# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1771 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1772 --- ## [Elasticsearch Mapping to ECS](https://discuss.elastic.co/t/elasticsearch-mapping-to-ecs/250913)
**Author:** [@bn1980](https://discuss.elastic.co/u/bn1980)\ **Replies:** 0\ **Last updated:** [October 5, 2020, 1:37am UTC](https://discuss.elastic.co/t/elasticsearch-mapping-to-ecs/250913 "2020-10-05T01:37:40Z")
I have logstash creating a daily index index =\> "logstash-suricata-%{+YYYY.MM.dd}" In order to create a mapping i am using a template which is assigned in logstash config template =\> "/usr/local/etc/logstash/suricat… --- ## [How to increase elasticsearch disk space](https://discuss.elastic.co/t/how-to-increase-elasticsearch-disk-space/250132)
**Author:** [@hourtest](https://discuss.elastic.co/u/hourtest)\ **Replies:** 2\ **Last updated:** [October 5, 2020, 2:22am UTC](https://discuss.elastic.co/t/how-to-increase-elasticsearch-disk-space/250132 "2020-10-05T02:22:42Z")
Not enough capacity I want to increase capacity maybe 50gb to 500gb how should I do --- ## [Glob based paths in Filebeat](https://discuss.elastic.co/t/glob-based-paths-in-filebeat/250906)
**Author:** [@ajesh](https://discuss.elastic.co/u/ajesh)\ **Replies:** 1\ **Last updated:** [October 5, 2020, 1:18am UTC](https://discuss.elastic.co/t/glob-based-paths-in-filebeat/250906 "2020-10-05T01:18:18Z")
Hi Team, I am trying to find out an easy way to give the Glob based path in filebeat. Below is a sample path which we need to configure in filebeat.yml . - /oraadr/XHPROD/adump/\*.aud - /projects/oraxhph2/orabase/ad… --- ## [How to get additional information added by filebeat in the output of logstash](https://discuss.elastic.co/t/how-to-get-additional-information-added-by-filebeat-in-the-output-of-logstash/250903)
**Author:** [@linhonghui](https://discuss.elastic.co/u/linhonghui)\ **Replies:** 2\ **Last updated:** [October 5, 2020, 12:54am UTC](https://discuss.elastic.co/t/how-to-get-additional-information-added-by-filebeat-in-the-output-of-logstash/250903 "2020-10-05T00:54:30Z")
Hi I added additional information by fields option in filebeat configuration to identify application name, 'app\_id', such as, filebeat.inputs: - type: log enabled: true fields: app\_id: crawler\_164 ...... output… --- ## [Auditd events are not captured for centos](https://discuss.elastic.co/t/auditd-events-are-not-captured-for-centos/247215)
**Author:** [@ajesh](https://discuss.elastic.co/u/ajesh)\ **Replies:** 5\ **Last updated:** [October 4, 2020, 5:52pm UTC](https://discuss.elastic.co/t/auditd-events-are-not-captured-for-centos/247215 "2020-10-04T17:52:00Z")
Hi There, We are running latest version of elastic stack 7.9. One issues we observed is auditd events are not captured for Centos 7 operating systems. Audit rules are already enabled and we see the events getting captur… --- ## [Recommended JVM settings?](https://discuss.elastic.co/t/recommended-jvm-settings/250891)
**Author:** [@headtea](https://discuss.elastic.co/u/headtea)\ **Replies:** 2\ **Last updated:** [October 4, 2020, 5:50pm UTC](https://discuss.elastic.co/t/recommended-jvm-settings/250891 "2020-10-04T17:50:48Z")
this is the settings I gave logstash: -Xms2g -Xmx4g The machine has 8 cores and 24 GB of ram. My problem is that I've only added about 10-15 machines with audit&filebeat and all the cores are over 80% and some reach … --- ## [Index template setting overwrite](https://discuss.elastic.co/t/index-template-setting-overwrite/250528)
