# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=597 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 598 --- ## [Topbeat 1.0 stops sending events although it is running](https://discuss.elastic.co/t/topbeat-1-0-stops-sending-events-although-it-is-running/36590)
**Author:** [@Omar\_Al\_Zabir](https://discuss.elastic.co/u/Omar_Al_Zabir)\ **Replies:** 28\ **Last updated:** [December 30, 2015, 2:23pm UTC](https://discuss.elastic.co/t/topbeat-1-0-stops-sending-events-although-it-is-running/36590 "2015-12-30T14:23:42Z")
ps aux shows: root 10592 0.3 7.5 411648 305972 ? Sl Nov29 39:17 ./topbeat -v -e -c topbeat.yml So it is running. But the log shows: 2015/12/03 21:35:35.773149 single.go:143: INFO send fail 2015/12/… --- ## [Topbeat / Graylog is just displaying 0 for percentage](https://discuss.elastic.co/t/topbeat-graylog-is-just-displaying-0-for-percentage/38039)
**Author:** [@mbuyukkarakas](https://discuss.elastic.co/u/mbuyukkarakas)\ **Replies:** 5\ **Last updated:** [December 30, 2015, 11:52am UTC](https://discuss.elastic.co/t/topbeat-graylog-is-just-displaying-0-for-percentage/38039 "2015-12-30T11:52:28Z")
Hi everybody I just started to use topbeat on my test Win7 PC. I forwarded logs via Logstash to Graylog. But it's only showing 0 for percentage (\_p) fields. My config is ; Win7 Sp1 Graylog 2.4 Topbeat 1 I wonder a… --- ## [Filebeat harvesters don't restart after stopping due to ignore\_older](https://discuss.elastic.co/t/filebeat-harvesters-dont-restart-after-stopping-due-to-ignore-older/38046)
**Author:** [@pghalliday](https://discuss.elastic.co/u/pghalliday)\ **Replies:** 4\ **Last updated:** [December 28, 2015, 3:17pm UTC](https://discuss.elastic.co/t/filebeat-harvesters-dont-restart-after-stopping-due-to-ignore-older/38046 "2015-12-28T15:17:08Z")
I've been trawling these topics and may have found a couple of issues that sound similar but I can't figure out what the expected behaviour is in the following use case (which seems quite straight forward): I have some… --- ## [Beats to output to Kafka for geographically distributed LS+EC cluster](https://discuss.elastic.co/t/beats-to-output-to-kafka-for-geographically-distributed-ls-ec-cluster/38005)
**Author:** [@Omar\_Al\_Zabir](https://discuss.elastic.co/u/Omar_Al_Zabir)\ **Replies:** 0\ **Last updated:** [December 27, 2015, 12:37pm UTC](https://discuss.elastic.co/t/beats-to-output-to-kafka-for-geographically-distributed-ls-ec-cluster/38005 "2015-12-27T12:37:37Z")
I am trying to setup a geographically distributed EC clusters, where each DC has its own standalone EC cluster. Now I need to get the same messages from all the client system filebeat and topbeat to go to all the DCs so … --- ## [Maybe I missed something: FIlebeat prospectors seems to randomly stop harvesting 'some' files](https://discuss.elastic.co/t/maybe-i-missed-something-filebeat-prospectors-seems-to-randomly-stop-harvesting-some-files/37499)
**Author:** [@Matthew\_Prinvale](https://discuss.elastic.co/u/Matthew_Prinvale)\ **Replies:** 6\ **Last updated:** [December 27, 2015, 8:58am UTC](https://discuss.elastic.co/t/maybe-i-missed-something-filebeat-prospectors-seems-to-randomly-stop-harvesting-some-files/37499 "2015-12-27T08:58:15Z")
This is the 2nd time this has happened now. I have a prospector setup to read /var/log/myapp/\*.log and it brings up about 5 or 6 harvesters as intended. Things run smooth for a while but what seems to be randomly it just… --- ## [How to make Filebeat send events to multiple logstash in roundrobin](https://discuss.elastic.co/t/how-to-make-filebeat-send-events-to-multiple-logstash-in-roundrobin/37780)
