**Author:** [@malsioufi](https://discuss.elastic.co/u/malsioufi)\
**Replies:** 0\
**Last updated:** [July 11, 2021, 10:59am UTC](https://discuss.elastic.co/t/change-index-alias/278355 "2021-07-11T10:59:51Z")
Hi, Previously I have created an index alias tests PUT tests-00000001 { "aliases": { "tests": { "is\_write\_index": true } } } I have used it as rollover alias to create an index template PUT \_index\_t…
---
## [Kibana - intersection of two data sets on map](https://discuss.elastic.co/t/kibana-intersection-of-two-data-sets-on-map/277911)
**Author:** [@leonidbionic](https://discuss.elastic.co/u/leonidbionic)\
**Replies:** 4\
**Last updated:** [July 11, 2021, 9:34am UTC](https://discuss.elastic.co/t/kibana-intersection-of-two-data-sets-on-map/277911 "2021-07-11T09:34:38Z")
I have a index named 'request' with the below schema - \`\`\` "id": "160c6273-8462-4830-9a51-dabf2e292ebb", "username": "bob\_dylan", "date": "Jul 6, 2021 @ 12:00:00.000", "location": { "lat": 48.8, "lon": 2.35 }\`\`\`…
---
## [Metricbeat cluster sizing](https://discuss.elastic.co/t/metricbeat-cluster-sizing/276872)
**Author:** [@premierpsp](https://discuss.elastic.co/u/premierpsp)\
**Replies:** 16\
**Last updated:** [July 11, 2021, 7:12am UTC](https://discuss.elastic.co/t/metricbeat-cluster-sizing/276872 "2021-07-11T07:12:29Z")
Hello, I need your help. I’m deploying metricbeat on 3000 servers. The problem is that from 1000 agents loaded, kibana has problems to display the metrics. In fact, there are metrics that kibana cannot display. I think …
---
## [Search query for boolean operators in Elasticsearch 7.10?](https://discuss.elastic.co/t/search-query-for-boolean-operators-in-elasticsearch-7-10/278346)
**Author:** [@Nishikant\_Tayade](https://discuss.elastic.co/u/Nishikant_Tayade)\
**Replies:** 0\
**Last updated:** [July 11, 2021, 3:32am UTC](https://discuss.elastic.co/t/search-query-for-boolean-operators-in-elasticsearch-7-10/278346 "2021-07-11T03:32:01Z")
I have an index with large set of documents. I want to perform following boolean queries for the below operators: 1. eq 2. ne 3. startsWith 4. endsWith 5. contains 6. void : Return the document whi…
---
## [Can't find grok match](https://discuss.elastic.co/t/cant-find-grok-match/278240)
**Author:** [@Badb0y](https://discuss.elastic.co/u/Badb0y)\
**Replies:** 4\
**Last updated:** [July 11, 2021, 2:57am UTC](https://discuss.elastic.co/t/cant-find-grok-match/278240 "2021-07-11T02:57:07Z")
Hi, I'm almost at the solution but not sure how to make this optimal and how to parse the ? marked part. These are my log lines: 2021-07-09T12:11:40.917+0700 7fce8a240700 1 beast: 0x7fceee9b06b0: 10.111.111.111 - - \[…
---
## [Logstash don't send logs to elasticsearch](https://discuss.elastic.co/t/logstash-dont-send-logs-to-elasticsearch/278339)
**Author:** [@diegz](https://discuss.elastic.co/u/diegz)\
**Replies:** 20\
**Last updated:** [July 11, 2021, 12:50am UTC](https://discuss.elastic.co/t/logstash-dont-send-logs-to-elasticsearch/278339 "2021-07-11T00:50:43Z")
Hi community, I configured ssl on the whole stack (elasticsearch, kibana, logstash, filebeat) When I manually launch logstash to test my configuration, I have this return. I think it's good but I don't see anything in…
---
## [Golang How to parse alerting rule (index connector) document hits](https://discuss.elastic.co/t/golang-how-to-parse-alerting-rule-index-connector-document-hits/278028)
**Author:** [@bravo](https://discuss.elastic.co/u/bravo)\
**Replies:** 1\
**Last updated:** [July 10, 2021, 7:21pm UTC](https://discuss.elastic.co/t/golang-how-to-parse-alerting-rule-index-connector-document-hits/278028 "2021-07-10T19:21:56Z")
In the below sample the alert doument created by the alerting rule, contains 3 documents (json objects) under hits but they are NOT contained in an array , so in Go unable to parse them Can someone helpme parse the hits…
