# Latest **URL:** https://discuss.elastic.co/latest.md?page=1647 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1648 --- ## [Logstash](https://discuss.elastic.co/t/logstash/273611)
**Author:** [@httrack](https://discuss.elastic.co/u/httrack)\ **Replies:** 3\ **Last updated:** [June 1, 2021, 4:05pm UTC](https://discuss.elastic.co/t/logstash/273611 "2021-06-01T16:05:29Z")
Hello Team. I am having problems with a client. How can I activate the filebeat-\* index and the Logstash-\* index to have the syslog in the Discover part of Kibana --- ## [Heartbeat autodiscover kubernetes pods](https://discuss.elastic.co/t/heartbeat-autodiscover-kubernetes-pods/273642)
**Author:** [@jamesp220291](https://discuss.elastic.co/u/jamesp220291)\ **Replies:** 4\ **Last updated:** [June 1, 2021, 4:02pm UTC](https://discuss.elastic.co/t/heartbeat-autodiscover-kubernetes-pods/273642 "2021-06-01T16:02:18Z")
Hi i want heartbeat to find every single kubernetes pod and report it to elasticsearch uptime, however all i am able to currentlty get is the kubernetes nodes and my 1x http monitor. here is my config data: heartbea… --- ## [Scripted Field EsError in Kibana](https://discuss.elastic.co/t/scripted-field-eserror-in-kibana/274542)
**Author:** [@opdelta](https://discuss.elastic.co/u/opdelta)\ **Replies:** 1\ **Last updated:** [June 1, 2021, 3:38pm UTC](https://discuss.elastic.co/t/scripted-field-eserror-in-kibana/274542 "2021-06-01T15:38:18Z")
Hey there, I have Apache logs imported in ES where the "request.keyword" field contains the path of the accessed document of a server. For example: "/category/path/to/requested/data/xml/file.xml" I want to sort in a da… --- ## [How to call a filter/report in a watcher?](https://discuss.elastic.co/t/how-to-call-a-filter-report-in-a-watcher/274513)
**Author:** [@houjil](https://discuss.elastic.co/u/houjil)\ **Replies:** 5\ **Last updated:** [June 1, 2021, 3:49pm UTC](https://discuss.elastic.co/t/how-to-call-a-filter-report-in-a-watcher/274513 "2021-06-01T15:49:27Z")
Hi, Be indulgent plz this is my first watcher :slight\_smile: I'm trying to create a watcher in where I can: call and fetch a filter/report for a specific index (stream). The idea is to catch from received logs, of a… --- ## [Phrase/ multi-worlds search](https://discuss.elastic.co/t/phrase-multi-worlds-search/274661)
**Author:** [@lalitesh](https://discuss.elastic.co/u/lalitesh)\ **Replies:** 0\ **Last updated:** [June 1, 2021, 3:43pm UTC](https://discuss.elastic.co/t/phrase-multi-worlds-search/274661 "2021-06-01T15:43:01Z")
I am trying to implement a use case wherein a user can make a multi-words/ phrase search for 'product\_name' field. Assuming someone is searching for 'Richest Man', the following results should come: The Richest Man in… --- ## [APM only shows errors and Warnings](https://discuss.elastic.co/t/apm-only-shows-errors-and-warnings/274652)
**Author:** [@mar-ro](https://discuss.elastic.co/u/mar-ro)\ **Replies:** 1\ **Last updated:** [June 1, 2021, 3:39pm UTC](https://discuss.elastic.co/t/apm-only-shows-errors-and-warnings/274652 "2021-06-01T15:39:59Z")
Good afternoon! I would like to know if it is possible to configure the different APM agents to log only errors and warnings. Is it possible to do this? How? Thank you! --- ## [Extract fields from JSON Flie to Elastic using Logstash filters](https://discuss.elastic.co/t/extract-fields-from-json-flie-to-elastic-using-logstash-filters/274610)
