# Latest **URL:** https://discuss.elastic.co/latest.md?page=1414 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1415 --- ## [Resources for modeling application log data?](https://discuss.elastic.co/t/resources-for-modeling-application-log-data/285849)
**Author:** [@swainstead](https://discuss.elastic.co/u/swainstead)\ **Replies:** 3\ **Last updated:** [October 27, 2021, 12:58pm UTC](https://discuss.elastic.co/t/resources-for-modeling-application-log-data/285849 "2021-10-27T12:58:21Z")
I've been working with our application logging and creating Kibana dashboards for a little while now. I wonder though if I'm missing some best practices or techniques for designing the log messages themselves to get the… --- ## [Install and configure winlogbeat in syslog server](https://discuss.elastic.co/t/install-and-configure-winlogbeat-in-syslog-server/287793)
**Author:** [@frank\_rib](https://discuss.elastic.co/u/frank_rib)\ **Replies:** 0\ **Last updated:** [October 27, 2021, 12:21pm UTC](https://discuss.elastic.co/t/install-and-configure-winlogbeat-in-syslog-server/287793 "2021-10-27T12:21:05Z")
Hello, Is it possible to centralize the logs of the windows servers at the level of a SYSLOG server and to install the winlogbeat agent at the level of the latter to parse and send the logs to Elasticsearch? Thank you. … --- ## [Security error after re-install of ElasticSearch](https://discuss.elastic.co/t/security-error-after-re-install-of-elasticsearch/287593)
**Author:** [@MKirby](https://discuss.elastic.co/u/MKirby)\ **Replies:** 4\ **Last updated:** [October 27, 2021, 12:16pm UTC](https://discuss.elastic.co/t/security-error-after-re-install-of-elasticsearch/287593 "2021-10-27T12:16:37Z")
Good Morning I have been receiving multiple messages that read Error: \[object Object\]: shard\_not\_found\_exception at http://10.12.36.50:5601/41022/bundles/plugin/data/kibana/data.plugin.js:1:361224 at async index… --- ## [Elasticsearch WARN log : "component": "o.e.c.s.ClusterApplierService" "message": "cluster state applier task \[Publication{term=17, version=7278}\] took \[41.2s\] which is above the warn threshold of \[30s\]](https://discuss.elastic.co/t/elasticsearch-warn-log-component-o-e-c-s-clusterapplierservice-message-cluster-state-applier-task-publication-term-17-version-7278-took-41-2s-which-is-above-the-warn-threshold-of-30s/287780)
**Author:** [@Farzad\_Ebrahimi](https://discuss.elastic.co/u/Farzad_Ebrahimi)\ **Replies:** 1\ **Last updated:** [October 27, 2021, 12:14pm UTC](https://discuss.elastic.co/t/elasticsearch-warn-log-component-o-e-c-s-clusterapplierservice-message-cluster-state-applier-task-publication-term-17-version-7278-took-41-2s-which-is-above-the-warn-threshold-of-30s/287780 "2021-10-27T12:14:22Z")
Hi everyone, today we faced to this log with level WARN: {"type": "server", "timestamp": "2021-10-26T14:25:59,820Z", "level": "WARN", "component": "o.e.c.s.ClusterApplierService", "cluster.name": "elasticsearch\_cluster… --- ## [Values of type: VALUE\_NULL](https://discuss.elastic.co/t/values-of-type-value-null/286492)
**Author:** [@ebosdev](https://discuss.elastic.co/u/ebosdev)\ **Replies:** 3\ **Last updated:** [October 27, 2021, 12:12pm UTC](https://discuss.elastic.co/t/values-of-type-value-null/286492 "2021-10-27T12:12:34Z")
Hello everyone, I am trying to visualize a timelion and this is the query i am using: .es(index=investigation\_master\_index,timefield=uco-observable:sentTime.@value,split=uco-observable:messageText.keyword:1000) the me… --- ## [Need help to write fast query](https://discuss.elastic.co/t/need-help-to-write-fast-query/287791)
