# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1267 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1268 --- ## [If else in logstash throwin error](https://discuss.elastic.co/t/if-else-in-logstash-throwin-error/282436)
**Author:** [@selin](https://discuss.elastic.co/u/selin)\ **Replies:** 2\ **Last updated:** [August 25, 2021, 9:06am UTC](https://discuss.elastic.co/t/if-else-in-logstash-throwin-error/282436 "2021-08-25T09:06:20Z")
Below is my logstash configuration file output { if "%{\[fields\]\[myvalue1\]}" == "value" and "%{\[fields\]\[myvalue2\]}" == "valu" { hosts =\> \["https://es1:9200","https://es2:9200","https://es3:9200"\] ilm\_enabled =\> … --- ## [Filebeat high CPU usage during reading a huge file](https://discuss.elastic.co/t/filebeat-high-cpu-usage-during-reading-a-huge-file/282363)
**Author:** [@arberg](https://discuss.elastic.co/u/arberg)\ **Replies:** 0\ **Last updated:** [August 24, 2021, 2:35pm UTC](https://discuss.elastic.co/t/filebeat-high-cpu-usage-during-reading-a-huge-file/282363 "2021-08-24T14:35:01Z")
Hello fellow ELKstackers, Filebeat (6.3.1 on x64 old RedHat) runs with very high CPU when has been behind and needs to read some large log-files. It used 100% of 1/8 cpus (top said around 100%). After it was done proces… --- ## [Cant activate xpack on kibana 7.10'](https://discuss.elastic.co/t/cant-activate-xpack-on-kibana-7-10/282450)
**Author:** [@sebib](https://discuss.elastic.co/u/sebib)\ **Replies:** 2\ **Last updated:** [August 25, 2021, 8:26am UTC](https://discuss.elastic.co/t/cant-activate-xpack-on-kibana-7-10/282450 "2021-08-25T08:26:08Z")
Hey there! Im trying to deploy kibana within google kubernetes engine. When not setting xpack.security.enabled: true, everything works fine. As I would like to have a login page and user administration, I need to set … --- ## [Logstash not parse winlogbeat new version](https://discuss.elastic.co/t/logstash-not-parse-winlogbeat-new-version/282456)
**Author:** [@Nazakat](https://discuss.elastic.co/u/Nazakat)\ **Replies:** 0\ **Last updated:** [August 25, 2021, 7:49am UTC](https://discuss.elastic.co/t/logstash-not-parse-winlogbeat-new-version/282456 "2021-08-25T07:49:22Z")
There is create two fields and divided value version wies. Then i want to FileVersion field is remove --- ## [Determining 'size' in \[\_source \] \[includes\] query](https://discuss.elastic.co/t/determining-size-in-source-includes-query/282451)
**Author:** [@clawrencia](https://discuss.elastic.co/u/clawrencia)\ **Replies:** 8\ **Last updated:** [August 25, 2021, 7:41am UTC](https://discuss.elastic.co/t/determining-size-in-source-includes-query/282451 "2021-08-25T07:41:04Z")
Hi guys, I am just wondering if it possible to set the size for a particular field when we query. The following here is my query. (Apologies for the mess, the query is done in the python elasticsearch API). GET /index\_… --- ## [Reporting Kibana login/logout](https://discuss.elastic.co/t/reporting-kibana-login-logout/282334)
**Author:** [@RickT](https://discuss.elastic.co/u/RickT)\ **Replies:** 4\ **Last updated:** [August 25, 2021, 7:15am UTC](https://discuss.elastic.co/t/reporting-kibana-login-logout/282334 "2021-08-25T07:15:07Z")
Hi, Today, i've to administer the Kibana activity. What is the way to generate Kibana connections report ? I don't find any data in kibana logs ! (Kibana version 6.8.3) Thanks all --- ## [Control list](https://discuss.elastic.co/t/control-list/282248)
**Author:** [@Krunal](https://discuss.elastic.co/u/Krunal)\ **Replies:** 4\ **Last updated:** [August 25, 2021, 7:09am UTC](https://discuss.elastic.co/t/control-list/282248 "2021-08-25T07:09:32Z")
Hello, I am using control option list to search the client name. I am having approximately 2500 different clients and changes regularly, i cant able to find some of the client and by using lucene query, i can find it e… --- ## [Rename host](https://discuss.elastic.co/t/rename-host/282356)
**Author:** [@Garry](https://discuss.elastic.co/u/Garry)\ **Replies:** 5\ **Last updated:** [August 25, 2021, 7:05am UTC](https://discuss.elastic.co/t/rename-host/282356 "2021-08-25T07:05:57Z")
I have a number of hostnames which are pretty generic. Is there any way to change these when displaying in Kibana? E.g. Server01 to be changed to UK\_WebSever\_01 Any ideas? --- ## [Logstash 7.9 JDBC- Oracle input - Session closing](https://discuss.elastic.co/t/logstash-7-9-jdbc-oracle-input-session-closing/282452)
