# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=735 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 736 --- ## [Logtash CSV Parser Fail Muline Value is counting next raw](https://discuss.elastic.co/t/logtash-csv-parser-fail-muline-value-is-counting-next-raw/318617)
**Author:** [@dharminfadia](https://discuss.elastic.co/u/dharminfadia)\ **Replies:** 10\ **Last updated:** [November 11, 2022, 6:33pm UTC](https://discuss.elastic.co/t/logtash-csv-parser-fail-muline-value-is-counting-next-raw/318617 "2022-11-11T18:33:14Z")
see in my First raw last coulumn have multiline and second raw haveing signle line --- ## [Multilingual search and retrieval of a translated field](https://discuss.elastic.co/t/multilingual-search-and-retrieval-of-a-translated-field/318683)
**Author:** [@ChristopherHS](https://discuss.elastic.co/u/ChristopherHS)\ **Replies:** 2\ **Last updated:** [November 11, 2022, 6:05pm UTC](https://discuss.elastic.co/t/multilingual-search-and-retrieval-of-a-translated-field/318683 "2022-11-11T18:05:55Z")
Hello, I have the following mapping: { "settings": { "analysis": { "analyzer": { "en\_stopwords": { "type": "standard", "stopwords": "\_english\_" }, "de\_stopwords":… --- ## [Logstash Not Starting On Reboot - Ubuntu](https://discuss.elastic.co/t/logstash-not-starting-on-reboot-ubuntu/318406)
**Author:** [@AlP9923](https://discuss.elastic.co/u/AlP9923)\ **Replies:** 5\ **Last updated:** [November 11, 2022, 5:19pm UTC](https://discuss.elastic.co/t/logstash-not-starting-on-reboot-ubuntu/318406 "2022-11-11T17:19:51Z")
Hi My single node setup works fine except on reboot of the Ubuntu server when Logstash usually does not auto start up. But using the systemctl start logstash works ok. It looks like the issue is that Logstash is trying… --- ## [Cannot index event publisher - new line](https://discuss.elastic.co/t/cannot-index-event-publisher-new-line/318751)
**Author:** [@arhodoula](https://discuss.elastic.co/u/arhodoula)\ **Replies:** 0\ **Last updated:** [November 11, 2022, 3:25pm UTC](https://discuss.elastic.co/t/cannot-index-event-publisher-new-line/318751 "2022-11-11T15:25:04Z")
I am getting an illegal\_argument\_exception in filebeat. I found out it is because of the "reason": """Illegal unquoted character ((CTRL-CHAR, code 13)): has to be escaped using backslash to be included in string value … --- ## [Sorting identical timestamp of logs in kibana](https://discuss.elastic.co/t/sorting-identical-timestamp-of-logs-in-kibana/318746)
**Author:** [@Bikash\_Swain](https://discuss.elastic.co/u/Bikash_Swain)\ **Replies:** 0\ **Last updated:** [November 11, 2022, 1:57pm UTC](https://discuss.elastic.co/t/sorting-identical-timestamp-of-logs-in-kibana/318746 "2022-11-11T13:57:36Z")
Hi , I have filebeat-logstash-ES-kibana setup for index abc\* for one of the application log. In log file we have many occurrences of identical timestamp for messages/logs. sample log file below. when we are searching … --- ## [Rollup with max/min aggregation on @timestamp field typed as "float"](https://discuss.elastic.co/t/rollup-with-max-min-aggregation-on-timestamp-field-typed-as-float/317735)
**Author:** [@ISim](https://discuss.elastic.co/u/ISim)\ **Replies:** 3\ **Last updated:** [November 11, 2022, 1:46pm UTC](https://discuss.elastic.co/t/rollup-with-max-min-aggregation-on-timestamp-field-typed-as-float/317735 "2022-11-11T13:46:44Z")
Hello all, I have a index with accounting events with @timestamp (type "date"). There is a high volume of events so I created rollup job (elasticsearch 7.17.3) with "date\_histogram" : { "d… --- ## [Logstash Syslog output plugin streaming adds additional headers](https://discuss.elastic.co/t/logstash-syslog-output-plugin-streaming-adds-additional-headers/318719)