**Author:** [@itsmerajesh](https://discuss.elastic.co/u/itsmerajesh)\ **Replies:** 0\ **Last updated:** [October 27, 2021, 11:45am UTC](https://discuss.elastic.co/t/need-help-to-write-fast-query/287791 "2021-10-27T11:45:00Z")
Hi all, Consider, I have 1000phrases(Example of phrases can be: 1. "Hello",2. "What are you doing", 3. "automatically debit",...etc) as a1, a2, a3.......a1000. now I need to write a query in java for the ES database, th… --- ## [\_source is stored in elasticsearch?](https://discuss.elastic.co/t/source-is-stored-in-elasticsearch/287789)
**Author:** [@Francisco\_Gomez1](https://discuss.elastic.co/u/Francisco_Gomez1)\ **Replies:** 0\ **Last updated:** [October 27, 2021, 11:21am UTC](https://discuss.elastic.co/t/source-is-stored-in-elasticsearch/287789 "2021-10-27T11:21:27Z")
Hi. We are currently checking the capabilities of our cluster, and we noticed that when consult the information in Kibana discover, a json document contains both a "\_source" with all the fields and a separate field call… --- ## [Not able to access Kibana remotely. Request timeout after 3000ms](https://discuss.elastic.co/t/not-able-to-access-kibana-remotely-request-timeout-after-3000ms/287776)
**Author:** [@The\_Man](https://discuss.elastic.co/u/The_Man)\ **Replies:** 1\ **Last updated:** [October 27, 2021, 11:13am UTC](https://discuss.elastic.co/t/not-able-to-access-kibana-remotely-request-timeout-after-3000ms/287776 "2021-10-27T11:13:06Z")
I am not able to remotely access kibana using my http://publicip:5601 kibana.yml # Kibana is served by a back end server. This setting specifies the port to use. #server.port: 5601 # Specifies the address to which the… --- ## [{"SystemTotalCpuProvider"} Failed instantiating PerformanceCounter](https://discuss.elastic.co/t/systemtotalcpuprovider-failed-instantiating-performancecounter/287298)
**Author:** [@joakim.aberg](https://discuss.elastic.co/u/joakim.aberg)\ **Replies:** 0\ **Last updated:** [October 21, 2021, 10:06am UTC](https://discuss.elastic.co/t/systemtotalcpuprovider-failed-instantiating-performancecounter/287298 "2021-10-21T10:06:11Z")
We get the following error on both our Staging and Production evironment. log.level:Error message:{"SystemTotalCpuProvider"} Failed instantiating PerformanceCounter - please make sure the current user has permissions to … --- ## [Get key field mapping of flatten field](https://discuss.elastic.co/t/get-key-field-mapping-of-flatten-field/287783)
**Author:** [@ewolfman](https://discuss.elastic.co/u/ewolfman)\ **Replies:** 0\ **Last updated:** [October 27, 2021, 10:01am UTC](https://discuss.elastic.co/t/get-key-field-mapping-of-flatten-field/287783 "2021-10-27T10:01:20Z")
Hi, I have a use case for storing a map of key-value items. The keys are not likely to vary from one document to another, but I do not know them in advance. Therefore I am using dynamic\_templates in order to index them.… --- ## [Closing all indices before system recovery](https://discuss.elastic.co/t/closing-all-indices-before-system-recovery/287163)
**Author:** [@Waxman](https://discuss.elastic.co/u/Waxman)\ **Replies:** 3\ **Last updated:** [October 27, 2021, 9:42am UTC](https://discuss.elastic.co/t/closing-all-indices-before-system-recovery/287163 "2021-10-27T09:42:03Z")
Hi All, I'd like to ask if there is a possibility to recover whole cluster without closing indices ? In Kibana 7.11.2-\> stack management -\> snapshot and restore -\>when trying restore "All data streams and indices, incl… --- ## [Frozen tiers : How to size local cache?](https://discuss.elastic.co/t/frozen-tiers-how-to-size-local-cache/287704)
