# Latest **URL:** https://discuss.elastic.co/latest.md?page=1621 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1622 --- ## [Filebeat is not authenticating with elasticsearch after xpack was enabled](https://discuss.elastic.co/t/filebeat-is-not-authenticating-with-elasticsearch-after-xpack-was-enabled/275909)
**Author:** [@Antonio\_Chadwick](https://discuss.elastic.co/u/Antonio_Chadwick)\ **Replies:** 5\ **Last updated:** [June 15, 2021, 10:07pm UTC](https://discuss.elastic.co/t/filebeat-is-not-authenticating-with-elasticsearch-after-xpack-was-enabled/275909 "2021-06-15T22:07:09Z")
Hi Team, I have a local setup that running ubuntu which i have elasticsearch and kibana running on, and a separate box running centOS, which has filebeat installed on this is the server. I want to monitor logs from this… --- ## [Is it possible to combine two docs in different indices?](https://discuss.elastic.co/t/is-it-possible-to-combine-two-docs-in-different-indices/276035)
**Author:** [@attiley](https://discuss.elastic.co/u/attiley)\ **Replies:** 1\ **Last updated:** [June 15, 2021, 10:03pm UTC](https://discuss.elastic.co/t/is-it-possible-to-combine-two-docs-in-different-indices/276035 "2021-06-15T22:03:45Z")
Hello guys! If I have two docs in two different indices. One doc in index "content" is like this { "id": "content\_id", "content": random content, "user\_details":{ "user\_id":"123" } } and anoth… --- ## [CPU,RAM spec details for Elasticsearch Master & Data nodes](https://discuss.elastic.co/t/cpu-ram-spec-details-for-elasticsearch-master-data-nodes/276038)
**Author:** [@purushothamkdr143](https://discuss.elastic.co/u/purushothamkdr143)\ **Replies:** 1\ **Last updated:** [June 15, 2021, 10:02pm UTC](https://discuss.elastic.co/t/cpu-ram-spec-details-for-elasticsearch-master-data-nodes/276038 "2021-06-15T22:02:16Z")
Hi All, I am setting up elasticsearch cluster on k8s using eck operator. From the document I understood that Heapsize should be no more than 50% of Allocated RAM so passed the details accordingly. Details: k8 cluster:… --- ## [Is it possible to integrate anomaly detection with large amounts of data using Amazon's Elastiservice? Detection keeps on crashing when parsing through the information](https://discuss.elastic.co/t/is-it-possible-to-integrate-anomaly-detection-with-large-amounts-of-data-using-amazons-elastiservice-detection-keeps-on-crashing-when-parsing-through-the-information/276046)
**Author:** [@kanrab](https://discuss.elastic.co/u/kanrab)\ **Replies:** 1\ **Last updated:** [June 15, 2021, 9:53pm UTC](https://discuss.elastic.co/t/is-it-possible-to-integrate-anomaly-detection-with-large-amounts-of-data-using-amazons-elastiservice-detection-keeps-on-crashing-when-parsing-through-the-information/276046 "2021-06-15T21:53:56Z")
I am parsing large amounts of information and want to use this feature without it crashing --- ## [How do you detect any malicious traffic through baselines via Amazon's Elastiservice?](https://discuss.elastic.co/t/how-do-you-detect-any-malicious-traffic-through-baselines-via-amazons-elastiservice/276048)
**Author:** [@kanrab](https://discuss.elastic.co/u/kanrab)\ **Replies:** 1\ **Last updated:** [June 15, 2021, 9:52pm UTC](https://discuss.elastic.co/t/how-do-you-detect-any-malicious-traffic-through-baselines-via-amazons-elastiservice/276048 "2021-06-15T21:52:57Z")
I am looking for an effective way to parse through all the data --- ## [Kibana timeseries with stacked bar graph](https://discuss.elastic.co/t/kibana-timeseries-with-stacked-bar-graph/275464)
