# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1372 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1373 --- ## [Configure filebeat to read log with frequent events](https://discuss.elastic.co/t/configure-filebeat-to-read-log-with-frequent-events/275644)
**Author:** [@SulRin](https://discuss.elastic.co/u/SulRin)\ **Replies:** 0\ **Last updated:** [June 11, 2021, 5:32am UTC](https://discuss.elastic.co/t/configure-filebeat-to-read-log-with-frequent-events/275644 "2021-06-11T05:32:50Z")
Добрый день! Подскажите как настроить filebeat, чтобы он мог работать с логом, у которого частота событий 10-20 сообщений в секунду. дебаг filebeat -e -c filebeat.yml -d "\*", так повторяется очень долго, и нет сбро… --- ## [How to parse message use ELK+Kafka](https://discuss.elastic.co/t/how-to-parse-message-use-elk-kafka/275642)
**Author:** [@tod-yangyd](https://discuss.elastic.co/u/tod-yangyd)\ **Replies:** 1\ **Last updated:** [June 11, 2021, 5:52am UTC](https://discuss.elastic.co/t/how-to-parse-message-use-elk-kafka/275642 "2021-06-11T05:52:25Z")
Recently I tried to analyzed the log with the stream：filebeat -\> kafka -\>logstash -\> ES The data stored in ES becomes the structure shown below： { “\_source”:{ “@timestamp” : "YYYY-MM-DDTHH:mm:ss.sss" … --- ## [How to do lookup based on Ip ranges](https://discuss.elastic.co/t/how-to-do-lookup-based-on-ip-ranges/275397)
**Author:** [@tahseen\_fatima](https://discuss.elastic.co/u/tahseen_fatima)\ **Replies:** 1\ **Last updated:** [June 11, 2021, 5:38am UTC](https://discuss.elastic.co/t/how-to-do-lookup-based-on-ip-ranges/275397 "2021-06-11T05:38:00Z")
Hi Team, I have requirement where I have to do lookup on ranges like, If Ip 10.10.x.xx to 10.10x.xxx matches then add fileds Firewall 10.12.xx.xx to 10.12.x.xxx matches then add fileds Application. Below is my logst… --- ## [NPX is giving npm ERR! cb.apply is not a function when making gz and br files](https://discuss.elastic.co/t/npx-is-giving-npm-err-cb-apply-is-not-a-function-when-making-gz-and-br-files/275285)
**Author:** [@mohammadawaisjavaid](https://discuss.elastic.co/u/mohammadawaisjavaid)\ **Replies:** 3\ **Last updated:** [June 11, 2021, 5:18am UTC](https://discuss.elastic.co/t/npx-is-giving-npm-err-cb-apply-is-not-a-function-when-making-gz-and-br-files/275285 "2021-06-11T05:18:43Z")
Whenever I try to run the following command to customize ELK 7.10.0 npx gzip-cli /usr/share/kibana/x-pack/plugins/security/target/public/security.chunk.4.js -e=gz -e=b I got the following error. npm ERR! cb.apply is n… --- ## [Logstash taking wrong url for Elasticserach](https://discuss.elastic.co/t/logstash-taking-wrong-url-for-elasticserach/275527)
**Author:** [@Shubham\_Dhote](https://discuss.elastic.co/u/Shubham_Dhote)\ **Replies:** 5\ **Last updated:** [June 11, 2021, 4:12am UTC](https://discuss.elastic.co/t/logstash-taking-wrong-url-for-elasticserach/275527 "2021-06-11T04:12:57Z")
Hi, I have deployed elasticserach and logstash in kubernetes cluster. And my logstash is unable to connect to elasticserach. Problem is:- my elasticserach url is:- https://my-server.com/elasticsearch And logstash is ta… --- ## [Create Field in field](https://discuss.elastic.co/t/create-field-in-field/275566)
**Author:** [@alipujaistopo](https://discuss.elastic.co/u/alipujaistopo)\ **Replies:** 2\ **Last updated:** [June 11, 2021, 2:04am UTC](https://discuss.elastic.co/t/create-field-in-field/275566 "2021-06-11T02:04:51Z")
I have a field called "request header" I want to create another field in this field. what should i do? --- ## [Kibana REST API documentation lacking](https://discuss.elastic.co/t/kibana-rest-api-documentation-lacking/275521)
