# Latest **URL:** https://discuss.elastic.co/latest.md?page=1706 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1707 --- ## [Machine Learning Functions](https://discuss.elastic.co/t/machine-learning-functions/271404)
**Author:** [@Elk\_huh](https://discuss.elastic.co/u/Elk_huh)\ **Replies:** 3\ **Last updated:** [April 28, 2021, 10:06pm UTC](https://discuss.elastic.co/t/machine-learning-functions/271404 "2021-04-28T22:06:12Z")
If i had a Datafeed that spammed multiple docs at once ( for example botnetalert, it triggered 20x ) What is the best function to use to just alert of that one event of all 20 events this is in a short period of course … --- ## [Metricbeat not retrieving GCP metrics](https://discuss.elastic.co/t/metricbeat-not-retrieving-gcp-metrics/271562)
**Author:** [@Francisco\_Gomez1](https://discuss.elastic.co/u/Francisco_Gomez1)\ **Replies:** 0\ **Last updated:** [April 28, 2021, 9:50pm UTC](https://discuss.elastic.co/t/metricbeat-not-retrieving-gcp-metrics/271562 "2021-04-28T21:50:00Z")
Hi im trying to use metricbeat to monitor a GCP instance, i followed all the steps presents in: Monitor Google Cloud Platform | Observability Guide \[7.12\] | Elastic this tutorial. But when i try to test my GCP connectio… --- ## [Logstash IPV4 bind issue](https://discuss.elastic.co/t/logstash-ipv4-bind-issue/271303)
**Author:** [@edvrfn](https://discuss.elastic.co/u/edvrfn)\ **Replies:** 6\ **Last updated:** [April 28, 2021, 9:09pm UTC](https://discuss.elastic.co/t/logstash-ipv4-bind-issue/271303 "2021-04-28T21:09:52Z")
I have stopped/disabled firewalld and restarted logstash/Elasticsearch services but netstat only shows them listening only on IPv6. Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address … --- ## [Unable to Parse Meraki Flow Syslog Message with GROK and KV Filters in Logstash](https://discuss.elastic.co/t/unable-to-parse-meraki-flow-syslog-message-with-grok-and-kv-filters-in-logstash/271446)
**Author:** [@Khughes0516](https://discuss.elastic.co/u/Khughes0516)\ **Replies:** 4\ **Last updated:** [April 28, 2021, 9:03pm UTC](https://discuss.elastic.co/t/unable-to-parse-meraki-flow-syslog-message-with-grok-and-kv-filters-in-logstash/271446 "2021-04-28T21:03:53Z")
Hello, I am having a lot of trouble with trying to parse a Cisco Meraki flow syslog message in Logstash. A sample message looks like this: Apr 25 13:12:41 gateway 1619356361.230223408 ip\_flow\_end src=10.1.130.45 dst=3… --- ## [I want to import only data that are on a several namespaces](https://discuss.elastic.co/t/i-want-to-import-only-data-that-are-on-a-several-namespaces/271521)
**Author:** [@zozo6015](https://discuss.elastic.co/u/zozo6015)\ **Replies:** 3\ **Last updated:** [April 28, 2021, 8:59pm UTC](https://discuss.elastic.co/t/i-want-to-import-only-data-that-are-on-a-several-namespaces/271521 "2021-04-28T20:59:31Z")
Hello, I want to injest via filebeat only data from containers that are in a certain namespace. Is there a possibility to do that? --- ## [Search over all fields](https://discuss.elastic.co/t/search-over-all-fields/271511)
**Author:** [@Sander\_Marx](https://discuss.elastic.co/u/Sander_Marx)\ **Replies:** 3\ **Last updated:** [April 28, 2021, 8:33pm UTC](https://discuss.elastic.co/t/search-over-all-fields/271511 "2021-04-28T20:33:13Z")
Hi, i have a index with multiple documents with severeal fields. I want to be able to search over all the fields without using multi\_match and manualy writing each field. Is there a way to do this? Here is an example of… --- ## [NESTED ATTRIBUTE RENAME NOT WORKING](https://discuss.elastic.co/t/nested-attribute-rename-not-working/271545)
