# Latest **URL:** https://discuss.elastic.co/latest.md?page=1739 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1740 --- ## [Bulk indexing throws error "index is missing"](https://discuss.elastic.co/t/bulk-indexing-throws-error-index-is-missing/269748)
**Author:** [@anarwal](https://discuss.elastic.co/u/anarwal)\ **Replies:** 0\ **Last updated:** [April 9, 2021, 8:55pm UTC](https://discuss.elastic.co/t/bulk-indexing-throws-error-index-is-missing/269748 "2021-04-09T20:55:51Z")
(topic withdrawn by author, will be automatically deleted in 24 hours unless flagged) --- ## [Coordinate + kibana heap issues](https://discuss.elastic.co/t/coordinate-kibana-heap-issues/269738)
**Author:** [@d4nnyx](https://discuss.elastic.co/u/d4nnyx)\ **Replies:** 4\ **Last updated:** [April 9, 2021, 9:38pm UTC](https://discuss.elastic.co/t/coordinate-kibana-heap-issues/269738 "2021-04-09T21:38:17Z")
Hello, after Kibana upgrade to v7.12 Im experiencing issues with underlying coordinate-only node. It regularly crashes because of low heap memory. Before upgrade whole cluster worked like a charm. Cluster setup 3 mast… --- ## [Extract json fields from message](https://discuss.elastic.co/t/extract-json-fields-from-message/269742)
**Author:** [@adityak248](https://discuss.elastic.co/u/adityak248)\ **Replies:** 5\ **Last updated:** [April 9, 2021, 9:11pm UTC](https://discuss.elastic.co/t/extract-json-fields-from-message/269742 "2021-04-09T21:11:37Z")
Hello there, After applying grok filter to my message I get one of the fields called main\_message which looks like this main\_message Processing data {"si":"-2","a":"-54.0","r":"0","version":"1","id":"C112"} From t… --- ## [Options list control is not case sensitive](https://discuss.elastic.co/t/options-list-control-is-not-case-sensitive/268109)
**Author:** [@larrya](https://discuss.elastic.co/u/larrya)\ **Replies:** 2\ **Last updated:** [April 9, 2021, 7:27pm UTC](https://discuss.elastic.co/t/options-list-control-is-not-case-sensitive/268109 "2021-04-09T19:27:26Z")
I have a visualization using an Options list control with multiselect (Kibana 7.9.1). The field contains upper and lower case values of the same word, such as AAA, aaa, BBB, and bbb. When the control is used on a dashboa… --- ## [Host name does not match the certificate](https://discuss.elastic.co/t/host-name-does-not-match-the-certificate/269242)
**Author:** [@Ajith\_07](https://discuss.elastic.co/u/Ajith_07)\ **Replies:** 2\ **Last updated:** [April 9, 2021, 6:46pm UTC](https://discuss.elastic.co/t/host-name-does-not-match-the-certificate/269242 "2021-04-09T18:46:46Z")
Hi, I am facing Host name does not match the certificate issue in ES. I tried checking in ES forum and some has asked to disable the CN name check at code level but in the same thread we also see that its not recommende… --- ## [Group Results by Timestamp Ignoring Hours](https://discuss.elastic.co/t/group-results-by-timestamp-ignoring-hours/269643)
**Author:** [@TomTom](https://discuss.elastic.co/u/TomTom)\ **Replies:** 1\ **Last updated:** [April 9, 2021, 6:20pm UTC](https://discuss.elastic.co/t/group-results-by-timestamp-ignoring-hours/269643 "2021-04-09T18:20:29Z")
My document mapping has a date property in the strict\_date\_time\_no\_millis format. However, when doing an aggregation based on this property, it also uses the hours. Is it possible to perform the aggregation using only t… --- ## [Generate a Detection when new document is indexed](https://discuss.elastic.co/t/generate-a-detection-when-new-document-is-indexed/268140)
