# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=598 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 599 --- ## [Filebeat only sends logs on restart](https://discuss.elastic.co/t/filebeat-only-sends-logs-on-restart/37184)
**Author:** [@Sedward](https://discuss.elastic.co/u/Sedward)\ **Replies:** 1\ **Last updated:** [December 15, 2015, 12:58am UTC](https://discuss.elastic.co/t/filebeat-only-sends-logs-on-restart/37184 "2015-12-15T00:58:10Z")
I've just got started using Filebeat with logstash and amazon's elasticsearch + kibana setup. Whenever I start/restart filebeat, all new logs are sent through and show up in my es server. However when new new logs come i… --- ## [Filebeat is reading my logs but they stop to write on their files](https://discuss.elastic.co/t/filebeat-is-reading-my-logs-but-they-stop-to-write-on-their-files/37132)
**Author:** [@adsqueiroz](https://discuss.elastic.co/u/adsqueiroz)\ **Replies:** 2\ **Last updated:** [December 14, 2015, 3:43pm UTC](https://discuss.elastic.co/t/filebeat-is-reading-my-logs-but-they-stop-to-write-on-their-files/37132 "2015-12-14T15:43:55Z")
Hi folks! I'm new on FileBeat, Logstash and Elastiscsearch. I'm trying to implement in my work, but I'm having problem with FileBeat. When I start the service from FileBeat, my logs are sent to Logstash, but the file… --- ## [Is ignore\_older config option similar to dead\_timeout option in logstash forwarder](https://discuss.elastic.co/t/is-ignore-older-config-option-similar-to-dead-timeout-option-in-logstash-forwarder/37009)
**Author:** [@vgupta](https://discuss.elastic.co/u/vgupta)\ **Replies:** 2\ **Last updated:** [December 14, 2015, 1:47pm UTC](https://discuss.elastic.co/t/is-ignore-older-config-option-similar-to-dead-timeout-option-in-logstash-forwarder/37009 "2015-12-14T13:47:11Z")
Hi I want to tail all the files in a dir, which can have upwards of 5000 files added per hour. I want to close the FD for the files that are not update in last 1/2 hour but there may be a case where older file can ge… --- ## [How to install Filebeat?](https://discuss.elastic.co/t/how-to-install-filebeat/37094)
**Author:** [@kartheek91](https://discuss.elastic.co/u/kartheek91)\ **Replies:** 8\ **Last updated:** [December 14, 2015, 8:28am UTC](https://discuss.elastic.co/t/how-to-install-filebeat/37094 "2015-12-14T08:28:17Z")
We have two gcloud instances and we need to collect logs of those two instances using filebeat and we have another instance to store the logs and to analyze by kibana ,elasticsearch and logstash.My question can you tell… --- ## [Problem to start filebeat](https://discuss.elastic.co/t/problem-to-start-filebeat/37053)
**Author:** [@Sangheon](https://discuss.elastic.co/u/Sangheon)\ **Replies:** 3\ **Last updated:** [December 14, 2015, 6:33am UTC](https://discuss.elastic.co/t/problem-to-start-filebeat/37053 "2015-12-14T06:33:10Z")
Hello II set a ELK Server(172.16.223.19) and I installed a filebeat (172.16.28.153) using the shipper for apache logs. When i run a filebeat, normally transfer a access log for a few seconds, then I got an error mess… --- ## [\[SOLVED\] Build packetbeat on windows](https://discuss.elastic.co/t/solved-build-packetbeat-on-windows/35161)
**Author:** [@bering](https://discuss.elastic.co/u/bering)\ **Replies:** 10\ **Last updated:** [December 11, 2015, 2:51pm UTC](https://discuss.elastic.co/t/solved-build-packetbeat-on-windows/35161 "2015-12-11T14:51:10Z")
I am trying to build packetbeat on a windows 10 computer, steps so far: install: Go 1.5.1 Git 2.6.3 bzr 2.5.1 gopath=c:\\go\\bin goroot=c:\\go\\ created a directory structure c:\\go\\src\\github.com\\elastic cd c:\\go\\src\\git… --- ## [Kibana unable to locate packetbeat index](https://discuss.elastic.co/t/kibana-unable-to-locate-packetbeat-index/32956)
**Author:** [@niraj\_kumar](https://discuss.elastic.co/u/niraj_kumar)\ **Replies:** 9\ **Last updated:** [December 10, 2015, 12:53pm UTC](https://discuss.elastic.co/t/kibana-unable-to-locate-packetbeat-index/32956 "2015-12-10T12:53:04Z")
Hi, I have uploaded the custom dashboard and visualization using the beats dashboard. But when i go to view my dashboard , kibana is unable to find the index. Can anyone help me to triage the issue. I have verified t… --- ## [RDS monitoring](https://discuss.elastic.co/t/rds-monitoring/36860)