**Author:** [@Sjaak01](https://discuss.elastic.co/u/Sjaak01)\ **Replies:** 2\ **Last updated:** [June 11, 2021, 12:07am UTC](https://discuss.elastic.co/t/kibana-rest-api-documentation-lacking/275521 "2021-06-11T00:07:31Z")
Hello, I'm trying to use the REST API to import dashboards. It seems this shouldn't be that difficult but the due to the poor state of the documentation this is proving a lot harder than it should be. The query param… --- ## [Watcher does not get triggered properly](https://discuss.elastic.co/t/watcher-does-not-get-triggered-properly/275630)
**Author:** [@mhmtsvr](https://discuss.elastic.co/u/mhmtsvr)\ **Replies:** 0\ **Last updated:** [June 10, 2021, 10:45pm UTC](https://discuss.elastic.co/t/watcher-does-not-get-triggered-properly/275630 "2021-06-10T22:45:49Z")
Hi, I have a watcher notifying the slack channel once elastic receives any logs regarding the query I set. It usually triggers, but I sometimes observe that the watcher does not get triggered even though logs are availa… --- ## [Creating PDF report via watcher - 404 error](https://discuss.elastic.co/t/creating-pdf-report-via-watcher-404-error/275557)
**Author:** [@anmmok](https://discuss.elastic.co/u/anmmok)\ **Replies:** 2\ **Last updated:** [June 10, 2021, 9:49pm UTC](https://discuss.elastic.co/t/creating-pdf-report-via-watcher-404-error/275557 "2021-06-10T21:49:58Z")
I'm trying to create and send a pdf report from the dashboard via watcher. The dashboard contains two simple visuals and the generation of the report directly in the dashboard works fine. Now after coping the url and s… --- ## [API and or Query to Poll for latest Alerts](https://discuss.elastic.co/t/api-and-or-query-to-poll-for-latest-alerts/275596)
**Author:** [@Robin\_Elliott](https://discuss.elastic.co/u/Robin_Elliott)\ **Replies:** 2\ **Last updated:** [June 10, 2021, 9:16pm UTC](https://discuss.elastic.co/t/api-and-or-query-to-poll-for-latest-alerts/275596 "2021-06-10T21:16:26Z")
Have a customer with a mature Elastic/Kibana environment with a large number of alerts defined. As such I am not wanting them to have to add additional actions/make changes to these alerts with regards to my request bel… --- ## [Is it possible to do combSum in similarity?](https://discuss.elastic.co/t/is-it-possible-to-do-combsum-in-similarity/275040)
**Author:** [@rabbit0v0](https://discuss.elastic.co/u/rabbit0v0)\ **Replies:** 1\ **Last updated:** [June 10, 2021, 9:08pm UTC](https://discuss.elastic.co/t/is-it-possible-to-do-combsum-in-similarity/275040 "2021-06-10T21:08:56Z")
I wonder if I can calculate the similarity by adding up tf-idf score and BM25 score, is there a way to do it? --- ## [Mapping for versioned K,V pairs](https://discuss.elastic.co/t/mapping-for-versioned-k-v-pairs/275354)
**Author:** [@abhishekc92](https://discuss.elastic.co/u/abhishekc92)\ **Replies:** 1\ **Last updated:** [June 10, 2021, 9:06pm UTC](https://discuss.elastic.co/t/mapping-for-versioned-k-v-pairs/275354 "2021-06-10T21:06:17Z")
Hi, I'm trying to come up with a mapping for a document storing versioned custom key value pairs. Eg. version : "1" =\> \[{key : "customkey1", value : "val1"}, {key : "customkey2", value : "val2"}..\] version: "2" =\> \[{k… --- ## [Count the chattiest server](https://discuss.elastic.co/t/count-the-chattiest-server/275412)