**Author:** [@Sirine](https://discuss.elastic.co/u/Sirine)\ **Replies:** 5\ **Last updated:** [June 1, 2021, 3:18pm UTC](https://discuss.elastic.co/t/extract-fields-from-json-flie-to-elastic-using-logstash-filters/274610 "2021-06-01T15:18:50Z")
Hello, I'm trying to extract fields from my JSON file, but I have \_jsonparsefailure" error, I tried many other filters like grok Split or vk but always the same results, logstash doesn't extract the values of the fields… --- ## [Elasticsearch C# Nest unit tests with Moq : fail to mock concrete class](https://discuss.elastic.co/t/elasticsearch-c-nest-unit-tests-with-moq-fail-to-mock-concrete-class/274657)
**Author:** [@Nicolas\_Rey](https://discuss.elastic.co/u/Nicolas_Rey)\ **Replies:** 0\ **Last updated:** [June 1, 2021, 3:06pm UTC](https://discuss.elastic.co/t/elasticsearch-c-nest-unit-tests-with-moq-fail-to-mock-concrete-class/274657 "2021-06-01T15:06:16Z")
Hi, I need to mock some methods and properties in Nest.IElasticClient interface that is used in my repo. As example I need to stub the Indices.Exists() method to return an ExistsResponse having an Exists property return… --- ## [Elasticsearch 7.13 | Error deleting field mapping script, cluster return red state](https://discuss.elastic.co/t/elasticsearch-7-13-error-deleting-field-mapping-script-cluster-return-red-state/274655)
**Author:** [@joao](https://discuss.elastic.co/u/joao)\ **Replies:** 0\ **Last updated:** [June 1, 2021, 2:48pm UTC](https://discuss.elastic.co/t/elasticsearch-7-13-error-deleting-field-mapping-script-cluster-return-red-state/274655 "2021-06-01T14:48:33Z")
Hi, I've been testing the new features in the Elasticsearch 7.13, and I have a problem to deleting a field mapping script. This is my mapping: PUT runtime\_2\_indexed\_field { "mappings": { "propert… --- ## [Add a field depending on first log](https://discuss.elastic.co/t/add-a-field-depending-on-first-log/274653)
**Author:** [@A\_Chichi](https://discuss.elastic.co/u/A_Chichi)\ **Replies:** 0\ **Last updated:** [June 1, 2021, 2:37pm UTC](https://discuss.elastic.co/t/add-a-field-depending-on-first-log/274653 "2021-06-01T14:37:14Z")
Hello, I would like to add a field in my logstash pipeline. But this field would be a dynamic field. Here is a sample of my file : date\_log;job\_id;service\_id;name;progress;status;duration 2021-06-01 16:16:03;nJzP4g;7… --- ## [Elasticsearch seems not to receive logs from logstash](https://discuss.elastic.co/t/elasticsearch-seems-not-to-receive-logs-from-logstash/274648)
**Author:** [@gisellecarballo](https://discuss.elastic.co/u/gisellecarballo)\ **Replies:** 0\ **Last updated:** [June 1, 2021, 2:20pm UTC](https://discuss.elastic.co/t/elasticsearch-seems-not-to-receive-logs-from-logstash/274648 "2021-06-01T14:20:59Z")
Hi, anyone help me sort out why elasticsearch seems not to receive logs from logstash. I am new to ELK. here is my config so far. TIA /etc/elasticsearch/elasticsearch.yml network.host: 0.0.0.0 transport.host: localhos… --- ## [Json data ingested contains unicode data (xml)](https://discuss.elastic.co/t/json-data-ingested-contains-unicode-data-xml/274647)
