# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1967 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1968 --- ## [Wildcard in a match\_phrase query](https://discuss.elastic.co/t/wildcard-in-a-match-phrase-query/238775)
**Author:** [@Manjunath\_Venkatram](https://discuss.elastic.co/u/Manjunath_Venkatram)\ **Replies:** 3\ **Last updated:** [June 27, 2020, 12:25pm UTC](https://discuss.elastic.co/t/wildcard-in-a-match-phrase-query/238775 "2020-06-27T12:25:49Z")
Hi I am trying to do a wildcard query on a field as below, {"clientPort":{"query":"\*"}}, my intention is for the query to bring any/all values associated with clientPort, is this possible ? currently i dont get anythin… --- ## [Suricata and Kibana in Ubuntu 18.04](https://discuss.elastic.co/t/suricata-and-kibana-in-ubuntu-18-04/235438)
**Author:** [@wahyu\_wir](https://discuss.elastic.co/u/wahyu_wir)\ **Replies:** 6\ **Last updated:** [June 27, 2020, 11:29am UTC](https://discuss.elastic.co/t/suricata-and-kibana-in-ubuntu-18-04/235438 "2020-06-27T11:29:47Z")
how can I use ELK on the suricata that I installed on Ubuntu 18.04? I have followed the link: https://www.google.com/amp/s/logz.io/blog/network-security-monitoring/amp/ but after the kibana is opened, it appears that i… --- ## [Upgrade with docker](https://discuss.elastic.co/t/upgrade-with-docker/238689)
**Author:** [@Elastan](https://discuss.elastic.co/u/Elastan)\ **Replies:** 1\ **Last updated:** [June 27, 2020, 10:11am UTC](https://discuss.elastic.co/t/upgrade-with-docker/238689 "2020-06-27T10:11:28Z")
Hello, Where I can find manual how to pefrom version upgrade when Elastic cluster running in Docker? Regards --- ## [Combine rank with different buckets](https://discuss.elastic.co/t/combine-rank-with-different-buckets/238886)
**Author:** [@remeo](https://discuss.elastic.co/u/remeo)\ **Replies:** 0\ **Last updated:** [June 26, 2020, 4:55pm UTC](https://discuss.elastic.co/t/combine-rank-with-different-buckets/238886 "2020-06-26T16:55:24Z")
We are running a marketplace (with auctions and fixed price items). Since you have different type of search users and use cases (some search for precise items, others want some inspiration), we are thinking about this a… --- ## [View only last logline from all hosts](https://discuss.elastic.co/t/view-only-last-logline-from-all-hosts/238206)
**Author:** [@Marcel27](https://discuss.elastic.co/u/Marcel27)\ **Replies:** 3\ **Last updated:** [June 27, 2020, 9:26am UTC](https://discuss.elastic.co/t/view-only-last-logline-from-all-hosts/238206 "2020-06-27T09:26:57Z")
For a specific use case where i have 1000+ hosts using filebeat to send a logfile to ES, i want a view in Kibana with a (filterable) listview of all hosts, with only the last logline of each host. Is this possible, and… --- ## [Packetbeat not getting data of mongodb?](https://discuss.elastic.co/t/packetbeat-not-getting-data-of-mongodb/238937)
**Author:** [@Sushant\_Sawant](https://discuss.elastic.co/u/Sushant_Sawant)\ **Replies:** 0\ **Last updated:** [June 27, 2020, 9:17am UTC](https://discuss.elastic.co/t/packetbeat-not-getting-data-of-mongodb/238937 "2020-06-27T09:17:23Z")
I am working on windows 10 machine, I have installed packetbeat. but whenever I am trying to get the data of mongodb on port 27017 it is showing no data in kibana dashboard. can anyone help with this? --- ## [Metricbeat & docker & kibana dashboard](https://discuss.elastic.co/t/metricbeat-docker-kibana-dashboard/238090)
