# Latest **URL:** https://discuss.elastic.co/latest.md?page=1751 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1752 --- ## [How to simulate the failure of elasticsearch？](https://discuss.elastic.co/t/how-to-simulate-the-failure-of-elasticsearch/269149)
**Author:** [@asasas234](https://discuss.elastic.co/u/asasas234)\ **Replies:** 0\ **Last updated:** [April 3, 2021, 12:30pm UTC](https://discuss.elastic.co/t/how-to-simulate-the-failure-of-elasticsearch/269149 "2021-04-03T12:30:44Z")
I found that for some simple failures, I can do it easily with the help of tools, such as network partitioning, nodes being killed, but there are still many abnormal cases that are not good to simulate, for example, ther… --- ## [Latency in indexing using client.update() of the high level rest client](https://discuss.elastic.co/t/latency-in-indexing-using-client-update-of-the-high-level-rest-client/269142)
**Author:** [@Mahesh\_H\_Viraktamath](https://discuss.elastic.co/u/Mahesh_H_Viraktamath)\ **Replies:** 2\ **Last updated:** [April 3, 2021, 10:13am UTC](https://discuss.elastic.co/t/latency-in-indexing-using-client-update-of-the-high-level-rest-client/269142 "2021-04-03T10:13:54Z")
We have started using the high level REST client finally, to ease the development of queries from backend engineering perspective. For indexing, we are using the client.update(request, RequestOptions.DEFAULT) so that new… --- ## [Logstash is not processing logs](https://discuss.elastic.co/t/logstash-is-not-processing-logs/269084)
**Author:** [@James\_P](https://discuss.elastic.co/u/James_P)\ **Replies:** 1\ **Last updated:** [April 3, 2021, 7:49am UTC](https://discuss.elastic.co/t/logstash-is-not-processing-logs/269084 "2021-04-03T07:49:10Z")
Hi, Logstash was installed and was receiving logs from filebeat and syslog file stream. Currently logstash starts up successfully but no logs are being processed. \[2021-04-02T08:48:29,269\]\[INFO \]\[logstash.runner … --- ## [SIgma rules for Elastic SIEM](https://discuss.elastic.co/t/sigma-rules-for-elastic-siem/268453)
**Author:** [@kmz161](https://discuss.elastic.co/u/kmz161)\ **Replies:** 4\ **Last updated:** [April 3, 2021, 4:42am UTC](https://discuss.elastic.co/t/sigma-rules-for-elastic-siem/268453 "2021-04-03T04:42:49Z")
Hello! I need to use Sigma rules repo for my SIEM. How I can translate sigma to elastic? And how I can perform auto update sigma rules? --- ## [Kibana - Pipeline Editor](https://discuss.elastic.co/t/kibana-pipeline-editor/269134)
**Author:** [@mohsin106](https://discuss.elastic.co/u/mohsin106)\ **Replies:** 1\ **Last updated:** [April 2, 2021, 9:18pm UTC](https://discuss.elastic.co/t/kibana-pipeline-editor/269134 "2021-04-02T21:18:56Z")
Hi, I'm using Kibana 7.11.1 and I edit my pipelines under the Logstash Pipeline UI. I was wondering if there is a document somewhere that lists available shortcuts that can be used inside of the pipeline editor. Specifi… --- ## [QueryShardException No mapping found for \[failed\]](https://discuss.elastic.co/t/queryshardexception-no-mapping-found-for-failed/269111)
**Author:** [@MdRashid](https://discuss.elastic.co/u/MdRashid)\ **Replies:** 1\ **Last updated:** [April 2, 2021, 8:47pm UTC](https://discuss.elastic.co/t/queryshardexception-no-mapping-found-for-failed/269111 "2021-04-02T20:47:56Z")
Hi All, I have deploy my ES on Azure Kubernetes Services AKS after deploying i got error all shards failed Caused by: org.elasticsearch.index.query.QueryShardException: No mapping found for \[failed\] in order to sort o… --- ## [How to know Elasticsearch daily log intake?](https://discuss.elastic.co/t/how-to-know-elasticsearch-daily-log-intake/269104)
