# Latest **URL:** https://discuss.elastic.co/latest.md?page=1798 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1799 --- ## [Analyzing navigation paths](https://discuss.elastic.co/t/analyzing-navigation-paths/266068)
**Author:** [@Faycal](https://discuss.elastic.co/u/Faycal)\ **Replies:** 2\ **Last updated:** [March 7, 2021, 2:35pm UTC](https://discuss.elastic.co/t/analyzing-navigation-paths/266068 "2021-03-07T14:35:37Z")
Hello, i'm saving the url visited of my site as single documents with a visitID and the timestamp of the impression. I'd like to "count" the navigation paths inside a visit of my visitors. example home.html -\> catalo… --- ## [Practical scoring function](https://discuss.elastic.co/t/practical-scoring-function/266473)
**Author:** [@Tlm\_Konstantinos](https://discuss.elastic.co/u/Tlm_Konstantinos)\ **Replies:** 0\ **Last updated:** [March 7, 2021, 12:28pm UTC](https://discuss.elastic.co/t/practical-scoring-function/266473 "2021-03-07T12:28:50Z")
Hi everyone. I am currently working on figuring out the practical scoring function of elastic search queries. I would like to know what scores give bad text or semantic similarity. What is the threshold that shows little… --- ## [Logstash not working!](https://discuss.elastic.co/t/logstash-not-working/264983)
**Author:** [@Mohyden](https://discuss.elastic.co/u/Mohyden)\ **Replies:** 9\ **Last updated:** [March 7, 2021, 5:17am UTC](https://discuss.elastic.co/t/logstash-not-working/264983 "2021-03-07T05:17:27Z")
Hello, I'm running Ubuntu 16.04. When I try to start Logstash with systemctl start logstash, and then systemctl status logstash, it shows these: logstash.service - logstash Loaded: loaded (/etc/systemd/system/logstash… --- ## [Stack Monitoring not working with Kubernetes containers](https://discuss.elastic.co/t/stack-monitoring-not-working-with-kubernetes-containers/266421)
**Author:** [@InnerJoin](https://discuss.elastic.co/u/InnerJoin)\ **Replies:** 4\ **Last updated:** [March 7, 2021, 1:38am UTC](https://discuss.elastic.co/t/stack-monitoring-not-working-with-kubernetes-containers/266421 "2021-03-07T01:38:12Z")
Hi all, I'm trying to get stack monitoring working on a cluster that I have deployed for testing in a Kubernetes cluster. I was able to get the old self monitoring to work, but if I try to monitor with metricbeat everyt… --- ## [Journalbeat has no dashboards?](https://discuss.elastic.co/t/journalbeat-has-no-dashboards/266426)
**Author:** [@smm](https://discuss.elastic.co/u/smm)\ **Replies:** 1\ **Last updated:** [March 6, 2021, 6:28pm UTC](https://discuss.elastic.co/t/journalbeat-has-no-dashboards/266426 "2021-03-06T18:28:36Z")
Hi there, can it be that journalbeats has no predifined dashboards on board? Doing this: /usr/share/journalbeat/bin# ./journalbeat setup -e -c /etc/journalbeat/journalbeat.yml --dashboards I do not get anything in Ki… --- ## [All shards failing error](https://discuss.elastic.co/t/all-shards-failing-error/266303)
**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Replies:** 3\ **Last updated:** [March 6, 2021, 11:02pm UTC](https://discuss.elastic.co/t/all-shards-failing-error/266303 "2021-03-06T23:02:55Z")
I am having problems with an application (Arkime) which uses ES to store its data. When it does long searches these time out and on looking at the logs I find errors from ES. The same errors are in the ES logs and I hav… --- ## [Item 381of GeoJSON will not load?](https://discuss.elastic.co/t/item-381of-geojson-will-not-load/266414)
