# Latest **URL:** https://discuss.elastic.co/latest.md?page=1818 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1819 --- ## [Logstash error - Failed to decode CEF payload. Generating failure event with payload in message field](https://discuss.elastic.co/t/logstash-error-failed-to-decode-cef-payload-generating-failure-event-with-payload-in-message-field/265365)
**Author:** [@testsemd\_email](https://discuss.elastic.co/u/testsemd_email)\ **Replies:** 3\ **Last updated:** [February 24, 2021, 4:38pm UTC](https://discuss.elastic.co/t/logstash-error-failed-to-decode-cef-payload-generating-failure-event-with-payload-in-message-field/265365 "2021-02-24T16:38:36Z")
I configued the syslog.conf file to get the traffic to elasticsearch(installed in same server). Syslog data traffic is coming as CEF format to logstash. syslog.conf file as bellow: input { tcp { port =\> 5514 type =\>… --- ## [What is the ElasticMachine GitHub Bot?](https://discuss.elastic.co/t/what-is-the-elasticmachine-github-bot/265098)
**Author:** [@alex-treebeard](https://discuss.elastic.co/u/alex-treebeard)\ **Replies:** 2\ **Last updated:** [February 24, 2021, 4:16pm UTC](https://discuss.elastic.co/t/what-is-the-elasticmachine-github-bot/265098 "2021-02-24T16:16:12Z")
Hey folks, I've been researching tools for monitoring flaky tests and noticed some pretty neat activity with elasticmachine. By the looks of it this bot does a ton of operational work for elastic.co, and is closed sour… --- ## [UTC vs EST log events in Kibana](https://discuss.elastic.co/t/utc-vs-est-log-events-in-kibana/264921)
**Author:** [@Yuri\_Sibirski](https://discuss.elastic.co/u/Yuri_Sibirski)\ **Replies:** 5\ **Last updated:** [February 24, 2021, 4:09pm UTC](https://discuss.elastic.co/t/utc-vs-est-log-events-in-kibana/264921 "2021-02-24T16:09:45Z")
Hi there. I was not able to find a solution for my problem that is why I am creating this post. My problem is that we are sending logs to elasticsearch from linux nodes using either UTC or EST as their timezones. For EST… --- ## [Convert string in strict\_date\_time (yyyy-MM-dd'T'HH:mm:ss.SSSZZ) to @timestamp](https://discuss.elastic.co/t/convert-string-in-strict-date-time-yyyy-mm-ddthhss-ssszz-to-timestamp/265150)
**Author:** [@manulearns](https://discuss.elastic.co/u/manulearns)\ **Replies:** 10\ **Last updated:** [February 24, 2021, 4:02pm UTC](https://discuss.elastic.co/t/convert-string-in-strict-date-time-yyyy-mm-ddthhss-ssszz-to-timestamp/265150 "2021-02-24T16:02:12Z")
Hi, I'am trying to convert a string in strict\_date\_time format 2021-02-19T23:02:57.277+05:30 to @timestamp. date { match =\> \[ "timeStampString" , "yyyy-MM-dd'T'HH:mm:ss.SSSZZ" \] target =\> "logTimestamp3" } Throwin… --- ## [Select statemet results in a blocked write attempt](https://discuss.elastic.co/t/select-statemet-results-in-a-blocked-write-attempt/265366)
**Author:** [@daniel90](https://discuss.elastic.co/u/daniel90)\ **Replies:** 0\ **Last updated:** [February 24, 2021, 3:47pm UTC](https://discuss.elastic.co/t/select-statemet-results-in-a-blocked-write-attempt/265366 "2021-02-24T15:47:38Z")
I tried to access data created by greylog in a elasticsearch index using: As reference i should get the contents of greylog\_10 with: curl -X POST "localhost:9200/\_sql?format=txt&pretty" -H 'Content-Type: applicatio… --- ## [Kibana SQL question - subselect](https://discuss.elastic.co/t/kibana-sql-question-subselect/265229)
**Author:** [@tangkalo](https://discuss.elastic.co/u/tangkalo)\ **Replies:** 6\ **Last updated:** [February 24, 2021, 3:40pm UTC](https://discuss.elastic.co/t/kibana-sql-question-subselect/265229 "2021-02-24T15:40:06Z")
Hi, I am trying to get the latest messages and then sort these messages based on one of their fields(i.e. name in this case). I tried the following. It ran but the sorting didn't happen. Any idea of what I am doing wrong… --- ## [Compile rate limit for painless scripts](https://discuss.elastic.co/t/compile-rate-limit-for-painless-scripts/263421)
