# Latest **URL:** https://discuss.elastic.co/latest.md?page=1332 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1333 --- ## [Logstash configuration file in joining two csv files based on primary key](https://discuss.elastic.co/t/logstash-configuration-file-in-joining-two-csv-files-based-on-primary-key/292792)
**Author:** [@Dhamu-143](https://discuss.elastic.co/u/Dhamu-143)\ **Replies:** 1\ **Last updated:** [December 23, 2021, 2:36pm UTC](https://discuss.elastic.co/t/logstash-configuration-file-in-joining-two-csv-files-based-on-primary-key/292792 "2021-12-23T14:36:03Z")
Hi, I'm not able to join the two csv files based on the primary key(same value or same field). I'm taking two csv input files that are shown below Student Table(Table 1) Stdid,sname,fee 121,john,10000 123,glenn,120… --- ## [Xml input messy fields](https://discuss.elastic.co/t/xml-input-messy-fields/292812)
**Author:** [@abdullah144](https://discuss.elastic.co/u/abdullah144)\ **Replies:** 2\ **Last updated:** [December 23, 2021, 2:29pm UTC](https://discuss.elastic.co/t/xml-input-messy-fields/292812 "2021-12-23T14:29:52Z")
Hey Guys , I already can sent a log to my logstash as my log is xml format , but the issue is logstash creating a new fields from tag as below : I want to stop him creating the new fields from logMessage tag . My … --- ## [How to consume Logstash through the Postman](https://discuss.elastic.co/t/how-to-consume-logstash-through-the-postman/292702)
**Author:** [@abdullah144](https://discuss.elastic.co/u/abdullah144)\ **Replies:** 1\ **Last updated:** [December 22, 2021, 3:08pm UTC](https://discuss.elastic.co/t/how-to-consume-logstash-through-the-postman/292702 "2021-12-22T15:08:46Z")
Hey guys, I have a requirement to push data to Logstash through Postman where it will be automatically store it in Elasticsearch , how can I do that ? Best Regards, --- ## [Data not sent to ElasticSearch (with Logstash)](https://discuss.elastic.co/t/data-not-sent-to-elasticsearch-with-logstash/292696)
**Author:** [@Greninja\_San](https://discuss.elastic.co/u/Greninja_San)\ **Replies:** 6\ **Last updated:** [December 23, 2021, 2:03pm UTC](https://discuss.elastic.co/t/data-not-sent-to-elasticsearch-with-logstash/292696 "2021-12-23T14:03:22Z")
Hello! I'm trying to send data to Elasticsearch with logstash on a Linux server. For some reasons, I do not get any error, but nothing is sent. input { file { path =\> \["/srv/XXX/csv\_receivers/XXX\_receiver/\*"\] … --- ## [How can I delete and insert parent document?](https://discuss.elastic.co/t/how-can-i-delete-and-insert-parent-document/292803)
**Author:** [@Ulan\_Zhenisserov](https://discuss.elastic.co/u/Ulan_Zhenisserov)\ **Replies:** 0\ **Last updated:** [December 23, 2021, 12:50pm UTC](https://discuss.elastic.co/t/how-can-i-delete-and-insert-parent-document/292803 "2021-12-23T12:50:33Z")
Hi. Can someone help me with this as i want to delete my parent docs in my parent child relationship and insert it again to the index. How will it work? This again inserted parent document will be in the same shard as it… --- ## [Azure Billing in Fleet integration](https://discuss.elastic.co/t/azure-billing-in-fleet-integration/292797)
**Author:** [@dabo](https://discuss.elastic.co/u/dabo)\ **Replies:** 0\ **Last updated:** [December 23, 2021, 11:09am UTC](https://discuss.elastic.co/t/azure-billing-in-fleet-integration/292797 "2021-12-23T11:09:50Z")
Hi, Any idea when will Azure Billing be added to Azure integration in Fleet (elastic agent). I can see this PR is open: Create Azure billing package by narph · Pull Request #1052 · elastic/integrations · GitHub Kind r… --- ## [Filebeat, different indices from different CSV](https://discuss.elastic.co/t/filebeat-different-indices-from-different-csv/292724)