**Author:** [@dshashek](https://discuss.elastic.co/u/dshashek)\ **Replies:** 2\ **Last updated:** [March 6, 2021, 9:57pm UTC](https://discuss.elastic.co/t/item-381of-geojson-will-not-load/266414 "2021-03-06T21:57:47Z")
I do not understand at all what is going on here. I'm trying to load a geojson of congressional districts that I've merged with additional information about each congressman using the geopandas library. Every district … --- ## [Java connection lost](https://discuss.elastic.co/t/java-connection-lost/266454)
**Author:** [@Cosmin\_Ciobanu1](https://discuss.elastic.co/u/Cosmin_Ciobanu1)\ **Replies:** 0\ **Last updated:** [March 6, 2021, 9:06pm UTC](https://discuss.elastic.co/t/java-connection-lost/266454 "2021-03-06T21:06:17Z")
Hi! I'm trying to connect to my Elasticsearch node from Java. I have this code : final CredentialsProvider credentialsProvider = new BasicCredentialsProvider(); credentialsProvider.setCredentials(AuthS… --- ## [Elasticsearch OSS Docker Images](https://discuss.elastic.co/t/elasticsearch-oss-docker-images/266091)
**Author:** [@robinhood\_lko](https://discuss.elastic.co/u/robinhood_lko)\ **Replies:** 4\ **Last updated:** [March 6, 2021, 6:53pm UTC](https://discuss.elastic.co/t/elasticsearch-oss-docker-images/266091 "2021-03-06T18:53:34Z")
Hi All, What is primary difference between Elasticsearch OSS and OSS Snapshot docker images. Any link to document will be very helpful. Thanks. --- ## [Problem with searching and deleting data in Elasticsearch using term and regexp](https://discuss.elastic.co/t/problem-with-searching-and-deleting-data-in-elasticsearch-using-term-and-regexp/266447)
**Author:** [@white\_rabbit](https://discuss.elastic.co/u/white_rabbit)\ **Replies:** 0\ **Last updated:** [March 6, 2021, 2:59pm UTC](https://discuss.elastic.co/t/problem-with-searching-and-deleting-data-in-elasticsearch-using-term-and-regexp/266447 "2021-03-06T14:59:26Z")
I am currently developing a user data analysis platform and have a problem with searching and deleting data in Elasticsearch using term and regexp. I would be very grateful for checking the solutions below and writing so… --- ## [Logstash on Docker ERROR: Failed to read pipelines yaml file. Location: /usr/share/logstash/config/pipelines.yml](https://discuss.elastic.co/t/logstash-on-docker-error-failed-to-read-pipelines-yaml-file-location-usr-share-logstash-config-pipelines-yml/266449)
**Author:** [@20031485](https://discuss.elastic.co/u/20031485)\ **Replies:** 0\ **Last updated:** [March 6, 2021, 4:40pm UTC](https://discuss.elastic.co/t/logstash-on-docker-error-failed-to-read-pipelines-yaml-file-location-usr-share-logstash-config-pipelines-yml/266449 "2021-03-06T16:40:23Z")
Hello! I am facing difficulties trying to configure my ELK stack in which Logstash should be running multiple pipelines, and the problem seems to be in the Logstash docker-compose.yml configuration. In fact, I get the fo… --- ## [Vega Scale Question - static mapping](https://discuss.elastic.co/t/vega-scale-question-static-mapping/266379)
**Author:** [@dandcp](https://discuss.elastic.co/u/dandcp)\ **Replies:** 2\ **Last updated:** [March 6, 2021, 1:31pm UTC](https://discuss.elastic.co/t/vega-scale-question-static-mapping/266379 "2021-03-06T13:31:47Z")
I apologize for the simplicity of this question, but I simply cannot figure it out from the Vega documentation and I suspect it's a simple answer. I have a scatter chart that I've created and one of the things I do is c… --- ## [Do you know how to solve this in logs?](https://discuss.elastic.co/t/do-you-know-how-to-solve-this-in-logs/266321)
