# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1888 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1889 --- ## [Unable to capture some syslog with socket input](https://discuss.elastic.co/t/unable-to-capture-some-syslog-with-socket-input/243735)
**Author:** [@elk2](https://discuss.elastic.co/u/elk2)\ **Replies:** 0\ **Last updated:** [August 4, 2020, 2:47pm UTC](https://discuss.elastic.co/t/unable-to-capture-some-syslog-with-socket-input/243735 "2020-08-04T14:47:14Z")
I'm unable to capture some syslog from different sources: this is my conf: input { udp { port =\> 514 } tcp { port =\> 514 } } filter { } output { file { path … --- ## [Boolean should and proximity?](https://discuss.elastic.co/t/boolean-should-and-proximity/243734)
**Author:** [@flm](https://discuss.elastic.co/u/flm)\ **Replies:** 0\ **Last updated:** [August 4, 2020, 2:41pm UTC](https://discuss.elastic.co/t/boolean-should-and-proximity/243734 "2020-08-04T14:41:41Z")
Is there a way to mix boolean should and span or proximity queries? I want to match documents that contain X% of a group of terms in any order but not further apart from each other than distance D. Is this possible? --- ## [Auditbeat module system dataset login: error reading wtmp](https://discuss.elastic.co/t/auditbeat-module-system-dataset-login-error-reading-wtmp/243732)
**Author:** [@pauleccm](https://discuss.elastic.co/u/pauleccm)\ **Replies:** 0\ **Last updated:** [August 4, 2020, 2:40pm UTC](https://discuss.elastic.co/t/auditbeat-module-system-dataset-login-error-reading-wtmp/243732 "2020-08-04T14:40:25Z")
version: auditbeat version 7.8.0 (arm64), libbeat 7.8.0 \[f79387d32717d79f689d94fda1ec80b2cf285d30 built 2020-06-14 18:12:56 +0000 UTC\] Debian 10 Aug 04 16:37:51 scw-optimistic-austin auditbeat\[11004\]: 2020-08-04T16:37… --- ## [Azure.resource.name field is missing in Metricbeat 7.7](https://discuss.elastic.co/t/azure-resource-name-field-is-missing-in-metricbeat-7-7/243696)
**Author:** [@Abir\_Mahfoudhi](https://discuss.elastic.co/u/Abir_Mahfoudhi)\ **Replies:** 2\ **Last updated:** [August 4, 2020, 2:17pm UTC](https://discuss.elastic.co/t/azure-resource-name-field-is-missing-in-metricbeat-7-7/243696 "2020-08-04T14:17:56Z")
We are using metricbeat 7.7 to fetch data from azure using azure module and we use the data to build some monitoring dashboards . Everything was working fine until we discovered a missing field in metricbeat which is azu… --- ## [JSON parse error, original data now in message field](https://discuss.elastic.co/t/json-parse-error-original-data-now-in-message-field/242459)
**Author:** [@nisaxena](https://discuss.elastic.co/u/nisaxena)\ **Replies:** 7\ **Last updated:** [August 4, 2020, 2:12pm UTC](https://discuss.elastic.co/t/json-parse-error-original-data-now-in-message-field/242459 "2020-08-04T14:12:13Z")
Hi There, I am new to ELK, and need support. I have deployed a new ELK stack \[7.8.0\] & I am trying to ingest my rsyslogs to logstash. I am able to retrieve the logs to logstash but with following errors, logstash-plain… --- ## [Help reindexing to change date format](https://discuss.elastic.co/t/help-reindexing-to-change-date-format/243356)
**Author:** [@gius78](https://discuss.elastic.co/u/gius78)\ **Replies:** 3\ **Last updated:** [August 4, 2020, 2:01pm UTC](https://discuss.elastic.co/t/help-reindexing-to-change-date-format/243356 "2020-08-04T14:01:04Z")
Hi all, I have to change the timestamp format of documents in my index. Currently I have a "yyyymmddhhmmssZ" format. I have to change it to something that grafana can understand. So I think Epoch\_millis or ISO. can y… --- ## [CCS set-up](https://discuss.elastic.co/t/ccs-set-up/243711)