**Author:** [@smm](https://discuss.elastic.co/u/smm)\ **Replies:** 2\ **Last updated:** [June 27, 2020, 8:38am UTC](https://discuss.elastic.co/t/metricbeat-docker-kibana-dashboard/238090 "2020-06-27T08:38:41Z")
Hi there, I have a quite interesting question: I am deplyoing an elastic cluster with docker-compose. The problem I could not solve so far: docker-compose starts all containers, also metricbeat. But metricbeat tries to … --- ## [Index not found exception](https://discuss.elastic.co/t/index-not-found-exception/238734)
**Author:** [@Mamta1](https://discuss.elastic.co/u/Mamta1)\ **Replies:** 1\ **Last updated:** [June 27, 2020, 6:29am UTC](https://discuss.elastic.co/t/index-not-found-exception/238734 "2020-06-27T06:29:51Z")
Hi guys, Iam new to elasticsearch. I have indexed a small file. I get an error when i try to query it through an API as below: "{ "errors": \[ { "message": "index\_not\_found\_exception", "locations": \[ { "line": 2, … --- ## [API behaviors on index alias which points to several indices](https://discuss.elastic.co/t/api-behaviors-on-index-alias-which-points-to-several-indices/238922)
**Author:** [@lschmid](https://discuss.elastic.co/u/lschmid)\ **Replies:** 1\ **Last updated:** [June 27, 2020, 5:37am UTC](https://discuss.elastic.co/t/api-behaviors-on-index-alias-which-points-to-several-indices/238922 "2020-06-27T05:37:40Z")
Hi, Say we have index1 and index2 which are associated with alias1. Index1 has data from 05/11/2020, and index2 has data from 5/12/2020. We start a \_scroll request to alias1 with the time range for data from 5/12/2020. … --- ## [GROUP BY with only one query](https://discuss.elastic.co/t/group-by-with-only-one-query/236411)
**Author:** [@fmisso](https://discuss.elastic.co/u/fmisso)\ **Replies:** 1\ **Last updated:** [June 27, 2020, 4:38am UTC](https://discuss.elastic.co/t/group-by-with-only-one-query/236411 "2020-06-27T04:38:14Z")
Hello, I'm looking for a solution to do this : SELECT t.nom, t.latitude, l.longitude, r.MaxTime FROM ( SELECT name, MAX(time) as MaxTime FROM BusTable GROUP BY name ) r INNER JOIN BusTable t ON t.name… --- ## [Logstash delta pull from postgres](https://discuss.elastic.co/t/logstash-delta-pull-from-postgres/238501)
**Author:** [@tenet\_testuser1](https://discuss.elastic.co/u/tenet_testuser1)\ **Replies:** 5\ **Last updated:** [June 27, 2020, 4:15am UTC](https://discuss.elastic.co/t/logstash-delta-pull-from-postgres/238501 "2020-06-27T04:15:16Z")
I have a simple logstash pipeline job that is a SQL job that pulls data from a postgres db into ES. The initial pull was 1.5 million rows, which ran last night and took about 5 minutes. but the delta daily pull is about… --- ## [Rolling-over with daily index using ILM policy](https://discuss.elastic.co/t/rolling-over-with-daily-index-using-ilm-policy/237586)
**Author:** [@Sachith\_Senarathne](https://discuss.elastic.co/u/Sachith_Senarathne)\ **Replies:** 1\ **Last updated:** [June 27, 2020, 4:01am UTC](https://discuss.elastic.co/t/rolling-over-with-daily-index-using-ilm-policy/237586 "2020-06-27T04:01:26Z")
Hi We are in the process of creating an index template including ilm policy which has mentioned below. { "policy": { "phases": { "hot": { … --- ## [Namespace labels to kubernetes metadata - ELasticsearch - Metricbeat](https://discuss.elastic.co/t/namespace-labels-to-kubernetes-metadata-elasticsearch-metricbeat/238925)