**Author:** [@A\_Mightiev](https://discuss.elastic.co/u/A_Mightiev)\ **Replies:** 1\ **Last updated:** [June 10, 2021, 8:59pm UTC](https://discuss.elastic.co/t/count-the-chattiest-server/275412 "2021-06-10T20:59:59Z")
Hi I am getting logs from different servers and I would like to get a watcher where it will count the number of errors reported and trigger a response after certain threshold. I have it worked but it counts all errors o… --- ## [Is it possible to process AWS Cloudwatch logs using the nginx module?](https://discuss.elastic.co/t/is-it-possible-to-process-aws-cloudwatch-logs-using-the-nginx-module/275438)
**Author:** [@ndtreviv](https://discuss.elastic.co/u/ndtreviv)\ **Replies:** 5\ **Last updated:** [June 10, 2021, 8:34pm UTC](https://discuss.elastic.co/t/is-it-possible-to-process-aws-cloudwatch-logs-using-the-nginx-module/275438 "2021-06-10T20:34:48Z")
I have a service deployed to ECS which is basically an nginx instance. I want to ingest the logs using filebeat - I can do this using the aws cloudwatch input type, but it doesn't grok the message field like the nginx m… --- ## [Is it possible to obtain results with different term queries that each could have a percentage weight?](https://discuss.elastic.co/t/is-it-possible-to-obtain-results-with-different-term-queries-that-each-could-have-a-percentage-weight/275578)
**Author:** [@mstirling](https://discuss.elastic.co/u/mstirling)\ **Replies:** 1\ **Last updated:** [June 10, 2021, 8:25pm UTC](https://discuss.elastic.co/t/is-it-possible-to-obtain-results-with-different-term-queries-that-each-could-have-a-percentage-weight/275578 "2021-06-10T20:25:00Z")
Does anyone know if it's possible to obtain results to use an alternative term search based on a percentage? For example Imagine I have an Apple index. I'd like to have 40% of the results to be color red while 60% to be… --- ## [Logstash communication | configuration](https://discuss.elastic.co/t/logstash-communication-configuration/275331)
**Author:** [@farciarz121](https://discuss.elastic.co/u/farciarz121)\ **Replies:** 7\ **Last updated:** [June 10, 2021, 8:02pm UTC](https://discuss.elastic.co/t/logstash-communication-configuration/275331 "2021-06-10T20:02:57Z")
I am traying to send logs from beats to logs to ES cloud. 5 beats are hosted on IP addresses from 192.168.1.10-15. Logstash is installed on 192.168.1.100 node. Here is example of part of packet beat conf file from one … --- ## [Will Filebeat Traefik module parse CLF or JSON access logs?](https://discuss.elastic.co/t/will-filebeat-traefik-module-parse-clf-or-json-access-logs/274781)
**Author:** [@bluepuma77](https://discuss.elastic.co/u/bluepuma77)\ **Replies:** 2\ **Last updated:** [June 10, 2021, 7:54pm UTC](https://discuss.elastic.co/t/will-filebeat-traefik-module-parse-clf-or-json-access-logs/274781 "2021-06-10T19:54:10Z")
I check the documentation but it doesn't tell if the module will parse the CLF or JSON log file format of Traefik? Which format should I use? Cheers bluepuma --- ## [How to extract specific data from extraction query response](https://discuss.elastic.co/t/how-to-extract-specific-data-from-extraction-query-response/275349)