**Author:** [@mahesh.yerawar](https://discuss.elastic.co/u/mahesh.yerawar)\ **Replies:** 3\ **Last updated:** [April 2, 2021, 8:47pm UTC](https://discuss.elastic.co/t/how-to-know-elasticsearch-daily-log-intake/269104 "2021-04-02T20:47:01Z")
Hi, I'm looking to understand how much data is getting ingested to our ELK cluster on a daily basis. anyone has any idea how to get these details? Thank you. --- ## [Enhanced Table computed column issue](https://discuss.elastic.co/t/enhanced-table-computed-column-issue/269000)
**Author:** [@bab](https://discuss.elastic.co/u/bab)\ **Replies:** 3\ **Last updated:** [April 2, 2021, 6:27pm UTC](https://discuss.elastic.co/t/enhanced-table-computed-column-issue/269000 "2021-04-02T18:27:36Z")
i'm trying to get the duration in s using the formula but is not working, can someone help pls, thank you. --- ## [Endpoint Security supported on ARM Linux (AARCH64)?](https://discuss.elastic.co/t/endpoint-security-supported-on-arm-linux-aarch64/269127)
**Author:** [@danmcq](https://discuss.elastic.co/u/danmcq)\ **Replies:** 2\ **Last updated:** [April 2, 2021, 6:21pm UTC](https://discuss.elastic.co/t/endpoint-security-supported-on-arm-linux-aarch64/269127 "2021-04-02T18:21:21Z")
I have been trying, unsuccessfully, to get Endpoint Security up and running on an ARM64 Ubuntu Linux 20.04 system. The elastic-agent is installed and working, but the Endpoint Security client never seems to download/inst… --- ## [FATAL Error: Unable to complete saved object migrations for the \[.kibana\] index. TypeError: Cannot read property 'error' of undefined](https://discuss.elastic.co/t/fatal-error-unable-to-complete-saved-object-migrations-for-the-kibana-index-typeerror-cannot-read-property-error-of-undefined/269066)
**Author:** [@elk\_usr](https://discuss.elastic.co/u/elk_usr)\ **Replies:** 2\ **Last updated:** [April 2, 2021, 6:07pm UTC](https://discuss.elastic.co/t/fatal-error-unable-to-complete-saved-object-migrations-for-the-kibana-index-typeerror-cannot-read-property-error-of-undefined/269066 "2021-04-02T18:07:47Z")
Hello, I am trying to install Kibana7.12.0 on a new Win10 laptop that has elasticsearch7.12.0 already installed and running. However, Kibana install fails about halfway giving below fatal error Any help on this is g… --- ## [Need help to aggregate a text field into a visualization](https://discuss.elastic.co/t/need-help-to-aggregate-a-text-field-into-a-visualization/269034)
**Author:** [@trubisky](https://discuss.elastic.co/u/trubisky)\ **Replies:** 5\ **Last updated:** [April 2, 2021, 5:14pm UTC](https://discuss.elastic.co/t/need-help-to-aggregate-a-text-field-into-a-visualization/269034 "2021-04-02T17:14:22Z")
Hi All, I've spent a ton of time on this and I feel like it should be relatively simple but for some reason I'm not able to find the solution. I'll also add that I am fairly novice at visualizations. The docs looks sim… --- ## [FreeBSD 12 + Filebeat + netflow](https://discuss.elastic.co/t/freebsd-12-filebeat-netflow/269123)
**Author:** [@Yustas](https://discuss.elastic.co/u/Yustas)\ **Replies:** 0\ **Last updated:** [April 2, 2021, 5:03pm UTC](https://discuss.elastic.co/t/freebsd-12-filebeat-netflow/269123 "2021-04-02T17:03:30Z")
Hello I am installed beats7 by pkg on FreeBSD 12.1 But in installation missing module netflow for filebeat Anybody know how install filebeat with netflow support on freebsd? /usr/ports/sysutils/beats7/pkg-plist %%ME… --- ## [APM is working, but not User Experience](https://discuss.elastic.co/t/apm-is-working-but-not-user-experience/266376)
