# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=194 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 195 --- ## [ElasticSearch--Not able to get duration field value in long format in ES index](https://discuss.elastic.co/t/elasticsearch-not-able-to-get-duration-field-value-in-long-format-in-es-index/364179)
**Author:** [@Bhanu\_Praveen](https://discuss.elastic.co/u/Bhanu_Praveen)\ **Replies:** 1\ **Last updated:** [August 1, 2024, 9:41am UTC](https://discuss.elastic.co/t/elasticsearch-not-able-to-get-duration-field-value-in-long-format-in-es-index/364179 "2024-08-01T09:41:51Z")
Elasticsearch--Not able to get duration field value in long format in ES index Below is my json log string: { "traceId": "o0uyveRU/8BkjL+lbpDlnQ==", "spanId": "73rmqIRmo34=", "operationName": "ProcessWorkItem", "st… --- ## [Clarification needed: Changing PIT IDs in Elasticsearch](https://discuss.elastic.co/t/clarification-needed-changing-pit-ids-in-elasticsearch/364154)
**Author:** [@Hamza\_Belmellouki](https://discuss.elastic.co/u/Hamza_Belmellouki)\ **Replies:** 1\ **Last updated:** [August 1, 2024, 9:30am UTC](https://discuss.elastic.co/t/clarification-needed-changing-pit-ids-in-elasticsearch/364154 "2024-08-01T09:30:32Z")
The Elasticsearch documentation for version 7.17 states: The open point in time request and each subsequent search request can return different id; thus always use the most recently received id for the next search requ… --- ## [Ingest .sqlaudit logs to Elasticsearch](https://discuss.elastic.co/t/ingest-sqlaudit-logs-to-elasticsearch/363998)
**Author:** [@sanju1323](https://discuss.elastic.co/u/sanju1323)\ **Replies:** 2\ **Last updated:** [August 1, 2024, 8:49am UTC](https://discuss.elastic.co/t/ingest-sqlaudit-logs-to-elasticsearch/363998 "2024-08-01T08:49:47Z")
Hi Team, We are trying to ingest the mssql logs (.sqlaudit format) using filebeat (Version 7.16.2). But we are not able to read the logs. Can someone let us know what is the best way to pull the mssql logs and ingest in… --- ## [Elastic Stack Fields Issue](https://discuss.elastic.co/t/elastic-stack-fields-issue/364190)
**Author:** [@spazzrabbit](https://discuss.elastic.co/u/spazzrabbit)\ **Replies:** 0\ **Last updated:** [August 1, 2024, 8:46am UTC](https://discuss.elastic.co/t/elastic-stack-fields-issue/364190 "2024-08-01T08:46:05Z")
Hello everyone ! I'm having trouble to get some of the fields. (Using winlogbeat) For example: When I send windows defender logs I can't see fields such as "winlog.event\_data.ActionType", winlog.event\_data.MalwareName"… --- ## [Snapshot ,restore and free disk space](https://discuss.elastic.co/t/snapshot-restore-and-free-disk-space/364136)
**Author:** [@quan\_w](https://discuss.elastic.co/u/quan_w)\ **Replies:** 4\ **Last updated:** [August 1, 2024, 7:51am UTC](https://discuss.elastic.co/t/snapshot-restore-and-free-disk-space/364136 "2024-08-01T07:51:23Z")
When I create a snapshot, it prompts NoSuchException: source\_log\_2023\_06\]\[0\]\]\[backup\_repo2:snapshot\_name/tS8r2NxSRV29Qoj\_pZI0Ig\] failed to snapshot shard. And this info: low disk watermark \[85%\] exceeded on \[9kkzFDY6Re… --- ## [Unable to retrieve data from Oracle sample table using Logstash](https://discuss.elastic.co/t/unable-to-retrieve-data-from-oracle-sample-table-using-logstash/363811)
**Author:** [@sundarcdm1](https://discuss.elastic.co/u/sundarcdm1)\ **Replies:** 1\ **Last updated:** [August 1, 2024, 7:34am UTC](https://discuss.elastic.co/t/unable-to-retrieve-data-from-oracle-sample-table-using-logstash/363811 "2024-08-01T07:34:42Z")
Hi All, I am very new to Elastic . i was following a blog and video which describes step by step of how to configure create a simple db table and to retrieve values from table using logstash and to display in kibana por… --- ## [Monitor solace message broker using elk stack implementation?](https://discuss.elastic.co/t/monitor-solace-message-broker-using-elk-stack-implementation/364185)