**Author:** [@giron](https://discuss.elastic.co/u/giron)\ **Replies:** 1\ **Last updated:** [December 23, 2021, 10:29am UTC](https://discuss.elastic.co/t/filebeat-different-indices-from-different-csv/292724 "2021-12-23T10:29:28Z")
Hi all, I need your help to understand where or what is wrong. I need to read different file csv (for now 4 csv) and write the data in 4 indexs on elastic using Filebeat. This configuration with 2 CSV, 2 indexs and 2 p… --- ## [Logstash with two dissect - only the first dissect is used now and then](https://discuss.elastic.co/t/logstash-with-two-dissect-only-the-first-dissect-is-used-now-and-then/292794)
**Author:** [@stillfreem](https://discuss.elastic.co/u/stillfreem)\ **Replies:** 1\ **Last updated:** [December 23, 2021, 10:09am UTC](https://discuss.elastic.co/t/logstash-with-two-dissect-only-the-first-dissect-is-used-now-and-then/292794 "2021-12-23T10:09:14Z")
Hi All, I have the following conf { syslog { host =\> "127.0.0.1" port =\> 5000 } } filter { if \[program\] == "github\_auth" or \[program == "github\_gitauth"\] or \[progr… --- ## [Logstash - обработка access.log](https://discuss.elastic.co/t/logstash-access-log/292787)
**Author:** [@sergey\_privacy](https://discuss.elastic.co/u/sergey_privacy)\ **Replies:** 0\ **Last updated:** [December 23, 2021, 9:19am UTC](https://discuss.elastic.co/t/logstash-access-log/292787 "2021-12-23T09:19:46Z")
Добрый день! Подскажите пожалуйста по такому вопросу. Есть у меня логи апача. Если применять %{COMMONAPACHELOG} на строку с датой вида \[04/Jan/2015:05:13:42 +0000\] то строка парсится нормально. Но в моем файле логи … --- ## [How to whitelist again a email which is unsubscribed by the end user in Elastic Cloud?](https://discuss.elastic.co/t/how-to-whitelist-again-a-email-which-is-unsubscribed-by-the-end-user-in-elastic-cloud/292784)
**Author:** [@Gaurav2](https://discuss.elastic.co/u/Gaurav2)\ **Replies:** 0\ **Last updated:** [December 23, 2021, 9:03am UTC](https://discuss.elastic.co/t/how-to-whitelist-again-a-email-which-is-unsubscribed-by-the-end-user-in-elastic-cloud/292784 "2021-12-23T09:03:41Z")
Hello, we are using Elastic Cloud. we have configured alerts with the Elastic SMTP (preconfigure one which comes with Elastic Cloud default). It works fine. but one of our users has clicked on un-subscribe to the email … --- ## [How to send watcher alert email via gmail SMTP in Elastic Cloud?](https://discuss.elastic.co/t/how-to-send-watcher-alert-email-via-gmail-smtp-in-elastic-cloud/292783)
**Author:** [@Gaurav2](https://discuss.elastic.co/u/Gaurav2)\ **Replies:** 0\ **Last updated:** [December 23, 2021, 9:00am UTC](https://discuss.elastic.co/t/how-to-send-watcher-alert-email-via-gmail-smtp-in-elastic-cloud/292783 "2021-12-23T09:00:03Z")
Hello, we are trying to set watcher alerts via Gmail SMTP. we found some references in the official documentation and that seems to be of on-prem ELK Step. it is possible to do in Elastic Cloud? --- ## [Autoscaling on hosted elastic](https://discuss.elastic.co/t/autoscaling-on-hosted-elastic/292764)
**Author:** [@Divyank\_Mahalle](https://discuss.elastic.co/u/Divyank_Mahalle)\ **Replies:** 2\ **Last updated:** [December 23, 2021, 8:58am UTC](https://discuss.elastic.co/t/autoscaling-on-hosted-elastic/292764 "2021-12-23T08:58:53Z")
Hi, I am using hosted es with v 11.1.2. I am having two nodes with 1 primary shard and 1 replica shard in each node. (for 1 index- 1 primary and 1 replica shard) Autoscaling is enabled for clusters. During autoscaling… --- ## [Logstash new connection and connection reset](https://discuss.elastic.co/t/logstash-new-connection-and-connection-reset/292782)