**Author:** [@abhishek\_acharya](https://discuss.elastic.co/u/abhishek_acharya)\ **Replies:** 0\ **Last updated:** [June 27, 2020, 3:55am UTC](https://discuss.elastic.co/t/namespace-labels-to-kubernetes-metadata-elasticsearch-metricbeat/238925 "2020-06-27T03:55:57Z")
Hi I am working on an issue where i have assigned labels to my kubernetes namespace externally through kubectl command and wanted to get those kubernetes namespace labels in the metricbeat. I am following this https://… --- ## [Reduce iops during reindexing](https://discuss.elastic.co/t/reduce-iops-during-reindexing/236086)
**Author:** [@magnalite](https://discuss.elastic.co/u/magnalite)\ **Replies:** 1\ **Last updated:** [June 27, 2020, 3:42am UTC](https://discuss.elastic.co/t/reduce-iops-during-reindexing/236086 "2020-06-27T03:42:44Z")
At the moment my VMs get i/o throttled due to performing many i/o operations during reindexing but is nowhere near it's limit in terms of bandwidth. Is there any way I could reduce the number of i/o operations going to d… --- ## [Forcemerge?max\_num\_segments=1 is having any side affect to es engine](https://discuss.elastic.co/t/forcemerge-max-num-segments-1-is-having-any-side-affect-to-es-engine/236136)
**Author:** [@Dilip\_Kumar](https://discuss.elastic.co/u/Dilip_Kumar)\ **Replies:** 1\ **Last updated:** [June 27, 2020, 3:26am UTC](https://discuss.elastic.co/t/forcemerge-max-num-segments-1-is-having-any-side-affect-to-es-engine/236136 "2020-06-27T03:26:21Z")
Hi, I have used curl -XPOST localhost:9200/myindex/\_forcemerge?max\_num\_segments=1 , after hit this API i have checked segments with this API curl localhost:9200/myindex/\_segments?pretty and find that segment is reduced … --- ## [Logstash.instrument.periodicpoller.os\] PeriodicPoller: Timeout exception](https://discuss.elastic.co/t/logstash-instrument-periodicpoller-os-periodicpoller-timeout-exception/238923)
**Author:** [@Yeading](https://discuss.elastic.co/u/Yeading)\ **Replies:** 1\ **Last updated:** [June 27, 2020, 2:19am UTC](https://discuss.elastic.co/t/logstash-instrument-periodicpoller-os-periodicpoller-timeout-exception/238923 "2020-06-27T02:19:14Z")
\[2020-06-27T07:45:55,338\]\[DEBUG\]\[logstash.instrument.periodicpoller.os\] PeriodicPoller: Timeout exception {:poller=\>#\ **Author:** [@AClerk](https://discuss.elastic.co/u/AClerk)\ **Replies:** 1\ **Last updated:** [June 27, 2020, 1:57am UTC](https://discuss.elastic.co/t/slow-log-format-how-to-read-the-log/238798 "2020-06-27T01:57:21Z") Hi, I wanted to check queries run time. Enabled slowlog on the cluster. How can I know what query has been run? This is a sample from the log: { "type": "index\_search\_slowlog", "timestamp": "2020-06-26T16:38… --- ## [Public key protected PKCS12 not supported](https://discuss.elastic.co/t/public-key-protected-pkcs12-not-supported/238845)
**Author:** [@Yuy\_Heero](https://discuss.elastic.co/u/Yuy_Heero)\ **Replies:** 1\ **Last updated:** [June 27, 2020, 1:37am UTC](https://discuss.elastic.co/t/public-key-protected-pkcs12-not-supported/238845 "2020-06-27T01:37:51Z")
I want to use winbeat with siem, so I config elasticsearch 7.8 with TLS/SSL. I create cert files with this instruction. https://www.elastic.co/guide/en/elasticsearch/reference/7.7/configuring-tls.html#configuring-tls … --- ## [I need help! elastic doesn't get my mapping](https://discuss.elastic.co/t/i-need-help-elastic-doesnt-get-my-mapping/238909)
