# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=596 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 597 --- ## [Compiling Filebeat difficulties (Resolved)](https://discuss.elastic.co/t/compiling-filebeat-difficulties-resolved/38684)
**Author:** [@arahael](https://discuss.elastic.co/u/arahael)\ **Replies:** 6\ **Last updated:** [January 12, 2016, 12:31am UTC](https://discuss.elastic.co/t/compiling-filebeat-difficulties-resolved/38684 "2016-01-12T00:31:35Z")
I need to have multiline support, which seems to be implemented in master and backported to the 1.1 branch, however is not yet released. I was hoping to be able to compile this on mac os x, but I can't seem to find any… --- ## [Order of file generation and file reading](https://discuss.elastic.co/t/order-of-file-generation-and-file-reading/38914)
**Author:** [@sharon.c](https://discuss.elastic.co/u/sharon.c)\ **Replies:** 1\ **Last updated:** [January 11, 2016, 9:07pm UTC](https://discuss.elastic.co/t/order-of-file-generation-and-file-reading/38914 "2016-01-11T21:07:01Z")
I used filebeat logstash and elasticsearch together to port data from files to elasticsearch, I have a process to generate files in a folder, and filebeat reads them and sends data to logstash then to elasticsearch. The … --- ## [Topbeat how to get no of opened file and no of threads](https://discuss.elastic.co/t/topbeat-how-to-get-no-of-opened-file-and-no-of-threads/38883)
**Author:** [@Navneet\_Mathpal](https://discuss.elastic.co/u/Navneet_Mathpal)\ **Replies:** 1\ **Last updated:** [January 11, 2016, 2:48pm UTC](https://discuss.elastic.co/t/topbeat-how-to-get-no-of-opened-file-and-no-of-threads/38883 "2016-01-11T14:48:48Z")
Hi, How to get no of threads and no of opened file using topbeats ? Thanks --- ## [Starting packetbeat: 2016/01/08 12:13:43.009060 packetbeat.go:195: CRIT Initializing sniffer failed: Error creating sniffer: Pfring sniffing is not compiled in](https://discuss.elastic.co/t/starting-packetbeat-2016-01-08-12-13-43-009060-packetbeat-go-195-crit-initializing-sniffer-failed-error-creating-sniffer-pfring-sniffing-is-not-compiled-in/38721)
**Author:** [@slourenco](https://discuss.elastic.co/u/slourenco)\ **Replies:** 4\ **Last updated:** [January 11, 2016, 2:06pm UTC](https://discuss.elastic.co/t/starting-packetbeat-2016-01-08-12-13-43-009060-packetbeat-go-195-crit-initializing-sniffer-failed-error-creating-sniffer-pfring-sniffing-is-not-compiled-in/38721 "2016-01-11T14:06:48Z")
I've installed the RPM version of packetbeat 1.0.1 (latest) and no pf\_ring module is compiled. Do you have a RPM version of it? Do I need to compile the project? If only compiled version is available do I need extra conf… --- ## [Filebeat Firewall requirements](https://discuss.elastic.co/t/filebeat-firewall-requirements/38399)
**Author:** [@bibikmik](https://discuss.elastic.co/u/bibikmik)\ **Replies:** 6\ **Last updated:** [January 11, 2016, 12:45pm UTC](https://discuss.elastic.co/t/filebeat-firewall-requirements/38399 "2016-01-11T12:45:29Z")
Hi, community. I have: - 1 host with application which writes logs in the file and filebeat reads it and send to logstash - logstash cluster of 3 nodes Firewall rules are opened only as follows: filebeat (port numbe… --- ## [Mysql data no longer getting into ES](https://discuss.elastic.co/t/mysql-data-no-longer-getting-into-es/38635)