**Author:** [@Travis](https://discuss.elastic.co/u/Travis)\ **Replies:** 4\ **Last updated:** [October 27, 2021, 9:39am UTC](https://discuss.elastic.co/t/frozen-tiers-how-to-size-local-cache/287704 "2021-10-27T09:39:58Z")
Hello ! Is there any RAM/Disk ratio to size the local cache for frozen tiers ? I found ratios for Hot/Warm/Cold tiers but nothing for frozen tiers Thanks --- ## [Suricata logs logstash filter](https://discuss.elastic.co/t/suricata-logs-logstash-filter/287779)
**Author:** [@algira37](https://discuss.elastic.co/u/algira37)\ **Replies:** 0\ **Last updated:** [October 27, 2021, 9:29am UTC](https://discuss.elastic.co/t/suricata-logs-logstash-filter/287779 "2021-10-27T09:29:55Z")
Hello guys, Filbeat shipping eve.json to logstash and logstash dynamically maps fields and sends to Elasticsearch. Unfortunately, these logs are too much, lots of useless information for my project so I would like to c… --- ## [20 seconds downtime when swapping alias](https://discuss.elastic.co/t/20-seconds-downtime-when-swapping-alias/287739)
**Author:** [@morland96](https://discuss.elastic.co/u/morland96)\ **Replies:** 7\ **Last updated:** [October 27, 2021, 9:14am UTC](https://discuss.elastic.co/t/20-seconds-downtime-when-swapping-alias/287739 "2021-10-27T09:14:11Z")
Hi all. I have a service requires zero down time. Since the data need to be versionized, our pipeline will ingest data every day into a new index. After the new index is "green" and able to search, we simply swap the ali… --- ## [ELK (Docker-compose) integration with Iciniga2](https://discuss.elastic.co/t/elk-docker-compose-integration-with-iciniga2/287694)
**Author:** [@mohammed.sabil](https://discuss.elastic.co/u/mohammed.sabil)\ **Replies:** 2\ **Last updated:** [October 27, 2021, 9:12am UTC](https://discuss.elastic.co/t/elk-docker-compose-integration-with-iciniga2/287694 "2021-10-27T09:12:33Z")
Hello Team, I have ELK stack running using docker-compose on host and I have used Filebeat (Container again) on another instance to ship the application logs to ELK. Now I need to integrate ELK with Incinga2. Any kind… --- ## [Elasticsearch output pipeline error with api\_key](https://discuss.elastic.co/t/elasticsearch-output-pipeline-error-with-api-key/287618)
**Author:** [@Wonder\_Garance](https://discuss.elastic.co/u/Wonder_Garance)\ **Replies:** 3\ **Last updated:** [October 27, 2021, 8:49am UTC](https://discuss.elastic.co/t/elasticsearch-output-pipeline-error-with-api-key/287618 "2021-10-27T08:49:09Z")
Hello, I created a Logstash config to send files on index of Elasticsearch 7.15.1, on the same server. I got this error \[ERROR\]\[logstash.javapipeline \]\[main\] Pipeline error {:pipeline\_id=\>"main", :exception=\>#\ **Author:** [@Giovanni\_Di\_Lembo](https://discuss.elastic.co/u/Giovanni_Di_Lembo)\ **Replies:** 2\ **Last updated:** [October 27, 2021, 6:03am UTC](https://discuss.elastic.co/t/delete-async-on-response-of-update-async-does-not-work/287724 "2021-10-27T06:03:29Z") Hi all and sorry for my poor english I'm calling an updateAsync with an action listener bind. So I 'm calling a delete Async onResponse AND onFailure of previous async update but delete async is not excecuted correctly… --- ## [Does filebeat support azure service principal](https://discuss.elastic.co/t/does-filebeat-support-azure-service-principal/287771)
**Author:** [@heimo](https://discuss.elastic.co/u/heimo)\ **Replies:** 0\ **Last updated:** [October 27, 2021, 8:07am UTC](https://discuss.elastic.co/t/does-filebeat-support-azure-service-principal/287771 "2021-10-27T08:07:50Z")
Does filebeat support azure service principal , to replace service account to access Azure AKS(Kubernetes) , to get metadata of the kubernetes? --- ## [How to specify the time range with \`search API\`?](https://discuss.elastic.co/t/how-to-specify-the-time-range-with-search-api/287769)