---
## [Auditing all Linux clients with centralised server](https://discuss.elastic.co/t/auditing-all-linux-clients-with-centralised-server/278246)
**Author:** [@kaushalshriyan](https://discuss.elastic.co/u/kaushalshriyan)\
**Replies:** 3\
**Last updated:** [July 10, 2021, 5:39pm UTC](https://discuss.elastic.co/t/auditing-all-linux-clients-with-centralised-server/278246 "2021-07-10T17:39:32Z")
Hi, I have 20 Linux servers in the network. Is there a way to audit all Linux clients using a centralized server? For example, what commands are run by John on Linuxnode1? Steve on Linuxnode15? and so on and so forth to…
---
## [Listen loop error: #\](https://discuss.elastic.co/t/listen-loop-error-ioerror-closed-stream/278338)
**Author:** [@Carlos\_Velasquez](https://discuss.elastic.co/u/Carlos_Velasquez)\
**Replies:** 0\
**Last updated:** [July 10, 2021, 3:41pm UTC](https://discuss.elastic.co/t/listen-loop-error-ioerror-closed-stream/278338 "2021-07-10T15:41:10Z")
Hi, When I start the logstash (manual invocation), I receive the folowing error. the version i'm using is 7.12.1 and Centos 8 Operating System: CentOS Linux 8 CPE OS Name: cpe:/o:centos:centos:8 Ke…
---
## [I am unable to sync data from postgresql, Basically I am not able to start logstash](https://discuss.elastic.co/t/i-am-unable-to-sync-data-from-postgresql-basically-i-am-not-able-to-start-logstash/278331)
**Author:** [@NETESH\_KUMAR](https://discuss.elastic.co/u/NETESH_KUMAR)\
**Replies:** 2\
**Last updated:** [July 10, 2021, 2:50pm UTC](https://discuss.elastic.co/t/i-am-unable-to-sync-data-from-postgresql-basically-i-am-not-able-to-start-logstash/278331 "2021-07-10T14:50:47Z")
\#Here is my config file #--------- config file start---------------- Sample Logstash configuration for creating a simple Beats -\> Logstash -\> Elasticsearch pipeline. input{ jdbc{ jdbc\_connection\_string =\> "jdbc:postg…
---
## [\[Filebeat\] aws-cloudwatch input sends logs only after the filebeat service restarts](https://discuss.elastic.co/t/filebeat-aws-cloudwatch-input-sends-logs-only-after-the-filebeat-service-restarts/278336)
**Author:** [@Luci](https://discuss.elastic.co/u/Luci)\
**Replies:** 0\
**Last updated:** [July 10, 2021, 2:41pm UTC](https://discuss.elastic.co/t/filebeat-aws-cloudwatch-input-sends-logs-only-after-the-filebeat-service-restarts/278336 "2021-07-10T14:41:48Z")
Filebeats ver: 7.13 I am using the aws-cloudwatch plugin with the following input configuration. \[2021-07-10 13:39:49.883Z:30560:I:\_\_main\_\_:wst-infra:39\] Invoking: sshi on account: beacon-test-tko region: None filebeat…
---
## [ILM my index is not doing rollover properly](https://discuss.elastic.co/t/ilm-my-index-is-not-doing-rollover-properly/278334)
**Author:** [@Daud\_Ahmed1](https://discuss.elastic.co/u/Daud_Ahmed1)\
**Replies:** 4\
**Last updated:** [July 10, 2021, 2:29pm UTC](https://discuss.elastic.co/t/ilm-my-index-is-not-doing-rollover-properly/278334 "2021-07-10T14:29:07Z")
Below is my ILM policy { "policy": { "phases": { "hot": { "min\_age": "0ms", "actions": { "rollover": { "max\_age": "30d", "max\_size": "50gb" }, …
---