**Author:** [@alfianaf](https://discuss.elastic.co/u/alfianaf)\ **Replies:** 0\ **Last updated:** [December 23, 2021, 8:35am UTC](https://discuss.elastic.co/t/logstash-new-connection-and-connection-reset/292782 "2021-12-23T08:35:38Z")
Hello, I was looking for explanation on the logstash logs about "new connection" and "connection reset", and I couldn't find any clue. Does "new connection" mean that a new connection has been established from client to… --- ## [Failed to connect to backoff while connecting Winlogbeat with Logstash](https://discuss.elastic.co/t/failed-to-connect-to-backoff-while-connecting-winlogbeat-with-logstash/292781)
**Author:** [@risshukla](https://discuss.elastic.co/u/risshukla)\ **Replies:** 0\ **Last updated:** [December 23, 2021, 8:35am UTC](https://discuss.elastic.co/t/failed-to-connect-to-backoff-while-connecting-winlogbeat-with-logstash/292781 "2021-12-23T08:35:06Z")
Hello Everyone, I am trying to update Winlogbeat to 7.16.2 to make it compatible with Logstash 7.16.2. Our configuration was already working between two stack on version 7.6.0, so we are upgrading just the minor versio… --- ## [Can't select data by time on time picker. See all data only](https://discuss.elastic.co/t/cant-select-data-by-time-on-time-picker-see-all-data-only/292771)
**Author:** [@Alex\_C](https://discuss.elastic.co/u/Alex_C)\ **Replies:** 1\ **Last updated:** [December 23, 2021, 8:24am UTC](https://discuss.elastic.co/t/cant-select-data-by-time-on-time-picker-see-all-data-only/292771 "2021-12-23T08:24:15Z")
Hi. I use Kibana 7.16.1 I'm trying to analyze the log that comes from a CSV file (Windows File bat --\> Logstash --\> Elastic) There is a date and time of events in the log During processing in Logstash, I add this dat… --- ## [CICD pipeline for testing the logstash config](https://discuss.elastic.co/t/cicd-pipeline-for-testing-the-logstash-config/292778)
**Author:** [@WimDH](https://discuss.elastic.co/u/WimDH)\ **Replies:** 0\ **Last updated:** [December 23, 2021, 8:24am UTC](https://discuss.elastic.co/t/cicd-pipeline-for-testing-the-logstash-config/292778 "2021-12-23T08:24:12Z")
Dears, I have my logstash config in gitlab, from where I deploy it on my production machines. As the config grows, and others contribute to it, the risk of getting errors is becoming bigger. Therefore, I would like to … --- ## [Dec 23rd, 2021: \[es\] Aumentando documentos con la política geo\_match](https://discuss.elastic.co/t/dec-23rd-2021-es-aumentando-documentos-con-la-politica-geo-match/292462)
**Author:** [@jsanz](https://discuss.elastic.co/u/jsanz)\ **Replies:** 0\ **Last updated:** [December 23, 2021, 8:00am UTC](https://discuss.elastic.co/t/dec-23rd-2021-es-aumentando-documentos-con-la-politica-geo-match/292462 "2021-12-23T08:00:39Z")
:speaking\_head: This article is also available in English Como tal vez sepas, el 19 de Septiembre de 2021 comenzó la erupción del Cumbre Vieja en la isla de La Palma en las Islas Canarias, España. El gobierno de la i… --- ## [Dec 23rd, 2021: \[en\] Enriching documents with the geo\_match policy](https://discuss.elastic.co/t/dec-23rd-2021-en-enriching-documents-with-the-geo-match-policy/289302)
**Author:** [@jsanz](https://discuss.elastic.co/u/jsanz)\ **Replies:** 0\ **Last updated:** [December 23, 2021, 8:00am UTC](https://discuss.elastic.co/t/dec-23rd-2021-en-enriching-documents-with-the-geo-match-policy/289302 "2021-12-23T08:00:39Z")
:speaking\_head: This article is also available in Spanish As you may know, on September 19th of 2021, the Cumbre Vieja volcano eruption started in La Palma, Canary Islands, Spain. The island's government almost immedi… --- ## [7.15.2 is also very slow](https://discuss.elastic.co/t/7-15-2-is-also-very-slow/290596)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 17\ **Last updated:** [December 23, 2021, 7:23am UTC](https://discuss.elastic.co/t/7-15-2-is-also-very-slow/290596 "2021-12-23T07:23:37Z")
