# Latest **URL:** https://discuss.elastic.co/latest.md?page=1449 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1450 --- ## [Parsing data from multiple application servers through logstash](https://discuss.elastic.co/t/parsing-data-from-multiple-application-servers-through-logstash/285069)
**Author:** [@prat](https://discuss.elastic.co/u/prat)\ **Replies:** 10\ **Last updated:** [October 4, 2021, 3:27pm UTC](https://discuss.elastic.co/t/parsing-data-from-multiple-application-servers-through-logstash/285069 "2021-10-04T15:27:56Z")
Hi Team, I have application running on 2 servers and application logs are getting logged on both the servers, so i want to parse logs from both servers. filebeat is installed on two application servers, logstash is in… --- ## [Grok pattern issue](https://discuss.elastic.co/t/grok-pattern-issue/284247)
**Author:** [@Divya\_Bansal](https://discuss.elastic.co/u/Divya_Bansal)\ **Replies:** 1\ **Last updated:** [October 4, 2021, 3:24pm UTC](https://discuss.elastic.co/t/grok-pattern-issue/284247 "2021-10-04T15:24:51Z")
I have two logs: one with loglevel field and one without it as mentioned below. can anyone help me with thescript processing both type of logs from single pattern. the sample logs are:- 2021-09-13T23:58:22.676 \[\] loca… --- ## [Ошибка при создание бэкапа](https://discuss.elastic.co/t/topic/285693)
**Author:** [@Uporaba](https://discuss.elastic.co/u/Uporaba)\ **Replies:** 6\ **Last updated:** [October 4, 2021, 3:18pm UTC](https://discuss.elastic.co/t/topic/285693 "2021-10-04T15:18:58Z")
Добрый вечер. Пытаюсь сделать бэкап. По официальной инструкции ввожу: curl -X PUT "localhost:9200/\_snapshot/graylog?pretty" -H 'Content-Type: application/json' -d' { "type": "fs", "settings": { "location": "/var/backup/… --- ## [Need help in understanding query search of elastic search with sub string search](https://discuss.elastic.co/t/need-help-in-understanding-query-search-of-elastic-search-with-sub-string-search/285833)
**Author:** [@S\_basu](https://discuss.elastic.co/u/S_basu)\ **Replies:** 0\ **Last updated:** [October 4, 2021, 2:52pm UTC](https://discuss.elastic.co/t/need-help-in-understanding-query-search-of-elastic-search-with-sub-string-search/285833 "2021-10-04T14:52:32Z")
Hi All, We have created an index with analyzer which uses "keyword" as tokenizer. We have values such in a field as role\_number which may or may not contain any special character such as - or \_, for examplecontains data… --- ## [Endpoint Security without using Fleet](https://discuss.elastic.co/t/endpoint-security-without-using-fleet/281802)
**Author:** [@KevSex](https://discuss.elastic.co/u/KevSex)\ **Replies:** 9\ **Last updated:** [October 4, 2021, 2:52pm UTC](https://discuss.elastic.co/t/endpoint-security-without-using-fleet/281802 "2021-10-04T14:52:30Z")
Hi, Is it possible to use the Elastic Endpoint Security integration without utilising Fleet? We have a use case to protect endpoints with the Endpoint Security that has restricted access to the Elastic stack. Ideally,… --- ## [Is it possible to change the repo backing a searchable snapshot without interruption?](https://discuss.elastic.co/t/is-it-possible-to-change-the-repo-backing-a-searchable-snapshot-without-interruption/285832)