## [Starting Elasticsearch fails](https://discuss.elastic.co/t/starting-elasticsearch-fails/278318)
**Author:** [@maof97](https://discuss.elastic.co/u/maof97)\
**Replies:** 2\
**Last updated:** [July 10, 2021, 8:42am UTC](https://discuss.elastic.co/t/starting-elasticsearch-fails/278318 "2021-07-10T08:42:05Z")
Hi, I had an outage at my Server (self-hosted) and now every time I want to start ES this error appears: Jul 10 08:15:44 pelk logstash\[720\]: \[2021-07-10T08:15:44,162\]\[WARN \]\[logstash.outputs.elasticsearch\]\[pfelk\] Attemp…
---
## [Cannot compute used swap when total swap is 0 and free swap is 0](https://discuss.elastic.co/t/cannot-compute-used-swap-when-total-swap-is-0-and-free-swap-is-0/277128)
**Author:** [@alexus](https://discuss.elastic.co/u/alexus)\
**Replies:** 2\
**Last updated:** [June 28, 2021, 12:35am UTC](https://discuss.elastic.co/t/cannot-compute-used-swap-when-total-swap-is-0-and-free-swap-is-0/277128 "2021-06-28T00:35:12Z")
Hello World! My logs are getting flooded with following message: cannot compute used swap when total swap is 0 and free swap is 0 I assume it's safe to ignore since it's not recommended to have swap enabled anyways,…
---
## [Heartbeat: Locking-Down Heartbeat and Beats when "HTTP Endpoint" is Enabled on the Beats?](https://discuss.elastic.co/t/heartbeat-locking-down-heartbeat-and-beats-when-http-endpoint-is-enabled-on-the-beats/278292)
**Author:** [@Log\_Gobbler](https://discuss.elastic.co/u/Log_Gobbler)\
**Replies:** 0\
**Last updated:** [July 9, 2021, 4:29pm UTC](https://discuss.elastic.co/t/heartbeat-locking-down-heartbeat-and-beats-when-http-endpoint-is-enabled-on-the-beats/278292 "2021-07-09T16:29:59Z")
I have a test Heartbeat and test Filebeat (with "HTTP Endpoint" enabled) set-up and working (via Uptime) but they do not have security features enabled/configured between them. I've stored the credentials in the Heartbe…
---
## [Extracting @timestamp from Source within Hits](https://discuss.elastic.co/t/extracting-timestamp-from-source-within-hits/278306)
**Author:** [@NoviceESCoder](https://discuss.elastic.co/u/NoviceESCoder)\
**Replies:** 0\
**Last updated:** [July 9, 2021, 8:22pm UTC](https://discuss.elastic.co/t/extracting-timestamp-from-source-within-hits/278306 "2021-07-09T20:22:56Z")
I am trying to extract @timestamp from .Source but whenever I type a dot after the word Source I do not get any options that Source can contain where I can grab @timestamp. Is there a specific way I can grab @timestamp f…
---
## [Add\_process\_metadata cannot parse pid in integer](https://discuss.elastic.co/t/add-process-metadata-cannot-parse-pid-in-integer/263380)
**Author:** [@Yin\_Zhang](https://discuss.elastic.co/u/Yin_Zhang)\
**Replies:** 3\
**Last updated:** [July 9, 2021, 8:40pm UTC](https://discuss.elastic.co/t/add-process-metadata-cannot-parse-pid-in-integer/263380 "2021-07-09T20:40:03Z")
Hi all, I got some weird error when using add\_process\_metadata in filebeat 7.10.2. It doesn't seem to like integer value. Given following json input: { "level": "info", "pid": 1, "message": "test1", "tags": \["tag1", "…
---
## [Custom scoring based on number of matches](https://discuss.elastic.co/t/custom-scoring-based-on-number-of-matches/278305)
**Author:** [@Viktor\_Krasynskyy](https://discuss.elastic.co/u/Viktor_Krasynskyy)\
**Replies:** 0\
**Last updated:** [July 9, 2021, 7:15pm UTC](https://discuss.elastic.co/t/custom-scoring-based-on-number-of-matches/278305 "2021-07-09T19:15:49Z")
My question is somewhat similar to an old feature request Add match count scoring option · Issue #13806 · elastic/elasticsearch · GitHub but some options suggested there are already deprecated. I'm trying to create a cu…
---
