# Latest **URL:** https://discuss.elastic.co/latest.md?page=1455 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1456 --- ## [Parse contents of a specific field and store in new fields](https://discuss.elastic.co/t/parse-contents-of-a-specific-field-and-store-in-new-fields/285527)
**Author:** [@rickyhicky](https://discuss.elastic.co/u/rickyhicky)\ **Replies:** 0\ **Last updated:** [September 29, 2021, 10:41pm UTC](https://discuss.elastic.co/t/parse-contents-of-a-specific-field-and-store-in-new-fields/285527 "2021-09-29T22:41:33Z")
Hello all, I have few log entries like below, which I am parsing using grok/regex. How can I again parse contents of a field and store it to new fields within the same index? Log example: \`2021-09-24T17:05:52,777 INFO… --- ## [How to run down source of mutate error?](https://discuss.elastic.co/t/how-to-run-down-source-of-mutate-error/285500)
**Author:** [@mistrhanky](https://discuss.elastic.co/u/mistrhanky)\ **Replies:** 5\ **Last updated:** [September 29, 2021, 9:55pm UTC](https://discuss.elastic.co/t/how-to-run-down-source-of-mutate-error/285500 "2021-09-29T21:55:26Z")
I have an error like the one below. In fact I get a fair number of them, lets say a few hundred each day on a production system(7.12) that logs fairly heavy, 800 million or so records a day. So the amount of these errors… --- ## [Elastic 7.x - how to create coordinate map?](https://discuss.elastic.co/t/elastic-7-x-how-to-create-coordinate-map/285394)
**Author:** [@ppine7](https://discuss.elastic.co/u/ppine7)\ **Replies:** 6\ **Last updated:** [September 29, 2021, 9:40pm UTC](https://discuss.elastic.co/t/elastic-7-x-how-to-create-coordinate-map/285394 "2021-09-29T21:40:20Z")
Hello, I had a coordinate map visualization created in ES 6.x - but when I try to create a similar one in ES 7.x (Elastic Cloud) - I can't find the same options. In particular, I want to create a Coordinate Map with Sca… --- ## [Monitoring Veeam Backup Jobs](https://discuss.elastic.co/t/monitoring-veeam-backup-jobs/284401)
**Author:** [@Xabi](https://discuss.elastic.co/u/Xabi)\ **Replies:** 3\ **Last updated:** [September 29, 2021, 9:38pm UTC](https://discuss.elastic.co/t/monitoring-veeam-backup-jobs/284401 "2021-09-29T21:38:52Z")
Hi guys, I'm interested in monitoring our veem backup jobs. Especially the events related to the execution of jobs. any suggestions? --- ## [Filebeat: error json decode](https://discuss.elastic.co/t/filebeat-error-json-decode/285302)
**Author:** [@mohammed.sabil](https://discuss.elastic.co/u/mohammed.sabil)\ **Replies:** 1\ **Last updated:** [September 29, 2021, 9:37pm UTC](https://discuss.elastic.co/t/filebeat-error-json-decode/285302 "2021-09-29T21:37:47Z")
Hello Team and @john.akash, Hope you are doing good. I am also trying to push log message data to ES so that I can filter the data and create visualization. Here is my sample log "@timestamp" =\> 2021-09-28T04:51:22.… --- ## [Single-node, manage data with more than one path](https://discuss.elastic.co/t/single-node-manage-data-with-more-than-one-path/285485)
**Author:** [@glitz](https://discuss.elastic.co/u/glitz)\ **Replies:** 1\ **Last updated:** [September 29, 2021, 9:36pm UTC](https://discuss.elastic.co/t/single-node-manage-data-with-more-than-one-path/285485 "2021-09-29T21:36:13Z")
Hello, I have a little yet productive (then important) single-node ELK stack version 7.9.3. In my unexperience I didn't properly took care of disk space...so I have a 200GB data partition at around at 90% disk usage, w… --- ## [Kibana stopped working after update](https://discuss.elastic.co/t/kibana-stopped-working-after-update/285444)
