# Latest **URL:** https://discuss.elastic.co/latest.md?page=1140 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1141 --- ## [Loading unstructured data](https://discuss.elastic.co/t/loading-unstructured-data/304212)
**Author:** [@Naga\_Prudhvi](https://discuss.elastic.co/u/Naga_Prudhvi)\ **Replies:** 2\ **Last updated:** [May 9, 2022, 8:25am UTC](https://discuss.elastic.co/t/loading-unstructured-data/304212 "2022-05-09T08:25:33Z")
I am getting error while loading below line in elastic using gork filter 192.168.72.177 - - \[22/Dec/2002:23:32:14 -0400\] "GET /news/sports.html HTTP/1.1" 200 3500 www.yahoo.com "http://www.some.com/" "Mozilla/4.0 (com… --- ## [Filebeat can not collect logs data from mounted disk](https://discuss.elastic.co/t/filebeat-can-not-collect-logs-data-from-mounted-disk/303134)
**Author:** [@sahinguler](https://discuss.elastic.co/u/sahinguler)\ **Replies:** 5\ **Last updated:** [May 9, 2022, 8:04am UTC](https://discuss.elastic.co/t/filebeat-can-not-collect-logs-data-from-mounted-disk/303134 "2022-05-09T08:04:04Z")
Hi all, I used filebeat for collecting my logs and my filebeat version is 7.16.3. When I collect my logs from /var/lib/docker/containers/${data.docker.container.id}/\*.log, logs were collected. If I used /mnt/.. (my mou… --- ## [Fleet agent upgrade fails 8.1.2](https://discuss.elastic.co/t/fleet-agent-upgrade-fails-8-1-2/302970)
**Author:** [@VamPikmin](https://discuss.elastic.co/u/VamPikmin)\ **Replies:** 12\ **Last updated:** [May 9, 2022, 8:12am UTC](https://discuss.elastic.co/t/fleet-agent-upgrade-fails-8-1-2/302970 "2022-05-09T08:12:41Z")
After the stack upgrade to the latest 8.1.3 the agents are unable to upgrade error: failed verification of agent binary: 2 errors occurred:\\n\\t\* fetching asc file from 'C:\\\\Program Files\\\\Elastic\\\\Agent\\\\data\\\\elastic-… --- ## [Date histogram on objects with a start and end time](https://discuss.elastic.co/t/date-histogram-on-objects-with-a-start-and-end-time/303290)
**Author:** [@Griffures](https://discuss.elastic.co/u/Griffures)\ **Replies:** 5\ **Last updated:** [May 9, 2022, 8:05am UTC](https://discuss.elastic.co/t/date-histogram-on-objects-with-a-start-and-end-time/303290 "2022-05-09T08:05:44Z")
Hello everyone, first time poster here. Please make me aware of any mishaps I might have done. I'll use a specific usecase to illustrate my question, but I would love a more general answer as I just got into Kibana. El… --- ## [Security Error Kibana](https://discuss.elastic.co/t/security-error-kibana/303823)
**Author:** [@S-elk](https://discuss.elastic.co/u/S-elk)\ **Replies:** 4\ **Last updated:** [May 9, 2022, 7:52am UTC](https://discuss.elastic.co/t/security-error-kibana/303823 "2022-05-09T07:52:19Z")
Hello ! When I enter a dashboard with my user who has a specific role assigned, the following error appears. I can't find what permission would be needed.... \[object Object\]: security\_exception: \[security\_exception\] Re… --- ## [Failed to retrieve shard stats from node](https://discuss.elastic.co/t/failed-to-retrieve-shard-stats-from-node/304211)
**Author:** [@amitsa](https://discuss.elastic.co/u/amitsa)\ **Replies:** 1\ **Last updated:** [May 9, 2022, 7:49am UTC](https://discuss.elastic.co/t/failed-to-retrieve-shard-stats-from-node/304211 "2022-05-09T07:49:20Z")
I am running es-cluster on kubernetes on secure mode(Basic security) . I am getting below warning on master es node logs. why am i getting this error during benchmarking with esrally. i have 1 master and a data node run… --- ## [Logstash S3 input](https://discuss.elastic.co/t/logstash-s3-input/304118)
