# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=833 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 834 --- ## [How to use http input logstash](https://discuss.elastic.co/t/how-to-use-http-input-logstash/311928)
**Author:** [@cihady](https://discuss.elastic.co/u/cihady)\ **Replies:** 1\ **Last updated:** [August 11, 2022, 1:19pm UTC](https://discuss.elastic.co/t/how-to-use-http-input-logstash/311928 "2022-08-11T13:19:55Z")
I am trying to api call logstash by using http input but when I run logstash it failse and throws the error below Here is my config file input { http { host=\>0.0.0.0 port =\>2020 } } output { elasticsearch { … --- ## ["tags":\["info","savedobjects-service"\],"pid":X,"message":"Starting saved objects migrations"}](https://discuss.elastic.co/t/tags-info-savedobjects-service-pid-x-message-starting-saved-objects-migrations/311458)
**Author:** [@alexus](https://discuss.elastic.co/u/alexus)\ **Replies:** 5\ **Last updated:** [August 11, 2022, 1:12pm UTC](https://discuss.elastic.co/t/tags-info-savedobjects-service-pid-x-message-starting-saved-objects-migrations/311458 "2022-08-11T13:12:43Z")
Hello World! As I start Kibana, it takes kinda long to start and in logs I see "Starting saved objects migrations": kibana | {"type":"log","@timestamp":"2022-08-04T04:10:47+00:00","tags":\["info","savedobjects-service"… --- ## [Elastic Agent error with event.created & event.ingested](https://discuss.elastic.co/t/elastic-agent-error-with-event-created-event-ingested/311927)
**Author:** [@DougR](https://discuss.elastic.co/u/DougR)\ **Replies:** 0\ **Last updated:** [August 11, 2022, 1:03pm UTC](https://discuss.elastic.co/t/elastic-agent-error-with-event-created-event-ingested/311927 "2022-08-11T13:03:41Z")
I am in the process of migrating from self-managed beats to Elastic Agent. I'm currently monitoring an application log in filebeat, which I'm migrating to a Custom Log in Elastic Agent. The log is ingesting as expected. … --- ## [Split logs per customers](https://discuss.elastic.co/t/split-logs-per-customers/311658)
**Author:** [@YannKistenmacker](https://discuss.elastic.co/u/YannKistenmacker)\ **Replies:** 9\ **Last updated:** [August 11, 2022, 12:46pm UTC](https://discuss.elastic.co/t/split-logs-per-customers/311658 "2022-08-11T12:46:34Z")
Hello everyone, I'm new elasticsearch user and i'm in charge to develop a system to monitoring our customers logs. So starting by this point i have to monitoring Fortinet Firewall Logs and i've already did with filebeat… --- ## [Documentation for dynamic template mappings?](https://discuss.elastic.co/t/documentation-for-dynamic-template-mappings/311746)
**Author:** [@nisow95612](https://discuss.elastic.co/u/nisow95612)\ **Replies:** 3\ **Last updated:** [August 11, 2022, 8:55am UTC](https://discuss.elastic.co/t/documentation-for-dynamic-template-mappings/311746 "2022-08-11T08:55:47Z")
Hello, I have trouble finding API documentation for setting dynamic templates. I expected this to be documented at Update mapping API | Elasticsearch Guide \[8.3\] | Elastic , but this just points to "mapping object" (A … --- ## [Auditbeat on Windows core with sshd](https://discuss.elastic.co/t/auditbeat-on-windows-core-with-sshd/311920)
**Author:** [@dmgeurts](https://discuss.elastic.co/u/dmgeurts)\ **Replies:** 0\ **Last updated:** [August 11, 2022, 11:42am UTC](https://discuss.elastic.co/t/auditbeat-on-windows-core-with-sshd/311920 "2022-08-11T11:42:56Z")
Just installed the first Aufitbeat agent to a Windows server and as this is a Windows Core server access is really only via ssh. Has anyone played with this setup? Auditbeat is reporting, but I'm not seeing sshd login be… --- ## [Connecting to ElasticSearch from Tableau Desktop](https://discuss.elastic.co/t/connecting-to-elasticsearch-from-tableau-desktop/311906)