**Author:** [@kamalgunda](https://discuss.elastic.co/u/kamalgunda)\ **Replies:** 3\ **Last updated:** [April 28, 2021, 8:30pm UTC](https://discuss.elastic.co/t/nested-attribute-rename-not-working/271545 "2021-04-28T20:30:27Z")
Hi All, I am not able to rename the nested attribute through logstash mutate/filter/ruby codes while loading the Elasticsearch index and input data is from database. Sample input data and logstash config file given bel… --- ## [Calculate the time difference between 2 xml log lines](https://discuss.elastic.co/t/calculate-the-time-difference-between-2-xml-log-lines/271458)
**Author:** [@roua.B](https://discuss.elastic.co/u/roua.B)\ **Replies:** 4\ **Last updated:** [April 28, 2021, 7:49pm UTC](https://discuss.elastic.co/t/calculate-the-time-difference-between-2-xml-log-lines/271458 "2021-04-28T19:49:02Z")
Hello everyone, I have an XML log file that looks like this: \ \ \ **Author:** [@Vannessa\_Kemeni](https://discuss.elastic.co/u/Vannessa_Kemeni)\ **Replies:** 2\ **Last updated:** [April 28, 2021, 7:42pm UTC](https://discuss.elastic.co/t/find-the-gelocation-from-ip-internal-network/270559 "2021-04-28T19:42:49Z") Hello, i have internal ip adress and the corresonding geolocation. How i can create a list with those ip adresses and the location and enrich my documents in elastic search. Thank you. --- ## [Use a password protected elasticsearch-ca.pem inside kibana.kml](https://discuss.elastic.co/t/use-a-password-protected-elasticsearch-ca-pem-inside-kibana-kml/271396)
**Author:** [@ehsan\_kabiri\_33](https://discuss.elastic.co/u/ehsan_kabiri_33)\ **Replies:** 2\ **Last updated:** [April 28, 2021, 6:05pm UTC](https://discuss.elastic.co/t/use-a-password-protected-elasticsearch-ca-pem-inside-kibana-kml/271396 "2021-04-28T18:05:07Z")
To make communications between Kibana and Elasticsearch be encrypted , I can use one of the followings: elasticsearch.ssl.certificateAuthorities: /etc/kibana/elasticsearch-ca.pem elasticsearch.ssl.key.path: /etc/kibana… --- ## [How to monitor the number of events in Dead letter queue](https://discuss.elastic.co/t/how-to-monitor-the-number-of-events-in-dead-letter-queue/271410)
**Author:** [@Animesh\_Agarwal](https://discuss.elastic.co/u/Animesh_Agarwal)\ **Replies:** 2\ **Last updated:** [April 28, 2021, 6:03pm UTC](https://discuss.elastic.co/t/how-to-monitor-the-number-of-events-in-dead-letter-queue/271410 "2021-04-28T18:03:45Z")
Hi Team, We have configured Dead Letter Queue(DLQ) in our Logstash layer. We want to be alerted when the number of events in DLQ increase beyond a certain limit. I tried going through the Logstash Monitoring docs, but… --- ## [Elasticsearch query to update one document using data from another document in the same es](https://discuss.elastic.co/t/elasticsearch-query-to-update-one-document-using-data-from-another-document-in-the-same-es/271540)
**Author:** [@chamiduz](https://discuss.elastic.co/u/chamiduz)\ **Replies:** 0\ **Last updated:** [April 28, 2021, 5:06pm UTC](https://discuss.elastic.co/t/elasticsearch-query-to-update-one-document-using-data-from-another-document-in-the-same-es/271540 "2021-04-28T17:06:56Z")
Hi, I have static data stored in elasticsearch. for example country name and country id { "id" : 250, "name" : "Sri Lanka" } { "id" : 260, "name" : "India" } I am getting another set of attraction data from a web ser… --- ## [Rally on docker will not list tracks "Cannot list. Could not register track plugin"](https://discuss.elastic.co/t/rally-on-docker-will-not-list-tracks-cannot-list-could-not-register-track-plugin/271510)
