# Latest **URL:** https://discuss.elastic.co/latest.md?page=1631 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1632 --- ## [Filebeat netflow huawei](https://discuss.elastic.co/t/filebeat-netflow-huawei/275515)
**Author:** [@VamPikmin](https://discuss.elastic.co/u/VamPikmin)\ **Replies:** 0\ **Last updated:** [June 10, 2021, 4:42am UTC](https://discuss.elastic.co/t/filebeat-netflow-huawei/275515 "2021-06-10T04:42:20Z")
Hey all, I've been testing netflow from Huawei AR2200 Keep getting the following No template for ID 5000 2021-06-10T14:30:14.874+1000 DEBUG \[input\] input/input.go:139 Run input 2021-06-10T14:30:23.305+1000 DEBUG \[netf… --- ## [Constant Unassigned Shards](https://discuss.elastic.co/t/constant-unassigned-shards/275486)
**Author:** [@Oleksandr.Tedikov](https://discuss.elastic.co/u/Oleksandr.Tedikov)\ **Replies:** 7\ **Last updated:** [June 10, 2021, 4:21am UTC](https://discuss.elastic.co/t/constant-unassigned-shards/275486 "2021-06-10T04:21:05Z")
Hello, I have Elastic Cluster with the following Configuration: 3 Master Nodes (JVM Heap Ram 4 GB, 1 CPU, 1 GB Disk) 10 Data/Ingest Nodes (JVM Heap Ram 8 GB, 2 CPU, 500 GB Disk) ~200 Indexes Each Index has 2 Replica… --- ## [Logstash 7.13.1 Windows pipeline.separate\_logs Problem](https://discuss.elastic.co/t/logstash-7-13-1-windows-pipeline-separate-logs-problem/275503)
**Author:** [@KSib](https://discuss.elastic.co/u/KSib)\ **Replies:** 4\ **Last updated:** [June 10, 2021, 3:58am UTC](https://discuss.elastic.co/t/logstash-7-13-1-windows-pipeline-separate-logs-problem/275503 "2021-06-10T03:58:21Z")
I'm not sure what's going on here. I'm using Logstash 7.13.1 on Windows Server 2019. When I run logstash with the following C:\\Elastic\\logstash\\bin\\logstash.bat -f "C:\\Elastic\\logstash\\redacted-config\\pipeline\\\_temp\\cus… --- ## [Filebeat iis module time taken field](https://discuss.elastic.co/t/filebeat-iis-module-time-taken-field/275504)
**Author:** [@Garry](https://discuss.elastic.co/u/Garry)\ **Replies:** 1\ **Last updated:** [June 10, 2021, 3:35am UTC](https://discuss.elastic.co/t/filebeat-iis-module-time-taken-field/275504 "2021-06-10T03:35:49Z")
Using the filebeat iis module in v7.13, I cannot explicitly see the time taken field. Am I missing something or has it been replaced with event duration? The iis logs exports all fields. --- ## [Logstash is unable to push logs to elasticsearch even ssl verify is set to fals](https://discuss.elastic.co/t/logstash-is-unable-to-push-logs-to-elasticsearch-even-ssl-verify-is-set-to-fals/275510)
**Author:** [@prataprajasekhar](https://discuss.elastic.co/u/prataprajasekhar)\ **Replies:** 1\ **Last updated:** [June 10, 2021, 3:02am UTC](https://discuss.elastic.co/t/logstash-is-unable-to-push-logs-to-elasticsearch-even-ssl-verify-is-set-to-fals/275510 "2021-06-10T03:02:27Z")
Dear Friends, I have enabled TLS/SSL in my elasticsearch latest version and all my filebeat, metricbeats are working perfectly. However, logstash is unable to connect to elasticsearch after enabling TLS and return the … --- ## [Kafka publish failed with: kafka: client has run out of available brokers to talk to (Is your cluster reachable?)](https://discuss.elastic.co/t/kafka-publish-failed-with-kafka-client-has-run-out-of-available-brokers-to-talk-to-is-your-cluster-reachable/274805)