**Author:** [@Guillaume\_Vachon](https://discuss.elastic.co/u/Guillaume_Vachon)\ **Replies:** 5\ **Last updated:** [January 11, 2016, 11:39am UTC](https://discuss.elastic.co/t/mysql-data-no-longer-getting-into-es/38635 "2016-01-11T11:39:34Z")
Hi all, I have been running packetbeat to collect mysql data since the early beta and it always worked perfectly. I upgraded through every release and now im running 1.0.1. Sending the mysql data stopped working a … --- ## [How to forward index from filebeat to elasticsearch via logstash](https://discuss.elastic.co/t/how-to-forward-index-from-filebeat-to-elasticsearch-via-logstash/38722)
**Author:** [@djvidov](https://discuss.elastic.co/u/djvidov)\ **Replies:** 2\ **Last updated:** [January 11, 2016, 8:26am UTC](https://discuss.elastic.co/t/how-to-forward-index-from-filebeat-to-elasticsearch-via-logstash/38722 "2016-01-11T08:26:18Z")
Hello, I have this script for filebeat which sends all logs to logstash: filebeat: prospectors: paths: - D:\\Logs\\\* input\_type: log registry\_file: "D:/ElasticSearch/filebeat-1.0.0-windows/regist… --- ## [Idea Filemeta beat](https://discuss.elastic.co/t/idea-filemeta-beat/38714)
**Author:** [@bering](https://discuss.elastic.co/u/bering)\ **Replies:** 2\ **Last updated:** [January 8, 2016, 11:52am UTC](https://discuss.elastic.co/t/idea-filemeta-beat/38714 "2016-01-08T11:52:16Z")
I was thinking about creating a new beat that can collect metadata information from files. Especially the MD5 checksum and security/acl information about who has access the the file, also creation date, last modify date,… --- ## [Filebeat send a json log but is stored as a string](https://discuss.elastic.co/t/filebeat-send-a-json-log-but-is-stored-as-a-string/38410)
**Author:** [@djvidov](https://discuss.elastic.co/u/djvidov)\ **Replies:** 16\ **Last updated:** [January 8, 2016, 10:17am UTC](https://discuss.elastic.co/t/filebeat-send-a-json-log-but-is-stored-as-a-string/38410 "2016-01-08T10:17:24Z")
Hello, I have logs from a file, like that: {"LogLevel":"INFO","StartTime":"15:01:30.625528","ExecutionTime":1,"CallingMethod":"GetHistoryComments"} {"LogLevel":"INFO","StartTime":"15:01:25.5745528","ExecutionTime":0,"… --- ## [CRIT No outputs are defined](https://discuss.elastic.co/t/crit-no-outputs-are-defined/38561)
**Author:** [@sharon.c](https://discuss.elastic.co/u/sharon.c)\ **Replies:** 2\ **Last updated:** [January 7, 2016, 6:51pm UTC](https://discuss.elastic.co/t/crit-no-outputs-are-defined/38561 "2016-01-07T18:51:16Z")
I am new with logstash, I am using logstash 1.5.4, and I am using filebeats to read files and foward to logstash pipeline I already installed filebeat input plugin, and started filebeat using systemctl. and I started th… --- ## [Packetbeat memory issue?](https://discuss.elastic.co/t/packetbeat-memory-issue/37318)
**Author:** [@Marcbilger](https://discuss.elastic.co/u/Marcbilger)\ **Replies:** 4\ **Last updated:** [January 7, 2016, 12:56pm UTC](https://discuss.elastic.co/t/packetbeat-memory-issue/37318 "2016-01-07T12:56:26Z")
Hi again :smile: Use case : DNS traffic sent to logstash and then Easticsearch / kibana. Packetbeat is installed as a service on a dedicated server. I am using tcpreplay to send 1 gig of DNS trafic (for testing purpos… --- ## [Unable to process multiple logs](https://discuss.elastic.co/t/unable-to-process-multiple-logs/38577)
**Author:** [@hw96](https://discuss.elastic.co/u/hw96)\ **Replies:** 6\ **Last updated:** [January 7, 2016, 10:31am UTC](https://discuss.elastic.co/t/unable-to-process-multiple-logs/38577 "2016-01-07T10:31:43Z")
Hi, I'm relatively new to Filebeat in general and I'm currently facing the problem of being unable to process multiple logs under a single "paths" segment. In my case, only the first log is processed whereas the rest are… --- ## [Creating certificates for filebeat](https://discuss.elastic.co/t/creating-certificates-for-filebeat/38585)