**Author:** [@dineshabbi](https://discuss.elastic.co/u/dineshabbi)\ **Replies:** 4\ **Last updated:** [February 24, 2021, 3:30pm UTC](https://discuss.elastic.co/t/compile-rate-limit-for-painless-scripts/263421 "2021-02-24T15:30:03Z")
Hi team, For one of our update use cases, we were benchmarking painless scripts to check to what extent we can scale them. In our experiments, I had 200 scripts, each with a '\\n' character difference, and each script wa… --- ## [Deduce filters from search string](https://discuss.elastic.co/t/deduce-filters-from-search-string/265353)
**Author:** [@Christian87](https://discuss.elastic.co/u/Christian87)\ **Replies:** 4\ **Last updated:** [February 24, 2021, 3:15pm UTC](https://discuss.elastic.co/t/deduce-filters-from-search-string/265353 "2021-02-24T15:15:40Z")
Hi, let's say I store a catalogue of household appliances in Elasticsearch. Documents in my index can represent dish washers, washing machines, freezers and similar devices. Dish washers have a text field "type" which … --- ## [Remote Elasticsearch Cluster monitoring through Metricbeat not disabling metricset](https://discuss.elastic.co/t/remote-elasticsearch-cluster-monitoring-through-metricbeat-not-disabling-metricset/264964)
**Author:** [@silversonic](https://discuss.elastic.co/u/silversonic)\ **Replies:** 0\ **Last updated:** [February 20, 2021, 11:31pm UTC](https://discuss.elastic.co/t/remote-elasticsearch-cluster-monitoring-through-metricbeat-not-disabling-metricset/264964 "2021-02-20T23:31:11Z")
Hello, Scratching my head on this one. I'm setting up remote elasticsearch monitoring for a production cluster and sending metrics to a second elasticsearch cluster to handle observing the production cluster. Everythi… --- ## [Filebeat Helm deployment reports use of deprected k8s api](https://discuss.elastic.co/t/filebeat-helm-deployment-reports-use-of-deprected-k8s-api/262671)
**Author:** [@Rodrigo\_LN](https://discuss.elastic.co/u/Rodrigo_LN)\ **Replies:** 1\ **Last updated:** [February 24, 2021, 3:12pm UTC](https://discuss.elastic.co/t/filebeat-helm-deployment-reports-use-of-deprected-k8s-api/262671 "2021-02-24T15:12:56Z")
Helm based deployment of Filebeat, and ES produce the following warnings: W0128 13:25:59.736302 3118 warnings.go:70\] rbac.authorization.k8s.io/v1beta1 ClusterRole is deprecated in v1.17+, unavailable in v1.22+; use r… --- ## [Let Logstash handle multi-pipeline performance?](https://discuss.elastic.co/t/let-logstash-handle-multi-pipeline-performance/265177)
**Author:** [@nico127](https://discuss.elastic.co/u/nico127)\ **Replies:** 3\ **Last updated:** [February 24, 2021, 3:08pm UTC](https://discuss.elastic.co/t/let-logstash-handle-multi-pipeline-performance/265177 "2021-02-24T15:08:00Z")
In the case of multi-pipeline, I understand that the canonical way to handle performance is to manually configure each pipeline, e.g. to use N pipeline workers, or to have a batch size of M. is it possible to let Logsta… --- ## [Difference between top hit and max in kibana visualization aggregation](https://discuss.elastic.co/t/difference-between-top-hit-and-max-in-kibana-visualization-aggregation/265309)
**Author:** [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\ **Replies:** 1\ **Last updated:** [February 24, 2021, 3:00pm UTC](https://discuss.elastic.co/t/difference-between-top-hit-and-max-in-kibana-visualization-aggregation/265309 "2021-02-24T15:00:04Z")
Hi all, I am trying to find the difference between top hit aggregation and max aggregation in kibana. They both are supposed to give maximum value of a group. I went through threads, but could not find anything relate… --- ## [\[7.10.2\] Pending alerts when multiple instances of kibana](https://discuss.elastic.co/t/7-10-2-pending-alerts-when-multiple-instances-of-kibana/263583)
**Author:** [@dao](https://discuss.elastic.co/u/dao)\ **Replies:** 10\ **Last updated:** [February 24, 2021, 2:48pm UTC](https://discuss.elastic.co/t/7-10-2-pending-alerts-when-multiple-instances-of-kibana/263583 "2021-02-24T14:48:13Z")
Hello. This thread is the translation of this one, this one and this issue that may be reopened when I'll have more clues So, I have created a brand new deployment on cloud.elastic.co. Created an alert on it with an ema… --- ## [Two indexes how to filter with different name fields](https://discuss.elastic.co/t/two-indexes-how-to-filter-with-different-name-fields/265095)