**Author:** [@Anandh\_Kumar](https://discuss.elastic.co/u/Anandh_Kumar)\ **Replies:** 1\ **Last updated:** [November 11, 2022, 1:45pm UTC](https://discuss.elastic.co/t/logstash-syslog-output-plugin-streaming-adds-additional-headers/318719 "2022-11-11T13:45:43Z")
Hi We are using Logstash syslog output plugin v3.0.5 to stream audit log to a external SIEM server using TCP with SSL. It is observed that there are additional headers automatically appended by the plugin to the origina… --- ## [CEF message parsing](https://discuss.elastic.co/t/cef-message-parsing/318743)
**Author:** [@d\_c](https://discuss.elastic.co/u/d_c)\ **Replies:** 0\ **Last updated:** [November 11, 2022, 1:14pm UTC](https://discuss.elastic.co/t/cef-message-parsing/318743 "2022-11-11T13:14:15Z")
Hello, I'm using TCP Input plugin with CEF codec to receive CEF messages. Problem is, that some messages are not parsed parsed correctly. Message isn't processed as whole, but it's split at blankspace character within m… --- ## [Import saved objects through API](https://discuss.elastic.co/t/import-saved-objects-through-api/315481)
**Author:** [@hemmerlin](https://discuss.elastic.co/u/hemmerlin)\ **Replies:** 2\ **Last updated:** [October 14, 2022, 4:00pm UTC](https://discuss.elastic.co/t/import-saved-objects-through-api/315481 "2022-10-14T16:00:32Z")
Hello, To summarize this post, I'm able to import Kibana saved objects using the web UI, but I face some issues importing them using the API. We use a dashboard.ndjson file which is the result of a saved object export … --- ## [Scaling elastic search for read heavy applications](https://discuss.elastic.co/t/scaling-elastic-search-for-read-heavy-applications/317597)
**Author:** [@himesh](https://discuss.elastic.co/u/himesh)\ **Replies:** 11\ **Last updated:** [November 11, 2022, 12:03pm UTC](https://discuss.elastic.co/t/scaling-elastic-search-for-read-heavy-applications/317597 "2022-11-11T12:03:37Z")
We have Node JS (Nest JS / Express) - based application services on the GCP cloud. We are using Elasticsearch to support full-text search on a blog/news website. Our requirement is to support 2000 reads per second mini… --- ## [Suricata SIEM](https://discuss.elastic.co/t/suricata-siem/318733)
**Author:** [@Ryhal\_Kumar](https://discuss.elastic.co/u/Ryhal_Kumar)\ **Replies:** 0\ **Last updated:** [November 11, 2022, 11:15am UTC](https://discuss.elastic.co/t/suricata-siem/318733 "2022-11-11T11:15:32Z")
I am running a suricata siem with suricata,elasticsearch,kibana and filebeat. But there are few issues, while the dashboard is running it is fine but when I run a ddos attack using kali it stops working and shows alert o… --- ## [Any performance difference between "must\_not" clause and "query\_string" with NOT operator?](https://discuss.elastic.co/t/any-performance-difference-between-must-not-clause-and-query-string-with-not-operator/318729)
**Author:** [@astrodi](https://discuss.elastic.co/u/astrodi)\ **Replies:** 0\ **Last updated:** [November 11, 2022, 11:09am UTC](https://discuss.elastic.co/t/any-performance-difference-between-must-not-clause-and-query-string-with-not-operator/318729 "2022-11-11T11:09:39Z")
Hi there, I'm wondering, if there is any performance gain using must\_not clause over to query\_string using NOT operator (will be used inside filter and should clause). query\_string has obviously shorter scripture, no r… --- ## [Input/output error when creating snapshot](https://discuss.elastic.co/t/input-output-error-when-creating-snapshot/318721)