**Author:** [@jijo.john](https://discuss.elastic.co/u/jijo.john)\ **Replies:** 4\ **Last updated:** [October 4, 2020, 5:44pm UTC](https://discuss.elastic.co/t/index-template-setting-overwrite/250528 "2020-10-04T17:44:26Z")
Hi Team, I have a problem with the elasticsearch index template setting. below is a custom config i have updated in the index template setting to keep the index in hot nodes, "routing": { "allocation": { "require… --- ## [Wrong timestamp suricata module](https://discuss.elastic.co/t/wrong-timestamp-suricata-module/250876)
**Author:** [@nunex\_17](https://discuss.elastic.co/u/nunex_17)\ **Replies:** 3\ **Last updated:** [October 4, 2020, 4:34pm UTC](https://discuss.elastic.co/t/wrong-timestamp-suricata-module/250876 "2020-10-04T16:34:22Z")
Hi. I+m having a problem with my suricata logs on kibana. My server and kibana are configured with the time Europe/Lisbon. The eve.json logs are in the correct timestamp. But when i move to kibana, the logs are shown in … --- ## [Use elasticsearch index rollover policy with logstash](https://discuss.elastic.co/t/use-elasticsearch-index-rollover-policy-with-logstash/250504)
**Author:** [@Mohamed\_Saeed](https://discuss.elastic.co/u/Mohamed_Saeed)\ **Replies:** 1\ **Last updated:** [October 4, 2020, 1:13pm UTC](https://discuss.elastic.co/t/use-elasticsearch-index-rollover-policy-with-logstash/250504 "2020-10-04T13:13:01Z")
I'm using elasticsearch and logstash version 7.3.0 I'm using logstash to output all logs to elasticsearch. Now I'm trying to use the rollover policy to delete indexes older than 3 days. I defined policy in elasticsearc… --- ## [Creating alerts in Kibana for a specific query](https://discuss.elastic.co/t/creating-alerts-in-kibana-for-a-specific-query/250740)
**Author:** [@vpurushottam](https://discuss.elastic.co/u/vpurushottam)\ **Replies:** 4\ **Last updated:** [October 4, 2020, 12:13pm UTC](https://discuss.elastic.co/t/creating-alerts-in-kibana-for-a-specific-query/250740 "2020-10-04T12:13:06Z")
Hi, I am struggling with creating an alert on Kibana. I have the license and have Slack notification connected. I have logs coming in from a HIDS and from those logs, which has logs for many different kind of activities… --- ## [Winlogbeat service stopped automaticly](https://discuss.elastic.co/t/winlogbeat-service-stopped-automaticly/249026)
**Author:** [@collideroff](https://discuss.elastic.co/u/collideroff)\ **Replies:** 2\ **Last updated:** [October 4, 2020, 12:08pm UTC](https://discuss.elastic.co/t/winlogbeat-service-stopped-automaticly/249026 "2020-10-04T12:08:56Z")
Good day! I have installed winlogbeat in WindowsServer 2012R2 on EventCollector. It's was istalled properly, but service automaticly stopped after several time..abou 12 hours on more. winlogbeat.event\_logs: name: Ap… --- ## [Remove LogLevel and Logger from message in logstash?](https://discuss.elastic.co/t/remove-loglevel-and-logger-from-message-in-logstash/250896)
**Author:** [@Bhavin\_Varsur](https://discuss.elastic.co/u/Bhavin_Varsur)\ **Replies:** 0\ **Last updated:** [October 4, 2020, 11:29am UTC](https://discuss.elastic.co/t/remove-loglevel-and-logger-from-message-in-logstash/250896 "2020-10-04T11:29:53Z")
Can I able to reove loglevel and logger from message. I want to create fields level and logger and store into it and then remove from message so it will easy to filterize log in kibana. Is this possible? How ? --- ## [Copy Field from a new processed document to an old Document](https://discuss.elastic.co/t/copy-field-from-a-new-processed-document-to-an-old-document/250897)
