# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1313 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1314 --- ## [How to strip events from message field? Logstash syslog](https://discuss.elastic.co/t/how-to-strip-events-from-message-field-logstash-syslog/279110)
**Author:** [@RaonyO](https://discuss.elastic.co/u/RaonyO)\ **Replies:** 7\ **Last updated:** [July 21, 2021, 2:21pm UTC](https://discuss.elastic.co/t/how-to-strip-events-from-message-field-logstash-syslog/279110 "2021-07-21T14:21:08Z")
hello guys, i'm trying to send logs from a syslog-ng server to logstash and logstash to elasticsearch, but all events are coming in the message field. Is it possible to separate these events to create a new field for eac… --- ## [Filtering, sorting and paginate nested object list](https://discuss.elastic.co/t/filtering-sorting-and-paginate-nested-object-list/279078)
**Author:** [@nickcigna](https://discuss.elastic.co/u/nickcigna)\ **Replies:** 1\ **Last updated:** [July 21, 2021, 2:20pm UTC](https://discuss.elastic.co/t/filtering-sorting-and-paginate-nested-object-list/279078 "2021-07-21T14:20:02Z")
Hello everybody, I have an index that contains documents with the following structure. ///SHOWS INDEX { "\_id", "artists":\[ -----\> NESTED OBJECT LIST { "id": "1", "name": "text" }, { "id": "2", "… --- ## [How to create a text box in a visualization in kibana vega](https://discuss.elastic.co/t/how-to-create-a-text-box-in-a-visualization-in-kibana-vega/277256)
**Author:** [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\ **Replies:** 2\ **Last updated:** [July 21, 2021, 2:10pm UTC](https://discuss.elastic.co/t/how-to-create-a-text-box-in-a-visualization-in-kibana-vega/277256 "2021-07-21T14:10:07Z")
Hello, I have a visualization in kibana - vega, I already made a graph, but now I want to add a text below the "Estado" bar, I do not know if there is the possibility of putting some text there already having a graph, I … --- ## [Multiple field names into single field name in elasticsearch](https://discuss.elastic.co/t/multiple-field-names-into-single-field-name-in-elasticsearch/279237)
**Author:** [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\ **Replies:** 1\ **Last updated:** [July 21, 2021, 2:05pm UTC](https://discuss.elastic.co/t/multiple-field-names-into-single-field-name-in-elasticsearch/279237 "2021-07-21T14:05:29Z")
Hi all, I'm working on a project where we need to a field to read multiple field names as same field name. Is there a way where we can configure multiple field names into one field using some method? For example, we h… --- ## [Elasticsearch ingest pipeline - not extract data passed from filebeat](https://discuss.elastic.co/t/elasticsearch-ingest-pipeline-not-extract-data-passed-from-filebeat/279039)
**Author:** [@samiusan](https://discuss.elastic.co/u/samiusan)\ **Replies:** 12\ **Last updated:** [July 21, 2021, 1:55pm UTC](https://discuss.elastic.co/t/elasticsearch-ingest-pipeline-not-extract-data-passed-from-filebeat/279039 "2021-07-21T13:55:19Z")
Hi, I'm slowly teaching myself the Elastic stack. Current project is attempting to ingest and modelling alerts from snort3 against the elastic common schema. I've run into an issue where an ingest pipeline is not correc… --- ## [Filebeat send log to kafka with haproxy module](https://discuss.elastic.co/t/filebeat-send-log-to-kafka-with-haproxy-module/279141)
**Author:** [@Andrey4ik85](https://discuss.elastic.co/u/Andrey4ik85)\ **Replies:** 6\ **Last updated:** [July 21, 2021, 1:49pm UTC](https://discuss.elastic.co/t/filebeat-send-log-to-kafka-with-haproxy-module/279141 "2021-07-21T13:49:13Z")
Hello! I am currently experiencing a problem to load haproxy module to parse logs and send it to my kafka servers. The system module has been enabled and verified using "filebeat modules list" filebeat version 7.13.3 … --- ## [Auditbeat ERROR instance/beat.go:971 Exiting: one or more modules must be configured](https://discuss.elastic.co/t/auditbeat-error-instance-beat-go-971-exiting-one-or-more-modules-must-be-configured/279272)
