# Latest **URL:** https://discuss.elastic.co/latest.md?page=1666 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1667 --- ## [Log file doesnt read](https://discuss.elastic.co/t/log-file-doesnt-read/273665)
**Author:** [@legolas\_bilbao](https://discuss.elastic.co/u/legolas_bilbao)\ **Replies:** 0\ **Last updated:** [May 21, 2021, 12:33pm UTC](https://discuss.elastic.co/t/log-file-doesnt-read/273665 "2021-05-21T12:33:19Z")
HI everybody, I wanna read and deploy data from file logs but when i started the logstash service appears the following data Logstash.log \[2021-05-21T13:50:38,097\]\[INFO \]\[logstash.inputs.file \]\[squid\] No sincedb\_… --- ## [Fortinet module not parsing from file](https://discuss.elastic.co/t/fortinet-module-not-parsing-from-file/273590)
**Author:** [@Mustafa\_Y](https://discuss.elastic.co/u/Mustafa_Y)\ **Replies:** 5\ **Last updated:** [May 21, 2021, 12:23pm UTC](https://discuss.elastic.co/t/fortinet-module-not-parsing-from-file/273590 "2021-05-21T12:23:16Z")
Hello, I want to parse fortinet logs from file instead of syslog network. There is an option var.paths in Fortinet module | Filebeat Reference \[master\] | Elastic and var.input . I configured it as below: - module: for… --- ## [Filebeat uses process time instead event time](https://discuss.elastic.co/t/filebeat-uses-process-time-instead-event-time/273646)
**Author:** [@nflinenberg](https://discuss.elastic.co/u/nflinenberg)\ **Replies:** 1\ **Last updated:** [May 21, 2021, 12:15pm UTC](https://discuss.elastic.co/t/filebeat-uses-process-time-instead-event-time/273646 "2021-05-21T12:15:38Z")
Hi all, Hope you can help me out for the following. We've setup and Elasticstack and configured filebeat to send json logs to elasticsearch, using this configuration: filebeat.inputs: - type: log enabled: true … --- ## [How to send logs by watchers action](https://discuss.elastic.co/t/how-to-send-logs-by-watchers-action/273530)
**Author:** [@luczajk](https://discuss.elastic.co/u/luczajk)\ **Replies:** 1\ **Last updated:** [May 21, 2021, 11:10am UTC](https://discuss.elastic.co/t/how-to-send-logs-by-watchers-action/273530 "2021-05-21T11:10:26Z")
I'm trying to find a way to send every log which attribute "Exception" includes "statusCode: 500" and word "exception". At this time my watcher send information about 10000 logs every check. But its wrong, if i check it … --- ## [Is there a way to export \_ttl from docs?](https://discuss.elastic.co/t/is-there-a-way-to-export-ttl-from-docs/273028)
**Author:** [@rschirin](https://discuss.elastic.co/u/rschirin)\ **Replies:** 9\ **Last updated:** [May 21, 2021, 10:49am UTC](https://discuss.elastic.co/t/is-there-a-way-to-export-ttl-from-docs/273028 "2021-05-21T10:49:09Z")
Hey there, if \_ttl expiration value is configured within the documents of an index, is there a way to export/reindex those documents with the \_ttl value of that moment? For instance, using Logstash elasticsearch input … --- ## [How can i schedule logstash every two hours for jdbc input plugin?](https://discuss.elastic.co/t/how-can-i-schedule-logstash-every-two-hours-for-jdbc-input-plugin/272973)
**Author:** [@sreedhar1](https://discuss.elastic.co/u/sreedhar1)\ **Replies:** 5\ **Last updated:** [May 21, 2021, 10:40am UTC](https://discuss.elastic.co/t/how-can-i-schedule-logstash-every-two-hours-for-jdbc-input-plugin/272973 "2021-05-21T10:40:01Z")
How can i schedule logstash every two hours for jdbc input plugin? --- ## [Metadata name in VolumeClaimTemplates](https://discuss.elastic.co/t/metadata-name-in-volumeclaimtemplates/273650)
