# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1191 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1192 --- ## [IIS FTP Logs](https://discuss.elastic.co/t/iis-ftp-logs/287395)
**Author:** [@Bingdom](https://discuss.elastic.co/u/Bingdom)\ **Replies:** 1\ **Last updated:** [October 22, 2021, 12:16pm UTC](https://discuss.elastic.co/t/iis-ftp-logs/287395 "2021-10-22T12:16:00Z")
Hello, In our setup, I have managed to retrieve the webserver IIS logs - which works great However, it appears for the IIS module, it's only compatible with the IIS webserver. We host our FTP servers via IIS. I'm wond… --- ## [How to parase xml in logstash](https://discuss.elastic.co/t/how-to-parase-xml-in-logstash/285214)
**Author:** [@INS](https://discuss.elastic.co/u/INS)\ **Replies:** 16\ **Last updated:** [October 14, 2021, 4:33pm UTC](https://discuss.elastic.co/t/how-to-parase-xml-in-logstash/285214 "2021-10-14T16:33:08Z")
Hi I'm wondering how can I can parse below structure of XML in logstash as XML in the single event. Maybe in that case would be use fluentd.??? This logs will be upload by filebeat. here it is worth mentioning that the… --- ## [How to find largest size document?](https://discuss.elastic.co/t/how-to-find-largest-size-document/287405)
**Author:** [@Busra\_Duygu](https://discuss.elastic.co/u/Busra_Duygu)\ **Replies:** 2\ **Last updated:** [October 22, 2021, 11:11am UTC](https://discuss.elastic.co/t/how-to-find-largest-size-document/287405 "2021-10-22T11:11:47Z")
Hello dear friends, you have helped me in many ways before, thank you very much for this. Again I am facing a problem. The problem is that I want to find the largest size document in my index. Is it possible for me to do… --- ## [How to perform math formula in Elasticsearch script score based on field value conditions?](https://discuss.elastic.co/t/how-to-perform-math-formula-in-elasticsearch-script-score-based-on-field-value-conditions/287034)
**Author:** [@Mariusz\_Liksza](https://discuss.elastic.co/u/Mariusz_Liksza)\ **Replies:** 6\ **Last updated:** [October 22, 2021, 12:10pm UTC](https://discuss.elastic.co/t/how-to-perform-math-formula-in-elasticsearch-script-score-based-on-field-value-conditions/287034 "2021-10-22T12:10:44Z")
I would like to apply a simple math formula to all documents in Elasticsearch DB. The tricky thing is that each variables consists of multiply values which are at the same time person attributes. { "\_id" : "1",… --- ## [Increasing the heap size](https://discuss.elastic.co/t/increasing-the-heap-size/287410)
**Author:** [@alicango](https://discuss.elastic.co/u/alicango)\ **Replies:** 1\ **Last updated:** [October 22, 2021, 11:50am UTC](https://discuss.elastic.co/t/increasing-the-heap-size/287410 "2021-10-22T11:50:22Z")
Hi, We are getting this error. \[2021-10-01 08:11:12\] local.ERROR: ReportDataProcess Job Exception: {“error”:{“root\_cause”:\[{“type”:“circuit\_breaking\_exception”,“reason”:“\[in\_flight\_requests\] Data too large, data for \[\ **Author:** [@nehaltrivedi96](https://discuss.elastic.co/u/nehaltrivedi96)\ **Replies:** 3\ **Last updated:** [October 22, 2021, 11:46am UTC](https://discuss.elastic.co/t/regex-kibana/287362 "2021-10-22T11:46:06Z") Hello, I am trying to create a regex query in kibana. I want to get a result which has sanitation followed by access meaning I am trying to find sanitation access\*. I am entering the following query but I am not getting… --- ## [Using wildcard and fuzziness in Elasticsearch](https://discuss.elastic.co/t/using-wildcard-and-fuzziness-in-elasticsearch/286822)
**Author:** [@jpllana](https://discuss.elastic.co/u/jpllana)\ **Replies:** 3\ **Last updated:** [October 22, 2021, 11:41am UTC](https://discuss.elastic.co/t/using-wildcard-and-fuzziness-in-elasticsearch/286822 "2021-10-22T11:41:42Z")
I have a query to search for an address where I am using also the wildcard. So if I am searching for Kennedy using the query below, I have these addresses: Query: GET my\_index/\_search { "query": { "query\_string":… --- ## [Elasticsearch tuning](https://discuss.elastic.co/t/elasticsearch-tuning/286623)
