# Latest **URL:** https://discuss.elastic.co/latest.md?page=1075 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1076 --- ## [Question regarding using a logo](https://discuss.elastic.co/t/question-regarding-using-a-logo/308027)
**Author:** [@Marko\_Todoric](https://discuss.elastic.co/u/Marko_Todoric)\ **Replies:** 1\ **Last updated:** [June 24, 2022, 12:15am UTC](https://discuss.elastic.co/t/question-regarding-using-a-logo/308027 "2022-06-24T00:15:51Z")
Hello everyone I'm creating an addon for an open source project that would essentially be filebeat and will be used to ship logs to user self-hosted elasticsearch cluster/node so they can store and/or analyze logs. I wo… --- ## [How to ship logs from filebeat to elasticsearch](https://discuss.elastic.co/t/how-to-ship-logs-from-filebeat-to-elasticsearch/308039)
**Author:** [@gisellecarballo](https://discuss.elastic.co/u/gisellecarballo)\ **Replies:** 2\ **Last updated:** [June 24, 2022, 12:10am UTC](https://discuss.elastic.co/t/how-to-ship-logs-from-filebeat-to-elasticsearch/308039 "2022-06-24T00:10:26Z")
Hi Everyone, I am trying to form a setup where my cisco devices syslog to be sent to filebeat and then filebeat will send it to elasticsearch so that it can be viewed on kibana. Problem: Filebeat error is The requested… --- ## [Metricbeat error about scanning empty io.stat file](https://discuss.elastic.co/t/metricbeat-error-about-scanning-empty-io-stat-file/308063)
**Author:** [@matutter](https://discuss.elastic.co/u/matutter)\ **Replies:** 0\ **Last updated:** [June 23, 2022, 11:53pm UTC](https://discuss.elastic.co/t/metricbeat-error-about-scanning-empty-io-stat-file/308063 "2022-06-23T23:53:52Z")
I'm deploying metricbeat and using the system and docker modules but keep getting an error message in my logs. My configs are below. The content of /hostfs/sys/fs/cgroup/io.stat on my system is nothing - it is an empty f… --- ## [Filebeat error: fail to execute the HTTP GET request: Get "https://172.30.169.50:5000/api/status": x509: certificate signed by unknown authority](https://discuss.elastic.co/t/filebeat-error-fail-to-execute-the-http-get-request-get-https-172-30-169-50-5000-api-status-x509-certificate-signed-by-unknown-authority/308057)
**Author:** [@gisellecarballo](https://discuss.elastic.co/u/gisellecarballo)\ **Replies:** 1\ **Last updated:** [June 23, 2022, 10:45pm UTC](https://discuss.elastic.co/t/filebeat-error-fail-to-execute-the-http-get-request-get-https-172-30-169-50-5000-api-status-x509-certificate-signed-by-unknown-authority/308057 "2022-06-23T22:45:21Z")
Hi Team, Anyone had an idea why I am getting this error while setting up filebeat. Thanks so much. \ Exiting: error connecting to Kibana: fail to get the Kibana version: HTTP GET request to https://172.30.169.50:5000… --- ## [Struggling to replace a string in a syslog message with sub](https://discuss.elastic.co/t/struggling-to-replace-a-string-in-a-syslog-message-with-sub/307809)
**Author:** [@ddaloia](https://discuss.elastic.co/u/ddaloia)\ **Replies:** 4\ **Last updated:** [June 23, 2022, 10:36pm UTC](https://discuss.elastic.co/t/struggling-to-replace-a-string-in-a-syslog-message-with-sub/307809 "2022-06-23T22:36:45Z")
Hi Friends. I am taking in cef syslog messages from an application called Secret Server. The messages are not parsing correctly because some of the fields usernames have a slash in the username. The format is domain\\user… --- ## [Connect azure](https://discuss.elastic.co/t/connect-azure/308058)