**Author:** [@justroll](https://discuss.elastic.co/u/justroll)\ **Replies:** 0\ **Last updated:** [June 1, 2021, 2:20pm UTC](https://discuss.elastic.co/t/json-data-ingested-contains-unicode-data-xml/274647 "2021-06-01T14:20:15Z")
Hi I'm a little bit puzzled .. We got logging coming from a k8s , it is logging in json to our elastic , the logging exposes a xml file in the message field, this is encoded in unicode like \ \ \ **Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 1\ **Last updated:** [June 1, 2021, 2:13pm UTC](https://discuss.elastic.co/t/could-i-get-per-process-read-write-diskio-using-metricbeat/274365 "2021-06-01T14:13:41Z") Currently metricbeat is only giving me this information "cgroup" =\> { "blkio" =\> { "id" =\> "ssh.service", "path" =\> "/system.slice/ssh.service", … --- ## [Unable to find valid certification path to requested target while trying to implement HTTPS](https://discuss.elastic.co/t/unable-to-find-valid-certification-path-to-requested-target-while-trying-to-implement-https/274644)
**Author:** [@riccardo\_centropaghe](https://discuss.elastic.co/u/riccardo_centropaghe)\ **Replies:** 0\ **Last updated:** [June 1, 2021, 2:10pm UTC](https://discuss.elastic.co/t/unable-to-find-valid-certification-path-to-requested-target-while-trying-to-implement-https/274644 "2021-06-01T14:10:44Z")
Hi, I am using a ELK stack in docker for pfSense, from here GitHub - pfelk/docker: Deploy pfelk with docker-compose All went fine, I even implement https with my own domain certificate. Navigating on the KIBANA dashboar… --- ## [How to update the GeoIP Databases for Elastic Ingest Pipelines](https://discuss.elastic.co/t/how-to-update-the-geoip-databases-for-elastic-ingest-pipelines/274259)
**Author:** [@nverrill](https://discuss.elastic.co/u/nverrill)\ **Replies:** 4\ **Last updated:** [June 1, 2021, 2:05pm UTC](https://discuss.elastic.co/t/how-to-update-the-geoip-databases-for-elastic-ingest-pipelines/274259 "2021-06-01T14:05:44Z")
I've read up on the docs and current topics and haven't found how to properly update the GeoIP Databases that come with Elasticsearch for the Ingest Pipelines. I have downloaded the latest GeoLite2-Country.mmdb from Ma… --- ## [How to use mutate filter plugin in output](https://discuss.elastic.co/t/how-to-use-mutate-filter-plugin-in-output/274578)
**Author:** [@rknd](https://discuss.elastic.co/u/rknd)\ **Replies:** 1\ **Last updated:** [June 1, 2021, 1:40pm UTC](https://discuss.elastic.co/t/how-to-use-mutate-filter-plugin-in-output/274578 "2021-06-01T13:40:36Z")
I have a logstash configuration. With that configuration logstash do some operation in filter and send outputs. Everything works well. I want one more elasticsearch output in same configuration file. I mean after parsin… --- ## [Ingest plugin context data](https://discuss.elastic.co/t/ingest-plugin-context-data/273788)
**Author:** [@nmalocic](https://discuss.elastic.co/u/nmalocic)\ **Replies:** 7\ **Last updated:** [June 1, 2021, 1:29pm UTC](https://discuss.elastic.co/t/ingest-plugin-context-data/273788 "2021-06-01T13:29:16Z")
Hi everyone, I am building ingest plugin, and I was wondering if there is any way to know index, or pipeline name from plugin? My idea is to enable users to have multiple configurations so this seems like easy solution… --- ## [Deliberately fail event in logstash to requeue it](https://discuss.elastic.co/t/deliberately-fail-event-in-logstash-to-requeue-it/274635)
**Author:** [@tumbledwyer](https://discuss.elastic.co/u/tumbledwyer)\ **Replies:** 0\ **Last updated:** [June 1, 2021, 1:19pm UTC](https://discuss.elastic.co/t/deliberately-fail-event-in-logstash-to-requeue-it/274635 "2021-06-01T13:19:09Z")
Hi Is there a way to fail an event so that it can be requeued for processing later? Let's take this conf for example: input { pipeline { address =\> "previous-pipe" } } filter { elasticsearch { hosts =\> \[… --- ## [Logstash one to one mapping of two lines](https://discuss.elastic.co/t/logstash-one-to-one-mapping-of-two-lines/274634)
