# Latest **URL:** https://discuss.elastic.co/latest.md?page=1612 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1613 --- ## [How To parse Multiline Message With Grok](https://discuss.elastic.co/t/how-to-parse-multiline-message-with-grok/276500)
**Author:** [@ankitdevnalkar](https://discuss.elastic.co/u/ankitdevnalkar)\ **Replies:** 6\ **Last updated:** [June 21, 2021, 10:47am UTC](https://discuss.elastic.co/t/how-to-parse-multiline-message-with-grok/276500 "2021-06-21T10:47:09Z")
I am working with AWS Cloudwatchs' GuardDuty finding events, I am getting GuardDuty event in the following format : "message": "\\n\\"AWS MY\_ACCOUNTID has a severity 2 GuardDuty finding type Recon:EC2/PortProbeUnprotected… --- ## [Elasticsearch not working](https://discuss.elastic.co/t/elasticsearch-not-working/274944)
**Author:** [@Drupad\_Soni](https://discuss.elastic.co/u/Drupad_Soni)\ **Replies:** 2\ **Last updated:** [June 21, 2021, 10:46am UTC](https://discuss.elastic.co/t/elasticsearch-not-working/274944 "2021-06-21T10:46:48Z")
Hi People, My elasticsearch fails to start please guide me thru this. Sharing error as below ● elasticsearch.service - Elasticsearch Loaded: loaded (/usr/lib/systemd/system/elasticsearch.service; disabled; vendor pres… --- ## [Using Ngrams for building a autocomplete suggester](https://discuss.elastic.co/t/using-ngrams-for-building-a-autocomplete-suggester/276520)
**Author:** [@Hooman\_Bahreini](https://discuss.elastic.co/u/Hooman_Bahreini)\ **Replies:** 0\ **Last updated:** [June 21, 2021, 10:19am UTC](https://discuss.elastic.co/t/using-ngrams-for-building-a-autocomplete-suggester/276520 "2021-06-21T10:19:47Z")
I have 2 fields in my index, Title and Description. Title obviously a short phrase (max 100 characters) and description is a long description (up to 5000 characters). I have built a autocomplete by building ngrams on T… --- ## [Conditional search in Lucene or Query DSL](https://discuss.elastic.co/t/conditional-search-in-lucene-or-query-dsl/276436)
**Author:** [@Eric\_Barreto](https://discuss.elastic.co/u/Eric_Barreto)\ **Replies:** 3\ **Last updated:** [June 21, 2021, 10:07am UTC](https://discuss.elastic.co/t/conditional-search-in-lucene-or-query-dsl/276436 "2021-06-21T10:07:56Z")
Hi guys, I'm trying to do a search via Lucene or Query DSL that does the following: I have a log that contains several fields, among them the sourceIp and resourceKey fields. I need to create a survey that shows me all… --- ## [408 HTTP Error when running filebeat setup](https://discuss.elastic.co/t/408-http-error-when-running-filebeat-setup/275817)
**Author:** [@pjvilloud](https://discuss.elastic.co/u/pjvilloud)\ **Replies:** 5\ **Last updated:** [June 21, 2021, 10:01am UTC](https://discuss.elastic.co/t/408-http-error-when-running-filebeat-setup/275817 "2021-06-21T10:01:19Z")
Hello ! I'm trying to run filebeat setup -e on my local machine and it fails with the following error error loading index pattern: returned 408 to import file: \. I'm using the latest version of filebeat (7.13.1) an… --- ## [Is it possible to get the %timefield% value on vega script](https://discuss.elastic.co/t/is-it-possible-to-get-the-timefield-value-on-vega-script/276191)
**Author:** [@ayanam](https://discuss.elastic.co/u/ayanam)\ **Replies:** 3\ **Last updated:** [June 21, 2021, 9:52am UTC](https://discuss.elastic.co/t/is-it-possible-to-get-the-timefield-value-on-vega-script/276191 "2021-06-21T09:52:40Z")
Hi, I'm actually working with vega in kibana, and I need to access to the two borns of date filter of kibana, In fact I've succeeded to limit the data processed to the range by specifying the "%timefield", but I also nee… --- ## [Filter products in shared catalogs with price range](https://discuss.elastic.co/t/filter-products-in-shared-catalogs-with-price-range/276264)