**Author:** [@ironbeast](https://discuss.elastic.co/u/ironbeast)\ **Replies:** 4\ **Last updated:** [January 7, 2016, 10:20am UTC](https://discuss.elastic.co/t/creating-certificates-for-filebeat/38585 "2016-01-07T10:20:01Z")
Dear all, For logstashforwarder I had to create certificates containing the hostnames of the logstash servers. Do I have to do this the same for filebeat? Or can I now once again create wildcards ssl-certs without the… --- ## [Specify a TTL for connection from Filebeat to Logstash](https://discuss.elastic.co/t/specify-a-ttl-for-connection-from-filebeat-to-logstash/38538)
**Author:** [@Jeremy\_White](https://discuss.elastic.co/u/Jeremy_White)\ **Replies:** 2\ **Last updated:** [January 7, 2016, 9:31am UTC](https://discuss.elastic.co/t/specify-a-ttl-for-connection-from-filebeat-to-logstash/38538 "2016-01-07T09:31:30Z")
I am using Filebeat to forward logs to a Logstash load balancer (Amazon ELB) and would like to specify a time to live (TTL) for the connection to Logstash. The ELB works great, except when I apply changes to the instan… --- ## [How to find connection between filebeat and logstash](https://discuss.elastic.co/t/how-to-find-connection-between-filebeat-and-logstash/38581)
**Author:** [@usahitya](https://discuss.elastic.co/u/usahitya)\ **Replies:** 1\ **Last updated:** [January 7, 2016, 9:08am UTC](https://discuss.elastic.co/t/how-to-find-connection-between-filebeat-and-logstash/38581 "2016-01-07T09:08:32Z")
Hi Friends, I installed Kibana, elasticsearch, logstash on one server and installed filebeat on other server. there is no error while installing logstash or filebeat or kibana, elasticsearch, But there is no data is co… --- ## [Filebeat large files](https://discuss.elastic.co/t/filebeat-large-files/38573)
**Author:** [@Raggyman](https://discuss.elastic.co/u/Raggyman)\ **Replies:** 4\ **Last updated:** [January 7, 2016, 8:43am UTC](https://discuss.elastic.co/t/filebeat-large-files/38573 "2016-01-07T08:43:37Z")
Using Filebeats 1.0.0 but have tested using the nightly release of 1.2 but doesn't seem to have fixed the issue. Have a bit of an issue when a file gets over 2Gb where the log file no longer seems to be processed. The… --- ## [Certificate Error in File Beat connecting to Logstash](https://discuss.elastic.co/t/certificate-error-in-file-beat-connecting-to-logstash/38503)
**Author:** [@RickH](https://discuss.elastic.co/u/RickH)\ **Replies:** 3\ **Last updated:** [January 7, 2016, 7:50am UTC](https://discuss.elastic.co/t/certificate-error-in-file-beat-connecting-to-logstash/38503 "2016-01-07T07:50:17Z")
We are running a proof of concept on our network to establish whether we can configure filebeat (installed on Windows 2012) to connect to Logstash (on RHEL). unfortunately we are getting a certificate error when we attem… --- ## [New to elastic having issue with file beat](https://discuss.elastic.co/t/new-to-elastic-having-issue-with-file-beat/38560)
**Author:** [@Ronald\_Hill](https://discuss.elastic.co/u/Ronald_Hill)\ **Replies:** 9\ **Last updated:** [January 7, 2016, 1:27am UTC](https://discuss.elastic.co/t/new-to-elastic-having-issue-with-file-beat/38560 "2016-01-07T01:27:56Z")
Restarting Sends log files to Logstash or directly to Elasticsearch. filebeat 2016/01/07 00:17:05.443037 outputs.go:105: ERR failed to initialize elasticsearch plugin as output: no host configuration foun… --- ## [My packetbeat events don't show up in Kibaba](https://discuss.elastic.co/t/my-packetbeat-events-dont-show-up-in-kibaba/38286)