**Author:** [@pkaramol](https://discuss.elastic.co/u/pkaramol)\ **Replies:** 1\ **Last updated:** [May 21, 2021, 10:30am UTC](https://discuss.elastic.co/t/metadata-name-in-volumeclaimtemplates/273650 "2021-05-21T10:30:21Z")
Assuming I want to make 1 nodeSet of 2-role nodes masters/data and 1 nodeSet with data nodes as follows: - name: master config: node.roles: \["master", "data"\] count: 3 volumeClaimTemplates: - met… --- ## [What is the usage of parameter 'delimiter' in metricbeat graphite module?](https://discuss.elastic.co/t/what-is-the-usage-of-parameter-delimiter-in-metricbeat-graphite-module/273626)
**Author:** [@bertr](https://discuss.elastic.co/u/bertr)\ **Replies:** 1\ **Last updated:** [May 21, 2021, 10:28am UTC](https://discuss.elastic.co/t/what-is-the-usage-of-parameter-delimiter-in-metricbeat-graphite-module/273626 "2021-05-21T10:28:16Z")
I am looking at the graphite module for metricbeat. I understand what all parameters do/mean except for the delimiter parameter. I copy a yml below for clearity: - module: graphite metricsets: - server protocol:… --- ## [Failed to connect to backoff(elasticsearch](https://discuss.elastic.co/t/failed-to-connect-to-backoff-elasticsearch/273424)
**Author:** [@noraben](https://discuss.elastic.co/u/noraben)\ **Replies:** 1\ **Last updated:** [May 21, 2021, 10:06am UTC](https://discuss.elastic.co/t/failed-to-connect-to-backoff-elasticsearch/273424 "2021-05-21T10:06:05Z")
Hello, I have some issues with agents enrollement. My agents are enrolled using a policy with Endpoint integration. The issue is that these agents display no logs message, and do not appear in Administration tab (a stuc… --- ## [Can't use specific date field as primary time field](https://discuss.elastic.co/t/cant-use-specific-date-field-as-primary-time-field/273542)
**Author:** [@Travis](https://discuss.elastic.co/u/Travis)\ **Replies:** 3\ **Last updated:** [May 21, 2021, 9:22am UTC](https://discuss.elastic.co/t/cant-use-specific-date-field-as-primary-time-field/273542 "2021-05-21T09:22:35Z")
Hello ! I have the field "Generated Time" in my message. I want to use it as primary date field in Kibana. To do so, I create my index pattern and choose "Generated Time" as primary date field. But once in Discover, no… --- ## [DotNet Agent - Seeing transactions but no grouping by span type](https://discuss.elastic.co/t/dotnet-agent-seeing-transactions-but-no-grouping-by-span-type/273534)
**Author:** [@georgepopovici](https://discuss.elastic.co/u/georgepopovici)\ **Replies:** 1\ **Last updated:** [May 21, 2021, 9:12am UTC](https://discuss.elastic.co/t/dotnet-agent-seeing-transactions-but-no-grouping-by-span-type/273534 "2021-05-21T09:12:28Z")
Kibana version : 7.11.1 Elasticsearch version : 7.11.1 APM Server version : { "build\_date": "2021-02-15T12:37:48Z", "build\_sha": "e77061bb3aaedae5ae8dd0ca193eb662513aedde", "version": "7.11.0" } APM Agent langu… --- ## [Distinct search using Java API](https://discuss.elastic.co/t/distinct-search-using-java-api/272978)
**Author:** [@MinwooKim](https://discuss.elastic.co/u/MinwooKim)\ **Replies:** 22\ **Last updated:** [May 21, 2021, 9:07am UTC](https://discuss.elastic.co/t/distinct-search-using-java-api/272978 "2021-05-21T09:07:09Z")
Inquiry with Java API. Is there any method to configure a search for distinct data? SearchSourceBuilder searchSourceBuilder = new SearchSourceBuilder(); BoolQueryBuilder queryBuilder = QueryBuilders.boolQuery()… --- ## [Ingestion pipeline key value pair](https://discuss.elastic.co/t/ingestion-pipeline-key-value-pair/272811)