**Author:** [@A\_j\_xx](https://discuss.elastic.co/u/A_j_xx)\ **Replies:** 0\ **Last updated:** [June 23, 2022, 9:37pm UTC](https://discuss.elastic.co/t/connect-azure/308058 "2022-06-23T21:37:50Z")
Hi all , Is there a way to add azure account to snapshot repository from kibana console I tried this query but it turns out it does not work PUT /\_snapshot/repo\_with\_features { "type": "azure", "settings": { … --- ## [How to find events that match for every string expression on Kibana?](https://discuss.elastic.co/t/how-to-find-events-that-match-for-every-string-expression-on-kibana/307543)
**Author:** [@gabrsar](https://discuss.elastic.co/u/gabrsar)\ **Replies:** 2\ **Last updated:** [June 23, 2022, 9:26pm UTC](https://discuss.elastic.co/t/how-to-find-events-that-match-for-every-string-expression-on-kibana/307543 "2022-06-23T21:26:05Z")
Hi. In Kibana -\> Discovery. How can I make a search for all logs that contain all the phrases I want, in or out of order? For example, Logs that contain "Operation complete", "total amount" and "success", without logs … --- ## [Elasticsearch index settings locked due to unsupported setting](https://discuss.elastic.co/t/elasticsearch-index-settings-locked-due-to-unsupported-setting/308053)
**Author:** [@bren\_x](https://discuss.elastic.co/u/bren_x)\ **Replies:** 0\ **Last updated:** [June 23, 2022, 7:19pm UTC](https://discuss.elastic.co/t/elasticsearch-index-settings-locked-due-to-unsupported-setting/308053 "2022-06-23T19:19:33Z")
Hi, We are trying to upgrade our elasticsearch cluster from version 6.1 to version 6.8. While upgrading, we noticed that the index settings seem to be locked. Any command to change any index setting results in: { "er… --- ## [How can I create new field inside an array of obejcts?](https://discuss.elastic.co/t/how-can-i-create-new-field-inside-an-array-of-obejcts/308036)
**Author:** [@jvinacio](https://discuss.elastic.co/u/jvinacio)\ **Replies:** 2\ **Last updated:** [June 23, 2022, 5:42pm UTC](https://discuss.elastic.co/t/how-can-i-create-new-field-inside-an-array-of-obejcts/308036 "2022-06-23T17:42:28Z")
Hello! I have the following array: { "tempoTotalDayEvents" : \[ { "tempo7" : 25.0 }, { "tempo8" : 0.0 }, { "tempo11" : 0.0 }, { "tempo12" : 6.0 }, { "tempo13" : 0.0 }, { "tempo14" : 3.0 }, { "tempo1… --- ## [Cannot view single document however index exists](https://discuss.elastic.co/t/cannot-view-single-document-however-index-exists/308043)
**Author:** [@GloomOff](https://discuss.elastic.co/u/GloomOff)\ **Replies:** 2\ **Last updated:** [June 23, 2022, 4:49pm UTC](https://discuss.elastic.co/t/cannot-view-single-document-however-index-exists/308043 "2022-06-23T16:49:42Z")
Hello. I receive nginx logs from filebeat. Search works well. But in kibana in the expanded view, click View single document I get error: Cannot run search filebeat-7.9.2-2022.06.23-001859 is missing. \[Please ensure … --- ## [What is "Query Length"?](https://discuss.elastic.co/t/what-is-query-length/307835)
**Author:** [@minzeycat](https://discuss.elastic.co/u/minzeycat)\ **Replies:** 9\ **Last updated:** [June 23, 2022, 4:18pm UTC](https://discuss.elastic.co/t/what-is-query-length/307835 "2022-06-23T16:18:22Z")
Hi all, I'm wondering what query length is referring to in this limit guide (it is set to 128)? Limits | Elastic App Search Documentation \[8.2\] | Elastic I am having a hard time understanding what part of the query is l… --- ## [Elastic Stack Architecture and Requirements](https://discuss.elastic.co/t/elastic-stack-architecture-and-requirements/307930)
