# Latest **URL:** https://discuss.elastic.co/latest.md?page=1322 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1323 --- ## [How to interpret filebeat logs?](https://discuss.elastic.co/t/how-to-interpret-filebeat-logs/293524)
**Author:** [@hjazz6](https://discuss.elastic.co/u/hjazz6)\ **Replies:** 0\ **Last updated:** [January 5, 2022, 10:47am UTC](https://discuss.elastic.co/t/how-to-interpret-filebeat-logs/293524 "2022-01-05T10:47:12Z")
Hi, I'm running filebeat 7.14.0 to ingest Netflow data, which is then stored in Elasticsearch and viewed on Kibana. When I run "filebeat -e", I will see some logs generated by filebeat every 30s. The logs are similar to… --- ## [Load a log file in fleet to read the file or logs in the elastic agent](https://discuss.elastic.co/t/load-a-log-file-in-fleet-to-read-the-file-or-logs-in-the-elastic-agent/292949)
**Author:** [@dannie-ml](https://discuss.elastic.co/u/dannie-ml)\ **Replies:** 1\ **Last updated:** [January 5, 2022, 10:10am UTC](https://discuss.elastic.co/t/load-a-log-file-in-fleet-to-read-the-file-or-logs-in-the-elastic-agent/292949 "2022-01-05T10:10:50Z")
Hi im exploring the elastic technology and im using fleet and i want to configure it an elastic agent to read my .log file, can any one please tell me how to read my .log file or can you tell me the steps to achieve this… --- ## [Shared views in Inventory Observability \[7.15.2\]](https://discuss.elastic.co/t/shared-views-in-inventory-observability-7-15-2/291991)
**Author:** [@RdrgPorto](https://discuss.elastic.co/u/RdrgPorto)\ **Replies:** 1\ **Last updated:** [January 5, 2022, 10:08am UTC](https://discuss.elastic.co/t/shared-views-in-inventory-observability-7-15-2/291991 "2022-01-05T10:08:17Z")
Hi, everyone I have created a view in Inventory called Infraestructure in Default space. Does this view only can used by my user? I would like to create a global view, is it possible? is there any way to share it? … --- ## [Calculated the sum of blank per doc](https://discuss.elastic.co/t/calculated-the-sum-of-blank-per-doc/293516)
**Author:** [@Sugand](https://discuss.elastic.co/u/Sugand)\ **Replies:** 0\ **Last updated:** [January 5, 2022, 10:07am UTC](https://discuss.elastic.co/t/calculated-the-sum-of-blank-per-doc/293516 "2022-01-05T10:07:31Z")
Hi, Have a data structure doc like attached, I want to create a field which is the calculation of sum of blanks per doc or per ID So a field "total blank" with above example should be like "total blank" 3 2 1 … --- ## [Migrating Java Rest Client to Java Api Client](https://discuss.elastic.co/t/migrating-java-rest-client-to-java-api-client/293337)
**Author:** [@Swati\_Jain1](https://discuss.elastic.co/u/Swati_Jain1)\ **Replies:** 1\ **Last updated:** [January 5, 2022, 9:56am UTC](https://discuss.elastic.co/t/migrating-java-rest-client-to-java-api-client/293337 "2022-01-05T09:56:51Z")
After upgrading Elasticsearch to 7.16.2, Elasticsearch Java Rest Client seems to be deprecated. We are migrating to Java API client which lacks proper documentation. Please help. --- ## [Cloudwatch Metric stream to Elastic search](https://discuss.elastic.co/t/cloudwatch-metric-stream-to-elastic-search/293506)
**Author:** [@akb\_2021](https://discuss.elastic.co/u/akb_2021)\ **Replies:** 1\ **Last updated:** [January 5, 2022, 8:53am UTC](https://discuss.elastic.co/t/cloudwatch-metric-stream-to-elastic-search/293506 "2022-01-05T08:53:00Z")
My Objective is to build a monitoring system for RDS databases. So I am trying to create Cloudwatch metric stream to Elasticsearch(open search AWS) using kinesis firehose & lambda. The RDS metrics are appearing but Datab… --- ## [System load too high](https://discuss.elastic.co/t/system-load-too-high/293436)