**Author:** [@Naresh\_Vadla](https://discuss.elastic.co/u/Naresh_Vadla)\ **Replies:** 1\ **Last updated:** [August 11, 2022, 8:22am UTC](https://discuss.elastic.co/t/connecting-to-elasticsearch-from-tableau-desktop/311906 "2022-08-11T08:22:36Z")
I am trying to connect to Elasticsearch from Tableau Desktop. I am using Tableau Desktop 2021.x, Tableau Desktop 2022.x versions. My Elastic search version is 7.11.2. I have followed everything mentioned in But It is … --- ## [Add new document using logstash](https://discuss.elastic.co/t/add-new-document-using-logstash/311833)
**Author:** [@alex\_vermex](https://discuss.elastic.co/u/alex_vermex)\ **Replies:** 2\ **Last updated:** [August 11, 2022, 7:23am UTC](https://discuss.elastic.co/t/add-new-document-using-logstash/311833 "2022-08-11T07:23:52Z")
Hi, i have a file so i read this file using filebeat and i do the multilne like this filebeat.yml: - type: log enabled: true paths: - D:\\elastic\_stack\\logs\\\* fields: kafka\_topic: "kafka-topic-1" ta… --- ## [Does elasticsearch not support nfs as data directory?](https://discuss.elastic.co/t/does-elasticsearch-not-support-nfs-as-data-directory/311692)
**Author:** [@wajika](https://discuss.elastic.co/u/wajika)\ **Replies:** 7\ **Last updated:** [August 11, 2022, 6:30am UTC](https://discuss.elastic.co/t/does-elasticsearch-not-support-nfs-as-data-directory/311692 "2022-08-11T06:30:37Z")
es: 7.17.3 I mount the nfs path locally, and then point the es data directory to the location of the nfs, but the es startup fails, if I change the es data directory to a local partition (var/lib/elasticsearch) , then e… --- ## [Elastic Agent 8.3.3 on MacOS x509: “XYZR" certificate is not standards compliant](https://discuss.elastic.co/t/elastic-agent-8-3-3-on-macos-x509-xyzr-certificate-is-not-standards-compliant/311896)
**Author:** [@ajj31](https://discuss.elastic.co/u/ajj31)\ **Replies:** 0\ **Last updated:** [August 11, 2022, 6:16am UTC](https://discuss.elastic.co/t/elastic-agent-8-3-3-on-macos-x509-xyzr-certificate-is-not-standards-compliant/311896 "2022-08-11T06:16:34Z")
Hello Team, Fleet server is healthy and working well with Linux elastic agents. Only when i run an agent with another Agent policy for MacOS, I get this error. siza:elastic-agent-8.3.3-darwin-x86\_64 macZ$ sudo ./elast… --- ## [Configure Kibana logging.quiet](https://discuss.elastic.co/t/configure-kibana-logging-quiet/310590)
**Author:** [@alexus](https://discuss.elastic.co/u/alexus)\ **Replies:** 5\ **Last updated:** [August 11, 2022, 5:07am UTC](https://discuss.elastic.co/t/configure-kibana-logging-quiet/310590 "2022-08-11T05:07:01Z")
Hello World! I'm trying to: to be more precise: logging.quiet \[7.13.0\] Deprecated in 7.13.0. This setting will be removed in Kibana 8.0.Instead, set the root logger level to error. Set the value of this setting t… --- ## [Esrally: error: --target-hosts and --client-options must define the same keys for multi cluster setups](https://discuss.elastic.co/t/esrally-error-target-hosts-and-client-options-must-define-the-same-keys-for-multi-cluster-setups/311780)
