# Latest **URL:** https://discuss.elastic.co/latest.md?page=1692 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1693 --- ## [Try to convert UTC timestamp to IST in logstash](https://discuss.elastic.co/t/try-to-convert-utc-timestamp-to-ist-in-logstash/272268)
**Author:** [@sudheendra](https://discuss.elastic.co/u/sudheendra)\ **Replies:** 0\ **Last updated:** [May 6, 2021, 9:36am UTC](https://discuss.elastic.co/t/try-to-convert-utc-timestamp-to-ist-in-logstash/272268 "2021-05-06T09:36:21Z")
Hi , I need to convert the log UTC to my local time in IST . Used ruby Filter to convert to local time . My filter in logstash.yaml file filter { ruby { code =\> "event.set('new\_date', event.get('\[@timestamp\]').time… --- ## [Can't parse after optionnal field has been set](https://discuss.elastic.co/t/cant-parse-after-optionnal-field-has-been-set/272253)
**Author:** [@Travis](https://discuss.elastic.co/u/Travis)\ **Replies:** 2\ **Last updated:** [May 6, 2021, 8:40am UTC](https://discuss.elastic.co/t/cant-parse-after-optionnal-field-has-been-set/272253 "2021-05-06T08:40:42Z")
Hello ! I'm working on Cisco WSA logs. Some fields are optionnal. In particular, the filed which contains username infomation: sometimes we have "DOMAIN\\smith@AD" and sometimes we have just - When username is present, … --- ## [Log Segregation](https://discuss.elastic.co/t/log-segregation/272254)
**Author:** [@Mukund\_Anand](https://discuss.elastic.co/u/Mukund_Anand)\ **Replies:** 1\ **Last updated:** [May 6, 2021, 8:34am UTC](https://discuss.elastic.co/t/log-segregation/272254 "2021-05-06T08:34:51Z")
Hi, I have requirement to segregate the logs what different users can see. I have a log file as a source with all the logs. But, half of those logs has to be seen by one user and other half has to be seen by the other u… --- ## [Log-rotation with Beats](https://discuss.elastic.co/t/log-rotation-with-beats/272165)
**Author:** [@Keerthana\_Manoharan](https://discuss.elastic.co/u/Keerthana_Manoharan)\ **Replies:** 1\ **Last updated:** [May 6, 2021, 8:27am UTC](https://discuss.elastic.co/t/log-rotation-with-beats/272165 "2021-05-06T08:27:10Z")
I am trying to figure out the best possible method for enabling log rotation. The beats is deployed in Kubernetes as daemon set, its input file is stored in a shared location accessed by multiple pods, writing to it. A… --- ## [Events are lost when elasticsearch output is temporary unavailable](https://discuss.elastic.co/t/events-are-lost-when-elasticsearch-output-is-temporary-unavailable/272176)
**Author:** [@mabato](https://discuss.elastic.co/u/mabato)\ **Replies:** 3\ **Last updated:** [May 6, 2021, 8:23am UTC](https://discuss.elastic.co/t/events-are-lost-when-elasticsearch-output-is-temporary-unavailable/272176 "2021-05-06T08:23:44Z")
Hi all, Newbie here. I have kubernetes cluster in a location with patchy internet connection. I have metric beats on the cluster and I want to send metrics to ES which runs in cloud. I thought that when I put logstash … --- ## [Elasticsearch is built with known username & password and need to access with java api](https://discuss.elastic.co/t/elasticsearch-is-built-with-known-username-password-and-need-to-access-with-java-api/272247)
**Author:** [@KK\_LL](https://discuss.elastic.co/u/KK_LL)\ **Replies:** 1\ **Last updated:** [May 6, 2021, 8:11am UTC](https://discuss.elastic.co/t/elasticsearch-is-built-with-known-username-password-and-need-to-access-with-java-api/272247 "2021-05-06T08:11:18Z")
I have built and up an elasticsearch on my computer. And set the xpack.security.enabled: true xpack.security.authc.api\_key.enabled: true to enable basic security. The elastic username password is also generated automa… --- ## [Logstash/kibana timezone issue](https://discuss.elastic.co/t/logstash-kibana-timezone-issue/272139)