**Author:** [@thangld](https://discuss.elastic.co/u/thangld)\ **Replies:** 1\ **Last updated:** [June 21, 2021, 9:33am UTC](https://discuss.elastic.co/t/filter-products-in-shared-catalogs-with-price-range/276264 "2021-06-21T09:33:07Z")
Hi there, I have a store and use Elasticsearch for storing products. I need to filter products by price range. It is simple if products' price is the same to all customers, but in my case, customers from different grou… --- ## [Severe I/O performance degradation after Ubuntu 18.04 upgrade](https://discuss.elastic.co/t/severe-i-o-performance-degradation-after-ubuntu-18-04-upgrade/276509)
**Author:** [@amo1](https://discuss.elastic.co/u/amo1)\ **Replies:** 1\ **Last updated:** [June 21, 2021, 9:19am UTC](https://discuss.elastic.co/t/severe-i-o-performance-degradation-after-ubuntu-18-04-upgrade/276509 "2021-06-21T09:19:24Z")
Hi, We recently upgraded the OS on a couple of independently running hot/warm clusters. Each cluster has 9 nodes (3 masters, 3 hot nodes and 3 warm nodes) and are running on pretty decent hardware (32GB-64GB RAM on each… --- ## [Any way for an Elasticsearch plugin to override default api behavior?](https://discuss.elastic.co/t/any-way-for-an-elasticsearch-plugin-to-override-default-api-behavior/276255)
**Author:** [@Dor\_Levi](https://discuss.elastic.co/u/Dor_Levi)\ **Replies:** 1\ **Last updated:** [June 21, 2021, 9:10am UTC](https://discuss.elastic.co/t/any-way-for-an-elasticsearch-plugin-to-override-default-api-behavior/276255 "2021-06-21T09:10:30Z")
Hi, I'm playing around with Elastic, and wondered if there's anyway to dynamically override a default endpoint behavior. I tried creating a plugin which adds a BaseRestHandler, but when attempting to specify a route wh… --- ## [Want a fault tolerant search but got to much results](https://discuss.elastic.co/t/want-a-fault-tolerant-search-but-got-to-much-results/276311)
**Author:** [@Joni94](https://discuss.elastic.co/u/Joni94)\ **Replies:** 1\ **Last updated:** [June 21, 2021, 9:04am UTC](https://discuss.elastic.co/t/want-a-fault-tolerant-search-but-got-to-much-results/276311 "2021-06-21T09:04:29Z")
Hello, I am trying to set up an error-tolerant search and have created the field "name" as "text" in my index and would like to search for it. I expect to search for exactly what I entered but normalise the string befo… --- ## [Update by query after mapping change](https://discuss.elastic.co/t/update-by-query-after-mapping-change/276397)
**Author:** [@YvorL](https://discuss.elastic.co/u/YvorL)\ **Replies:** 1\ **Last updated:** [June 21, 2021, 8:57am UTC](https://discuss.elastic.co/t/update-by-query-after-mapping-change/276397 "2021-06-21T08:57:05Z")
Hi, In case I have a daily index and want to add a new field without waiting for the new index that would re-read the mapping template, I can use the Update mapping API. What I'm not 100% sure is that I would only need … --- ## [Enrich processor not working](https://discuss.elastic.co/t/enrich-processor-not-working/276367)