**Author:** [@marifwanna](https://discuss.elastic.co/u/marifwanna)\ **Replies:** 2\ **Last updated:** [June 10, 2021, 7:51pm UTC](https://discuss.elastic.co/t/how-to-extract-specific-data-from-extraction-query-response/275349 "2021-06-10T19:51:00Z")
I am using an extraction query in monitor to alert me in case the email I send to a user bounces. I am able to get the trigger to work and receive an alert on slack I would like to include the user's email in the alert … --- ## [Ingest AWS-CloudTrail Logs](https://discuss.elastic.co/t/ingest-aws-cloudtrail-logs/273464)
**Author:** [@vishakh](https://discuss.elastic.co/u/vishakh)\ **Replies:** 10\ **Last updated:** [June 10, 2021, 7:45pm UTC](https://discuss.elastic.co/t/ingest-aws-cloudtrail-logs/273464 "2021-06-10T19:45:46Z")
I’m trying to extract & ingest AWS-Cloudtrail logs using Filebeat-7.10.0 AWS-module. I’m seeing the below error when filebeat is started & fails in starting further until I disable the AWS filebeat module. {"file.name"… --- ## [Kibana repeats data in a table](https://discuss.elastic.co/t/kibana-repeats-data-in-a-table/275595)
**Author:** [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\ **Replies:** 3\ **Last updated:** [June 10, 2021, 7:09pm UTC](https://discuss.elastic.co/t/kibana-repeats-data-in-a-table/275595 "2021-06-10T19:09:44Z")
Hello I have an error when displaying data from a table in kibana, what happens is that the data is repeated and does not show me real data. and in the discover if it shows me the correct data: --- ## [How to get the heap size used by an indices?](https://discuss.elastic.co/t/how-to-get-the-heap-size-used-by-an-indices/275531)
**Author:** [@rebug](https://discuss.elastic.co/u/rebug)\ **Replies:** 1\ **Last updated:** [June 10, 2021, 6:37pm UTC](https://discuss.elastic.co/t/how-to-get-the-heap-size-used-by-an-indices/275531 "2021-06-10T18:37:53Z")
Hello, I would like to know is there a possibility to get the heap used by a particular indices in elastic search ? Thanks :grinning: --- ## [Module for Hardware Monitoring - iDRAC and iLO](https://discuss.elastic.co/t/module-for-hardware-monitoring-idrac-and-ilo/275609)
**Author:** [@albertosoares](https://discuss.elastic.co/u/albertosoares)\ **Replies:** 0\ **Last updated:** [June 10, 2021, 6:23pm UTC](https://discuss.elastic.co/t/module-for-hardware-monitoring-idrac-and-ilo/275609 "2021-06-10T18:23:25Z")
Hello, I would like to collect data from iDRAC and iLO. My intention is to send Syslog messages to Elasticsearch, but before I do it, I would like to know if there are other ways to do it. For example, a module of logst… --- ## [Geocoding using Pelias](https://discuss.elastic.co/t/geocoding-using-pelias/275575)
**Author:** [@element119](https://discuss.elastic.co/u/element119)\ **Replies:** 2\ **Last updated:** [June 10, 2021, 5:59pm UTC](https://discuss.elastic.co/t/geocoding-using-pelias/275575 "2021-06-10T17:59:35Z")
Hi all, very new to Elastick Stack and Pelias... I've searched everything I can think of for a solution but haven't found anything which tells me there's something glaringly obvious I've missed. What I have Elasticsear… --- ## [Yarn kbn bootstrap](https://discuss.elastic.co/t/yarn-kbn-bootstrap/275603)
**Author:** [@Akhil2](https://discuss.elastic.co/u/Akhil2)\ **Replies:** 6\ **Last updated:** [June 10, 2021, 5:57pm UTC](https://discuss.elastic.co/t/yarn-kbn-bootstrap/275603 "2021-06-10T17:57:09Z")
Hello there, I am trying to build Kibana from the source and following this link. but when I run yarn kbn bootstrap. I received the following error. D:\\Kibana-development\\kibana\>yarn kbn bootstrap yarn run v1.22.1 $… --- ## [Aggregate filter: How to delete the event when no matching task\_id found within the timeout?](https://discuss.elastic.co/t/aggregate-filter-how-to-delete-the-event-when-no-matching-task-id-found-within-the-timeout/275375)
