# Latest **URL:** https://discuss.elastic.co/latest.md?page=1396 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1397 --- ## [Where would my syslogs be?](https://discuss.elastic.co/t/where-would-my-syslogs-be/288819)
**Author:** [@MKirby](https://discuss.elastic.co/u/MKirby)\ **Replies:** 0\ **Last updated:** [November 9, 2021, 8:19pm UTC](https://discuss.elastic.co/t/where-would-my-syslogs-be/288819 "2021-11-09T20:19:28Z")
Good Afternoon Elastic team. I have proof via packetbeat that my syslogs are flowing to my Logstash server. I can also netstat and confirm the ports are open and listening on the configured port. I have the following … --- ## ["Too small maximum heap"](https://discuss.elastic.co/t/too-small-maximum-heap/288816)
**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Replies:** 2\ **Last updated:** [November 9, 2021, 7:53pm UTC](https://discuss.elastic.co/t/too-small-maximum-heap/288816 "2021-11-09T19:53:42Z")
I have installed 7.14 on a new machine running ubuntu 18.04. This machine has 48 GB of memory and is identical to another machine that I am currently running ES 7.14 on. The Elasticsearch.yml is identical and jvm.opti… --- ## [ParNew and ConcurrentMarkSweep seen in logs](https://discuss.elastic.co/t/parnew-and-concurrentmarksweep-seen-in-logs/288806)
**Author:** [@MKirby](https://discuss.elastic.co/u/MKirby)\ **Replies:** 4\ **Last updated:** [November 9, 2021, 7:37pm UTC](https://discuss.elastic.co/t/parnew-and-concurrentmarksweep-seen-in-logs/288806 "2021-11-09T19:37:22Z")
Good Afternoon everyone; I am seeing the following lines when I place my Logstash in Debug mode to collect logs. I have a feeling that it is what is stopping me from seeing any syslog that has been forwarded to the logs… --- ## [Error install kibana last version](https://discuss.elastic.co/t/error-install-kibana-last-version/288684)
**Author:** [@samuel\_desseaux](https://discuss.elastic.co/u/samuel_desseaux)\ **Replies:** 7\ **Last updated:** [November 9, 2021, 7:29pm UTC](https://discuss.elastic.co/t/error-install-kibana-last-version/288684 "2021-11-09T19:29:57Z")
Hello I've installed elastcisearch without any problems in the last version,things are OK but when i installl kibana, it says "kibana server is not ready yet". In my configuration file, i've just filled the port,url of… --- ## [Get the first line of \[message\] field coming from winlogbeat](https://discuss.elastic.co/t/get-the-first-line-of-message-field-coming-from-winlogbeat/288768)
**Author:** [@yquirion](https://discuss.elastic.co/u/yquirion)\ **Replies:** 6\ **Last updated:** [November 9, 2021, 7:24pm UTC](https://discuss.elastic.co/t/get-the-first-line-of-message-field-coming-from-winlogbeat/288768 "2021-11-09T19:24:30Z")
Hello, I'm trying to get the first line of the message field because this is an important information to keep. The \[message\] line, when I set the output to file using rudydebug option looks like this: "message" =\> "A… --- ## [Unexpected file read error while reading index](https://discuss.elastic.co/t/unexpected-file-read-error-while-reading-index/288795)
**Author:** [@tropically](https://discuss.elastic.co/u/tropically)\ **Replies:** 2\ **Last updated:** [November 9, 2021, 7:23pm UTC](https://discuss.elastic.co/t/unexpected-file-read-error-while-reading-index/288795 "2021-11-09T19:23:58Z")
Hi We are running elastisearch on Openshift. Currently there are 3 nodes configured. We received the below error on one of the 3 nodes that we have : ElasticsearchException\[failed to load metadata\]; nested: CorruptI… --- ## [How elasticsearch index Geo-points?](https://discuss.elastic.co/t/how-elasticsearch-index-geo-points/288813)