**Author:** [@sulsulatoff](https://discuss.elastic.co/u/sulsulatoff)\ **Replies:** 1\ **Last updated:** [June 21, 2021, 8:56am UTC](https://discuss.elastic.co/t/enrich-processor-not-working/276367 "2021-06-21T08:56:13Z")
Giving error \[indices:data/read/xpack/enrich/coordinate\_lookups\] is unauthorized for user \[myusername\] What privileges should be given to this user? --- ## [Does adding field collapsing improve the query latency](https://discuss.elastic.co/t/does-adding-field-collapsing-improve-the-query-latency/276426)
**Author:** [@Bhavik92](https://discuss.elastic.co/u/Bhavik92)\ **Replies:** 1\ **Last updated:** [June 21, 2021, 8:46am UTC](https://discuss.elastic.co/t/does-adding-field-collapsing-improve-the-query-latency/276426 "2021-06-21T08:46:55Z")
In elastic-search, I am using phrase\_prefix queries for my use case. Surprisingly, the query returns results much faster when adding collapse clause based on a field. This feels counter-intuitive to me since collapse sho… --- ## [Filebeat Multiline not working](https://discuss.elastic.co/t/filebeat-multiline-not-working/276506)
**Author:** [@SLIM\_SLIM](https://discuss.elastic.co/u/SLIM_SLIM)\ **Replies:** 0\ **Last updated:** [June 21, 2021, 8:43am UTC](https://discuss.elastic.co/t/filebeat-multiline-not-working/276506 "2021-06-21T08:43:01Z")
Hi, i want to regroup lines in log file (5 lines max), i want to regroup lines until (default task-XX) This is my filebeat config : fields\_under\_root: true multiline.type: pattern multiline.pattern: '\[0-9\]{4}-\[0-9\]{… --- ## [Elastic simple query with wildcard](https://discuss.elastic.co/t/elastic-simple-query-with-wildcard/276441)
**Author:** [@Vinoth\_G](https://discuss.elastic.co/u/Vinoth_G)\ **Replies:** 1\ **Last updated:** [June 21, 2021, 8:42am UTC](https://discuss.elastic.co/t/elastic-simple-query-with-wildcard/276441 "2021-06-21T08:42:31Z")
I am new to elastic and planning to migrate my application from algolia to elastic cloud. In algolia after creating an index and writing a document I can search by passing a search query, no need to specify wildcard pat… --- ## [Getting Elasticsearch exception while indexing using Python script](https://discuss.elastic.co/t/getting-elasticsearch-exception-while-indexing-using-python-script/276299)
**Author:** [@ravi-shanker](https://discuss.elastic.co/u/ravi-shanker)\ **Replies:** 2\ **Last updated:** [June 21, 2021, 8:35am UTC](https://discuss.elastic.co/t/getting-elasticsearch-exception-while-indexing-using-python-script/276299 "2021-06-21T08:35:20Z")
Hello All I am trying read, parse and index a html file using the below python script. from elasticsearch import Elasticsearch from bs4 import BeautifulSoup import glob es=Elasticsearch(\[{'host':'ip-address','port':9… --- ## [Watcher elastic query](https://discuss.elastic.co/t/watcher-elastic-query/274210)
**Author:** [@lucac](https://discuss.elastic.co/u/lucac)\ **Replies:** 4\ **Last updated:** [June 21, 2021, 8:29am UTC](https://discuss.elastic.co/t/watcher-elastic-query/274210 "2021-06-21T08:29:20Z")
Hello everybody, I'm trying to create in Elastic (the cloud version) a trigger / alert that, based on the value of an index field, sends an email. My index is, more or less, structured like this: id time… --- ## [Parse output of elasticsearch-py commands](https://discuss.elastic.co/t/parse-output-of-elasticsearch-py-commands/275879)
**Author:** [@tp20165](https://discuss.elastic.co/u/tp20165)\ **Replies:** 1\ **Last updated:** [June 21, 2021, 8:27am UTC](https://discuss.elastic.co/t/parse-output-of-elasticsearch-py-commands/275879 "2021-06-21T08:27:49Z")
I am writing on alerting functionality in Python using elasticsearch-py client. https://github.com/elastic/elasticserch-py. CatClient class has methods that I am interested in. I can see the output as stdout when I run m… --- ## [Watcher condition against buckets](https://discuss.elastic.co/t/watcher-condition-against-buckets/275870)