**Author:** [@edvrfn](https://discuss.elastic.co/u/edvrfn)\ **Replies:** 3\ **Last updated:** [May 6, 2021, 8:07am UTC](https://discuss.elastic.co/t/logstash-kibana-timezone-issue/272139 "2021-05-06T08:07:52Z")
Below is the sample log message \<12\>May 5 00:10:28 UDM,50c9676c6d24,udm-1.9.3.3438 kernel: \[522844.682013\] IN=br30 OUT=eth4 MAC=76:ac:b9:1e:f2:fc:dc:a6:32:eb:22:ac:08:00 SRC=192.168.3.53 DST=132.145.110.200 LEN=61 TOS=… --- ## [Multiple index search. One with routing](https://discuss.elastic.co/t/multiple-index-search-one-with-routing/272204)
**Author:** [@liorg2](https://discuss.elastic.co/u/liorg2)\ **Replies:** 5\ **Last updated:** [May 6, 2021, 7:20am UTC](https://discuss.elastic.co/t/multiple-index-search-one-with-routing/272204 "2021-05-06T07:20:06Z")
Hello, Is it possible to query multiple indices at the same time, where one of them requires routing? For example if index1 requires routing but index 2 doesn't. Get index1,index2/\_search?routing=..? Thanks --- ## [Low log rate per agent.hostname](https://discuss.elastic.co/t/low-log-rate-per-agent-hostname/272162)
**Author:** [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)\ **Replies:** 6\ **Last updated:** [May 6, 2021, 7:34am UTC](https://discuss.elastic.co/t/low-log-rate-per-agent-hostname/272162 "2021-05-06T07:34:56Z")
Hello everybody, I have created a machine learning job to be able to detect when beats stop sending logs to my cluster. Job Type: Multi-metric Metric: Low count(Event rate) split field: agent.hostname an example of … --- ## [Metricbeat on elasticserach 7.10](https://discuss.elastic.co/t/metricbeat-on-elasticserach-7-10/272147)
**Author:** [@SafiaSo](https://discuss.elastic.co/u/SafiaSo)\ **Replies:** 4\ **Last updated:** [May 6, 2021, 7:27am UTC](https://discuss.elastic.co/t/metricbeat-on-elasticserach-7-10/272147 "2021-05-06T07:27:19Z")
Hi Should we install metricbeat on elasticsearch 7.10 ? --- ## [I want to further split messages into json and message after splitting them with grok](https://discuss.elastic.co/t/i-want-to-further-split-messages-into-json-and-message-after-splitting-them-with-grok/272243)
**Author:** [@its-ogawa](https://discuss.elastic.co/u/its-ogawa)\ **Replies:** 4\ **Last updated:** [May 6, 2021, 7:23am UTC](https://discuss.elastic.co/t/i-want-to-further-split-messages-into-json-and-message-after-splitting-them-with-grok/272243 "2021-05-06T07:23:10Z")
I want to further split messages into json and message after splitting them with grok. I am using grok to split messages. I'm getting a log in json format in a field, and I found a case where the field contains both js… --- ## [Slow search process in kibana Discover](https://discuss.elastic.co/t/slow-search-process-in-kibana-discover/272188)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 4\ **Last updated:** [May 6, 2021, 6:23am UTC](https://discuss.elastic.co/t/slow-search-process-in-kibana-discover/272188 "2021-05-06T06:23:54Z")
I am using elk 7.11..i am searching an index size of 100gb but it taking long time more than 5 minutes or i can say it is not showing me the data it can show me only 7 days data although it contain last 30 days data but… --- ## [Can Heartbeat use basic auth to log into a website](https://discuss.elastic.co/t/can-heartbeat-use-basic-auth-to-log-into-a-website/270208)
