# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1558 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1559 --- ## [Filebeat configuration (o365 module) is not working](https://discuss.elastic.co/t/filebeat-configuration-o365-module-is-not-working/264089)
**Author:** [@riahc3](https://discuss.elastic.co/u/riahc3)\ **Replies:** 0\ **Last updated:** [February 12, 2021, 7:59am UTC](https://discuss.elastic.co/t/filebeat-configuration-o365-module-is-not-working/264089 "2021-02-12T07:59:22Z")
Hello Im trying to configure the 0365 module with this: # List of content-types to fetch. By default all known content-types # are retrieved: var.content\_type: - "Audit.AzureActiveDirectory" # - "Audit.Exchange" … --- ## [Filebeat to ingest raw cloudtrail logs](https://discuss.elastic.co/t/filebeat-to-ingest-raw-cloudtrail-logs/264086)
**Author:** [@p1k4chu](https://discuss.elastic.co/u/p1k4chu)\ **Replies:** 0\ **Last updated:** [February 12, 2021, 7:36am UTC](https://discuss.elastic.co/t/filebeat-to-ingest-raw-cloudtrail-logs/264086 "2021-02-12T07:36:02Z")
Hello, I have raw cloudtrail logs in archives stored on a disk. How can I ingest them to elasticsearch instead of S3 input or direct cloudtrail input. --- ## [Need to setup cpu,memory,disk dashboards in kibana](https://discuss.elastic.co/t/need-to-setup-cpu-memory-disk-dashboards-in-kibana/263295)
**Author:** [@charanteja](https://discuss.elastic.co/u/charanteja)\ **Replies:** 6\ **Last updated:** [February 12, 2021, 6:17am UTC](https://discuss.elastic.co/t/need-to-setup-cpu-memory-disk-dashboards-in-kibana/263295 "2021-02-12T06:17:29Z")
I am fairly new to ELK and going thru dis portal is kind of helping me a little bit. I saw you are active and knowledgable in ELK. Could you help me in setting my visualization so I could set up the dashboards for my ne… --- ## [Indexing time issue after upgrading 7.7.1 to 7.10.1](https://discuss.elastic.co/t/indexing-time-issue-after-upgrading-7-7-1-to-7-10-1/261777)
**Author:** [@Evgeny\_Dekhtyarev](https://discuss.elastic.co/u/Evgeny_Dekhtyarev)\ **Replies:** 4\ **Last updated:** [February 12, 2021, 5:22am UTC](https://discuss.elastic.co/t/indexing-time-issue-after-upgrading-7-7-1-to-7-10-1/261777 "2021-02-12T05:22:51Z")
Hello everyone! Thanks for your product! We have several Elasticsearch clusters and one of them has a problem when upgrading from 7.7.1 to 7.10.1. We needed an update due to a problem with the circuit breaker (https:/… --- ## [How to enable kibana\_system user for kibana application](https://discuss.elastic.co/t/how-to-enable-kibana-system-user-for-kibana-application/263949)
**Author:** [@kasim123](https://discuss.elastic.co/u/kasim123)\ **Replies:** 6\ **Last updated:** [February 12, 2021, 5:20am UTC](https://discuss.elastic.co/t/how-to-enable-kibana-system-user-for-kibana-application/263949 "2021-02-12T05:20:00Z")
Hi Team, We have one EFK stack running on 7.4.X version with X-pack security enabled and we defined elastic user for kibana application and everything works so far. Now we are trying to use 7.9 version of EFK with same… --- ## [Parsing USG Pro Firewall logs using GROK](https://discuss.elastic.co/t/parsing-usg-pro-firewall-logs-using-grok/264078)
**Author:** [@jaysbeekay](https://discuss.elastic.co/u/jaysbeekay)\ **Replies:** 2\ **Last updated:** [February 12, 2021, 4:36am UTC](https://discuss.elastic.co/t/parsing-usg-pro-firewall-logs-using-grok/264078 "2021-02-12T04:36:31Z")
I have managed to stand up an ELK stack on an Ubuntu host to bring in my NGINX logs, which is all working well. I have now tried to expand this to bring in firewall logs from my USG Pro Firewall and am running into some… --- ## [Elasticsearch.py scanerror](https://discuss.elastic.co/t/elasticsearch-py-scanerror/264074)