**Author:** [@b4yu](https://discuss.elastic.co/u/b4yu)\ **Replies:** 6\ **Last updated:** [March 6, 2021, 9:47am UTC](https://discuss.elastic.co/t/do-you-know-how-to-solve-this-in-logs/266321 "2021-03-06T09:47:21Z")
i got this on kibana logs how to fix it so kibana logs can work? failed to format message from /var/log/suricata/eve.json --- ## [What is elasticsearch best feature to achieve what I need?](https://discuss.elastic.co/t/what-is-elasticsearch-best-feature-to-achieve-what-i-need/266360)
**Author:** [@Nuno\_Oliveira](https://discuss.elastic.co/u/Nuno_Oliveira)\ **Replies:** 3\ **Last updated:** [March 6, 2021, 8:52am UTC](https://discuss.elastic.co/t/what-is-elasticsearch-best-feature-to-achieve-what-i-need/266360 "2021-03-06T08:52:21Z")
Hi, I'm relatively new to elasticsearch and I'm not sure what is the best approach to achieve what I want, but this is what I've been trying: I have a list of dog breeds in an Index and given the input "0293 Corki USA" … --- ## [Никак не могу обновить elasticsearch выше 7.9.3](https://discuss.elastic.co/t/elasticsearch-7-9-3/266400)
**Author:** [@Jhonny-2005](https://discuss.elastic.co/u/Jhonny-2005)\ **Replies:** 3\ **Last updated:** [March 6, 2021, 12:28am UTC](https://discuss.elastic.co/t/elasticsearch-7-9-3/266400 "2021-03-06T00:28:50Z")
Сейчас установлена версия Elasticsearch 7.9.0. Никак не могу обновить Elastic, начиная с версии 7.10.0. Это происходит и в более новых версия. До 7.9.3 обновляется нормально. Прошу, помогите, куда копать уже не знаю. По… --- ## [Optimization for rolling restart without stopping indexing](https://discuss.elastic.co/t/optimization-for-rolling-restart-without-stopping-indexing/266411)
**Author:** [@jthoni](https://discuss.elastic.co/u/jthoni)\ **Replies:** 0\ **Last updated:** [March 5, 2021, 10:30pm UTC](https://discuss.elastic.co/t/optimization-for-rolling-restart-without-stopping-indexing/266411 "2021-03-05T22:30:03Z")
I know the topic of shard allocation during rolling restarts is a well worn path here. When we do node restarts, we: Disable shard allocation Restart the node Once the node comes back online, we reenable allocation Whe… --- ## [Detection Failiure in ELK7.8 SIEM](https://discuss.elastic.co/t/detection-failiure-in-elk7-8-siem/266217)
**Author:** [@jancodenew](https://discuss.elastic.co/u/jancodenew)\ **Replies:** 1\ **Last updated:** [March 5, 2021, 10:18pm UTC](https://discuss.elastic.co/t/detection-failiure-in-elk7-8-siem/266217 "2021-03-05T22:18:07Z")
Hello, It is noticed that detection rule is getting failed by showing the bellow error message. "Consider increasing your look back time or adding more Kibana instances." I have tried increasing the look back time fro… --- ## [The filebeat and logstash connections will be refused](https://discuss.elastic.co/t/the-filebeat-and-logstash-connections-will-be-refused/266094)
**Author:** [@its-ogawa](https://discuss.elastic.co/u/its-ogawa)\ **Replies:** 1\ **Last updated:** [March 5, 2021, 10:15pm UTC](https://discuss.elastic.co/t/the-filebeat-and-logstash-connections-will-be-refused/266094 "2021-03-05T22:15:50Z")
I want filebeat and logstash to communicate with each other to collect multiple log files. I have run the following test command for filebeat, but the connection is refused. What is the reason for this? filebeat -e -c… --- ## [Field aliases in search results](https://discuss.elastic.co/t/field-aliases-in-search-results/266221)