**Author:** [@Tuckson](https://discuss.elastic.co/u/Tuckson)\ **Replies:** 0\ **Last updated:** [August 4, 2020, 1:05pm UTC](https://discuss.elastic.co/t/ccs-set-up/243711 "2020-08-04T13:05:34Z")
Hi, On 2 locations I setup an elasticsearch cluster. Both run ok individually. Both also have a coordinating node. These nodes I want to connect to eachother to be able to do cross cluster search. So in the yml files … --- ## [Cluster\_stats not sent to monitoring cluster](https://discuss.elastic.co/t/cluster-stats-not-sent-to-monitoring-cluster/243402)
**Author:** [@souravsahoo](https://discuss.elastic.co/u/souravsahoo)\ **Replies:** 1\ **Last updated:** [August 4, 2020, 1:42pm UTC](https://discuss.elastic.co/t/cluster-stats-not-sent-to-monitoring-cluster/243402 "2020-08-04T13:42:08Z")
Hi all, I am facing an issue, where the production cluster/sending cluster is sending the monitoring data to the monitoring cluster. However, I am not able to view it on the stack monitoring page. On further analysis, I… --- ## [Tls handshake timeout tcp input plugin](https://discuss.elastic.co/t/tls-handshake-timeout-tcp-input-plugin/243715)
**Author:** [@f3lang](https://discuss.elastic.co/u/f3lang)\ **Replies:** 0\ **Last updated:** [August 4, 2020, 1:34pm UTC](https://discuss.elastic.co/t/tls-handshake-timeout-tcp-input-plugin/243715 "2020-08-04T13:34:14Z")
Hi Everyone, I hope, you can help me with my problem :slight\_smile: I have configured a logstash server with the tcp input plugin and client tls authentication enabled. So far everything works great and as long as th… --- ## [Logstash to Logstash Certificate Error](https://discuss.elastic.co/t/logstash-to-logstash-certificate-error/243713)
**Author:** [@Yawn](https://discuss.elastic.co/u/Yawn)\ **Replies:** 0\ **Last updated:** [August 4, 2020, 1:21pm UTC](https://discuss.elastic.co/t/logstash-to-logstash-certificate-error/243713 "2020-08-04T13:21:51Z")
Hello everyone Would really appreciate anyone's input on this.. I've been struggling with a certificate problem between 2 logstash servers. I have the following setup basically: agents \> LogstashA \> LogstashB \> Elast… --- ## [Logstash filebeat Performance](https://discuss.elastic.co/t/logstash-filebeat-performance/243707)
**Author:** [@eth](https://discuss.elastic.co/u/eth)\ **Replies:** 0\ **Last updated:** [August 4, 2020, 12:54pm UTC](https://discuss.elastic.co/t/logstash-filebeat-performance/243707 "2020-08-04T12:54:54Z")
I am sending kubernetes pod logs from filebeat to logstash via kafka plugin. Filebeat, Logstash and kafka running as pods in the single host. filebeat ==\> Kafka ==\> Logstash when i checked the network bandw… --- ## [What's the preferred way to update part of a nested document](https://discuss.elastic.co/t/whats-the-preferred-way-to-update-part-of-a-nested-document/243705)
**Author:** [@viebel](https://discuss.elastic.co/u/viebel)\ **Replies:** 0\ **Last updated:** [August 4, 2020, 12:36pm UTC](https://discuss.elastic.co/t/whats-the-preferred-way-to-update-part-of-a-nested-document/243705 "2020-08-04T12:36:26Z")
My document has a nested structure like this: PUT /customer/\_doc/1 { "name": "hello", "body": { "module": "aa", "config": "bb" } } Now, I'd like to update body field to be: { "module": "cc", "arg… --- ## [Kibana ML anomalies detection and regression](https://discuss.elastic.co/t/kibana-ml-anomalies-detection-and-regression/241894)