**Author:** [@Artemis\_Fowl](https://discuss.elastic.co/u/Artemis_Fowl)\ **Replies:** 6\ **Last updated:** [September 29, 2021, 9:32pm UTC](https://discuss.elastic.co/t/kibana-stopped-working-after-update/285444 "2021-09-29T21:32:33Z")
After the update kibana is not working. http://localhost:5601/ response - "Kibana server is not ready yet" $ journalctl -u kibana.service Sep 29 12:03:21 Notebook systemd\[1\]: Stopping Kibana... Sep 29 12:03:55 Noteboo… --- ## [Anonymization - Do not display a bar in a chart if occurence / count below 10](https://discuss.elastic.co/t/anonymization-do-not-display-a-bar-in-a-chart-if-occurence-count-below-10/284730)
**Author:** [@wgault](https://discuss.elastic.co/u/wgault)\ **Replies:** 3\ **Last updated:** [September 29, 2021, 9:30pm UTC](https://discuss.elastic.co/t/anonymization-do-not-display-a-bar-in-a-chart-if-occurence-count-below-10/284730 "2021-09-29T21:30:28Z")
Hello, I wish to create some anonymized dashboard. This requires to have a minimum amount of occurence/count per category / bar in a chart. In this case, if the count is below 10, then we would have two options : 1 - … --- ## [Auto split an index's shard when certain size reached](https://discuss.elastic.co/t/auto-split-an-indexs-shard-when-certain-size-reached/285521)
**Author:** [@raonic](https://discuss.elastic.co/u/raonic)\ **Replies:** 1\ **Last updated:** [September 29, 2021, 9:06pm UTC](https://discuss.elastic.co/t/auto-split-an-indexs-shard-when-certain-size-reached/285521 "2021-09-29T21:06:48Z")
Hello, I am relatively new to Elasticsearch and building an ES cluster for customers. The way I am designing the cluster is that each customer would get an index of their own which they will write to and read from. Pro… --- ## [Kibana missing cpu stats](https://discuss.elastic.co/t/kibana-missing-cpu-stats/285422)
**Author:** [@Jerry\_Hoffmeister](https://discuss.elastic.co/u/Jerry_Hoffmeister)\ **Replies:** 4\ **Last updated:** [September 29, 2021, 8:45pm UTC](https://discuss.elastic.co/t/kibana-missing-cpu-stats/285422 "2021-09-29T20:45:48Z")
We recently upgraded our Elasticsearch prod cluster from 6.4.2-\>6.8.15-\>7.12.1 and we are not seeing cpu data in kibana now: Hovering over the info link suggests that we need to enable cpu quotas but I'm unable to … --- ## [How to search using keywords or tags?](https://discuss.elastic.co/t/how-to-search-using-keywords-or-tags/285516)
**Author:** [@Sebastian\_Marroquin](https://discuss.elastic.co/u/Sebastian_Marroquin)\ **Replies:** 0\ **Last updated:** [September 29, 2021, 7:58pm UTC](https://discuss.elastic.co/t/how-to-search-using-keywords-or-tags/285516 "2021-09-29T19:58:55Z")
Hello everyone, I need help to resolve a question regarding Elasticsearch. I want to use the tags but in a different way. I am using the following composition when making the "tags": #RGB keyboard Is it possible to d… --- ## [Fortinet module fails to install](https://discuss.elastic.co/t/fortinet-module-fails-to-install/284777)
**Author:** [@Gorillabiscuit](https://discuss.elastic.co/u/Gorillabiscuit)\ **Replies:** 8\ **Last updated:** [September 29, 2021, 7:22pm UTC](https://discuss.elastic.co/t/fortinet-module-fails-to-install/284777 "2021-09-29T19:22:58Z")
I inherited an ELK stack and recently upgraded my firewall. We can send syslog to filebeat, which I'm doing, and then filebeat should be sending to ES. When I try and run the filebeat setup -e from the remote server I ge… --- ## [How to enrich data based on similar values?](https://discuss.elastic.co/t/how-to-enrich-data-based-on-similar-values/285508)
