# Latest **URL:** https://discuss.elastic.co/latest.md?page=1043 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1044 --- ## [Heartbeat - Avoid journey timeout](https://discuss.elastic.co/t/heartbeat-avoid-journey-timeout/309421)
**Author:** [@Verdugo\_Gonzalo](https://discuss.elastic.co/u/Verdugo_Gonzalo)\ **Replies:** 1\ **Last updated:** [July 18, 2022, 8:29pm UTC](https://discuss.elastic.co/t/heartbeat-avoid-journey-timeout/309421 "2022-07-18T20:29:58Z")
Hello, I'm working with synthetic monitoring. How can I prevent the journey from finishing when one of the steps throws an error or timeout and 2 steps remain pending? unfortunately I have a small number of logins on a… --- ## [Not possible to access the Cloud UI from the ECE Training Lab](https://discuss.elastic.co/t/not-possible-to-access-the-cloud-ui-from-the-ece-training-lab/309752)
**Author:** [@rcorfield](https://discuss.elastic.co/u/rcorfield)\ **Replies:** 2\ **Last updated:** [July 18, 2022, 8:24pm UTC](https://discuss.elastic.co/t/not-possible-to-access-the-cloud-ui-from-the-ece-training-lab/309752 "2022-07-18T20:24:58Z")
Hi, I'm working through the ECE Fundamentals training course, but I've hit a problem in Lab 2 when I'm asked to access Cloud UI. I think there's actually a problem with lab notes, because it initially asks to use the pub… --- ## [Logstash pipeline DLQ issue](https://discuss.elastic.co/t/logstash-pipeline-dlq-issue/309920)
**Author:** [@Harper\_S1](https://discuss.elastic.co/u/Harper_S1)\ **Replies:** 9\ **Last updated:** [July 18, 2022, 7:31pm UTC](https://discuss.elastic.co/t/logstash-pipeline-dlq-issue/309920 "2022-07-18T19:31:37Z")
Hi, I am upgrading my logstash from 7.x.x to 8.2.0. Problem is, logstash is not able to run the pipeline, showing the following error. \[2022-07-18T11:08:52,606\]\[ERROR\]\[org.logstash.common.io.DeadLetterQueueWriter\]\[main… --- ## [Better to have more indices or more shards per index?](https://discuss.elastic.co/t/better-to-have-more-indices-or-more-shards-per-index/309937)
**Author:** [@Jeremy\_Andrews](https://discuss.elastic.co/u/Jeremy_Andrews)\ **Replies:** 2\ **Last updated:** [July 18, 2022, 6:58pm UTC](https://discuss.elastic.co/t/better-to-have-more-indices-or-more-shards-per-index/309937 "2022-07-18T18:58:35Z")
Let's say I have 200 GB of data and I'll split it between 4 shards of 50 GB each. Is there a difference in terms of performance whether I have 4 indices with 1 shard each, versus having one index with 4 primary shards? --- ## [Logstash syslog input filter default grok patterns](https://discuss.elastic.co/t/logstash-syslog-input-filter-default-grok-patterns/309938)
**Author:** [@rugenl](https://discuss.elastic.co/u/rugenl)\ **Replies:** 1\ **Last updated:** [July 18, 2022, 6:54pm UTC](https://discuss.elastic.co/t/logstash-syslog-input-filter-default-grok-patterns/309938 "2022-07-18T18:54:47Z")
What are the default grok patterns for the syslog input filter? The data is from old snare, failing messages are formatted something like this: \<135\> 07/18/2022:18:14:52 GMT HOSTNAME syslog\_message. Thanks --- ## [Logstash cannot parse user\_agent field of nginx](https://discuss.elastic.co/t/logstash-cannot-parse-user-agent-field-of-nginx/309934)
**Author:** [@kosmylo](https://discuss.elastic.co/u/kosmylo)\ **Replies:** 3\ **Last updated:** [July 18, 2022, 6:51pm UTC](https://discuss.elastic.co/t/logstash-cannot-parse-user-agent-field-of-nginx/309934 "2022-07-18T18:51:43Z")
I have nginx logs with the following format: 192.168.0.1 - - \[18/Jul/2022:11:20:28 +0000\] "GET / HTTP/1.1" 200 15 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Sa… --- ## [Confirm connection](https://discuss.elastic.co/t/confirm-connection/309498)
