# Latest **URL:** https://discuss.elastic.co/latest.md?page=1710 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1711 --- ## [Parsing audit log SAP](https://discuss.elastic.co/t/parsing-audit-log-sap/271373)
**Author:** [@San9](https://discuss.elastic.co/u/San9)\ **Replies:** 0\ **Last updated:** [April 27, 2021, 12:41pm UTC](https://discuss.elastic.co/t/parsing-audit-log-sap/271373 "2021-04-27T12:41:20Z")
hello team, there was a need to analyze SAP audit logs. A filebeat was installed on the machines to transfer logs from to logstash. Format of audit logs - a file is created every day and data is written in one line (me… --- ## [Logstash container stuck in a restart loop](https://discuss.elastic.co/t/logstash-container-stuck-in-a-restart-loop/271372)
**Author:** [@gorbroth](https://discuss.elastic.co/u/gorbroth)\ **Replies:** 0\ **Last updated:** [April 27, 2021, 12:40pm UTC](https://discuss.elastic.co/t/logstash-container-stuck-in-a-restart-loop/271372 "2021-04-27T12:40:47Z")
Hi, My new logstash docker container is stuck in a restart loop . Error in logs - Does it try to require a relative path? That's been removed in Ruby 1.9. uri:classloader:/META-INF/jruby.home/lib/ru… --- ## [Filebeat does not mount volume](https://discuss.elastic.co/t/filebeat-does-not-mount-volume/271269)
**Author:** [@ata](https://discuss.elastic.co/u/ata)\ **Replies:** 3\ **Last updated:** [April 27, 2021, 12:28pm UTC](https://discuss.elastic.co/t/filebeat-does-not-mount-volume/271269 "2021-04-27T12:28:06Z")
Hi, I was running filebeat 7.10.1 on EKS 1.18 and everything was fine, after the EKS upgrade of EKS to 1.19 filebeat container cannot mount its volume: MountVolume.SetUp failed for volume "docker-sock" : hostPath type … --- ## [Failed to start Elasticsearch](https://discuss.elastic.co/t/failed-to-start-elasticsearch/271251)
**Author:** [@Rizky\_Hudha](https://discuss.elastic.co/u/Rizky_Hudha)\ **Replies:** 9\ **Last updated:** [April 27, 2021, 12:11pm UTC](https://discuss.elastic.co/t/failed-to-start-elasticsearch/271251 "2021-04-27T12:11:16Z")
hello, I have a problem regarding elasticsearch, where to start, the error "Failed to start Elasticsearch" always appears, please help to solve my error, thank you Apr 27 02:48:09 bigdata systemd\[1\]: Unit elasticsearch.… --- ## [Big mapping and few fields on index](https://discuss.elastic.co/t/big-mapping-and-few-fields-on-index/270999)
**Author:** [@pereyrdi](https://discuss.elastic.co/u/pereyrdi)\ **Replies:** 2\ **Last updated:** [April 27, 2021, 12:03pm UTC](https://discuss.elastic.co/t/big-mapping-and-few-fields-on-index/270999 "2021-04-27T12:03:06Z")
Hello folks! A question about index template, because Im creating a template for many indexs and not in alls indexs, all fields available in template are used. In some case less than ten, and in template are available a… --- ## [Elastic Agent and/or Filebeat](https://discuss.elastic.co/t/elastic-agent-and-or-filebeat/270967)
**Author:** [@insurin](https://discuss.elastic.co/u/insurin)\ **Replies:** 1\ **Last updated:** [April 27, 2021, 11:57am UTC](https://discuss.elastic.co/t/elastic-agent-and-or-filebeat/270967 "2021-04-27T11:57:28Z")
HI all. I have followed this guide ELK-SIEM/Deployment-Guide at main · watsoninfosec/ELK-SIEM · GitHub This installs ElasticSearch, Kibana, Logstash and Filebeat on Ubuntu. I have 3 Windows Servers showing as healthy. E… --- ## [Visualisation Painless script between two characters](https://discuss.elastic.co/t/visualisation-painless-script-between-two-characters/271296)