**Author:** [@ahadi](https://discuss.elastic.co/u/ahadi)\ **Replies:** 12\ **Last updated:** [August 4, 2020, 12:15pm UTC](https://discuss.elastic.co/t/kibana-ml-anomalies-detection-and-regression/241894 "2020-08-04T12:15:59Z")
Hi, I have trend data and i want to identify customers whose turnover climb or fall . Witch Kibana ML model can i do to identify them? Anomalies detection or regression ? I also want to know how to interpret the res… --- ## [Need help in jq parser with my aggregrations](https://discuss.elastic.co/t/need-help-in-jq-parser-with-my-aggregrations/243701)
**Author:** [@Blason](https://discuss.elastic.co/u/Blason)\ **Replies:** 0\ **Last updated:** [August 4, 2020, 12:03pm UTC](https://discuss.elastic.co/t/need-help-in-jq-parser-with-my-aggregrations/243701 "2020-08-04T12:03:12Z")
Hi Guys, I am trying to figure out the Json data parsing out using jq from elastic 7.8. However I am confused and data is not being parsed correctly. Can someone pls help me with? "took": 1, "timed\_out": false, … --- ## [Multiline Logstah file txt](https://discuss.elastic.co/t/multiline-logstah-file-txt/243613)
**Author:** [@Daniel\_Bergmann](https://discuss.elastic.co/u/Daniel_Bergmann)\ **Replies:** 6\ **Last updated:** [August 4, 2020, 11:53am UTC](https://discuss.elastic.co/t/multiline-logstah-file-txt/243613 "2020-08-04T11:53:30Z")
I have a TXT file that I want to import into Elasticsearch via LogStash, it is a fixed type of columns, in which I used grok and if to separate the columns of this file, that's fine, but I want to use the multiline to g… --- ## [Import only beats relevant dashoard from the whole default dashboards](https://discuss.elastic.co/t/import-only-beats-relevant-dashoard-from-the-whole-default-dashboards/243526)
**Author:** [@StefanoM](https://discuss.elastic.co/u/StefanoM)\ **Replies:** 5\ **Last updated:** [August 4, 2020, 11:46am UTC](https://discuss.elastic.co/t/import-only-beats-relevant-dashoard-from-the-whole-default-dashboards/243526 "2020-08-04T11:46:02Z")
Hi there, is there some best practice or a trick for this: as everyone knowsthe default dashboards are quite many. How / What can I do it if I only want to import the default stuff (dashboards, templates and so on) for … --- ## [How to Get Bucket Key in Terms Aggregation to use in Sub Aggregations](https://discuss.elastic.co/t/how-to-get-bucket-key-in-terms-aggregation-to-use-in-sub-aggregations/243699)
**Author:** [@benjieperez28](https://discuss.elastic.co/u/benjieperez28)\ **Replies:** 0\ **Last updated:** [August 4, 2020, 11:41am UTC](https://discuss.elastic.co/t/how-to-get-bucket-key-in-terms-aggregation-to-use-in-sub-aggregations/243699 "2020-08-04T11:41:19Z")
Here I have an aggregation to determine each article count per publication, now my question is I have to make a sub aggregation base on per publication (bucket.key), is it possible to get the bucket key after the term a… --- ## [Filebeat output setting on modules](https://discuss.elastic.co/t/filebeat-output-setting-on-modules/243669)
**Author:** [@esseti](https://discuss.elastic.co/u/esseti)\ **Replies:** 1\ **Last updated:** [August 4, 2020, 11:33am UTC](https://discuss.elastic.co/t/filebeat-output-setting-on-modules/243669 "2020-08-04T11:33:24Z")
Hello all, I've two system one ELK for monitoring (Monitoring) and an ELK for auditing (Auditing) On a machine, i've setup filebeat to send the output to Monitoring. that's fine. Now,I 've to setup a filebaeat conf th… --- ## [Upgrading my application from ES 5.3 to 7.7](https://discuss.elastic.co/t/upgrading-my-application-from-es-5-3-to-7-7/243527)