**Author:** [@Omar\_Al\_Zabir](https://discuss.elastic.co/u/Omar_Al_Zabir)\ **Replies:** 2\ **Last updated:** [December 24, 2015, 11:47am UTC](https://discuss.elastic.co/t/how-to-make-filebeat-send-events-to-multiple-logstash-in-roundrobin/37780 "2015-12-24T11:47:24Z")
I have a server which produces 1500 req/sec. Filebeat is processing the logs and sending to a logstash. However, it sends all the events to one logstash. How do I get it to send to multiple logstash servers in order to d… --- ## [Packetbeat data not going from ES to Kibana](https://discuss.elastic.co/t/packetbeat-data-not-going-from-es-to-kibana/28757)
**Author:** [@syn\_](https://discuss.elastic.co/u/syn_)\ **Replies:** 7\ **Last updated:** [December 24, 2015, 8:52am UTC](https://discuss.elastic.co/t/packetbeat-data-not-going-from-es-to-kibana/28757 "2015-12-24T08:52:52Z")
Hi guys, Not sure if this is the best category, as it may be either an ElasticSearch or Kibana issue, but since I followed the guide found here: https://www.elastic.co/guide/en/beats/packetbeat/current/packetbeat-gettin… --- ## [How to configurate filebeats for muliline log file](https://discuss.elastic.co/t/how-to-configurate-filebeats-for-muliline-log-file/37679)
**Author:** [@swelltt0576](https://discuss.elastic.co/u/swelltt0576)\ **Replies:** 2\ **Last updated:** [December 24, 2015, 5:54am UTC](https://discuss.elastic.co/t/how-to-configurate-filebeats-for-muliline-log-file/37679 "2015-12-24T05:54:38Z")
hi, i have a file just like this: 2015-12-21 17:44:31,922 ERROR c.e.u.e.e.E2BService. \[pool-2-thread-519\] Connect to localhost:80 \[localhost/127.0.0.1\] failed: Connection refused org.apache.http.conn.HttpHostConnectE… --- ## [Multiple Index in Filebeat.yml configuration file](https://discuss.elastic.co/t/multiple-index-in-filebeat-yml-configuration-file/37908)
**Author:** [@aniamin](https://discuss.elastic.co/u/aniamin)\ **Replies:** 1\ **Last updated:** [December 24, 2015, 5:45am UTC](https://discuss.elastic.co/t/multiple-index-in-filebeat-yml-configuration-file/37908 "2015-12-24T05:45:47Z")
Hi, I am using filebeat to ship log into logstash server. I want to send logs from different harvester into different index. Example: I want to send application log in application index and syslog in syslog index. From… --- ## [Process auditd log to elasticsearch by using Filebeat](https://discuss.elastic.co/t/process-auditd-log-to-elasticsearch-by-using-filebeat/37773)
**Author:** [@rpuserh](https://discuss.elastic.co/u/rpuserh)\ **Replies:** 1\ **Last updated:** [December 23, 2015, 4:37pm UTC](https://discuss.elastic.co/t/process-auditd-log-to-elasticsearch-by-using-filebeat/37773 "2015-12-23T16:37:06Z")
Hi, We are using auditd to monitor all user actions on all machines (Now we are using rsyslog auditd and syslog-ng). I would like to switch to Filebeat, elasticsearch and kibana. But auditd has output for 3 lines for on… --- ## [Topbeat very high CPU on a HAProxy server](https://discuss.elastic.co/t/topbeat-very-high-cpu-on-a-haproxy-server/37788)
**Author:** [@Omar\_Al\_Zabir](https://discuss.elastic.co/u/Omar_Al_Zabir)\ **Replies:** 5\ **Last updated:** [December 23, 2015, 4:31pm UTC](https://discuss.elastic.co/t/topbeat-very-high-cpu-on-a-haproxy-server/37788 "2015-12-23T16:31:04Z")
top command shows topbeat consuming very high CPU on a HAproxy server that is getting around 400 req/sec. PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 13770 root 15 0 761m 378m 5904 R 6… --- ## [Filebeat and availability](https://discuss.elastic.co/t/filebeat-and-availability/37787)