**Author:** [@andreas123](https://discuss.elastic.co/u/andreas123)\ **Replies:** 1\ **Last updated:** [March 5, 2021, 10:10pm UTC](https://discuss.elastic.co/t/field-aliases-in-search-results/266221 "2021-03-05T22:10:19Z")
Hey, we have different suppliers for data that is imported into elastic. The suppliers use different field names, but some of them use the same type of data. Example: Supplier A: last\_seen: 2020\_02\_03 IP: 10.10.10.1… --- ## [Async-search keepalive value](https://discuss.elastic.co/t/async-search-keepalive-value/266314)
**Author:** [@alexpanas](https://discuss.elastic.co/u/alexpanas)\ **Replies:** 9\ **Last updated:** [March 5, 2021, 10:04pm UTC](https://discuss.elastic.co/t/async-search-keepalive-value/266314 "2021-03-05T22:04:30Z")
Hi, As far as I can see from https://www.elastic.co/guide/en/elasticsearch/reference/current/async-search.html - the default keep-alive value for async search is 5 days and is regulated on the query side. This results … --- ## [Indicator match rule not matched and Mapped with filebeat-\* (MISP Module)](https://discuss.elastic.co/t/indicator-match-rule-not-matched-and-mapped-with-filebeat-misp-module/266315)
**Author:** [@raviraja](https://discuss.elastic.co/u/raviraja)\ **Replies:** 1\ **Last updated:** [March 5, 2021, 10:01pm UTC](https://discuss.elastic.co/t/indicator-match-rule-not-matched-and-mapped-with-filebeat-misp-module/266315 "2021-03-05T22:01:05Z")
Hi guys, We are using ELK 7.11.1 version. We have ingested threat intelligence feeds from MISP server and stored in Elasticsearch through Filebeat.(Using Module MISP) and we want to map and match with Zscalerlog. Base… --- ## [Need help to update es6 template to es7](https://discuss.elastic.co/t/need-help-to-update-es6-template-to-es7/266409)
**Author:** [@michbsd](https://discuss.elastic.co/u/michbsd)\ **Replies:** 0\ **Last updated:** [March 5, 2021, 9:27pm UTC](https://discuss.elastic.co/t/need-help-to-update-es6-template-to-es7/266409 "2021-03-05T21:27:38Z")
Hi, I have been using varnishstatbeat in the past to ship varnish statistics to Elasticsearch. I am currently in the process of upgrading my cluster to 7.x - and there is no es7 template for the varnishstatbeat project… --- ## [Filebeat and logs with preallocated space](https://discuss.elastic.co/t/filebeat-and-logs-with-preallocated-space/266223)
**Author:** [@111449](https://discuss.elastic.co/u/111449)\ **Replies:** 2\ **Last updated:** [March 5, 2021, 9:06pm UTC](https://discuss.elastic.co/t/filebeat-and-logs-with-preallocated-space/266223 "2021-03-05T21:06:39Z")
Hello! Legacy software I have to use works on Windows and writes a log in the following way: it writes a lot of \\u0000 (NULL) symbols into the end of file to preallocate space and then (when it needs to write a log str… --- ## [Ruby, App Search, filters & my sanity](https://discuss.elastic.co/t/ruby-app-search-filters-my-sanity/266406)
**Author:** [@brianw123](https://discuss.elastic.co/u/brianw123)\ **Replies:** 5\ **Last updated:** [March 5, 2021, 8:54pm UTC](https://discuss.elastic.co/t/ruby-app-search-filters-my-sanity/266406 "2021-03-05T20:54:40Z")
Hello! I've been losing my mind trying to figure out how to use multiple filters on a query using the Ruby gem for App Search (elastic-enterprise-search). Reading the docs here: I'm not seeing any examples using multi… --- ## [Metricbeat v7 on FreeBSD system module / memory not working](https://discuss.elastic.co/t/metricbeat-v7-on-freebsd-system-module-memory-not-working/266390)