**Author:** [@georgejolliffe](https://discuss.elastic.co/u/georgejolliffe)\ **Replies:** 7\ **Last updated:** [April 27, 2021, 11:50am UTC](https://discuss.elastic.co/t/visualisation-painless-script-between-two-characters/271296 "2021-04-27T11:50:03Z")
Hi guys, I have this example string in a field called querystring: utm\_medium=inapp&utm\_source=crm&utm\_campaign=newsl&utm\_term=fishandchips I am trying to visualise occurrences of all the possible "utm\_source". I can'… --- ## [Canvas - x-Axis label width](https://discuss.elastic.co/t/canvas-x-axis-label-width/271368)
**Author:** [@KevSex](https://discuss.elastic.co/u/KevSex)\ **Replies:** 0\ **Last updated:** [April 27, 2021, 11:48am UTC](https://discuss.elastic.co/t/canvas-x-axis-label-width/271368 "2021-04-27T11:48:35Z")
Continuing the discussion from Canvas - Graph legend position: I have a line chart with a legend and using the below CSS, I am able to show the legend on the right side that doesn't obstruct the graph. .canvasRenderEl … --- ## [Change filebeat default index name while using Suricata module](https://discuss.elastic.co/t/change-filebeat-default-index-name-while-using-suricata-module/271302)
**Author:** [@nunex\_17](https://discuss.elastic.co/u/nunex_17)\ **Replies:** 3\ **Last updated:** [April 27, 2021, 11:40am UTC](https://discuss.elastic.co/t/change-filebeat-default-index-name-while-using-suricata-module/271302 "2021-04-27T11:40:25Z")
Hi! How can I change the filebeat default index name while using Suricata module? Appreciated! --- ## [Two-node graylog+elasticsearch failover cluster](https://discuss.elastic.co/t/two-node-graylog-elasticsearch-failover-cluster/271355)
**Author:** [@dunhillers](https://discuss.elastic.co/u/dunhillers)\ **Replies:** 5\ **Last updated:** [April 27, 2021, 11:29am UTC](https://discuss.elastic.co/t/two-node-graylog-elasticsearch-failover-cluster/271355 "2021-04-27T11:29:17Z")
Hi, I have deployed graylog+elastic on two servers (Centos 7.8). The goal: to create a failover cluster of two nodes with support for index replication. So that if one of the nodes falls, the indexes continue to be writt… --- ## [Elasticsearch terms aggregation with partition does not honor the “size” value](https://discuss.elastic.co/t/elasticsearch-terms-aggregation-with-partition-does-not-honor-the-size-value/271294)
**Author:** [@sayali\_hinge](https://discuss.elastic.co/u/sayali_hinge)\ **Replies:** 4\ **Last updated:** [April 27, 2021, 11:26am UTC](https://discuss.elastic.co/t/elasticsearch-terms-aggregation-with-partition-does-not-honor-the-size-value/271294 "2021-04-27T11:26:55Z")
I have a nested field in the ES index. I used the cardinality aggregation to get the total number of buckets and then came up with num\_partitions, and size values to fetch the buckets. E.g. the total number of term buck… --- ## [Very often FileSystemException : Operation not permitted](https://discuss.elastic.co/t/very-often-filesystemexception-operation-not-permitted/271079)
**Author:** [@rzrucher](https://discuss.elastic.co/u/rzrucher)\ **Replies:** 12\ **Last updated:** [April 27, 2021, 11:17am UTC](https://discuss.elastic.co/t/very-often-filesystemexception-operation-not-permitted/271079 "2021-04-27T11:17:48Z")
Hello, I've a cluster of elasticsearch 6.1.2 and very often in the elasticsearch log I've : \[2021-04-15T01:03:38,388\]\[WARN \]\[o.e.c.a.s.ShardStateAction\] \[ELK1\] \[events-202104\]\[2\] received shard failed for shard… --- ## [Master not discovered yet, this node has not previously joined a bootstrapped (v7+) cluster](https://discuss.elastic.co/t/master-not-discovered-yet-this-node-has-not-previously-joined-a-bootstrapped-v7-cluster/270797)