**Author:** [@rmartinez.rv](https://discuss.elastic.co/u/rmartinez.rv)\ **Replies:** 2\ **Last updated:** [June 15, 2021, 9:42pm UTC](https://discuss.elastic.co/t/kibana-timeseries-with-stacked-bar-graph/275464 "2021-06-15T21:42:30Z")
Hi. I'm looking for help with getting a "particular" graph from kibana. I have an index in my elastic server filling with this kind of information: { "\_index": "register", "\_type": "\_doc", "\_id": "6kRQ8XkBeDPVH1… --- ## [How to drop a block of lines in logstash filter?](https://discuss.elastic.co/t/how-to-drop-a-block-of-lines-in-logstash-filter/276053)
**Author:** [@Patr123](https://discuss.elastic.co/u/Patr123)\ **Replies:** 0\ **Last updated:** [June 15, 2021, 8:29pm UTC](https://discuss.elastic.co/t/how-to-drop-a-block-of-lines-in-logstash-filter/276053 "2021-06-15T20:29:50Z")
I have these lines in my websphere Systemout.log file: \*\*\*\*\*\*\*\*\*\*\*\* Start Display Current Environment \*\*\*\*\*\*\*\*\*\*\*\* line 1 line 2 line 3 line 4 line 5 line 7 \*\*\*\*\*\*\*\*\*\*\*\*\* End Display Current Environment \*\*\*\*\*\*\*\*\*\*\*\*\* H… --- ## [Is there a way to query/filter for just RFC Non-Compliant Traffic?](https://discuss.elastic.co/t/is-there-a-way-to-query-filter-for-just-rfc-non-compliant-traffic/275155)
**Author:** [@kanrab](https://discuss.elastic.co/u/kanrab)\ **Replies:** 3\ **Last updated:** [June 15, 2021, 8:14pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-query-filter-for-just-rfc-non-compliant-traffic/275155 "2021-06-15T20:14:41Z")
I was unable to come up with a come up with anything. Any ideas? --- ## [How does kibana regenerate the target file](https://discuss.elastic.co/t/how-does-kibana-regenerate-the-target-file/275237)
**Author:** [@541002492](https://discuss.elastic.co/u/541002492)\ **Replies:** 3\ **Last updated:** [June 15, 2021, 7:59pm UTC](https://discuss.elastic.co/t/how-does-kibana-regenerate-the-target-file/275237 "2021-06-15T19:59:46Z")
I want to modify one of kibana's index.js files, but running the modification does not take effect. Looking at the browser, I find that the browser is loading the target file. How to recompile the index.js file to genera… --- ## [Filebeat Stops Processing logs for AWS module](https://discuss.elastic.co/t/filebeat-stops-processing-logs-for-aws-module/275993)
**Author:** [@ankitdevnalkar](https://discuss.elastic.co/u/ankitdevnalkar)\ **Replies:** 7\ **Last updated:** [June 15, 2021, 7:38pm UTC](https://discuss.elastic.co/t/filebeat-stops-processing-logs-for-aws-module/275993 "2021-06-15T19:38:56Z")
I am facing exactly the same issue as this thread Filebeat stops proccessing s3 input with no error. Also, I experienced sometimes Filebeat suddenly stops processing data for other modules too, I faced it with Gsuite mo… --- ## [Logstash does not parse all logs with file as input](https://discuss.elastic.co/t/logstash-does-not-parse-all-logs-with-file-as-input/276044)
**Author:** [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\ **Replies:** 1\ **Last updated:** [June 15, 2021, 7:22pm UTC](https://discuss.elastic.co/t/logstash-does-not-parse-all-logs-with-file-as-input/276044 "2021-06-15T19:22:20Z")
Hi All. I am using file input plugin to read logs. My config looks like below: input { file { path =\> "/opt/gtal/iptal/elasticsearch/app/logstash/stage/CVMQA\_UAT\_STATS-\*.txt" codec =\> multiline { pattern =\> "… --- ## [Is there a way to get all doc ID's from an index for a specified time range?](https://discuss.elastic.co/t/is-there-a-way-to-get-all-doc-ids-from-an-index-for-a-specified-time-range/275885)
