "2016-01-15T16:54:41Z")
Is the the Multiline option run before or after the Exclude/Include option? What I would like to do is to combine lines first and then after this either Include or Exclude these combined lines. --- ## [Custom fields or a way to analyze tags](https://discuss.elastic.co/t/custom-fields-or-a-way-to-analyze-tags/39129)
**Author:** [@cg-max](https://discuss.elastic.co/u/cg-max)\ **Replies:** 3\ **Last updated:** [January 15, 2016, 4:25pm UTC](https://discuss.elastic.co/t/custom-fields-or-a-way-to-analyze-tags/39129 "2016-01-15T16:25:52Z")
Hi, We're evaluating topbeat and have a need for a double hostname setup, where both the 'real' hostnames (12349187324.somecloud.com) and nice hostname (elastic08.somecloud.com) can be used to search/filter and graph u… --- ## [Shipper log with filebeat on windows sv 2008](https://discuss.elastic.co/t/shipper-log-with-filebeat-on-windows-sv-2008/39305)
**Author:** [@tatdat](https://discuss.elastic.co/u/tatdat)\ **Replies:** 1\ **Last updated:** [January 15, 2016, 7:40am UTC](https://discuss.elastic.co/t/shipper-log-with-filebeat-on-windows-sv-2008/39305 "2016-01-15T07:40:26Z")
i using filebeat (lastest version) for shipping log IIS on windows server 2008. I testing with IIS log file large (5GB). but i don't see log on ES ( don't create new indices becasue in config filebeat, i set new indice… --- ## [Does excuse me filebeat support input to kafka？](https://discuss.elastic.co/t/does-excuse-me-filebeat-support-input-to-kafka/39211)
**Author:** [@clifford](https://discuss.elastic.co/u/clifford)\ **Replies:** 7\ **Last updated:** [January 15, 2016, 2:39am UTC](https://discuss.elastic.co/t/does-excuse-me-filebeat-support-input-to-kafka/39211 "2016-01-15T02:39:26Z")
Does excuse me， filebeat support input to kafka, want to this architecture: filebeat - \> kakfa -- -- -- -- \> logstash - \> elasticsearch - \> kibana? --- ## [Segfault when starting filebeat on RHEL5.5](https://discuss.elastic.co/t/segfault-when-starting-filebeat-on-rhel5-5/39258)
**Author:** [@jkpaye](https://discuss.elastic.co/u/jkpaye)\ **Replies:** 1\ **Last updated:** [January 14, 2016, 8:51pm UTC](https://discuss.elastic.co/t/segfault-when-starting-filebeat-on-rhel5-5/39258 "2016-01-14T20:51:38Z")
Having issues getting filebeat to run on RHEL5.5. Running kernel 2.6.18-238. Any ideas? strace -f /usr/bin/filebeat -c /etc/filebeat/filebeat.yml -e figtest execve("/usr/bin/filebeat", \["/usr/bin/filebeat", "-c", "/… --- ## [How to Handle Publication Failures](https://discuss.elastic.co/t/how-to-handle-publication-failures/38753)
**Author:** [@robinpercy](https://discuss.elastic.co/u/robinpercy)\ **Replies:** 8\ **Last updated:** [January 14, 2016, 5:43pm UTC](https://discuss.elastic.co/t/how-to-handle-publication-failures/38753 "2016-01-14T17:43:19Z")
I'm writing a Beat to pull events from a message queue and publish them via libbeat. If an event fails to publish, I'd like to send it to a dead letter queue. However, from looking at the outputs/elasticsearch/client.go#… --- ## [Slice bounds out of range](https://discuss.elastic.co/t/slice-bounds-out-of-range/39049)
**Author:** [@ceekay](https://discuss.elastic.co/u/ceekay)\ **Replies:** 3\ **Last updated:** [January 14, 2016, 1:47pm UTC](https://discuss.elastic.co/t/slice-bounds-out-of-range/39049 "2016-01-14T13:47:44Z")
Hi all, I'm running Packetbeat on an Ubuntu system with Postgres 9.2 and keep seeing the following in syslog: Jan 13 15:43:24 cat-prod-pg92 /usr/bin/packetbeat\[26499\]: log.go:113: ParsePgsql exception. Recovering, but… --- ## [Beats input: unhandled exception](https://discuss.elastic.co/t/beats-input-unhandled-exception/39101)
**Author:** [@axil\_76](https://discuss.elastic.co/u/axil_76)\ **Replies:** 13\ **Last updated:** [January 14, 2016, 1:39pm UTC](https://discuss.elastic.co/t/beats-input-unhandled-exception/39101 "2016-01-14T13:39:10Z")
Hello I just migrate to filebeat logstash-forwarder, and I end up with the following error message {:timestamp=\>"2016-01-13T13:46:10.478000+0100", :message=\>"Beats input: unhandled exception", :exception=\>#\ **Author:** [@djvidov](https://discuss.elastic.co/u/djvidov)\ **Replies:** 12\ **Last updated:** [January 14, 2016, 7:53am UTC](https://discuss.elastic.co/t/filebeat-as-service-on-windows-server-2008-r2-not-work-properly/38997 "2016-01-14T07:53:45Z") Hello, I have finished the the implementation of ELK + filebeat, and on my laptop works well. ELK are installed into linux server. And filebeat should monitor files from an windows server 2008. When I run FileBeat 1.0… --- ## [Topbeat: seeing userid of process](https://discuss.elastic.co/t/topbeat-seeing-userid-of-process/39039)