**Author:** [@hiteshmahajan](https://discuss.elastic.co/u/hiteshmahajan)\ **Replies:** 2\ **Last updated:** [December 10, 2015, 11:21am UTC](https://discuss.elastic.co/t/rds-monitoring/36860 "2015-12-10T11:21:18Z")
How do we monitor RDS through packetbeat ? --- ## [Does filebeat cache?](https://discuss.elastic.co/t/does-filebeat-cache/35369)
**Author:** [@sijis](https://discuss.elastic.co/u/sijis)\ **Replies:** 20\ **Last updated:** [December 9, 2015, 6:33pm UTC](https://discuss.elastic.co/t/does-filebeat-cache/35369 "2015-12-09T18:33:04Z")
We bake our ami in AWS packer which includes filebeat. However, we've noticed that new instances are showing the ip of of the instance used to create the ami (aka wrong ip) as shipper in logstash. Currently, if we ju… --- ## [How to collect from two instances to logstash instance using filebeat](https://discuss.elastic.co/t/how-to-collect-from-two-instances-to-logstash-instance-using-filebeat/36689)
**Author:** [@kartheek91](https://discuss.elastic.co/u/kartheek91)\ **Replies:** 11\ **Last updated:** [December 9, 2015, 8:15am UTC](https://discuss.elastic.co/t/how-to-collect-from-two-instances-to-logstash-instance-using-filebeat/36689 "2015-12-09T08:15:08Z")
Can you please guide me how to collect logs from two seperate instances to logstash. --- ## [Filebeat and Windows Eventlog](https://discuss.elastic.co/t/filebeat-and-windows-eventlog/35643)
**Author:** [@straluna](https://discuss.elastic.co/u/straluna)\ **Replies:** 6\ **Last updated:** [December 9, 2015, 2:16am UTC](https://discuss.elastic.co/t/filebeat-and-windows-eventlog/35643 "2015-12-09T02:16:38Z")
Yes, i have to admit: we also have windows machine!\[:smile:\] Is the new filebeat 1.0.0 release ready for the Windows Eventlog? If not, what would be the best way to capture the Eventlog? Logstash-forwarder? I can not fi… --- ## [File beats compared to Log4j SocketAppender](https://discuss.elastic.co/t/file-beats-compared-to-log4j-socketappender/36601)
**Author:** [@ari](https://discuss.elastic.co/u/ari)\ **Replies:** 2\ **Last updated:** [December 8, 2015, 12:51pm UTC](https://discuss.elastic.co/t/file-beats-compared-to-log4j-socketappender/36601 "2015-12-08T12:51:18Z")
I see that this article is now marked as no longer recommended: https://www.elastic.co/blog/logging-elasticsearch-events-with-logstash-and-elasticsearch What is it about the article which is now bad? Why would I prefer… --- ## [Filebeat 1rc1 Windows does not work with Logstash 2](https://discuss.elastic.co/t/filebeat-1rc1-windows-does-not-work-with-logstash-2/34817)
**Author:** [@Omar\_Al\_Zabir](https://discuss.elastic.co/u/Omar_Al_Zabir)\ **Replies:** 4\ **Last updated:** [December 8, 2015, 12:40pm UTC](https://discuss.elastic.co/t/filebeat-1rc1-windows-does-not-work-with-logstash-2/34817 "2015-12-08T12:40:53Z")
When I configure filebeat on Windows, my Logstash gives the following error: {:timestamp=\>"2015-11-17T14:50:30.766000+0000", :message=\>"Beats input: unhandled exception", :exception=\>#\ **Author:** [@mvenkat\_in](https://discuss.elastic.co/u/mvenkat_in)\ **Replies:** 1\ **Last updated:** [December 8, 2015, 11:08am UTC](https://discuss.elastic.co/t/top-beat-metrics-in-readable-format/36604 "2015-12-08T11:08:34Z") Hi Is there anyway to get the metrics from Topbeat to display in Kibana in User Friendly readable format. For instance the metrics such as memory (all in bytes of KB) and CPU... It would be difficult to view and conve… --- ## [What the different beats to es and beats to logstash to es](https://discuss.elastic.co/t/what-the-different-beats-to-es-and-beats-to-logstash-to-es/36020)
**Author:** [@11175](https://discuss.elastic.co/u/11175)\ **Replies:** 6\ **Last updated:** [December 8, 2015, 5:56am UTC](https://discuss.elastic.co/t/what-the-different-beats-to-es-and-beats-to-logstash-to-es/36020 "2015-12-08T05:56:09Z")
beats -\> data -\> es beats -\> logstash -\> es which good solution? --- ## [What is actual?](https://discuss.elastic.co/t/what-is-actual/36548)