**Author:** [@Davide89](https://discuss.elastic.co/u/Davide89)\ **Replies:** 5\ **Last updated:** [January 5, 2022, 8:41am UTC](https://discuss.elastic.co/t/system-load-too-high/293436 "2022-01-05T08:41:19Z")
I'm working on a VM with a single-node instance of Elasticsearch and I registered a lot of alerts about system load for many days. Indeed the overall system load is always higher then 1. Below a Grafana chart that shows… --- ## [Unable to install logstash-input-azureblob with logstash 7.16.2](https://discuss.elastic.co/t/unable-to-install-logstash-input-azureblob-with-logstash-7-16-2/293504)
**Author:** [@Natarajan](https://discuss.elastic.co/u/Natarajan)\ **Replies:** 0\ **Last updated:** [January 5, 2022, 8:20am UTC](https://discuss.elastic.co/t/unable-to-install-logstash-input-azureblob-with-logstash-7-16-2/293504 "2022-01-05T08:20:29Z")
I am trying to install logstash-input-azureblob with logstash 7.16.2. But getting the below error. I am running the logstash as docker. ERROR: Installation Aborted, message: Bundler could not find compatible versions … --- ## [Failed to open TCP connection to ES while trying to connect from fluentd](https://discuss.elastic.co/t/failed-to-open-tcp-connection-to-es-while-trying-to-connect-from-fluentd/293502)
**Author:** [@subha1](https://discuss.elastic.co/u/subha1)\ **Replies:** 0\ **Last updated:** [January 5, 2022, 6:53am UTC](https://discuss.elastic.co/t/failed-to-open-tcp-connection-to-es-while-trying-to-connect-from-fluentd/293502 "2022-01-05T06:53:35Z")
Failed to open TCP connection to ES while trying to connect from fluentd. In the cluster, there are 5 clients , 5 masters & 5 data pods are running with 155 fluentd daemonsets. some of the fluentd pods are getting res… --- ## [ILM isn't deleting searchable snapshots](https://discuss.elastic.co/t/ilm-isnt-deleting-searchable-snapshots/293388)
**Author:** [@seanziee](https://discuss.elastic.co/u/seanziee)\ **Replies:** 1\ **Last updated:** [January 5, 2022, 6:22am UTC](https://discuss.elastic.co/t/ilm-isnt-deleting-searchable-snapshots/293388 "2022-01-05T06:22:04Z")
I'm trying to figure out why my old data that is currently a searchable snapshot isn't being deleted from my ILM policy: Here's the \_ilm/explain output: { "indices" : { "restored-.ds-dev-metricbeat-datastream-202… --- ## [Can we use elasticsearch analyzer for kibana](https://discuss.elastic.co/t/can-we-use-elasticsearch-analyzer-for-kibana/293310)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 2\ **Last updated:** [January 5, 2022, 5:27am UTC](https://discuss.elastic.co/t/can-we-use-elasticsearch-analyzer-for-kibana/293310 "2022-01-05T05:27:00Z")
Hi team, I am learning Elasticsearch analyzer and now i have to test this analyzer for my new index. There is a question strucking in my mind that if made analyzer and we are searching our text in kibana discover. Beca… --- ## [\[ES v6.7.2\] Speed up snapshot restore from GCS Snapshot Repository](https://discuss.elastic.co/t/es-v6-7-2-speed-up-snapshot-restore-from-gcs-snapshot-repository/293343)
**Author:** [@Akshay\_KN](https://discuss.elastic.co/u/Akshay_KN)\ **Replies:** 2\ **Last updated:** [January 5, 2022, 5:19am UTC](https://discuss.elastic.co/t/es-v6-7-2-speed-up-snapshot-restore-from-gcs-snapshot-repository/293343 "2022-01-05T05:19:58Z")
Hello Team, We are trying to speed up our snapshot restoration speed in our ES cluster hosted on GCP Compute instances. TL;DR : Current Performance: 50 MBps per data node Infra Capable of 500 MBps We want to improve … --- ## [Logstash Exception in posting data to Azure Loganalytics](https://discuss.elastic.co/t/logstash-exception-in-posting-data-to-azure-loganalytics/293497)