**Author:** [@shivendra95](https://discuss.elastic.co/u/shivendra95)\ **Replies:** 3\ **Last updated:** [May 9, 2022, 7:34am UTC](https://discuss.elastic.co/t/logstash-s3-input/304118 "2022-05-09T07:34:07Z")
Hi there, I'm trying to use the logstash S3 input plugin to fetch logs from S3 bucket. This is my input s3 { id =\> "terminal\_app" access\_key\_id =\> "${access\_key\_id}" secret\_access\_key =\> "${secret\_access\_k… --- ## [Timestamp field issue](https://discuss.elastic.co/t/timestamp-field-issue/304126)
**Author:** [@shivendra95](https://discuss.elastic.co/u/shivendra95)\ **Replies:** 2\ **Last updated:** [May 9, 2022, 7:31am UTC](https://discuss.elastic.co/t/timestamp-field-issue/304126 "2022-05-09T07:31:04Z")
Hi there, I'm using S3 to read input into logstash. The timestamp field generated in Elasticsearch is the time when logs are read from S3 and not the timestamp field of the json log file. Below is one object of the jso… --- ## [Why query DSL select doc which not include field?](https://discuss.elastic.co/t/why-query-dsl-select-doc-which-not-include-field/304208)
**Author:** [@d.silwon](https://discuss.elastic.co/u/d.silwon)\ **Replies:** 4\ **Last updated:** [May 9, 2022, 7:25am UTC](https://discuss.elastic.co/t/why-query-dsl-select-doc-which-not-include-field/304208 "2022-05-09T07:25:40Z")
Dears, I need your advice/explanation. This is my query which select document from index which not include field f1.rc. I don't understand why. What is wrong in below query? Any idea? In my opinion this query should … --- ## [Apm agent misses some requests](https://discuss.elastic.co/t/apm-agent-misses-some-requests/304213)
**Author:** [@wajika](https://discuss.elastic.co/u/wajika)\ **Replies:** 0\ **Last updated:** [May 9, 2022, 6:43am UTC](https://discuss.elastic.co/t/apm-agent-misses-some-requests/304213 "2022-05-09T06:43:56Z")
When the developer came to me, I found out that apm didn't log some requests, I don't know why. I can see the request record in the log, but I can't find any data for this request on the apm UI. I didn't… --- ## [High CPU usage elasticsearch](https://discuss.elastic.co/t/high-cpu-usage-elasticsearch/304085)
**Author:** [@dishant.sharma](https://discuss.elastic.co/u/dishant.sharma)\ **Replies:** 4\ **Last updated:** [May 9, 2022, 6:40am UTC](https://discuss.elastic.co/t/high-cpu-usage-elasticsearch/304085 "2022-05-09T06:40:02Z")
I have created an Elasticsearch plugin. It is working absolutely fine. But, in the case of bulk indexing, it is getting a request timeout, and when I checked the CPU usage, it was showing 101.76% usage. I am using a lot… --- ## [Detection Rules \_Severity override based on multiple values](https://discuss.elastic.co/t/detection-rules-severity-override-based-on-multiple-values/304010)
**Author:** [@sbianco1978](https://discuss.elastic.co/u/sbianco1978)\ **Replies:** 2\ **Last updated:** [May 9, 2022, 6:31am UTC](https://discuss.elastic.co/t/detection-rules-severity-override-based-on-multiple-values/304010 "2022-05-09T06:31:50Z")
Hello, I hope this is the correct section. I need an advice. When creating some detection rules I would need to perform a severity override based on differents "source field" values, for istance: Default severity: Me… --- ## [What happens if I let my beats service run constantly](https://discuss.elastic.co/t/what-happens-if-i-let-my-beats-service-run-constantly/304036)