**Author:** [@suyannam](https://discuss.elastic.co/u/suyannam)\ **Replies:** 1\ **Last updated:** [June 10, 2021, 2:56am UTC](https://discuss.elastic.co/t/kafka-publish-failed-with-kafka-client-has-run-out-of-available-brokers-to-talk-to-is-your-cluster-reachable/274805 "2021-06-10T02:56:08Z")
Dear friends, need your help. For last couple of days stuck with below error. we are trying to send application logs to kafka, below is the kafka output config. We want to use kerberose auth type. I am not sure whether … --- ## [Understanding scaling for a read heavy cluster](https://discuss.elastic.co/t/understanding-scaling-for-a-read-heavy-cluster/275322)
**Author:** [@andyleanlibrary](https://discuss.elastic.co/u/andyleanlibrary)\ **Replies:** 3\ **Last updated:** [June 10, 2021, 1:05am UTC](https://discuss.elastic.co/t/understanding-scaling-for-a-read-heavy-cluster/275322 "2021-06-10T01:05:36Z")
Hi, I'm trying to understand how to scale an Elasticsearch cluster which is extremely slow right now! Can anyone help? It's approx. 124,000,000 documents totalling about 60GB. I index the data once per month. In term… --- ## [How to round a value in an aggregation query?](https://discuss.elastic.co/t/how-to-round-a-value-in-an-aggregation-query/275509)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 0\ **Last updated:** [June 10, 2021, 12:31am UTC](https://discuss.elastic.co/t/how-to-round-a-value-in-an-aggregation-query/275509 "2021-06-10T00:31:53Z")
Hi Im trying to round the value of "forecast\_prediction" in an aggs query, I have tried bucket script aggregation but is not working "aggs": { "jobid": { "terms": { "field… --- ## [@timestamp for time zone issues](https://discuss.elastic.co/t/timestamp-for-time-zone-issues/275507)
**Author:** [@asasas234](https://discuss.elastic.co/u/asasas234)\ **Replies:** 0\ **Last updated:** [June 9, 2021, 11:11pm UTC](https://discuss.elastic.co/t/timestamp-for-time-zone-issues/275507 "2021-06-09T23:11:32Z")
I have an old logstash docker image, its version is 6.2.2 and the time zone is +0800, my new logstash docker image version is 7.12.1 , the time zone is +0000, but there is a surprising result, the final output @timestamp … --- ## [Kibana discover does not display system index data](https://discuss.elastic.co/t/kibana-discover-does-not-display-system-index-data/275425)
**Author:** [@asasas234](https://discuss.elastic.co/u/asasas234)\ **Replies:** 5\ **Last updated:** [June 9, 2021, 11:04pm UTC](https://discuss.elastic.co/t/kibana-discover-does-not-display-system-index-data/275425 "2021-06-09T23:04:09Z")
I have 1 index, it uses datastream, the name is .ds-xxx, currently the data can be written normally and query by GET request, but kibana discover does not show any data on this index, I created indext pattern when the sy… --- ## [Ingesting JSON Data Samples w/ Logstash](https://discuss.elastic.co/t/ingesting-json-data-samples-w-logstash/275185)
**Author:** [@pkward](https://discuss.elastic.co/u/pkward)\ **Replies:** 33\ **Last updated:** [June 9, 2021, 9:57pm UTC](https://discuss.elastic.co/t/ingesting-json-data-samples-w-logstash/275185 "2021-06-09T21:57:10Z")
Hello, I'm trying to test a machine learning classifier in elasticsearch, but I am having a hard time ingesting my data. I've tried using JQ to stream the data via Bulk API, so now I'm ready to try Logstash which may be… --- ## [Elasticsearch 7.13 "Cannot Find License/Not a Valid License"](https://discuss.elastic.co/t/elasticsearch-7-13-cannot-find-license-not-a-valid-license/275362)