**Author:** [@puritymind85](https://discuss.elastic.co/u/puritymind85)\ **Replies:** 1\ **Last updated:** [July 18, 2022, 6:39pm UTC](https://discuss.elastic.co/t/confirm-connection/309498 "2022-07-18T18:39:48Z")
Hello. Configuring ELK it is necessary to configure fleet and agent. The agent is running on the 3rd installation point fleet still shows Confirm connection. Tell me what could be the problem? Everything is installed on… --- ## [Elastic Agent on Amazon Linux 2: "service" executable file not found in $PATH](https://discuss.elastic.co/t/elastic-agent-on-amazon-linux-2-service-executable-file-not-found-in-path/309616)
**Author:** [@ajbailey](https://discuss.elastic.co/u/ajbailey)\ **Replies:** 2\ **Last updated:** [July 18, 2022, 6:29pm UTC](https://discuss.elastic.co/t/elastic-agent-on-amazon-linux-2-service-executable-file-not-found-in-path/309616 "2022-07-18T18:29:47Z")
Hi, Following the installation guidelines for the Elastic Agent, it does not seem possible to run it on Amazon Linux 2. How can we work around this? I believe that AL2 does not use "service". docker run -it --rm amazon… --- ## [256GB worth of logs accumulate over 24 hs](https://discuss.elastic.co/t/256gb-worth-of-logs-accumulate-over-24-hs/309904)
**Author:** [@ElasticUser11](https://discuss.elastic.co/u/ElasticUser11)\ **Replies:** 4\ **Last updated:** [July 18, 2022, 6:22pm UTC](https://discuss.elastic.co/t/256gb-worth-of-logs-accumulate-over-24-hs/309904 "2022-07-18T18:22:52Z")
I'm running a honeypot in a sandbox environment for testing purposes before I expose it to the Internet. Both the honeypot and Elastic seem to run fine on all fronts. The main issue I'm having is that despite the fair am… --- ## [Logstash Filter JSON syslog message field is not getting parsed](https://discuss.elastic.co/t/logstash-filter-json-syslog-message-field-is-not-getting-parsed/309864)
**Author:** [@Giridharan\_C](https://discuss.elastic.co/u/Giridharan_C)\ **Replies:** 3\ **Last updated:** [July 18, 2022, 6:12pm UTC](https://discuss.elastic.co/t/logstash-filter-json-syslog-message-field-is-not-getting-parsed/309864 "2022-07-18T18:12:22Z")
I cannot parse the incoming Syslog by JSON. The message field is not getting parsed. I tried JSON filter using addfield and also with mutate but no luck. I used GROK to parse specific fields but the message field has key… --- ## [Logstash grok pattern for custom nginx access log](https://discuss.elastic.co/t/logstash-grok-pattern-for-custom-nginx-access-log/309933)
**Author:** [@kosmylo](https://discuss.elastic.co/u/kosmylo)\ **Replies:** 0\ **Last updated:** [July 18, 2022, 5:46pm UTC](https://discuss.elastic.co/t/logstash-grok-pattern-for-custom-nginx-access-log/309933 "2022-07-18T17:46:09Z")
I have a custom format of nginx access.log and I want to parse it with logstash. The format of the access log is the following: log\_format main '$remote\_addr - $remote\_user \[$time\_local\] "$request" ' … --- ## [Unable to deploy elastic agent on kubernetes as daemonset](https://discuss.elastic.co/t/unable-to-deploy-elastic-agent-on-kubernetes-as-daemonset/309931)