**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Replies:** 0\ **Last updated:** [October 4, 2021, 2:49pm UTC](https://discuss.elastic.co/t/is-it-possible-to-change-the-repo-backing-a-searchable-snapshot-without-interruption/285832 "2021-10-04T14:49:46Z")
Hi All, I'm trying to find out if it is possible to change the backing repository of a searchable snapshot? Looking at the docs, it doesn't appear to mention this. Example of what I'm trying to do: Have an index, ind… --- ## [API Bug? Error enabling rule: could not create API key - Unsupported scheme \\"ApiKey\\" for granting API Key](https://discuss.elastic.co/t/api-bug-error-enabling-rule-could-not-create-api-key-unsupported-scheme-apikey-for-granting-api-key/285407)
**Author:** [@jrykowski-huron](https://discuss.elastic.co/u/jrykowski-huron)\ **Replies:** 2\ **Last updated:** [October 4, 2021, 2:48pm UTC](https://discuss.elastic.co/t/api-bug-error-enabling-rule-could-not-create-api-key-unsupported-scheme-apikey-for-granting-api-key/285407 "2021-10-04T14:48:08Z")
Authentication type is ApiKey. Version: 7.14.1 When rule is already Enabled, there is no trouble calling the API endpoint for \_enable. Returns Status Code 204. But if rule is actually Disabled (and therefore need to … --- ## [Customize Kibana URL and DNS](https://discuss.elastic.co/t/customize-kibana-url-and-dns/284744)
**Author:** [@netjammr](https://discuss.elastic.co/u/netjammr)\ **Replies:** 5\ **Last updated:** [October 4, 2021, 2:47pm UTC](https://discuss.elastic.co/t/customize-kibana-url-and-dns/284744 "2021-10-04T14:47:18Z")
I am looking at options for customizing the Kibana URL for an ECE deployment. As an example, if under Platform \> Settings the "Deployments domain name" is "myece.mydomain.com", I understand that the Kibana URL would be s… --- ## [Work with nested fields in logstash elasticsearch filter](https://discuss.elastic.co/t/work-with-nested-fields-in-logstash-elasticsearch-filter/285828)
**Author:** [@rodri.gz](https://discuss.elastic.co/u/rodri.gz)\ **Replies:** 1\ **Last updated:** [October 4, 2021, 2:35pm UTC](https://discuss.elastic.co/t/work-with-nested-fields-in-logstash-elasticsearch-filter/285828 "2021-10-04T14:35:42Z")
hello! i want to enrich my data with the elastic filter . i tried to keep de host.hostname fields of metricbeat without success with this: elasticsearch { hosts =\> "https://xxxx:9200" index =\> "metricbeat" … --- ## [Kuromojiユーザ辞書に定義済みの単語で構成された複合語の形態素解析について](https://discuss.elastic.co/t/kuromoji/285149)
**Author:** [@hemi-n](https://discuss.elastic.co/u/hemi-n)\ **Replies:** 2\ **Last updated:** [October 4, 2021, 2:13pm UTC](https://discuss.elastic.co/t/kuromoji/285149 "2021-10-04T14:13:39Z")
Elasticsearch Version: 5.6.14 Kuromojiを使って形態素解析を行っているのですが、ユーザー辞書に登録済みの単語で構成された複合語を定義した際に想定通りに文章の単語分割が行われませんでした。 実施したいこと 文章にホタテが含まれる場合は、ホタテを1つの単語として取り扱いたい 文章にホタテのりが含まれる場合は、ホタテのりを1つの単語として取り扱いたい 設定例 curl -X PUT "localho… --- ## [Logstash does not send few log events generally the last ones](https://discuss.elastic.co/t/logstash-does-not-send-few-log-events-generally-the-last-ones/285802)
**Author:** [@Pratyush\_Rath](https://discuss.elastic.co/u/Pratyush_Rath)\ **Replies:** 6\ **Last updated:** [October 4, 2021, 1:44pm UTC](https://discuss.elastic.co/t/logstash-does-not-send-few-log-events-generally-the-last-ones/285802 "2021-10-04T13:44:28Z")
I am using an ELK stack in my local machine . I have tested sending log events from variety of inputs like file, stdin, filebeat and outputs like Elasticsearch, stdout and tried variety of combinations but the Outputs al… --- ## [Send custom metric via MetricBeat](https://discuss.elastic.co/t/send-custom-metric-via-metricbeat/284887)