**Author:** [@accateo](https://discuss.elastic.co/u/accateo)\ **Replies:** 2\ **Last updated:** [May 13, 2021, 7:05am UTC](https://discuss.elastic.co/t/ingestion-pipeline-key-value-pair/272811 "2021-05-13T07:05:37Z")
Hi, I have a index mappings like this: ... "location": { "type": "nested", "properties": { "accuracy": { "type": "float" }, "lat": { "… --- ## [Kibana Lens 7.12 - Mixed Bar/Line Option in Lens to show Daily as Bar and Moving Avg as line](https://discuss.elastic.co/t/kibana-lens-7-12-mixed-bar-line-option-in-lens-to-show-daily-as-bar-and-moving-avg-as-line/273037)
**Author:** [@stevedearl](https://discuss.elastic.co/u/stevedearl)\ **Replies:** 9\ **Last updated:** [May 21, 2021, 8:00am UTC](https://discuss.elastic.co/t/kibana-lens-7-12-mixed-bar-line-option-in-lens-to-show-daily-as-bar-and-moving-avg-as-line/273037 "2021-05-21T08:00:42Z")
Hi All, I'm using Kibana to show the count of events for various services received over time. I've been displaying this as a bar chart no problem but would like to also include a moving 7 day average as a line so that t… --- ## [Snapshot and restore keep reporting 29 number indices](https://discuss.elastic.co/t/snapshot-and-restore-keep-reporting-29-number-indices/272758)
**Author:** [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Replies:** 7\ **Last updated:** [May 21, 2021, 7:56am UTC](https://discuss.elastic.co/t/snapshot-and-restore-keep-reporting-29-number-indices/272758 "2021-05-21T07:56:32Z")
Hi all I have a problem with the snapshot feature. I have a little script that will take snapshot of an indices of my choice in a file. But recently when i upgrade to version 7.12 when i take the snapshot, not only th… --- ## [SIEM mail format for winevent log](https://discuss.elastic.co/t/siem-mail-format-for-winevent-log/273632)
**Author:** [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Replies:** 0\ **Last updated:** [May 21, 2021, 7:54am UTC](https://discuss.elastic.co/t/siem-mail-format-for-winevent-log/273632 "2021-05-21T07:54:52Z")
Hi a. The mail format for elastic siem was a little weird for me at this point. For most case the mail got the right format out to me but on the case of winevent log it is a bit difference. when i try the {{winlog.eve… --- ## [Load more than 1 million row from SQL Server to ES with Logstash](https://discuss.elastic.co/t/load-more-than-1-million-row-from-sql-server-to-es-with-logstash/273627)
**Author:** [@Dai\_Thai\_Hoa\_Vo](https://discuss.elastic.co/u/Dai_Thai_Hoa_Vo)\ **Replies:** 1\ **Last updated:** [May 21, 2021, 7:48am UTC](https://discuss.elastic.co/t/load-more-than-1-million-row-from-sql-server-to-es-with-logstash/273627 "2021-05-21T07:48:26Z")
Hi every one. I have one case that my table has more 1 million rows in SQL Server and I used logstash JDBC to load them to Elastic Search. It work fine but run very slow. This is my file config. input { jdbc { jdbc\_dr… --- ## [Session lost after log file rotation](https://discuss.elastic.co/t/session-lost-after-log-file-rotation/273531)
**Author:** [@Harm](https://discuss.elastic.co/u/Harm)\ **Replies:** 2\ **Last updated:** [May 21, 2021, 7:02am UTC](https://discuss.elastic.co/t/session-lost-after-log-file-rotation/273531 "2021-05-21T07:02:42Z")
Hi, I have recently upgraded from Kibana 7.10.0 to 7.12.1 and since then I'm observing an issue where all user sessions are getting lost after a logfile rotation. My current logging settings are: logging.dest: "/var/… --- ## [FileBeat + LogsTash port 5044](https://discuss.elastic.co/t/filebeat-logstash-port-5044/271777)