**Author:** [@Samuel\_Ho](https://discuss.elastic.co/u/Samuel_Ho)\ **Replies:** 0\ **Last updated:** [July 18, 2022, 5:20pm UTC](https://discuss.elastic.co/t/unable-to-deploy-elastic-agent-on-kubernetes-as-daemonset/309931 "2022-07-18T17:20:38Z")
Hi, I'm having some issue trying to deploy elastic agent to monitor kubernetes as a daemonset. Please see logs from the pod as following. Greatly appreciate some guidance. {"log.level":"warn","@timestamp":"2022-07-18T1… --- ## [Crawling Microsoft Stream Videos Site Issue](https://discuss.elastic.co/t/crawling-microsoft-stream-videos-site-issue/309823)
**Author:** [@itsraj](https://discuss.elastic.co/u/itsraj)\ **Replies:** 5\ **Last updated:** [July 18, 2022, 5:00pm UTC](https://discuss.elastic.co/t/crawling-microsoft-stream-videos-site-issue/309823 "2022-07-18T17:00:22Z")
Hello Team, I am trying to crawl the Microsoft Streams site in Enterprise Search. But getting below error. Please help me to crawl the password-protected URL below to crawl videos. Microsoft Stream --- ## [Elastic APM AWS Lambda Python](https://discuss.elastic.co/t/elastic-apm-aws-lambda-python/309340)
**Author:** [@marcoaleixo](https://discuss.elastic.co/u/marcoaleixo)\ **Replies:** 13\ **Last updated:** [July 18, 2022, 4:53pm UTC](https://discuss.elastic.co/t/elastic-apm-aws-lambda-python/309340 "2022-07-18T16:53:26Z")
Kibana version: v8.3.1 Elasticsearch version: v8.3.1 APM Server version: APM Server version 8.3.1 APM Agent language and version: elastic-apm==6.10.1 using Python 3.8 Browser version: Google Chrome Versão 103.0.… --- ## [Removing special characters](https://discuss.elastic.co/t/removing-special-characters/309766)
**Author:** [@JeremyP](https://discuss.elastic.co/u/JeremyP)\ **Replies:** 6\ **Last updated:** [July 18, 2022, 4:40pm UTC](https://discuss.elastic.co/t/removing-special-characters/309766 "2022-07-18T16:40:07Z")
Hello, I have some special characters in one of my fields which I'm having issues removing. They may be reserved characters so my logstash instance is failing. Here is the event in question... "proof" =\> \[ … --- ## [Localhost path to folder to automatically ingest existent files](https://discuss.elastic.co/t/localhost-path-to-folder-to-automatically-ingest-existent-files/309707)
**Author:** [@marius03](https://discuss.elastic.co/u/marius03)\ **Replies:** 2\ **Last updated:** [July 18, 2022, 4:18pm UTC](https://discuss.elastic.co/t/localhost-path-to-folder-to-automatically-ingest-existent-files/309707 "2022-07-18T16:18:23Z")
Hi, I have installed Elasticsearch with Kibana on Localhost on Linux Mint, everything works perfectly but I can't seem to set it to automatically ingest files from certain folders. I want it to automatically ingest all… --- ## [Implementing Search After to fetch hits greater than 10000](https://discuss.elastic.co/t/implementing-search-after-to-fetch-hits-greater-than-10000/309913)
**Author:** [@Namita\_Jaokar](https://discuss.elastic.co/u/Namita_Jaokar)\ **Replies:** 1\ **Last updated:** [July 18, 2022, 2:59pm UTC](https://discuss.elastic.co/t/implementing-search-after-to-fetch-hits-greater-than-10000/309913 "2022-07-18T14:59:18Z")
Hi team, I am using elasticsearch in java to query hits that are greater than maximum default of 10000. For the same I came across using search after along with sort. I tried the query by sorting it on the basis of @ti… --- ## [Receiving partial messages in elastic](https://discuss.elastic.co/t/receiving-partial-messages-in-elastic/309730)