**Author:** [@A\_Chichi](https://discuss.elastic.co/u/A_Chichi)\ **Replies:** 21\ **Last updated:** [April 2, 2021, 5:00pm UTC](https://discuss.elastic.co/t/apm-is-working-but-not-user-experience/266376 "2021-04-02T17:00:45Z")
Hello, I have a small problem with the "User Experienc" tab indeed, I set up APM on my Python/Flask application. APM works perfectly : However, when I go to the "User Experience" tab I see nothing: Also, in the "w… --- ## [Help me writing grok filter for the pattern](https://discuss.elastic.co/t/help-me-writing-grok-filter-for-the-pattern/268794)
**Author:** [@abhishek\_s1](https://discuss.elastic.co/u/abhishek_s1)\ **Replies:** 8\ **Last updated:** [April 2, 2021, 3:39pm UTC](https://discuss.elastic.co/t/help-me-writing-grok-filter-for-the-pattern/268794 "2021-04-02T15:39:21Z")
I've http log of the form 10.255.255.255 - jira \[11/Mar/2021:10:00:03 -0800\] "GET /svn/repos/branches/feature-IPv6-TWLP-3.2/ZProxyHealthManager.cpp HTTP/1.1" 200 29110 & my pattern is: %{IPORHOST:client\_ip} %{HTTPDUS… --- ## [Filter one value with other value](https://discuss.elastic.co/t/filter-one-value-with-other-value/269103)
**Author:** [@domra](https://discuss.elastic.co/u/domra)\ **Replies:** 1\ **Last updated:** [April 2, 2021, 2:42pm UTC](https://discuss.elastic.co/t/filter-one-value-with-other-value/269103 "2021-04-02T14:42:38Z")
Hi! I want to apply a filter to an TSVB metric visualization where I filter all documents, where one value is between a offset of another value. something like this: valueA: \[valueB-1 TO valueB+1\] Is something like th… --- ## [Unable to create scripted filed](https://discuss.elastic.co/t/unable-to-create-scripted-filed/269101)
**Author:** [@Dinesh\_Sharma](https://discuss.elastic.co/u/Dinesh_Sharma)\ **Replies:** 7\ **Last updated:** [April 2, 2021, 2:12pm UTC](https://discuss.elastic.co/t/unable-to-create-scripted-filed/269101 "2021-04-02T14:12:46Z")
Hi, I was trying to create an scripted field. Where I was implementing the following logic which is return true if IP is equal to Pi\_IP. ''' if (doc\['IP.kayword'\].value == doc\['Pi\_IP.keyword'\].value) { retrun "true"; … --- ## [Pipeline has lesser fields than Filebeat directly to Elasticsearch](https://discuss.elastic.co/t/pipeline-has-lesser-fields-than-filebeat-directly-to-elasticsearch/269054)
**Author:** [@Automation\_Scripts](https://discuss.elastic.co/u/Automation_Scripts)\ **Replies:** 0\ **Last updated:** [April 1, 2021, 4:04pm UTC](https://discuss.elastic.co/t/pipeline-has-lesser-fields-than-filebeat-directly-to-elasticsearch/269054 "2021-04-01T16:04:17Z")
Hi team, I have a pipeline like this: filebeat =\>kafka =\>logstask=\>elasticsearch (ELK7.12) Why I have a smaller amounts of fileds than filebeat directly =\>elasticsearch (ELK7.11.1) Whenever I check the fields from ECS… --- ## [Ngram vs wildcard (Using ngrams instead of wildcards)](https://discuss.elastic.co/t/ngram-vs-wildcard-using-ngrams-instead-of-wildcards/260809)
**Author:** [@mohsin](https://discuss.elastic.co/u/mohsin)\ **Replies:** 1\ **Last updated:** [April 2, 2021, 1:56pm UTC](https://discuss.elastic.co/t/ngram-vs-wildcard-using-ngrams-instead-of-wildcards/260809 "2021-04-02T13:56:06Z")
We are using spring-data-elasticsearch in our Project we have the autocomplete function for the search textbox. When we type into the search text field, we will fetch suggestions by performing a wild card search with t… --- ## [Is there any option to define multiple key value pairs based on delimeter while ingesting files through FSCrawler in Elasticsearch?](https://discuss.elastic.co/t/is-there-any-option-to-define-multiple-key-value-pairs-based-on-delimeter-while-ingesting-files-through-fscrawler-in-elasticsearch/261383)