**Author:** [@amardeep.mahato](https://discuss.elastic.co/u/amardeep.mahato)\ **Replies:** 0\ **Last updated:** [July 21, 2021, 1:31pm UTC](https://discuss.elastic.co/t/auditbeat-error-instance-beat-go-971-exiting-one-or-more-modules-must-be-configured/279272 "2021-07-21T13:31:07Z")
Getting below error while installing auditbeat 7.12.1 on EKS cluster: auditbeat ERROR instance/beat.go:971 Exiting: one or more modules must be configured Could you please help? --- ## [Filter to select lines that contain a certain word which begins with "ANS" and which can end with a series of numbers or letters](https://discuss.elastic.co/t/filter-to-select-lines-that-contain-a-certain-word-which-begins-with-ans-and-which-can-end-with-a-series-of-numbers-or-letters/279259)
**Author:** [@boubou](https://discuss.elastic.co/u/boubou)\ **Replies:** 1\ **Last updated:** [July 21, 2021, 1:31pm UTC](https://discuss.elastic.co/t/filter-to-select-lines-that-contain-a-certain-word-which-begins-with-ans-and-which-can-end-with-a-series-of-numbers-or-letters/279259 "2021-07-21T13:31:02Z")
Hello everybody, I would like to create a filter who select lines that contain a certain word which begins with "ANS" and which can end with a series of numbers or letters. For example, I have a Tag who contains these … --- ## [Install specific version of ES on homebrew](https://discuss.elastic.co/t/install-specific-version-of-es-on-homebrew/279234)
**Author:** [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\ **Replies:** 1\ **Last updated:** [July 21, 2021, 1:15pm UTC](https://discuss.elastic.co/t/install-specific-version-of-es-on-homebrew/279234 "2021-07-21T13:15:11Z")
Hi all, I'm working in a project where we are using previous version of Elasticsearch i.e 7.11.1 . I'm supposed to use same version. When I try to download Elasticsearch on my MAC using homebrew services, I download la… --- ## [Elastic Agent 7.10.1 - Understanding/Changing Data Destination](https://discuss.elastic.co/t/elastic-agent-7-10-1-understanding-changing-data-destination/279267)
**Author:** [@cpoetzel](https://discuss.elastic.co/u/cpoetzel)\ **Replies:** 0\ **Last updated:** [July 21, 2021, 1:05pm UTC](https://discuss.elastic.co/t/elastic-agent-7-10-1-understanding-changing-data-destination/279267 "2021-07-21T13:05:06Z")
I walked into an existing ELK stack and an learning as i go. Ihave a 7.10.1 ELK Stack with around 5K Agents depolyed at 7.10.1 using Fleet. \*\* Understanding DATA Destination \*\* Under the Global Fleet Settings it says. … --- ## [Problem with filebeat "failed to add target to root"](https://discuss.elastic.co/t/problem-with-filebeat-failed-to-add-target-to-root/278740)
**Author:** [@ThreatInter](https://discuss.elastic.co/u/ThreatInter)\ **Replies:** 2\ **Last updated:** [July 21, 2021, 11:50am UTC](https://discuss.elastic.co/t/problem-with-filebeat-failed-to-add-target-to-root/278740 "2021-07-21T11:50:24Z")
Hello, I try to decode escaped\_json using "decode\_json\_fields" processor. I want to add my extracted json fields to root. But in log I see this error: DEBUG \[processors\] processing/processors.go:128 Fail to ap… --- ## [FileBeat to push logs](https://discuss.elastic.co/t/filebeat-to-push-logs/279256)
**Author:** [@Vajb12](https://discuss.elastic.co/u/Vajb12)\ **Replies:** 0\ **Last updated:** [July 21, 2021, 11:15am UTC](https://discuss.elastic.co/t/filebeat-to-push-logs/279256 "2021-07-21T11:15:58Z")
We have installed filebeat in the server where logfiles are available. In this server, we have application related logs available in individual folders split based on the associated microservice.For eg,Login related logs… --- ## [Unable to show empty buckets when using Date Histogram on @timestamp field](https://discuss.elastic.co/t/unable-to-show-empty-buckets-when-using-date-histogram-on-timestamp-field/279238)