**Author:** [@slowup](https://discuss.elastic.co/u/slowup)\ **Replies:** 8\ **Last updated:** [August 11, 2022, 4:58am UTC](https://discuss.elastic.co/t/esrally-error-target-hosts-and-client-options-must-define-the-same-keys-for-multi-cluster-setups/311780 "2022-08-11T04:58:58Z")
Rally version elastic/rally latest version The command is as shown above. Because the destination elasticsearch uses xpack, I use client-options to prevent a security exception. Even after looking at the official … --- ## [How to see the data from the time range \>=90 days in discover and alerting](https://discuss.elastic.co/t/how-to-see-the-data-from-the-time-range-90-days-in-discover-and-alerting/311783)
**Author:** [@muthusundar.p](https://discuss.elastic.co/u/muthusundar.p)\ **Replies:** 2\ **Last updated:** [August 11, 2022, 1:46am UTC](https://discuss.elastic.co/t/how-to-see-the-data-from-the-time-range-90-days-in-discover-and-alerting/311783 "2022-08-11T01:46:25Z")
Dear Experts, Please let us know how to see or set a dashboard to view greater than 90days of data. every time we select the time range in the discover option. --- ## [Reset elastic user password in docker container](https://discuss.elastic.co/t/reset-elastic-user-password-in-docker-container/311884)
**Author:** [@single.track.mind](https://discuss.elastic.co/u/single.track.mind)\ **Replies:** 3\ **Last updated:** [August 11, 2022, 12:30am UTC](https://discuss.elastic.co/t/reset-elastic-user-password-in-docker-container/311884 "2022-08-11T00:30:55Z")
I have inherited a 7.16.2 elastic cluster with Basic license, running in docker containers(using docker-compose) and am trying to add xpack.security.enabled=true as an intermediate step to configure internal user passwo… --- ## [Veeam Logstash Grok](https://discuss.elastic.co/t/veeam-logstash-grok/311774)
**Author:** [@rcraigncs](https://discuss.elastic.co/u/rcraigncs)\ **Replies:** 16\ **Last updated:** [August 10, 2022, 10:57pm UTC](https://discuss.elastic.co/t/veeam-logstash-grok/311774 "2022-08-10T22:57:30Z")
Hello, I'm trying to grok logs from Veeam logs \> filebeat file stream \> logstash to create a better filter on logs collected from Veeam. I'm relatively new when it comes to grok and I'm stuck on how I would go about gro… --- ## [Change type character varying to date elasticsearch](https://discuss.elastic.co/t/change-type-character-varying-to-date-elasticsearch/311885)
**Author:** [@5k\_pwc](https://discuss.elastic.co/u/5k_pwc)\ **Replies:** 1\ **Last updated:** [August 10, 2022, 10:52pm UTC](https://discuss.elastic.co/t/change-type-character-varying-to-date-elasticsearch/311885 "2022-08-10T22:52:11Z")
hi , anyone know how to changed data from char to date, i have inserted this code but she doesnt work . "datecons" : { "type" : "date" "format": "yyyy-MM-dd HH:mm:ss.SSSSSS" }, and my data like this: --- ## [Cant access API. Get unauthorized message](https://discuss.elastic.co/t/cant-access-api-get-unauthorized-message/311876)
**Author:** [@MK817664](https://discuss.elastic.co/u/MK817664)\ **Replies:** 0\ **Last updated:** [August 10, 2022, 8:38pm UTC](https://discuss.elastic.co/t/cant-access-api-get-unauthorized-message/311876 "2022-08-10T20:38:25Z")
So I'm very new and green to ES, I was trying to run over some online docs to try and get the connected to the API and do a insert of an attachment (PDF) When I attempted to run the put command I get back action \[indic… --- ## [Analysis the Logs of the Elastic](https://discuss.elastic.co/t/analysis-the-logs-of-the-elastic/311845)