**Author:** [@Felipe\_Fuller](https://discuss.elastic.co/u/Felipe_Fuller)\ **Replies:** 7\ **Last updated:** [April 9, 2021, 6:02pm UTC](https://discuss.elastic.co/t/generate-a-detection-when-new-document-is-indexed/268140 "2021-04-09T18:02:16Z")
Hi Community, I'm trying to generate a detection over time with Elastic SIEM. Giving more context, I'm indexing, through Logstash, data from an API rest, so every half an hour I receive new data. Mostly, is repeated dat… --- ## [How to exclude key value pair from KV filter if Key size greater than 15 char](https://discuss.elastic.co/t/how-to-exclude-key-value-pair-from-kv-filter-if-key-size-greater-than-15-char/269566)
**Author:** [@mangeshmj1992](https://discuss.elastic.co/u/mangeshmj1992)\ **Replies:** 6\ **Last updated:** [April 9, 2021, 6:00pm UTC](https://discuss.elastic.co/t/how-to-exclude-key-value-pair-from-kv-filter-if-key-size-greater-than-15-char/269566 "2021-04-09T18:00:42Z")
We have log message which contain key value pairs and we are using KV filter to parse these data. We need to exclude key value pair from KV filter if Key size greater than 15 char. Need to exclude https://www.google.co… --- ## [Can i combine input search and http?](https://discuss.elastic.co/t/can-i-combine-input-search-and-http/269736)
**Author:** [@rajsolanki](https://discuss.elastic.co/u/rajsolanki)\ **Replies:** 0\ **Last updated:** [April 9, 2021, 5:58pm UTC](https://discuss.elastic.co/t/can-i-combine-input-search-and-http/269736 "2021-04-09T17:58:15Z")
Can i combine search and http in input for watcher ? I have 5 network devices sending logs to my elastic. They each are supported by 5 different teams. I m trying to write one watcher which would search for a desired err… --- ## [Visibility Monitoring - Have Kibana Ingest a File that Contains a List of Log Sources and Have Kibana Compare that List to What Sources Are Actually Being Collected](https://discuss.elastic.co/t/visibility-monitoring-have-kibana-ingest-a-file-that-contains-a-list-of-log-sources-and-have-kibana-compare-that-list-to-what-sources-are-actually-being-collected/269734)
**Author:** [@Log\_Gobbler](https://discuss.elastic.co/u/Log_Gobbler)\ **Replies:** 0\ **Last updated:** [April 9, 2021, 4:47pm UTC](https://discuss.elastic.co/t/visibility-monitoring-have-kibana-ingest-a-file-that-contains-a-list-of-log-sources-and-have-kibana-compare-that-list-to-what-sources-are-actually-being-collected/269734 "2021-04-09T16:47:59Z")
Hi Everybody. We're new to ELK but not new to SIEMs. We're trying to improve our visibility by creating something in the ELK stack that might be considered "Visibility Monitoring". Our "Visibility Monitoring" comes with … --- ## [Filebeat kafka ssl output](https://discuss.elastic.co/t/filebeat-kafka-ssl-output/269652)
**Author:** [@madhan\_dhanikachalam](https://discuss.elastic.co/u/madhan_dhanikachalam)\ **Replies:** 4\ **Last updated:** [April 9, 2021, 5:12pm UTC](https://discuss.elastic.co/t/filebeat-kafka-ssl-output/269652 "2021-04-09T17:12:32Z")
Trying to set up ssl kafka output in filebeat. reading a log file and sending to kafka. non-ssl works fine. for ssl i am trying the below #---- kafka output output.kafka: # initial brokers for reading cluster metadat… --- ## [How to call mget from Logstash?](https://discuss.elastic.co/t/how-to-call-mget-from-logstash/269733)
**Author:** [@ice2021](https://discuss.elastic.co/u/ice2021)\ **Replies:** 3\ **Last updated:** [April 9, 2021, 5:12pm UTC](https://discuss.elastic.co/t/how-to-call-mget-from-logstash/269733 "2021-04-09T17:12:09Z")
The REST request below works in Kibana. Can this similarly be achieved in Logstash? I am trying to retrieve multiple documents from multiple indices(5 indices) in a single request to ElasticSearch in Logstash. GET /\_… --- ## [Split filebeat log with a variable length and create multiple events group by a field](https://discuss.elastic.co/t/split-filebeat-log-with-a-variable-length-and-create-multiple-events-group-by-a-field/269630)