**Author:** [@rgreen](https://discuss.elastic.co/u/rgreen)\ **Replies:** 1\ **Last updated:** [June 21, 2021, 8:27am UTC](https://discuss.elastic.co/t/watcher-condition-against-buckets/275870 "2021-06-21T08:27:04Z")
I need to be able to write a condition for a watcher that will alert when the results from the Bucket Critical doc\_count is at 50% or higher of bucket Info doc\_count This is the aggregation results "aggregations" : … --- ## [Kibana 7.13.0 APM Dashboard not showing some environments](https://discuss.elastic.co/t/kibana-7-13-0-apm-dashboard-not-showing-some-environments/276394)
**Author:** [@adsandie](https://discuss.elastic.co/u/adsandie)\ **Replies:** 4\ **Last updated:** [June 21, 2021, 8:22am UTC](https://discuss.elastic.co/t/kibana-7-13-0-apm-dashboard-not-showing-some-environments/276394 "2021-06-21T08:22:44Z")
Hi, We are using 7.13.0 and we restore a snapshot from 7.7.1. Everything is working but we noticed that on Kibana APM Dashboard, the ActiveMQ Service has some servers that are not showing under Environment if there's no… --- ## [Overall traffic rollup](https://discuss.elastic.co/t/overall-traffic-rollup/276503)
**Author:** [@ghaithTK](https://discuss.elastic.co/u/ghaithTK)\ **Replies:** 0\ **Last updated:** [June 21, 2021, 8:09am UTC](https://discuss.elastic.co/t/overall-traffic-rollup/276503 "2021-06-21T08:09:12Z")
Hi I am trying to rollup (daily) network inbound traffic using field system.network.in.bytes. but when i use inbound visualization with rollup index i got this(image) what the problem and is there another way to ro… --- ## [Winlogbeat Missing Security Events after logfile rotation](https://discuss.elastic.co/t/winlogbeat-missing-security-events-after-logfile-rotation/272179)
**Author:** [@Ed\_28](https://discuss.elastic.co/u/Ed_28)\ **Replies:** 4\ **Last updated:** [June 21, 2021, 8:06am UTC](https://discuss.elastic.co/t/winlogbeat-missing-security-events-after-logfile-rotation/272179 "2021-06-21T08:06:59Z")
Version: 7.12.0 OS: Windows Server 2016 10 second time frame: 3221 reported 3282 Security event log During that timeframe the security log reaches Max log size and new logfile is created. Event log automatic backup … --- ## [Field host.ip problem](https://discuss.elastic.co/t/field-host-ip-problem/276498)
**Author:** [@rebug](https://discuss.elastic.co/u/rebug)\ **Replies:** 0\ **Last updated:** [June 21, 2021, 7:58am UTC](https://discuss.elastic.co/t/field-host-ip-problem/276498 "2021-06-21T07:58:25Z")
Hi guys. I have a problem, every index I made (using Filebeat modules or not) I have a field named host.ip with about 20 different IP address in it. I can't use it because it is unrelevant, anyone has the same problem … --- ## [Windows event message field](https://discuss.elastic.co/t/windows-event-message-field/276496)
**Author:** [@michaal1511](https://discuss.elastic.co/u/michaal1511)\ **Replies:** 0\ **Last updated:** [June 21, 2021, 7:39am UTC](https://discuss.elastic.co/t/windows-event-message-field/276496 "2021-06-21T07:39:15Z")
Hi, how can I parse message string to seperate lines? Example: Line1 = An account was logged off. Subject: Line2 = Security ID: XXXX Line3 = Account Name: XXXX Line4 = Account Domain: XXX Line5 = Logon ID:… --- ## [Disabling "View single document"](https://discuss.elastic.co/t/disabling-view-single-document/275832)