**Author:** [@maltewhiite](https://discuss.elastic.co/u/maltewhiite)\ **Replies:** 1\ **Last updated:** [October 4, 2021, 12:45pm UTC](https://discuss.elastic.co/t/send-custom-metric-via-metricbeat/284887 "2021-10-04T12:45:28Z")
We wish to send custom metrics via metricbeat. Specifically we have an integer, which we can get via a command line argument, from a custom program, which we want to send to elastic via Metricbeat. We want to do this, … --- ## [Sinding date field to elastic search through logstash](https://discuss.elastic.co/t/sinding-date-field-to-elastic-search-through-logstash/285811)
**Author:** [@mangeshs](https://discuss.elastic.co/u/mangeshs)\ **Replies:** 5\ **Last updated:** [October 4, 2021, 12:40pm UTC](https://discuss.elastic.co/t/sinding-date-field-to-elastic-search-through-logstash/285811 "2021-10-04T12:40:00Z")
I have log format as 2021-10-04 14:20:27,552 --- and I want field in Elasticsearch as date type but i am getting string type my logstash config file is input { file{ path =\> "D:/Project/ogs/\*\*/\*.log" #path =\> … --- ## [Multiple pipelines mixing records in indexes](https://discuss.elastic.co/t/multiple-pipelines-mixing-records-in-indexes/285705)
**Author:** [@Danny\_Dumenigo](https://discuss.elastic.co/u/Danny_Dumenigo)\ **Replies:** 2\ **Last updated:** [October 4, 2021, 12:35pm UTC](https://discuss.elastic.co/t/multiple-pipelines-mixing-records-in-indexes/285705 "2021-10-04T12:35:13Z")
Hello Community: Im a new user at ELK. I have deployed an ELK stack and everything works fine except for my Logstash pipelines. I explain myself: I have a Logstash server with 3 pipelines defined: Pipeline 1: Manage a… --- ## [Elastic SIEM - Keeps Logging me Out](https://discuss.elastic.co/t/elastic-siem-keeps-logging-me-out/259057)
**Author:** [@austinsonger](https://discuss.elastic.co/u/austinsonger)\ **Replies:** 1\ **Last updated:** [October 4, 2021, 12:02pm UTC](https://discuss.elastic.co/t/elastic-siem-keeps-logging-me-out/259057 "2021-10-04T12:02:20Z")
Whenever I modify a rule I become forced logged out of the session. --- ## [My Indices are getting deleted automatically](https://discuss.elastic.co/t/my-indices-are-getting-deleted-automatically/285805)
**Author:** [@nnice](https://discuss.elastic.co/u/nnice)\ **Replies:** 2\ **Last updated:** [October 4, 2021, 11:58am UTC](https://discuss.elastic.co/t/my-indices-are-getting-deleted-automatically/285805 "2021-10-04T11:58:28Z")
Dear Community, I'm new to ELK. Need you assistance why my indices are getting deleted. if you could let me know what is the issue. I'll be highly obliged for that. Thank you soooo muchhhhh # ======================== E… --- ## [External provisioner is not creating volume](https://discuss.elastic.co/t/external-provisioner-is-not-creating-volume/285762)
**Author:** [@HoseinGhanbari](https://discuss.elastic.co/u/HoseinGhanbari)\ **Replies:** 4\ **Last updated:** [October 4, 2021, 11:44am UTC](https://discuss.elastic.co/t/external-provisioner-is-not-creating-volume/285762 "2021-10-04T11:44:58Z")
Recently deployed a brand new ECK and Elasticsearch Cluster using the official quickstart guide. but my external provisioner which is a NFS server through custom StorageClass is not creating the volume for Elasticsearch … --- ## [Warm data tier nodes are being queried in recent data queries](https://discuss.elastic.co/t/warm-data-tier-nodes-are-being-queried-in-recent-data-queries/285798)
**Author:** [@dordadush](https://discuss.elastic.co/u/dordadush)\ **Replies:** 1\ **Last updated:** [October 4, 2021, 11:28am UTC](https://discuss.elastic.co/t/warm-data-tier-nodes-are-being-queried-in-recent-data-queries/285798 "2021-10-04T11:28:44Z")
Hello everyone! :slight\_smile: I have added a warm data node in my Elastic Cloud deployment. I have also configured the relevant ILM policies to use the Warm phase accordingly. The problem is that the warm nodes are b… --- ## [Elasticsearch - Change nodes to data only](https://discuss.elastic.co/t/elasticsearch-change-nodes-to-data-only/285007)