**Author:** [@Vishal\_Tomar](https://discuss.elastic.co/u/Vishal_Tomar)\ **Replies:** 2\ **Last updated:** [October 22, 2021, 11:28am UTC](https://discuss.elastic.co/t/elasticsearch-tuning/286623 "2021-10-22T11:28:55Z")
We are developing a platform where millions of records update or insert on a daily basis. For developing this platform we are working with MongoDB as primary database and Elasticsearch for secondary database(Only for se… --- ## [A question regarding querying only the index's latest documents](https://discuss.elastic.co/t/a-question-regarding-querying-only-the-indexs-latest-documents/286295)
**Author:** [@nivo](https://discuss.elastic.co/u/nivo)\ **Replies:** 7\ **Last updated:** [October 21, 2021, 10:35pm UTC](https://discuss.elastic.co/t/a-question-regarding-querying-only-the-indexs-latest-documents/286295 "2021-10-21T22:35:06Z")
Hi everyone, I'm doing a POC on a rolling indexes alternative approach in order to avoid deleting documents. I encounter some difficulties querying the data I need and I'm not sure if that's just me looking at the quer… --- ## [How to add field "id"](https://discuss.elastic.co/t/how-to-add-field-id/287336)
**Author:** [@khouloud](https://discuss.elastic.co/u/khouloud)\ **Replies:** 2\ **Last updated:** [October 22, 2021, 10:29am UTC](https://discuss.elastic.co/t/how-to-add-field-id/287336 "2021-10-22T10:29:16Z")
Hello, I wanna add a unique id identifier per file log in logstash. Thank you --- ## [Highlight subset of characters](https://discuss.elastic.co/t/highlight-subset-of-characters/285370)
**Author:** [@itokai](https://discuss.elastic.co/u/itokai)\ **Replies:** 2\ **Last updated:** [October 18, 2021, 10:56am UTC](https://discuss.elastic.co/t/highlight-subset-of-characters/285370 "2021-10-18T10:56:26Z")
Hello, how to highlight subset of characters in word(s) within sentence? For sentence: It makes website content ingestion easier than ever, so you can add search to your websites and apps in record time. if chars arr… --- ## [How to create custom message info for monitors in Elastic?](https://discuss.elastic.co/t/how-to-create-custom-message-info-for-monitors-in-elastic/283456)
**Author:** [@Maddyle0](https://discuss.elastic.co/u/Maddyle0)\ **Replies:** 3\ **Last updated:** [October 22, 2021, 8:46am UTC](https://discuss.elastic.co/t/how-to-create-custom-message-info-for-monitors-in-elastic/283456 "2021-10-22T08:46:31Z")
Hello, I'm new to Elastic, I have configured the Email alerts for port violation monitor, but I getting emails with default Messages info, not Specific details about the alert. How can I edit the default template and add… --- ## [Unable to connect to elasticsearch when Xpack is configured](https://discuss.elastic.co/t/unable-to-connect-to-elasticsearch-when-xpack-is-configured/287279)
**Author:** [@Kadhem](https://discuss.elastic.co/u/Kadhem)\ **Replies:** 3\ **Last updated:** [October 22, 2021, 8:34am UTC](https://discuss.elastic.co/t/unable-to-connect-to-elasticsearch-when-xpack-is-configured/287279 "2021-10-22T08:34:25Z")
Hi, i've configured Xpack to get users and roles. it's all working fine but when i want to run logstash file.conf to push data i get an error saying: \[2021-10-21T09:34:55,359\]\[WARN \]\[logstash.outputs.elasticsearch\]\[main… --- ## [Heartbeat Down Counter](https://discuss.elastic.co/t/heartbeat-down-counter/285817)
**Author:** [@maltewhiite](https://discuss.elastic.co/u/maltewhiite)\ **Replies:** 3\ **Last updated:** [October 22, 2021, 7:59am UTC](https://discuss.elastic.co/t/heartbeat-down-counter/285817 "2021-10-22T07:59:18Z")
How do I make a simple counter, that show how many of my hosts are down? We are running heartbeat. I'd think it was simple to make this, but I can't figure it out. How do I make a simple counter that show how many of … --- ## [How to learn index with most queries?](https://discuss.elastic.co/t/how-to-learn-index-with-most-queries/287407)
**Author:** [@Busra\_Duygu](https://discuss.elastic.co/u/Busra_Duygu)\ **Replies:** 2\ **Last updated:** [October 22, 2021, 7:27am UTC](https://discuss.elastic.co/t/how-to-learn-index-with-most-queries/287407 "2021-10-22T07:27:21Z")
Hello dear friends, I would like to ask you a question that has been on my mind before. This question is: I wonder if we can find which indexes get the most queries. So I have more than one index and these indexes are us… --- ## [Add "time" chart on kibana](https://discuss.elastic.co/t/add-time-chart-on-kibana/287271)