**Author:** [@rmartinez.rv](https://discuss.elastic.co/u/rmartinez.rv)\ **Replies:** 13\ **Last updated:** [April 9, 2021, 4:54pm UTC](https://discuss.elastic.co/t/split-filebeat-log-with-a-variable-length-and-create-multiple-events-group-by-a-field/269630 "2021-04-09T16:54:36Z")
Hi. I'm trying to parse the information from a log line with this format. 2021 Mar 30 00:45:01;1617075901;user1,gw11,0;user1,gw22,5;user2,gw33,2;user2;gw43,3 I'm using dissect to format the first part of the log, with… --- ## [Stuck in Logstash](https://discuss.elastic.co/t/stuck-in-logstash/269704)
**Author:** [@padamrai](https://discuss.elastic.co/u/padamrai)\ **Replies:** 15\ **Last updated:** [April 9, 2021, 4:43pm UTC](https://discuss.elastic.co/t/stuck-in-logstash/269704 "2021-04-09T16:43:54Z")
Whenever I am running file, it is stuck even I tried different file but still stuck. --- ## [Unable to parse the xml tag and create a field in Elastic Search](https://discuss.elastic.co/t/unable-to-parse-the-xml-tag-and-create-a-field-in-elastic-search/269645)
**Author:** [@sdeven](https://discuss.elastic.co/u/sdeven)\ **Replies:** 5\ **Last updated:** [April 9, 2021, 4:40pm UTC](https://discuss.elastic.co/t/unable-to-parse-the-xml-tag-and-create-a-field-in-elastic-search/269645 "2021-04-09T16:40:49Z")
Hi, I am using the http plugin in my logstash.conf file, where I am getting a XML document. I have to extract a tag from the XML document and make it as a field in elastic search. I am not getting any errors but the fil… --- ## ["\_jsonparsefailure" Getting Error while reading messages from RabbitMQ](https://discuss.elastic.co/t/jsonparsefailure-getting-error-while-reading-messages-from-rabbitmq/269690)
**Author:** [@padamrai](https://discuss.elastic.co/u/padamrai)\ **Replies:** 6\ **Last updated:** [April 9, 2021, 4:25pm UTC](https://discuss.elastic.co/t/jsonparsefailure-getting-error-while-reading-messages-from-rabbitmq/269690 "2021-04-09T16:25:47Z")
I am reading messages from rabbitmq while running the config file getting error "jsonparsefailure". message like "You have withdrawn RS. xxxfrom ATM.", "You are welcome again", etc... My config file: input { rabbitmq… --- ## [Logstash:event api to get nested fields with attribute values in ruby filter](https://discuss.elastic.co/t/logstash-event-api-to-get-nested-fields-with-attribute-values-in-ruby-filter/269665)
**Author:** [@prathibha](https://discuss.elastic.co/u/prathibha)\ **Replies:** 1\ **Last updated:** [April 9, 2021, 4:10pm UTC](https://discuss.elastic.co/t/logstash-event-api-to-get-nested-fields-with-attribute-values-in-ruby-filter/269665 "2021-04-09T16:10:12Z")
Hello Team, I would like to use an event api inside ruby filter to get nested fields with attribute value. I have a sample here as below: "Event1" =\> { "Event2" =\> { … --- ## [Logstash docker container can not connect to the ElasticSearch (non-docker) on another host](https://discuss.elastic.co/t/logstash-docker-container-can-not-connect-to-the-elasticsearch-non-docker-on-another-host/269730)
**Author:** [@kube-elk](https://discuss.elastic.co/u/kube-elk)\ **Replies:** 0\ **Last updated:** [April 9, 2021, 4:03pm UTC](https://discuss.elastic.co/t/logstash-docker-container-can-not-connect-to-the-elasticsearch-non-docker-on-another-host/269730 "2021-04-09T16:03:52Z")
Hi I have 2 docker containers: filebeat and logstash which I run using docker-compose. I am trying to configure logstash such that it will write index to the Elasticsearch (non-docker) hosted on another node. Here is m… --- ## [Problème avec Aggregate](https://discuss.elastic.co/t/probleme-avec-aggregate/269669)