**Author:** [@overbid](https://discuss.elastic.co/u/overbid)\ **Replies:** 3\ **Last updated:** [April 27, 2021, 11:13am UTC](https://discuss.elastic.co/t/master-not-discovered-yet-this-node-has-not-previously-joined-a-bootstrapped-v7-cluster/270797 "2021-04-27T11:13:42Z")
I'm trying to install via podman compose in 3 machines version: "3" services: es01: image: docker.elastic.co/elasticsearch/elasticsearch:7.12.0 container\_name: es01 environment: … --- ## [Sort aggregation based on TopHits (ie top 10) average score](https://discuss.elastic.co/t/sort-aggregation-based-on-tophits-ie-top-10-average-score/271358)
**Author:** [@JF2018](https://discuss.elastic.co/u/JF2018)\ **Replies:** 1\ **Last updated:** [April 27, 2021, 10:31am UTC](https://discuss.elastic.co/t/sort-aggregation-based-on-tophits-ie-top-10-average-score/271358 "2021-04-27T10:31:02Z")
Hi I wish to be able to sort my buckets from a termAggregation, based on the scores of the top N documents in each bucket. I know how to sort by min/max/avg/sum score for all documents in a bucket (See example I furthe… --- ## [Dockerfile for Metricbeat based on ubi8](https://discuss.elastic.co/t/dockerfile-for-metricbeat-based-on-ubi8/268210)
**Author:** [@noid999](https://discuss.elastic.co/u/noid999)\ **Replies:** 5\ **Last updated:** [April 27, 2021, 9:41am UTC](https://discuss.elastic.co/t/dockerfile-for-metricbeat-based-on-ubi8/268210 "2021-04-27T09:41:56Z")
Hi everyone, we are trying to build a Metricbeat Image based on ubi8. There are a lot of information's but no one explaines how this can be archived. I reverse engineered the official Image but there must be another wa… --- ## [New warm nodes are getting filled fast](https://discuss.elastic.co/t/new-warm-nodes-are-getting-filled-fast/269417)
**Author:** [@prajwalgmpp](https://discuss.elastic.co/u/prajwalgmpp)\ **Replies:** 12\ **Last updated:** [April 27, 2021, 9:35am UTC](https://discuss.elastic.co/t/new-warm-nodes-are-getting-filled-fast/269417 "2021-04-27T09:35:28Z")
Hi All, In the beginning, we had 4 data nodes. Two were ilm designated hot nodes and the other two were warm nodes. Newly created indices would be in the hot nodes under the hot phase and after 4 weeks of retention, wou… --- ## [Change Kibana highlighter](https://discuss.elastic.co/t/change-kibana-highlighter/271344)
**Author:** [@CaptainAmericaFan2](https://discuss.elastic.co/u/CaptainAmericaFan2)\ **Replies:** 1\ **Last updated:** [April 27, 2021, 9:32am UTC](https://discuss.elastic.co/t/change-kibana-highlighter/271344 "2021-04-27T09:32:10Z")
Is it possible to configure Kibana to use fast vector highlighter in its queries instead of the default? I'm running version 7.8 Thanks! --- ## [Index data into Elasticsearch without setting trigger on database tables](https://discuss.elastic.co/t/index-data-into-elasticsearch-without-setting-trigger-on-database-tables/270821)
**Author:** [@e-fo](https://discuss.elastic.co/u/e-fo)\ **Replies:** 3\ **Last updated:** [April 27, 2021, 8:49am UTC](https://discuss.elastic.co/t/index-data-into-elasticsearch-without-setting-trigger-on-database-tables/270821 "2021-04-27T08:49:50Z")
Hi, Our company is a mobile game publisher, we need analyze our published games data from their database and we needs use elasticsearch and kibana for some analysis but the game developers who work with us only give us … --- ## [How to write compound queries on kibana to search multi records of logs](https://discuss.elastic.co/t/how-to-write-compound-queries-on-kibana-to-search-multi-records-of-logs/269812)