**Author:** [@pkward](https://discuss.elastic.co/u/pkward)\ **Replies:** 2\ **Last updated:** [June 9, 2021, 9:55pm UTC](https://discuss.elastic.co/t/elasticsearch-7-13-cannot-find-license-not-a-valid-license/275362 "2021-06-09T21:55:54Z")
I was ingesting data via Logstash, and I was using the \_count API to view how many documents were being ingested. And all of a sudden my Elasticsearch master was unreachable, and it stated that the license cannot be foun… --- ## [Kibana Access logs](https://discuss.elastic.co/t/kibana-access-logs/275428)
**Author:** [@Prasanth\_V](https://discuss.elastic.co/u/Prasanth_V)\ **Replies:** 1\ **Last updated:** [June 9, 2021, 9:50pm UTC](https://discuss.elastic.co/t/kibana-access-logs/275428 "2021-06-09T21:50:50Z")
How can configure the Kibana access log? it meant whoever using services will get logged.... --- ## [Multiline stacktrace in JSON not parsed by Filebeat/seen in Kibana](https://discuss.elastic.co/t/multiline-stacktrace-in-json-not-parsed-by-filebeat-seen-in-kibana/275502)
**Author:** [@jcklie](https://discuss.elastic.co/u/jcklie)\ **Replies:** 1\ **Last updated:** [June 9, 2021, 9:44pm UTC](https://discuss.elastic.co/t/multiline-stacktrace-in-json-not-parsed-by-filebeat-seen-in-kibana/275502 "2021-06-09T21:44:37Z")
I use JSON Template Layout from Apache log4j to log to jsonl. Then I use Filebeat to ingest this: filebeat.inputs: - type: log enabled: true paths: - /srv/inception-stable/logs/inception-stable.log - /srv/i… --- ## [Kibana alerting: log threshold using OR](https://discuss.elastic.co/t/kibana-alerting-log-threshold-using-or/275496)
**Author:** [@tslattery](https://discuss.elastic.co/u/tslattery)\ **Replies:** 1\ **Last updated:** [June 9, 2021, 9:44pm UTC](https://discuss.elastic.co/t/kibana-alerting-log-threshold-using-or/275496 "2021-06-09T21:44:06Z")
Is it possible to create a log threshold condition that triggers if event.keyword is apConnectionLost OR event.keyword is apConnected? The UI is only allowing the AND operation. WHEN THE count OF LOG ENTRIES WITH event… --- ## [Filebeat losing logs](https://discuss.elastic.co/t/filebeat-losing-logs/275501)
**Author:** [@devopscanada](https://discuss.elastic.co/u/devopscanada)\ **Replies:** 0\ **Last updated:** [June 9, 2021, 9:38pm UTC](https://discuss.elastic.co/t/filebeat-losing-logs/275501 "2021-06-09T21:38:53Z")
Hello, see this question for context. I'm running filebeat 7.13.1 in Kubernetes (GKE) with this running configuration: kubectl exec filebeat-filebeat-2rmhh -- filebeat export config filebeat: inputs: - paths: -… --- ## [Trace functions?](https://discuss.elastic.co/t/trace-functions/275499)
**Author:** [@EwertTheDragon](https://discuss.elastic.co/u/EwertTheDragon)\ **Replies:** 0\ **Last updated:** [June 9, 2021, 9:21pm UTC](https://discuss.elastic.co/t/trace-functions/275499 "2021-06-09T21:21:36Z")
Before we have been using NewRelic, and we want to change to Elastic APM. I don't know if I am missing something in my setup, or that I have misunderstood how to get things like function traces (now I only get queries … --- ## [I can't start elastcsearch](https://discuss.elastic.co/t/i-cant-start-elastcsearch/275436)
**Author:** [@sk88](https://discuss.elastic.co/u/sk88)\ **Replies:** 2\ **Last updated:** [June 9, 2021, 9:13pm UTC](https://discuss.elastic.co/t/i-cant-start-elastcsearch/275436 "2021-06-09T21:13:31Z")
type or paste code here STATUS: ● elasticsearch.service - Elasticsearch Loaded: loaded (/lib/systemd/system/elasticsearch.service; enabled; vendor preset: enabled) Active: failed (Result: timeout) since Wed 2021-06-0… --- ## [Successful authentication after 3 failures](https://discuss.elastic.co/t/successful-authentication-after-3-failures/275491)