**Author:** [@Analyst](https://discuss.elastic.co/u/Analyst)\ **Replies:** 2\ **Last updated:** [June 23, 2022, 3:34pm UTC](https://discuss.elastic.co/t/elastic-stack-architecture-and-requirements/307930 "2022-06-23T15:34:23Z")
Hi Guys, I need to create an ELK architecture but I don't know how many servers and requirements (CPU, RAM,Disk space) I will need for large organization deployment. I will need to send syslog and logfiles from 7000 se… --- ## [Unknown hosts in the Trial of Elastic Cloud](https://discuss.elastic.co/t/unknown-hosts-in-the-trial-of-elastic-cloud/307754)
**Author:** [@SamuelSMendes](https://discuss.elastic.co/u/SamuelSMendes)\ **Replies:** 3\ **Last updated:** [June 23, 2022, 3:48pm UTC](https://discuss.elastic.co/t/unknown-hosts-in-the-trial-of-elastic-cloud/307754 "2022-06-23T15:48:42Z")
What is these hosts that ocasionally appears while on elastic trial? I've seen them a few times but still don't know what it means... --- ## [Codec in gelf input plugin not working](https://discuss.elastic.co/t/codec-in-gelf-input-plugin-not-working/308017)
**Author:** [@smtp\_server](https://discuss.elastic.co/u/smtp_server)\ **Replies:** 5\ **Last updated:** [June 23, 2022, 3:37pm UTC](https://discuss.elastic.co/t/codec-in-gelf-input-plugin-not-working/308017 "2022-06-23T15:37:03Z")
I'm trying to use codec for logs coming from gelf driver of another container to aggregate multiline logs but they are turning into events for each line in message, So multiline is not working at all. input{ gelf{ … --- ## [{"expected:'\[', actual:'{', at offset:2058"}](https://discuss.elastic.co/t/expected-actual-at-offset-2058/308012)
**Author:** [@Zedson.Sagar](https://discuss.elastic.co/u/Zedson.Sagar)\ **Replies:** 2\ **Last updated:** [June 23, 2022, 3:31pm UTC](https://discuss.elastic.co/t/expected-actual-at-offset-2058/308012 "2022-06-23T15:31:45Z")
Hi, I'm new to elastic and FSCrawler. I have an index created using FSCrawler. It has only a single document which looks like below - { "content" : """MotorColour - CoatingColor - CSV """, … --- ## [Update data in Elastic with Filebeats](https://discuss.elastic.co/t/update-data-in-elastic-with-filebeats/308019)
**Author:** [@Worlock](https://discuss.elastic.co/u/Worlock)\ **Replies:** 0\ **Last updated:** [June 23, 2022, 1:48pm UTC](https://discuss.elastic.co/t/update-data-in-elastic-with-filebeats/308019 "2022-06-23T13:48:45Z")
I have some data from our Monitoring tool that is uploaded to Elastic with Filebeats. When the monitoring alert is closed, I get a new entry with "Resolution state: Closed" I would like to update the Resolution state in … --- ## [Logstash http\_poller input body](https://discuss.elastic.co/t/logstash-http-poller-input-body/308034)
**Author:** [@mfrg85](https://discuss.elastic.co/u/mfrg85)\ **Replies:** 0\ **Last updated:** [June 23, 2022, 3:15pm UTC](https://discuss.elastic.co/t/logstash-http-poller-input-body/308034 "2022-06-23T15:15:15Z")
I'm trying to POST to an external API that requires authorization headers and a query. Here is the configuration that I have so far and the error that I am receiving. I'm not sure if the body portion of the config is for… --- ## [How to Improve ELK Performance](https://discuss.elastic.co/t/how-to-improve-elk-performance/307092)
**Author:** [@truptir](https://discuss.elastic.co/u/truptir)\ **Replies:** 8\ **Last updated:** [June 23, 2022, 3:07pm UTC](https://discuss.elastic.co/t/how-to-improve-elk-performance/307092 "2022-06-23T15:07:44Z")
Hi Team, My flow is, JSON Logs files will be processed from FileBeat \> Logstash \> Elasticsearch. But it skips some data. In thread\_pool It shows below many rejected write requests. node-1 write 0 0 0 … --- ## [Setting mapping limits using java api in 8.2 fails due to wrong config name creation](https://discuss.elastic.co/t/setting-mapping-limits-using-java-api-in-8-2-fails-due-to-wrong-config-name-creation/305107)