**Author:** [@christbiz86](https://discuss.elastic.co/u/christbiz86)\ **Replies:** 6\ **Last updated:** [October 22, 2021, 6:31am UTC](https://discuss.elastic.co/t/add-time-chart-on-kibana/287271 "2021-10-22T06:31:24Z")
hi all, i want adding time chart like the screenshot. kibana only show the "document" field ony. i've add the index pattern and it doesn't work. any help please! my kibana currently --- ## [Data path configuration in source code (7.15) running in local machine](https://discuss.elastic.co/t/data-path-configuration-in-source-code-7-15-running-in-local-machine/287397)
**Author:** [@vnaveed](https://discuss.elastic.co/u/vnaveed)\ **Replies:** 0\ **Last updated:** [October 22, 2021, 5:45am UTC](https://discuss.elastic.co/t/data-path-configuration-in-source-code-7-15-running-in-local-machine/287397 "2021-10-22T05:45:44Z")
Hi.. Am running the Elasticsearch source code (7.15) in my window machine, May I know in which file I have to change the path to store my data permanently Since each time I restart the machine build folder gets reset. I… --- ## [Clearing the concept of Translog](https://discuss.elastic.co/t/clearing-the-concept-of-translog/287374)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 4\ **Last updated:** [October 22, 2021, 5:32am UTC](https://discuss.elastic.co/t/clearing-the-concept-of-translog/287374 "2021-10-22T05:32:24Z")
In translog documentation it is said that All index and delete operations are written to the translog after being processed by the internal Lucene index but before they are acknowledged So i am not understanding what… --- ## [How to push log from Filebeat to Logstash/Elasticsearch affer setting secure TSL?](https://discuss.elastic.co/t/how-to-push-log-from-filebeat-to-logstash-elasticsearch-affer-setting-secure-tsl/287386)
**Author:** [@nhattanmai](https://discuss.elastic.co/u/nhattanmai)\ **Replies:** 0\ **Last updated:** [October 22, 2021, 4:34am UTC](https://discuss.elastic.co/t/how-to-push-log-from-filebeat-to-logstash-elasticsearch-affer-setting-secure-tsl/287386 "2021-10-22T04:34:28Z")
Dear all, I configured Encrypt traffic between Kibana and Elasticsearch successfully and now I can start Kibana (not yet https) and connected Elasticsearch Here is Elasticsearch's setting: network.host: 0.0.0.0 disco… --- ## [Save all message event to array in ruby filter](https://discuss.elastic.co/t/save-all-message-event-to-array-in-ruby-filter/287381)
**Author:** [@Hertz\_Drive](https://discuss.elastic.co/u/Hertz_Drive)\ **Replies:** 0\ **Last updated:** [October 22, 2021, 3:51am UTC](https://discuss.elastic.co/t/save-all-message-event-to-array-in-ruby-filter/287381 "2021-10-22T03:51:44Z")
I need save event to array. print (event) %{host} %{message} I need print message in event. Thank you. --- ## [Add a new field with a specifically formatted timestamp from @timestamp](https://discuss.elastic.co/t/add-a-new-field-with-a-specifically-formatted-timestamp-from-timestamp/287373)
**Author:** [@trwillis](https://discuss.elastic.co/u/trwillis)\ **Replies:** 1\ **Last updated:** [October 22, 2021, 12:25am UTC](https://discuss.elastic.co/t/add-a-new-field-with-a-specifically-formatted-timestamp-from-timestamp/287373 "2021-10-22T00:25:17Z")
I want to take the value from @timestamp, format it like "yyyy MM dd HH:mm:ss" and prepend it to the message field. Input data is syslog in json format. --- ## [Conditional Sort Using Two Fields](https://discuss.elastic.co/t/conditional-sort-using-two-fields/287352)
**Author:** [@cruzmoan](https://discuss.elastic.co/u/cruzmoan)\ **Replies:** 0\ **Last updated:** [October 21, 2021, 6:40pm UTC](https://discuss.elastic.co/t/conditional-sort-using-two-fields/287352 "2021-10-21T18:40:11Z")
We have a document that has the following fields: field1 field2 valueType We want to include both fields in the sort. We do NOT want to sort field1, then field2. We want the sort to use both fields at the same sort… --- ## [How to get kubernetes namespace in webhook alert payload?](https://discuss.elastic.co/t/how-to-get-kubernetes-namespace-in-webhook-alert-payload/286877)
**Author:** [@AndyLibrian](https://discuss.elastic.co/u/AndyLibrian)\ **Replies:** 1\ **Last updated:** [October 21, 2021, 9:01pm UTC](https://discuss.elastic.co/t/how-to-get-kubernetes-namespace-in-webhook-alert-payload/286877 "2021-10-21T21:01:05Z")
Hi. Does anyone know how to get kubernetes namespace in webhook alert payload from metricbeat k8s module? Or more generically, how to access the event data to include in the payload? I installed metricbeat on kubernetes… --- ## [Do I need to generate a cert?](https://discuss.elastic.co/t/do-i-need-to-generate-a-cert/286773)