**Author:** [@Simon\_Becker](https://discuss.elastic.co/u/Simon_Becker)\ **Replies:** 3\ **Last updated:** [May 6, 2021, 5:34am UTC](https://discuss.elastic.co/t/can-heartbeat-use-basic-auth-to-log-into-a-website/270208 "2021-05-06T05:34:34Z")
Hello Elasticians, I am trying out the new Synthetics Module in Heartbeat. The webserver I am trying to check has a basic auth feature implemented. So before I can access the webpage I need to use user and password to … --- ## [Basic security Setup multi Node Cluster Query](https://discuss.elastic.co/t/basic-security-setup-multi-node-cluster-query/271232)
**Author:** [@Boris\_Joseph](https://discuss.elastic.co/u/Boris_Joseph)\ **Replies:** 3\ **Last updated:** [May 6, 2021, 5:09am UTC](https://discuss.elastic.co/t/basic-security-setup-multi-node-cluster-query/271232 "2021-05-06T05:09:32Z")
Hi Elastic team, Below reference indicates, that before proceeding with basic security, the minimal security steps must be completed for every node in the cluster. Does that mean we must bring down all ES nodes in s… --- ## [Add custom field and its value needs to be derived from one of the source field](https://discuss.elastic.co/t/add-custom-field-and-its-value-needs-to-be-derived-from-one-of-the-source-field/272229)
**Author:** [@AnamikaN](https://discuss.elastic.co/u/AnamikaN)\ **Replies:** 2\ **Last updated:** [May 6, 2021, 4:47am UTC](https://discuss.elastic.co/t/add-custom-field-and-its-value-needs-to-be-derived-from-one-of-the-source-field/272229 "2021-05-06T04:47:15Z")
I need to add one custom field 'log.level' into filebeat.yml. ITs value needs to be derived from one of source field 'message'. I need to extract log level (INFO or DEBUG or ERROR etc.) from message. Message field looks … --- ## [Add custom field and its value needs to be derived from one of the source field](https://discuss.elastic.co/t/add-custom-field-and-its-value-needs-to-be-derived-from-one-of-the-source-field/272119)
**Author:** [@AnamikaN](https://discuss.elastic.co/u/AnamikaN)\ **Replies:** 5\ **Last updated:** [May 6, 2021, 4:48am UTC](https://discuss.elastic.co/t/add-custom-field-and-its-value-needs-to-be-derived-from-one-of-the-source-field/272119 "2021-05-06T04:48:03Z")
I need to add one custom field 'log.level' into filebeat.yml. ITs value needs to be derived from one of source field 'message'. I need to extract log level (INFO or DEBUG or ERROR etc.) from message. Message field looks … --- ## [Moustache script syntax for aggregated buckets](https://discuss.elastic.co/t/moustache-script-syntax-for-aggregated-buckets/272145)
**Author:** [@michaelv](https://discuss.elastic.co/u/michaelv)\ **Replies:** 2\ **Last updated:** [May 6, 2021, 4:32am UTC](https://discuss.elastic.co/t/moustache-script-syntax-for-aggregated-buckets/272145 "2021-05-06T04:32:16Z")
Hi All, I'm sure this is a no brainer question. I have a search followed by this aggregation: "aggs": { "destination\_ip": { "significant\_terms": { … --- ## [Authentication of \[elastic\] was terminated by realm \[reserved\] - failed to authenticate user \[elastic\]](https://discuss.elastic.co/t/authentication-of-elastic-was-terminated-by-realm-reserved-failed-to-authenticate-user-elastic/272235)