**Author:** [@Augustin\_Chen](https://discuss.elastic.co/u/Augustin_Chen)\ **Replies:** 8\ **Last updated:** [January 6, 2016, 7:18am UTC](https://discuss.elastic.co/t/my-packetbeat-events-dont-show-up-in-kibaba/38286 "2016-01-06T07:18:27Z")
Hi, I once use the follwing ELK + packetbeat stack before, the packetbeat events showed up in Kibana as expected. packet:1.0.0-beta2 elasticsearch: 1.4.4 logstash: 1.4.2 redis: 3.0.1 Kibana:4.1.1 Now I upgrade the… --- ## [Filebeat Implementation Details](https://discuss.elastic.co/t/filebeat-implementation-details/38416)
**Author:** [@NikolaeVarius](https://discuss.elastic.co/u/NikolaeVarius)\ **Replies:** 5\ **Last updated:** [January 5, 2016, 8:18pm UTC](https://discuss.elastic.co/t/filebeat-implementation-details/38416 "2016-01-05T20:18:16Z")
Hi, I'm using filebeat for tons of servers in my Production environment and have some questions. Does Filebeat compress logs while they're being streamed? We're trying to limit bandwidth usage between our servers and a… --- ## [Input period](https://discuss.elastic.co/t/input-period/38427)
**Author:** [@mryanb](https://discuss.elastic.co/u/mryanb)\ **Replies:** 1\ **Last updated:** [January 5, 2016, 8:06pm UTC](https://discuss.elastic.co/t/input-period/38427 "2016-01-05T20:06:56Z")
With a input period of 10. Should I assume that outputs match that frequency? --- ## [Can i use filebeat to filter tomcate log?](https://discuss.elastic.co/t/can-i-use-filebeat-to-filter-tomcate-log/38381)
**Author:** [@Mohamed\_Ibrahim](https://discuss.elastic.co/u/Mohamed_Ibrahim)\ **Replies:** 1\ **Last updated:** [January 5, 2016, 8:09am UTC](https://discuss.elastic.co/t/can-i-use-filebeat-to-filter-tomcate-log/38381 "2016-01-05T08:09:50Z")
i installed Logstash and elasticsearch from the below tutorial https://www.digitalocean.com/community/tutorials/how-to-install-elasticsearch-logstash-and-kibana-elk-stack-on-centos-71 and tomcat logs successfully appea… --- ## [Skip first few lines in file](https://discuss.elastic.co/t/skip-first-few-lines-in-file/38198)
**Author:** [@tweetybird](https://discuss.elastic.co/u/tweetybird)\ **Replies:** 10\ **Last updated:** [January 4, 2016, 3:38pm UTC](https://discuss.elastic.co/t/skip-first-few-lines-in-file/38198 "2016-01-04T15:38:34Z")
Is it possible to to skip (ie. not send them to logstash) lines in a log file? The log I'm working with has 4 lines at the top which I would like to ignore and not send to logstash. Is this possible? --- ## [Negate/Ignore certain files](https://discuss.elastic.co/t/negate-ignore-certain-files/38317)
**Author:** [@lwhitworth](https://discuss.elastic.co/u/lwhitworth)\ **Replies:** 3\ **Last updated:** [January 4, 2016, 2:24pm UTC](https://discuss.elastic.co/t/negate-ignore-certain-files/38317 "2016-01-04T14:24:17Z")
Hi all, I have a number of files in a folder called something similar to: file1-auth-detail-20160101.gz file1-auth-detail-20160102.gz file1-auth-detail-20160103 file1-auth-detail-20160104 I want to ingest the fil… --- ## [Beats Field Data](https://discuss.elastic.co/t/beats-field-data/38179)