## [Winlogbeat winlog.event\_data.AccessList process](https://discuss.elastic.co/t/winlogbeat-winlog-event-data-accesslist-process/278303)
**Author:** [@MarceloSamoilenko](https://discuss.elastic.co/u/MarceloSamoilenko)\
**Replies:** 0\
**Last updated:** [July 9, 2021, 6:49pm UTC](https://discuss.elastic.co/t/winlogbeat-winlog-event-data-accesslist-process/278303 "2021-07-09T18:49:08Z")
Hello everyone, I want to have control of log events using Winlogbeat with parsing event with id 4663, winlog.event\_data.AccessMask's and winlog.event\_data.AccessList's winlog.event\_data.AccessMask: "0x10000" winlog.e…
---
## [Removing item from array based on string value from another field](https://discuss.elastic.co/t/removing-item-from-array-based-on-string-value-from-another-field/278279)
**Author:** [@mad\_dog](https://discuss.elastic.co/u/mad_dog)\
**Replies:** 6\
**Last updated:** [July 9, 2021, 6:27pm UTC](https://discuss.elastic.co/t/removing-item-from-array-based-on-string-value-from-another-field/278279 "2021-07-09T18:27:00Z")
I have a ruby filter that puts all mac addresses (access points and stations macs) in a log to mac\_addresses field and this works fine. I also have another grok filter which puts only station mac addresses to station\_ma…
---
## [Elasticsearch访问权限xpack](https://discuss.elastic.co/t/elasticsearch-xpack/276736)
**Author:** [@peng-elasticsearch](https://discuss.elastic.co/u/peng-elasticsearch)\
**Replies:** 5\
**Last updated:** [July 9, 2021, 5:30pm UTC](https://discuss.elastic.co/t/elasticsearch-xpack/276736 "2021-07-09T17:30:25Z")
elasticsearch6.3.1版本申请免费基础版license证书，上传导入证书报错问题； 上传导入命令： curl -XPOST -u elastic:123456 http://127.0.0.1:9200/\_xpack/license/start\_basic?acknowledge=true -H "Content-Type: application/json" -d @license.json 执行结果返回：{"ac…
---
## [Create KV-pairs for field not in key:value format and use ruby filter on KV pairs](https://discuss.elastic.co/t/create-kv-pairs-for-field-not-in-key-value-format-and-use-ruby-filter-on-kv-pairs/278220)
**Author:** [@parinitha.nagaraja](https://discuss.elastic.co/u/parinitha.nagaraja)\
**Replies:** 3\
**Last updated:** [July 9, 2021, 4:44pm UTC](https://discuss.elastic.co/t/create-kv-pairs-for-field-not-in-key-value-format-and-use-ruby-filter-on-kv-pairs/278220 "2021-07-09T16:44:39Z")
Hello, I am trying to apply KV filter to a field that does not have "key:value key:value" format. The format is "value(key) value(key) ...". Below are the details. 2021-06-28 19:06:15.848 \[0000-XYZ\] \[appLog …
---
## [Importing text from text files and merging to existing documents](https://discuss.elastic.co/t/importing-text-from-text-files-and-merging-to-existing-documents/278269)
**Author:** [@stashing\_logs](https://discuss.elastic.co/u/stashing_logs)\
**Replies:** 1\
**Last updated:** [July 9, 2021, 4:43pm UTC](https://discuss.elastic.co/t/importing-text-from-text-files-and-merging-to-existing-documents/278269 "2021-07-09T16:43:39Z")
I have an existing elastic engine containing documents with an ID and some metadata (date, original file path, author etc.). I now have the text files which have the extracted text for these documents. The text files ar…
---
## [Does the lumberjack output plugin do the loadbalacing](https://discuss.elastic.co/t/does-the-lumberjack-output-plugin-do-the-loadbalacing/278252)
**Author:** [@lemahdois](https://discuss.elastic.co/u/lemahdois)\
**Replies:** 1\
**Last updated:** [July 9, 2021, 4:40pm UTC](https://discuss.elastic.co/t/does-the-lumberjack-output-plugin-do-the-loadbalacing/278252 "2021-07-09T16:40:07Z")
Dear all, I am using lumberjack output plugin to send logs from logstash to logstash. I use this code lumberjack { codec =\> json hosts =\> \["XXX","YYY"\] port =\> ZZZ …
---