**Author:** [@Prashant\_Achari](https://discuss.elastic.co/u/Prashant_Achari)\ **Replies:** 0\ **Last updated:** [August 25, 2021, 7:01am UTC](https://discuss.elastic.co/t/logstash-7-9-jdbc-oracle-input-session-closing/282452 "2021-08-25T07:01:58Z")
We have an scenario where we are connecting to oracle db for getting db stats using JDBC / Logstash. In some cases oracle db connection are not closed after query execution. These session are seen in long running sess… --- ## [Kibana Dashboards](https://discuss.elastic.co/t/kibana-dashboards/281886)
**Author:** [@RobertC1](https://discuss.elastic.co/u/RobertC1)\ **Replies:** 3\ **Last updated:** [August 25, 2021, 6:40am UTC](https://discuss.elastic.co/t/kibana-dashboards/281886 "2021-08-25T06:40:22Z")
Hi there I am new with these tool. I have 3 fields, fecha (@timestanp), transactions and services. I don´t know how to build a dashborboard counting by transactions and SUM the services using the HOUR of the @timesta… --- ## [Error using logstash : ParserError: Unexpected character ('\<'](https://discuss.elastic.co/t/error-using-logstash-parsererror-unexpected-character/281322)
**Author:** [@vp096](https://discuss.elastic.co/u/vp096)\ **Replies:** 18\ **Last updated:** [August 25, 2021, 5:54am UTC](https://discuss.elastic.co/t/error-using-logstash-parsererror-unexpected-character/281322 "2021-08-25T05:54:17Z")
Hello, I have been using ELK for a while and I am trying to retrieve the logs from a Wifi controller (Aruba Mobility Master). I checked with Wireshark, and I'm getting my syslog packets fine. However, logstash makes an … --- ## [How to Capture user's activity in Elasticsearch](https://discuss.elastic.co/t/how-to-capture-users-activity-in-elasticsearch/282346)
**Author:** [@ravi-shanker](https://discuss.elastic.co/u/ravi-shanker)\ **Replies:** 6\ **Last updated:** [August 25, 2021, 5:35am UTC](https://discuss.elastic.co/t/how-to-capture-users-activity-in-elasticsearch/282346 "2021-08-25T05:35:44Z")
Dear Elastic Users, I am working on an Elasticsearch POC and as part of that i need to capture below details -- What users are searching for -- Which links users are clicking In short i want to capture users activity… --- ## [Which node to apply Active Directory configuration](https://discuss.elastic.co/t/which-node-to-apply-active-directory-configuration/282365)
**Author:** [@roh](https://discuss.elastic.co/u/roh)\ **Replies:** 4\ **Last updated:** [August 25, 2021, 5:16am UTC](https://discuss.elastic.co/t/which-node-to-apply-active-directory-configuration/282365 "2021-08-25T05:16:54Z")
Hi all! I'm working on Elasticsearch Cluster with 10 ES nodes for my client's project on production and already created cluster with 3 ES nodes on development . Nodes are like below: Production 6 Hot (3 of them incl… --- ## [Best practices for indexing documents](https://discuss.elastic.co/t/best-practices-for-indexing-documents/282347)
**Author:** [@TheHunter](https://discuss.elastic.co/u/TheHunter)\ **Replies:** 2\ **Last updated:** [August 25, 2021, 4:43am UTC](https://discuss.elastic.co/t/best-practices-for-indexing-documents/282347 "2021-08-25T04:43:46Z")
Hi all, I’m trying to get info about best practices to define indices, mainly in microservices environment. The question is, inside each our microservices we have many “schemas”, so in order to use in a right way shard… --- ## [Change machine learning algorithms](https://discuss.elastic.co/t/change-machine-learning-algorithms/282343)
**Author:** [@Hartinah](https://discuss.elastic.co/u/Hartinah)\ **Replies:** 5\ **Last updated:** [August 25, 2021, 4:37am UTC](https://discuss.elastic.co/t/change-machine-learning-algorithms/282343 "2021-08-25T04:37:01Z")
Sorry, I've only been learning about elastics for a few years...And I happen to want to do some research with Wazuh and Elastic...I noticed that there are machine learning features in elastic in data analysis. Is it pos… --- ## [ILM Index Lifecycle](https://discuss.elastic.co/t/ilm-index-lifecycle/282367)