**Author:** [@Tensoue](https://discuss.elastic.co/u/Tensoue)\ **Replies:** 0\ **Last updated:** [October 4, 2020, 11:42am UTC](https://discuss.elastic.co/t/copy-field-from-a-new-processed-document-to-an-old-document/250897 "2020-10-04T11:42:49Z")
Hi all, I am trying to copy field from a new document received in logstash to an old one exists in the elasticsearch server. For example: There are 2 events, lets call them event1 and event2 event1{name: "xyz",lastna… --- ## [Logstash pipeline](https://discuss.elastic.co/t/logstash-pipeline/250799)
**Author:** [@KRISHNAPRASAD\_HG](https://discuss.elastic.co/u/KRISHNAPRASAD_HG)\ **Replies:** 3\ **Last updated:** [October 4, 2020, 10:32am UTC](https://discuss.elastic.co/t/logstash-pipeline/250799 "2020-10-04T10:32:05Z")
Below is my pipelines.yml file but the configs not picked by logstash! Anything wrong here? pipeline.id: step1 pipeline.workers: 1 path.config: "D:/logstash-7.8.1/config/step1.conf" pipeline.id: step2 pipeline.worker… --- ## [How to configure output as webhook for filebeat?](https://discuss.elastic.co/t/how-to-configure-output-as-webhook-for-filebeat/250826)
**Author:** [@abh90](https://discuss.elastic.co/u/abh90)\ **Replies:** 2\ **Last updated:** [October 4, 2020, 10:20am UTC](https://discuss.elastic.co/t/how-to-configure-output-as-webhook-for-filebeat/250826 "2020-10-04T10:20:59Z")
I went through the output list of filebeat, webhook is not supported is what I can gather. How easy or difficult will it be to add webhook as output param for filebeat? I am already using filebeat to ship logs to elast… --- ## [Non-zero metrics in the last 30s (filebeat with docker)](https://discuss.elastic.co/t/non-zero-metrics-in-the-last-30s-filebeat-with-docker/250859)
**Author:** [@linhonghui](https://discuss.elastic.co/u/linhonghui)\ **Replies:** 4\ **Last updated:** [October 4, 2020, 9:17am UTC](https://discuss.elastic.co/t/non-zero-metrics-in-the-last-30s-filebeat-with-docker/250859 "2020-10-04T09:17:03Z")
I used docker to run filebeat and always got this message "Non-zero metrics in the last 30s". It seems not to work. file docker-compose.yml: version: '2' services: filebeat: image: elastic/filebea… --- ## [Help needed in making a query for elastic search](https://discuss.elastic.co/t/help-needed-in-making-a-query-for-elastic-search/250477)
**Author:** [@vishalYadav](https://discuss.elastic.co/u/vishalYadav)\ **Replies:** 8\ **Last updated:** [October 4, 2020, 8:20am UTC](https://discuss.elastic.co/t/help-needed-in-making-a-query-for-elastic-search/250477 "2020-10-04T08:20:26Z")
Hey,I am working on a index which has 300 fieds in it.Now there is a requirement where i have to make 2 field irrelevent for searching in that index.As of now i am using \*.\* to search . i studied somewhere we can mak… --- ## [Audit Events for Elasticsearch](https://discuss.elastic.co/t/audit-events-for-elasticsearch/250885)
**Author:** [@shrikantgulia](https://discuss.elastic.co/u/shrikantgulia)\ **Replies:** 0\ **Last updated:** [October 4, 2020, 6:06am UTC](https://discuss.elastic.co/t/audit-events-for-elasticsearch/250885 "2020-10-04T06:06:43Z")
Hello, Can someone explain me what is the difference between the Elasticsearch Audit Events and Kibana audit Events. I observed that my elasticsearch audit event file is much larger its is like 18 GB or much more than … --- ## [3 ESXi virtual machines, versus 3 dockers on a single ESXi virtual machine](https://discuss.elastic.co/t/3-esxi-virtual-machines-versus-3-dockers-on-a-single-esxi-virtual-machine/250884)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 0\ **Last updated:** [October 4, 2020, 4:04am UTC](https://discuss.elastic.co/t/3-esxi-virtual-machines-versus-3-dockers-on-a-single-esxi-virtual-machine/250884 "2020-10-04T04:04:25Z")
