# Latest **URL:** https://discuss.elastic.co/latest.md?page=1761 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1762 --- ## [Wish the search method for elasticsearch is working on rails](https://discuss.elastic.co/t/wish-the-search-method-for-elasticsearch-is-working-on-rails/268620)
**Author:** [@HeppokoNeet](https://discuss.elastic.co/u/HeppokoNeet)\ **Replies:** 0\ **Last updated:** [March 29, 2021, 1:56am UTC](https://discuss.elastic.co/t/wish-the-search-method-for-elasticsearch-is-working-on-rails/268620 "2021-03-29T01:56:46Z")
■The environment ・MacOS ・RailsServer ・Ruby 2.4.1 ・Ruby on Rails 5.1.7 ・MySQL ・Elasticsearch 7.10.2-SNAPSHOT ・kuromoji ・elasticsearch (7.4.0) ・elasticsearch-api (7.4.0) ・elasticsearch-model (7.1.0 80822d6) ・el… --- ## [How can only show some fields with Kibana + Filebeat?](https://discuss.elastic.co/t/how-can-only-show-some-fields-with-kibana-filebeat/268616)
**Author:** [@Joaquin\_menchaca](https://discuss.elastic.co/u/Joaquin_menchaca)\ **Replies:** 1\ **Last updated:** [March 29, 2021, 12:52am UTC](https://discuss.elastic.co/t/how-can-only-show-some-fields-with-kibana-filebeat/268616 "2021-03-29T00:52:07Z")
I am just getting started with ES + Kibana + Filebeat. How can I create a visual list of just the log lines form docker containers? I was able to capture log activity using this: Filebeat + Dgraph Docker Exploration … --- ## [Deleting Indexes From Kibana Not Freed Any Disk Space On Hosts](https://discuss.elastic.co/t/deleting-indexes-from-kibana-not-freed-any-disk-space-on-hosts/268610)
**Author:** [@sefacanacar](https://discuss.elastic.co/u/sefacanacar)\ **Replies:** 1\ **Last updated:** [March 29, 2021, 12:23am UTC](https://discuss.elastic.co/t/deleting-indexes-from-kibana-not-freed-any-disk-space-on-hosts/268610 "2021-03-29T00:23:24Z")
Hi, i deleted some big indexes from Kibana but no disk space is freed on my elasticsearch hosts. So i found this Elasticsearch index deletion and disk space reclamation here and tried this: curl -XPOST "https://:9200/\_… --- ## [Filebeat and ELK stack question](https://discuss.elastic.co/t/filebeat-and-elk-stack-question/268521)
**Author:** [@nunex\_17](https://discuss.elastic.co/u/nunex_17)\ **Replies:** 1\ **Last updated:** [March 29, 2021, 12:12am UTC](https://discuss.elastic.co/t/filebeat-and-elk-stack-question/268521 "2021-03-29T00:12:01Z")
Hi I have two servers (one that is running suricata and filebeat) the other is running ELK stack. They are on the same network and I want to send the suricata logs via filebeat to the ELK stack (that as basic license an… --- ## [Circuit\_breaking\_exception \[parent\] Data too large](https://discuss.elastic.co/t/circuit-breaking-exception-parent-data-too-large/268528)
**Author:** [@jfs1](https://discuss.elastic.co/u/jfs1)\ **Replies:** 1\ **Last updated:** [March 29, 2021, 12:10am UTC](https://discuss.elastic.co/t/circuit-breaking-exception-parent-data-too-large/268528 "2021-03-29T00:10:57Z")
Got this dreadful circuit\_breaking\_exception The cause is known : I accidentally started creating one index per event. Bad idea ! I stopped the offending logstash instance, so my cluster is not under load anymore. Unfo… --- ## [This behavior is deprecated. Specify JAVA\_HOME](https://discuss.elastic.co/t/this-behavior-is-deprecated-specify-java-home/268544)