following thread is close hence open new one. https://discuss.elastic.co/t/7-15-1-is-extremely-slow/287617/10 I show 7.15.2 is out hence decided to test in this setup I have Elasticsearch -\> 7.15.1 and kibane 7.15.2. … --- ## [Configure load balancer/ingress for ECK on AWS EKS](https://discuss.elastic.co/t/configure-load-balancer-ingress-for-eck-on-aws-eks/292526)
**Author:** [@George\_Leonard](https://discuss.elastic.co/u/George_Leonard)\ **Replies:** 3\ **Last updated:** [December 23, 2021, 6:29am UTC](https://discuss.elastic.co/t/configure-load-balancer-ingress-for-eck-on-aws-eks/292526 "2021-12-23T06:29:40Z")
Hi guys Can anyone point me to how/what to configure to make the stack accessible from say a 2nd K8S cluster... I will have X workload on my EKS cluster, which includes the EKS stack, but also have a 2nd EKS cluster an… --- ## [EQL scenario doesn't match](https://discuss.elastic.co/t/eql-scenario-doesnt-match/292765)
**Author:** [@ateethrigvedi](https://discuss.elastic.co/u/ateethrigvedi)\ **Replies:** 0\ **Last updated:** [December 23, 2021, 6:20am UTC](https://discuss.elastic.co/t/eql-scenario-doesnt-match/292765 "2021-12-23T06:20:53Z")
I was trying to match some lines using EQL, but no match was found in-spite of having lines which matches the criteria in Elasticsearch. Kindly provide some leads about the same. Thanks in advance EQL QUERY: GET /inde… --- ## [Filebeat kafka input using multiline parser gives no output](https://discuss.elastic.co/t/filebeat-kafka-input-using-multiline-parser-gives-no-output/292290)
**Author:** [@rsniper](https://discuss.elastic.co/u/rsniper)\ **Replies:** 1\ **Last updated:** [December 23, 2021, 5:27am UTC](https://discuss.elastic.co/t/filebeat-kafka-input-using-multiline-parser-gives-no-output/292290 "2021-12-23T05:27:39Z")
I have posted the issue on stackoverflow as well Filebeat kafka input using multiline parser gives no output Filebeat is configured to use input from kafka and output to file When the multiline setting is turned off, … --- ## [Is it possible to use secrets from Elasticsearch keystore in ES Watcher actions?](https://discuss.elastic.co/t/is-it-possible-to-use-secrets-from-elasticsearch-keystore-in-es-watcher-actions/292755)
**Author:** [@andrewthetack](https://discuss.elastic.co/u/andrewthetack)\ **Replies:** 1\ **Last updated:** [December 23, 2021, 4:08am UTC](https://discuss.elastic.co/t/is-it-possible-to-use-secrets-from-elasticsearch-keystore-in-es-watcher-actions/292755 "2021-12-23T04:08:02Z")
I use watchers that call custom webhooks in their actions sections. Can I refer keystore values in the Authorization headers similar to variables? I need something similar to: "actions": { "my-api-notification": { … --- ## [Elastic Stack upgradation from 7.13.4 to 7.16.2](https://discuss.elastic.co/t/elastic-stack-upgradation-from-7-13-4-to-7-16-2/292703)
**Author:** [@chandra\_mohan1](https://discuss.elastic.co/u/chandra_mohan1)\ **Replies:** 2\ **Last updated:** [December 23, 2021, 4:14am UTC](https://discuss.elastic.co/t/elastic-stack-upgradation-from-7-13-4-to-7-16-2/292703 "2021-12-23T04:14:58Z")
We are planning to update elastic stack which contains, Elasticsearch cluster, Logstash, Kibana & Elasticsearch Monitoring cluster. We are not using any beats to ship data to logstash. Data to monitoring cluster is ship… --- ## [How to install Elasticsearch & Logstash using RPM for version 7.13.4](https://discuss.elastic.co/t/how-to-install-elasticsearch-logstash-using-rpm-for-version-7-13-4/292715)