**Author:** [@kerbero](https://discuss.elastic.co/u/kerbero)\ **Replies:** 2\ **Last updated:** [June 21, 2021, 7:29am UTC](https://discuss.elastic.co/t/disabling-view-single-document/275832 "2021-06-21T07:29:47Z")
I have a doubt about kibana dashboard, Is it possible to disable the "View single document" button? This button is located when Kibana shows a document information both in table format as well as json. Thanks. --- ## [Logstash Application throwing up warning "Connection reset by peer"](https://discuss.elastic.co/t/logstash-application-throwing-up-warning-connection-reset-by-peer/276489)
**Author:** [@theju0805](https://discuss.elastic.co/u/theju0805)\ **Replies:** 0\ **Last updated:** [June 21, 2021, 7:14am UTC](https://discuss.elastic.co/t/logstash-application-throwing-up-warning-connection-reset-by-peer/276489 "2021-06-21T07:14:08Z")
Logstash application throwing up warning "Connection reset by peer". Logstash is hosted on Azure. This warning doesn't exist or occur on the VM, but after the VM is scaled up(VMSS) I see the warning coming up continuous… --- ## [filter\>jdbc\_streaming\>\[Oracle\] Delete Query return “\[Warn\] ORA-01002”](https://discuss.elastic.co/t/filter-jdbc-streaming-oracle-delete-query-return-warn-ora-01002/273907)
**Author:** [@zeraf29](https://discuss.elastic.co/u/zeraf29)\ **Replies:** 1\ **Last updated:** [June 21, 2021, 6:55am UTC](https://discuss.elastic.co/t/filter-jdbc-streaming-oracle-delete-query-return-warn-ora-01002/273907 "2021-06-21T06:55:28Z")
Hi. Nice to meet you. I try to make logstash-pipeline which works like below. (1)Input: JDBC plugin-Select data on Oracle DBMS (2)Filter: JDBC\_STREAMING plugin- Delete Data slected by input plugin results (3)Output: … --- ## [Filebeat Dissect Processor](https://discuss.elastic.co/t/filebeat-dissect-processor/276350)
**Author:** [@Anabella\_Cristaldi](https://discuss.elastic.co/u/Anabella_Cristaldi)\ **Replies:** 2\ **Last updated:** [June 21, 2021, 5:30am UTC](https://discuss.elastic.co/t/filebeat-dissect-processor/276350 "2021-06-21T05:30:24Z")
Hi All, I was testing the dissect processor in filebeat with this "%{ip\_address} - %{user} \[%{by\_date|date}\] \\"%{request}\\" %{response\_code} %{response\_size} %{msg\_tail}" and I wanted to test directly to convert the f… --- ## [Elasticsearch force parallel collector by default](https://discuss.elastic.co/t/elasticsearch-force-parallel-collector-by-default/276476)
**Author:** [@RAM\_NATHAN](https://discuss.elastic.co/u/RAM_NATHAN)\ **Replies:** 2\ **Last updated:** [June 21, 2021, 5:25am UTC](https://discuss.elastic.co/t/elasticsearch-force-parallel-collector-by-default/276476 "2021-06-21T05:25:42Z")
Im getting below error while adding nodes to cluster. Im using Elasticsearch 7.10.2 . I was not getting this error in 7.4.2 \[1\] bootstrap checks failed \[1\]: JVM is using the serial collector but should not be for the b… --- ## [Question on using my own value as \_id](https://discuss.elastic.co/t/question-on-using-my-own-value-as-id/276470)
**Author:** [@pk.241011](https://discuss.elastic.co/u/pk.241011)\ **Replies:** 4\ **Last updated:** [June 21, 2021, 6:15am UTC](https://discuss.elastic.co/t/question-on-using-my-own-value-as-id/276470 "2021-06-21T06:15:18Z")
Hi As per this post it is not advisable to bring your own \_id to elasticsearch. I have inherited a shared windows (horror of all the horrors) drive as a source of log file and already see re-ingestion happening occasion… [Previous page](https://discuss.elastic.co/latest.md?page=1611) [Next page](https://discuss.elastic.co/latest.md?page=1613)