**Author:** [@sina12](https://discuss.elastic.co/u/sina12)\ **Replies:** 1\ **Last updated:** [June 26, 2020, 11:47pm UTC](https://discuss.elastic.co/t/i-need-help-elastic-doesnt-get-my-mapping/238909 "2020-06-26T23:47:27Z")
Hi Guys! I am in trouble. I need to visualize my data but elastic search doesn't accept my mapping. I created this mapping but Kibana/Elastic always adds "filed" and "message" and puts all the data inside those elemen… --- ## [Monitoring Amazon EKS logs and metrics with the Elastic Stack](https://discuss.elastic.co/t/monitoring-amazon-eks-logs-and-metrics-with-the-elastic-stack/238916)
**Author:** [@CoyoteKG](https://discuss.elastic.co/u/CoyoteKG)\ **Replies:** 1\ **Last updated:** [June 26, 2020, 11:43pm UTC](https://discuss.elastic.co/t/monitoring-amazon-eks-logs-and-metrics-with-the-elastic-stack/238916 "2020-06-26T23:43:29Z")
Hello @Asjad\_Athick, I found this nice guide, and I would like to try it. But, is it possible to be done with AWS ELK service instead Elastic Cloud service? --- ## [Help configuring logstash on Microsoft Azure](https://discuss.elastic.co/t/help-configuring-logstash-on-microsoft-azure/238919)
**Author:** [@LukeJB](https://discuss.elastic.co/u/LukeJB)\ **Replies:** 0\ **Last updated:** [June 26, 2020, 10:08pm UTC](https://discuss.elastic.co/t/help-configuring-logstash-on-microsoft-azure/238919 "2020-06-26T22:08:25Z")
Hi, I'm trying to get logstash configured correctly on Azure. I'm a bit less that a week old with this. Recently, when I try running logstash, I get the following warnings and errors: WARNING: Could not find logstash.ym… --- ## [Filter/search by log.file.path in kibana](https://discuss.elastic.co/t/filter-search-by-log-file-path-in-kibana/238918)
**Author:** [@shawn35gh](https://discuss.elastic.co/u/shawn35gh)\ **Replies:** 0\ **Last updated:** [June 26, 2020, 9:30pm UTC](https://discuss.elastic.co/t/filter-search-by-log-file-path-in-kibana/238918 "2020-06-26T21:30:39Z")
Hey, I want to search by log.file.path in filebeat-\*. values as below. I want to search/filter all the logs in folder 67890 and its sub-folder. anyone know how to do this search? Thanks in advance! Shawn /home/users/… --- ## [Filebeat do not send logs to kafka](https://discuss.elastic.co/t/filebeat-do-not-send-logs-to-kafka/238718)
**Author:** [@ramgold9](https://discuss.elastic.co/u/ramgold9)\ **Replies:** 3\ **Last updated:** [June 26, 2020, 9:47pm UTC](https://discuss.elastic.co/t/filebeat-do-not-send-logs-to-kafka/238718 "2020-06-26T21:47:01Z")
Hello Everyone, We are trying implement a centralized logging solution filebeats (on eks) -\>kafka -\> elasticsearch(aws). I have tried different versions of filebeat 6.X and 7.X with different valid versions of kafka. F… --- ## [Reingest Winlogbeat Events through Logstash](https://discuss.elastic.co/t/reingest-winlogbeat-events-through-logstash/238914)
**Author:** [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Replies:** 0\ **Last updated:** [June 26, 2020, 8:57pm UTC](https://discuss.elastic.co/t/reingest-winlogbeat-events-through-logstash/238914 "2020-06-26T20:57:50Z")
Not really sure where to put this question since it involves a lot of different parts of the stack.... I am currently ingesting windows event logs from a server --\> logstash --\> elasticsearch. I have modified my logsta… --- ## [\[Filebeat\] Changing filebeat's path for it's configuration module](https://discuss.elastic.co/t/filebeat-changing-filebeats-path-for-its-configuration-module/236243)