**Author:** [@selin](https://discuss.elastic.co/u/selin)\ **Replies:** 2\ **Last updated:** [August 25, 2021, 4:23am UTC](https://discuss.elastic.co/t/ilm-index-lifecycle/282367 "2021-08-25T04:23:37Z")
Hi can i know if ilm\_rollover\_alias not speificed, will it take index name as alias? index =\> "my\_index" ilm\_pattern =\> "{now/d{yyyyMMdd}}-00001" so it will be my\_index-20210823-00001 ? --- ## [Elastic cloud deployment issue](https://discuss.elastic.co/t/elastic-cloud-deployment-issue/282366)
**Author:** [@kadiveti](https://discuss.elastic.co/u/kadiveti)\ **Replies:** 2\ **Last updated:** [August 25, 2021, 4:08am UTC](https://discuss.elastic.co/t/elastic-cloud-deployment-issue/282366 "2021-08-25T04:08:39Z")
Hi Team, My kibana console is showing This site can’t be reached even after trying for multiple edits in 14 days cloud trial. Thanks, Sai --- ## [How to save the data obtained by using the http\_poller input plug-in of logstash to elasticsearch?](https://discuss.elastic.co/t/how-to-save-the-data-obtained-by-using-the-http-poller-input-plug-in-of-logstash-to-elasticsearch/282304)
**Author:** [@zhyp](https://discuss.elastic.co/u/zhyp)\ **Replies:** 5\ **Last updated:** [August 25, 2021, 3:06am UTC](https://discuss.elastic.co/t/how-to-save-the-data-obtained-by-using-the-http-poller-input-plug-in-of-logstash-to-elasticsearch/282304 "2021-08-25T03:06:01Z")
Hi :slightly\_smiling\_face: I use version 7.12.0. I used http\_poller to call the SQL API of elasticsearch and got some statistics. input { http\_poller { urls =\> { item =\> { method =\> post url =\> "http://localho… --- ## [Stop token filter how to set whitespace char as stop word in stopwords\_path config file](https://discuss.elastic.co/t/stop-token-filter-how-to-set-whitespace-char-as-stop-word-in-stopwords-path-config-file/280905)
**Author:** [@chenchuangc](https://discuss.elastic.co/u/chenchuangc)\ **Replies:** 2\ **Last updated:** [August 25, 2021, 2:55am UTC](https://discuss.elastic.co/t/stop-token-filter-how-to-set-whitespace-char-as-stop-word-in-stopwords-path-config-file/280905 "2021-08-25T02:55:00Z")
Elasticsearch 7.5 thank you for help me ! i want to set the stop word by the stopwords\_path , i set a lot word in the stopwords.txt file , most of the word in the file is effective but only the whitespace char is not e… --- ## [NVMe storage with Helm charts](https://discuss.elastic.co/t/nvme-storage-with-helm-charts/282428)
**Author:** [@porscheme](https://discuss.elastic.co/u/porscheme)\ **Replies:** 0\ **Last updated:** [August 25, 2021, 2:37am UTC](https://discuss.elastic.co/t/nvme-storage-with-helm-charts/282428 "2021-08-25T02:37:56Z")
Does ES helm charts support using NVMe storage? Any hep is really appreciated!. --- ## [Index not displaying expected log values](https://discuss.elastic.co/t/index-not-displaying-expected-log-values/282314)
**Author:** [@flenoir](https://discuss.elastic.co/u/flenoir)\ **Replies:** 1\ **Last updated:** [August 25, 2021, 1:20am UTC](https://discuss.elastic.co/t/index-not-displaying-expected-log-values/282314 "2021-08-25T01:20:46Z")
Hi, I'm struggling with filebeat and logstash because, i want to handle different logs ( logs and json file) as inputs and i want to have a dedicated index for all logs (first\_index and another one for json datas ( on s… --- ## [On the division of labor between packetbeat and filebeat](https://discuss.elastic.co/t/on-the-division-of-labor-between-packetbeat-and-filebeat/282379)
**Author:** [@chinaxushi](https://discuss.elastic.co/u/chinaxushi)\ **Replies:** 2\ **Last updated:** [August 25, 2021, 1:19am UTC](https://discuss.elastic.co/t/on-the-division-of-labor-between-packetbeat-and-filebeat/282379 "2021-08-25T01:19:14Z")
Today, I just noticed that filebeat can also listen to TCP or UPD traffic data, even NetFlow traffic data. Shouldn't these be the working scope of packetbeat. I feel beat's planning is a little messy! --- ## [Filebeat: initial ingestion of 2M files](https://discuss.elastic.co/t/filebeat-initial-ingestion-of-2m-files/282362)
**Author:** [@Baygon](https://discuss.elastic.co/u/Baygon)\ **Replies:** 2\ **Last updated:** [August 25, 2021, 1:03am UTC](https://discuss.elastic.co/t/filebeat-initial-ingestion-of-2m-files/282362 "2021-08-25T01:03:35Z")
I have about 2M log files to process for initial ingestion. These csv files are spread on 4 folders. I have set up a filebeat pipeline and set harvester\_limit: 0 I have also tried to set up 4 filebeat instances, modif… --- ## [Alias Index & Alias fields usability in projects](https://discuss.elastic.co/t/alias-index-alias-fields-usability-in-projects/282293)