**Author:** [@ehsan\_kabiri\_33](https://discuss.elastic.co/u/ehsan_kabiri_33)\ **Replies:** 0\ **Last updated:** [November 9, 2021, 7:19pm UTC](https://discuss.elastic.co/t/how-elasticsearch-index-geo-points/288813 "2021-11-09T19:19:31Z")
I can't imagine how Elasteicsearch index Geo-points. Suppose I have 1 million records/documents in my table/index and each document has a geo point (Lat/Lon). In sql , if I want to find the 10 nearest docs, I need to … --- ## [\_update\_by\_query with substring](https://discuss.elastic.co/t/update-by-query-with-substring/288777)
**Author:** [@Petr.Simik](https://discuss.elastic.co/u/Petr.Simik)\ **Replies:** 3\ **Last updated:** [November 9, 2021, 6:45pm UTC](https://discuss.elastic.co/t/update-by-query-with-substring/288777 "2021-11-09T18:45:12Z")
Hi I wand to update specific fields with its substring value MSISDN: "444123456" replace with MSISDN: "123456" is there a way how to write update query ? What is the best way to do such thing. thank you P POST t… --- ## [Logstashpipelines, Internal API server error, path\_info=\>"/\_node/stats"](https://discuss.elastic.co/t/logstashpipelines-internal-api-server-error-path-info-node-stats/288735)
**Author:** [@Melany](https://discuss.elastic.co/u/Melany)\ **Replies:** 1\ **Last updated:** [November 9, 2021, 6:03pm UTC](https://discuss.elastic.co/t/logstashpipelines-internal-api-server-error-path-info-node-stats/288735 "2021-11-09T18:03:42Z")
Hello, when I start my logstashpipelines service I am getting the following error: \[2021-11-09T10:05:16,268\]\[ERROR\]\[logstash.agent \] Internal API server error {:status=\>500, :request\_method=\>"GET", :path\_info=\>"/\_node/s… --- ## [How to replace all groups of number in a string using gsub](https://discuss.elastic.co/t/how-to-replace-all-groups-of-number-in-a-string-using-gsub/288761)
**Author:** [@gustavon](https://discuss.elastic.co/u/gustavon)\ **Replies:** 1\ **Last updated:** [November 9, 2021, 5:49pm UTC](https://discuss.elastic.co/t/how-to-replace-all-groups-of-number-in-a-string-using-gsub/288761 "2021-11-09T17:49:00Z")
Hi, I have an uri on nginx log like this: /xyz/attachment/thumbnail/61355754/90/90 and others, so I need to use gsub to replace all number to something else, /xyz/attachment/thumbnail/{}/{}/{} for example, I tried to us… --- ## [Grok Named capture group as metadata](https://discuss.elastic.co/t/grok-named-capture-group-as-metadata/288731)
**Author:** [@sirReeall](https://discuss.elastic.co/u/sirReeall)\ **Replies:** 1\ **Last updated:** [November 9, 2021, 5:47pm UTC](https://discuss.elastic.co/t/grok-named-capture-group-as-metadata/288731 "2021-11-09T17:47:57Z")
Hello, I was wondering if it is possible to set a named capture group as metadata rather then a field sent to Elastic? I'm parsing some data that has these permutations for the same field: 1m 125s 345ms 125s 345ms 345… --- ## [Generate Series of Days with ElasticSearch](https://discuss.elastic.co/t/generate-series-of-days-with-elasticsearch/288804)
**Author:** [@TomTom](https://discuss.elastic.co/u/TomTom)\ **Replies:** 0\ **Last updated:** [November 9, 2021, 5:47pm UTC](https://discuss.elastic.co/t/generate-series-of-days-with-elasticsearch/288804 "2021-11-09T17:47:40Z")
With PostgreSQL I can use the generate\_series feature to generate a list of days between two dates, and with a little effort, even generate a list of sales made by day within that range, even if there are no sales for th… --- ## [Elasticsearch Mapping field for Multiple languages Search](https://discuss.elastic.co/t/elasticsearch-mapping-field-for-multiple-languages-search/288762)