**Author:** [@stillfreem](https://discuss.elastic.co/u/stillfreem)\ **Replies:** 0\ **Last updated:** [January 5, 2022, 4:53am UTC](https://discuss.elastic.co/t/logstash-exception-in-posting-data-to-azure-loganalytics/293497 "2022-01-05T04:53:17Z")
Hi All, I've a server on which Logstash is installed and sending logs to Azure Sentinel. It works just fine but lately any other week I'd see the below entry in the logstash-plain.log file and it seems that the connect… --- ## [2021: The Year in Review](https://discuss.elastic.co/t/2021-the-year-in-review/293492)
**Author:** [@system](https://discuss.elastic.co/u/system)\ **Replies:** 23\ **Last updated:** [January 5, 2022, 4:53am UTC](https://discuss.elastic.co/t/2021-the-year-in-review/293492 "2022-01-05T04:53:17Z")
2021's Top Users Most Time Reading User Hours Read … --- ## [kibana.autocompleteTerminateAfter': is not allowed](https://discuss.elastic.co/t/kibana-autocompleteterminateafter-is-not-allowed/291279)
**Author:** [@lifeowl](https://discuss.elastic.co/u/lifeowl)\ **Replies:** 5\ **Last updated:** [January 5, 2022, 2:34am UTC](https://discuss.elastic.co/t/kibana-autocompleteterminateafter-is-not-allowed/291279 "2022-01-05T02:34:04Z")
Hi there, Have there been any recent changes or deprecations with kibana.autocompleteTerminateAfter? I recently had this value configured in my kibana.yml file (using 7.14 on Elastic Cloud) but now, when I try to update… --- ## [Lost data:The successfully written data is missing](https://discuss.elastic.co/t/lost-data-the-successfully-written-data-is-missing/293486)
**Author:** [@51pwn](https://discuss.elastic.co/u/51pwn)\ **Replies:** 3\ **Last updated:** [January 5, 2022, 1:34am UTC](https://discuss.elastic.co/t/lost-data-the-successfully-written-data-is-missing/293486 "2022-01-05T01:34:34Z")
Docker 7.16.2 official image I successfully wrote 177393 pieces of data, each of which returned: {"total": 1, "successful": 1, "failed": 0}, but passed http://127.0.0.1:9200/\_cat/indices?v See docs The count is 147840… --- ## [Osquery causing policy to go unhealthy](https://discuss.elastic.co/t/osquery-causing-policy-to-go-unhealthy/293482)
**Author:** [@bm11100](https://discuss.elastic.co/u/bm11100)\ **Replies:** 0\ **Last updated:** [January 4, 2022, 11:15pm UTC](https://discuss.elastic.co/t/osquery-causing-policy-to-go-unhealthy/293482 "2022-01-04T23:15:49Z")
Currently running stack version 7.16.2 and am constantly having issues with the osquery manager integration. It keeps causing my agents to go unhealthy. Any reason why it is causing these issues? --- ## [Elastic Query for alerts Windows](https://discuss.elastic.co/t/elastic-query-for-alerts-windows/293481)
**Author:** [@PublicName](https://discuss.elastic.co/u/PublicName)\ **Replies:** 0\ **Last updated:** [January 4, 2022, 10:42pm UTC](https://discuss.elastic.co/t/elastic-query-for-alerts-windows/293481 "2022-01-04T22:42:14Z")
I know this is going to be simple but it's just not coming to me at all today. GET /logs-\*/\_eql/search { "query": """ winlog where winlog.event\_id == "4625" and stringContains(message, "The specified account's pas… --- ## [Filebeat - avoid data duplication during switch over](https://discuss.elastic.co/t/filebeat-avoid-data-duplication-during-switch-over/293319)