**Author:** [@lifer](https://discuss.elastic.co/u/lifer)\ **Replies:** 1\ **Last updated:** [November 11, 2022, 10:48am UTC](https://discuss.elastic.co/t/input-output-error-when-creating-snapshot/318721 "2022-11-11T10:48:38Z")
Hi! We have a 3-nodes self-hosted ES 8.5 cluster, and when we make daily snapshots few shards fail every time with the following error: INTERNAL\_SERVER\_ERROR: UncategorizedExecutionException\[Failed execution\]; nested:… --- ## [Pipeline getting terminated with OrgJrubyExceptions::ThreadKill](https://discuss.elastic.co/t/pipeline-getting-terminated-with-orgjrubyexceptions-threadkill/318724)
**Author:** [@Hafis](https://discuss.elastic.co/u/Hafis)\ **Replies:** 0\ **Last updated:** [November 11, 2022, 10:25am UTC](https://discuss.elastic.co/t/pipeline-getting-terminated-with-orgjrubyexceptions-threadkill/318724 "2022-11-11T10:25:45Z")
Hi Am using logstash 8.4.0 with csv filter. Am facing an issue that logstash is getting killed itself. From the logs I can see that the pipeline is getting terminated. Below I have pasted sample logs. \[2022-11-11T06:40… --- ## [Use Filebeat in MacOS M1 to ship extracted win evtx file to docker ELK](https://discuss.elastic.co/t/use-filebeat-in-macos-m1-to-ship-extracted-win-evtx-file-to-docker-elk/318723)
**Author:** [@Roger\_Huang](https://discuss.elastic.co/u/Roger_Huang)\ **Replies:** 0\ **Last updated:** [November 11, 2022, 10:19am UTC](https://discuss.elastic.co/t/use-filebeat-in-macos-m1-to-ship-extracted-win-evtx-file-to-docker-elk/318723 "2022-11-11T10:19:09Z")
Hi all, I am new to ELK. I know this may sounds weird. But I am doing some POC and testing by extracting a Sysmon EVTX from a windows server. The workstation I am using a Mac M1. I installed filebeat in Mac and wanted … --- ## [Master not discovered or elected yet](https://discuss.elastic.co/t/master-not-discovered-or-elected-yet/318706)
**Author:** [@usilva](https://discuss.elastic.co/u/usilva)\ **Replies:** 3\ **Last updated:** [November 11, 2022, 9:12am UTC](https://discuss.elastic.co/t/master-not-discovered-or-elected-yet/318706 "2022-11-11T09:12:46Z")
{"type": "server", "timestamp": "2022-11-11T05:46:01,375Z", "level": "WARN", "component": "o.e.c.c.ClusterFormationFailureHelper", "cluster.name": "elasticsearch", "node.name": "elasticsearch-master-0", "message": "mas… --- ## [Extract data from elasticsearch and store into mongodb](https://discuss.elastic.co/t/extract-data-from-elasticsearch-and-store-into-mongodb/318337)
**Author:** [@chinmoy\_padhi](https://discuss.elastic.co/u/chinmoy_padhi)\ **Replies:** 4\ **Last updated:** [November 11, 2022, 7:44am UTC](https://discuss.elastic.co/t/extract-data-from-elasticsearch-and-store-into-mongodb/318337 "2022-11-11T07:44:32Z")
Hi, I'm looking for an option to extract data from Elasticsearch and store into the mongodb using some python script. Please help me with that. --- ## [Winlogbeat events not parsed](https://discuss.elastic.co/t/winlogbeat-events-not-parsed/318518)
**Author:** [@vitkon](https://discuss.elastic.co/u/vitkon)\ **Replies:** 1\ **Last updated:** [November 11, 2022, 9:08am UTC](https://discuss.elastic.co/t/winlogbeat-events-not-parsed/318518 "2022-11-11T09:08:50Z")
Hello, I am using elasticstack v8. The messages are sent from winlogbeat -\> logstash -\> elastic. The message is arrived unparsed. Logstash config: input { beats { port =\> "5044" … --- ## [Elastic Dashboard code of Elastic.co](https://discuss.elastic.co/t/elastic-dashboard-code-of-elastic-co/318688)