**Author:** [@mguiwin](https://discuss.elastic.co/u/mguiwin)\ **Replies:** 2\ **Last updated:** [December 23, 2015, 4:20pm UTC](https://discuss.elastic.co/t/filebeat-and-availability/37787 "2015-12-23T16:20:14Z")
Hello, The reasons to use a broker like Redis in the ELK log pipeline are (please correct me if I'm wrong): 1. Offload the shipper's (Filebeat or Logstash) internal queue quickly 2. Prevent the Elasticserch from being … --- ## [Filebeat: Reading Prospector Config from Directory](https://discuss.elastic.co/t/filebeat-reading-prospector-config-from-directory/37752)
**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 3\ **Last updated:** [December 23, 2015, 3:50pm UTC](https://discuss.elastic.co/t/filebeat-reading-prospector-config-from-directory/37752 "2015-12-23T15:50:49Z")
Hi, I have been reading some test logs successfully with filebeat. However, when I move the prospector config out into an external directory it fails. Fielbeat sees the directory and the file: 2015-12-22T11:48:11Z INFO… --- ## [Not finding my log file](https://discuss.elastic.co/t/not-finding-my-log-file/37726)
**Author:** [@OliverBock](https://discuss.elastic.co/u/OliverBock)\ **Replies:** 2\ **Last updated:** [December 23, 2015, 12:37am UTC](https://discuss.elastic.co/t/not-finding-my-log-file/37726 "2015-12-23T00:37:24Z")
There is some newbie thing I have missed here. I have configured filebeat 1.0.1 on the latest ubuntu 14.04, installed via the elastic.co repository. Stripped of comments and blank lines, my filebeat.yml file looks like… --- ## [How to compile beats](https://discuss.elastic.co/t/how-to-compile-beats/37805)
**Author:** [@Cory\_Marsh](https://discuss.elastic.co/u/Cory_Marsh)\ **Replies:** 1\ **Last updated:** [December 22, 2015, 11:55pm UTC](https://discuss.elastic.co/t/how-to-compile-beats/37805 "2015-12-22T23:55:31Z")
TL;DR: Is there a doc or wiki page on how to compile? I'm sure it's something simple and obvious, but I don't even know what to try or what to read at this point So I have been struggling trying to get libbeat to comp… --- ## [@timestamp error](https://discuss.elastic.co/t/timestamp-error/37369)
**Author:** [@Alleycat](https://discuss.elastic.co/u/Alleycat)\ **Replies:** 2\ **Last updated:** [December 22, 2015, 3:37pm UTC](https://discuss.elastic.co/t/timestamp-error/37369 "2015-12-22T15:37:34Z")
I have filebeat sending Apache logs to logstash which is located on another server. Logstash shows the following error: {:timestamp=\>"2015-12-16T15:32:05.053000+0000", :message=\>"Beats input: unhandled exception", :e… --- ## [Filebeat Fields](https://discuss.elastic.co/t/filebeat-fields/37751)
**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 1\ **Last updated:** [December 22, 2015, 12:17pm UTC](https://discuss.elastic.co/t/filebeat-fields/37751 "2015-12-22T12:17:57Z")
Hi, Can I ask, what is the difference between filebeat.name and filebeat.hostname? They have the same value for each host I collect from. Regards, David --- ## [Filebeat is reading my logs, but logs with date time on name, stop incremet](https://discuss.elastic.co/t/filebeat-is-reading-my-logs-but-logs-with-date-time-on-name-stop-incremet/37589)