**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 8\ **Last updated:** [January 4, 2016, 11:15am UTC](https://discuss.elastic.co/t/beats-field-data/38179 "2016-01-04T11:15:22Z")
Hi, In the "fields" defintions of filebeat.yml is nesting permitted as follows: fields: field\_type: sub\_type1: value sub\_type2: value ...which I would then reference in logstash as \[fields\]\[field\_type\]\[sub\_… --- ## [Tomcat log not detected after chnge the PATH on filebeat.yml](https://discuss.elastic.co/t/tomcat-log-not-detected-after-chnge-the-path-on-filebeat-yml/38267)
**Author:** [@Mohamed\_Ibrahim](https://discuss.elastic.co/u/Mohamed_Ibrahim)\ **Replies:** 10\ **Last updated:** [January 4, 2016, 9:27am UTC](https://discuss.elastic.co/t/tomcat-log-not-detected-after-chnge-the-path-on-filebeat-yml/38267 "2016-01-04T09:27:10Z")
my configuration like the below filebeat: prospectors: - paths: - /home/mohamed/localhost\_access\_log.2015-12-20.txt input\_type: syslog registry\_file: /var/lib/filebeat/registry output: ela… --- ## [Error while restarting filebeat?](https://discuss.elastic.co/t/error-while-restarting-filebeat/38247)
**Author:** [@kartheek91](https://discuss.elastic.co/u/kartheek91)\ **Replies:** 1\ **Last updated:** [January 4, 2016, 7:48am UTC](https://discuss.elastic.co/t/error-while-restarting-filebeat/38247 "2016-01-04T07:48:56Z")
Please find the error and help me in order to recover from it. Restarting Sends log files to Logstash or directly to Elasticsearch. filebeat 2016/01/01 15… --- ## [After starting filebeat, prospectors initially pushes some logs and then stops](https://discuss.elastic.co/t/after-starting-filebeat-prospectors-initially-pushes-some-logs-and-then-stops/36420)
**Author:** [@Matthew\_Prinvale](https://discuss.elastic.co/u/Matthew_Prinvale)\ **Replies:** 3\ **Last updated:** [January 3, 2016, 5:30pm UTC](https://discuss.elastic.co/t/after-starting-filebeat-prospectors-initially-pushes-some-logs-and-then-stops/36420 "2016-01-03T17:30:08Z")
Edit: I must have missed a part where you had to remove the elasticsearch portion from the config.yml. In previous versions removing it broke it. Hopefully I explain this correct: Running filebeat with two prospectors… --- ## [Remove password but keep username in http authorization header](https://discuss.elastic.co/t/remove-password-but-keep-username-in-http-authorization-header/37415)
**Author:** [@nradonicich](https://discuss.elastic.co/u/nradonicich)\ **Replies:** 4\ **Last updated:** [January 2, 2016, 10:26pm UTC](https://discuss.elastic.co/t/remove-password-but-keep-username-in-http-authorization-header/37415 "2016-01-02T22:26:30Z")
Is it possible to strip out the password from the authorization header but retain the username somehow? I use basic auth for some web apps and want to keep the username of who is accessing but strip out the password from… --- ## [Filebeat doesn't seem to be doing anything (new to this software) #321 #322](https://discuss.elastic.co/t/filebeat-doesnt-seem-to-be-doing-anything-new-to-this-software-321-322/38184)
**Author:** [@PeterV19823](https://discuss.elastic.co/u/PeterV19823)\ **Replies:** 2\ **Last updated:** [January 2, 2016, 10:40am UTC](https://discuss.elastic.co/t/filebeat-doesnt-seem-to-be-doing-anything-new-to-this-software-321-322/38184 "2016-01-02T10:40:32Z")
 PeterV1982 commented 5 minutes ago Follow up somhow i don't know why my code missed something instead off •c://programdata//elasticsearch//logs// the actual code says •c://programdata//elasticsearch//log… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=595) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=597)