**Author:** [@prathamesh7](https://discuss.elastic.co/u/prathamesh7)\ **Replies:** 4\ **Last updated:** [July 21, 2021, 10:32am UTC](https://discuss.elastic.co/t/unable-to-show-empty-buckets-when-using-date-histogram-on-timestamp-field/279238 "2021-07-21T10:32:00Z")
Hi Team, I am retrieving results of a query for last 7 days in visualisation, but in the response i am not seeing results for empty buckets i.e its not showing any result for that day when there is no data. There is no … --- ## [Esrally running the same track by giving multiple laps not working](https://discuss.elastic.co/t/esrally-running-the-same-track-by-giving-multiple-laps-not-working/279035)
**Author:** [@Sameera\_De\_Silva](https://discuss.elastic.co/u/Sameera_De_Silva)\ **Replies:** 7\ **Last updated:** [July 21, 2021, 10:22am UTC](https://discuss.elastic.co/t/esrally-running-the-same-track-by-giving-multiple-laps-not-working/279035 "2021-07-21T10:22:11Z")
I want to run the same track repeatedly in a loop , because I want to do the benchmark performance testing for 3 hours. When I ran without lap count, it get completed within 30 minutes. However, even when I ran with… --- ## [Logstash goes wrong after add filter](https://discuss.elastic.co/t/logstash-goes-wrong-after-add-filter/278730)
**Author:** [@quyennguyen](https://discuss.elastic.co/u/quyennguyen)\ **Replies:** 26\ **Last updated:** [July 21, 2021, 10:20am UTC](https://discuss.elastic.co/t/logstash-goes-wrong-after-add-filter/278730 "2021-07-21T10:20:07Z")
Hello everyone, I install Logstash in Ubuntu 18 with two conf.d file input and output. Everything run normally. But when I add 10-syslog-filter.conf something went wrong. 02-beat-input.conf input { beats { host… --- ## [How to remove backslash from weird formatted json](https://discuss.elastic.co/t/how-to-remove-backslash-from-weird-formatted-json/279084)
**Author:** [@MaxenceVacheron](https://discuss.elastic.co/u/MaxenceVacheron)\ **Replies:** 4\ **Last updated:** [July 21, 2021, 10:11am UTC](https://discuss.elastic.co/t/how-to-remove-backslash-from-weird-formatted-json/279084 "2021-07-21T10:11:19Z")
Hello :raised\_hand\_with\_fingers\_splayed:, I have the following (valid) formatted json of which I can't change the formatting : \[{ "id": "1", "sn": "00:1E:C0:8D:9A:CD", "log": "{\\"date\\":\\"16\\/04\\/2021\\",\\"t… --- ## [Set up dashboards for Logstash Output](https://discuss.elastic.co/t/set-up-dashboards-for-logstash-output/278989)
**Author:** [@diegz](https://discuss.elastic.co/u/diegz)\ **Replies:** 18\ **Last updated:** [July 21, 2021, 10:07am UTC](https://discuss.elastic.co/t/set-up-dashboards-for-logstash-output/278989 "2021-07-21T10:07:46Z")
Hi community, I would like to enable dashboards in kibana for metricbeat, heartbeat, filebeat and winlogbeat. On the documentation it says to pass these commands when logstash is in output. What are the settings when … --- ## [403 Forbidden when trying to send logs using Filebeat](https://discuss.elastic.co/t/403-forbidden-when-trying-to-send-logs-using-filebeat/279249)
**Author:** [@OksanaH](https://discuss.elastic.co/u/OksanaH)\ **Replies:** 0\ **Last updated:** [July 21, 2021, 10:04am UTC](https://discuss.elastic.co/t/403-forbidden-when-trying-to-send-logs-using-filebeat/279249 "2021-07-21T10:04:13Z")
I'm using Filebeat OSS licenced version 7.10, and AWS ElasticSearch 7.10. I use a reverse logging proxy and set up auth like this:proxy\_set\_header Authorization ""; When configuring Filebeat, I use Basic Auth (username… --- ## [Mapper\_parsing\_exception when trying to append object to array](https://discuss.elastic.co/t/mapper-parsing-exception-when-trying-to-append-object-to-array/279071)