**Author:** [@gonzalo2kx](https://discuss.elastic.co/u/gonzalo2kx)\ **Replies:** 2\ **Last updated:** [June 26, 2020, 7:56pm UTC](https://discuss.elastic.co/t/filebeat-changing-filebeats-path-for-its-configuration-module/236243 "2020-06-26T19:56:22Z")
Good day, I am currently experiencing a problem to load the system module on filebeat. The system module has been enabled and verified using "filebeat modules list". When I launch filebeat 7.6.2 in publish mode I get th… --- ## [/etc/init.d/elasticsearch: No such file or directory](https://discuss.elastic.co/t/etc-init-d-elasticsearch-no-such-file-or-directory/238908)
**Author:** [@Akira\_Kise](https://discuss.elastic.co/u/Akira_Kise)\ **Replies:** 0\ **Last updated:** [June 26, 2020, 7:16pm UTC](https://discuss.elastic.co/t/etc-init-d-elasticsearch-no-such-file-or-directory/238908 "2020-06-26T19:16:10Z")
Please help! I'm so desperate in getting help because I don't know what else to do. I'm working on a server that already had elasticsearch installed. But then I downloaded an elasticsearch package with this command: w… --- ## [Aggregate from one doc table to select items from another](https://discuss.elastic.co/t/aggregate-from-one-doc-table-to-select-items-from-another/238902)
**Author:** [@CapitanRedBeard](https://discuss.elastic.co/u/CapitanRedBeard)\ **Replies:** 1\ **Last updated:** [June 26, 2020, 7:26pm UTC](https://discuss.elastic.co/t/aggregate-from-one-doc-table-to-select-items-from-another/238902 "2020-06-26T19:26:11Z")
Consider the following, I have a ratings and posts index. The ratings doc is structured like: { "postId": { "type": "text", "fields": { "keyword": { "t… --- ## [Grok pattern not working](https://discuss.elastic.co/t/grok-pattern-not-working/238875)
**Author:** [@ndg](https://discuss.elastic.co/u/ndg)\ **Replies:** 5\ **Last updated:** [June 26, 2020, 7:21pm UTC](https://discuss.elastic.co/t/grok-pattern-not-working/238875 "2020-06-26T19:21:27Z")
Hi! I want to parse a Haproxy log sent by a rsyslog service. I have a grok pattern to parse the original rsyslog message (which send the message of the service to a syslog\_message field) and another that parse the syslog… --- ## [Problem in parsing json string](https://discuss.elastic.co/t/problem-in-parsing-json-string/238901)
**Author:** [@azteker](https://discuss.elastic.co/u/azteker)\ **Replies:** 1\ **Last updated:** [June 26, 2020, 6:45pm UTC](https://discuss.elastic.co/t/problem-in-parsing-json-string/238901 "2020-06-26T18:45:44Z")
This is how I parse json in filter json { source =\> "json\_content" target =\> "content" remove\_field=\>\["json\_content"\] } But I got the following error "type"=\>"mapper\_parsing\_exception", "reason"=\>"failed to parse… --- ## [Logstash xpack monitoring with certificate instead of truststore](https://discuss.elastic.co/t/logstash-xpack-monitoring-with-certificate-instead-of-truststore/238885)
**Author:** [@mtudisco](https://discuss.elastic.co/u/mtudisco)\ **Replies:** 0\ **Last updated:** [June 26, 2020, 4:19pm UTC](https://discuss.elastic.co/t/logstash-xpack-monitoring-with-certificate-instead-of-truststore/238885 "2020-06-26T16:19:43Z")
Hi, I have a cluster of elasticsearch and i have configured ssl/tls and set xpack.security.http.ssl.client\_authentication: required The i have logstash with xpack monitoring enabled, and i have to specify a certific… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1966) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1968)