**Author:** [@ytld](https://discuss.elastic.co/u/ytld)\ **Replies:** 4\ **Last updated:** [July 18, 2022, 2:56pm UTC](https://discuss.elastic.co/t/receiving-partial-messages-in-elastic/309730 "2022-07-18T14:56:03Z")
We have a problem in our ELK-stack of which I'm unsure how to solve. We're running 8.3 version of the ELK-stack on Centos 7 machines and whereas everything worked fine before, since this week we're only seeing partial m… --- ## [Searching on aggregated nested fields](https://discuss.elastic.co/t/searching-on-aggregated-nested-fields/309909)
**Author:** [@Robina\_Dhingra1](https://discuss.elastic.co/u/Robina_Dhingra1)\ **Replies:** 0\ **Last updated:** [July 18, 2022, 1:57pm UTC](https://discuss.elastic.co/t/searching-on-aggregated-nested-fields/309909 "2022-07-18T13:57:23Z")
Hi Team Elastic, We have a requirement where we created continuous transform to keep track of field status of our trades data. The transform aggregates the data and produces documents in this form - { "\_index":… --- ## [Dedicated index logs-ti\* (Threat Intel module) in Filebeat](https://discuss.elastic.co/t/dedicated-index-logs-ti-threat-intel-module-in-filebeat/309908)
**Author:** [@Rysiu](https://discuss.elastic.co/u/Rysiu)\ **Replies:** 0\ **Last updated:** [July 18, 2022, 1:52pm UTC](https://discuss.elastic.co/t/dedicated-index-logs-ti-threat-intel-module-in-filebeat/309908 "2022-07-18T13:52:26Z")
I have a minor problem, According to the documentation, the logs from the Threat Intel module in Filebeat can reside in a dedicated logs-ti\* index. Quick link to the page: Enable threat intelligence integrations | Elas… --- ## [First filter then run nested query](https://discuss.elastic.co/t/first-filter-then-run-nested-query/309905)
**Author:** [@Michal\_Bogusz](https://discuss.elastic.co/u/Michal_Bogusz)\ **Replies:** 2\ **Last updated:** [July 18, 2022, 1:51pm UTC](https://discuss.elastic.co/t/first-filter-then-run-nested-query/309905 "2022-07-18T13:51:03Z")
I have document with mapping: { "properties": { "title": {"type": "text"}, "added": {"type": "date"}, "pdf\_url": {"type": "text"}, "blocks": {"type": "nested"} } } I plan to have… --- ## [Unable to create webhook action with path parameter](https://discuss.elastic.co/t/unable-to-create-webhook-action-with-path-parameter/309204)
**Author:** [@Vivek\_Kumar1](https://discuss.elastic.co/u/Vivek_Kumar1)\ **Replies:** 2\ **Last updated:** [July 18, 2022, 1:32pm UTC](https://discuss.elastic.co/t/unable-to-create-webhook-action-with-path-parameter/309204 "2022-07-18T13:32:35Z")
Hi, I want to create a connector for opsgienie, which will close the alert once it will be recovered. Opsgenie allows to close alerts by the alias, Alert API. So how do I mention the id or alias in the URL? What will… --- ## [Query Time Dynamic synonym](https://discuss.elastic.co/t/query-time-dynamic-synonym/309898)
**Author:** [@pavithra\_arul](https://discuss.elastic.co/u/pavithra_arul)\ **Replies:** 0\ **Last updated:** [July 18, 2022, 12:38pm UTC](https://discuss.elastic.co/t/query-time-dynamic-synonym/309898 "2022-07-18T12:38:38Z")
Hi Team, Trying to achieve dynamic synonym expansion at Query time using Rest API call Trying to update the synonym.txt file dynamically using Rest API. (or) updating the synonyms list via Rest call without even creat… --- ## [How to "reindex" a field with "source" disabled and "store: true"?](https://discuss.elastic.co/t/how-to-reindex-a-field-with-source-disabled-and-store-true/309817)