**Author:** [@PRASHANT\_MEHTA](https://discuss.elastic.co/u/PRASHANT_MEHTA)\ **Replies:** 0\ **Last updated:** [August 1, 2024, 6:04am UTC](https://discuss.elastic.co/t/monitor-solace-message-broker-using-elk-stack-implementation/364185 "2024-08-01T06:04:48Z")
Hello All, I need to monitor solace message broker using elk , I am not sure how to do this and what could be possible ways used to implement ? Any guidance would be helpful. Thanx --- ## [Not able to push the data to nested directories in Google Cloud Storage](https://discuss.elastic.co/t/not-able-to-push-the-data-to-nested-directories-in-google-cloud-storage/364189)
**Author:** [@sanju1323](https://discuss.elastic.co/u/sanju1323)\ **Replies:** 0\ **Last updated:** [August 1, 2024, 7:25am UTC](https://discuss.elastic.co/t/not-able-to-push-the-data-to-nested-directories-in-google-cloud-storage/364189 "2024-08-01T07:25:48Z")
Hi Team, We are trying to push the data to GCS from Logstash. Logstash is specifying it is pushing, but the data is not there in the GCS bucket. When we had a close look at it, we understood that there is no option in … --- ## [ElasticSearch--Not able to convert date to nanomillis using index template](https://discuss.elastic.co/t/elasticsearch-not-able-to-convert-date-to-nanomillis-using-index-template/364175)
**Author:** [@Bhanu\_Praveen](https://discuss.elastic.co/u/Bhanu_Praveen)\ **Replies:** 0\ **Last updated:** [August 1, 2024, 2:07am UTC](https://discuss.elastic.co/t/elasticsearch-not-able-to-convert-date-to-nanomillis-using-index-template/364175 "2024-08-01T02:07:18Z")
Elasticsearch--Not able to convert date to nanomillis using index template. From logstash below json field "startTime" is coming in as date. I need to copy to a new field which i am doing. Then convert it to as below fi… --- ## [All fields from logstash coming in as text to ES, Pls let me know how to set as keyword?](https://discuss.elastic.co/t/all-fields-from-logstash-coming-in-as-text-to-es-pls-let-me-know-how-to-set-as-keyword/364076)
**Author:** [@Bhanu\_Praveen](https://discuss.elastic.co/u/Bhanu_Praveen)\ **Replies:** 3\ **Last updated:** [August 1, 2024, 1:56am UTC](https://discuss.elastic.co/t/all-fields-from-logstash-coming-in-as-text-to-es-pls-let-me-know-how-to-set-as-keyword/364076 "2024-08-01T01:56:21Z")
All fields from logstash coming in as text to ES, Pls let me know how to set as keyword? Below is my json log string: { "traceId": "o0uyveRU/8BkjL+lbpDlnQ==", "spanId": "73rmqIRmo34=", "operationName": "ProcessWorkI… --- ## [How to reload certs periodically for input with TLS](https://discuss.elastic.co/t/how-to-reload-certs-periodically-for-input-with-tls/364167)
**Author:** [@pewpew](https://discuss.elastic.co/u/pewpew)\ **Replies:** 4\ **Last updated:** [July 31, 2024, 10:46pm UTC](https://discuss.elastic.co/t/how-to-reload-certs-periodically-for-input-with-tls/364167 "2024-07-31T22:46:04Z")
I have a pipeline which is configured to receive input as below: input { tcp { port =\> 12345 codec =\> json\_lines ssl\_enabled =\> true ssl\_client\_authentication =\> "required" ssl\_certificate =\> "/etc… --- ## [Elastic Search Splitting in Azure Container Apps](https://discuss.elastic.co/t/elastic-search-splitting-in-azure-container-apps/364097)