**Author:** [@rsokolova](https://discuss.elastic.co/u/rsokolova)\ **Replies:** 0\ **Last updated:** [September 29, 2021, 6:53pm UTC](https://discuss.elastic.co/t/how-to-enrich-data-based-on-similar-values/285508 "2021-09-29T18:53:38Z")
Hello, Does Elasticsearch has any capability to enrich data based on possible or close match ? First index: "name" : "Hamilton Law LLC", "risk" : "High" Second index : "name": "Hamilton Company ", "description": " T… --- ## [Monitoring cluster](https://discuss.elastic.co/t/monitoring-cluster/285507)
**Author:** [@eh2021-elastic](https://discuss.elastic.co/u/eh2021-elastic)\ **Replies:** 0\ **Last updated:** [September 29, 2021, 6:52pm UTC](https://discuss.elastic.co/t/monitoring-cluster/285507 "2021-09-29T18:52:18Z")
I have a similar question tothe one posted by souravsahoo "Cluster\_stats not sent to monitoring cluster" but no answer was posted. I am having something similar to where I have installed metricbeats on a production clust… --- ## [Filters contains invalid key: status](https://discuss.elastic.co/t/filters-contains-invalid-key-status/285267)
**Author:** [@dgetz-riskalyze](https://discuss.elastic.co/u/dgetz-riskalyze)\ **Replies:** 3\ **Last updated:** [September 29, 2021, 6:04pm UTC](https://discuss.elastic.co/t/filters-contains-invalid-key-status/285267 "2021-09-29T18:04:55Z")
We added a new field to the schema of our engine, but not all of the documents have the field yet, which is named "status". When we do the App Search query below, we get the error, "Filters contains invalid key: status".… --- ## [Logstash doesnot ingest data when started as a service](https://discuss.elastic.co/t/logstash-doesnot-ingest-data-when-started-as-a-service/285491)
**Author:** [@Gauti](https://discuss.elastic.co/u/Gauti)\ **Replies:** 5\ **Last updated:** [September 29, 2021, 5:57pm UTC](https://discuss.elastic.co/t/logstash-doesnot-ingest-data-when-started-as-a-service/285491 "2021-09-29T17:57:33Z")
Hi All, I am trying to ingest csv data into Elasticsearch by using logstash, when i run the conf file manually the data is getting ingested, but when i add the conf file into pipelines.yml and then start logstash as a s… --- ## [Pipeline worker error in logstash config](https://discuss.elastic.co/t/pipeline-worker-error-in-logstash-config/285496)
**Author:** [@kriss332](https://discuss.elastic.co/u/kriss332)\ **Replies:** 2\ **Last updated:** [September 29, 2021, 5:24pm UTC](https://discuss.elastic.co/t/pipeline-worker-error-in-logstash-config/285496 "2021-09-29T17:24:05Z")
Hello all. I am trying to parse a VPN device logs. t send data in KV format. The data received as I see in netcat's output is- \<13\>Sep 29 21:52:00 172.xx.43.101 488 \<134\>1 2021-09-29T21:52:00+05:30 vpn.com2 PulseSecure… --- ## [How does elasticsearch index json](https://discuss.elastic.co/t/how-does-elasticsearch-index-json/285335)
**Author:** [@Zeeshan\_Alam](https://discuss.elastic.co/u/Zeeshan_Alam)\ **Replies:** 2\ **Last updated:** [September 29, 2021, 3:24pm UTC](https://discuss.elastic.co/t/how-does-elasticsearch-index-json/285335 "2021-09-29T15:24:25Z")
We are trying to push log into elastic which adhere to Elastic Common Schema (ECS) . Does elastic index data differently for the logs shown below. Both are having same data just the JSON format is different. Format 1 {… --- ## [Elastic-agent-control.sock: operation not supported on socket](https://discuss.elastic.co/t/elastic-agent-control-sock-operation-not-supported-on-socket/285101)