**Author:** [@subash](https://discuss.elastic.co/u/subash)\ **Replies:** 3\ **Last updated:** [June 10, 2021, 4:39pm UTC](https://discuss.elastic.co/t/aggregate-filter-how-to-delete-the-event-when-no-matching-task-id-found-within-the-timeout/275375 "2021-06-10T16:39:09Z")
Hi, I am using aggregate filter in Logstash to merge the events based on task\_id. The problem is, I don't want to push the event when no matching task\_id found within the given timeout. Please pour you ideas to achiev… --- ## [Failed to parse field \[eAgent.tstEvent\] of type \[date\]](https://discuss.elastic.co/t/failed-to-parse-field-eagent-tstevent-of-type-date/275576)
**Author:** [@vaclav1](https://discuss.elastic.co/u/vaclav1)\ **Replies:** 1\ **Last updated:** [June 10, 2021, 4:35pm UTC](https://discuss.elastic.co/t/failed-to-parse-field-eagent-tstevent-of-type-date/275576 "2021-06-10T16:35:11Z")
Dear team, I have used date filter plugin to parse the date field: date { match =\> \[ "\[message\]\[tstEventPlan\]", "yyyy-MM-dd HH:mm:ss'.'SSS" \] remove\_field =\> \[ "\[message\]\[tstEventPlan\]" \] target =\> "\[eAgent\]\[t… --- ## [Logstash Elasticsearch plugin compare inputs](https://discuss.elastic.co/t/logstash-elasticsearch-plugin-compare-inputs/275152)
**Author:** [@Armen\_Petrosyan](https://discuss.elastic.co/u/Armen_Petrosyan)\ **Replies:** 6\ **Last updated:** [June 10, 2021, 4:07pm UTC](https://discuss.elastic.co/t/logstash-elasticsearch-plugin-compare-inputs/275152 "2021-06-10T16:07:21Z")
I have logstash configured to have two inputs from different ES clusters input { elasticsearch { hosts =\> \["xxx:111"\] ssl =\> true user =\> "" password =\> "" ca\_file =\> "" … --- ## [Elaticsearch multiMatchQuery with wildcard](https://discuss.elastic.co/t/elaticsearch-multimatchquery-with-wildcard/275590)
**Author:** [@saiteja](https://discuss.elastic.co/u/saiteja)\ **Replies:** 0\ **Last updated:** [June 10, 2021, 3:08pm UTC](https://discuss.elastic.co/t/elaticsearch-multimatchquery-with-wildcard/275590 "2021-06-10T15:08:27Z")
Hello, I have a requirement to search in all the fileds data with wild card in java using elaticsearch spring data in spring boot Here is my code String queryString = "362\*"; final Query searchQuery = new… --- ## [Parsing result from custom Beats](https://discuss.elastic.co/t/parsing-result-from-custom-beats/275574)
**Author:** [@blackberrySherbet](https://discuss.elastic.co/u/blackberrySherbet)\ **Replies:** 1\ **Last updated:** [June 10, 2021, 3:05pm UTC](https://discuss.elastic.co/t/parsing-result-from-custom-beats/275574 "2021-06-10T15:05:06Z")
I have created my own Beats and I am passing data from that Beats to logstash. This is what I get when I print to stdout in logstash(stdout { codec =\> "rubydebug"}) { "agent" =\> { "type" =\> "cu… --- ## [Lookup for IP range](https://discuss.elastic.co/t/lookup-for-ip-range/275520)
**Author:** [@abhishek30](https://discuss.elastic.co/u/abhishek30)\ **Replies:** 1\ **Last updated:** [June 10, 2021, 2:57pm UTC](https://discuss.elastic.co/t/lookup-for-ip-range/275520 "2021-06-10T14:57:17Z")
Hi, I would like to perform lookup for IP range in logstash pipeline. IP ranges meaning 10.0.0.0 to 10.255.255.0. Kindly Help Thanks & Regards Abhishek [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1371) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1373)