**Author:** [@Pablo\_Andres\_Santama](https://discuss.elastic.co/u/Pablo_Andres_Santama)\ **Replies:** 0\ **Last updated:** [May 6, 2021, 3:43am UTC](https://discuss.elastic.co/t/authentication-of-elastic-was-terminated-by-realm-reserved-failed-to-authenticate-user-elastic/272235 "2021-05-06T03:43:01Z")
Hello All I have a cluster which was running in 7.7.0 version without issues and I just update it to 7.12.1 version and when I scale out the cluster the new instance is able to join the cluster but after a minute shows … --- ## [How to connect beats to elasticsearch, when elasticsearch using ssl/tls](https://discuss.elastic.co/t/how-to-connect-beats-to-elasticsearch-when-elasticsearch-using-ssl-tls/271735)
**Author:** [@alipujaistopo](https://discuss.elastic.co/u/alipujaistopo)\ **Replies:** 19\ **Last updated:** [May 6, 2021, 2:36am UTC](https://discuss.elastic.co/t/how-to-connect-beats-to-elasticsearch-when-elasticsearch-using-ssl-tls/271735 "2021-05-06T02:36:27Z")
what should i do to make all of my beat can send log to my elasticsearch since i setting ssl/tls to my elasticsearch. this my configuration and the log ##################### Filebeat Configuration Example ##############… --- ## [Find Cases API endpoint](https://discuss.elastic.co/t/find-cases-api-endpoint/271904)
**Author:** [@rpiccio](https://discuss.elastic.co/u/rpiccio)\ **Replies:** 1\ **Last updated:** [May 6, 2021, 2:05am UTC](https://discuss.elastic.co/t/find-cases-api-endpoint/271904 "2021-05-06T02:05:56Z")
Hi! I've been playing a bit with the Find Cases API endpoint but I'm unable to filter cases by any field other than status, reporters and tags. I've tried the Saved Objects filter parameter with lots of expresions to t… --- ## [Process never end when I run a single pipeline inside a docker container](https://discuss.elastic.co/t/process-never-end-when-i-run-a-single-pipeline-inside-a-docker-container/272231)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 1\ **Last updated:** [May 6, 2021, 1:41am UTC](https://discuss.elastic.co/t/process-never-end-when-i-run-a-single-pipeline-inside-a-docker-container/272231 "2021-05-06T01:41:39Z")
with a python script Im running logstash via command inside a docker container, the normal behavior (with logstash installed in the server) is that after the pipeline get the data that pipeline shuts down, but the proces… --- ## [Alert mail siem format question](https://discuss.elastic.co/t/alert-mail-siem-format-question/271849)
**Author:** [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Replies:** 1\ **Last updated:** [May 6, 2021, 1:15am UTC](https://discuss.elastic.co/t/alert-mail-siem-format-question/271849 "2021-05-06T01:15:50Z")
Hi all i have a question regarding elastic alert mail in siem. last time i get the test mail send was successfully parse the field to the mail. but this time i want to know that if the data that i have is not like json… --- ## [Sync Clusters](https://discuss.elastic.co/t/sync-clusters/272169)
**Author:** [@Chen\_Levi](https://discuss.elastic.co/u/Chen_Levi)\ **Replies:** 1\ **Last updated:** [May 6, 2021, 12:28am UTC](https://discuss.elastic.co/t/sync-clusters/272169 "2021-05-06T00:28:48Z")
Hi i have a Prod ES Cluster (elastic.co) and a Staging one. i want to create a nightly process that sync the Prod cluster into Staging cluster so we will have updated data from prod. the way i want to do that is the f… --- ## [Rollover illegal\_state\_exception and illegal\_argument\_exception](https://discuss.elastic.co/t/rollover-illegal-state-exception-and-illegal-argument-exception/272197)
**Author:** [@dorinand](https://discuss.elastic.co/u/dorinand)\ **Replies:** 0\ **Last updated:** [May 5, 2021, 1:45pm UTC](https://discuss.elastic.co/t/rollover-illegal-state-exception-and-illegal-argument-exception/272197 "2021-05-05T13:45:45Z")
I implemented rollover index myapp ant it works like a charm for a long time. Today, I find out in Kibana that two of my indices encounter errors: 2 indices have lifecycle errors. GET /\_cat/aliases/myapp?v=true alias in… --- ## [How to run multiple logstash config in parallel](https://discuss.elastic.co/t/how-to-run-multiple-logstash-config-in-parallel/272198)