**Author:** [@faizan.gulzar](https://discuss.elastic.co/u/faizan.gulzar)\ **Replies:** 1\ **Last updated:** [November 9, 2021, 5:09pm UTC](https://discuss.elastic.co/t/elasticsearch-mapping-field-for-multiple-languages-search/288762 "2021-11-09T17:09:00Z")
We are using Elasticsearch (Version 2.3.1) to Search on our website. Company Names are different in different languages like English, German, Polisch, Turkish, etc. When we search Company Name using English characters, … --- ## [Event Filter endpoint agent via Kibana (Fleet) with wildcards](https://discuss.elastic.co/t/event-filter-endpoint-agent-via-kibana-fleet-with-wildcards/288680)
**Author:** [@tfriesen](https://discuss.elastic.co/u/tfriesen)\ **Replies:** 2\ **Last updated:** [November 9, 2021, 5:08pm UTC](https://discuss.elastic.co/t/event-filter-endpoint-agent-via-kibana-fleet-with-wildcards/288680 "2021-11-09T17:08:19Z")
Situation: I'm deploying endpoint security via Fleet and Elastic agent. Many of the default settings cause the agents to be extremely chatty, shipping many uninteresting, chatty logs. I want to filter out some of these e… --- ## [Elastic search with Springboot connection error](https://discuss.elastic.co/t/elastic-search-with-springboot-connection-error/288789)
**Author:** [@adeybabs](https://discuss.elastic.co/u/adeybabs)\ **Replies:** 1\ **Last updated:** [November 9, 2021, 5:03pm UTC](https://discuss.elastic.co/t/elastic-search-with-springboot-connection-error/288789 "2021-11-09T17:03:11Z")
I keep getting this error when I try to load my spring application connected to Elasticsearch --- ## [Applying settings /app/logs/settings via an API](https://discuss.elastic.co/t/applying-settings-app-logs-settings-via-an-api/288771)
**Author:** [@angelom888](https://discuss.elastic.co/u/angelom888)\ **Replies:** 3\ **Last updated:** [November 9, 2021, 4:52pm UTC](https://discuss.elastic.co/t/applying-settings-app-logs-settings-via-an-api/288771 "2021-11-09T16:52:25Z")
I am able to manually configure the setting for logs streams from https:/kibanahost:5601/app/logs/settings I want to do this programmatically but cannot seem to find the API to do this. Can anyone help point me in the… --- ## [Index data as nested and flattened to improve aggregation performance?](https://discuss.elastic.co/t/index-data-as-nested-and-flattened-to-improve-aggregation-performance/288799)
**Author:** [@caseydm](https://discuss.elastic.co/u/caseydm)\ **Replies:** 0\ **Last updated:** [November 9, 2021, 4:51pm UTC](https://discuss.elastic.co/t/index-data-as-nested-and-flattened-to-improve-aggregation-performance/288799 "2021-11-09T16:51:39Z")
I am indexing academic papers that have a list of authors. Right now, I index the authors as a nested field type, because we want to query within the list, such as author\_sequence\_number: 1 and author\_display\_name: torre… --- ## [Can't enroll agent to fleet: (Fail to enroll: fail to execute request to fleet-server)](https://discuss.elastic.co/t/cant-enroll-agent-to-fleet-fail-to-enroll-fail-to-execute-request-to-fleet-server/285682)
**Author:** [@John9](https://discuss.elastic.co/u/John9)\ **Replies:** 4\ **Last updated:** [November 9, 2021, 4:29pm UTC](https://discuss.elastic.co/t/cant-enroll-agent-to-fleet-fail-to-enroll-fail-to-execute-request-to-fleet-server/285682 "2021-11-09T16:29:34Z")
Hello, I've been trying to setup a testing ELK stack environment for learning purposes. I am running: VM1 = Ubuntu Server 20.04 running Elasticsearch / Kibana with IP 172.16.0.27. Minimal Security is on. VM2 = Ubuntu … --- ## [Unable to parse Timestamp on CEF LOGS](https://discuss.elastic.co/t/unable-to-parse-timestamp-on-cef-logs/288781)