**Author:** [@diego.ss](https://discuss.elastic.co/u/diego.ss)\ **Replies:** 0\ **Last updated:** [February 12, 2021, 2:02am UTC](https://discuss.elastic.co/t/elasticsearch-py-scanerror/264074 "2021-02-12T02:02:34Z")
Hello, I'm having a similar problem with elasticsearch-py as in the discussion below, except for the fact that my problem is with the version 6. https://discuss.elastic.co/t/elasticsearch-dsl-python-scanerror/201980. … --- ## [Logstash kv field\_split regex](https://discuss.elastic.co/t/logstash-kv-field-split-regex/264058)
**Author:** [@newmember](https://discuss.elastic.co/u/newmember)\ **Replies:** 2\ **Last updated:** [February 12, 2021, 1:10am UTC](https://discuss.elastic.co/t/logstash-kv-field-split-regex/264058 "2021-02-12T01:10:26Z")
I am using logstash 2.4.0 for business reasons. Does the field\_split split on each of these characters: (,\\r,\\n,|,\\n,),\\t OR using regex does the split recognize the OR option in the brackets? (\\r\\n|\\n)\\t kv { … --- ## [Thread waitedTime is more while connecting to elastic](https://discuss.elastic.co/t/thread-waitedtime-is-more-while-connecting-to-elastic/264024)
**Author:** [@Sumaiya](https://discuss.elastic.co/u/Sumaiya)\ **Replies:** 1\ **Last updated:** [February 12, 2021, 12:59am UTC](https://discuss.elastic.co/t/thread-waitedtime-is-more-while-connecting-to-elastic/264024 "2021-02-12T00:59:04Z")
Hello All , One of our spring boot micro service connecting to elastic has high response time , while the took time itself is 50ms the service response time is high . After taking couple of threaddumps I see there are i… --- ## [Syslog cef + logstash + security device logs parsing issues](https://discuss.elastic.co/t/syslog-cef-logstash-security-device-logs-parsing-issues/264070)
**Author:** [@Xor44](https://discuss.elastic.co/u/Xor44)\ **Replies:** 0\ **Last updated:** [February 12, 2021, 12:39am UTC](https://discuss.elastic.co/t/syslog-cef-logstash-security-device-logs-parsing-issues/264070 "2021-02-12T00:39:47Z")
Hello , I'm beginning with logstash, I need a help to understand why CEF logs sent by security equipment are not parsed correctly. I am using the filter below but some fields are not named correctly. here is an sample … --- ## [SAML Returning 304 Error](https://discuss.elastic.co/t/saml-returning-304-error/264033)
**Author:** [@teej](https://discuss.elastic.co/u/teej)\ **Replies:** 1\ **Last updated:** [February 11, 2021, 11:53pm UTC](https://discuss.elastic.co/t/saml-returning-304-error/264033 "2021-02-11T23:53:52Z")
Hi, I have a system currently using AD to authenticate users. Recently, they've asked for SAML to be used as a primary realm. Problem is when I try to bring up Kibana I get "Error 403 - Forbidden". The logs show: {"ty… --- ## [Compare a vector to a list of vectors contained in each document](https://discuss.elastic.co/t/compare-a-vector-to-a-list-of-vectors-contained-in-each-document/263905)
**Author:** [@flavienbwk](https://discuss.elastic.co/u/flavienbwk)\ **Replies:** 1\ **Last updated:** [February 11, 2021, 11:04pm UTC](https://discuss.elastic.co/t/compare-a-vector-to-a-list-of-vectors-contained-in-each-document/263905 "2021-02-11T23:04:54Z")
Hi, Each of my documents contain a list of dense\_vectors inside a nested object : words.vector I try to compare my input vector to all documents' words.vector properties. I currently try with the following but elastic… --- ## [Azure Activity logs issue](https://discuss.elastic.co/t/azure-activity-logs-issue/264061)