**Author:** [@Nirmal\_Raj](https://discuss.elastic.co/u/Nirmal_Raj)\ **Replies:** 3\ **Last updated:** [April 2, 2021, 1:49pm UTC](https://discuss.elastic.co/t/is-there-any-option-to-define-multiple-key-value-pairs-based-on-delimeter-while-ingesting-files-through-fscrawler-in-elasticsearch/261383 "2021-04-02T13:49:14Z")
I'm trying to ingest multiple extension files like (.pdf, .doc, .docx, .csv) using FSCrawler in Elasticsearch . After ingesting, all the details inside the files mapped under one key value pair called content. Is there … --- ## [Elasticsearch thread\_pool is growing over and over](https://discuss.elastic.co/t/elasticsearch-thread-pool-is-growing-over-and-over/266078)
**Author:** [@nuzolx](https://discuss.elastic.co/u/nuzolx)\ **Replies:** 3\ **Last updated:** [April 2, 2021, 1:39pm UTC](https://discuss.elastic.co/t/elasticsearch-thread-pool-is-growing-over-and-over/266078 "2021-04-02T13:39:17Z")
Hi all, I am a newbie with Elastic. I cannot find all my documents in my research. If I repeat the same search, after a while, it's okay. I understood that it could come from the 'refresh'. But sometimes the waiting tim… --- ## [Best way to maintain total count for rollup documents?](https://discuss.elastic.co/t/best-way-to-maintain-total-count-for-rollup-documents/269109)
**Author:** [@hsalim](https://discuss.elastic.co/u/hsalim)\ **Replies:** 0\ **Last updated:** [April 2, 2021, 1:37pm UTC](https://discuss.elastic.co/t/best-way-to-maintain-total-count-for-rollup-documents/269109 "2021-04-02T13:37:54Z")
Hello, I am performing Elastic rollups on an index with the following streaming documents and fields. Rollup is on Field 1: Field1 Field2 doc1 1200 a doc2 1200 b doc3 1200 c doc4 … --- ## [Alert and connect mail format error](https://discuss.elastic.co/t/alert-and-connect-mail-format-error/268998)
**Author:** [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Replies:** 9\ **Last updated:** [April 2, 2021, 1:26pm UTC](https://discuss.elastic.co/t/alert-and-connect-mail-format-error/268998 "2021-04-02T13:26:14Z")
Hi all i have some question I was trying the version 7.12 for the first time, what interest me the most was that kibana finally have mail format for the siem rule, well i try cortext.alert just like how they show on gi… --- ## [Sending data from logstash to ElasticSearch (ECK): Certificate issue](https://discuss.elastic.co/t/sending-data-from-logstash-to-elasticsearch-eck-certificate-issue/269106)
**Author:** [@kelk](https://discuss.elastic.co/u/kelk)\ **Replies:** 0\ **Last updated:** [April 2, 2021, 1:25pm UTC](https://discuss.elastic.co/t/sending-data-from-logstash-to-elasticsearch-eck-certificate-issue/269106 "2021-04-02T13:25:11Z")
have setup operator based elasticsearch & kibana.. but since logstash is not within ECK, running logstash as standalone. Unfortunately, i'm trying it hard to find to connect to Elasticsearch due to certificate issue. ou… --- ## [Change ILM policy](https://discuss.elastic.co/t/change-ilm-policy/269105)
**Author:** [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)\ **Replies:** 0\ **Last updated:** [April 2, 2021, 12:49pm UTC](https://discuss.elastic.co/t/change-ilm-policy/269105 "2021-04-02T12:49:17Z")
Hello, I have a cluster of 2 nodes HOT and 1 DATA warm, and my ILM configuration is set to 1 shard and 1 replica I checked today my indexes and I found out that My HOT data node is going to hit 90% of DISK, and after … --- ## [Unable to start Kibana](https://discuss.elastic.co/t/unable-to-start-kibana/268950)