**Author:** [@jtvdw](https://discuss.elastic.co/u/jtvdw)\ **Replies:** 1\ **Last updated:** [March 29, 2021, 12:09am UTC](https://discuss.elastic.co/t/this-behavior-is-deprecated-specify-java-home/268544 "2021-03-29T00:09:46Z")
Hi, I ran into a error when I installed the latest version of ActiveCollab, it makes use of ES6 and not ES7, not sure why, I had ES7 installed but ActiveCollab confirmed I need to use ES6 for it to work. Here is the er… --- ## [Data depending on the logged in user](https://discuss.elastic.co/t/data-depending-on-the-logged-in-user/268501)
**Author:** [@xquest](https://discuss.elastic.co/u/xquest)\ **Replies:** 2\ **Last updated:** [March 29, 2021, 12:07am UTC](https://discuss.elastic.co/t/data-depending-on-the-logged-in-user/268501 "2021-03-29T00:07:15Z")
Hi! In our organization, we collect logs from 100 servers. We also have 100 developers for these servers. We would like to provide one dashboard for all developers, but so that each of them only sees their own data. W… --- ## [Filebeat.yml correct configuration on MAC OS - docker autodiscover -- Docker daemon at unix:///var/run/docker.sock](https://discuss.elastic.co/t/filebeat-yml-correct-configuration-on-mac-os-docker-autodiscover-docker-daemon-at-unix-var-run-docker-sock/266923)
**Author:** [@Automation\_Scripts](https://discuss.elastic.co/u/Automation_Scripts)\ **Replies:** 2\ **Last updated:** [March 28, 2021, 11:38pm UTC](https://discuss.elastic.co/t/filebeat-yml-correct-configuration-on-mac-os-docker-autodiscover-docker-daemon-at-unix-var-run-docker-sock/266923 "2021-03-28T23:38:48Z")
Guys, I am new to Docker. Am running Docker on my MAC. I've created on my docker-compose file this configuration: filebeat: depends\_on: - kibana - logstash container\_name: fileb… --- ## [Filebeat failed to start in PCF](https://discuss.elastic.co/t/filebeat-failed-to-start-in-pcf/268603)
**Author:** [@mgzwarrior](https://discuss.elastic.co/u/mgzwarrior)\ **Replies:** 1\ **Last updated:** [March 28, 2021, 11:00pm UTC](https://discuss.elastic.co/t/filebeat-failed-to-start-in-pcf/268603 "2021-03-28T23:00:56Z")
Filebeat is failing to start with the following error. ERR Exiting: fileset okta/system is configured but doesn't exist I am attempting to run filebeat as an application in PCF with the input being sys logs from Okta (… --- ## [Issue in metricbeat 7.12](https://discuss.elastic.co/t/issue-in-metricbeat-7-12/268474)
**Author:** [@Aymeric\_Caroff](https://discuss.elastic.co/u/Aymeric_Caroff)\ **Replies:** 2\ **Last updated:** [March 28, 2021, 8:19pm UTC](https://discuss.elastic.co/t/issue-in-metricbeat-7-12/268474 "2021-03-28T20:19:46Z")
Hi, I've debugging an issue for some time now where metricbeat-7.12 doesn't seem to be able to create a new alias for an index template. About the set up: Elasticsearch 7.12 Kibana 7.12 Metricbeat 7.12 Security enabl… --- ## [All-in-one deployement of Wazuh](https://discuss.elastic.co/t/all-in-one-deployement-of-wazuh/268289)
**Author:** [@SafiaSo](https://discuss.elastic.co/u/SafiaSo)\ **Replies:** 2\ **Last updated:** [March 28, 2021, 6:56pm UTC](https://discuss.elastic.co/t/all-in-one-deployement-of-wazuh/268289 "2021-03-28T18:56:13Z")
Hi I'm trying to deploy Wazuh and ELK on a Centos 7 from the Wazuh official documentation. I'm blocking here : Run the Elasticsearch’s "securityadmin" script to load the new certificates information and start the clu… --- ## [Cant index field with ingest pipeline](https://discuss.elastic.co/t/cant-index-field-with-ingest-pipeline/268586)