**Author:** [@renadoz](https://discuss.elastic.co/u/renadoz)\ **Replies:** 0\ **Last updated:** [February 11, 2021, 10:35pm UTC](https://discuss.elastic.co/t/azure-activity-logs-issue/264061 "2021-02-11T22:35:40Z")
Dear Community, I am having an issue with getting azure activity logs in Kibana in a proper format. It is like azure activity logs are not fully reflected on kibana side. Although it is the same log, several fields ar… --- ## [Forced Awareness Setting](https://discuss.elastic.co/t/forced-awareness-setting/264060)
**Author:** [@abdulazizali77](https://discuss.elastic.co/u/abdulazizali77)\ **Replies:** 0\ **Last updated:** [February 11, 2021, 10:27pm UTC](https://discuss.elastic.co/t/forced-awareness-setting/264060 "2021-02-11T22:27:35Z")
Hi Currently im testing 7.2 from a zip file in a development environment on Windows 10. I apologize if this has been thoroughly explained elsewhere but Ive looked at a few of the old forced awareness topics here and i … --- ## [Grok for time with UUUU](https://discuss.elastic.co/t/grok-for-time-with-uuuu/264040)
**Author:** [@newmember](https://discuss.elastic.co/u/newmember)\ **Replies:** 2\ **Last updated:** [February 11, 2021, 9:57pm UTC](https://discuss.elastic.co/t/grok-for-time-with-uuuu/264040 "2021-02-11T21:57:28Z")
I am reading this in the grok patterns pages but I dont see a syntax for the time format. # datestamp is YYYY/MM/DD-HH:MM:SS.UUUU (or something like it) Is there a grok pattern for this time format? 10:02:19.9830 --- ## [Long and float fields showing up as text fields in Kibana](https://discuss.elastic.co/t/long-and-float-fields-showing-up-as-text-fields-in-kibana/263921)
**Author:** [@asnyameeteen](https://discuss.elastic.co/u/asnyameeteen)\ **Replies:** 0\ **Last updated:** [February 10, 2021, 6:37pm UTC](https://discuss.elastic.co/t/long-and-float-fields-showing-up-as-text-fields-in-kibana/263921 "2021-02-10T18:37:49Z")
Running Kibana version 5.5.2. My current setup is Logstash is taking the logs from Docker containers, runs grok filters before sending the logs to elasticsearch. The specific logs that I need to show up as long, float a… --- ## [New index name after rollover](https://discuss.elastic.co/t/new-index-name-after-rollover/264055)
**Author:** [@Yenii\_Ceri](https://discuss.elastic.co/u/Yenii_Ceri)\ **Replies:** 0\ **Last updated:** [February 11, 2021, 9:04pm UTC](https://discuss.elastic.co/t/new-index-name-after-rollover/264055 "2021-02-11T21:04:02Z")
Hi, I'm creating a hot worm architecture cluster, I would like to implement ILM with rollover but I which to have a different name for the indexes after rollover: For example with an index name: winlogbeat-10, the name… --- ## [Translate Filter plugin for a real CSV](https://discuss.elastic.co/t/translate-filter-plugin-for-a-real-csv/263940)
**Author:** [@jchaves506](https://discuss.elastic.co/u/jchaves506)\ **Replies:** 3\ **Last updated:** [February 11, 2021, 8:02pm UTC](https://discuss.elastic.co/t/translate-filter-plugin-for-a-real-csv/263940 "2021-02-11T20:02:10Z")
Hello I have a big CSV file(10 columns, 40Mb) that I want to use as a dictionary using the translate filter. I'm already doing that with a little csv files (2 columns, 4kb) and that is working fine. I'm doing it like th… --- ## [Mysql schema logs push to logstash](https://discuss.elastic.co/t/mysql-schema-logs-push-to-logstash/264016)