**Author:** [@Muhammad\_Faisal](https://discuss.elastic.co/u/Muhammad_Faisal)\ **Replies:** 0\ **Last updated:** [June 1, 2021, 1:17pm UTC](https://discuss.elastic.co/t/logstash-one-to-one-mapping-of-two-lines/274634 "2021-06-01T13:17:15Z")
hi guys, how to do one to one mapping of below two lines - number of comma separated values in message and header fields can be dynamic but number of items in both fields will be same "message" =\> "error\_count,10,20,3… --- ## [Prefix field with specific index name while searching on multiple indices](https://discuss.elastic.co/t/prefix-field-with-specific-index-name-while-searching-on-multiple-indices/274628)
**Author:** [@Dgame](https://discuss.elastic.co/u/Dgame)\ **Replies:** 0\ **Last updated:** [June 1, 2021, 12:14pm UTC](https://discuss.elastic.co/t/prefix-field-with-specific-index-name-while-searching-on-multiple-indices/274628 "2021-06-01T12:14:39Z")
Let's say I have two different indices (index\_a and index\_b) which both have different fields. For example index\_a has the field title and body and index\_b has only the field body. Now I'm searching like this: { "quer… --- ## [Splunk data to elasticsearch migration](https://discuss.elastic.co/t/splunk-data-to-elasticsearch-migration/274623)
**Author:** [@mruthyu](https://discuss.elastic.co/u/mruthyu)\ **Replies:** 2\ **Last updated:** [June 1, 2021, 12:08pm UTC](https://discuss.elastic.co/t/splunk-data-to-elasticsearch-migration/274623 "2021-06-01T12:08:54Z")
Is there a way data from Splunk can be indexed into elasticserach considering few tens of TB of data? Is there any utility program which can be used to export data from splunk? Thanks. --- ## [Problem running logstash:7.13.0 on docker](https://discuss.elastic.co/t/problem-running-logstash-7-13-0-on-docker/274627)
**Author:** [@Jonas\_Forte](https://discuss.elastic.co/u/Jonas_Forte)\ **Replies:** 0\ **Last updated:** [June 1, 2021, 12:05pm UTC](https://discuss.elastic.co/t/problem-running-logstash-7-13-0-on-docker/274627 "2021-06-01T12:05:34Z")
Hello everyone, I am having an error when running the logstash on the docker. I'm trying to run logstash on the docker with the following command: command: docker run --rm -it -v /usr/share/logstash/pipeline/logstash.… --- ## [Upgrade hardware size - Any downtime?](https://discuss.elastic.co/t/upgrade-hardware-size-any-downtime/274613)
**Author:** [@Cesidio\_DiBenedetto](https://discuss.elastic.co/u/Cesidio_DiBenedetto)\ **Replies:** 5\ **Last updated:** [June 1, 2021, 12:03pm UTC](https://discuss.elastic.co/t/upgrade-hardware-size-any-downtime/274613 "2021-06-01T12:03:38Z")
Will an upgrade in hardware size cause any downtime? --- ## [ILM: index not showing in Cold phase and Delete phase](https://discuss.elastic.co/t/ilm-index-not-showing-in-cold-phase-and-delete-phase/272289)
**Author:** [@neko](https://discuss.elastic.co/u/neko)\ **Replies:** 4\ **Last updated:** [June 1, 2021, 11:42am UTC](https://discuss.elastic.co/t/ilm-index-not-showing-in-cold-phase-and-delete-phase/272289 "2021-06-01T11:42:48Z")
Hi, I'm using Winlogbeat and i've defined a lifecycle with the following phases: Hot, Warm, Cold and Delete. In Index Management i have indices only for Hot and Warm phases. Could someone tell me what is wrong? Any he… --- ## [Packetbeat Service Stop Automatically Everyday](https://discuss.elastic.co/t/packetbeat-service-stop-automatically-everyday/274621)
