# Latest **URL:** https://discuss.elastic.co/latest.md?page=1431 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1432 --- ## [PARSE Logs having pip saperator](https://discuss.elastic.co/t/parse-logs-having-pip-saperator/286881)
**Author:** [@Nikparab](https://discuss.elastic.co/u/Nikparab)\ **Replies:** 7\ **Last updated:** [October 16, 2021, 3:33am UTC](https://discuss.elastic.co/t/parse-logs-having-pip-saperator/286881 "2021-10-16T03:33:50Z")
Hi I am having the log format as below. 2021-10-16 00:14:14|http-nio-2222-exec-1|DEBUG|c.v.a.ultimatevault.web.TraceFilter|01AD08F98FB24AB7A639383F44613AE4|Processing request:- id: 01AD08F98FB24AB7A639383F44613AE4 metho… --- ## [Fetch additional info for each Elasticsearch](https://discuss.elastic.co/t/fetch-additional-info-for-each-elasticsearch/286880)
**Author:** [@pedrorabbi](https://discuss.elastic.co/u/pedrorabbi)\ **Replies:** 2\ **Last updated:** [October 16, 2021, 3:31am UTC](https://discuss.elastic.co/t/fetch-additional-info-for-each-elasticsearch/286880 "2021-10-16T03:31:12Z")
So, I have 2 indexes in my Elasticsearch server. I need to gather the results from the first index, and for each result I need to gather info from the second index. How to do that? Tried the foreach processor, but no lu… --- ## [Help with window sort in vega](https://discuss.elastic.co/t/help-with-window-sort-in-vega/286783)
**Author:** [@nsimi](https://discuss.elastic.co/u/nsimi)\ **Replies:** 3\ **Last updated:** [October 15, 2021, 10:04pm UTC](https://discuss.elastic.co/t/help-with-window-sort-in-vega/286783 "2021-10-15T22:04:43Z")
Hello All, I am trying to get a window transform to sort data, and am having some issues, either my expectations are wrong or I am just doing something wrong: { "$schema": "https://vega.github.io/schema/vega/v5.json"… --- ## [How to disable search button when no text is entered on search input field and enable when text is entered](https://discuss.elastic.co/t/how-to-disable-search-button-when-no-text-is-entered-on-search-input-field-and-enable-when-text-is-entered/286869)
**Author:** [@pradeepjanga](https://discuss.elastic.co/u/pradeepjanga)\ **Replies:** 2\ **Last updated:** [October 15, 2021, 9:02pm UTC](https://discuss.elastic.co/t/how-to-disable-search-button-when-no-text-is-entered-on-search-input-field-and-enable-when-text-is-entered/286869 "2021-10-15T21:02:51Z")
am using the below code. but unable to disable it when search term is having data. how to achieve this ? \ ( \<\> \
**Author:** [@Rakesh\_B](https://discuss.elastic.co/u/Rakesh_B)\ **Replies:** 3\ **Last updated:** [October 15, 2021, 8:26pm UTC](https://discuss.elastic.co/t/enable-keyword-fields-for-specific-fields-only/286866 "2021-10-15T20:26:16Z")
Hi, Elasticsearch Version: 7.15.0 Logstash Version: 7.15.0 We have a ton of fields for our index and we get new fields frequently so, we cannot disable dynamic mapping. Dynamic mapping creates .keyword fields for a ma… --- ## [How to get the value of an array using ctx.payload](https://discuss.elastic.co/t/how-to-get-the-value-of-an-array-using-ctx-payload/286864)
**Author:** [@StephaneRodier](https://discuss.elastic.co/u/StephaneRodier)\ **Replies:** 1\ **Last updated:** [October 15, 2021, 8:19pm UTC](https://discuss.elastic.co/t/how-to-get-the-value-of-an-array-using-ctx-payload/286864 "2021-10-15T20:19:27Z")
Hello, Let's say I have the results below in an array of 2: "hits": { "hits": \[ { "\_index": "blah-2021.10.01-000003", "\_type": "\_doc", "\_source": … --- ## [S3 - setting and verifying repo issue](https://discuss.elastic.co/t/s3-setting-and-verifying-repo-issue/286661)