**Author:** [@bilel\_meddeb](https://discuss.elastic.co/u/bilel_meddeb)\ **Replies:** 0\ **Last updated:** [June 9, 2021, 7:04pm UTC](https://discuss.elastic.co/t/successful-authentication-after-3-failures/275491 "2021-06-09T19:04:03Z")
Hello, I'm new in ELK I want to create an alert if a windows user makes a successful login after he make 3 failed authentication that's mean after 3 failed (4625 event id ) and 1 success (4624 event id ) he make alert … --- ## [Error unable to find valid certification path](https://discuss.elastic.co/t/error-unable-to-find-valid-certification-path/122304)
**Author:** [@rschirin](https://discuss.elastic.co/u/rschirin)\ **Replies:** 9\ **Last updated:** [June 9, 2021, 8:52pm UTC](https://discuss.elastic.co/t/error-unable-to-find-valid-certification-path/122304 "2021-06-09T20:52:05Z")
Hi, I'm trying to configure TLS between Logstash and Elastic. Currently I have configured (correctly, it seems), TLS on my cluster (3 nodes) and I can access to it using Kibana. In my Logstash (installed in localhost … --- ## [How to get output in CSV format in Elastic Node Sql POST method](https://discuss.elastic.co/t/how-to-get-output-in-csv-format-in-elastic-node-sql-post-method/275330)
**Author:** [@Resington\_R](https://discuss.elastic.co/u/Resington_R)\ **Replies:** 4\ **Last updated:** [June 9, 2021, 7:42pm UTC](https://discuss.elastic.co/t/how-to-get-output-in-csv-format-in-elastic-node-sql-post-method/275330 "2021-06-09T19:42:26Z")
Hi... Can someone help to format the output in CSV for this Node JS code. I am using Elastic 7.10.2. I have tried change the path like /\_sql?format=csv its not working. But the same path in Kibana Dev Terminal, I am abl… --- ## [PHP APM errors not showing on Kibana dashboard](https://discuss.elastic.co/t/php-apm-errors-not-showing-on-kibana-dashboard/275480)
**Author:** [@richardlagerstrom](https://discuss.elastic.co/u/richardlagerstrom)\ **Replies:** 0\ **Last updated:** [June 9, 2021, 5:39pm UTC](https://discuss.elastic.co/t/php-apm-errors-not-showing-on-kibana-dashboard/275480 "2021-06-09T17:39:34Z")
Hi, I'm currently running a PHP project in Kubernetes (php7-fpm, nginx etc..). On this project there is a seemingly successful setup of apm-agent-php in the php-fpm deployment. Kibana shows me APM transactions, BUT the … --- ## [Elasticsearch php vs raw](https://discuss.elastic.co/t/elasticsearch-php-vs-raw/275424)
**Author:** [@Rammi22](https://discuss.elastic.co/u/Rammi22)\ **Replies:** 1\ **Last updated:** [June 9, 2021, 5:32pm UTC](https://discuss.elastic.co/t/elasticsearch-php-vs-raw/275424 "2021-06-09T17:32:00Z")
Hi, i asked also on Github:ongr-io/ElasticsearchDSL. used: ElsaticsearchPHP Elasticsearch DSL library Browser-Extension Elasticvue (Chrome) Executing an search request with both clients, IMHO with the same query con… --- ## [Auditbeat rules](https://discuss.elastic.co/t/auditbeat-rules/275479)
**Author:** [@Cosmin\_Ciobanu1](https://discuss.elastic.co/u/Cosmin_Ciobanu1)\ **Replies:** 0\ **Last updated:** [June 9, 2021, 5:29pm UTC](https://discuss.elastic.co/t/auditbeat-rules/275479 "2021-06-09T17:29:34Z")
Hi! I have Auditbeat installed on a Linux machine and I want to receive logs for commands like systemctl stop / start syslog but it receives only for status. So, not all commands can be inspected in Kibana. Any idea wha… --- ## [ElasticSearch Query string returns total hits different than scroll](https://discuss.elastic.co/t/elasticsearch-query-string-returns-total-hits-different-than-scroll/275462)