**Author:** [@kelk](https://discuss.elastic.co/u/kelk)\ **Replies:** 2\ **Last updated:** [November 11, 2022, 7:13am UTC](https://discuss.elastic.co/t/elastic-dashboard-code-of-elastic-co/318688 "2022-11-11T07:13:25Z")
Just checking the stock ticker of Elastic https://ir.elastic.co/stock/stock-quote/default.aspx Any chance to get the code of the above ? Looks nice and clean and blazing fast. cheers --- ## [Network devices like switch and firewall logs not visible in ELk](https://discuss.elastic.co/t/network-devices-like-switch-and-firewall-logs-not-visible-in-elk/318711)
**Author:** [@vrkumar79](https://discuss.elastic.co/u/vrkumar79)\ **Replies:** 0\ **Last updated:** [November 11, 2022, 6:48am UTC](https://discuss.elastic.co/t/network-devices-like-switch-and-firewall-logs-not-visible-in-elk/318711 "2022-11-11T06:48:25Z")
network devices like switches and firewall logs are not visible in Elk. we are using customized UDP ports for each location, --- ## [How to resize image file in watcher](https://discuss.elastic.co/t/how-to-resize-image-file-in-watcher/318703)
**Author:** [@minkiyo](https://discuss.elastic.co/u/minkiyo)\ **Replies:** 0\ **Last updated:** [November 11, 2022, 2:51am UTC](https://discuss.elastic.co/t/how-to-resize-image-file-in-watcher/318703 "2022-11-11T02:51:00Z")
I want to add image file in email using watcher. but It's only added very big size image file. I think the width and height in img src don't seem to work. Would you please explain how to resize image file in watcher?? … --- ## [Kibana unavailable](https://discuss.elastic.co/t/kibana-unavailable/316552)
**Author:** [@not\_correct](https://discuss.elastic.co/u/not_correct)\ **Replies:** 8\ **Last updated:** [October 14, 2022, 1:26pm UTC](https://discuss.elastic.co/t/kibana-unavailable/316552 "2022-10-14T13:26:45Z")
Hi, I am running into an issue: the kibana is not available. When I check the log it gives me the error that kibana version is not compliant with the version of elasticsearch. It looks like I have to downgrade it in ord… --- ## [Elastic 8.4 / PFSense Agent](https://discuss.elastic.co/t/elastic-8-4-pfsense-agent/318238)
**Author:** [@010101](https://discuss.elastic.co/u/010101)\ **Replies:** 2\ **Last updated:** [November 11, 2022, 1:39am UTC](https://discuss.elastic.co/t/elastic-8-4-pfsense-agent/318238 "2022-11-11T01:39:11Z")
So... I setup according to this pfSense | Elastic docs Pointed my firewall at ELK stack But 0 data Are there any instructions on how to get this going? --- ## [Elasticsearch8.5.0 jar hell problem](https://discuss.elastic.co/t/elasticsearch8-5-0-jar-hell-problem/318619)
**Author:** [@asasas234](https://discuss.elastic.co/u/asasas234)\ **Replies:** 1\ **Last updated:** [November 11, 2022, 1:10am UTC](https://discuss.elastic.co/t/elasticsearch8-5-0-jar-hell-problem/318619 "2022-11-11T01:10:51Z")
warning: ignoring JAVA\_HOME=/home/lizhibo/.sdkman/candidates/java/current; using bundled JDK java=/home/lizhibo/elasticsearch-8.5.0/jdk/bin/java \[2022-11-10T15:23:01,353\]\[ERROR\]\[o.e.b.Elasticsearch \] \[node-1\] fatal … --- ## [Filebeat Apache module not showing data on Dashboards when using Logstash](https://discuss.elastic.co/t/filebeat-apache-module-not-showing-data-on-dashboards-when-using-logstash/318594)