**Author:** [@vee](https://discuss.elastic.co/u/vee)\ **Replies:** 30\ **Last updated:** [October 15, 2021, 7:42pm UTC](https://discuss.elastic.co/t/s3-setting-and-verifying-repo-issue/286661 "2021-10-15T19:42:27Z")
Trying our in-house S3 compatible storage device as frozen tier, but seeing errors when verifying the repository. Got a confirmation from elastic support that the one we have is fully supported by S3 protocol. Here are … --- ## [Filter computer object password changes](https://discuss.elastic.co/t/filter-computer-object-password-changes/284651)
**Author:** [@WilGG](https://discuss.elastic.co/u/WilGG)\ **Replies:** 8\ **Last updated:** [October 15, 2021, 6:37pm UTC](https://discuss.elastic.co/t/filter-computer-object-password-changes/284651 "2021-10-15T18:37:13Z")
Good Afternoon Everyone, We are been overwhelmed by computer objects password changes. Does anyone know how to filter this events so we do not skip actual user object password change events ? Thank you! --- ## [Logstash open file descriptors only increases](https://discuss.elastic.co/t/logstash-open-file-descriptors-only-increases/285571)
**Author:** [@N1k-3l](https://discuss.elastic.co/u/N1k-3l)\ **Replies:** 2\ **Last updated:** [October 15, 2021, 5:58pm UTC](https://discuss.elastic.co/t/logstash-open-file-descriptors-only-increases/285571 "2021-10-15T17:58:09Z")
Hello. I have a problem with logstash (logstash 7.12.1) file descriptors only increases. I set limits to 50000, but on another host, with the same config i have: may be somebody knows about this? :blush: --- ## [Certificate error on database update](https://discuss.elastic.co/t/certificate-error-on-database-update/286550)
**Author:** [@rugenl](https://discuss.elastic.co/u/rugenl)\ **Replies:** 5\ **Last updated:** [October 15, 2021, 5:51pm UTC](https://discuss.elastic.co/t/certificate-error-on-database-update/286550 "2021-10-15T17:51:04Z")
After upgrading to logstash 7.14.1, I'm getting this error daily in the logstash-plain.log: \[ERROR\]\[logstash.filters.geoip.databasemanager\] certificate verify failed {:cause=\>#\ **Author:** [@Aliaksandr](https://discuss.elastic.co/u/Aliaksandr)\ **Replies:** 13\ **Last updated:** [October 15, 2021, 5:35pm UTC](https://discuss.elastic.co/t/topic/286603 "2021-10-15T17:35:22Z") Добрый день. Имеется около 120 млн объектов, которые нужно проиндексировать. Отправляю объекты на реиндекс предварительно отсортировав (по полю id типа guid), реиндекс занимает около 8 часов. Отправляю эти же объеты н… --- ## [Parse XML log with xml filter and grok fiter](https://discuss.elastic.co/t/parse-xml-log-with-xml-filter-and-grok-fiter/286712)
**Author:** [@Catalina\_Boteanu](https://discuss.elastic.co/u/Catalina_Boteanu)\ **Replies:** 1\ **Last updated:** [October 15, 2021, 5:34pm UTC](https://discuss.elastic.co/t/parse-xml-log-with-xml-filter-and-grok-fiter/286712 "2021-10-15T17:34:46Z")
Hello. I am currently trying to apply some filters to different logs in Logstash. I have a log that has a string in the beginning and then it is in xml format. I was able to take out the xml from the log with a regex. No… --- ## [Logstash pipeline multiple if statements](https://discuss.elastic.co/t/logstash-pipeline-multiple-if-statements/286737)