**Author:** [@Aravind1](https://discuss.elastic.co/u/Aravind1)\ **Replies:** 1\ **Last updated:** [August 10, 2022, 9:40pm UTC](https://discuss.elastic.co/t/analysis-the-logs-of-the-elastic/311845 "2022-08-10T21:40:41Z")
Hi, We are having a few queries on Elasticsearch logs optimization, we are doing the cost optimization and analyzing the consumed resources logs and breakups for each and every resource. As per the developer's perspec… --- ## [Scaling of the Elastic](https://discuss.elastic.co/t/scaling-of-the-elastic/311846)
**Author:** [@Aravind1](https://discuss.elastic.co/u/Aravind1)\ **Replies:** 1\ **Last updated:** [August 10, 2022, 9:40pm UTC](https://discuss.elastic.co/t/scaling-of-the-elastic/311846 "2022-08-10T21:40:04Z")
Hi, How to check the current usage of the Elasticsearch and is there any possibility to do the scaling of the elastic --- ## [Map - Filter by boundary, shape or line](https://discuss.elastic.co/t/map-filter-by-boundary-shape-or-line/311682)
**Author:** [@Matt.Wash](https://discuss.elastic.co/u/Matt.Wash)\ **Replies:** 2\ **Last updated:** [August 10, 2022, 9:35pm UTC](https://discuss.elastic.co/t/map-filter-by-boundary-shape-or-line/311682 "2022-08-10T21:35:32Z")
creating the filter for heat map geolocation is awesome, but how do i delete a filtered area? There doesn't appear to have the the same UI as noted below. I am running 8.3.3 Any ideas? Cheers, Matt --- ## [Apply "doesn't equal" with nested query](https://discuss.elastic.co/t/apply-doesnt-equal-with-nested-query/311821)
**Author:** [@Anh\_Le](https://discuss.elastic.co/u/Anh_Le)\ **Replies:** 1\ **Last updated:** [August 10, 2022, 9:13pm UTC](https://discuss.elastic.co/t/apply-doesnt-equal-with-nested-query/311821 "2022-08-10T21:13:56Z")
Hi there! Please help to suggest queries to get data. How to get documents that don't have FilterFields. ContentFieldUseID = 20 and FilterFields.ContentFieldValues = "aaaa@gmail.com". Expected result: I want to get two… --- ## [Connection error with ssh and pem file (FSCrawler)](https://discuss.elastic.co/t/connection-error-with-ssh-and-pem-file-fscrawler/311878)
**Author:** [@Doddy\_Joel](https://discuss.elastic.co/u/Doddy_Joel)\ **Replies:** 0\ **Last updated:** [August 10, 2022, 9:02pm UTC](https://discuss.elastic.co/t/connection-error-with-ssh-and-pem-file-fscrawler/311878 "2022-08-10T21:02:39Z")
I'm using FSCrawler by @dadoonet and I'm trying to connect directory with ssh. I have ssh configured on my server so I can access a directory and use FSCrawler. The steps I have followed are as follows: Create a publ… --- ## [Match Query for 2 Fields from 2 Indices (Like SQL Inner Join)](https://discuss.elastic.co/t/match-query-for-2-fields-from-2-indices-like-sql-inner-join/310990)
**Author:** [@codewriterguy](https://discuss.elastic.co/u/codewriterguy)\ **Replies:** 2\ **Last updated:** [August 10, 2022, 7:40pm UTC](https://discuss.elastic.co/t/match-query-for-2-fields-from-2-indices-like-sql-inner-join/310990 "2022-08-10T19:40:45Z")
Hi, I am wondering if it is possible to query ES for matches on values in 2 fields from 2 indexes, so that I can use resulting values from both events in visualizations. I've set up indicator match rules via Kibana and… --- ## [Devise logs](https://discuss.elastic.co/t/devise-logs/311849)
**Author:** [@alex\_vermex](https://discuss.elastic.co/u/alex_vermex)\ **Replies:** 3\ **Last updated:** [August 10, 2022, 7:16pm UTC](https://discuss.elastic.co/t/devise-logs/311849 "2022-08-10T19:16:42Z")
Hi, i have log file it looks like this : \*TR START\* AAAA INS AAAA: 121212 DATE 20-07-22 TIME 09:18:00 09:18:04 PI 09:1… --- ## [Create multiple dashboard from a dashboard template](https://discuss.elastic.co/t/create-multiple-dashboard-from-a-dashboard-template/311664)