**Author:** [@adsqueiroz](https://discuss.elastic.co/u/adsqueiroz)\ **Replies:** 6\ **Last updated:** [December 22, 2015, 12:16pm UTC](https://discuss.elastic.co/t/filebeat-is-reading-my-logs-but-logs-with-date-time-on-name-stop-incremet/37589 "2015-12-22T12:16:18Z")
Hello folks! I'm new on FileBeat, Logstash and Elastiscsearch. I'm trying to implement in my work, but I'm having problem with FileBeat. When I start the service from FileBeat, my logs with date time on name, stop in… --- ## [Multi line logs](https://discuss.elastic.co/t/multi-line-logs/37700)
**Author:** [@Raboo](https://discuss.elastic.co/u/Raboo)\ **Replies:** 2\ **Last updated:** [December 21, 2015, 9:40pm UTC](https://discuss.elastic.co/t/multi-line-logs/37700 "2015-12-21T21:40:28Z")
Hi, I'm currently using fluentd/td-agent to ship logs to elasticsearch and use kibana for visualization. In fluentd you can specify when tailing logs which is the first line of a multi-line log(for instance java errors… --- ## [Has anyone tried to compile beats for Raspberry Pi (ARM) yet?](https://discuss.elastic.co/t/has-anyone-tried-to-compile-beats-for-raspberry-pi-arm-yet/37716)
**Author:** [@kai5263499](https://discuss.elastic.co/u/kai5263499)\ **Replies:** 2\ **Last updated:** [December 21, 2015, 8:00pm UTC](https://discuss.elastic.co/t/has-anyone-tried-to-compile-beats-for-raspberry-pi-arm-yet/37716 "2015-12-21T20:00:01Z")
When I tried to build beats from source I get the following: make -C libbeat testsuite || exit 1; make -C packetbeat testsuite || exit 1; make -C topbeat testsuite || exit 1; make -C filebeat testsuite || exit 1; make … --- ## [Proc\_pid requested](https://discuss.elastic.co/t/proc-pid-requested/37580)
**Author:** [@hamelg](https://discuss.elastic.co/u/hamelg)\ **Replies:** 2\ **Last updated:** [December 18, 2015, 5:10pm UTC](https://discuss.elastic.co/t/proc-pid-requested/37580 "2015-12-18T17:10:18Z")
In the environmental packetbeat fields, we have the proc field. proc \>\> the name of the process that served the transaction. It would be very useful to add the pid. We collect http protocol and we have hundreds apache… --- ## [New protocol support: SAP HANA](https://discuss.elastic.co/t/new-protocol-support-sap-hana/37524)
**Author:** [@MingchunZhao](https://discuss.elastic.co/u/MingchunZhao)\ **Replies:** 1\ **Last updated:** [December 18, 2015, 3:43pm UTC](https://discuss.elastic.co/t/new-protocol-support-sap-hana/37524 "2015-12-18T15:43:07Z")
Hi, is there any plan to support SAP HANA in future? Best regards --- ## [How Do I create a dashboard with hostnames like Nagios or Zabbix](https://discuss.elastic.co/t/how-do-i-create-a-dashboard-with-hostnames-like-nagios-or-zabbix/37320)
**Author:** [@Priyavart\_Kaushik](https://discuss.elastic.co/u/Priyavart_Kaushik)\ **Replies:** 5\ **Last updated:** [December 18, 2015, 8:42am UTC](https://discuss.elastic.co/t/how-do-i-create-a-dashboard-with-hostnames-like-nagios-or-zabbix/37320 "2015-12-18T08:42:11Z")
Hi. I am working with topbeat and the out of the box dashboard do not generate a infrastructure view consolidated by hostname like in another monitoring tool. For example if you can help me to create dashboard for C… --- ## [Adding a New Protocol under Windows](https://discuss.elastic.co/t/adding-a-new-protocol-under-windows/37247)
**Author:** [@knobli](https://discuss.elastic.co/u/knobli)\ **Replies:** 7\ **Last updated:** [December 17, 2015, 9:29pm UTC](https://discuss.elastic.co/t/adding-a-new-protocol-under-windows/37247 "2015-12-17T21:29:42Z")
I'm trying to add a new protocol to packetbeat under Windows. I noticed that the "Developer Guide: Adding a New Protocol" is not up to date. I read that the git repository and the dependency management changed. I don't… --- ## ['ignore\_outgoing' doesn't work for me](https://discuss.elastic.co/t/ignore-outgoing-doesnt-work-for-me/37201)