**Author:** [@Alexandros888](https://discuss.elastic.co/u/Alexandros888)\ **Replies:** 2\ **Last updated:** [March 28, 2021, 6:25pm UTC](https://discuss.elastic.co/t/cant-index-field-with-ingest-pipeline/268586 "2021-03-28T18:25:05Z")
Hello, I am facing the following issue Steps: I am creating without problem the following ingest pipeline: PUT \_ingest/pipeline/alexpipeline { "description" : "calculate for the field http.request.body.origina… --- ## [See Who's changing signal detections](https://discuss.elastic.co/t/see-whos-changing-signal-detections/268545)
**Author:** [@Oliver2](https://discuss.elastic.co/u/Oliver2)\ **Replies:** 3\ **Last updated:** [March 28, 2021, 6:05pm UTC](https://discuss.elastic.co/t/see-whos-changing-signal-detections/268545 "2021-03-28T18:05:57Z")
Can you see which account have changed the signal.status field in elastic? if not can this be looked into I think it would be really useful to see which analyst is closing which detections --- ## [Find document position in query](https://discuss.elastic.co/t/find-document-position-in-query/268581)
**Author:** [@vradder](https://discuss.elastic.co/u/vradder)\ **Replies:** 8\ **Last updated:** [March 28, 2021, 5:35pm UTC](https://discuss.elastic.co/t/find-document-position-in-query/268581 "2021-03-28T17:35:15Z")
Hi, I am using ES for log viewer.. logs are displayed in timestamp ascending order with some boolQuery filters.. initially 10,000 records are displayed in first page there could be around 10 pages of query results.. and … --- ## [Custom Logo in 7.12](https://discuss.elastic.co/t/custom-logo-in-7-12/268565)
**Author:** [@Jose\_Dacosta](https://discuss.elastic.co/u/Jose_Dacosta)\ **Replies:** 2\ **Last updated:** [March 28, 2021, 5:11pm UTC](https://discuss.elastic.co/t/custom-logo-in-7-12/268565 "2021-03-28T17:11:28Z")
Hello, I am a new ELK user and I ant to customize kibana Logo. Any help? --- ## [Suricata logs over Filebeat](https://discuss.elastic.co/t/suricata-logs-over-filebeat/268538)
**Author:** [@nunex\_17](https://discuss.elastic.co/u/nunex_17)\ **Replies:** 1\ **Last updated:** [March 28, 2021, 4:56pm UTC](https://discuss.elastic.co/t/suricata-logs-over-filebeat/268538 "2021-03-28T16:56:27Z")
Hi. I am sending Suricata logs with filebeat to a ELK server. I have the eve.json configured to rotate every day at midnight. Logs are being sent to elastic and I can see them in the dashboards and discover tabs. But i… --- ## [LogStash not sending data to ElasticSearch](https://discuss.elastic.co/t/logstash-not-sending-data-to-elasticsearch/268597)
**Author:** [@ritika3799](https://discuss.elastic.co/u/ritika3799)\ **Replies:** 4\ **Last updated:** [March 28, 2021, 4:46pm UTC](https://discuss.elastic.co/t/logstash-not-sending-data-to-elasticsearch/268597 "2021-03-28T16:46:02Z")
input { file{ path =\> "C:/elastic\_stack/\*.csv" start\_position =\> "beginning" sincedb\_path =\> "null" } } filter { csv { separator =\> "," columns =\> \["name","mfr","type","calori… --- ## [Error restoring state from URL - Kibana Dashboard](https://discuss.elastic.co/t/error-restoring-state-from-url-kibana-dashboard/268573)
**Author:** [@austinsonger](https://discuss.elastic.co/u/austinsonger)\ **Replies:** 3\ **Last updated:** [March 28, 2021, 4:16pm UTC](https://discuss.elastic.co/t/error-restoring-state-from-url-kibana-dashboard/268573 "2021-03-28T16:16:08Z")
Unable to completely restore the URL, be sure to use the share functionality. Error: Unable to completely restore the URL, be sure to use the share functionality. at throwUnableToRestoreUrlError (https://####.kb.eastus2… --- ## [Logstash parsen logfiles](https://discuss.elastic.co/t/logstash-parsen-logfiles/268596)