**Author:** [@vivek2219](https://discuss.elastic.co/u/vivek2219)\ **Replies:** 0\ **Last updated:** [June 1, 2021, 11:14am UTC](https://discuss.elastic.co/t/packetbeat-service-stop-automatically-everyday/274621 "2021-06-01T11:14:24Z")
Dear Team, As we check packetbeat service auto stop every day and we need to start it manually. There is no any issue it's working fine after restart/start. Not able to find any issue. please help to resolve this why… --- ## [Performance issues when returning many ids](https://discuss.elastic.co/t/performance-issues-when-returning-many-ids/274618)
**Author:** [@Kristian\_Andersen](https://discuss.elastic.co/u/Kristian_Andersen)\ **Replies:** 0\ **Last updated:** [June 1, 2021, 10:52am UTC](https://discuss.elastic.co/t/performance-issues-when-returning-many-ids/274618 "2021-06-01T10:52:46Z")
Hello, I have a search index with 200.000 documents, and experience bad performance when performing searches that returns multiple results. Each document consists of 1040 fields all mapped as keywords. See filemapping … --- ## [Row encoding and autosize makes chart not appear](https://discuss.elastic.co/t/row-encoding-and-autosize-makes-chart-not-appear/274229)
**Author:** [@es\_net](https://discuss.elastic.co/u/es_net)\ **Replies:** 4\ **Last updated:** [June 1, 2021, 10:39am UTC](https://discuss.elastic.co/t/row-encoding-and-autosize-makes-chart-not-appear/274229 "2021-06-01T10:39:12Z")
Hi, I am attempting to make charts similar to Faceting a Plot into a Trellis Plot | Vega-Lite with multiple rows of charts, split using the row encoding. (The link above should go to the section titled ' Row Facet (with… --- ## [Could not find the logstash.yml](https://discuss.elastic.co/t/could-not-find-the-logstash-yml/274614)
**Author:** [@Kanishk\_Madan](https://discuss.elastic.co/u/Kanishk_Madan)\ **Replies:** 0\ **Last updated:** [June 1, 2021, 10:35am UTC](https://discuss.elastic.co/t/could-not-find-the-logstash-yml/274614 "2021-06-01T10:35:53Z")
I have a problem when i run a file using this command :sudo /usr/share/logstash/bin/logstash -f /etc/logstash/logstash.conf It shows:- Could not find logstash.yml which is typically located in $LS\_HOME/config or /etc/… --- ## [Using different names for services created by the operator](https://discuss.elastic.co/t/using-different-names-for-services-created-by-the-operator/273560)
**Author:** [@pkaramol](https://discuss.elastic.co/u/pkaramol)\ **Replies:** 2\ **Last updated:** [June 1, 2021, 10:05am UTC](https://discuss.elastic.co/t/using-different-names-for-services-created-by-the-operator/273560 "2021-06-01T10:05:11Z")
When creating the Elasticsearch resource (using ECK), the http service from where es is accessible is by default named esresourcename-es-http. Is this configurable? And in general, are all the options that can be confi… --- ## [Filebeat module system don't parse auth log](https://discuss.elastic.co/t/filebeat-module-system-dont-parse-auth-log/272801)
**Author:** [@beci](https://discuss.elastic.co/u/beci)\ **Replies:** 1\ **Last updated:** [June 1, 2021, 10:04am UTC](https://discuss.elastic.co/t/filebeat-module-system-dont-parse-auth-log/272801 "2021-06-01T10:04:50Z")
Hello all, I am using Filebeat 7.12.1 with the system module The logs send in Elastic without problem, but some failed authentication logs from pam\_unix(sshd:auth) are not parsed. Do you know why? Thank you very m… [Previous page](https://discuss.elastic.co/latest.md?page=1646) [Next page](https://discuss.elastic.co/latest.md?page=1648)