**Author:** [@maruthi\_Donthi](https://discuss.elastic.co/u/maruthi_Donthi)\ **Replies:** 5\ **Last updated:** [April 2, 2021, 11:33am UTC](https://discuss.elastic.co/t/unable-to-start-kibana/268950 "2021-04-02T11:33:52Z")
I am trying to start Kibana using a docker. I have already installed elastic search and it is working fine: I can see the elastic search status here: http://localhost:9200/\_cluster/health?pretty But when I run kibana do… --- ## [Set timestamp from message](https://discuss.elastic.co/t/set-timestamp-from-message/269073)
**Author:** [@Andrey\_RF](https://discuss.elastic.co/u/Andrey_RF)\ **Replies:** 4\ **Last updated:** [April 2, 2021, 11:12am UTC](https://discuss.elastic.co/t/set-timestamp-from-message/269073 "2021-04-02T11:12:38Z")
I have a pipeline to receive logs from different programs with different timestamp formats. input { beats { port =\> 5000 } } filter { date { match =\> \["message", "yyyy-MM-d… --- ## [Elasticsearch crashing with 'no space available', while disk still has 75% free storage](https://discuss.elastic.co/t/elasticsearch-crashing-with-no-space-available-while-disk-still-has-75-free-storage/269094)
**Author:** [@Kristijan](https://discuss.elastic.co/u/Kristijan)\ **Replies:** 1\ **Last updated:** [April 2, 2021, 11:10am UTC](https://discuss.elastic.co/t/elasticsearch-crashing-with-no-space-available-while-disk-still-has-75-free-storage/269094 "2021-04-02T11:10:08Z")
The elasticsearch(v5.6.12) is deployed as a single pod in a Kubernetes cluster with attached storage through a PVC. Once every couple of months it will go into a crash loop state and complain that there is no storage le… --- ## [How to create mulitple indices](https://discuss.elastic.co/t/how-to-create-mulitple-indices/268920)
**Author:** [@Shushil\_Shankar](https://discuss.elastic.co/u/Shushil_Shankar)\ **Replies:** 5\ **Last updated:** [April 2, 2021, 10:40am UTC](https://discuss.elastic.co/t/how-to-create-mulitple-indices/268920 "2021-04-02T10:40:48Z")
Good morning eveyyone! I have a question about the creation of a multiple indices. Currenlty in my project i have one index mutileple types. Now i need to migrate new version 7.12. How to do i create multiple indicies … --- ## [Filebeat to parse mixed data (strings and json)](https://discuss.elastic.co/t/filebeat-to-parse-mixed-data-strings-and-json/267629)
**Author:** [@Olivier\_Gerault](https://discuss.elastic.co/u/Olivier_Gerault)\ **Replies:** 3\ **Last updated:** [April 2, 2021, 10:34am UTC](https://discuss.elastic.co/t/filebeat-to-parse-mixed-data-strings-and-json/267629 "2021-04-02T10:34:54Z")
Hello, First of all, I'm a new to filebeat, so I may say stupids things. Forgive me in advance. I have to parse a log file that looks like : 2021-03-18 09:33:37,131 -- TYPE -- {"json1": "data", "json2": "data", "json3… --- ## [Where condition](https://discuss.elastic.co/t/where-condition/269072)
**Author:** [@Wolfram\_P](https://discuss.elastic.co/u/Wolfram_P)\ **Replies:** 13\ **Last updated:** [April 2, 2021, 10:22am UTC](https://discuss.elastic.co/t/where-condition/269072 "2021-04-02T10:22:59Z")
Hi, as a beginner on Kibana this question might be silly, but I cannot get across it: I would like to add a stacked bar graph to my dashboard. Two Y-axis: sum of index abc field1, where field2="1" sum of index abc f… [Previous page](https://discuss.elastic.co/latest.md?page=1750) [Next page](https://discuss.elastic.co/latest.md?page=1752)