**Author:** [@bab](https://discuss.elastic.co/u/bab)\ **Replies:** 0\ **Last updated:** [March 28, 2021, 3:51pm UTC](https://discuss.elastic.co/t/logstash-parsen-logfiles/268596 "2021-03-28T15:51:25Z")
Hi all, i'm new on ELK Stack, i need to Filter some log files using Logstash Filter features, so i need some input and tips how i can filter and parse my logs correctly, here is an example of a line from die log file: … --- ## [Issue importing geojson csa boundaries](https://discuss.elastic.co/t/issue-importing-geojson-csa-boundaries/266118)
**Author:** [@jvidin](https://discuss.elastic.co/u/jvidin)\ **Replies:** 6\ **Last updated:** [March 28, 2021, 3:53pm UTC](https://discuss.elastic.co/t/issue-importing-geojson-csa-boundaries/266118 "2021-03-28T15:53:46Z")
Hi there , Im following the blog post https://www.elastic.co/blog/how-to-map-custom-boundaries-in-kibana-with-reverse-geocoding and trying to import the csa geojson file i converted (using FME). Somehow at the end of t… --- ## [Store secrets in keystore using ansible](https://discuss.elastic.co/t/store-secrets-in-keystore-using-ansible/268595)
**Author:** [@cruggiero](https://discuss.elastic.co/u/cruggiero)\ **Replies:** 0\ **Last updated:** [March 28, 2021, 3:33pm UTC](https://discuss.elastic.co/t/store-secrets-in-keystore-using-ansible/268595 "2021-03-28T15:33:50Z")
Hello, I would like to store AWS credentials in the keystore. To deploy elasticsearch I used the official ansible playbook. Following the documentation I prepared this test node configuration: - hosts: 192.168.17… --- ## [Filtering by multiple rows](https://discuss.elastic.co/t/filtering-by-multiple-rows/268594)
**Author:** [@kevinevans](https://discuss.elastic.co/u/kevinevans)\ **Replies:** 0\ **Last updated:** [March 28, 2021, 3:31pm UTC](https://discuss.elastic.co/t/filtering-by-multiple-rows/268594 "2021-03-28T15:31:11Z")
I'm pretty new to ES, so this might be an obvious question. I have an index that contains rows of (field\_id, value, company\_id) where field\_id describes what kind of data value represents. I'd like to create a filtering… --- ## [Pipelines get event.duration from event.start and event.end](https://discuss.elastic.co/t/pipelines-get-event-duration-from-event-start-and-event-end/268561)
**Author:** [@Oliver2](https://discuss.elastic.co/u/Oliver2)\ **Replies:** 3\ **Last updated:** [March 28, 2021, 2:23pm UTC](https://discuss.elastic.co/t/pipelines-get-event-duration-from-event-start-and-event-end/268561 "2021-03-28T14:23:10Z")
what can i do in an elastic search pipeline to workout the event.duration from event.start and event.end --- ## [How to use logstash to collect docker logs cleanly](https://discuss.elastic.co/t/how-to-use-logstash-to-collect-docker-logs-cleanly/268548)
**Author:** [@wajika](https://discuss.elastic.co/u/wajika)\ **Replies:** 6\ **Last updated:** [March 28, 2021, 2:10pm UTC](https://discuss.elastic.co/t/how-to-use-logstash-to-collect-docker-logs-cleanly/268548 "2021-03-28T14:10:19Z")
The default output of docker is in json format, which will contain many special characters (such as \\n \\r). The following log sample, I need to merge multiple lines and remove all \\n \\r. For "\\r \\n", should Line Feed a… --- ## [Find time difference between documents in search hits](https://discuss.elastic.co/t/find-time-difference-between-documents-in-search-hits/268580)