**Author:** [@dre](https://discuss.elastic.co/u/dre)\ **Replies:** 2\ **Last updated:** [April 28, 2021, 5:02pm UTC](https://discuss.elastic.co/t/rally-on-docker-will-not-list-tracks-cannot-list-could-not-register-track-plugin/271510 "2021-04-28T17:02:40Z")
Hi, Trying to do the first step with running elastic rally in docker. I get the following issue, both on RHEL VM and on windows. I cannot find anything on this problem in the forum or general searching. Any help apprec… --- ## [How to send core web vitals data to RUM(Real User Monitoring) in a angular 11 app?](https://discuss.elastic.co/t/how-to-send-core-web-vitals-data-to-rum-real-user-monitoring-in-a-angular-11-app/271450)
**Author:** [@DSMilestone](https://discuss.elastic.co/u/DSMilestone)\ **Replies:** 4\ **Last updated:** [April 28, 2021, 4:41pm UTC](https://discuss.elastic.co/t/how-to-send-core-web-vitals-data-to-rum-real-user-monitoring-in-a-angular-11-app/271450 "2021-04-28T16:41:06Z")
Hi there, I was configuring RUM for my angular app using this \[Angular integration | APM Real User Monitoring JavaScript Agent Reference \[5.x\] | Elastic\]. But when check the in Kibana user experience section I was not a… --- ## [\_dateparsefailure mapping date and time to @timestamp field](https://discuss.elastic.co/t/dateparsefailure-mapping-date-and-time-to-timestamp-field/271509)
**Author:** [@Wilks](https://discuss.elastic.co/u/Wilks)\ **Replies:** 2\ **Last updated:** [April 28, 2021, 4:17pm UTC](https://discuss.elastic.co/t/dateparsefailure-mapping-date-and-time-to-timestamp-field/271509 "2021-04-28T16:17:52Z")
I am getting a \_dateparsefailure when I try to map the date and time the log arrived to the @timestamp field. Below is my filter, if I comment out the attempt to map to @timestamp I dont get a \_dateparsefailure so it so… --- ## [Threat Intel Module for Elastic cloud](https://discuss.elastic.co/t/threat-intel-module-for-elastic-cloud/271198)
**Author:** [@zoot](https://discuss.elastic.co/u/zoot)\ **Replies:** 7\ **Last updated:** [April 28, 2021, 4:15pm UTC](https://discuss.elastic.co/t/threat-intel-module-for-elastic-cloud/271198 "2021-04-28T16:15:00Z")
Hi, I am using Elastic Cloud for SEIM + Endpoint Security usecase. I want to integrate OTX as threat intel source but from the documentation it seems I need to use some different system instead of adding integration dir… --- ## [Logstash stop to output when one kafka node is down](https://discuss.elastic.co/t/logstash-stop-to-output-when-one-kafka-node-is-down/271412)
**Author:** [@Travis](https://discuss.elastic.co/u/Travis)\ **Replies:** 11\ **Last updated:** [April 28, 2021, 4:08pm UTC](https://discuss.elastic.co/t/logstash-stop-to-output-when-one-kafka-node-is-down/271412 "2021-04-28T16:08:22Z")
Hello everybody, I have a 3 kafka nodes cluster Logstash has a kafka input and output to elasticsearch and syslog (I'm using logstash output isolator pattern). When one kafka node is down (kafka3 in this case), logstas… --- ## [GCP module - Add cluster\_name for GKE / k8s.io logs](https://discuss.elastic.co/t/gcp-module-add-cluster-name-for-gke-k8s-io-logs/271278)
**Author:** [@aryon](https://discuss.elastic.co/u/aryon)\ **Replies:** 8\ **Last updated:** [April 28, 2021, 4:05pm UTC](https://discuss.elastic.co/t/gcp-module-add-cluster-name-for-gke-k8s-io-logs/271278 "2021-04-28T16:05:05Z")
Hello, I am using the GCP module to collect GCP audit logs. I noticed that for GKE / k8s.io logs, we do not have the cluster\_name in the ingested event. The field is present in the original event collected in Pub/Sub, … --- ## [Using esrally eql track to test es7.5 with error](https://discuss.elastic.co/t/using-esrally-eql-track-to-test-es7-5-with-error/270548)