**Author:** [@michbsd](https://discuss.elastic.co/u/michbsd)\ **Replies:** 1\ **Last updated:** [March 5, 2021, 8:14pm UTC](https://discuss.elastic.co/t/metricbeat-v7-on-freebsd-system-module-memory-not-working/266390 "2021-03-05T20:14:50Z")
metricbeat version 7.10.1 (amd64), libbeat 7.10.1 \[v7.10.1 built 2021-02-02 03:16:09 +0000 UTC\] Hi, According to the reference (https://www.elastic.co/guide/en/beats/metricbeat/current/metricbeat-metricset-system-memor… --- ## [Processor for shingles, similar to split?](https://discuss.elastic.co/t/processor-for-shingles-similar-to-split/266254)
**Author:** [@Mark\_Petersen](https://discuss.elastic.co/u/Mark_Petersen)\ **Replies:** 1\ **Last updated:** [March 5, 2021, 7:40pm UTC](https://discuss.elastic.co/t/processor-for-shingles-similar-to-split/266254 "2021-03-05T19:40:02Z")
Is there a processor that will do shingles or can I make a custom one somehow? In the pipeline processor below, I split on the space character, but I'd also like to combine words like a shingle analyzer would: PUT \_ing… --- ## [Filebeat module's fields in SIEM columns](https://discuss.elastic.co/t/filebeat-modules-fields-in-siem-columns/266090)
**Author:** [@radovan](https://discuss.elastic.co/u/radovan)\ **Replies:** 1\ **Last updated:** [March 5, 2021, 7:42pm UTC](https://discuss.elastic.co/t/filebeat-modules-fields-in-siem-columns/266090 "2021-03-05T19:42:34Z")
Hi, after upgrading our cluster from 7.10.2 to 7.11.1 we can no more see values of filebeat module's fields in columns, for example suricata's fields (screenshot below), although they are included in the signal's fi… --- ## [Index Policies Never Rollover to the Defined Index Life-cycle Policy](https://discuss.elastic.co/t/index-policies-never-rollover-to-the-defined-index-life-cycle-policy/266146)
**Author:** [@austinsonger](https://discuss.elastic.co/u/austinsonger)\ **Replies:** 10\ **Last updated:** [March 5, 2021, 7:17pm UTC](https://discuss.elastic.co/t/index-policies-never-rollover-to-the-defined-index-life-cycle-policy/266146 "2021-03-05T19:17:25Z")
No matter what how I edit the index policies. The indexes never roll over to Warm tier. My indexes just goes straight from hot to delete. Even though my index policy says the following: PUT \_ilm/policy/filebeat { "po… --- ## [Invalid license found, requires a basic or a valid trial license and received Open source](https://discuss.elastic.co/t/invalid-license-found-requires-a-basic-or-a-valid-trial-license-and-received-open-source/266391)
**Author:** [@Charles100](https://discuss.elastic.co/u/Charles100)\ **Replies:** 6\ **Last updated:** [March 5, 2021, 7:10pm UTC](https://discuss.elastic.co/t/invalid-license-found-requires-a-basic-or-a-valid-trial-license-and-received-open-source/266391 "2021-03-05T19:10:05Z")
Hi, I followed this procedure to install ELK on Kubernetes (Deploy ECK in your Kubernetes cluster | Elastic Cloud on Kubernetes \[1.4\] | Elastic). Everything looks ok. Now, I want to use filebeat on my kubernetes host t… --- ## [When it is useful to have multiple config files for a single Kibana instance?](https://discuss.elastic.co/t/when-it-is-useful-to-have-multiple-config-files-for-a-single-kibana-instance/266363)
**Author:** [@trex](https://discuss.elastic.co/u/trex)\ **Replies:** 3\ **Last updated:** [March 5, 2021, 7:04pm UTC](https://discuss.elastic.co/t/when-it-is-useful-to-have-multiple-config-files-for-a-single-kibana-instance/266363 "2021-03-05T19:04:58Z")
When is it useful to have multiple config files for a single Kibana instance? $ ./bin/kibana --help -c, --config \ Path to the config file, use multiple --config args to include multiple config files [Previous page](https://discuss.elastic.co/latest.md?page=1797) [Next page](https://discuss.elastic.co/latest.md?page=1799)