**Author:** [@taichi](https://discuss.elastic.co/u/taichi)\ **Replies:** 5\ **Last updated:** [August 4, 2020, 11:22am UTC](https://discuss.elastic.co/t/upgrading-my-application-from-es-5-3-to-7-7/243527 "2020-08-04T11:22:50Z")
I'm going to ES of my application (it's large) from version 5.3 to 7.7 I have to fix my application codes, finding difference between the two versions. Elastic documentation has many Breaking changes pages, correspondi… --- ## [How to restrict nodes while indexing to elastic search](https://discuss.elastic.co/t/how-to-restrict-nodes-while-indexing-to-elastic-search/243695)
**Author:** [@Rakesh\_Katakam](https://discuss.elastic.co/u/Rakesh_Katakam)\ **Replies:** 0\ **Last updated:** [August 4, 2020, 11:21am UTC](https://discuss.elastic.co/t/how-to-restrict-nodes-while-indexing-to-elastic-search/243695 "2020-08-04T11:21:34Z")
Hi, I am trying to index application logs to elastic search using file beats. Here I observed in elastic search, it created for each document hosts,agent..etc nodes, but I am interested only in message field Node. s… --- ## [Metricbeat 7.8 IIS Module Malformed Events Emitted from application\_pool metricset](https://discuss.elastic.co/t/metricbeat-7-8-iis-module-malformed-events-emitted-from-application-pool-metricset/241538)
**Author:** [@william.shipman](https://discuss.elastic.co/u/william.shipman)\ **Replies:** 2\ **Last updated:** [August 4, 2020, 11:18am UTC](https://discuss.elastic.co/t/metricbeat-7-8-iis-module-malformed-events-emitted-from-application-pool-metricset/241538 "2020-08-04T11:18:59Z")
Good afternoon, I'm currently seeing lots of missing data from the IIS module, specifically the application\_pool metricset: I believe there are a couple of different things going on here, including the same errors me… --- ## [Elastic stack hardware requirements](https://discuss.elastic.co/t/elastic-stack-hardware-requirements/243521)
**Author:** [@Gomeisa](https://discuss.elastic.co/u/Gomeisa)\ **Replies:** 3\ **Last updated:** [August 4, 2020, 11:16am UTC](https://discuss.elastic.co/t/elastic-stack-hardware-requirements/243521 "2020-08-04T11:16:04Z")
Hi I want to set up a cluster and I have these scenarios: I'm using ES, Kibana, filebeat(for logs) \[basic license\], a custom project instead of logstash Index heavy data, Not very frequent querying Monthly index with … --- ## [Production rules in legend](https://discuss.elastic.co/t/production-rules-in-legend/243683)
**Author:** [@Michaela\_Krkosova](https://discuss.elastic.co/u/Michaela_Krkosova)\ **Replies:** 1\ **Last updated:** [August 4, 2020, 11:11am UTC](https://discuss.elastic.co/t/production-rules-in-legend/243683 "2020-08-04T11:11:57Z")
Hi I would like to use production rules in vega legend - simplified example - I want a circle near number 10 to be orange. I assume my code should looks like this { "$schema": "https://vega.github.io/schema/vega/v5.… --- ## [Beats environment variable not working](https://discuss.elastic.co/t/beats-environment-variable-not-working/243660)
**Author:** [@mozam](https://discuss.elastic.co/u/mozam)\ **Replies:** 1\ **Last updated:** [August 4, 2020, 10:49am UTC](https://discuss.elastic.co/t/beats-environment-variable-not-working/243660 "2020-08-04T10:49:11Z")
Hello, I'm using Auditbeat 7.8.0, trying to pass value to configuration using environment variables under the processors - add\_host\_metadata. I have exported the variable in my shell using the command export CITY\_NAME=… --- ## [Error While Installing Elastic search plugins](https://discuss.elastic.co/t/error-while-installing-elastic-search-plugins/243170)