**Author:** [@psganeshk](https://discuss.elastic.co/u/psganeshk)\ **Replies:** 2\ **Last updated:** [February 11, 2021, 7:59pm UTC](https://discuss.elastic.co/t/mysql-schema-logs-push-to-logstash/264016 "2021-02-11T19:59:19Z")
Logstash config file '' input { jdbc { clean\_run =\> true jdbc\_validate\_connection =\> true jdbc\_driver\_library =\> 'C:\\Program Files (x86)\\MySQL\\Connector J 8 0\\mysql-connector-java-8.0.22.jar' jdbc\_driver\_class =\> … --- ## [URGENT.. PLEASE HELP : Not able to execute a procedure from logstash jdbc\_filter](https://discuss.elastic.co/t/urgent-please-help-not-able-to-execute-a-procedure-from-logstash-jdbc-filter/263858)
**Author:** [@Melvin\_Shaju](https://discuss.elastic.co/u/Melvin_Shaju)\ **Replies:** 1\ **Last updated:** [February 11, 2021, 7:56pm UTC](https://discuss.elastic.co/t/urgent-please-help-not-able-to-execute-a-procedure-from-logstash-jdbc-filter/263858 "2021-02-11T19:56:42Z")
I'm getting this following error when trying to execute a mysql procedure call from logstash. This procedure is getting successfully executed through mysql command line. The error is jdbcstreaming - Exception when exec… --- ## [Error when using template generated by ECS Tooling (1.7 and master) for datastream](https://discuss.elastic.co/t/error-when-using-template-generated-by-ecs-tooling-1-7-and-master-for-datastream/263016)
**Author:** [@mxu](https://discuss.elastic.co/u/mxu)\ **Replies:** 7\ **Last updated:** [February 11, 2021, 7:38pm UTC](https://discuss.elastic.co/t/error-when-using-template-generated-by-ecs-tooling-1-7-and-master-for-datastream/263016 "2021-02-11T19:38:21Z")
ECS Tooling (1.7.0 and master) generates template as following with my template-settings input: { "index\_patterns":\[ "my-data-stream\*" \], "data\_stream":{ }, "mappings":{ "properties":{ … --- ## [Unable to send data to AWS MSK, getting error message: Kafka publish failed with: circuit breaker is open](https://discuss.elastic.co/t/unable-to-send-data-to-aws-msk-getting-error-message-kafka-publish-failed-with-circuit-breaker-is-open/264045)
**Author:** [@saroja](https://discuss.elastic.co/u/saroja)\ **Replies:** 0\ **Last updated:** [February 11, 2021, 6:44pm UTC](https://discuss.elastic.co/t/unable-to-send-data-to-aws-msk-getting-error-message-kafka-publish-failed-with-circuit-breaker-is-open/264045 "2021-02-11T18:44:51Z")
Dear Team, I am using filebeat agent 7.10.0 and AWS msk in my pipeline. I am getting error : Kafka publish failed with: circuit breaker is open and retryer: send unwait signal to consumer. Please suggest if anyone f… --- ## [Anamoly Initialize issues/ Create Trigger give authorization error](https://discuss.elastic.co/t/anamoly-initialize-issues-create-trigger-give-authorization-error/263796)
**Author:** [@Vimal\_Bagmar](https://discuss.elastic.co/u/Vimal_Bagmar)\ **Replies:** 1\ **Last updated:** [February 11, 2021, 7:13pm UTC](https://discuss.elastic.co/t/anamoly-initialize-issues-create-trigger-give-authorization-error/263796 "2021-02-11T19:13:59Z")
Am using Kibana endpoint from ElasticSearch cluster. Was able to create Visuals. But when I create Anamoly , I have 2 issues Anamoly is still in initialize phase since 24hr. Creating Trigger (Alerting-\>Monitors-\>N… --- ## [Lowercase analyzer filter with nested field and queries](https://discuss.elastic.co/t/lowercase-analyzer-filter-with-nested-field-and-queries/264043)
**Author:** [@kgeographer](https://discuss.elastic.co/u/kgeographer)\ **Replies:** 0\ **Last updated:** [February 11, 2021, 6:31pm UTC](https://discuss.elastic.co/t/lowercase-analyzer-filter-with-nested-field-and-queries/264043 "2021-02-11T18:31:55Z")
In v6.6 I can't get a nested query to ignore case on a search of a property in the nested object, whether I specify a custom analyzer or not. Case is ignored on non-nested fields as expected. Is this expected? Do I have… --- ## [Tooltip in Vega](https://discuss.elastic.co/t/tooltip-in-vega/263886)