**Author:** [@smam](https://discuss.elastic.co/u/smam)\ **Replies:** 2\ **Last updated:** [May 9, 2022, 6:08am UTC](https://discuss.elastic.co/t/what-happens-if-i-let-my-beats-service-run-constantly/304036 "2022-05-09T06:08:45Z")
Hello, I have a script that changes my winlogbeat.yml as a scheduled task. What happens if I start the winlogbeat service? Would he notice the change of data and still use it or would I have to stop the service, change… --- ## [Import/export CSV data feeds to elasticsearch](https://discuss.elastic.co/t/import-export-csv-data-feeds-to-elasticsearch/304189)
**Author:** [@Samiul008](https://discuss.elastic.co/u/Samiul008)\ **Replies:** 4\ **Last updated:** [May 9, 2022, 5:18am UTC](https://discuss.elastic.co/t/import-export-csv-data-feeds-to-elasticsearch/304189 "2022-05-09T05:18:27Z")
Good Day community! is there any way to automate the process of downloading CSV files from gmail and ingest those to Elasticsearch by creating new indices? My challenges are following- Downloading the CSV files from … --- ## [Like search on multiple indexes on elastic search](https://discuss.elastic.co/t/like-search-on-multiple-indexes-on-elastic-search/304165)
**Author:** [@Rajesh\_Kumar3](https://discuss.elastic.co/u/Rajesh_Kumar3)\ **Replies:** 2\ **Last updated:** [May 9, 2022, 5:08am UTC](https://discuss.elastic.co/t/like-search-on-multiple-indexes-on-elastic-search/304165 "2022-05-09T05:08:46Z")
Hi, I stuck on like searching on multiple indexes on Elasticsearch. I am using a query string and must to extract data for the particular user. Example JSON index "tasks" { "channelName": "Weekly Task-(HT-01030284)… --- ## [使用Machine Learning創建job來判斷是否遭到攻擊](https://discuss.elastic.co/t/machine-learning-job/303726)
**Author:** [@OBT](https://discuss.elastic.co/u/OBT)\ **Replies:** 9\ **Last updated:** [May 9, 2022, 4:29am UTC](https://discuss.elastic.co/t/machine-learning-job/303726 "2022-05-09T04:29:37Z")
我目前有一個想嘗試的東西是使用filebeat獲得伺服器的log file 再透過machine learing進行判斷並再遭到攻擊時傳送alert來警告 這邊附上我使用Slowloris攻擊Apache的log file 希望在這的大佬能給我一些方向或是幫助 或是有甚麼這方面的教程影片也希望能提供一下 感恩 --- ## [Install winlogbeat dashboard](https://discuss.elastic.co/t/install-winlogbeat-dashboard/304198)
**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Replies:** 2\ **Last updated:** [May 9, 2022, 3:53am UTC](https://discuss.elastic.co/t/install-winlogbeat-dashboard/304198 "2022-05-09T03:53:09Z")
Is there a way to install the winlogbeat dashboards on the machine running kibana? All the docs imply that this can only be done from the windows system that are being monitored (of which there are many) and I don't hav… --- ## [Logging failed shards in search response](https://discuss.elastic.co/t/logging-failed-shards-in-search-response/303109)
**Author:** [@Nobuaki\_Ito](https://discuss.elastic.co/u/Nobuaki_Ito)\ **Replies:** 1\ **Last updated:** [May 9, 2022, 3:50am UTC](https://discuss.elastic.co/t/logging-failed-shards-in-search-response/303109 "2022-05-09T03:50:23Z")
My team would like to keep track of occurrences of shard failures. Is there any way to enable logging of such events? To clarify, the event that I would like to log is the occurrence of "failed" in the \_shards block of … --- ## [Can we select history source in peer recovery by settings When both Lucene soft-deletes and Translog are available](https://discuss.elastic.co/t/can-we-select-history-source-in-peer-recovery-by-settings-when-both-lucene-soft-deletes-and-translog-are-available/304203)