**Author:** [@rschirin](https://discuss.elastic.co/u/rschirin)\ **Replies:** 4\ **Last updated:** [September 29, 2021, 4:06pm UTC](https://discuss.elastic.co/t/elastic-agent-control-sock-operation-not-supported-on-socket/285101 "2021-09-29T16:06:01Z")
Hey there, I have an Elasticsearch and Kibana instance running via Docker images (I have configured the secure option). Now I am trying to install the elastic-agent to start the Fleet Server but I am facing this error: … --- ## [Change kibana.autocompleteTerminateAfter](https://discuss.elastic.co/t/change-kibana-autocompleteterminateafter/285311)
**Author:** [@Voula\_Mikr](https://discuss.elastic.co/u/Voula_Mikr)\ **Replies:** 3\ **Last updated:** [September 29, 2021, 3:07pm UTC](https://discuss.elastic.co/t/change-kibana-autocompleteterminateafter/285311 "2021-09-29T15:07:08Z")
Hi In a deployment with Elasticsearch and kibana, I get the below: I saw from Terms list might be incomplete because the request is taking to long - #15 by Fedi\_Ben\_Messaoud that kibana.autocompleteTerminateAfter pa… --- ## [Parsing JSON with a string at the beginning of each JSON Object](https://discuss.elastic.co/t/parsing-json-with-a-string-at-the-beginning-of-each-json-object/285480)
**Author:** [@pkward](https://discuss.elastic.co/u/pkward)\ **Replies:** 7\ **Last updated:** [September 29, 2021, 2:57pm UTC](https://discuss.elastic.co/t/parsing-json-with-a-string-at-the-beginning-of-each-json-object/285480 "2021-09-29T14:57:03Z")
Hello, I'm trying to parse a json file with a string at the beginning of each object. What is the easiest way to bypass the initial string or parse the json with string at the beginning? Here is an example of the JSON: … --- ## [Kibana User Session](https://discuss.elastic.co/t/kibana-user-session/285342)
**Author:** [@hiba](https://discuss.elastic.co/u/hiba)\ **Replies:** 5\ **Last updated:** [September 29, 2021, 2:49pm UTC](https://discuss.elastic.co/t/kibana-user-session/285342 "2021-09-29T14:49:06Z")
Hi team, I have a question that I’m having trouble finding the answer to elsewhere. I would like to create dashboards that customize the data based on the specific user logged in. The response of this api Post : http:… --- ## [Elasticsearch DSL query, exists and not exists fields](https://discuss.elastic.co/t/elasticsearch-dsl-query-exists-and-not-exists-fields/285489)
**Author:** [@antonisnyc94](https://discuss.elastic.co/u/antonisnyc94)\ **Replies:** 0\ **Last updated:** [September 29, 2021, 2:46pm UTC](https://discuss.elastic.co/t/elasticsearch-dsl-query-exists-and-not-exists-fields/285489 "2021-09-29T14:46:16Z")
Hello, I am trying to achieve the following with DSL querying ( not\_exists: "data.aws.userIdentity.sessionContext.attributes.mfaAuthenticated" AND data.aws.eventName: ConsoleLogin AND data.aws.additionalEventData.MFAUse… --- ## [Filebeat stops shipping events under load](https://discuss.elastic.co/t/filebeat-stops-shipping-events-under-load/285409)
**Author:** [@mirzmaster](https://discuss.elastic.co/u/mirzmaster)\ **Replies:** 2\ **Last updated:** [September 29, 2021, 2:27pm UTC](https://discuss.elastic.co/t/filebeat-stops-shipping-events-under-load/285409 "2021-09-29T14:27:01Z")
I have observed that when Filebeat is shipping container logs which are rapidly growing in size, it reaches some threshold and then just stops shipping events from that logfile. This behaviour was initially suspected to… --- ## [Kibana filter for thousands of IPs](https://discuss.elastic.co/t/kibana-filter-for-thousands-of-ips/285379)