**Author:** [@Carlos\_T](https://discuss.elastic.co/u/Carlos_T)\ **Replies:** 12\ **Last updated:** [November 10, 2022, 11:08pm UTC](https://discuss.elastic.co/t/filebeat-apache-module-not-showing-data-on-dashboards-when-using-logstash/318594 "2022-11-10T23:08:08Z")
Good afternoon all. I've recently installed a filebeat and enabled the system and apache modules. After that I set the filebeat.yml to point to ES and Kibana and run the 'filebeat setup -e' Everything went as expecte… --- ## [Three Node Elastic Cluster balance issue](https://discuss.elastic.co/t/three-node-elastic-cluster-balance-issue/318680)
**Author:** [@alex\_sws](https://discuss.elastic.co/u/alex_sws)\ **Replies:** 6\ **Last updated:** [November 10, 2022, 10:08pm UTC](https://discuss.elastic.co/t/three-node-elastic-cluster-balance-issue/318680 "2022-11-10T22:08:58Z")
I have a 3 node elastic cluster with each node having equal disk space (250 Gb) but for some reason two of the nodes have significant more data usage then the others. When reviewing the servers, all the data usage is tie… --- ## [Can filebeat's o365 module fetch windows defender logs](https://discuss.elastic.co/t/can-filebeats-o365-module-fetch-windows-defender-logs/317575)
**Author:** [@sriramb12](https://discuss.elastic.co/u/sriramb12)\ **Replies:** 2\ **Last updated:** [November 10, 2022, 8:35pm UTC](https://discuss.elastic.co/t/can-filebeats-o365-module-fetch-windows-defender-logs/317575 "2022-11-10T20:35:50Z")
Hello Team I am looking for some insights on fetching windwos defender logs via filebeat (o365 module) Currently the o365 config (yml) lists these: List of content-types to fetch. By default all known content-types # … --- ## [Network Condition Not Working?](https://discuss.elastic.co/t/network-condition-not-working/318369)
**Author:** [@chapmanjc](https://discuss.elastic.co/u/chapmanjc)\ **Replies:** 7\ **Last updated:** [November 10, 2022, 7:03pm UTC](https://discuss.elastic.co/t/network-condition-not-working/318369 "2022-11-10T19:03:10Z")
Hello all, I've set up an an Elastic Agent and I am using the Microsoft DHCP module. Everything is working great except there is a slight issue in regards to going into the "Advanced Options" inside of the Integration.… --- ## [How to handle "ef" and "num\_candidates" parameters in hnsw search](https://discuss.elastic.co/t/how-to-handle-ef-and-num-candidates-parameters-in-hnsw-search/318681)
**Author:** [@wole](https://discuss.elastic.co/u/wole)\ **Replies:** 1\ **Last updated:** [November 10, 2022, 6:23pm UTC](https://discuss.elastic.co/t/how-to-handle-ef-and-num-candidates-parameters-in-hnsw-search/318681 "2022-11-10T18:23:36Z")
Hi team, I am in the process of learning how to use ANN search (with HNSW) on Elasticsearch: in order to do so I am comparing the results I obtain with Elasticsearch and the faiss implementation of the algorithm (using … --- ## [How to install two Winlogbeat instances in same machine](https://discuss.elastic.co/t/how-to-install-two-winlogbeat-instances-in-same-machine/318674)
**Author:** [@hiruni.insyncit.net](https://discuss.elastic.co/u/hiruni.insyncit.net)\ **Replies:** 2\ **Last updated:** [November 10, 2022, 5:53pm UTC](https://discuss.elastic.co/t/how-to-install-two-winlogbeat-instances-in-same-machine/318674 "2022-11-10T17:53:36Z")
I'm using Elasticsearch 8.1 version and I want send Winlogbeat data to different ES clusters. I want to know how I can do it...? [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=734) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=736)