Currently I have 3 nodes on docker on the same virtual machine , the size of a monthly indexing is 200GB, a colleague recently install APM on elastic producing an index of 135GB so now monthly indexing is 335GB, we where… --- ## [The context.thresholdOf, context.metricOf and context.valueOf not working in inventory alert](https://discuss.elastic.co/t/the-context-thresholdof-context-metricof-and-context-valueof-not-working-in-inventory-alert/250094)
**Author:** [@mohanr](https://discuss.elastic.co/u/mohanr)\ **Replies:** 5\ **Last updated:** [October 3, 2020, 5:44pm UTC](https://discuss.elastic.co/t/the-context-thresholdof-context-metricof-and-context-valueof-not-working-in-inventory-alert/250094 "2020-10-03T17:44:25Z")
Hi, I am using the ELK 7.8.0 and making an inventory alert. I have created an action message as shown below. But I am not getting values for context.thresholdOf, context.metricOf and context.valueOf. I have also trie… --- ## [How can I indexing logs separate by their loggedtime(datetime)](https://discuss.elastic.co/t/how-can-i-indexing-logs-separate-by-their-loggedtime-datetime/250868)
**Author:** [@Bhavin\_Varsur](https://discuss.elastic.co/u/Bhavin_Varsur)\ **Replies:** 2\ **Last updated:** [October 3, 2020, 5:39pm UTC](https://discuss.elastic.co/t/how-can-i-indexing-logs-separate-by-their-loggedtime-datetime/250868 "2020-10-03T17:39:31Z")
I have 3 log files which is like this logstash-2020.10.01 logstash-2020.10.02 logstash-2020.10.03 when I run logstash (run logstash.conf pipeline) it indexing all logs in one index. but i want to index them by the t… --- ## [Cannot open data from 5.x in 6.x : Mappings](https://discuss.elastic.co/t/cannot-open-data-from-5-x-in-6-x-mappings/250346)
**Author:** [@yBother](https://discuss.elastic.co/u/yBother)\ **Replies:** 12\ **Last updated:** [October 3, 2020, 3:40pm UTC](https://discuss.elastic.co/t/cannot-open-data-from-5-x-in-6-x-mappings/250346 "2020-10-03T15:40:51Z")
I've created a routine that updates ES clients from 5.x to 6.x and finally 7.x Somehow some clients cannot be updated. Loading existing data in 6.8 fails. Appearently some mappings are causing this. But there are not… --- ## [Elasticsearch ignores the \`xpack.security.transport.ssl.certificate\_authorities\` parameter](https://discuss.elastic.co/t/elasticsearch-ignores-the-xpack-security-transport-ssl-certificate-authorities-parameter/250836)
**Author:** [@gimpastic](https://discuss.elastic.co/u/gimpastic)\ **Replies:** 1\ **Last updated:** [October 3, 2020, 3:36pm UTC](https://discuss.elastic.co/t/elasticsearch-ignores-the-xpack-security-transport-ssl-certificate-authorities-parameter/250836 "2020-10-03T15:36:02Z")
Hi, It seems like there is some misleading or a bug with the parameters: key, certificate, certificate\_authorities Elasticsearch ignores the xpack.security.transport.ssl.certificate\_authorities parameter The Elasticsea… --- ## [Execute a kibana pipeline from kibana cloud platform](https://discuss.elastic.co/t/execute-a-kibana-pipeline-from-kibana-cloud-platform/250875)
**Author:** [@Jordi](https://discuss.elastic.co/u/Jordi)\ **Replies:** 0\ **Last updated:** [October 3, 2020, 3:03pm UTC](https://discuss.elastic.co/t/execute-a-kibana-pipeline-from-kibana-cloud-platform/250875 "2020-10-03T15:03:34Z")
I am using kibana from the cloud and not from a local server. I have an index with data in Elastic, and I have created a pipeline from kibana that imports the data from a csv file and inserts it into the elastic index. M… --- ## [Elasticsearch random ConnectionnTimeout error](https://discuss.elastic.co/t/elasticsearch-random-connectionntimeout-error/250867)