**Author:** [@liurui](https://discuss.elastic.co/u/liurui)\ **Replies:** 2\ **Last updated:** [May 9, 2022, 3:12am UTC](https://discuss.elastic.co/t/can-we-select-history-source-in-peer-recovery-by-settings-when-both-lucene-soft-deletes-and-translog-are-available/304203 "2022-05-09T03:12:28Z")
Hi ~ :smile: I encountered a problem with an online cluster: Peer recovery is very slow on translog stage. Ioutil of source node full intermittently. We don't have much read/write tasks and from Jstack, we see sou… --- ## [Filebeat Docker input: exclude container by name](https://discuss.elastic.co/t/filebeat-docker-input-exclude-container-by-name/304202)
**Author:** [@alifsaddid](https://discuss.elastic.co/u/alifsaddid)\ **Replies:** 0\ **Last updated:** [May 9, 2022, 2:21am UTC](https://discuss.elastic.co/t/filebeat-docker-input-exclude-container-by-name/304202 "2022-05-09T02:21:37Z")
Hi, I am having a problem on configuring filebeat. I am running filebeat, logstash, Elasticsearch, and kibana on Docker. I want to retrieve logs of all existing containers, except from filebeat, logstash, Elasticsearch,… --- ## [How can I change the default size of the returned aggregations (10) in kibana “create new rule”?](https://discuss.elastic.co/t/how-can-i-change-the-default-size-of-the-returned-aggregations-10-in-kibana-create-new-rule/303860)
**Author:** [@MNB\_1101](https://discuss.elastic.co/u/MNB_1101)\ **Replies:** 1\ **Last updated:** [May 4, 2022, 1:09am UTC](https://discuss.elastic.co/t/how-can-i-change-the-default-size-of-the-returned-aggregations-10-in-kibana-create-new-rule/303860 "2022-05-04T01:09:45Z")
Hi, To create new rule in kibana ,when I selected "Threshold Aggregate query results to detect when number of matches exceeds threshold." , by default size is 10: { "aggregations": { "eventActionGroup": { "terms": { "o… --- ## [Automaticaly close SIEM case](https://discuss.elastic.co/t/automaticaly-close-siem-case/304195)
**Author:** [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Replies:** 1\ **Last updated:** [May 9, 2022, 2:25am UTC](https://discuss.elastic.co/t/automaticaly-close-siem-case/304195 "2022-05-09T02:25:11Z")
Hi all, I am tryiing to use shuffle soar to automate some of the task in the SIEM. One of them is the create and close cases. when i run the playbook the close case keep giving me error like this: These cases id has … --- ## [My filebeat start occur error](https://discuss.elastic.co/t/my-filebeat-start-occur-error/304188)
**Author:** [@zhanghao116560](https://discuss.elastic.co/u/zhanghao116560)\ **Replies:** 2\ **Last updated:** [May 9, 2022, 12:37am UTC](https://discuss.elastic.co/t/my-filebeat-start-occur-error/304188 "2022-05-09T00:37:05Z")
Here is my configuration information: processors: - add\_host\_metadata: ~ - add\_cloud\_metadata: ~ - drop\_fields: fields: \["beat"\] I want to add a filter to remove the beat attribute, However, a startup error o… --- ## [How to export results from alert page](https://discuss.elastic.co/t/how-to-export-results-from-alert-page/304156)