**Author:** [@voom](https://discuss.elastic.co/u/voom)\ **Replies:** 1\ **Last updated:** [October 4, 2021, 11:02am UTC](https://discuss.elastic.co/t/elasticsearch-change-nodes-to-data-only/285007 "2021-10-04T11:02:25Z")
Hi All, I have an 8 node cluster which is made up of the following roles: 3 master-only nodes 5 master + data nodes I am planning on having the 5 master + data nodes converted to data only and was planning on followi… --- ## [Logstash output to elasic with a pretty print JSON field, but as string (not scattered to fields)](https://discuss.elastic.co/t/logstash-output-to-elasic-with-a-pretty-print-json-field-but-as-string-not-scattered-to-fields/285804)
**Author:** [@dotaneli](https://discuss.elastic.co/u/dotaneli)\ **Replies:** 0\ **Last updated:** [October 4, 2021, 10:28am UTC](https://discuss.elastic.co/t/logstash-output-to-elasic-with-a-pretty-print-json-field-but-as-string-not-scattered-to-fields/285804 "2021-10-04T10:28:30Z")
Hi all. I have a pipline that take a JSON from filebeat. That json has fields that hold json themselvers. Escaped. I want to see in discover the json field as a pretty printed json, but think that I first need to send… --- ## [Logstash Rabbitmq connection refused?](https://discuss.elastic.co/t/logstash-rabbitmq-connection-refused/285801)
**Author:** [@padamrai](https://discuss.elastic.co/u/padamrai)\ **Replies:** 0\ **Last updated:** [October 4, 2021, 10:15am UTC](https://discuss.elastic.co/t/logstash-rabbitmq-connection-refused/285801 "2021-10-04T10:15:56Z")
I am using multiple instances using logstash, First I get an error multiple instance error when I resolved that error. Now I am getting a new error. \[ERROR\]\[logstash.inputs.rabbitmq \] RabbitMQ connection error, will ret… --- ## [Filebeat 7.12 output.file not working](https://discuss.elastic.co/t/filebeat-7-12-output-file-not-working/285797)
**Author:** [@grazia0912](https://discuss.elastic.co/u/grazia0912)\ **Replies:** 1\ **Last updated:** [October 4, 2021, 9:48am UTC](https://discuss.elastic.co/t/filebeat-7-12-output-file-not-working/285797 "2021-10-04T09:48:29Z")
Hi, Please advise why this output.file isn't working. I'm on windows and trying to get the events filebeat is sending to my logstash. I don't have access much on the logstash logs and stuff so i'm trying to output the e… --- ## [Reindex API - Need to improve performance](https://discuss.elastic.co/t/reindex-api-need-to-improve-performance/285453)
**Author:** [@Seba](https://discuss.elastic.co/u/Seba)\ **Replies:** 2\ **Last updated:** [October 4, 2021, 9:40am UTC](https://discuss.elastic.co/t/reindex-api-need-to-improve-performance/285453 "2021-10-04T09:40:07Z")
Hello, The goal is to accelerate the reindex of indexes from an ELK cluster (version 7.6.2) composed of 3 nodes each with all the roles to a datastream in an ELK cluster (version 7.11) installed in a container system w… --- ## [Need a little help for elasticsearch query](https://discuss.elastic.co/t/need-a-little-help-for-elasticsearch-query/285794)