**Author:** [@telebh](https://discuss.elastic.co/u/telebh)\ **Replies:** 2\ **Last updated:** [June 9, 2021, 5:01pm UTC](https://discuss.elastic.co/t/elasticsearch-query-string-returns-total-hits-different-than-scroll/275462 "2021-06-09T17:01:11Z")
Hi There, I run query string against new ES V7 which expected to return 25k result set, but only returns total hit 1000, when running the same query but using scroll, it returns the expected correct count of 25k as a to… --- ## [There is a way to use multiple analyzers?](https://discuss.elastic.co/t/there-is-a-way-to-use-multiple-analyzers/275472)
**Author:** [@Sebastian\_Marroquin](https://discuss.elastic.co/u/Sebastian_Marroquin)\ **Replies:** 1\ **Last updated:** [June 9, 2021, 4:34pm UTC](https://discuss.elastic.co/t/there-is-a-way-to-use-multiple-analyzers/275472 "2021-06-09T16:34:11Z")
Hi everyone, I'm starting my way to learn and use elasticsearch alongside the "MEN" stack. And I was wondering if there is a way to use multiple parsers, I show you the section of code that I want to use: query = { … --- ## [Filter spans based on response header and add a custom label](https://discuss.elastic.co/t/filter-spans-based-on-response-header-and-add-a-custom-label/275475)
**Author:** [@brulbi](https://discuss.elastic.co/u/brulbi)\ **Replies:** 0\ **Last updated:** [June 9, 2021, 4:16pm UTC](https://discuss.elastic.co/t/filter-spans-based-on-response-header-and-add-a-custom-label/275475 "2021-06-09T16:16:54Z")
Hi guys! I recently installed apm-server, elasticsearch and Kibana on a Centos 7 test server. Ths support for APM RUM-JS on apm-server was enabled. I'm trying to find a way to filter extensions based on response heade… --- ## [High CPU Usage with Winlogbeat (latest version of beats)](https://discuss.elastic.co/t/high-cpu-usage-with-winlogbeat-latest-version-of-beats/275474)
**Author:** [@reconluke](https://discuss.elastic.co/u/reconluke)\ **Replies:** 0\ **Last updated:** [June 9, 2021, 4:04pm UTC](https://discuss.elastic.co/t/high-cpu-usage-with-winlogbeat-latest-version-of-beats/275474 "2021-06-09T16:04:46Z")
Hello - We are experiencing high CPU usage from the winlogbeat agent on a single system that is generating an extremely high volume of PowerShell Operational logs. Once we remove PowerShell logging entirely, the CPU usag… --- ## [Why is the value in the field on kibana repeated?](https://discuss.elastic.co/t/why-is-the-value-in-the-field-on-kibana-repeated/275420)
**Author:** [@Cong\_To](https://discuss.elastic.co/u/Cong_To)\ **Replies:** 2\ **Last updated:** [June 9, 2021, 4:03pm UTC](https://discuss.elastic.co/t/why-is-the-value-in-the-field-on-kibana-repeated/275420 "2021-06-09T16:03:32Z")
Update: I found the cause, the error was because I had two configuration files in the logstash folder and they had the same grok. Thank you for following. Hi I use ELK version 7.13.1 on Ubuntu 18.04. I tried reading t… --- ## [Automatically start logstash configuration file](https://discuss.elastic.co/t/automatically-start-logstash-configuration-file/275427)
**Author:** [@tarekilani](https://discuss.elastic.co/u/tarekilani)\ **Replies:** 1\ **Last updated:** [June 9, 2021, 3:58pm UTC](https://discuss.elastic.co/t/automatically-start-logstash-configuration-file/275427 "2021-06-09T15:58:51Z")
Hello, Please i would like to know if there is any method to set a logstash.conf file start automatically with the OS. I'm currently using a logstash.conf file using this command : # /usr/share/logstash/bin/logstash -f… [Previous page](https://discuss.elastic.co/latest.md?page=1630) [Next page](https://discuss.elastic.co/latest.md?page=1632)