**Author:** [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\ **Replies:** 1\ **Last updated:** [August 25, 2021, 12:57am UTC](https://discuss.elastic.co/t/alias-index-alias-fields-usability-in-projects/282293 "2021-08-25T00:57:02Z")
Hi, I'm using different indices names and different fields. But i'm required to build common dashboards for them all. I can't really change any of my indices or fields as they are important & can't change them. I hav… --- ## [Mappings missing after rollover](https://discuss.elastic.co/t/mappings-missing-after-rollover/282295)
**Author:** [@Shashankdevaraj](https://discuss.elastic.co/u/Shashankdevaraj)\ **Replies:** 1\ **Last updated:** [August 25, 2021, 12:56am UTC](https://discuss.elastic.co/t/mappings-missing-after-rollover/282295 "2021-08-25T00:56:28Z")
Hi, After a rollover through ILM, recent additions to the mappings of the index, will not reflect in the latest rolled over one This will result in 'status': 400, 'error': {'type': 'strict\_dynamic\_mapping\_exception', '… --- ## [S3 CSV Codec - Using a non printable character as separator](https://discuss.elastic.co/t/s3-csv-codec-using-a-non-printable-character-as-separator/282262)
**Author:** [@Hammond95](https://discuss.elastic.co/u/Hammond95)\ **Replies:** 4\ **Last updated:** [August 25, 2021, 12:55am UTC](https://discuss.elastic.co/t/s3-csv-codec-using-a-non-printable-character-as-separator/282262 "2021-08-25T00:55:47Z")
Is it possible to use a non printable character as a separator in the csv codec? codec =\> csv { columns =\> \["col1", "col2", "col3"\] charset =\> "UTF-8" separator =\> "\\\\u001F" } I have tried… --- ## [Python - How to upload jsonl file to Elasticsearch](https://discuss.elastic.co/t/python-how-to-upload-jsonl-file-to-elasticsearch/282408)
**Author:** [@Talents](https://discuss.elastic.co/u/Talents)\ **Replies:** 1\ **Last updated:** [August 25, 2021, 12:53am UTC](https://discuss.elastic.co/t/python-how-to-upload-jsonl-file-to-elasticsearch/282408 "2021-08-25T00:53:22Z")
So I'm trying to learn how to use Elasticsearch but I'm really struggling. I've tried looking at the official documentation but it's really not helping me. Basically what I'm trying to do is upload a jsonl file that has… --- ## [Why elasticsearch Downs After Reboot](https://discuss.elastic.co/t/why-elasticsearch-downs-after-reboot/281678)
**Author:** [@mertkaant](https://discuss.elastic.co/u/mertkaant)\ **Replies:** 5\ **Last updated:** [August 24, 2021, 10:15pm UTC](https://discuss.elastic.co/t/why-elasticsearch-downs-after-reboot/281678 "2021-08-24T22:15:02Z")
Hello, dear community, Recently we faced some critical errors in elasticsearch. The errors down below occurred after we rebooted the machines. #Issue: Failed to Read keystore Password on Console The problem was Elasti… --- ## [Syslog data from external device into ELK Stack](https://discuss.elastic.co/t/syslog-data-from-external-device-into-elk-stack/282287)
**Author:** [@pooch](https://discuss.elastic.co/u/pooch)\ **Replies:** 3\ **Last updated:** [August 24, 2021, 10:03pm UTC](https://discuss.elastic.co/t/syslog-data-from-external-device-into-elk-stack/282287 "2021-08-24T22:03:49Z")
I have ELK collecting logs from all of my pods within my Kubernetes cluster. I would also like to collect logs from an external PA firewall (syslog) and have them processed into Elasticsearch. I am a bit confused on how … --- ## [How to do parallel filter search of 1M queries in minimal time?](https://discuss.elastic.co/t/how-to-do-parallel-filter-search-of-1m-queries-in-minimal-time/282023)
**Author:** [@elastic\_yogi](https://discuss.elastic.co/u/elastic_yogi)\ **Replies:** 5\ **Last updated:** [August 24, 2021, 8:43pm UTC](https://discuss.elastic.co/t/how-to-do-parallel-filter-search-of-1m-queries-in-minimal-time/282023 "2021-08-24T20:43:25Z")
Hi, I would like to search 1M filter queries in parallel in order to reduce the search time. This means a boolean query with 1M filter values, an no ordering is necessary. My index size is about 1GB, and I've stored ever… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1266) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1268)