**Author:** [@FALEN](https://discuss.elastic.co/u/FALEN)\ **Replies:** 0\ **Last updated:** [October 4, 2021, 9:02am UTC](https://discuss.elastic.co/t/need-a-little-help-for-elasticsearch-query/285794 "2021-10-04T09:02:57Z")
Hi everyone, Need help to convert this kibana query body to elastic query api format. My goal is to create an api query, that returns all the data between spesific times. So i can reingest this data to logstash, and p… --- ## [How to minimize the reindexing time](https://discuss.elastic.co/t/how-to-minimize-the-reindexing-time/285739)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 7\ **Last updated:** [October 3, 2021, 11:31am UTC](https://discuss.elastic.co/t/how-to-minimize-the-reindexing-time/285739 "2021-10-03T11:31:42Z")
Using ELK 7.13 cluster 3 master 6 data nodes and 2 coordinate nodes Master node configuration Heap Size: 8gb Storage: 50gb(ssd) CPU: 4 Data node configuration Heap Size: 28gb Storage: 1tb(ssd) CPU: 8 Coordinate no… --- ## [Changing a transaction type in APM Overview panel](https://discuss.elastic.co/t/changing-a-transaction-type-in-apm-overview-panel/285537)
**Author:** [@molsza](https://discuss.elastic.co/u/molsza)\ **Replies:** 2\ **Last updated:** [October 4, 2021, 8:52am UTC](https://discuss.elastic.co/t/changing-a-transaction-type-in-apm-overview-panel/285537 "2021-10-04T08:52:55Z")
APM Overview panel is always filtering the transaction type by the most common ones and it doesn't allow to change it. I have 2 cases where it is not working. One is the service which has a lot of running schedulers, wh… --- ## [Kibana: top values and "missing" (other) values](https://discuss.elastic.co/t/kibana-top-values-and-missing-other-values/285736)
**Author:** [@fabbo](https://discuss.elastic.co/u/fabbo)\ **Replies:** 1\ **Last updated:** [October 4, 2021, 8:51am UTC](https://discuss.elastic.co/t/kibana-top-values-and-missing-other-values/285736 "2021-10-04T08:51:50Z")
I'm using Kibana 7.10.2, and I want to make a pie chart where the slices are the top values of a field. There is a slider to change the number of values. However, I seem to recall that, in older versions, there was a ti… --- ## [ECK - How to set context path for elasticsearch?](https://discuss.elastic.co/t/eck-how-to-set-context-path-for-elasticsearch/285442)
**Author:** [@x00m](https://discuss.elastic.co/u/x00m)\ **Replies:** 1\ **Last updated:** [October 4, 2021, 8:41am UTC](https://discuss.elastic.co/t/eck-how-to-set-context-path-for-elasticsearch/285442 "2021-10-04T08:41:11Z")
After eck is setup, i can reach an index via http://quickstart-es-http/ How to set a custom context path so that the Elasticsearch is reachable via http://quickstart-es-http/customcontextpath/ ? --- ## [Apm, openshift cpu usage](https://discuss.elastic.co/t/apm-openshift-cpu-usage/285653)
**Author:** [@johanostberg](https://discuss.elastic.co/u/johanostberg)\ **Replies:** 2\ **Last updated:** [October 4, 2021, 8:21am UTC](https://discuss.elastic.co/t/apm-openshift-cpu-usage/285653 "2021-10-04T08:21:49Z")
Hi i have a question about memory and cpu metrics from openshift pods. From the APM java agent we are getting values in %. Is the % calculated from request and request limits??? How can we change from % to get the act… --- ## [ILM keeps losing track of indices](https://discuss.elastic.co/t/ilm-keeps-losing-track-of-indices/284055)
**Author:** [@cawoodm](https://discuss.elastic.co/u/cawoodm)\ **Replies:** 1\ **Last updated:** [October 4, 2021, 7:40am UTC](https://discuss.elastic.co/t/ilm-keeps-losing-track-of-indices/284055 "2021-10-04T07:40:11Z")
We keep seeing the issue described here where Elasticsearch is not rolling over indices properly. \[2021-09-13T12:39:16,671\]\[ERROR\]\[o.e.x.i.IndexLifecycleRunner\] \[ecom-repository01\] policy \[test-policy\] for index \[error… [Previous page](https://discuss.elastic.co/latest.md?page=1448) [Next page](https://discuss.elastic.co/latest.md?page=1450)