**Author:** [@Rodrigo\_Kapobel](https://discuss.elastic.co/u/Rodrigo_Kapobel)\ **Replies:** 2\ **Last updated:** [June 23, 2022, 2:24pm UTC](https://discuss.elastic.co/t/setting-mapping-limits-using-java-api-in-8-2-fails-due-to-wrong-config-name-creation/305107 "2022-06-23T14:24:37Z")
Hi, I'm currently using the new version of java api 8.2 with also ES 8.2 in a dockerized instance. I'm creating indexes through the API and using IndexSettings to add custom setting. One of them is the total fields limi… --- ## [Missing documents during bulk insert](https://discuss.elastic.co/t/missing-documents-during-bulk-insert/307802)
**Author:** [@EsraKahraman](https://discuss.elastic.co/u/EsraKahraman)\ **Replies:** 4\ **Last updated:** [June 23, 2022, 2:02pm UTC](https://discuss.elastic.co/t/missing-documents-during-bulk-insert/307802 "2022-06-23T14:02:29Z")
Hi there, I am using bulk API to load data in Elasticsearch. I need to load millions of documents to an elastic index; my ETL job breaks the whole set down to 10K record chunks. And then, it splits each chunk into the JS… --- ## [Deprecation.logstash.codecs.plain](https://discuss.elastic.co/t/deprecation-logstash-codecs-plain/308005)
**Author:** [@Stevenpoot](https://discuss.elastic.co/u/Stevenpoot)\ **Replies:** 1\ **Last updated:** [June 23, 2022, 1:59pm UTC](https://discuss.elastic.co/t/deprecation-logstash-codecs-plain/308005 "2022-06-23T13:59:23Z")
How do I solve this. Logstash is working but the message is repeating all the time \[deprecation.logstash.codecs.plain\] Relying on default value of pipeline.ecs\_compatibility, which may change in a future maj or release … --- ## [Awsfargate metricbeat module not working?](https://discuss.elastic.co/t/awsfargate-metricbeat-module-not-working/307990)
**Author:** [@ndtreviv](https://discuss.elastic.co/u/ndtreviv)\ **Replies:** 1\ **Last updated:** [June 23, 2022, 1:59pm UTC](https://discuss.elastic.co/t/awsfargate-metricbeat-module-not-working/307990 "2022-06-23T13:59:20Z")
I've declared a metricbeat container in an AWS ECS task definition so that it runs as a "sidecar" container to my main application and uses the awsfargate module to index task stats (CPU, memory etc) into my monitoring c… --- ## [NOT Queries documents returning no highlight fragment](https://discuss.elastic.co/t/not-queries-documents-returning-no-highlight-fragment/308016)
**Author:** [@jcmiron](https://discuss.elastic.co/u/jcmiron)\ **Replies:** 4\ **Last updated:** [June 23, 2022, 1:46pm UTC](https://discuss.elastic.co/t/not-queries-documents-returning-no-highlight-fragment/308016 "2022-06-23T13:46:58Z")
If I do a query like "NOT (CANADA)" or something like that it'll return the documents that don't include that word in it, but not return any highlight fragment. Is this the default behavior for a query like that? --- ## [Filter dashboard based on bounds drawn on chloropleth map](https://discuss.elastic.co/t/filter-dashboard-based-on-bounds-drawn-on-chloropleth-map/307978)
**Author:** [@NiklasHBB](https://discuss.elastic.co/u/NiklasHBB)\ **Replies:** 2\ **Last updated:** [June 23, 2022, 1:45pm UTC](https://discuss.elastic.co/t/filter-dashboard-based-on-bounds-drawn-on-chloropleth-map/307978 "2022-06-23T13:45:43Z")
I have followed the reverse geocoding example and the basics work great using Kibana 7.16. I have left the 'apply global search to layer data' option turned off so that the map updates when I filter observations in a das… --- ## [Office 365 Logs - Struggling to get data in](https://discuss.elastic.co/t/office-365-logs-struggling-to-get-data-in/308015)