**Author:** [@mcmichaelau](https://discuss.elastic.co/u/mcmichaelau)\ **Replies:** 4\ **Last updated:** [July 31, 2024, 9:39pm UTC](https://discuss.elastic.co/t/elastic-search-splitting-in-azure-container-apps/364097 "2024-07-31T21:39:23Z")
I am running the elasticsearch image in an azure container app. I have pushed data into ES using logstash via jdbc from a mssql db. In azure, I can see that there are 2 replicas of the image. As I am querying the data, I… --- ## [Kibana Canvas Dropdown Filter v. 8.12.2](https://discuss.elastic.co/t/kibana-canvas-dropdown-filter-v-8-12-2/364149)
**Author:** [@Hunter\_Knott](https://discuss.elastic.co/u/Hunter_Knott)\ **Replies:** 1\ **Last updated:** [July 31, 2024, 9:02pm UTC](https://discuss.elastic.co/t/kibana-canvas-dropdown-filter-v-8-12-2/364149 "2024-07-31T21:02:24Z")
Hi there, I've got a question regarding the dropdown filter used in Kibana's canvas workpads, version 8.12.2. So I have a table with various fields being listed off. The query (field and index names have been changed her… --- ## [System Information](https://discuss.elastic.co/t/system-information/364150)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 2\ **Last updated:** [July 31, 2024, 9:01pm UTC](https://discuss.elastic.co/t/system-information/364150 "2024-07-31T21:01:18Z")
Can Elastic grab information about the actual name of processor on system? Like for example: Intel(R) Xeon(R) Platinum 8358? --- ## [Performance and Efficiency for Indexing Using Machine Learning Models](https://discuss.elastic.co/t/performance-and-efficiency-for-indexing-using-machine-learning-models/363809)
**Author:** [@Shell\_Dias](https://discuss.elastic.co/u/Shell_Dias)\ **Replies:** 3\ **Last updated:** [July 31, 2024, 8:29pm UTC](https://discuss.elastic.co/t/performance-and-efficiency-for-indexing-using-machine-learning-models/363809 "2024-07-31T20:29:32Z")
I have a question about the performance of document indexing using the \_elser\_v2 model. I read in the documentation that it can index 26 documents per second, which is already a significant improvement over the v1 model… --- ## [Fleet Policy different IP from the server](https://discuss.elastic.co/t/fleet-policy-different-ip-from-the-server/362595)
**Author:** [@otortosa](https://discuss.elastic.co/u/otortosa)\ **Replies:** 13\ **Last updated:** [July 31, 2024, 7:29pm UTC](https://discuss.elastic.co/t/fleet-policy-different-ip-from-the-server/362595 "2024-07-31T19:29:47Z")
Hello guys! My Fleet server have a private IP, but i need to recolect logs from a VM with only public IP, working with a PFSense, created a Port Forwarder to the Fleet Server private IP. The issue is that the Fleet Age… --- ## [Understanding the scope and data coverage of Point in Time (PIT) snapshots in Elasticsearch](https://discuss.elastic.co/t/understanding-the-scope-and-data-coverage-of-point-in-time-pit-snapshots-in-elasticsearch/364148)
**Author:** [@Hamza\_Belmellouki](https://discuss.elastic.co/u/Hamza_Belmellouki)\ **Replies:** 0\ **Last updated:** [July 31, 2024, 4:07pm UTC](https://discuss.elastic.co/t/understanding-the-scope-and-data-coverage-of-point-in-time-pit-snapshots-in-elasticsearch/364148 "2024-07-31T16:07:00Z")
Hello, I'm working with Elasticsearch and utilizing the Point in Time (PIT) feature for my queries. I understand that PIT creates a snapshot(kind of) of the data to ensure consistent results across multiple searches, bu… --- ## [OSQuery Configuration - Change triggers retrieval of entire table contents](https://discuss.elastic.co/t/osquery-configuration-change-triggers-retrieval-of-entire-table-contents/364140)
**Author:** [@marmai16](https://discuss.elastic.co/u/marmai16)\ **Replies:** 0\ **Last updated:** [July 31, 2024, 2:35pm UTC](https://discuss.elastic.co/t/osquery-configuration-change-triggers-retrieval-of-entire-table-contents/364140 "2024-07-31T14:35:42Z")
Hello everyone, i'am currently working with osquery (which is a requirement) for information retrieval about my hosts. Now my issue relates to the way the osquery manager integration handles updates to the osquery conf… --- ## [Disable stack monitoring in Kibana](https://discuss.elastic.co/t/disable-stack-monitoring-in-kibana/364131)