**Author:** [@vradder](https://discuss.elastic.co/u/vradder)\ **Replies:** 0\ **Last updated:** [March 28, 2021, 10:16am UTC](https://discuss.elastic.co/t/find-time-difference-between-documents-in-search-hits/268580 "2021-03-28T10:16:22Z")
Hi, I am using ES for log viewer application, how can i add new script filed(hasTimeDifference) in search hits if the time difference between current and previous log is more than specified seconds(for ex: 10 seconds).. … --- ## [Logstash multiline codec not working](https://discuss.elastic.co/t/logstash-multiline-codec-not-working/268174)
**Author:** [@111435](https://discuss.elastic.co/u/111435)\ **Replies:** 1\ **Last updated:** [March 28, 2021, 9:34am UTC](https://discuss.elastic.co/t/logstash-multiline-codec-not-working/268174 "2021-03-28T09:34:53Z")
Hello, I have multilines logs: Trace file /gh/app Oracle Database 11g Enterprise Edition Release 11.2.0.4.0 - 64bit Production With the Partitioning option ORACLE\_HOME System name: SunOS Node name: kz-cdb Release:… --- ## [MetricBeat as less privileged user](https://discuss.elastic.co/t/metricbeat-as-less-privileged-user/268579)
**Author:** [@tiefseeruebe](https://discuss.elastic.co/u/tiefseeruebe)\ **Replies:** 0\ **Last updated:** [March 28, 2021, 7:55am UTC](https://discuss.elastic.co/t/metricbeat-as-less-privileged-user/268579 "2021-03-28T07:55:37Z")
Hello, I wonder what would be the most secure way to run Metricbeat with enabled system module with elevated permission to fetch all the details listed here. Some of those details are described as not available as less … --- ## [Logstash not reading the environment variable properly](https://discuss.elastic.co/t/logstash-not-reading-the-environment-variable-properly/268574)
**Author:** [@mastersmit](https://discuss.elastic.co/u/mastersmit)\ **Replies:** 0\ **Last updated:** [March 28, 2021, 4:43am UTC](https://discuss.elastic.co/t/logstash-not-reading-the-environment-variable-properly/268574 "2021-03-28T04:43:39Z")
As we are connecting to a secure elasticsearch via logstash, I have decided to have the password of the elasticsearch configured as a env variable for example ${ELASTIC\_SEARCH\_PASSWORD} but it doesnt work as expected wh… --- ## [Unsupported symbol \[-\] in geohash](https://discuss.elastic.co/t/unsupported-symbol-in-geohash/268563)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 2\ **Last updated:** [March 28, 2021, 3:06am UTC](https://discuss.elastic.co/t/unsupported-symbol-in-geohash/268563 "2021-03-28T03:06:57Z")
I am facing some issue while defining mapping for an index \[2021-03-27T23:27:36,733\]\[WARN \]\[logstash.outputs.elasticsearch\]\[packetbeat\]\[7bb6e349f13f74fc053ef83bdac5d84b4de038193ed7d008068e4432f88bd27d\] Could not index e… --- ## [How to include custom key/value in webhook?](https://discuss.elastic.co/t/how-to-include-custom-key-value-in-webhook/268570)
**Author:** [@Sandra\_Schlichting](https://discuss.elastic.co/u/Sandra_Schlichting)\ **Replies:** 1\ **Last updated:** [March 28, 2021, 12:09am UTC](https://discuss.elastic.co/t/how-to-include-custom-key-value-in-webhook/268570 "2021-03-28T00:09:47Z")
Dear all =) Does anyone know how to include a custom key/value in a webhook? E.g. "ExampleKey": "ExampleValue" My current webhook json encodes the payload, so the custom key/value would have to be part of the json bl… [Previous page](https://discuss.elastic.co/latest.md?page=1760) [Next page](https://discuss.elastic.co/latest.md?page=1762)