**Author:** [@Ara\_Nguyen](https://discuss.elastic.co/u/Ara_Nguyen)\ **Replies:** 1\ **Last updated:** [October 3, 2020, 2:56pm UTC](https://discuss.elastic.co/t/elasticsearch-random-connectionntimeout-error/250867 "2020-10-03T14:56:07Z")
Hi all, I'm using Amazon Elasticsearch with RestHighLevelClient for our team application and have noticed occasional small dips in our success rate from canary traffic calling our API due to the error below. Caused… --- ## [Multiple Nodes Single Machine](https://discuss.elastic.co/t/multiple-nodes-single-machine/247298)
**Author:** [@scaferton](https://discuss.elastic.co/u/scaferton)\ **Replies:** 15\ **Last updated:** [October 3, 2020, 2:19pm UTC](https://discuss.elastic.co/t/multiple-nodes-single-machine/247298 "2020-10-03T14:19:03Z")
Good Evening, I've been researching this use case for a couple of days and it looks like there is about a thread per year on it. It also looks like the answers have changed over time. I believe I have a valid use case f… --- ## [Modeling parent/child relationship boosting child search with parent attribute](https://discuss.elastic.co/t/modeling-parent-child-relationship-boosting-child-search-with-parent-attribute/250829)
**Author:** [@ffknob](https://discuss.elastic.co/u/ffknob)\ **Replies:** 2\ **Last updated:** [October 3, 2020, 12:46pm UTC](https://discuss.elastic.co/t/modeling-parent-child-relationship-boosting-child-search-with-parent-attribute/250829 "2020-10-03T12:46:51Z")
Hello I'd like to find out what your thoughts are on the following use case: We have a service that indexes thousands o products from each of our individual client's Those clients buy monthly an amount of credits Each… --- ## [Why numbers don't match when profiling an Elasticsearch slow request](https://discuss.elastic.co/t/why-numbers-dont-match-when-profiling-an-elasticsearch-slow-request/250072)
**Author:** [@Glamdring](https://discuss.elastic.co/u/Glamdring)\ **Replies:** 2\ **Last updated:** [October 3, 2020, 10:41am UTC](https://discuss.elastic.co/t/why-numbers-dont-match-when-profiling-an-elasticsearch-slow-request/250072 "2020-10-03T10:41:30Z")
I'm having some unexpectedly slow queries and so I ran the profiling API (Elasticsearch 7.4). However, it doesn't explain the slowness, as all components take at most a couple of milliseconods, whereas the query "took" m… --- ## [Unable to Start Elasticsearch](https://discuss.elastic.co/t/unable-to-start-elasticsearch/250625)
**Author:** [@muthug](https://discuss.elastic.co/u/muthug)\ **Replies:** 2\ **Last updated:** [October 3, 2020, 10:36am UTC](https://discuss.elastic.co/t/unable-to-start-elasticsearch/250625 "2020-10-03T10:36:25Z")
OS:- RHEL 7 ES Version: 6.7 ● elasticsearch.service - Elasticsearch Loaded: loaded (/usr/lib/systemd/system/elasticsearch.service; enabled; vendor preset: disabled) Active: failed (Result: exit-code) since Thu 2020-1… --- ## [How can I check loglevel with use of If else condition in logstash filter?](https://discuss.elastic.co/t/how-can-i-check-loglevel-with-use-of-if-else-condition-in-logstash-filter/250844)
**Author:** [@Bhavin\_Varsur](https://discuss.elastic.co/u/Bhavin_Varsur)\ **Replies:** 2\ **Last updated:** [October 3, 2020, 7:34am UTC](https://discuss.elastic.co/t/how-can-i-check-loglevel-with-use-of-if-else-condition-in-logstash-filter/250844 "2020-10-03T07:34:08Z")
filter{ # 1. for LogLevel.Error logs grok{ match=\> \["message","%{DATESTAMP:timestamp} %{LOGLEVEL:level} %{USERNAME:logger} %{USER:user} %{URI:url} %{USER:method} %{IPV4:clientIp} %{GREEDYDATA:message}"\] } # 2. for… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1770) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1772)