**Author:** [@ullasrao](https://discuss.elastic.co/u/ullasrao)\ **Replies:** 1\ **Last updated:** [May 6, 2021, 12:20am UTC](https://discuss.elastic.co/t/how-to-run-multiple-logstash-config-in-parallel/272198 "2021-05-06T00:20:05Z")
hi , i am new to ELK and I am setting up the pipelines for the data. i have a requirement where i have to read data from 2 different kafka topics and load them to 2 different elastic search tables respectively. I hav… --- ## [Issues with starting Filebeat 7.9.1](https://discuss.elastic.co/t/issues-with-starting-filebeat-7-9-1/272215)
**Author:** [@OtienoC](https://discuss.elastic.co/u/OtienoC)\ **Replies:** 1\ **Last updated:** [May 6, 2021, 12:11am UTC](https://discuss.elastic.co/t/issues-with-starting-filebeat-7-9-1/272215 "2021-05-06T00:11:33Z")
Having issues starting filebeat installed in RHEL8 . Error is related to kibana wanting permissions. Output error is below: Last login: Tue Apr 27 14:39:31 2021 from 10.147.4.244 # ausearch -c 'filebeat' --raw | audit2… --- ## [Filebeat Syslog isn't Opening Port](https://discuss.elastic.co/t/filebeat-syslog-isnt-opening-port/272126)
**Author:** [@odin-bb](https://discuss.elastic.co/u/odin-bb)\ **Replies:** 4\ **Last updated:** [May 5, 2021, 11:59pm UTC](https://discuss.elastic.co/t/filebeat-syslog-isnt-opening-port/272126 "2021-05-05T23:59:37Z")
Good Afternoon, First off, thank you for whatever help/suggestions you provide. I recently posted in the r/elasticsearch trying to understand the difference between logstash and filebeat and was greatly helped by someo… --- ## [Is it possible to adjust the point to point settings?](https://discuss.elastic.co/t/is-it-possible-to-adjust-the-point-to-point-settings/272124)
**Author:** [@seanziee](https://discuss.elastic.co/u/seanziee)\ **Replies:** 2\ **Last updated:** [May 5, 2021, 11:36pm UTC](https://discuss.elastic.co/t/is-it-possible-to-adjust-the-point-to-point-settings/272124 "2021-05-05T23:36:47Z")
I'm a bit confused at the aggregation feature of the point to point functionality. I am showing connections between nodes in a network of about 20 machines and I would like the lines to terminate on the node so I can un… --- ## [How to get License for on-premise stack](https://discuss.elastic.co/t/how-to-get-license-for-on-premise-stack/271799)
**Author:** [@twilight](https://discuss.elastic.co/u/twilight)\ **Replies:** 2\ **Last updated:** [May 5, 2021, 10:46pm UTC](https://discuss.elastic.co/t/how-to-get-license-for-on-premise-stack/271799 "2021-05-05T22:46:43Z")
Hello, I have been using some Gold features on trial and now we have decided to buy and implement the license into our on-prem ES and Kibana setup. I have been trying to find where do we select the license type, pay an… --- ## [Query sem dados](https://discuss.elastic.co/t/query-sem-dados/272017)
**Author:** [@francieliton\_araujo](https://discuss.elastic.co/u/francieliton_araujo)\ **Replies:** 4\ **Last updated:** [May 5, 2021, 6:35pm UTC](https://discuss.elastic.co/t/query-sem-dados/272017 "2021-05-05T18:35:54Z")
Is there a way to do some elasticquery and if it didn't work, it returns something default? [Previous page](https://discuss.elastic.co/latest.md?page=1691) [Next page](https://discuss.elastic.co/latest.md?page=1693)