**Author:** [@sandbender](https://discuss.elastic.co/u/sandbender)\ **Replies:** 5\ **Last updated:** [July 21, 2021, 9:55am UTC](https://discuss.elastic.co/t/mapper-parsing-exception-when-trying-to-append-object-to-array/279071 "2021-07-21T09:55:25Z")
Hello, I'm having trouble to append objects resulting from an enrich processor to a field, so that I'm ending up with an array of objects. This question seems to have been asked a lot but still I couldn't make it work s… --- ## [How to search \\t \\r \\n in elasticsearch?](https://discuss.elastic.co/t/how-to-search-t-r-n-in-elasticsearch/278984)
**Author:** [@MarvinLiu](https://discuss.elastic.co/u/MarvinLiu)\ **Replies:** 1\ **Last updated:** [July 19, 2021, 9:14am UTC](https://discuss.elastic.co/t/how-to-search-t-r-n-in-elasticsearch/278984 "2021-07-19T09:14:23Z")
I want to search \\t \\r \\n in my doc, how to input in query string syntax. It seems "\\n" can work , "\\n","\\n" not work , Is there any other choises? POST /test6/\_doc/2 { "id": 1002, "name": "test1", "desc"… --- ## [Delay betbeen timestamp and event.created on Winlogbeat](https://discuss.elastic.co/t/delay-betbeen-timestamp-and-event-created-on-winlogbeat/279182)
**Author:** [@smerzlyakov](https://discuss.elastic.co/u/smerzlyakov)\ **Replies:** 0\ **Last updated:** [July 20, 2021, 3:43pm UTC](https://discuss.elastic.co/t/delay-betbeen-timestamp-and-event-created-on-winlogbeat/279182 "2021-07-20T15:43:42Z")
Hello! The problem We have unpredictable flating delay betbeen timestamp and event.created, when process logs with Winlogbeat. Background We use WEF to send logs from Windows host to Windows log collector. Then we us… --- ## [Change interval while viewing a dashboard, without editing?](https://discuss.elastic.co/t/change-interval-while-viewing-a-dashboard-without-editing/279158)
**Author:** [@GrahamHannington](https://discuss.elastic.co/u/GrahamHannington)\ **Replies:** 2\ **Last updated:** [July 21, 2021, 7:50am UTC](https://discuss.elastic.co/t/change-interval-while-viewing-a-dashboard-without-editing/279158 "2021-07-21T07:50:26Z")
Background to this question Feedback from a user viewing a Kibana dashboard I've developed: can we set the interval of time-based charts to 1 hour? An excerpt of my response: Yes. However, I have deliberately set t… --- ## [CCR user permission issue. action \[cluster:admin/settings/update\] is unauthorized for user \[my-certificate-cn\]](https://discuss.elastic.co/t/ccr-user-permission-issue-action-cluster-admin-settings-update-is-unauthorized-for-user-my-certificate-cn/279055)
**Author:** [@Armen\_Petrosyan](https://discuss.elastic.co/u/Armen_Petrosyan)\ **Replies:** 4\ **Last updated:** [July 21, 2021, 7:35am UTC](https://discuss.elastic.co/t/ccr-user-permission-issue-action-cluster-admin-settings-update-is-unauthorized-for-user-my-certificate-cn/279055 "2021-07-21T07:35:49Z")
I have deployed Elasticsearch 7.7.1. I have created certificate which includes CN=my-certificate-cn and configured transport layer with it. I have created two roles - ccr\_leader and ccr\_follower in accordance with the d… --- ## [Elastic search Data fetch](https://discuss.elastic.co/t/elastic-search-data-fetch/279231)
**Author:** [@Hamendra\_Sunthwal](https://discuss.elastic.co/u/Hamendra_Sunthwal)\ **Replies:** 0\ **Last updated:** [July 21, 2021, 7:19am UTC](https://discuss.elastic.co/t/elastic-search-data-fetch/279231 "2021-07-21T07:19:07Z")
I am using below script to fetch data from Elastic search, I want to know how the data is being fetched from Magento to ES. This script get me product details in Output, but for some product the data is incorrect i need… --- ## [Packetbeat not see some trafic](https://discuss.elastic.co/t/packetbeat-not-see-some-trafic/279229)