**Author:** [@Yahya\_Bouzoubaa](https://discuss.elastic.co/u/Yahya_Bouzoubaa)\ **Replies:** 6\ **Last updated:** [April 9, 2021, 3:51pm UTC](https://discuss.elastic.co/t/probleme-avec-aggregate/269669 "2021-04-09T15:51:39Z")
Bonjour, J'ai un bug qui persiste en lien avec l'aggregate. Description du problème initial : j'ai des logs de types request et d'autres de type response. Les logs ne se succèdent pas, entre ces deux requêtes il y a t… --- ## [Logstash-iterating through array field with specific action for every value](https://discuss.elastic.co/t/logstash-iterating-through-array-field-with-specific-action-for-every-value/269702)
**Author:** [@Jan\_Kabelka](https://discuss.elastic.co/u/Jan_Kabelka)\ **Replies:** 1\ **Last updated:** [April 9, 2021, 3:40pm UTC](https://discuss.elastic.co/t/logstash-iterating-through-array-field-with-specific-action-for-every-value/269702 "2021-04-09T15:40:00Z")
Hi,logstash wizards! I suppose ruby must be used for what I need but I tried many many ways with no success:( I parse DNS responses on Logstash and as a result I have field below with array of values: {"dns": { … --- ## [Russian symbols in kibana](https://discuss.elastic.co/t/russian-symbols-in-kibana/268742)
**Author:** [@ajdanoff](https://discuss.elastic.co/u/ajdanoff)\ **Replies:** 3\ **Last updated:** [April 9, 2021, 3:29pm UTC](https://discuss.elastic.co/t/russian-symbols-in-kibana/268742 "2021-04-09T15:29:59Z")
Hello, I have the following question. I have created an index in kibana, which contains a "description" field. The field contains texts in Russian. When discovering this index in kibana, Russian letters are displayed a… --- ## [Русские символы в кибана](https://discuss.elastic.co/t/topic/268740)
**Author:** [@ajdanoff](https://discuss.elastic.co/u/ajdanoff)\ **Replies:** 4\ **Last updated:** [April 9, 2021, 3:27pm UTC](https://discuss.elastic.co/t/topic/268740 "2021-04-09T15:27:32Z")
Здравствуйте, у меня следующий вопрос. Я создал индекс в кибана, который содержит поле "description", в этом поле содержится текст на русском языке. При отображении этого индекса в кибана, русские буквы отображаются в … --- ## [Full Export Saved Objects -\> Import](https://discuss.elastic.co/t/full-export-saved-objects-import/269628)
**Author:** [@Luis\_Garcia](https://discuss.elastic.co/u/Luis_Garcia)\ **Replies:** 2\ **Last updated:** [April 9, 2021, 3:17pm UTC](https://discuss.elastic.co/t/full-export-saved-objects-import/269628 "2021-04-09T15:17:06Z")
Hi from Argentina. I've exported all my saved objects using Elastic/Kibana 7.10, the result was a 12 MB ndjson file. Now I'm trying to import it using Kibana/Elastic 7.12 hosted in GKE Google Kubernetes Engine ("build… --- ## [Is there any other way than rollover to create the indexes on ElasticSearch for continous 2 hours rather than per hour or per day](https://discuss.elastic.co/t/is-there-any-other-way-than-rollover-to-create-the-indexes-on-elasticsearch-for-continous-2-hours-rather-than-per-hour-or-per-day/269668)
**Author:** [@KunwarAkanksha](https://discuss.elastic.co/u/KunwarAkanksha)\ **Replies:** 1\ **Last updated:** [April 9, 2021, 1:54pm UTC](https://discuss.elastic.co/t/is-there-any-other-way-than-rollover-to-create-the-indexes-on-elasticsearch-for-continous-2-hours-rather-than-per-hour-or-per-day/269668 "2021-04-09T13:54:14Z")
I am using logstash to push the data in YYYY.MM.dd.hh format which consider AM and PM in one index means two different hour data is available in same index. I want a index of two hours but those hours need to be continou… --- ## [Multi\_match fuzzy matching on shingled field](https://discuss.elastic.co/t/multi-match-fuzzy-matching-on-shingled-field/269713)