**Author:** [@chandra\_mohan1](https://discuss.elastic.co/u/chandra_mohan1)\ **Replies:** 2\ **Last updated:** [December 23, 2021, 4:13am UTC](https://discuss.elastic.co/t/how-to-install-elasticsearch-logstash-using-rpm-for-version-7-13-4/292715 "2021-12-23T04:13:46Z")
I want install Elasticsearch & Logstash of version 7.13.4 using RPM to perform some testing. I am trying to install using using RPM package mentioned here: \[Installing Logstash | Logstash Reference \[7.16\] | Elastic\](htt… --- ## [How to join two index](https://discuss.elastic.co/t/how-to-join-two-index/292629)
**Author:** [@arisxf](https://discuss.elastic.co/u/arisxf)\ **Replies:** 5\ **Last updated:** [December 23, 2021, 2:11am UTC](https://discuss.elastic.co/t/how-to-join-two-index/292629 "2021-12-23T02:11:36Z")
I've tried using aliases (aliases a and b) the results alert The data you are seeing might be incomplete or wrong. in the field at index b. Please help me POST /\_aliases { "actions" : \[ { "add" : { "index" :… --- ## [Some vulnerabilities in repository S3 plugin for Elasticsearch](https://discuss.elastic.co/t/some-vulnerabilities-in-repository-s3-plugin-for-elasticsearch/292748)
**Author:** [@Sagarika\_Mahalik](https://discuss.elastic.co/u/Sagarika_Mahalik)\ **Replies:** 1\ **Last updated:** [December 23, 2021, 1:17am UTC](https://discuss.elastic.co/t/some-vulnerabilities-in-repository-s3-plugin-for-elasticsearch/292748 "2021-12-23T01:17:52Z")
Hi There are some Vulnerabilities which are coming from repository S3 plugin in these two jar jackson-databind-2.10.4.jar log4j-1.2-api-2.11.1.jar Please have a look into these. --- ## [Zero-day-exploit in log4j2 which is part of elasticsearch](https://discuss.elastic.co/t/zero-day-exploit-in-log4j2-which-is-part-of-elasticsearch/291439)
**Author:** [@spotlight2001](https://discuss.elastic.co/u/spotlight2001)\ **Replies:** 93\ **Last updated:** [December 23, 2021, 12:44am UTC](https://discuss.elastic.co/t/zero-day-exploit-in-log4j2-which-is-part-of-elasticsearch/291439 "2021-12-23T00:44:47Z")
Elasticsearch 7.1.1 seems to contain log4j 2.11.1 So is Elasticsearch affected? Will there be a new 7.1.x? --- ## [Transform not synching](https://discuss.elastic.co/t/transform-not-synching/292699)
**Author:** [@iamtheschmitzer](https://discuss.elastic.co/u/iamtheschmitzer)\ **Replies:** 8\ **Last updated:** [December 22, 2021, 10:20pm UTC](https://discuss.elastic.co/t/transform-not-synching/292699 "2021-12-22T22:20:50Z")
Hi trying to build my first transform - a latest transform. Maybe I misunderstand, but I expect to create and start the transform and it runs continuously - so new documents in the source index are processed and reflec… --- ## [ES transforms behaviour change after upgrading from 7.10.0 to 7.16.1](https://discuss.elastic.co/t/es-transforms-behaviour-change-after-upgrading-from-7-10-0-to-7-16-1/292700)
**Author:** [@brna](https://discuss.elastic.co/u/brna)\ **Replies:** 3\ **Last updated:** [December 22, 2021, 10:05pm UTC](https://discuss.elastic.co/t/es-transforms-behaviour-change-after-upgrading-from-7-10-0-to-7-16-1/292700 "2021-12-22T22:05:38Z")
I am observing a change in the way es transforms work after the cluster upgrade from 7.10.0 to 7.16.1 It is a continuous transform with filter on source index that would get all of the documents from the source index wi… [Previous page](https://discuss.elastic.co/latest.md?page=1331) [Next page](https://discuss.elastic.co/latest.md?page=1333)