# Beats behaviour **URL:** \ **Category:** Beats\ **Created:** [June 5, 2016, 12:24pm UTC](https://discuss.elastic.co/t/beats-behaviour/51875 "2016-06-05T12:24:35Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![Igor\_Dementyeff](https://avatars.discourse-cdn.com/v4/letter/i/a87d85/32.png) [@Igor\_Dementyeff](https://discuss.elastic.co/u/Igor_Dementyeff)\ **Post date:** [June 5, 2016, 12:24pm UTC](https://discuss.elastic.co/t/beats-behaviour/51875/1 "2016-06-05T12:24:35Z")
Hello all. I got a very strange problem with the Kibana and I honestly don't know where to search... So the overview is this: Kibana server with topbeat, packetbeat and filebeat running Once in a day, or 2 days, filebeat stops showing any results in the dashboard I made. Restart to Kibana and all 3 beats is not giving any solution, as also the removing and adding beats back to the index patterns Under the /0/indices folder every beat got its own folder for today and 3 days back. Older folders are deleted by the cronjob every day Kibana server is Linux, and it monitors the JBOSS linux servers. Filebeat is used for analysing the logs of JBOSS servers Can someone please help me to solve the issue? Thanks in advance Igor ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [June 5, 2016, 11:33pm UTC](https://discuss.elastic.co/t/beats-behaviour/51875/2 "2016-06-05T23:33:29Z")
Is there data in the indices? Take a look with `_cat/indices`. ---
**Author:** ![Igor\_Dementyeff](https://avatars.discourse-cdn.com/v4/letter/i/a87d85/32.png) [@Igor\_Dementyeff](https://discuss.elastic.co/u/Igor_Dementyeff)\ **Post date:** [June 6, 2016, 7:31am UTC](https://discuss.elastic.co/t/beats-behaviour/51875/3 "2016-06-06T07:31:39Z")
Thanks for the answer. Yes, it is ![](https://us1.discourse-cdn.com/elastic/original/2X/2/2054271d1a5072ad642fef2aa30fe95dea1d5ce5.png) ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [June 6, 2016, 7:45am UTC](https://discuss.elastic.co/t/beats-behaviour/51875/4 "2016-06-06T07:45:22Z")
Please don't post pictures of text, they are difficult to read and some people may not be even able to see them. Also, use the APIs, not the filesystem. What does that API show you? ---
**Author:** ![Igor\_Dementyeff](https://avatars.discourse-cdn.com/v4/letter/i/a87d85/32.png) [@Igor\_Dementyeff](https://discuss.elastic.co/u/Igor_Dementyeff)\ **Post date:** [June 6, 2016, 7:49am UTC](https://discuss.elastic.co/t/beats-behaviour/51875/5 "2016-06-06T07:49:37Z")
Sorry, will not do it again The result: `-bash-4.1# curl 'localhost:9200/_cat/indices/twi*?v' health status index pri rep docs.count docs.deleted store.size pri.store.size` So it shows nothing as I assume ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [June 6, 2016, 7:51am UTC](https://discuss.elastic.co/t/beats-behaviour/51875/6 "2016-06-06T07:51:55Z")
Then it looks like a beats issue. Can you post your configs and versions? ---
**Author:** ![Igor\_Dementyeff](https://avatars.discourse-cdn.com/v4/letter/i/a87d85/32.png) [@Igor\_Dementyeff](https://discuss.elastic.co/u/Igor_Dementyeff)\ **Post date:** [June 6, 2016, 8:11am UTC](https://discuss.elastic.co/t/beats-behaviour/51875/7 "2016-06-06T08:11:55Z")
``` 2016/06/06 08:08:22.355246 beat.go:107: INFO Init Beat: topbeat; Version: 1.0.1 2016/06/06 08:09:13.320334 beat.go:107: INFO Init Beat: filebeat; Version: 1.0.1 2016/06/06 08:09:46.564029 beat.go:107: INFO Init Beat: packetbeat; Version: 1.0.1 ``` Config - you mean the .yml files? ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [June 6, 2016, 9:48pm UTC](https://discuss.elastic.co/t/beats-behaviour/51875/8 "2016-06-06T21:48:37Z")
Yes. ---
**Author:** ![Igor\_Dementyeff](https://avatars.discourse-cdn.com/v4/letter/i/a87d85/32.png) [@Igor\_Dementyeff](https://discuss.elastic.co/u/Igor_Dementyeff)\ **Post date:** [June 7, 2016, 4:55am UTC](https://discuss.elastic.co/t/beats-behaviour/51875/10 "2016-06-07T04:55:29Z")
`filebeat: prospectors: - paths: - /opt/jboss/EAP/standalone/log/server.log fields: server: jboss registry\_file: /var/lib/filebeat/registry output: logstash: hosts: ["badger:5018"] shipper: logging: level: warning to\_files: true to\_syslog: false files: path: /var/log/filebeat name: filebeat.log keepfiles: 2 rotateeverybytes: 10485760 # = 10MB interfaces: device: any protocols: dns: ports: [53] include\_authorities: true include\_additionals: true http: ports: [80, 8080, 8180, 8280, 8380] hide\_keywords: ['password'] memcache: ports: [11211] vi /etc/topbeat/topbeat.yml input: period: 10 procs: [".\*"] stats: system: true proc: true filesystem: true output: logstash: hosts: ["badger:5018"] shipper: logging: to\_syslog: false to\_files: true files: path: /var/log/topbeat name: topbeat.log rotateeverybytes: 10485760 # = 10MB keepfiles: 2 level: warning ~ output: logstash: hosts: ["badger:5018"] shipper: logging: to\_files: true to\_syslog: false files: path: /var/log/packetbeat name: packetbeat.log rotateeverybytes: 10485760 # = 10MB keepfiles: 2 level: warning ` ---
**Author:** ![Igor\_Dementyeff](https://avatars.discourse-cdn.com/v4/letter/i/a87d85/32.png) [@Igor\_Dementyeff](https://discuss.elastic.co/u/Igor_Dementyeff)\ **Post date:** [June 9, 2016, 2:40pm UTC](https://discuss.elastic.co/t/beats-behaviour/51875/11 "2016-06-09T14:40:53Z")
Mark, you here? 🙂 ---
**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\ **Post date:** [June 10, 2016, 10:18am UTC](https://discuss.elastic.co/t/beats-behaviour/51875/12 "2016-06-10T10:18:58Z")
please upgrade your beats to more recent release. Old versions have a known bug of beats not sending new events if logstash/network failed way too often. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 5, 2017, 9:51pm UTC](https://discuss.elastic.co/t/beats-behaviour/51875/13 "2017-07-05T21:51:14Z")