**Author:** [@Robin020](https://discuss.elastic.co/u/Robin020)\ **Replies:** 1\ **Last updated:** [October 15, 2021, 5:02pm UTC](https://discuss.elastic.co/t/logstash-pipeline-multiple-if-statements/286737 "2021-10-15T17:02:58Z")
Hello, I am trying create multiple if statements in the filter section in my pipeline config but I have no success with that. This works (with one if statement) filter { json { source =\> "message" } split … --- ## [Can you reference a dynamic variable in the grok filter?](https://discuss.elastic.co/t/can-you-reference-a-dynamic-variable-in-the-grok-filter/286838)
**Author:** [@Cibot](https://discuss.elastic.co/u/Cibot)\ **Replies:** 2\ **Last updated:** [October 15, 2021, 4:57pm UTC](https://discuss.elastic.co/t/can-you-reference-a-dynamic-variable-in-the-grok-filter/286838 "2021-10-15T16:57:52Z")
I have been trying to split up the input of a script from execbeat. So far everything has been going smooth. I have input of similar fashion. rpm-2109130090009900.x86-64 Thu 2019 ... and so on. So basically an inform… --- ## [BOOSTS not always works](https://discuss.elastic.co/t/boosts-not-always-works/286800)
**Author:** [@PabloUrbano](https://discuss.elastic.co/u/PabloUrbano)\ **Replies:** 1\ **Last updated:** [October 15, 2021, 4:57pm UTC](https://discuss.elastic.co/t/boosts-not-always-works/286800 "2021-10-15T16:57:49Z")
Hello, We are using relevance tuning to enhance various search fields. We have a text type field, made up of several arrays of charts. In this case, we can enhance or reduce the weight of the search when one of the elem… --- ## [Parsing nested json to flat structure](https://discuss.elastic.co/t/parsing-nested-json-to-flat-structure/286790)
**Author:** [@IsAa](https://discuss.elastic.co/u/IsAa)\ **Replies:** 1\ **Last updated:** [October 15, 2021, 4:50pm UTC](https://discuss.elastic.co/t/parsing-nested-json-to-flat-structure/286790 "2021-10-15T16:50:36Z")
Hi Team, I was looking to parse my nested json structure using json filter. I have looked at some of the posts and tried their solution. My question, is it possible to make this structure completely flat, So if my log… --- ## [How can I filter a Vega data table to unique values of a field?](https://discuss.elastic.co/t/how-can-i-filter-a-vega-data-table-to-unique-values-of-a-field/286761)
**Author:** [@nsimi](https://discuss.elastic.co/u/nsimi)\ **Replies:** 2\ **Last updated:** [October 15, 2021, 4:26pm UTC](https://discuss.elastic.co/t/how-can-i-filter-a-vega-data-table-to-unique-values-of-a-field/286761 "2021-10-15T16:26:17Z")
Hello All, I have data that I am querying, and I want to be able to filter to unique values of a field on the data in the table, can I do that? If so can someone explain to me how? Thank you! --- ## [Кластер высокой доступности из 4 ElasticSearch, 4 Logstash, 1 Kibana и 1 Grafana](https://discuss.elastic.co/t/4-elasticsearch-4-logstash-1-kibana-1-grafana/286515)
**Author:** [@Areopagit](https://discuss.elastic.co/u/Areopagit)\ **Replies:** 3\ **Last updated:** [October 15, 2021, 3:50pm UTC](https://discuss.elastic.co/t/4-elasticsearch-4-logstash-1-kibana-1-grafana/286515 "2021-10-15T15:50:19Z")
Добрый день. Собрал кластер (для сбора логов всех систем организации) из вышеперечисленного (четыре ноды Elasticsearch, четыре ноды Logstash, одна нода Kibana и одна нода Grafana) на одном высокопроизводительном физичес… --- ## [401 Unauthorised error heartbeat](https://discuss.elastic.co/t/401-unauthorised-error-heartbeat/286056)