**Author:** [@WaseemSiddiqui](https://discuss.elastic.co/u/WaseemSiddiqui)\ **Replies:** 4\ **Last updated:** [August 4, 2020, 10:28am UTC](https://discuss.elastic.co/t/error-while-installing-elastic-search-plugins/243170 "2020-08-04T10:28:23Z")
Installing the ICU analysis 7.3.1. for Elastic Search 7.3.1 unfortunately I am getting a java error .C:\\Program Files\\Elastic\\Elasticsearch\\7.3.1\\bin\>elasticsearch-plugin.bat instal l path\\analysis-icu-7.3.1.zip -\> … --- ## [Incremental search on geo\_point](https://discuss.elastic.co/t/incremental-search-on-geo-point/243649)
**Author:** [@ocmvin](https://discuss.elastic.co/u/ocmvin)\ **Replies:** 3\ **Last updated:** [August 4, 2020, 9:59am UTC](https://discuss.elastic.co/t/incremental-search-on-geo-point/243649 "2020-08-04T09:59:40Z")
Wish to search a closest person from input geo\_point location . Quick steps to explain the requirement. Steps : 1: Add documents with person name and their lat /long details Expected result Request body shall contain g… --- ## [Changing mapping fields structure flow](https://discuss.elastic.co/t/changing-mapping-fields-structure-flow/243576)
**Author:** [@gitterhh](https://discuss.elastic.co/u/gitterhh)\ **Replies:** 1\ **Last updated:** [August 4, 2020, 9:50am UTC](https://discuss.elastic.co/t/changing-mapping-fields-structure-flow/243576 "2020-08-04T09:50:57Z")
I have an index with the mappings { "mappings": { "properties": { "title": { "type": "text" }, "location": { "type": "keyword" } } } } In lo… --- ## [Filter results by the length of the nested objects returned, similar to min\_child](https://discuss.elastic.co/t/filter-results-by-the-length-of-the-nested-objects-returned-similar-to-min-child/243582)
**Author:** [@Dustin\_Silk](https://discuss.elastic.co/u/Dustin_Silk)\ **Replies:** 1\ **Last updated:** [August 4, 2020, 9:48am UTC](https://discuss.elastic.co/t/filter-results-by-the-length-of-the-nested-objects-returned-similar-to-min-child/243582 "2020-08-04T09:48:55Z")
I'm trying to filter my results based on the number of nested objects found for a document. I've tried using scores but I cant get scores to work with filters, and I've tried a script but can't get that working either. … --- ## [Auditbeat not getting the host's public address](https://discuss.elastic.co/t/auditbeat-not-getting-the-hosts-public-address/243200)
**Author:** [@curiousmind](https://discuss.elastic.co/u/curiousmind)\ **Replies:** 3\ **Last updated:** [August 4, 2020, 9:44am UTC](https://discuss.elastic.co/t/auditbeat-not-getting-the-hosts-public-address/243200 "2020-08-04T09:44:37Z")
Beats and Elasticsearch Version 7.8.0 We have 50+ sources in which auditbeat version 7.8.0 is installed. The OS used is predominantly Windows in all these sources. These 50+ sources are sending the logs directly to a 2… --- ## [How export logs from Kibana 4?](https://discuss.elastic.co/t/how-export-logs-from-kibana-4/186)
**Author:** [@Dnyaneshwar](https://discuss.elastic.co/u/Dnyaneshwar)\ **Replies:** 9\ **Last updated:** [August 4, 2020, 8:53am UTC](https://discuss.elastic.co/t/how-export-logs-from-kibana-4/186 "2020-08-04T08:53:32Z")
I have tried the export button in kibana 4, but it export the table with timestamp and count column.. there is not logs. How export logs from Kibana 4 ? Thanks [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1887) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1889)