**Author:** [@rosssymons](https://discuss.elastic.co/u/rosssymons)\ **Replies:** 0\ **Last updated:** [June 23, 2022, 1:32pm UTC](https://discuss.elastic.co/t/office-365-logs-struggling-to-get-data-in/308015 "2022-06-23T13:32:01Z")
I've configured the Office 365 Logs integration but I'm struggling to get the data in. In my logs I'm seeing these lines: I'm not sure what 'currently in use, waiting...' is in reference to. I think all my config is… --- ## [Not able to download track](https://discuss.elastic.co/t/not-able-to-download-track/305712)
**Author:** [@amitsa](https://discuss.elastic.co/u/amitsa)\ **Replies:** 10\ **Last updated:** [June 23, 2022, 1:15pm UTC](https://discuss.elastic.co/t/not-able-to-download-track/305712 "2022-06-23T13:15:59Z")
Hi i am using below script to download track https://raw.githubusercontent.com/elastic/rally-tracks/master/download.sh i am able to download tracks on ubuntu 20.04 Cloning into '/home/user/.rally/benchmarks/tracks/def… --- ## [Unable to verify that the server is ElasticSearch due to unsuccesful product check call](https://discuss.elastic.co/t/unable-to-verify-that-the-server-is-elasticsearch-due-to-unsuccesful-product-check-call/308000)
**Author:** [@charlot\_Attard](https://discuss.elastic.co/u/charlot_Attard)\ **Replies:** 2\ **Last updated:** [June 23, 2022, 1:20pm UTC](https://discuss.elastic.co/t/unable-to-verify-that-the-server-is-elasticsearch-due-to-unsuccesful-product-check-call/308000 "2022-06-23T13:20:31Z")
Hello, We have an application connecting with NEST to ES Version 7.17. Intermitently we are facing this issue Unable to verify that the server is ElasticSearch due to unsuccesful product check call. Some functionality … --- ## [Enable debug logging on metricbeat using a docker CMD](https://discuss.elastic.co/t/enable-debug-logging-on-metricbeat-using-a-docker-cmd/308006)
**Author:** [@ndtreviv](https://discuss.elastic.co/u/ndtreviv)\ **Replies:** 1\ **Last updated:** [June 23, 2022, 1:07pm UTC](https://discuss.elastic.co/t/enable-debug-logging-on-metricbeat-using-a-docker-cmd/308006 "2022-06-23T13:07:40Z")
If I'm running metricbeat in docker, how can I enable debug logging? So far I've tried ./metricbeat setup -E logging.level="debug" && ./metricbeat ./metricbeat -d "\*" but I can't get it to work. I'm expecting the lo… --- ## [Defined time for custom action interval](https://discuss.elastic.co/t/defined-time-for-custom-action-interval/308011)
**Author:** [@Wolfram\_Haussig](https://discuss.elastic.co/u/Wolfram_Haussig)\ **Replies:** 0\ **Last updated:** [June 23, 2022, 12:48pm UTC](https://discuss.elastic.co/t/defined-time-for-custom-action-interval/308011 "2022-06-23T12:48:43Z")
Hi all, We are ingesting application errors into Elasticsearch and created an alert for that which sends an email to the administrators. We use an Elasticsearch query and run the check every hour but configured the aler… --- ## [Logstash parse multiline logging](https://discuss.elastic.co/t/logstash-parse-multiline-logging/307995)
**Author:** [@Ceesz](https://discuss.elastic.co/u/Ceesz)\ **Replies:** 1\ **Last updated:** [June 23, 2022, 12:36pm UTC](https://discuss.elastic.co/t/logstash-parse-multiline-logging/307995 "2022-06-23T12:36:43Z")
Hi all, I am trying to parse the following log file with multi-log lines: Benutzerkennung: test1 Uhrzeit: 20:53:54 14.05.2022 Version: Microsoft Dynamics AX 6.2 (Erstellungsnummer 3000.5768) Datenbank: Microsoft SQL Se… [Previous page](https://discuss.elastic.co/latest.md?page=1074) [Next page](https://discuss.elastic.co/latest.md?page=1076)