**Author:** [@sandeepmuthathi](https://discuss.elastic.co/u/sandeepmuthathi)\ **Replies:** 1\ **Last updated:** [January 4, 2022, 10:11pm UTC](https://discuss.elastic.co/t/filebeat-avoid-data-duplication-during-switch-over/293319 "2022-01-04T22:11:54Z")
I've a scenario where I need to read the file contents from an NFS mount point using filebeat. Also, I need to install another filebeat instance on another system incase the first machine (where i installed filebeat) goe… --- ## [Trying to divide the cardinality of a string/hash field by the numeric value of another field](https://discuss.elastic.co/t/trying-to-divide-the-cardinality-of-a-string-hash-field-by-the-numeric-value-of-another-field/293374)
**Author:** [@jjammin92](https://discuss.elastic.co/u/jjammin92)\ **Replies:** 1\ **Last updated:** [January 4, 2022, 9:10pm UTC](https://discuss.elastic.co/t/trying-to-divide-the-cardinality-of-a-string-hash-field-by-the-numeric-value-of-another-field/293374 "2022-01-04T21:10:07Z")
I'm trying to create a runtime field within an index template. I can easily divide the values of two integers like this: emit(doc\['bounce\_time'\].value / doc\['session'\].value) EG bounce\_time: 100 / session: 25 = 4 Ho… --- ## [Filebeat parsing long log](https://discuss.elastic.co/t/filebeat-parsing-long-log/293438)
**Author:** [@Milad\_Akhlaghi](https://discuss.elastic.co/u/Milad_Akhlaghi)\ **Replies:** 0\ **Last updated:** [January 4, 2022, 11:49am UTC](https://discuss.elastic.co/t/filebeat-parsing-long-log/293438 "2022-01-04T11:49:01Z")
Hi Friends, i have a long log and i'm trying to parse it with javascript this is the filebeat config that i have: filebeat.inputs: - type: log enabled: true paths: - /root/logtest/test.log # clean\_removed: tr… --- ## [Host availability](https://discuss.elastic.co/t/host-availability/293479)
**Author:** [@Kirill\_Gofman](https://discuss.elastic.co/u/Kirill_Gofman)\ **Replies:** 0\ **Last updated:** [January 4, 2022, 8:41pm UTC](https://discuss.elastic.co/t/host-availability/293479 "2022-01-04T20:41:56Z")
Hey, we are trying to configure SAML auth with adfs. How can we verify that security rules are configured correctly on AWS/host and that it's available from elastic ? Any option to ping/trace destination host from the el… --- ## [Logstash multiline codec plugin won't keep blank lines](https://discuss.elastic.co/t/logstash-multiline-codec-plugin-wont-keep-blank-lines/293429)
**Author:** [@saprof](https://discuss.elastic.co/u/saprof)\ **Replies:** 2\ **Last updated:** [January 4, 2022, 7:26pm UTC](https://discuss.elastic.co/t/logstash-multiline-codec-plugin-wont-keep-blank-lines/293429 "2022-01-04T19:26:57Z")
Hi, I am working on the correct settings for the multiline codec plugin. I want to join all lines between two \\r\\n into a single event and it works well, except that blank lines are dropped. I'm running Logstash v7.16.… --- ## [Merge different index in function two fields and paste eleement of fields](https://discuss.elastic.co/t/merge-different-index-in-function-two-fields-and-paste-eleement-of-fields/293363)
**Author:** [@Vivian](https://discuss.elastic.co/u/Vivian)\ **Replies:** 8\ **Last updated:** [January 4, 2022, 7:06pm UTC](https://discuss.elastic.co/t/merge-different-index-in-function-two-fields-and-paste-eleement-of-fields/293363 "2022-01-04T19:06:46Z")
Hello, I have an index of this shape : { "\_index": "df\_extrait", "\_type": "\_doc", "\_id": "27685", "\_version": 1, "\_seq\_no": 0, "\_primary\_term": 1, "\_score": 1, "\_source": { "source": "avatar", "… --- ## [Internal Server Error on Kibana Index Management Screen](https://discuss.elastic.co/t/internal-server-error-on-kibana-index-management-screen/293470)