**Author:** [@Mmatos](https://discuss.elastic.co/u/Mmatos)\ **Replies:** 1\ **Last updated:** [November 9, 2021, 3:46pm UTC](https://discuss.elastic.co/t/unable-to-parse-timestamp-on-cef-logs/288781 "2021-11-09T15:46:59Z")
Hi, I am having problems parsing a set of logs from sophos central Intercept X Antivirus. I am using the sophos tool to download the logs and store them in a File. "Service and Support" Of the multiple formats, the CEF… --- ## [Alternatives to Multiline Codec for logging Java traces with TCP input?](https://discuss.elastic.co/t/alternatives-to-multiline-codec-for-logging-java-traces-with-tcp-input/288784)
**Author:** [@bennetth](https://discuss.elastic.co/u/bennetth)\ **Replies:** 0\ **Last updated:** [November 9, 2021, 3:43pm UTC](https://discuss.elastic.co/t/alternatives-to-multiline-codec-for-logging-java-traces-with-tcp-input/288784 "2021-11-09T15:43:08Z")
Hello all, I have an issue where I am trying to log Java traces for a TCP input. However, it appears that Logstash truncates the trace to just the first line of the trace. I have attempted to use the multiline codec for… --- ## [HTTP header does not include traceparent](https://discuss.elastic.co/t/http-header-does-not-include-traceparent/288649)
**Author:** [@sfischer](https://discuss.elastic.co/u/sfischer)\ **Replies:** 3\ **Last updated:** [November 9, 2021, 3:29pm UTC](https://discuss.elastic.co/t/http-header-does-not-include-traceparent/288649 "2021-11-09T15:29:27Z")
I am trying to use RUM on the spring-boot application https://github.com/spring-projects/spring-petclinic. I would like to link the transactions from the Client side (i.e. JavaScript) to the Server side (i.e. Java). Fro… --- ## [TypeScript + elasticSearch search has\_child filter](https://discuss.elastic.co/t/typescript-elasticsearch-search-has-child-filter/288775)
**Author:** [@Francisco\_Ferreira](https://discuss.elastic.co/u/Francisco_Ferreira)\ **Replies:** 1\ **Last updated:** [November 9, 2021, 3:01pm UTC](https://discuss.elastic.co/t/typescript-elasticsearch-search-has-child-filter/288775 "2021-11-09T15:01:47Z")
Hey guys, i'm been building a search endpoint to my api. and when i try to filter the ''has\_child'' query with a match\\term query it returns me all the employees that have childs or none at all here i have the way i'm i… --- ## [ELK Licencing question](https://discuss.elastic.co/t/elk-licencing-question/288681)
**Author:** [@Eduard\_Abril](https://discuss.elastic.co/u/Eduard_Abril)\ **Replies:** 4\ **Last updated:** [November 9, 2021, 2:44pm UTC](https://discuss.elastic.co/t/elk-licencing-question/288681 "2021-11-09T14:44:39Z")
Hello guys, We are planning to deploy an ELK architecture with enterprise features, our though is to deploy 9 Elasticsearch nodes with different roles, 1 kibana node and 2 logstash nodes, my question is How many nodes d… --- ## [%{message} is always empty](https://discuss.elastic.co/t/message-is-always-empty/288765)
**Author:** [@Robert\_Neagu](https://discuss.elastic.co/u/Robert_Neagu)\ **Replies:** 1\ **Last updated:** [November 9, 2021, 2:32pm UTC](https://discuss.elastic.co/t/message-is-always-empty/288765 "2021-11-09T14:32:56Z")
I want to send an email notification if there are any errors inside the Logstash import process. For this I'm using the email plugin inside the output section output { email { to =\> "mail@gmail.com" from =\> "server@… --- ## [Solr APM transactions not showing](https://discuss.elastic.co/t/solr-apm-transactions-not-showing/288607)