**Author:** [@huuyafwww](https://discuss.elastic.co/u/huuyafwww)\ **Replies:** 4\ **Last updated:** [July 18, 2022, 12:52pm UTC](https://discuss.elastic.co/t/how-to-reindex-a-field-with-source-disabled-and-store-true/309817 "2022-07-18T12:52:15Z")
I am currently looking to optimize the performance of indexing and search on fields with very large text in them. And I have already read the following articles and previous forum posts. Searching in a large text fiel… --- ## [Aggregate sum till specific threshold reached](https://discuss.elastic.co/t/aggregate-sum-till-specific-threshold-reached/309897)
**Author:** [@brampurnot](https://discuss.elastic.co/u/brampurnot)\ **Replies:** 0\ **Last updated:** [July 18, 2022, 12:27pm UTC](https://discuss.elastic.co/t/aggregate-sum-till-specific-threshold-reached/309897 "2022-07-18T12:27:16Z")
Hi all, We are storing products in an index. Each product has a price and a specific quantity. Now we want to get the list of cheapest products up till a maximum quantity of 100. The total quantity should be a sum aggr… --- ## [Available fields are not visible in the Discovery panel](https://discuss.elastic.co/t/available-fields-are-not-visible-in-the-discovery-panel/309781)
**Author:** [@random\_dash](https://discuss.elastic.co/u/random_dash)\ **Replies:** 1\ **Last updated:** [July 18, 2022, 12:25pm UTC](https://discuss.elastic.co/t/available-fields-are-not-visible-in-the-discovery-panel/309781 "2022-07-18T12:25:05Z")
Hello! I have some indices where a part of their corresponding template is like this: when I query the indices in the Dev Tools, I am able to retrieve desired data and see the above fields. For example you can c… --- ## [Hide Metricbeat Dashboard](https://discuss.elastic.co/t/hide-metricbeat-dashboard/309399)
**Author:** [@Diego\_Lima](https://discuss.elastic.co/u/Diego_Lima)\ **Replies:** 1\ **Last updated:** [July 18, 2022, 12:23pm UTC](https://discuss.elastic.co/t/hide-metricbeat-dashboard/309399 "2022-07-18T12:23:05Z")
Hello guys! I would like to know how I can hide only the metricbeat dashboard, for my anonymous login user. Note: I didn't upload an example image, because I'm getting the following error here: "Sorry, there was an err… --- ## [Problems With Winlogbeat](https://discuss.elastic.co/t/problems-with-winlogbeat/308508)
**Author:** [@Jared9922](https://discuss.elastic.co/u/Jared9922)\ **Replies:** 3\ **Last updated:** [July 18, 2022, 12:22pm UTC](https://discuss.elastic.co/t/problems-with-winlogbeat/308508 "2022-07-18T12:22:56Z")
Hello, I am trying to setup Winlogbeat and I am running into some issues. I was able to get it configured correctly and when I run it in debug mode it seems to run fine. .\\winlogbeat.exe -c winlogbeat.yml -e -v -d "\*" W… --- ## [Elastic charts with angular js](https://discuss.elastic.co/t/elastic-charts-with-angular-js/309656)
**Author:** [@frankgif](https://discuss.elastic.co/u/frankgif)\ **Replies:** 1\ **Last updated:** [July 18, 2022, 12:22pm UTC](https://discuss.elastic.co/t/elastic-charts-with-angular-js/309656 "2022-07-18T12:22:13Z")
How to integrate elastic charts with Angular application. Without having react framework --- ## [Automation of Data Analysis](https://discuss.elastic.co/t/automation-of-data-analysis/309879)
**Author:** [@elkstack2](https://discuss.elastic.co/u/elkstack2)\ **Replies:** 1\ **Last updated:** [July 18, 2022, 12:17pm UTC](https://discuss.elastic.co/t/automation-of-data-analysis/309879 "2022-07-18T12:17:46Z")
Hi all! I am interning at an organisation and have been asked to research automation in the ELK stack - I don't really know what I'm doing so any help would be appreciated! One of the increasingly large challenges my or… [Previous page](https://discuss.elastic.co/latest.md?page=1042) [Next page](https://discuss.elastic.co/latest.md?page=1044)