**Author:** [@Paveltest](https://discuss.elastic.co/u/Paveltest)\ **Replies:** 6\ **Last updated:** [May 21, 2021, 7:00am UTC](https://discuss.elastic.co/t/filebeat-logstash-port-5044/271777 "2021-05-21T07:00:03Z")
Error ERROR#011\[publisher\_pipeline\_output\]#011pipeline/output.go:154#011Failed to connect to backoff(async(tcp://192.168.10.14:5044)). I can not connect on port 5044 with logstash! On the logstash server port 5044 is op… --- ## [Logstash input s3 Time difference in data acceptance](https://discuss.elastic.co/t/logstash-input-s3-time-difference-in-data-acceptance/273616)
**Author:** [@xiaoloutingfengyu](https://discuss.elastic.co/u/xiaoloutingfengyu)\ **Replies:** 0\ **Last updated:** [May 21, 2021, 6:26am UTC](https://discuss.elastic.co/t/logstash-input-s3-time-difference-in-data-acceptance/273616 "2021-05-21T06:26:37Z")
Logstash receives data from aws-s3, but kibana data is dozens of minutes later than the data on S3. How to modify it? --- ## [PKI security realm lisence](https://discuss.elastic.co/t/pki-security-realm-lisence/273392)
**Author:** [@Armen\_Petrosyan](https://discuss.elastic.co/u/Armen_Petrosyan)\ **Replies:** 8\ **Last updated:** [May 21, 2021, 6:17am UTC](https://discuss.elastic.co/t/pki-security-realm-lisence/273392 "2021-05-21T06:17:18Z")
In subscription page Subscriptions | Elastic Stack Products & Support | Elastic Stated that Encrypted communications is under basic subscription. However when I defined pki real for client authentication, it didn't wor… --- ## [Is there a way to create visualizations/dashboards automatically via API calls?](https://discuss.elastic.co/t/is-there-a-way-to-create-visualizations-dashboards-automatically-via-api-calls/273379)
**Author:** [@Shreesh\_Narayanan](https://discuss.elastic.co/u/Shreesh_Narayanan)\ **Replies:** 3\ **Last updated:** [May 21, 2021, 6:16am UTC](https://discuss.elastic.co/t/is-there-a-way-to-create-visualizations-dashboards-automatically-via-api-calls/273379 "2021-05-21T06:16:47Z")
I have just started off with ELK stack , i have a bunch of data that needs to be visualized, while it is easy on doing it in the GUI, i was wondering if there a way to create visualizations /dashboards automatically via… --- ## [Good practices with Beats and Logstash](https://discuss.elastic.co/t/good-practices-with-beats-and-logstash/273296)
**Author:** [@mar-ro](https://discuss.elastic.co/u/mar-ro)\ **Replies:** 2\ **Last updated:** [May 21, 2021, 6:15am UTC](https://discuss.elastic.co/t/good-practices-with-beats-and-logstash/273296 "2021-05-21T06:15:48Z")
Hello to all of you! I have the following question about which option is better to be able to register two types of logs in elastic search. Let's say for example that I want to log the nginx and crontab logs. In addit… --- ## [Kibana Control visual "No matching indices found" error](https://discuss.elastic.co/t/kibana-control-visual-no-matching-indices-found-error/273553)
**Author:** [@Nisha2297](https://discuss.elastic.co/u/Nisha2297)\ **Replies:** 2\ **Last updated:** [May 21, 2021, 5:26am UTC](https://discuss.elastic.co/t/kibana-control-visual-no-matching-indices-found-error/273553 "2021-05-21T05:26:18Z")
While creating the Control visual in Kibana, I am facing "No matching indices found" error everytime I create a new visual. The index which I am using is totally different than the indices shown in the error. Please ref… --- ## [Kibana visual flexibility](https://discuss.elastic.co/t/kibana-visual-flexibility/273485)