**Author:** [@KeithTt](https://discuss.elastic.co/u/KeithTt)\ **Replies:** 0\ **Last updated:** [October 27, 2021, 7:56am UTC](https://discuss.elastic.co/t/how-to-specify-the-time-range-with-search-api/287769 "2021-10-27T07:56:40Z")
The request body like this: "range": { "time\_iso8601": { "gte": now.shift(days=-1).floor('day').timestamp() \* 1000, "lte": now.shift(days=-1).ceil('day').timestamp() \* 1000, "format": "epoch\_… --- ## [Elasticsearch service deployed to EKS by Jenkins suddenly fails health check](https://discuss.elastic.co/t/elasticsearch-service-deployed-to-eks-by-jenkins-suddenly-fails-health-check/287766)
**Author:** [@alanwgmendel](https://discuss.elastic.co/u/alanwgmendel)\ **Replies:** 1\ **Last updated:** [October 27, 2021, 7:43am UTC](https://discuss.elastic.co/t/elasticsearch-service-deployed-to-eks-by-jenkins-suddenly-fails-health-check/287766 "2021-10-27T07:43:50Z")
Hello I have an application that is deployed via Jenkins to an EKS cluster. One of the application's services is an Elasticsearch service. After having successfully run it over a dozen times this year, the deployment ha… --- ## [How to integrate one kibana with multiple elatsicsearch](https://discuss.elastic.co/t/how-to-integrate-one-kibana-with-multiple-elatsicsearch/287764)
**Author:** [@Radhikag815](https://discuss.elastic.co/u/Radhikag815)\ **Replies:** 1\ **Last updated:** [October 27, 2021, 7:34am UTC](https://discuss.elastic.co/t/how-to-integrate-one-kibana-with-multiple-elatsicsearch/287764 "2021-10-27T07:34:39Z")
I need to integrate multiple elaticsearch with one kibana dashboard so whenever I search for query it will search in both the elastic and display result in one console. Please help me I am new in this ELK. --- ## [Parameter Errors When Getting Snapshots](https://discuss.elastic.co/t/parameter-errors-when-getting-snapshots/287761)
**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 1\ **Last updated:** [October 27, 2021, 7:27am UTC](https://discuss.elastic.co/t/parameter-errors-when-getting-snapshots/287761 "2021-10-27T07:27:56Z")
Hi, I'm trying to get a list of snapshots using the size and sort parameters: GET /\_snapshot/\/snapshots-\*?size=2&sort=name But get this error: { "error" : { "root\_cause" : \[ { "type" : … --- ## [Rejections in Thread\_Pool v6.2.4](https://discuss.elastic.co/t/rejections-in-thread-pool-v6-2-4/287689)
**Author:** [@CCCowboy](https://discuss.elastic.co/u/CCCowboy)\ **Replies:** 4\ **Last updated:** [October 27, 2021, 7:02am UTC](https://discuss.elastic.co/t/rejections-in-thread-pool-v6-2-4/287689 "2021-10-27T07:02:42Z")
I have a problem with a node (different each time) that stops responding. When checking \_cat/thread\_pool in "hanging mode", the GET queue is full and have started rejected requests. The log file, though, indicates that … --- ## [EOL / End of life and support topic](https://discuss.elastic.co/t/eol-end-of-life-and-support-topic/287756)
**Author:** [@smm](https://discuss.elastic.co/u/smm)\ **Replies:** 2\ **Last updated:** [October 27, 2021, 6:54am UTC](https://discuss.elastic.co/t/eol-end-of-life-and-support-topic/287756 "2021-10-27T06:54:45Z")
Dear Elastic Team, I have a gold support. My 7.8 environment reaches EOL in the mid of December. Does it mean I cannot open issues anymore in case of need after that day? By the way: I am planning the follwoing upgrad… --- ## [How to find which IP most requests to elasticsearch come from?](https://discuss.elastic.co/t/how-to-find-which-ip-most-requests-to-elasticsearch-come-from/287538)