**Author:** [@Cyanat](https://discuss.elastic.co/u/Cyanat)\ **Replies:** 3\ **Last updated:** [July 31, 2024, 2:04pm UTC](https://discuss.elastic.co/t/disable-stack-monitoring-in-kibana/364131 "2024-07-31T14:04:14Z")
Hello! I have wanted to see what monitoring of stack was offerring. As I don't have metricbeat installed, I chose a self monitoring. Now, I would like to revert this change and disable monitoring (because I'm afraid mo… --- ## [Anomaly Detection Job Results Index](https://discuss.elastic.co/t/anomaly-detection-job-results-index/364002)
**Author:** [@aphadnis](https://discuss.elastic.co/u/aphadnis)\ **Replies:** 1\ **Last updated:** [July 31, 2024, 1:57pm UTC](https://discuss.elastic.co/t/anomaly-detection-job-results-index/364002 "2024-07-31T13:57:17Z")
Hi, I had a question regarding the results index used in anomaly detection. So far, I've created an anomaly detection job (let's say it has the job id 'ad-job'), in which I'm using partition\_field and by\_field. I notic… --- ## [Elastic Search update from 7.16.2 to 8.13.3](https://discuss.elastic.co/t/elastic-search-update-from-7-16-2-to-8-13-3/363975)
**Author:** [@nishant\_goyal](https://discuss.elastic.co/u/nishant_goyal)\ **Replies:** 3\ **Last updated:** [July 31, 2024, 1:46pm UTC](https://discuss.elastic.co/t/elastic-search-update-from-7-16-2-to-8-13-3/363975 "2024-07-31T13:46:11Z")
I updated the Elasticsearch from 7.16.2 version to 8.13.3 After that, i am not able to see any previous document --- ## [Parsing Windows Event Logs in syslog format](https://discuss.elastic.co/t/parsing-windows-event-logs-in-syslog-format/364115)
**Author:** [@miko](https://discuss.elastic.co/u/miko)\ **Replies:** 1\ **Last updated:** [July 31, 2024, 12:17pm UTC](https://discuss.elastic.co/t/parsing-windows-event-logs-in-syslog-format/364115 "2024-07-31T12:17:43Z")
Hello, I'm looking for a way to parse Windows logs that are send via SYSLOG format. I don't want to change the format to an other format (like json) but when my logs are received in Elastic, the timestamp and sysloghost… --- ## [Filebeat not updating datastream](https://discuss.elastic.co/t/filebeat-not-updating-datastream/364059)
**Author:** [@sebinnsebastiann](https://discuss.elastic.co/u/sebinnsebastiann)\ **Replies:** 0\ **Last updated:** [July 30, 2024, 1:13pm UTC](https://discuss.elastic.co/t/filebeat-not-updating-datastream/364059 "2024-07-30T13:13:07Z")
I have a docker swarm cluster with 3 nodes. I set up a elasticsearch, kibana and filebeat as docker swarm services. These three swarm services are running without an error. A datastream is created by filebeat but no logs… --- ## [Find saved objects with certain index pattern](https://discuss.elastic.co/t/find-saved-objects-with-certain-index-pattern/363781)
**Author:** [@ddoroshenko](https://discuss.elastic.co/u/ddoroshenko)\ **Replies:** 1\ **Last updated:** [July 29, 2024, 9:09pm UTC](https://discuss.elastic.co/t/find-saved-objects-with-certain-index-pattern/363781 "2024-07-29T21:09:01Z")
Hi, I'd like to find visualizations which have direct relationship to certain index pattern. Is it possible to write query for search something like this type:(visualization) child:(type=index-pattern, title=certain-i… --- ## [Elasticsearch readiness Probe change to httpGet instead of exec](https://discuss.elastic.co/t/elasticsearch-readiness-probe-change-to-httpget-instead-of-exec/363940)