**Author:** [@MKirby](https://discuss.elastic.co/u/MKirby)\ **Replies:** 8\ **Last updated:** [October 21, 2021, 7:23pm UTC](https://discuss.elastic.co/t/do-i-need-to-generate-a-cert/286773 "2021-10-21T19:23:03Z")
I have successfully configured minimal security in my environment and am now moving on to Basic, so that I can use fleet and SIEM. Version of Elastic I am using is 7.13.4, on a RHEL 8.0 server. I only have 1 Elasticsea… --- ## [Quotes are not converted correctly](https://discuss.elastic.co/t/quotes-are-not-converted-correctly/286994)
**Author:** [@Sandra\_Schlichting](https://discuss.elastic.co/u/Sandra_Schlichting)\ **Replies:** 7\ **Last updated:** [October 21, 2021, 7:15pm UTC](https://discuss.elastic.co/t/quotes-are-not-converted-correctly/286994 "2021-10-21T19:15:53Z")
Dear all =) When creating Create Rule over the API, and want to search for host:"10.250.11.11", then I run into problems. This is invalid JSON: "esQuery": '{ "query": { "query\_string": { "query": "host:"10.250.11.11" … --- ## [Default username and password for Elasticsearch 7.15](https://discuss.elastic.co/t/default-username-and-password-for-elasticsearch-7-15/287235)
**Author:** [@harryco](https://discuss.elastic.co/u/harryco)\ **Replies:** 3\ **Last updated:** [October 21, 2021, 7:12pm UTC](https://discuss.elastic.co/t/default-username-and-password-for-elasticsearch-7-15/287235 "2021-10-21T19:12:44Z")
Hi, I just installed Elasticsearch 7.15.1 on macOS Catalina, and I set the following in Elasticsearch.yml in order to enable security: xpack.security.enabled: true Now, I'm prompted for a username and password, but I … --- ## [winlog.event\_data.Image.keyword not populated](https://discuss.elastic.co/t/winlog-event-data-image-keyword-not-populated/287342)
**Author:** [@mcreedjr](https://discuss.elastic.co/u/mcreedjr)\ **Replies:** 2\ **Last updated:** [October 21, 2021, 6:53pm UTC](https://discuss.elastic.co/t/winlog-event-data-image-keyword-not-populated/287342 "2021-10-21T18:53:12Z")
I am shipping logs from a Windows 10 machine with Process auditing enabled in the Windows using 7.15 version of winlogbeats to logstash, and then in turn Elasticsearch. As an example, I am trying to use a detection rule… --- ## [Add custom tag to zeek filebeat module](https://discuss.elastic.co/t/add-custom-tag-to-zeek-filebeat-module/287349)
**Author:** [@kcrawford19](https://discuss.elastic.co/u/kcrawford19)\ **Replies:** 0\ **Last updated:** [October 21, 2021, 6:33pm UTC](https://discuss.elastic.co/t/add-custom-tag-to-zeek-filebeat-module/287349 "2021-10-21T18:33:27Z")
Hello, I am configuring an ELK stack and would like to use filebeat to read in zeek logs. Below is a snippet of my filebeat module configuration: # cat /etc/filebeat/modules.d/zeek.yml - module: zeek capture\_loss: … --- ## [SQL indexes with dashes fail with high level java client (escaped with quotes)](https://discuss.elastic.co/t/sql-indexes-with-dashes-fail-with-high-level-java-client-escaped-with-quotes/287108)
**Author:** [@larryjag99](https://discuss.elastic.co/u/larryjag99)\ **Replies:** 2\ **Last updated:** [October 21, 2021, 6:21pm UTC](https://discuss.elastic.co/t/sql-indexes-with-dashes-fail-with-high-level-java-client-escaped-with-quotes/287108 "2021-10-21T18:21:29Z")
I am using the high-level java client to submit SQL requests to our elastic cluster. I'm seeing an issue where if the index name has a "dash" in it (while enclosed in quotes), the request cannot be parsed by the server.… --- ## [RSpec: Testing Aggregate Filters](https://discuss.elastic.co/t/rspec-testing-aggregate-filters/287345)
**Author:** [@UXabre](https://discuss.elastic.co/u/UXabre)\ **Replies:** 0\ **Last updated:** [October 21, 2021, 6:02pm UTC](https://discuss.elastic.co/t/rspec-testing-aggregate-filters/287345 "2021-10-21T18:02:56Z")
I'm trying to unittest a filter that utilizes aggregate filter. In my sample, I'm dropping all messages and wait for the timeout to occur instead. I'd like to retrieve this async message somehow and verify if the conten… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1190) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1192)