**Author:** [@alittlejoy](https://discuss.elastic.co/u/alittlejoy)\ **Replies:** 5\ **Last updated:** [April 28, 2021, 3:39pm UTC](https://discuss.elastic.co/t/using-esrally-eql-track-to-test-es7-5-with-error/270548 "2021-04-28T15:39:52Z")
hello I am using esrally eql track to test ES7.5.1 But I met an error ,does anyone has any idea? \[ERROR\] Cannot race. Error in load generator \[4\] ("Request returned an error. Error type: transport, Description: illeg… --- ## [Configuring and better understanding index.refresh\_interval for an index updated twice a day](https://discuss.elastic.co/t/configuring-and-better-understanding-index-refresh-interval-for-an-index-updated-twice-a-day/271535)
**Author:** [@Catalin](https://discuss.elastic.co/u/Catalin)\ **Replies:** 1\ **Last updated:** [April 28, 2021, 3:33pm UTC](https://discuss.elastic.co/t/configuring-and-better-understanding-index-refresh-interval-for-an-index-updated-twice-a-day/271535 "2021-04-28T15:33:27Z")
How exactly does index.refresh\_interval affect search performance ? I have an index that is updated for 10 mins twice a day. Is it sufficient to refresh it 1 time, once the updating process finishes and disable index.re… --- ## [Http curl queries. is possible?](https://discuss.elastic.co/t/http-curl-queries-is-possible/271422)
**Author:** [@sylvani](https://discuss.elastic.co/u/sylvani)\ **Replies:** 4\ **Last updated:** [April 28, 2021, 3:28pm UTC](https://discuss.elastic.co/t/http-curl-queries-is-possible/271422 "2021-04-28T15:28:37Z")
Hello, I need to ask a question, maybe a little stupid ... Is it possible to query the kibana web console by http and curl? Is there a way for this to return the data from the query? Thanks --- ## [Kibana Metrics Logs Timeouts in some spaces](https://discuss.elastic.co/t/kibana-metrics-logs-timeouts-in-some-spaces/271501)
**Author:** [@Kosodrom](https://discuss.elastic.co/u/Kosodrom)\ **Replies:** 3\ **Last updated:** [April 28, 2021, 3:18pm UTC](https://discuss.elastic.co/t/kibana-metrics-logs-timeouts-in-some-spaces/271501 "2021-04-28T15:18:11Z")
Hi folks, I experience strange behavior in my kibana 7.6.2. I have multiple different spaces, where I have not changed the default settings for metrics or logs dashboards. In some spaces when I press on Metrics after … --- ## [Input on UDP converting to default UTF-8 but want Hex Strings](https://discuss.elastic.co/t/input-on-udp-converting-to-default-utf-8-but-want-hex-strings/271513)
**Author:** [@Yasho](https://discuss.elastic.co/u/Yasho)\ **Replies:** 0\ **Last updated:** [April 28, 2021, 12:52pm UTC](https://discuss.elastic.co/t/input-on-udp-converting-to-default-utf-8-but-want-hex-strings/271513 "2021-04-28T12:52:43Z")
Why is logstash converting input stream by default to UTF-8, ASCII, Unsigned Char, I want the data either converted full or do not touch it.. There is no codec to format the received data on UDP port. Example: This i… --- ## [Kibana table question](https://discuss.elastic.co/t/kibana-table-question/271514)
**Author:** [@nunex\_17](https://discuss.elastic.co/u/nunex_17)\ **Replies:** 1\ **Last updated:** [April 28, 2021, 3:00pm UTC](https://discuss.elastic.co/t/kibana-table-question/271514 "2021-04-28T15:00:35Z")
Hi there. I have a dashboard with some tables like this. My idea is to set an URL on each of these entries that redirects to the "Discover" tab with the filter applied, for example, click on "ET POLICY TEAMVIEWER DYN… --- ## [Creating a threshold based rule in the detection engine](https://discuss.elastic.co/t/creating-a-threshold-based-rule-in-the-detection-engine/270941)