**Author:** [@Spoo](https://discuss.elastic.co/u/Spoo)\ **Replies:** 1\ **Last updated:** [October 15, 2021, 3:22pm UTC](https://discuss.elastic.co/t/401-unauthorised-error-heartbeat/286056 "2021-10-15T15:22:14Z")
Hi I have a question about Elasticsearch and kibana setup on my work account So I have setup elk stack on an AWS EC2 instance and an other ubuntu web server. I am working on self managed not cloud based. I have insta… --- ## [Watcher - how to set the doc\_values condition for a query with a filter terms aggregation. (Detect lack of logs per hostname - use case)](https://discuss.elastic.co/t/watcher-how-to-set-the-doc-values-condition-for-a-query-with-a-filter-terms-aggregation-detect-lack-of-logs-per-hostname-use-case/286225)
**Author:** [@Manu\_BS](https://discuss.elastic.co/u/Manu_BS)\ **Replies:** 2\ **Last updated:** [October 15, 2021, 3:19pm UTC](https://discuss.elastic.co/t/watcher-how-to-set-the-doc-values-condition-for-a-query-with-a-filter-terms-aggregation-detect-lack-of-logs-per-hostname-use-case/286225 "2021-10-15T15:19:44Z")
Hello friends, I wanted to create a few watchers that help us to detect when we are not receiving specific logs that are crucial for the monitoring chain. It means, to not be receiving logs from specific servers. For … --- ## [Assigning Multiple Roles to one Kibana Space](https://discuss.elastic.co/t/assigning-multiple-roles-to-one-kibana-space/285812)
**Author:** [@pkward](https://discuss.elastic.co/u/pkward)\ **Replies:** 1\ **Last updated:** [October 15, 2021, 3:14pm UTC](https://discuss.elastic.co/t/assigning-multiple-roles-to-one-kibana-space/285812 "2021-10-15T15:14:18Z")
Hello, I want to assign multiple roles to one space, but I also want one role to be able to view specific dashboards or even if they have access to the dashboard to only see data that I give them access to. For example,… --- ## [Trying to Compare two timestamps to calculate ingestion speed](https://discuss.elastic.co/t/trying-to-compare-two-timestamps-to-calculate-ingestion-speed/286823)
**Author:** [@jamesm1](https://discuss.elastic.co/u/jamesm1)\ **Replies:** 2\ **Last updated:** [October 15, 2021, 2:58pm UTC](https://discuss.elastic.co/t/trying-to-compare-two-timestamps-to-calculate-ingestion-speed/286823 "2021-10-15T14:58:52Z")
Hello! I am in the process of attempting to create a column which tells me the difference between the time the log was created in elastic (so the ingestion time stamp) and the timestamp against my IIS log(so the iis.acc… --- ## [Customize Lens's graphs](https://discuss.elastic.co/t/customize-lenss-graphs/286702)
**Author:** [@Kadhem](https://discuss.elastic.co/u/Kadhem)\ **Replies:** 9\ **Last updated:** [October 15, 2021, 2:36pm UTC](https://discuss.elastic.co/t/customize-lenss-graphs/286702 "2021-10-15T14:36:12Z")
Hi, i'm using Lens charts in Kibana. i want to display a graph where Y axis is the timestamp and X axis is the values of My field . But Lens enable me to use a simple Function "Value" is there any solution? I don't want… --- ## [How to filter out a specific data in a panel?](https://discuss.elastic.co/t/how-to-filter-out-a-specific-data-in-a-panel/286799)
**Author:** [@elasticfran](https://discuss.elastic.co/u/elasticfran)\ **Replies:** 3\ **Last updated:** [October 15, 2021, 2:26pm UTC](https://discuss.elastic.co/t/how-to-filter-out-a-specific-data-in-a-panel/286799 "2021-10-15T14:26:55Z")
Hey there! Have a question about kibana / dashboard / panel. How can i exclude a given information in a panel? Say i have a graph reporting cities my customers are from, how can i exclude one of the cities? Best! --- ## [Very slow aggregate query](https://discuss.elastic.co/t/very-slow-aggregate-query/286371)