**Author:** [@jamesgorrie](https://discuss.elastic.co/u/jamesgorrie)\ **Replies:** 0\ **Last updated:** [April 9, 2021, 2:01pm UTC](https://discuss.elastic.co/t/multi-match-fuzzy-matching-on-shingled-field/269713 "2021-04-09T14:01:53Z")
I am trying to get some fuzzy matching setup on a multi\_match query of a field that has been shingled. Here is my mappings and queries. Both fuzzy queries match all documents, which is what I would expect. However on … --- ## [Web Crawler API endpoints for URLs and crawl rules](https://discuss.elastic.co/t/web-crawler-api-endpoints-for-urls-and-crawl-rules/269598)
**Author:** [@Yuriy\_Stakhniak](https://discuss.elastic.co/u/Yuriy_Stakhniak)\ **Replies:** 3\ **Last updated:** [April 9, 2021, 1:12pm UTC](https://discuss.elastic.co/t/web-crawler-api-endpoints-for-urls-and-crawl-rules/269598 "2021-04-09T13:12:18Z")
Since this topic is already closed, I was forced to create a new one. Please tell me if it is possible now to programmatically set URLs and crawl rules into the web crawler. This is not currently described in the API do… --- ## [Trial expired but it works](https://discuss.elastic.co/t/trial-expired-but-it-works/269682)
**Author:** [@accateo](https://discuss.elastic.co/u/accateo)\ **Replies:** 0\ **Last updated:** [April 9, 2021, 8:38am UTC](https://discuss.elastic.co/t/trial-expired-but-it-works/269682 "2021-04-09T08:38:36Z")
Hi, I've used ElasticSearch on cloud for 14 days and now my trial period is expired. I've created a new deployment: and I haven't entered the billing bank details yet. But why can I use kibana without any problems… --- ## [Kibana maps does not show index pattern](https://discuss.elastic.co/t/kibana-maps-does-not-show-index-pattern/269312)
**Author:** [@jungsoo](https://discuss.elastic.co/u/jungsoo)\ **Replies:** 3\ **Last updated:** [April 9, 2021, 12:51pm UTC](https://discuss.elastic.co/t/kibana-maps-does-not-show-index-pattern/269312 "2021-04-09T12:51:32Z")
Hello, I was testing maps feature and got problem. Symptom: Kibana Maps \> add layers \> documents It does not show any index pattern, although I have kibana sample data with index pattern which has geo\_point. How I… --- ## [Deleting a space-agnostic exception container](https://discuss.elastic.co/t/deleting-a-space-agnostic-exception-container/269640)
**Author:** [@gplourde](https://discuss.elastic.co/u/gplourde)\ **Replies:** 1\ **Last updated:** [April 9, 2021, 12:27pm UTC](https://discuss.elastic.co/t/deleting-a-space-agnostic-exception-container/269640 "2021-04-09T12:27:07Z")
How do you delete an exception container that is space agnostic? "namespace\_type": "agnostic" If I try to delete it using the Exceptions API I get an error stating the list does not exist. { "message": "exce… --- ## [Parsing variable multiline text from event log](https://discuss.elastic.co/t/parsing-variable-multiline-text-from-event-log/269450)
**Author:** [@SimonR](https://discuss.elastic.co/u/SimonR)\ **Replies:** 3\ **Last updated:** [April 9, 2021, 11:35am UTC](https://discuss.elastic.co/t/parsing-variable-multiline-text-from-event-log/269450 "2021-04-09T11:35:13Z")
Hi Logstash experts. Im having big issues parsing MSSQL logs from the Windows event log, and i hope someone can assist. MSSQL logs event id 33205 to Windows event log, in a somewhat structured format, except the "State… [Previous page](https://discuss.elastic.co/latest.md?page=1738) [Next page](https://discuss.elastic.co/latest.md?page=1740)