**Author:** [@Mrizzi](https://discuss.elastic.co/u/Mrizzi)\ **Replies:** 2\ **Last updated:** [January 4, 2022, 6:47pm UTC](https://discuss.elastic.co/t/internal-server-error-on-kibana-index-management-screen/293470 "2022-01-04T18:47:48Z")
Hey everyone, I'm suddenly facing this error: Whenever I try to look into the index page on my installation It constantly throws out the following error in the kibana.log file: \[2022-01-04T15:24:05.114-03:00\]\[ERRO… --- ## [ElasticSearch Upgrade to 5.6](https://discuss.elastic.co/t/elasticsearch-upgrade-to-5-6/293469)
**Author:** [@mario12](https://discuss.elastic.co/u/mario12)\ **Replies:** 3\ **Last updated:** [January 4, 2022, 6:20pm UTC](https://discuss.elastic.co/t/elasticsearch-upgrade-to-5-6/293469 "2022-01-04T18:20:51Z")
We are currently running Elasticsearch version 2.4. We are planning to upgrade to ES 5.6. We ran the upgrade advisor and we took care of the issues. We are planning to upgrade by setting up a new cluster and restoring th… --- ## [Disable java security policies in elasticsearch:5.6.9 docker image](https://discuss.elastic.co/t/disable-java-security-policies-in-elasticsearch-5-6-9-docker-image/293460)
**Author:** [@curioususer](https://discuss.elastic.co/u/curioususer)\ **Replies:** 0\ **Last updated:** [January 4, 2022, 3:25pm UTC](https://discuss.elastic.co/t/disable-java-security-policies-in-elasticsearch-5-6-9-docker-image/293460 "2022-01-04T15:25:53Z")
Hi, I'm trying to exploit the log4j vulnerability in Elasticsearch 5.6.9 for an academic project. I was able to get a RCE (a simple print), but when it comes to executing a shell, I get this error: java.security.Access… --- ## [Logstash prune blacklist\_values](https://discuss.elastic.co/t/logstash-prune-blacklist-values/293266)
**Author:** [@4art4](https://discuss.elastic.co/u/4art4)\ **Replies:** 6\ **Last updated:** [January 4, 2022, 5:38pm UTC](https://discuss.elastic.co/t/logstash-prune-blacklist-values/293266 "2022-01-04T17:38:05Z")
So the json inputs are not always consistent. For example, one field is usually true/false, but the source occasionally tosses in a "not\_supported" just to be fun. So after some digging, I thought that I could just do: … --- ## [RUM Not reporting Data on Kibana](https://discuss.elastic.co/t/rum-not-reporting-data-on-kibana/293123)
**Author:** [@gauravraje](https://discuss.elastic.co/u/gauravraje)\ **Replies:** 2\ **Last updated:** [January 4, 2022, 5:03pm UTC](https://discuss.elastic.co/t/rum-not-reporting-data-on-kibana/293123 "2022-01-04T17:03:40Z")
Team, We have added the below options in the apm-server.rum section of the apm-server.yml config file to enable RUM Agent ,but its not reporting data back to the dashboard. apm-server.rum.enabled: true apm-server.auth… --- ## [Logstash is running but not sending logs to elasticsearch](https://discuss.elastic.co/t/logstash-is-running-but-not-sending-logs-to-elasticsearch/293433)
**Author:** [@Othmane\_CHHAIBI](https://discuss.elastic.co/u/Othmane_CHHAIBI)\ **Replies:** 1\ **Last updated:** [January 4, 2022, 4:48pm UTC](https://discuss.elastic.co/t/logstash-is-running-but-not-sending-logs-to-elasticsearch/293433 "2022-01-04T16:48:42Z")
Hello everyone, after the upgrade of logstash from version 6.8 to 7.16.2, the status of logstash is running but it isn't sending logs to Elasticsearch. this is the logstash log file in the image below :slight\_smile: … [Previous page](https://discuss.elastic.co/latest.md?page=1321) [Next page](https://discuss.elastic.co/latest.md?page=1323)