**Author:** [@Nisha2297](https://discuss.elastic.co/u/Nisha2297)\ **Replies:** 2\ **Last updated:** [May 21, 2021, 4:41am UTC](https://discuss.elastic.co/t/kibana-visual-flexibility/273485 "2021-05-21T04:41:12Z")
Is it possible to create the below table chart in Kibana? As much as I explored, Kibana only creates a simple table visual and this type of grouping(ABC,XYZ,OTHER) of field is not possible. --- ## [How does rollup work?](https://discuss.elastic.co/t/how-does-rollup-work/273505)
**Author:** [@Nisha2297](https://discuss.elastic.co/u/Nisha2297)\ **Replies:** 2\ **Last updated:** [May 21, 2021, 4:24am UTC](https://discuss.elastic.co/t/how-does-rollup-work/273505 "2021-05-21T04:24:32Z")
How does Rollup job and rollup index work? what is the use of rolling up the data? I am not very clear of why we are rolling up an index to another one. And my Rollup job is working fine and data is getting indexed but… --- ## [Context-aware Markdown panels via attribute value of antecedent element and attribute selector in custom CSS?](https://discuss.elastic.co/t/context-aware-markdown-panels-via-attribute-value-of-antecedent-element-and-attribute-selector-in-custom-css/273539)
**Author:** [@GrahamHannington](https://discuss.elastic.co/u/GrahamHannington)\ **Replies:** 5\ **Last updated:** [May 21, 2021, 3:51am UTC](https://discuss.elastic.co/t/context-aware-markdown-panels-via-attribute-value-of-antecedent-element-and-attribute-selector-in-custom-css/273539 "2021-05-21T03:51:39Z")
I have a TSVB Markdown panel that consists of a list of links to related dashboards. I'm inserting that panel at the top of each of the related dashboards. I'm in denial about having to create a separate version of that… --- ## [Collecting syslog from several different vendors](https://discuss.elastic.co/t/collecting-syslog-from-several-different-vendors/273497)
**Author:** [@Christer\_Palmen](https://discuss.elastic.co/u/Christer_Palmen)\ **Replies:** 2\ **Last updated:** [May 21, 2021, 3:39am UTC](https://discuss.elastic.co/t/collecting-syslog-from-several-different-vendors/273497 "2021-05-21T03:39:44Z")
Hello. We have got an task of setting up an Elasticstack server that collects as a start syslog from different vendors in their environment, visualize it in Kibana and forward the syslogs to a CERT department As a sta… --- ## [Logstash-plugin-s3 接收数据有延迟30分钟](https://discuss.elastic.co/t/logstash-plugin-s3-30/273599)
**Author:** [@xiaoloutingfengyu](https://discuss.elastic.co/u/xiaoloutingfengyu)\ **Replies:** 0\ **Last updated:** [May 21, 2021, 2:39am UTC](https://discuss.elastic.co/t/logstash-plugin-s3-30/273599 "2021-05-21T02:39:05Z")
使用logstash的s3插件接受aws上的数据，数据接受有延迟，延迟时间如果超过半小时会继续接受，直到和真实时间相差10分钟左右停止接受，然后等相差超过30分钟时logstash-plugin-s3会再次接受数据。请问这个问题如何调整，我想要接受的数据和真实时间相差不超过5分钟。 --- ## [Elasticsearch/kibana mapping multi-layered/nested data](https://discuss.elastic.co/t/elasticsearch-kibana-mapping-multi-layered-nested-data/272821)
**Author:** [@stcdarrell](https://discuss.elastic.co/u/stcdarrell)\ **Replies:** 1\ **Last updated:** [May 21, 2021, 12:21am UTC](https://discuss.elastic.co/t/elasticsearch-kibana-mapping-multi-layered-nested-data/272821 "2021-05-21T00:21:32Z")
hi, i'm having some issues wrapping my head around how to map this data in elasticsearch/kibana: I'm pulling query data from VirusTotal.com's API on malware. here is a SMALL portion of a HUGE chunk of the query: (1) … [Previous page](https://discuss.elastic.co/latest.md?page=1665) [Next page](https://discuss.elastic.co/latest.md?page=1667)