**Author:** [@Pranath](https://discuss.elastic.co/u/Pranath)\ **Replies:** 5\ **Last updated:** [February 11, 2021, 5:27pm UTC](https://discuss.elastic.co/t/tooltip-in-vega/263886 "2021-02-11T17:27:38Z")
Here I wanted to show distinct 'd' field values for each 'a' field in tooltip. For text it's giving correct but A and B are overlapping and in tooltip it's giving only B. { "$schema": "https://vega.github.io/schema/ve… --- ## [Newly added Field Not available for aggregations](https://discuss.elastic.co/t/newly-added-field-not-available-for-aggregations/261050)
**Author:** [@lzukel](https://discuss.elastic.co/u/lzukel)\ **Replies:** 7\ **Last updated:** [February 11, 2021, 5:21pm UTC](https://discuss.elastic.co/t/newly-added-field-not-available-for-aggregations/261050 "2021-02-11T17:21:29Z")
Elasticsearch 7.9.1 Kibana 7.9.1 - 4 docker containers Updated the index mapping to add new field of type keyword. Waited for new index to be created. Refreshed the index pattern in Kibana. Searched for that field i… --- ## [Filebeat low throughput and many old files under harvesting](https://discuss.elastic.co/t/filebeat-low-throughput-and-many-old-files-under-harvesting/263093)
**Author:** [@aksadvance](https://discuss.elastic.co/u/aksadvance)\ **Replies:** 3\ **Last updated:** [February 11, 2021, 5:09pm UTC](https://discuss.elastic.co/t/filebeat-low-throughput-and-many-old-files-under-harvesting/263093 "2021-02-11T17:09:25Z")
Hi, I am noticing this weird problem on filebeat side. Using filebeat version=7.1 I follow this setup , Filebeat -\> Logstash -\> ES. Logstash servers have been setup with persisted queue of 20GB. filebeat is reading… --- ## [Logstash config for parsing ASA logs](https://discuss.elastic.co/t/logstash-config-for-parsing-asa-logs/262563)
**Author:** [@psycadelicgecko](https://discuss.elastic.co/u/psycadelicgecko)\ **Replies:** 2\ **Last updated:** [February 11, 2021, 5:00pm UTC](https://discuss.elastic.co/t/logstash-config-for-parsing-asa-logs/262563 "2021-02-11T17:00:27Z")
So I am brand new to ELK/Elastic so I'm sure I'm doing at least a few things wrong. I was able to find a couple examples of Logstash config files for parsing ASA logs. They are similar to what I've seen on this forum. S… --- ## [Scripted field not available in Rest API](https://discuss.elastic.co/t/scripted-field-not-available-in-rest-api/264031)
**Author:** [@Gauti](https://discuss.elastic.co/u/Gauti)\ **Replies:** 5\ **Last updated:** [February 11, 2021, 4:54pm UTC](https://discuss.elastic.co/t/scripted-field-not-available-in-rest-api/264031 "2021-02-11T16:54:26Z")
Hi All, I'm trying to fetch data from elasticsaerch using rest api, i'm able to get all the documents by running the below query GET perfchk/\_search?size=1000 I have created few scripted fields in this index, those sc… --- ## [Metricbeat AWS Module - billing metricset](https://discuss.elastic.co/t/metricbeat-aws-module-billing-metricset/263223)
**Author:** [@Jurilz](https://discuss.elastic.co/u/Jurilz)\ **Replies:** 10\ **Last updated:** [February 11, 2021, 12:27pm UTC](https://discuss.elastic.co/t/metricbeat-aws-module-billing-metricset/263223 "2021-02-11T12:27:42Z")
Good day, I'm currently trying to collect billing information from AWS by using the billing metricset of the Metricbeat AWS module, but the received data does not contain any billing information. my metricbeat.yml: me… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1557) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1559)