**Author:** [@abhishek\_s1](https://discuss.elastic.co/u/abhishek_s1)\ **Replies:** 2\ **Last updated:** [April 28, 2021, 2:51pm UTC](https://discuss.elastic.co/t/creating-a-threshold-based-rule-in-the-detection-engine/270941 "2021-04-28T14:51:06Z")
I'm managing logs of a particular server, I'm defining an activity of a person with some username to be suspicious if there is sudden increase in their activity( i.e., user logs into server 100 times whereas on average h… --- ## [Maps delayed loading of cluster circle icon](https://discuss.elastic.co/t/maps-delayed-loading-of-cluster-circle-icon/271444)
**Author:** [@DMinovski](https://discuss.elastic.co/u/DMinovski)\ **Replies:** 3\ **Last updated:** [April 28, 2021, 2:41pm UTC](https://discuss.elastic.co/t/maps-delayed-loading-of-cluster-circle-icon/271444 "2021-04-28T14:41:53Z")
I'm using Maps in Kibana 7.11.1. The maps have a field filter in the cluster settings menu, and the dashboard has one or two global filters in the top menu. Sometimes, there is a delay of the cluster circle icon if it's … --- ## [Fleet Beta Risks](https://discuss.elastic.co/t/fleet-beta-risks/271467)
**Author:** [@hilt86](https://discuss.elastic.co/u/hilt86)\ **Replies:** 2\ **Last updated:** [April 28, 2021, 1:57pm UTC](https://discuss.elastic.co/t/fleet-beta-risks/271467 "2021-04-28T13:57:53Z")
Can someone from Elastic tell us what the risks of running Fleet are? when you run Fleet it says : Fleet is under active development and is not intended for use in production environments. This beta release is designed … --- ## [ElasticsearchRestTemplate After not using it for a period of time: Java.io.ioException: The remote host forced closure of an existing connection](https://discuss.elastic.co/t/elasticsearchresttemplate-after-not-using-it-for-a-period-of-time-java-io-ioexception-the-remote-host-forced-closure-of-an-existing-connection/271172)
**Author:** [@canye666](https://discuss.elastic.co/u/canye666)\ **Replies:** 7\ **Last updated:** [April 28, 2021, 1:57pm UTC](https://discuss.elastic.co/t/elasticsearchresttemplate-after-not-using-it-for-a-period-of-time-java-io-ioexception-the-remote-host-forced-closure-of-an-existing-connection/271172 "2021-04-28T13:57:23Z")
远程主机强迫关闭了一个现有的连接。; nested exception is java.lang.RuntimeException: 远程主机强迫关闭了一个现有的连接。 org.springframework.dao.DataAccessResourceFailureException: 远程主机强迫关闭了一个现有的连接。 at org.springframework.data.elasticsearch.cor… --- ## [Logstash Ouptut to Elasticsearch when one node is down](https://discuss.elastic.co/t/logstash-ouptut-to-elasticsearch-when-one-node-is-down/270876)
**Author:** [@linfordwoode](https://discuss.elastic.co/u/linfordwoode)\ **Replies:** 6\ **Last updated:** [April 28, 2021, 1:52pm UTC](https://discuss.elastic.co/t/logstash-ouptut-to-elasticsearch-when-one-node-is-down/270876 "2021-04-28T13:52:52Z")
Logstash sending output to three ES nodes. When one ES node is down, Logstash doesn't forward specific outputs to other nodes, probably because the dead node was receiving the output. For example, in the Logstash conf be… --- ## [Filebeat .csv file is not updating on Kibana](https://discuss.elastic.co/t/filebeat-csv-file-is-not-updating-on-kibana/270393)
**Author:** [@SHUBHAM\_SALUNKHE](https://discuss.elastic.co/u/SHUBHAM_SALUNKHE)\ **Replies:** 11\ **Last updated:** [April 28, 2021, 1:38pm UTC](https://discuss.elastic.co/t/filebeat-csv-file-is-not-updating-on-kibana/270393 "2021-04-28T13:38:34Z")
Hi, there are 2 .conf files under conf.d on server where ELK is hosted. one .conf file for jenkins logs & another one for filebeat. filebeat is hosted on another server. So, which .conf file is taken as config file? Al… [Previous page](https://discuss.elastic.co/latest.md?page=1705) [Next page](https://discuss.elastic.co/latest.md?page=1707)