**Author:** [@biswajit86](https://discuss.elastic.co/u/biswajit86)\ **Replies:** 1\ **Last updated:** [January 13, 2016, 10:35pm UTC](https://discuss.elastic.co/t/topbeat-seeing-userid-of-process/39039 "2016-01-13T22:35:24Z")
Is there a way in topbeat to figure out the userid which is running the process. We have a few instances where multiple user ids can run on the same host and we want to see that information in Elastic/Kibana --- ## [IBM Aix supports filebeat?](https://discuss.elastic.co/t/ibm-aix-supports-filebeat/39110)
**Author:** [@shreepad](https://discuss.elastic.co/u/shreepad)\ **Replies:** 3\ **Last updated:** [January 13, 2016, 2:28pm UTC](https://discuss.elastic.co/t/ibm-aix-supports-filebeat/39110 "2016-01-13T14:28:48Z")
Hi All, I am new to ELK and filebeat concepts.I installed Filebeat in AIX 6 box, after configuring filebeat.yml I tried running filebeat,but I ended up with an error saying "Cannot execute binary file" and the bad thin… --- ## [Filebeat Exception Handling](https://discuss.elastic.co/t/filebeat-exception-handling/39088)
**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 1\ **Last updated:** [January 13, 2016, 1:08pm UTC](https://discuss.elastic.co/t/filebeat-exception-handling/39088 "2016-01-13T13:08:44Z")
Hi, What does beats do with exceptions in source files? Does it do nothing? if so, what is the recommended way to handle them in a beats context? By setting the input codec to multi-line in logstash or using multi-line … --- ## [Topbeat: See complete command line options](https://discuss.elastic.co/t/topbeat-see-complete-command-line-options/39038)
**Author:** [@biswajit86](https://discuss.elastic.co/u/biswajit86)\ **Replies:** 1\ **Last updated:** [January 13, 2016, 10:12am UTC](https://discuss.elastic.co/t/topbeat-see-complete-command-line-options/39038 "2016-01-13T10:12:29Z")
Is there a way in topbeat to see the complete list of arguments that are part of the process. For ex , one of our processes is marked as regression\_listener\_fs cadence 3.16.1 Performance 289562235 In the topbeat out… --- ## [Need a clarification regarding filebeat & multiline codec](https://discuss.elastic.co/t/need-a-clarification-regarding-filebeat-multiline-codec/39065)
**Author:** [@vinod8427](https://discuss.elastic.co/u/vinod8427)\ **Replies:** 5\ **Last updated:** [January 13, 2016, 9:48am UTC](https://discuss.elastic.co/t/need-a-clarification-regarding-filebeat-multiline-codec/39065 "2016-01-13T09:48:48Z")
Currently I am running a filebeat instance on one client. The output of filebeat is directed to logstash and a FQDN is entered for logstash hosts. This FQDN can resolve to 3 IP's where 3 instances of logstash are running… --- ## [Filebeat stops sending logs after logrotates](https://discuss.elastic.co/t/filebeat-stops-sending-logs-after-logrotates/38998)
**Author:** [@naga1](https://discuss.elastic.co/u/naga1)\ **Replies:** 3\ **Last updated:** [January 12, 2016, 9:07pm UTC](https://discuss.elastic.co/t/filebeat-stops-sending-logs-after-logrotates/38998 "2016-01-12T21:07:02Z")
Filebeat stops sending logs after app log rotates over night. App lognames are below -- - virtual.access.20160111 - virtual.access.20160112 Below is the Code SnippSet /// filebeat: prospectors: - paths: … --- ## [Multiple files, multiple outputs](https://discuss.elastic.co/t/multiple-files-multiple-outputs/38888)
**Author:** [@R\_T](https://discuss.elastic.co/u/R_T)\ **Replies:** 2\ **Last updated:** [January 12, 2016, 4:46pm UTC](https://discuss.elastic.co/t/multiple-files-multiple-outputs/38888 "2016-01-12T16:46:05Z")
I've an application that produces three files, each with very different multiline configs. Because of the multiline processing I created three different beats inputs in logstash, all on their own port, each handling th… --- ## [Beats to check pings](https://discuss.elastic.co/t/beats-to-check-pings/38875)
**Author:** [@elastic-fan](https://discuss.elastic.co/u/elastic-fan)\ **Replies:** 6\ **Last updated:** [January 12, 2016, 8:41am UTC](https://discuss.elastic.co/t/beats-to-check-pings/38875 "2016-01-12T08:41:40Z")
Hi all, how can i check the reachability of a server through beats for windows, i am a newbie here --- ## [Filebeat and incompatible CentOS](https://discuss.elastic.co/t/filebeat-and-incompatible-centos/38908)
**Author:** [@Munsta0](https://discuss.elastic.co/u/Munsta0)\ **Replies:** 2\ **Last updated:** [January 12, 2016, 7:34am UTC](https://discuss.elastic.co/t/filebeat-and-incompatible-centos/38908 "2016-01-12T07:34:29Z")
Hey All, Our IT department was tasked with finding and implementing a new log parser for our servers and we chose the ELK solution. Everything went smooth until we tried to installing filebeat on the servers. We ar… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=594) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=596)