**Author:** [@francescouk](https://discuss.elastic.co/u/francescouk)\ **Replies:** 1\ **Last updated:** [May 9, 2022, 12:34am UTC](https://discuss.elastic.co/t/how-to-export-results-from-alert-page/304156 "2022-05-09T00:34:56Z")
Hello there, I would like to know if is possible to export the results from the alert security page?? Thanks for the attention. --- ## [License is not available](https://discuss.elastic.co/t/license-is-not-available/304149)
**Author:** [@Onsrm](https://discuss.elastic.co/u/Onsrm)\ **Replies:** 5\ **Last updated:** [May 8, 2022, 11:46pm UTC](https://discuss.elastic.co/t/license-is-not-available/304149 "2022-05-08T23:46:26Z")
hello , when I use Elasticsearch with kibana they work together but when I add xpack.security.enabled: true in Elasticsearch.yml they stop working and I get this message : license is not available --- ## [I cant Add index in my kibana](https://discuss.elastic.co/t/i-cant-add-index-in-my-kibana/304183)
**Author:** [@DanialNabi82](https://discuss.elastic.co/u/DanialNabi82)\ **Replies:** 1\ **Last updated:** [May 8, 2022, 11:24pm UTC](https://discuss.elastic.co/t/i-cant-add-index-in-my-kibana/304183 "2022-05-08T23:24:36Z")
Hi I install new version of kibana and Elasticsearch (8.2.0) in my kibana dashboard I cant add new index --- ## [Trouble with artifacts.elastic.co ― Error 403](https://discuss.elastic.co/t/trouble-with-artifacts-elastic-co-error-403/304142)
**Author:** [@ilya.romashev](https://discuss.elastic.co/u/ilya.romashev)\ **Replies:** 1\ **Last updated:** [May 8, 2022, 10:29pm UTC](https://discuss.elastic.co/t/trouble-with-artifacts-elastic-co-error-403/304142 "2022-05-08T22:29:30Z")
Can't connect to Elasticsearch rpm repo, instead of xml with repo metadata server answers with 403 error. Is there anything wrong with this repo? --- ## [How to change default value size parameter of the terms aggregation?](https://discuss.elastic.co/t/how-to-change-default-value-size-parameter-of-the-terms-aggregation/304162)
**Author:** [@MNB\_1101](https://discuss.elastic.co/u/MNB_1101)\ **Replies:** 3\ **Last updated:** [May 8, 2022, 10:27pm UTC](https://discuss.elastic.co/t/how-to-change-default-value-size-parameter-of-the-terms-aggregation/304162 "2022-05-08T22:27:53Z")
By default, the terms aggregation returns the top ten terms with the most documents. How to change default value of the size parameter of terms aggregation? --- ## [Logstash cant start the pipeline in the conf.d file](https://discuss.elastic.co/t/logstash-cant-start-the-pipeline-in-the-conf-d-file/304172)
**Author:** [@ahmed\_barki](https://discuss.elastic.co/u/ahmed_barki)\ **Replies:** 9\ **Last updated:** [May 8, 2022, 7:49pm UTC](https://discuss.elastic.co/t/logstash-cant-start-the-pipeline-in-the-conf-d-file/304172 "2022-05-08T19:49:00Z")
Hello everyone, when i use the command /usr/share/logstash/bin/logstash -f /etc/logstash/conf.d/simple.conf here is what i get '\[INFO \] 2022-05-07 09:58:02.271 \[\[main\]-pipeline-manager\] elasticsearch - New Elasticsear… --- ## [\[.kibana\_task\_manager\] Action failed with ‘Request timed out’](https://discuss.elastic.co/t/kibana-task-manager-action-failed-with-request-timed-out/302420)
**Author:** [@ndinesh-aie](https://discuss.elastic.co/u/ndinesh-aie)\ **Replies:** 3\ **Last updated:** [May 8, 2022, 7:08pm UTC](https://discuss.elastic.co/t/kibana-task-manager-action-failed-with-request-timed-out/302420 "2022-05-08T19:08:19Z")
Continuing the discussion from \[.kibana\_task\_manager\] Action failed with 'Request timed out': [Previous page](https://discuss.elastic.co/latest.md?page=1139) [Next page](https://discuss.elastic.co/latest.md?page=1141)