**Author:** [@aidenosi](https://discuss.elastic.co/u/aidenosi)\ **Replies:** 3\ **Last updated:** [June 15, 2021, 5:34pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-get-all-doc-ids-from-an-index-for-a-specified-time-range/275885 "2021-06-15T17:34:35Z")
Hello, We recently had an issue that caused one of our servers to report as "down" to heartbeat even though it was up. This caused us to have 3 days of "downtime" in our metrics. We want to fix this by going through and… --- ## [Winlogbeat 7.13.0 expected int but got type string in equals condition](https://discuss.elastic.co/t/winlogbeat-7-13-0-expected-int-but-got-type-string-in-equals-condition/274273)
**Author:** [@VamPikmin](https://discuss.elastic.co/u/VamPikmin)\ **Replies:** 5\ **Last updated:** [June 15, 2021, 5:17pm UTC](https://discuss.elastic.co/t/winlogbeat-7-13-0-expected-int-but-got-type-string-in-equals-condition/274273 "2021-06-15T17:17:58Z")
I've upgraded to the latest version and winlogbeat is not sending data anymore The changes in 7.13.0 Change event.code and winlog.event\_id from int to keyword. I'm seeing a lot of these WARN \[conditions\] condit… --- ## [Elasticsearch Performance Issues Upgrading v6.2.3 to v7.13.1](https://discuss.elastic.co/t/elasticsearch-performance-issues-upgrading-v6-2-3-to-v7-13-1/275611)
**Author:** [@radleta](https://discuss.elastic.co/u/radleta)\ **Replies:** 2\ **Last updated:** [June 15, 2021, 5:06pm UTC](https://discuss.elastic.co/t/elasticsearch-performance-issues-upgrading-v6-2-3-to-v7-13-1/275611 "2021-06-15T17:06:53Z")
We've been working on an upgrade from Elasticsearch cluster running v6.2.3 to v7.13.1 and running into a major performance roadblock. We are running the versions side-by-side and trying to cut-over to the new version bu… --- ## [Rename strings field to nested field](https://discuss.elastic.co/t/rename-strings-field-to-nested-field/275912)
**Author:** [@frank\_rib](https://discuss.elastic.co/u/frank_rib)\ **Replies:** 6\ **Last updated:** [June 15, 2021, 4:48pm UTC](https://discuss.elastic.co/t/rename-strings-field-to-nested-field/275912 "2021-06-15T16:48:00Z")
Hello every body, I want to parse the logs bellow Apr 20 01:10:04 hostname sshproxy\[150\]: \[SSH Session\] session\_id="56454646eaeazjajflen" client\_ip="X.X.X.X" target\_ip="X.X.X.X" user="X.X.X.X" device="X.X.X.X" service… --- ## [Elasticsearch cluster with 2 nodes](https://discuss.elastic.co/t/elasticsearch-cluster-with-2-nodes/275588)
**Author:** [@dddddddddddddddd](https://discuss.elastic.co/u/dddddddddddddddd)\ **Replies:** 4\ **Last updated:** [June 15, 2021, 4:35pm UTC](https://discuss.elastic.co/t/elasticsearch-cluster-with-2-nodes/275588 "2021-06-15T16:35:16Z")
hi I hope this message finds you well I have situation where I have installed two instance of Elasticsearch setup in remote server 1 (node1) and remote server 2 (node2), and I want to connect both these node in one clu… --- ## [High Disk IO utilization in filebeat and logstash nodes](https://discuss.elastic.co/t/high-disk-io-utilization-in-filebeat-and-logstash-nodes/276032)
**Author:** [@bhavaniprasad\_reddy](https://discuss.elastic.co/u/bhavaniprasad_reddy)\ **Replies:** 0\ **Last updated:** [June 15, 2021, 4:30pm UTC](https://discuss.elastic.co/t/high-disk-io-utilization-in-filebeat-and-logstash-nodes/276032 "2021-06-15T16:30:55Z")
I see high Disk IO utilization in nodes where filebeat and logstash pods are running. This is lowering the event collection rates in all the nodes. I do not know what are the factors that are effecting the event collect… --- ## [Way to change the version of JARs used in Elasticsearch](https://discuss.elastic.co/t/way-to-change-the-version-of-jars-used-in-elasticsearch/275999)
**Author:** [@Ripu\_Sudan](https://discuss.elastic.co/u/Ripu_Sudan)\ **Replies:** 1\ **Last updated:** [June 15, 2021, 4:05pm UTC](https://discuss.elastic.co/t/way-to-change-the-version-of-jars-used-in-elasticsearch/275999 "2021-06-15T16:05:30Z")
I've used the latest version of Elasticsearch docker image, As in image you can see the listing of JARs used, On running vulnerabilities test on image, some modules gives vulnerabilities, like jackson-dataformat-cbor-… --- ## [How do I divide two metrics calculated in bar-chart](https://discuss.elastic.co/t/how-do-i-divide-two-metrics-calculated-in-bar-chart/276024)