**Author:** [@ShashikanthKomandoor](https://discuss.elastic.co/u/ShashikanthKomandoor)\ **Replies:** 1\ **Last updated:** [April 27, 2021, 8:40am UTC](https://discuss.elastic.co/t/how-to-write-compound-queries-on-kibana-to-search-multi-records-of-logs/269812 "2021-04-27T08:40:01Z")
Hi team, I am currently sending my MTAs' /var/log/maillog files to a centralized Elastic Stack Log Analyser. I am using Elastic Stack version 7.X. I have got a requirement to search set of message ids which look like m… --- ## [If else condition in ES query](https://discuss.elastic.co/t/if-else-condition-in-es-query/271319)
**Author:** [@Pallavibhushan](https://discuss.elastic.co/u/Pallavibhushan)\ **Replies:** 4\ **Last updated:** [April 27, 2021, 8:35am UTC](https://discuss.elastic.co/t/if-else-condition-in-es-query/271319 "2021-04-27T08:35:24Z")
Hi, I am trying to write a query for below data: sample data: { "\_index" : "target\_data", "\_type" : "\_doc", "\_id" : "Training\_2020", "\_score" : 1.0, "\_source" : { "year" : "2020", "date\_epoch" : 1577817000000, … --- ## [Discover table - multi line field](https://discuss.elastic.co/t/discover-table-multi-line-field/271248)
**Author:** [@amircogan](https://discuss.elastic.co/u/amircogan)\ **Replies:** 2\ **Last updated:** [April 27, 2021, 8:31am UTC](https://discuss.elastic.co/t/discover-table-multi-line-field/271248 "2021-04-27T08:31:14Z")
Hi there, I have a string field which is multiline, say 20 lines, and I want to see all of them in the discover table, but it get truncated and I see only few lines. I tried field type String, and Truncated string with… --- ## [Filebeat output to Kafka, how do I do stack monitoring](https://discuss.elastic.co/t/filebeat-output-to-kafka-how-do-i-do-stack-monitoring/271209)
**Author:** [@ktpktr0](https://discuss.elastic.co/u/ktpktr0)\ **Replies:** 5\ **Last updated:** [April 27, 2021, 7:39am UTC](https://discuss.elastic.co/t/filebeat-output-to-kafka-how-do-i-do-stack-monitoring/271209 "2021-04-27T07:39:55Z")
I output the log to Kafka and how I add filebeat to the stack monitor. I try the following, and it works well, but on kibana, I still don't see the state of filebeat. output.kafka: hosts: \["192.168.1.190:9092"\] topi… --- ## [APM Java agent not tracking spans](https://discuss.elastic.co/t/apm-java-agent-not-tracking-spans/270993)
**Author:** [@Mohammad\_Etemad](https://discuss.elastic.co/u/Mohammad_Etemad)\ **Replies:** 6\ **Last updated:** [April 27, 2021, 7:34am UTC](https://discuss.elastic.co/t/apm-java-agent-not-tracking-spans/270993 "2021-04-27T07:34:36Z")
Kibana version: 7.4.0 Elasticsearch version: 7.4.0 APM Server version: 7.4.1 APM Agent language and version: apm java agent: 1.16.0 AND 1.23.0 (tested both) Description of the problem including expected versus actual… --- ## [Transform usage - How to push event for all specific terms even if one of them is missing](https://discuss.elastic.co/t/transform-usage-how-to-push-event-for-all-specific-terms-even-if-one-of-them-is-missing/271326)
**Author:** [@vigneshr35](https://discuss.elastic.co/u/vigneshr35)\ **Replies:** 0\ **Last updated:** [April 27, 2021, 7:20am UTC](https://discuss.elastic.co/t/transform-usage-how-to-push-event-for-all-specific-terms-even-if-one-of-them-is-missing/271326 "2021-04-27T07:20:50Z")
Hi Team, I have a scenario. I have a transform created that groups all events of each day from the source index into 3 different status - Completed, Terminated and Retry. For example, if for 25th Apr 2021 we have Comple… --- ## [Logstash configuration best practices](https://discuss.elastic.co/t/logstash-configuration-best-practices/271051)