**Author:** [@MasonNorris](https://discuss.elastic.co/u/MasonNorris)\ **Replies:** 8\ **Last updated:** [September 29, 2021, 2:26pm UTC](https://discuss.elastic.co/t/kibana-filter-for-thousands-of-ips/285379 "2021-09-29T14:26:07Z")
Kibana Version: 7.12.1 Is there a way to filter for thousands of IPs in one visualization. Currently I have enabled state:storeinseesion and am using a DSL filter but am limited to 1024 clauses within the DSL filter. I … --- ## [Observability Engineer Training - Modules](https://discuss.elastic.co/t/observability-engineer-training-modules/285408)
**Author:** [@kvmuralidhar](https://discuss.elastic.co/u/kvmuralidhar)\ **Replies:** 1\ **Last updated:** [September 29, 2021, 1:39pm UTC](https://discuss.elastic.co/t/observability-engineer-training-modules/285408 "2021-09-29T13:39:52Z")
Hi, I can't keep the heartbeat/metricbeat/filebeat modules running even if I start on the background mode. The machine changes all the time. Is there an option to have this up and running for ever ? Thanks Murali --- ## [Synthetic Monitoring using proxy servers](https://discuss.elastic.co/t/synthetic-monitoring-using-proxy-servers/283389)
**Author:** [@shinmaeng](https://discuss.elastic.co/u/shinmaeng)\ **Replies:** 1\ **Last updated:** [September 29, 2021, 1:23pm UTC](https://discuss.elastic.co/t/synthetic-monitoring-using-proxy-servers/283389 "2021-09-29T13:23:03Z")
Hi, elastic staffs. I have two questions about Synthetic installed in private network. It can not call any outbound requests to the internet unless I do any network works. I read the heartbeat document below about s… --- ## [Filebeat stop sending the logs bulk index operations: 400 Bad Request](https://discuss.elastic.co/t/filebeat-stop-sending-the-logs-bulk-index-operations-400-bad-request/285479)
**Author:** [@abhi.logs](https://discuss.elastic.co/u/abhi.logs)\ **Replies:** 0\ **Last updated:** [September 29, 2021, 1:17pm UTC](https://discuss.elastic.co/t/filebeat-stop-sending-the-logs-bulk-index-operations-400-bad-request/285479 "2021-09-29T13:17:19Z")
Filebeat is not sending logs to elastic host. showing some error ERROR \[publisher\_pipeline\_output\] pipeline/output.go:180 failed to publish events: 400 Bad Request: Collected errors: \*\* Error 0: failed to encode bundle… --- ## [Synthetics test configuration](https://discuss.elastic.co/t/synthetics-test-configuration/284150)
**Author:** [@shinmaeng](https://discuss.elastic.co/u/shinmaeng)\ **Replies:** 1\ **Last updated:** [September 29, 2021, 1:10pm UTC](https://discuss.elastic.co/t/synthetics-test-configuration/284150 "2021-09-29T13:10:49Z")
Hi elastic staff. I got the error message from synthetic agent. io:error executing step: Error: page.goto:net::ERR\_CERT\_AUTHORITY\_INVALID at .. So, I wanted to set ignoreHTTPSErrors to true and I found that playwrigh… --- ## [Name or service not known](https://discuss.elastic.co/t/name-or-service-not-known/284831)
**Author:** [@mahalanobis](https://discuss.elastic.co/u/mahalanobis)\ **Replies:** 6\ **Last updated:** [September 29, 2021, 12:29pm UTC](https://discuss.elastic.co/t/name-or-service-not-known/284831 "2021-09-29T12:29:50Z")
I'm trying to setup an Elasticsearch cluster but I'm getting "Name or service not known" Below you can find configuration and logs first node logs: https://gist.github.com/sintonag/d6ee4e4c68084a0941c28afcf251b519 sec… [Previous page](https://discuss.elastic.co/latest.md?page=1454) [Next page](https://discuss.elastic.co/latest.md?page=1456)