**Author:** [@desert\_rose](https://discuss.elastic.co/u/desert_rose)\ **Replies:** 3\ **Last updated:** [December 17, 2015, 7:57pm UTC](https://discuss.elastic.co/t/ignore-outgoing-doesnt-work-for-me/37201 "2015-12-17T19:57:26Z")
I've uncommented "#ignore\_outgoing: true" line in packetbeat.yml and restarted packetbeat, but I can still see new transactions created by the server where packetbeat installed. Here are some fields of a transaction: … --- ## [Does putting more config files into config\_dir require restart?](https://discuss.elastic.co/t/does-putting-more-config-files-into-config-dir-require-restart/37394)
**Author:** [@Thomas\_Larsson\_Kron](https://discuss.elastic.co/u/Thomas_Larsson_Kron)\ **Replies:** 2\ **Last updated:** [December 16, 2015, 8:25pm UTC](https://discuss.elastic.co/t/does-putting-more-config-files-into-config-dir-require-restart/37394 "2015-12-16T20:25:25Z")
Hi, If I place more configuration files in the config\_dir while filebeat is running, does it require a restart to pick up the new config? If so, is there any plan to change this? As far as I remember, the logstash ag… --- ## [Prospectors from config\_dir don't produce any harvesters](https://discuss.elastic.co/t/prospectors-from-config-dir-dont-produce-any-harvesters/37393)
**Author:** [@Thomas\_Larsson\_Kron](https://discuss.elastic.co/u/Thomas_Larsson_Kron)\ **Replies:** 2\ **Last updated:** [December 16, 2015, 7:33pm UTC](https://discuss.elastic.co/t/prospectors-from-config-dir-dont-produce-any-harvesters/37393 "2015-12-16T19:33:26Z")
Hello, I just started with filebeat and I encountered a problem. I want to feed my filebeat service with multiple config files and so I created a directory /etc/filebeat.d and copied the /etc/filebeat/filebeat.yml to /… --- ## [About resending of packets or out of order packets](https://discuss.elastic.co/t/about-resending-of-packets-or-out-of-order-packets/32630)
**Author:** [@MingchunZhao](https://discuss.elastic.co/u/MingchunZhao)\ **Replies:** 4\ **Last updated:** [December 16, 2015, 4:25pm UTC](https://discuss.elastic.co/t/about-resending-of-packets-or-out-of-order-packets/32630 "2015-12-16T16:25:11Z")
Is Packetbeat able to deal with that resending of packets or out of order packets? --- ## [Af\_packet error on RHEL](https://discuss.elastic.co/t/af-packet-error-on-rhel/37314)
**Author:** [@Marcbilger](https://discuss.elastic.co/u/Marcbilger)\ **Replies:** 2\ **Last updated:** [December 16, 2015, 9:56am UTC](https://discuss.elastic.co/t/af-packet-error-on-rhel/37314 "2015-12-16T09:56:14Z")
Hi, First, I'd like to thank you for the great job you're providing ! Here is my use case : I want to get DNS data into ELK (huge amount of packets/ sec). Packetbeat is installed on a dedicated server. I installed P… --- ## [Filebeat ca cert problem](https://discuss.elastic.co/t/filebeat-ca-cert-problem/37252)
**Author:** [@AlRad](https://discuss.elastic.co/u/AlRad)\ **Replies:** 4\ **Last updated:** [December 15, 2015, 9:00pm UTC](https://discuss.elastic.co/t/filebeat-ca-cert-problem/37252 "2015-12-15T21:00:16Z")
I'm attempting to basically get encrypted comms going between Filebeat hosts and the Logstash server (encryption only, no client authentication). Filebeat, however, is not accepting the CA certificate. Here is my fileb… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=596) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=598)