**Author:** [@Giovanni\_Di\_Lembo](https://discuss.elastic.co/u/Giovanni_Di_Lembo)\ **Replies:** 15\ **Last updated:** [October 15, 2021, 2:13pm UTC](https://discuss.elastic.co/t/very-slow-aggregate-query/286371 "2021-10-15T14:13:15Z")
Hi all I have 200 Gb data in Elasticsearch and when I excecute an aggregate query it takes 8 seconds. My client goes in timeout. Actually my query is like that: { "aggs": { "filtered": { "filter": { … --- ## [Logstash creates a 'page.xxx' file, 0KB in size, stopping all log ingestion](https://discuss.elastic.co/t/logstash-creates-a-page-xxx-file-0kb-in-size-stopping-all-log-ingestion/286849)
**Author:** [@jtocher](https://discuss.elastic.co/u/jtocher)\ **Replies:** 0\ **Last updated:** [October 15, 2021, 2:09pm UTC](https://discuss.elastic.co/t/logstash-creates-a-page-xxx-file-0kb-in-size-stopping-all-log-ingestion/286849 "2021-10-15T14:09:26Z")
We're using the Elastic Stack to centralize logs across multiple systems. We're using Windows, and are currently on version 7.10. (Upgrading to 7.15 in the near future.) Occasionally all of our log ingestion halts comp… --- ## [Test Suite error - time.Local vs time.UTC?](https://discuss.elastic.co/t/test-suite-error-time-local-vs-time-utc/286735)
**Author:** [@hinchliff](https://discuss.elastic.co/u/hinchliff)\ **Replies:** 1\ **Last updated:** [October 15, 2021, 2:04pm UTC](https://discuss.elastic.co/t/test-suite-error-time-local-vs-time-utc/286735 "2021-10-15T14:04:11Z")
Seeing some failures for make testsuite for libbeat, that seem to be Timezone related. (My computer is in US Eastern.) command \[go test -cover -coverprofile /tmp/gotestcover-1560318489 github.com/elastic/beats/v7/libbe… --- ## [Strategy for automatically importing a kibana backup JSON file](https://discuss.elastic.co/t/strategy-for-automatically-importing-a-kibana-backup-json-file/286829)
**Author:** [@ramom01](https://discuss.elastic.co/u/ramom01)\ **Replies:** 1\ **Last updated:** [October 15, 2021, 1:53pm UTC](https://discuss.elastic.co/t/strategy-for-automatically-importing-a-kibana-backup-json-file/286829 "2021-10-15T13:53:01Z")
I have an instance of elastic + kibana in version 7.13.1 with docker compose, I have some kibana backup files with some dashboards, and I was wondering if there is a strategy to automatically import these backups when I … --- ## [Winlogbeat modules and file ingestion](https://discuss.elastic.co/t/winlogbeat-modules-and-file-ingestion/286845)
**Author:** [@jane](https://discuss.elastic.co/u/jane)\ **Replies:** 0\ **Last updated:** [October 15, 2021, 1:46pm UTC](https://discuss.elastic.co/t/winlogbeat-modules-and-file-ingestion/286845 "2021-10-15T13:46:34Z")
Hey, Is it possible to apply Security, Sysmon and Powershell modules in winlogbeat.yml if I'm ingesting a file? I'm trying something like this, but it doesn't work :confused: winlogbeat.event\_logs: - name: "C:/LOGS/so… --- ## [StackOverflowError triggering cluster crash](https://discuss.elastic.co/t/stackoverflowerror-triggering-cluster-crash/285550)
**Author:** [@bhargava\_kovi](https://discuss.elastic.co/u/bhargava_kovi)\ **Replies:** 7\ **Last updated:** [October 15, 2021, 1:43pm UTC](https://discuss.elastic.co/t/stackoverflowerror-triggering-cluster-crash/285550 "2021-10-15T13:43:36Z")
The cluster was suddenly crashed mentioning the below stack trace. we are using version ES 7.10.1. I tried to look for a similar issue on StackOverflowError in Lucene but couldnt find much on it. Can anyone help to un… [Previous page](https://discuss.elastic.co/latest.md?page=1430) [Next page](https://discuss.elastic.co/latest.md?page=1432)