**Author:** [@Dhruv\_Makwana](https://discuss.elastic.co/u/Dhruv_Makwana)\ **Replies:** 1\ **Last updated:** [June 15, 2021, 3:52pm UTC](https://discuss.elastic.co/t/how-do-i-divide-two-metrics-calculated-in-bar-chart/276024 "2021-06-15T15:52:34Z")
I want to divide two metrics which were calculated by sum and count at the y-axis in Bar-graphs. I went through some discussion, for the newer version there's supposed to calculation field in metrics aggregation. But… --- ## [Управление ILM из Logstash для Filebeat](https://discuss.elastic.co/t/ilm-logstash-filebeat/275200)
**Author:** [@Sergei\_Frolov](https://discuss.elastic.co/u/Sergei_Frolov)\ **Replies:** 2\ **Last updated:** [June 15, 2021, 3:39pm UTC](https://discuss.elastic.co/t/ilm-logstash-filebeat/275200 "2021-06-15T15:39:11Z")
Добрый день. Хочу сделать централизованную отправку логов, собранных модулями Filebeat в кафку, и из кафки - в Elasticsearch. Делаю как написано в этой инструкции: Это работает, но получаю ошибки ILM при такой конст… --- ## [It is possible to use two filters within a query in NodeJs?](https://discuss.elastic.co/t/it-is-possible-to-use-two-filters-within-a-query-in-nodejs/276029)
**Author:** [@Sebastian\_Marroquin](https://discuss.elastic.co/u/Sebastian_Marroquin)\ **Replies:** 0\ **Last updated:** [June 15, 2021, 3:39pm UTC](https://discuss.elastic.co/t/it-is-possible-to-use-two-filters-within-a-query-in-nodejs/276029 "2021-06-15T15:39:09Z")
Hello everybody. I was wondering if it is possible to have within a variable in NodeJs two types of filters, for example: query = { "bool": { … --- ## [Overwrite @timestamp with log timestamp](https://discuss.elastic.co/t/overwrite-timestamp-with-log-timestamp/275713)
**Author:** [@Evan\_W](https://discuss.elastic.co/u/Evan_W)\ **Replies:** 5\ **Last updated:** [June 15, 2021, 3:28pm UTC](https://discuss.elastic.co/t/overwrite-timestamp-with-log-timestamp/275713 "2021-06-15T15:28:47Z")
As the title says, I'm looking to overwrite ingest timestamp to reflect the actual timestamp pulled from log data. I've already got a custom regex that can pull this timestamp out of my logs as its own unique field, but … --- ## [How would I parse further the syslog5424\_msg in a syslog event in logstash conf?](https://discuss.elastic.co/t/how-would-i-parse-further-the-syslog5424-msg-in-a-syslog-event-in-logstash-conf/275964)
**Author:** [@devashishsingh](https://discuss.elastic.co/u/devashishsingh)\ **Replies:** 4\ **Last updated:** [June 15, 2021, 2:47pm UTC](https://discuss.elastic.co/t/how-would-i-parse-further-the-syslog5424-msg-in-a-syslog-event-in-logstash-conf/275964 "2021-06-15T14:47:54Z")
Hello, I have parsed the XML log format coming from a syslog source as defined in logstash config file. What shall be done further to parse the syslog message field within the XML? Below is the config: input { tcp … --- ## [Request Body is Required](https://discuss.elastic.co/t/request-body-is-required/275691)
**Author:** [@Tim\_Mobley](https://discuss.elastic.co/u/Tim_Mobley)\ **Replies:** 3\ **Last updated:** [June 15, 2021, 2:41pm UTC](https://discuss.elastic.co/t/request-body-is-required/275691 "2021-06-15T14:41:50Z")
I am attempting to use the reindex API to combine indices for the month into one single index: POST \_reindex?pretty { "conflicts": "proceed", "source": { "index": "my-index-2021.04.\*" }, "dest": { "index… --- ## [Heartbeat ask for unnecessary cluster privileges at startup](https://discuss.elastic.co/t/heartbeat-ask-for-unnecessary-cluster-privileges-at-startup/275814)