**Author:** [@Shubham\_Singh](https://discuss.elastic.co/u/Shubham_Singh)\ **Replies:** 4\ **Last updated:** [November 9, 2021, 2:29pm UTC](https://discuss.elastic.co/t/solr-apm-transactions-not-showing/288607 "2021-11-09T14:29:03Z")
Implemented solr APM but under transactions it shows- --- ## [Elastisearch snapshots error - Can not find an azure client for account](https://discuss.elastic.co/t/elastisearch-snapshots-error-can-not-find-an-azure-client-for-account/288754)
**Author:** [@Cian](https://discuss.elastic.co/u/Cian)\ **Replies:** 0\ **Last updated:** [November 9, 2021, 11:57am UTC](https://discuss.elastic.co/t/elastisearch-snapshots-error-can-not-find-an-azure-client-for-account/288754 "2021-11-09T11:57:57Z")
Hi Elasticsearch, I want to update the Azure storage account that we upload snapshots to but I get the below error: "Can not find an azure client for account \[null\]\]" this is only happening when I change the storage ac… --- ## [Unable to retrieve version information from Elasticsearch node](https://discuss.elastic.co/t/unable-to-retrieve-version-information-from-elasticsearch-node/288717)
**Author:** [@slashlinux](https://discuss.elastic.co/u/slashlinux)\ **Replies:** 1\ **Last updated:** [November 9, 2021, 1:39pm UTC](https://discuss.elastic.co/t/unable-to-retrieve-version-information-from-elasticsearch-node/288717 "2021-11-09T13:39:33Z")
After I've enabled the xpack security for integrating the Keycloak SSO on Kibana/Elasticsearch, now my kibana says - Kibana server is not ready yet and the kibana logs showing :slight\_smile: {"type":"log","@timestamp":"… --- ## [ECK with elastic helm-charts](https://discuss.elastic.co/t/eck-with-elastic-helm-charts/288502)
**Author:** [@TobiaszG24](https://discuss.elastic.co/u/TobiaszG24)\ **Replies:** 1\ **Last updated:** [November 9, 2021, 1:27pm UTC](https://discuss.elastic.co/t/eck-with-elastic-helm-charts/288502 "2021-11-09T13:27:21Z")
How to deploy ELK using helm charts, but set ECK as cluster manager? From what I understand, ECK requires to set "Kind" in yaml manifest to "Elasticsearch" (specific custom resource) instead of "StatefulSet". --- ## [Is searches faster with more match queries?](https://discuss.elastic.co/t/is-searches-faster-with-more-match-queries/287867)
**Author:** [@MinwooKim](https://discuss.elastic.co/u/MinwooKim)\ **Replies:** 3\ **Last updated:** [November 9, 2021, 1:06pm UTC](https://discuss.elastic.co/t/is-searches-faster-with-more-match-queries/287867 "2021-11-09T13:06:37Z")
I have two queries. And in the index all of the data have collectHour as 10. if I request both queries, the one with more match statements was faster.... I am curious, if all fields are inspected as columns that are in… --- ## [Adding ECK Operator Liveness Probe](https://discuss.elastic.co/t/adding-eck-operator-liveness-probe/288235)
**Author:** [@MattThomson](https://discuss.elastic.co/u/MattThomson)\ **Replies:** 2\ **Last updated:** [November 9, 2021, 12:44pm UTC](https://discuss.elastic.co/t/adding-eck-operator-liveness-probe/288235 "2021-11-09T12:44:52Z")
I've attempted to add liveness and readiness probes to the ECK operator itself (not the Elasticsearch,kibana,etc pods), but I can't find any documentation on exposed endpoints for health checks. So far I'm doing this wit… [Previous page](https://discuss.elastic.co/latest.md?page=1395) [Next page](https://discuss.elastic.co/latest.md?page=1397)