**Author:** [@atony](https://discuss.elastic.co/u/atony)\ **Replies:** 4\ **Last updated:** [August 10, 2022, 4:29pm UTC](https://discuss.elastic.co/t/create-multiple-dashboard-from-a-dashboard-template/311664 "2022-08-10T16:29:05Z")
Hello guys, I would like to generate similar dashboards for values of a field. for each value of the field -\> generate dashboard is there any way to do it on Kibana? I did it manualy for some values, using filters, b… --- ## [Convert Kibana Visualize to elasticsearch dsl](https://discuss.elastic.co/t/convert-kibana-visualize-to-elasticsearch-dsl/311738)
**Author:** [@zys864](https://discuss.elastic.co/u/zys864)\ **Replies:** 3\ **Last updated:** [August 10, 2022, 4:09pm UTC](https://discuss.elastic.co/t/convert-kibana-visualize-to-elasticsearch-dsl/311738 "2022-08-10T16:09:02Z")
Kibana Visualize internally use \_msearch,How to convert a Kibana Visualize to elasticsearch \_msearch dsl. --- ## [Creating success rate based on boolean field](https://discuss.elastic.co/t/creating-success-rate-based-on-boolean-field/311812)
**Author:** [@frederico](https://discuss.elastic.co/u/frederico)\ **Replies:** 0\ **Last updated:** [August 10, 2022, 9:36am UTC](https://discuss.elastic.co/t/creating-success-rate-based-on-boolean-field/311812 "2022-08-10T09:36:30Z")
Hello, I'm using elk 7.11.2 I want to do a line chart where I plot a ratio over time of a certain boolean field. Ie, i want aggregate by time (minutes or hours) and plot the percentage of records where the boolean fie… --- ## [Extract value from message field ( runtime fields)](https://discuss.elastic.co/t/extract-value-from-message-field-runtime-fields/311679)
**Author:** [@jplopezy](https://discuss.elastic.co/u/jplopezy)\ **Replies:** 16\ **Last updated:** [August 10, 2022, 2:23pm UTC](https://discuss.elastic.co/t/extract-value-from-message-field-runtime-fields/311679 "2022-08-10T14:23:44Z")
Hello everyone, Currently, I have an OpenVPN log that is sent from the server to elastic... from what I see the fields are pretty generic and the most important one is "message", it has all the information and I can't p… --- ## [Merge two csv files into single csv file using logstash](https://discuss.elastic.co/t/merge-two-csv-files-into-single-csv-file-using-logstash/311478)
**Author:** [@r.ganeshbabu](https://discuss.elastic.co/u/r.ganeshbabu)\ **Replies:** 4\ **Last updated:** [August 10, 2022, 2:21pm UTC](https://discuss.elastic.co/t/merge-two-csv-files-into-single-csv-file-using-logstash/311478 "2022-08-10T14:21:31Z")
Hi All, I am trying to merge two csv files into single csv file using logstash and below is the sample data and config I have tried, logstash-1.csv Sample,Gender,Age 1,dentist,10 2,doctor,20 3,rep,30 logstash-2.csv S… --- ## [Process\_cluster\_event\_timeout\_exception error on put-mapping in test environment](https://discuss.elastic.co/t/process-cluster-event-timeout-exception-error-on-put-mapping-in-test-environment/311567)
**Author:** [@diegomarcet](https://discuss.elastic.co/u/diegomarcet)\ **Replies:** 5\ **Last updated:** [August 10, 2022, 2:18pm UTC](https://discuss.elastic.co/t/process-cluster-event-timeout-exception-error-on-put-mapping-in-test-environment/311567 "2022-08-10T14:18:43Z")
Hello, I'm using the docker.elastic.co/elasticsearch/elasticsearch:7.17.5 docker image for running our tests in the CI server on a single node configuration. We're frequently getting the following error while running t… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=832) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=834)