**Author:** [@franpom](https://discuss.elastic.co/u/franpom)\ **Replies:** 0\ **Last updated:** [July 21, 2021, 7:05am UTC](https://discuss.elastic.co/t/packetbeat-not-see-some-trafic/279229 "2021-07-21T07:05:10Z")
Hello, I am trying to set up a sniffer with packetbeat. The sniffer receives the traffic via several mirroring of vlan at the level of a switch. It works very well except for a case identified on a vlan with which I ha… --- ## [Dissector mapping field not found in event](https://discuss.elastic.co/t/dissector-mapping-field-not-found-in-event/279179)
**Author:** [@gongon](https://discuss.elastic.co/u/gongon)\ **Replies:** 13\ **Last updated:** [July 21, 2021, 6:59am UTC](https://discuss.elastic.co/t/dissector-mapping-field-not-found-in-event/279179 "2021-07-21T06:59:16Z")
Hi, I used the dissect filter and it worked .Now it does not. The only change is the upgrate of mac Os Catalina to mac OS Big Sur v 11.4 A message is displayed : Dissector mapping field not found in event Could you … --- ## [\[ES v7.5.1\] Speed up snapshot restore from GCS Snapshot Repository](https://discuss.elastic.co/t/es-v7-5-1-speed-up-snapshot-restore-from-gcs-snapshot-repository/278974)
**Author:** [@amitsh728](https://discuss.elastic.co/u/amitsh728)\ **Replies:** 8\ **Last updated:** [July 21, 2021, 5:54am UTC](https://discuss.elastic.co/t/es-v7-5-1-speed-up-snapshot-restore-from-gcs-snapshot-repository/278974 "2021-07-21T05:54:44Z")
Hello, We are trying to speed up our snapshot restoration speed in our ES cluster hosted on GCP Compute instances. TL;DR: Current Performance: 56 MBps per data node Infra Capable of 500 MBps We want to improve our re… --- ## [Logstash POS Log Transaction (TLogs) to JSON](https://discuss.elastic.co/t/logstash-pos-log-transaction-tlogs-to-json/279213)
**Author:** [@Anil\_Khiani](https://discuss.elastic.co/u/Anil_Khiani)\ **Replies:** 2\ **Last updated:** [July 21, 2021, 5:45am UTC](https://discuss.elastic.co/t/logstash-pos-log-transaction-tlogs-to-json/279213 "2021-07-21T05:45:59Z")
Hi Everyone, I have below log from IBM 4690 POS systems generating Transaction Logs (TLogs) as below "::p:�:�:�:�:U:!a" ":p::D::�::�::�::!a:U: P:�:�:#:�:�:",":�!8qg4:�:�P:�::�",":�!8qg4:�:�P:�:�F:�",":�!8qg4:�:�:�::d",… --- ## [Kibana 7.10.2 build from src code failing due to socket hang up](https://discuss.elastic.co/t/kibana-7-10-2-build-from-src-code-failing-due-to-socket-hang-up/278982)
**Author:** [@shivani\_aggarwal](https://discuss.elastic.co/u/shivani_aggarwal)\ **Replies:** 2\ **Last updated:** [July 21, 2021, 5:13am UTC](https://discuss.elastic.co/t/kibana-7-10-2-build-from-src-code-failing-due-to-socket-hang-up/278982 "2021-07-21T05:13:10Z")
Hi, Kibana version: 7.10.2 I am trying to build kibana-oss rpm from src code (for centos env) following the procedure from developer guide. The required pre-req dependencies (git,gcc etc) are installed, kibana bootstr… --- ## [Metricbeat: collects k8s pods cpu which is lower than actually used](https://discuss.elastic.co/t/metricbeat-collects-k8s-pods-cpu-which-is-lower-than-actually-used/279215)
**Author:** [@SperChung-11](https://discuss.elastic.co/u/SperChung-11)\ **Replies:** 0\ **Last updated:** [July 21, 2021, 2:17am UTC](https://discuss.elastic.co/t/metricbeat-collects-k8s-pods-cpu-which-is-lower-than-actually-used/279215 "2021-07-21T02:17:31Z")
We are using metricbeat to collects k8s pods cpu. In the beginning, it can collects the cpu collectly. After running for serveral weeks or serveral months, we found that the pods cpu metricbeat collects is lower than act… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1312) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1314)