## [Convert string to integer](https://discuss.elastic.co/t/convert-string-to-integer/277915)
**Author:** [@ANKITA\_SAHA](https://discuss.elastic.co/u/ANKITA_SAHA)\
**Replies:** 3\
**Last updated:** [July 9, 2021, 4:31pm UTC](https://discuss.elastic.co/t/convert-string-to-integer/277915 "2021-07-09T16:31:07Z")
Hello everyone! I need help for converting a string data to integer value. I have an 'Hours' column which consist of numeric data but kibana is reading as string as a result when i try to sort the axis it does not sort…
---
## [Troubles with JVM Heap](https://discuss.elastic.co/t/troubles-with-jvm-heap/278290)
**Author:** [@Di\_Croatiano](https://discuss.elastic.co/u/Di_Croatiano)\
**Replies:** 1\
**Last updated:** [July 9, 2021, 4:25pm UTC](https://discuss.elastic.co/t/troubles-with-jvm-heap/278290 "2021-07-09T16:25:54Z")
Hello there! After a considerable time optimizing and testing different configurations, I have no idea why my ES nodes uses so much of a JVM heap, with not so many shards in a cluster. I’m definitely missing something, …
---
## [How do I reference a field name that contains a dot in watcher logging action](https://discuss.elastic.co/t/how-do-i-reference-a-field-name-that-contains-a-dot-in-watcher-logging-action/266614)
**Author:** [@Emilio\_Vega](https://discuss.elastic.co/u/Emilio_Vega)\
**Replies:** 3\
**Last updated:** [July 9, 2021, 3:19pm UTC](https://discuss.elastic.co/t/how-do-i-reference-a-field-name-that-contains-a-dot-in-watcher-logging-action/266614 "2021-07-09T15:19:41Z")
An elastic template index got field names using dots ("property.name") and I am wondering if it is possible reference them using "ctx.payload.hits.hits.0.\_source" object. I did some different attempts without success. I…
---
## [ECK elasticsearch pod failing to start since it couldn't load persistent cache](https://discuss.elastic.co/t/eck-elasticsearch-pod-failing-to-start-since-it-couldnt-load-persistent-cache/277824)
**Author:** [@Sam\_Mellors](https://discuss.elastic.co/u/Sam_Mellors)\
**Replies:** 8\
**Last updated:** [July 9, 2021, 2:53pm UTC](https://discuss.elastic.co/t/eck-elasticsearch-pod-failing-to-start-since-it-couldnt-load-persistent-cache/277824 "2021-07-09T14:53:02Z")
Hi everyone! I have an ECK operator managed ES cluster of 3 nodes which I am trying to spin up with new persistent volume claims that are using old persistent volumes from a previous ES cluster. In order to do this I d…
---
## [Filebeat threatintel module error](https://discuss.elastic.co/t/filebeat-threatintel-module-error/278287)
**Author:** [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)\
**Replies:** 0\
**Last updated:** [July 9, 2021, 2:42pm UTC](https://discuss.elastic.co/t/filebeat-threatintel-module-error/278287 "2021-07-09T14:42:19Z")
Hello, I am trying the new threat intel module, I am having an error in the otx 2021-07-09T16:33:12.322+0200 ERROR \[input.httpjson-cursor.retryablehttp\] go-retryablehttp@v0.6.6/client.go:553 request failed%!(EXTRA stri…
---
## [Logstash .Conf file](https://discuss.elastic.co/t/logstash-conf-file/278194)
**Author:** [@Ashwin\_Patil1](https://discuss.elastic.co/u/Ashwin_Patil1)\
**Replies:** 9\
**Last updated:** [July 9, 2021, 2:40pm UTC](https://discuss.elastic.co/t/logstash-conf-file/278194 "2021-07-09T14:40:33Z")
I am trying to collect logs from multiple inputs and write them into 2 indices. Please refer the below conf file, am able to create a index called syslog but am not able to create index called winlog. All the logs are g…
[Previous page](https://discuss.elastic.co/latest.md?page=1578)
[Next page](https://discuss.elastic.co/latest.md?page=1580)