**Author:** [@michaellizhou](https://discuss.elastic.co/u/michaellizhou)\ **Replies:** 3\ **Last updated:** [December 7, 2015, 8:47pm UTC](https://discuss.elastic.co/t/what-is-actual/36548 "2015-12-07T20:47:36Z")
there are lots of fields that are labeled with actual! What is the difference? mem.actual\_used? --- ## [Beat to feed JMX data of Java processes to ES](https://discuss.elastic.co/t/beat-to-feed-jmx-data-of-java-processes-to-es/34465)
**Author:** [@owulff](https://discuss.elastic.co/u/owulff)\ **Replies:** 7\ **Last updated:** [December 7, 2015, 7:07pm UTC](https://discuss.elastic.co/t/beat-to-feed-jmx-data-of-java-processes-to-es/34465 "2015-12-07T19:07:55Z")
Are there already some ideas or plans to feed JMX data of Java processes into ES? Maybe Jolokia is an option as it provides an HTTP/JSON interface to the MBeanServer within a JVM: https://jolokia.org/reference/html/ind… --- ## [Collecting less information](https://discuss.elastic.co/t/collecting-less-information/36545)
**Author:** [@michaellizhou](https://discuss.elastic.co/u/michaellizhou)\ **Replies:** 2\ **Last updated:** [December 7, 2015, 4:00pm UTC](https://discuss.elastic.co/t/collecting-less-information/36545 "2015-12-07T16:00:22Z")
It seems we can enable 3 features which will capture lots of data. Is there anyway to fine tune this without logstash? Trying to save diskspace \[:smile:\] --- ## [Just warnings or something I should be concerned with?](https://discuss.elastic.co/t/just-warnings-or-something-i-should-be-concerned-with/36483)
**Author:** [@michaellizhou](https://discuss.elastic.co/u/michaellizhou)\ **Replies:** 4\ **Last updated:** [December 7, 2015, 3:16pm UTC](https://discuss.elastic.co/t/just-warnings-or-something-i-should-be-concerned-with/36483 "2015-12-07T15:16:08Z")
Here is a sample output when I run topbeats for a few seconds. Will continue to test: \[2015-12-06 18:49:14,027\]\[DEBUG\]\[action.admin.indices.mapping.put\] \[Inferno\] failed to put mappings on indices \[\[topbeat-2015.12.06\]… --- ## [Beats from the Open Source Community](https://discuss.elastic.co/t/beats-from-the-open-source-community/32700)
**Author:** [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Replies:** 2\ **Last updated:** [December 5, 2015, 9:47pm UTC](https://discuss.elastic.co/t/beats-from-the-open-source-community/32700 "2015-12-05T21:47:57Z")
We keep a list of Beats that are maintained by the open source community here: https://www.elastic.co/guide/en/beats/libbeat/master/community-beats.html. Edit: replaced the list here with the link to the authoritative… --- ## [\[SOLVED\] Redis, memory leak issue](https://discuss.elastic.co/t/solved-redis-memory-leak-issue/35870)
**Author:** [@hamelg](https://discuss.elastic.co/u/hamelg)\ **Replies:** 3\ **Last updated:** [December 4, 2015, 9:37am UTC](https://discuss.elastic.co/t/solved-redis-memory-leak-issue/35870 "2015-12-04T09:37:37Z")
Hello, Here is our setup : Packbeat(v0.5) \* 8 \>\> Redis (v3.0.5) \<\< Logstash(v1.5.5) \>\> elasticsearch(v1.7.3) We are very satisfy with this setup except we notice a memory leak on our redis server. Memory usage increas… --- ## [Dealing with frequent logrotation - ignore\_older seems to be ignored](https://discuss.elastic.co/t/dealing-with-frequent-logrotation-ignore-older-seems-to-be-ignored/36271)
**Author:** [@Cylindric](https://discuss.elastic.co/u/Cylindric)\ **Replies:** 5\ **Last updated:** [December 3, 2015, 3:33pm UTC](https://discuss.elastic.co/t/dealing-with-frequent-logrotation-ignore-older-seems-to-be-ignored/36271 "2015-12-03T15:33:33Z")
I am using filebeat to forward logs from a pair of Varnish servers, and these produce a fairly large amount of data pretty quickly. Because we don't want to keep this stuff, I've set up a one-hour log-rotation schedule f… --- ## [Filebeats - Multiple and different file types](https://discuss.elastic.co/t/filebeats-multiple-and-different-file-types/35995)
**Author:** [@Raggyman](https://discuss.elastic.co/u/Raggyman)\ **Replies:** 3\ **Last updated:** [December 3, 2015, 5:13am UTC](https://discuss.elastic.co/t/filebeats-multiple-and-different-file-types/35995 "2015-12-03T05:13:54Z")
I am trying to figure out how to deal with different types of log files using Filebeats as the the forwarder. Basically I have several different log files I want to monitor, and then I actually want to put an extra f… --- ## [Proc.name limited to 15 chars?](https://discuss.elastic.co/t/proc-name-limited-to-15-chars/36034)