**Author:** [@iorfix](https://discuss.elastic.co/u/iorfix)\ **Replies:** 5\ **Last updated:** [June 15, 2021, 2:28pm UTC](https://discuss.elastic.co/t/heartbeat-ask-for-unnecessary-cluster-privileges-at-startup/275814 "2021-06-15T14:28:43Z")
Hi all, I'm using Heartbeat 7.13.1. I first setup templates and ILM policy with elastic superuser, and then I start heartbeat using a ristrected "apikey" user. However, I have this error at startup: {"log.level":"err… --- ## [Nested field size script](https://discuss.elastic.co/t/nested-field-size-script/276013)
**Author:** [@tfe2012](https://discuss.elastic.co/u/tfe2012)\ **Replies:** 0\ **Last updated:** [June 15, 2021, 2:06pm UTC](https://discuss.elastic.co/t/nested-field-size-script/276013 "2021-06-15T14:06:35Z")
Hi, I try to get all documents which nested field size \> 1 my mapping: "selectStatsListNested" : { "type" : "nested", "properties" : { "isSampleSelect" : { "type" : "boolea… --- ## [I would like to concatenate date and time fields with logstash](https://discuss.elastic.co/t/i-would-like-to-concatenate-date-and-time-fields-with-logstash/275992)
**Author:** [@sudo-ranjith](https://discuss.elastic.co/u/sudo-ranjith)\ **Replies:** 2\ **Last updated:** [June 15, 2021, 2:05pm UTC](https://discuss.elastic.co/t/i-would-like-to-concatenate-date-and-time-fields-with-logstash/275992 "2021-06-15T14:05:52Z")
Hi There, I have two fields date and time("10/26/20","09:30:53"). My Grok patterns are "%{DATA:date}","%{DATA:time}" I would like to concatenate these two fields as datetime, Could you please help me on the same. --- ## [Configure logstash to recieve logs from Openshift 4 and fluentdForward](https://discuss.elastic.co/t/configure-logstash-to-recieve-logs-from-openshift-4-and-fluentdforward/276012)
**Author:** [@sudden74](https://discuss.elastic.co/u/sudden74)\ **Replies:** 0\ **Last updated:** [June 15, 2021, 2:00pm UTC](https://discuss.elastic.co/t/configure-logstash-to-recieve-logs-from-openshift-4-and-fluentdforward/276012 "2021-06-15T14:00:41Z")
We have configured the fluentdForward on Openshift 4.7 to send logs to an external ELK stack. Logs are arriving to logstash but we are not able to decode the messages correctly. It looks like the special characters are r… --- ## [Is it necessary to give only elasticsearch master nodes in kibana config](https://discuss.elastic.co/t/is-it-necessary-to-give-only-elasticsearch-master-nodes-in-kibana-config/275543)
**Author:** [@elk11](https://discuss.elastic.co/u/elk11)\ **Replies:** 1\ **Last updated:** [June 15, 2021, 1:57pm UTC](https://discuss.elastic.co/t/is-it-necessary-to-give-only-elasticsearch-master-nodes-in-kibana-config/275543 "2021-06-15T13:57:55Z")
Elasticsearch and Kibana version: 7.3.1 I'm deploying Elasticsearch (3 nodes) and Kibana on docker. node1: elasticsearch master(data) and kibana node2: elasticsearch (data) node3: elasticsearch (data) our kibana con… --- ## [Beats 7.13.1 Helm Charts Missing/Removed?](https://discuss.elastic.co/t/beats-7-13-1-helm-charts-missing-removed/275854)
**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Replies:** 2\ **Last updated:** [June 15, 2021, 1:24pm UTC](https://discuss.elastic.co/t/beats-7-13-1-helm-charts-missing-removed/275854 "2021-06-15T13:24:58Z")
I was trying to upgrade a helm deployment of Filebeat and Metricbeat to 7.13.1 and noticed that only 7.13.0 is available for it. 7.13.1 was available last week. Were the 7.13.1 charts removed for a specific reason? [Previous page](https://discuss.elastic.co/latest.md?page=1620) [Next page](https://discuss.elastic.co/latest.md?page=1622)