**Author:** [@Rakesh\_9](https://discuss.elastic.co/u/Rakesh_9)\ **Replies:** 2\ **Last updated:** [July 31, 2024, 11:36am UTC](https://discuss.elastic.co/t/elasticsearch-readiness-probe-change-to-httpget-instead-of-exec/363940 "2024-07-31T11:36:23Z")
Hi, I'm trying to set up an Elasticsearch stack on Kubernetes using the ECK operator. I was able to install the operator successfully. I wanted to change the default readiness prob from exec type ( Default Probe ) to ht… --- ## [Looking forward for help！Kibana source code run about 3min output Server crashed with status code 1](https://discuss.elastic.co/t/looking-forward-for-help-kibana-source-code-run-about-3min-output-server-crashed-with-status-code-1/364133)
**Author:** [@juda](https://discuss.elastic.co/u/juda)\ **Replies:** 1\ **Last updated:** [July 31, 2024, 11:20am UTC](https://discuss.elastic.co/t/looking-forward-for-help-kibana-source-code-run-about-3min-output-server-crashed-with-status-code-1/364133 "2024-07-31T11:20:31Z")
I want to run kibana source code ，i have runned the project ,but when it run about 5min,some ERROR output.Please help me. Unhandled Promise rejection detected: { Error: connect ETIMEDOUT 0.0.30.210:80 at TCPConnect… --- ## [How to use Elastic Search with a Self Made SSL certificate not made by using Elastic search.bat](https://discuss.elastic.co/t/how-to-use-elastic-search-with-a-self-made-ssl-certificate-not-made-by-using-elastic-search-bat/364101)
**Author:** [@Likhit](https://discuss.elastic.co/u/Likhit)\ **Replies:** 2\ **Last updated:** [July 31, 2024, 9:35am UTC](https://discuss.elastic.co/t/how-to-use-elastic-search-with-a-self-made-ssl-certificate-not-made-by-using-elastic-search-bat/364101 "2024-07-31T09:35:04Z")
I am unable to use my certificate which i made using New-SelfSignedCertificate command and i tried replacing it with http.pfx in cert folder along with its configuration on elasticsearch.yml but it ain't working --- ## [Integration Issue with Sending Windows Event Logs to Elastic-Agent and Logstash via UDP](https://discuss.elastic.co/t/integration-issue-with-sending-windows-event-logs-to-elastic-agent-and-logstash-via-udp/364127)
**Author:** [@wangsubo](https://discuss.elastic.co/u/wangsubo)\ **Replies:** 0\ **Last updated:** [July 31, 2024, 9:13am UTC](https://discuss.elastic.co/t/integration-issue-with-sending-windows-event-logs-to-elastic-agent-and-logstash-via-udp/364127 "2024-07-31T09:13:27Z")
Hello everyone, I am currently working in a specific network environment where, due to network restrictions,I plan to transmit Windows event logs to Elastic-Agent via UDP. The specific data flow is as follows: Windows … --- ## [全角数字を一文字ずつ区切られないようにしたい](https://discuss.elastic.co/t/topic/364123)
**Author:** [@Totsuka](https://discuss.elastic.co/u/Totsuka)\ **Replies:** 0\ **Last updated:** [July 31, 2024, 8:55am UTC](https://discuss.elastic.co/t/topic/364123 "2024-07-31T08:55:08Z")
全角数字を半角数字にし、一文字ずつ区切られないように設定するプラグインをご教示いただけますでしょうか。 □事象 GET kensyo\_index/\_analyze { "text" : "６０００", "analyzer": "my\_custom\_analyzer" } { "tokens" : \[ { "token" : "６", "start\_offset" : 0, "… --- ## [Is elasticsearch anyway associated with pmlogger service](https://discuss.elastic.co/t/is-elasticsearch-anyway-associated-with-pmlogger-service/364106)
**Author:** [@martianzz](https://discuss.elastic.co/u/martianzz)\ **Replies:** 2\ **Last updated:** [July 31, 2024, 8:49am UTC](https://discuss.elastic.co/t/is-elasticsearch-anyway-associated-with-pmlogger-service/364106 "2024-07-31T08:49:16Z")
Is Elasticsearch associated with the pmlogger service in any way? I noticed that the pmlogger service in my 3-node ELK stack cluster has started automatically, and logs are being filled up in /var/log/pcp/pmlogger on all… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=193) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=195)