**Author:** [@Dzious](https://discuss.elastic.co/u/Dzious)\ **Replies:** 3\ **Last updated:** [April 27, 2021, 7:09am UTC](https://discuss.elastic.co/t/logstash-configuration-best-practices/271051 "2021-04-27T07:09:17Z")
Hi everyone, I would like to know a bit more about logstash best practices I need to setup a monitoring system for about 20 servers at the moment and more to come in the future. Onto these servers, i'll have multiple … --- ## [.kibana index template](https://discuss.elastic.co/t/kibana-index-template/271096)
**Author:** [@bentleg1](https://discuss.elastic.co/u/bentleg1)\ **Replies:** 4\ **Last updated:** [April 27, 2021, 7:08am UTC](https://discuss.elastic.co/t/kibana-index-template/271096 "2021-04-27T07:08:55Z")
Hello. I want to add several replicas for system .kibana index. I have created template. PUT \_template/kibana { "index\_patterns": ".kibana\*", "settings": { "number\_of\_replicas": "5" } } … --- ## [Shard allocation on cluster](https://discuss.elastic.co/t/shard-allocation-on-cluster/271323)
**Author:** [@bentleg1](https://discuss.elastic.co/u/bentleg1)\ **Replies:** 2\ **Last updated:** [April 27, 2021, 6:59am UTC](https://discuss.elastic.co/t/shard-allocation-on-cluster/271323 "2021-04-27T06:59:17Z")
Hi to all. Imagine that we have 4 data nodes. N1 and N2 placed on main data center and N3 and N4 placed in backup data center. How to configure shard allocation to place all primary shards on N1 and N2 nodes and all re… --- ## [Grok: tag\_on\_failure is not working and has no effect](https://discuss.elastic.co/t/grok-tag-on-failure-is-not-working-and-has-no-effect/271320)
**Author:** [@meerlicht](https://discuss.elastic.co/u/meerlicht)\ **Replies:** 0\ **Last updated:** [April 27, 2021, 6:40am UTC](https://discuss.elastic.co/t/grok-tag-on-failure-is-not-working-and-has-no-effect/271320 "2021-04-27T06:40:34Z")
Hi there, I can't get my head around why this snippet successfully groks the message, but neither sets nor removes the tags. I've tried to set a custom tag and also removing all tags (as in the current snippet) grok { … --- ## [Using pre-defined grok patterns](https://discuss.elastic.co/t/using-pre-defined-grok-patterns/271216)
**Author:** [@ThreatInter](https://discuss.elastic.co/u/ThreatInter)\ **Replies:** 4\ **Last updated:** [April 27, 2021, 4:48am UTC](https://discuss.elastic.co/t/using-pre-defined-grok-patterns/271216 "2021-04-27T04:48:21Z")
Hi, community. I just discovered that logstash has pre-defined grok patterns, for firewalls, for example (here logstash-patterns-core/patterns at master · logstash-plugins/logstash-patterns-core · GitHub). But I can't u… --- ## [Elasticsearch error license is not available](https://discuss.elastic.co/t/elasticsearch-error-license-is-not-available/271039)
**Author:** [@charles97](https://discuss.elastic.co/u/charles97)\ **Replies:** 2\ **Last updated:** [April 27, 2021, 6:08am UTC](https://discuss.elastic.co/t/elasticsearch-error-license-is-not-available/271039 "2021-04-27T06:08:34Z")
es: 7.12 os:CentOS7 java : java-1.8.0-openjdk.x86\_64 (/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.282.b08-1.el7\_9.x86\_64/jre/bin/java) My cluster used to had 2 node, this node as : master another node as : data-1. I deci… [Previous page](https://discuss.elastic.co/latest.md?page=1709) [Next page](https://discuss.elastic.co/latest.md?page=1711)