**Author:** [@Busra\_Duygu](https://discuss.elastic.co/u/Busra_Duygu)\ **Replies:** 7\ **Last updated:** [October 27, 2021, 6:41am UTC](https://discuss.elastic.co/t/how-to-find-which-ip-most-requests-to-elasticsearch-come-from/287538 "2021-10-27T06:41:46Z")
Hello friends, my Elasticsearch server is constantly receiving requests from other IPs. Is it possible to find out from which IP the most requests are received? Any ideas will help me thank you in advance. --- ## [Automatically Applying Existing ILM Policy to Newly Created Indicies](https://discuss.elastic.co/t/automatically-applying-existing-ilm-policy-to-newly-created-indicies/287749)
**Author:** [@rajsuper2021](https://discuss.elastic.co/u/rajsuper2021)\ **Replies:** 1\ **Last updated:** [October 27, 2021, 5:38am UTC](https://discuss.elastic.co/t/automatically-applying-existing-ilm-policy-to-newly-created-indicies/287749 "2021-10-27T05:38:55Z")
I have indicies that daily created by logstash in Elasticsearch called "logstash-\*" I have a ILM policy to clean up indicies that are 10 days old. How do I ensure newly created indices have the ILM Policy automatically… --- ## [How to add a timestamp from the previous line to the current line](https://discuss.elastic.co/t/how-to-add-a-timestamp-from-the-previous-line-to-the-current-line/287600)
**Author:** [@anoopahamad](https://discuss.elastic.co/u/anoopahamad)\ **Replies:** 6\ **Last updated:** [October 27, 2021, 5:18am UTC](https://discuss.elastic.co/t/how-to-add-a-timestamp-from-the-previous-line-to-the-current-line/287600 "2021-10-27T05:18:32Z")
In my log file, some of the lines don't have a timestamp. I want to assign the previous line's timestamp to the lines that don't have the timestamp. I tried "memorize" but that's giving some errors. Is there a way we… --- ## [Agg results can't support long words](https://discuss.elastic.co/t/agg-results-cant-support-long-words/286590)
**Author:** [@carpeDiem](https://discuss.elastic.co/u/carpeDiem)\ **Replies:** 4\ **Last updated:** [October 27, 2021, 3:41am UTC](https://discuss.elastic.co/t/agg-results-cant-support-long-words/286590 "2021-10-27T03:41:34Z")
Hello experts, I'm currently trying to excute aggregate request,but I can't get some results which the field value is a little long,and I can't find any information for the length of field value to aggregate on guide,th… --- ## [\[DOCS\] Where can I find the newest 7.15 guide docs zh-CN versions?](https://discuss.elastic.co/t/docs-where-can-i-find-the-newest-7-15-guide-docs-zh-cn-versions/287662)
**Author:** [@xiongjiamu](https://discuss.elastic.co/u/xiongjiamu)\ **Replies:** 3\ **Last updated:** [October 27, 2021, 2:04am UTC](https://discuss.elastic.co/t/docs-where-can-i-find-the-newest-7-15-guide-docs-zh-cn-versions/287662 "2021-10-27T02:04:22Z")
HI there I am a beginner for Elasticsearch, and it is not very convenient for me to read the guide book with English. I't very nice that you have gave us a Chinese guide book here https://www.elastic.co/guide/cn/elasti… --- ## [Suricata integration parsing issues](https://discuss.elastic.co/t/suricata-integration-parsing-issues/284954)
**Author:** [@hilt86](https://discuss.elastic.co/u/hilt86)\ **Replies:** 3\ **Last updated:** [October 27, 2021, 2:02am UTC](https://discuss.elastic.co/t/suricata-integration-parsing-issues/284954 "2021-10-27T02:02:07Z")
I'm running 7.14.1 with an Elastic agent trying to pick up eve.json files using the suricata integration. Somewhere along the line it is not able to correctly parse the events. Here is the error I'm getting : {\\"type\\… [Previous page](https://discuss.elastic.co/latest.md?page=1413) [Next page](https://discuss.elastic.co/latest.md?page=1415)