**Author:** [@abraxxa](https://discuss.elastic.co/u/abraxxa)\ **Replies:** 4\ **Last updated:** [December 2, 2015, 4:48pm UTC](https://discuss.elastic.co/t/proc-name-limited-to-15-chars/36034 "2015-12-02T16:48:00Z")
I have several daemons which names have a common prefix which is longer than 15 characters that seem to get cut off by topbeat and end up being counted as one. It seems there is no config option in topbeat, is this a lim… --- ## [Filebeat cannot find /etc/filebeat/filebeat.yml on Windows server](https://discuss.elastic.co/t/filebeat-cannot-find-etc-filebeat-filebeat-yml-on-windows-server/34439)
**Author:** [@TheWinterWizard](https://discuss.elastic.co/u/TheWinterWizard)\ **Replies:** 7\ **Last updated:** [December 2, 2015, 4:10pm UTC](https://discuss.elastic.co/t/filebeat-cannot-find-etc-filebeat-filebeat-yml-on-windows-server/34439 "2015-12-02T16:10:28Z")
I've been banging my head against this for a while now, and no matter what I do (installing from .zip, running from .exe release, or running from what go get brings me), I'm unable to even execute filebeat.exe because it… --- ## [Beats deployment with logstash relays to a central LS instance](https://discuss.elastic.co/t/beats-deployment-with-logstash-relays-to-a-central-ls-instance/36107)
**Author:** [@kimery](https://discuss.elastic.co/u/kimery)\ **Replies:** 4\ **Last updated:** [December 2, 2015, 2:46pm UTC](https://discuss.elastic.co/t/beats-deployment-with-logstash-relays-to-a-central-ls-instance/36107 "2015-12-02T14:46:22Z")
Is there a documented way to configure this setup? beat -\> regional LS relay -\> central LS -\> ES I'd like to minimize and control the number of connections to my central ES cluster via an ACL, and trying to maintain … --- ## [Filebeat unresponsive after executing with .yml config file](https://discuss.elastic.co/t/filebeat-unresponsive-after-executing-with-yml-config-file/35460)
**Author:** [@Rizal\_Amir](https://discuss.elastic.co/u/Rizal_Amir)\ **Replies:** 1\ **Last updated:** [December 2, 2015, 1:28pm UTC](https://discuss.elastic.co/t/filebeat-unresponsive-after-executing-with-yml-config-file/35460 "2015-12-02T13:28:31Z")
Hi There, Quite new to beats here, previously success shippping logs using logstash to parsing and ship to Redis & ELK. I would like some advise on Packetbeat. I tried both rpm and tar package on my Centos 6 but it … --- ## [File beats should work on windows server 2008R2?](https://discuss.elastic.co/t/file-beats-should-work-on-windows-server-2008r2/35899)
**Author:** [@Lavanya\_Anne](https://discuss.elastic.co/u/Lavanya_Anne)\ **Replies:** 8\ **Last updated:** [December 2, 2015, 6:18am UTC](https://discuss.elastic.co/t/file-beats-should-work-on-windows-server-2008r2/35899 "2015-12-02T06:18:55Z")
i am trying to start the file beat service it is throwing error. please help me. Error is the service could not respond in timely fashion --- ## [Exclude files to be processed](https://discuss.elastic.co/t/exclude-files-to-be-processed/36093)
**Author:** [@tgdesrochers](https://discuss.elastic.co/u/tgdesrochers)\ **Replies:** 2\ **Last updated:** [December 1, 2015, 9:45pm UTC](https://discuss.elastic.co/t/exclude-files-to-be-processed/36093 "2015-12-01T21:45:22Z")
I currently use Logstash to read files in my directory. I use the input from file plugin and use path/to/logs/\*.log then use exclude statements to exclude the logs I don't want transported into my ES cluster. Is ther… --- ## [Using Topbeats for computers on LAN and VM](https://discuss.elastic.co/t/using-topbeats-for-computers-on-lan-and-vm/36016)
**Author:** [@aviv.ratzon](https://discuss.elastic.co/u/aviv.ratzon)\ **Replies:** 4\ **Last updated:** [December 1, 2015, 1:51pm UTC](https://discuss.elastic.co/t/using-topbeats-for-computers-on-lan-and-vm/36016 "2015-12-01T13:51:58Z")
Hello, I was wondering if it is possible to monitore multiple computers over LAN without the need to install it on wach one. Also, lets say these are actually VMs. What would be the best way to monitore their performan… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=597) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=599)