**Author:** [@Lorenzo\_Allori](https://discuss.elastic.co/u/Lorenzo_Allori)\ **Replies:** 3\ **Last updated:** [February 24, 2021, 8:27am UTC](https://discuss.elastic.co/t/two-indexes-how-to-filter-with-different-name-fields/265095 "2021-02-24T08:27:33Z")
Hi there! I have two different indexes that have different fields name which are actually the same thing: For example: Index 1 has: IPV4\_SRC\_ADDR : "75.72.214.200" Index 2 has: source.addr: "75.72.214.200" I cannot … --- ## [\[Bug\] Enterprise Search dashboard url pending](https://discuss.elastic.co/t/bug-enterprise-search-dashboard-url-pending/265281)
**Author:** [@s97712](https://discuss.elastic.co/u/s97712)\ **Replies:** 6\ **Last updated:** [February 24, 2021, 2:43pm UTC](https://discuss.elastic.co/t/bug-enterprise-search-dashboard-url-pending/265281 "2021-02-24T14:43:22Z")
same as https://discuss.elastic.co/t/bug-app-search-dashboard-fails-to-load-after-restarting-the-server/206237 \[2021-02-24T06:47:17.713+00:00\]\[1602\]\[2522\]\[app-server\]\[INFO\]: \[ca4b3fd5-d181-4c13-86ea-cebced39a3b5\] S… --- ## [Logstash configuration | Elimination of if loops in checking values at nested JSON keys](https://discuss.elastic.co/t/logstash-configuration-elimination-of-if-loops-in-checking-values-at-nested-json-keys/265139)
**Author:** [@pkrahul236](https://discuss.elastic.co/u/pkrahul236)\ **Replies:** 3\ **Last updated:** [February 24, 2021, 2:38pm UTC](https://discuss.elastic.co/t/logstash-configuration-elimination-of-if-loops-in-checking-values-at-nested-json-keys/265139 "2021-02-24T14:38:29Z")
Hello Community Users, I am seeking help regarding writing a better logstash configuration file. I am dealing with nested array JSON which looks something like this. { "data": { "content": { "payload": \[ … --- ## [Change format of labels in a visualization X axis chart](https://discuss.elastic.co/t/change-format-of-labels-in-a-visualization-x-axis-chart/265131)
**Author:** [@fefontana](https://discuss.elastic.co/u/fefontana)\ **Replies:** 3\ **Last updated:** [February 24, 2021, 2:37pm UTC](https://discuss.elastic.co/t/change-format-of-labels-in-a-visualization-x-axis-chart/265131 "2021-02-24T14:37:59Z")
Hello, I'd like to know if it is possible to change the format of the labels at the chart axis in visualizations. An image with an example is attached. --- ## [I have to enable send email alert for if down system and if cross threshold limit](https://discuss.elastic.co/t/i-have-to-enable-send-email-alert-for-if-down-system-and-if-cross-threshold-limit/265357)
**Author:** [@psganeshk](https://discuss.elastic.co/u/psganeshk)\ **Replies:** 1\ **Last updated:** [February 24, 2021, 2:36pm UTC](https://discuss.elastic.co/t/i-have-to-enable-send-email-alert-for-if-down-system-and-if-cross-threshold-limit/265357 "2021-02-24T14:36:27Z")
please guide us what is the price for enabling email alert --- ## [Legend Color](https://discuss.elastic.co/t/legend-color/265310)
**Author:** [@NourBM](https://discuss.elastic.co/u/NourBM)\ **Replies:** 5\ **Last updated:** [February 24, 2021, 2:35pm UTC](https://discuss.elastic.co/t/legend-color/265310 "2021-02-24T14:35:21Z")
Hi , Is there any way where i can make the color for up= Green and down= RED, instead of default colors provided by Kibana as shown below. and also when you click on down area then Graph shows GREEN which should be RED f… --- ## [How to automatically stop logstash process instance after its read the doc](https://discuss.elastic.co/t/how-to-automatically-stop-logstash-process-instance-after-its-read-the-doc/265343)
**Author:** [@rknd](https://discuss.elastic.co/u/rknd)\ **Replies:** 1\ **Last updated:** [February 24, 2021, 2:33pm UTC](https://discuss.elastic.co/t/how-to-automatically-stop-logstash-process-instance-after-its-read-the-doc/265343 "2021-02-24T14:33:47Z")
I want to ask that, below is my code. With the below code logstash reads the file until its end. Then it is stops reading but process is still alive. I want that process stops when it finishes the reading. How can i do t… --- ## [Setting index.mapper.dynamic was removed after version 6.0.0](https://discuss.elastic.co/t/setting-index-mapper-dynamic-was-removed-after-version-6-0-0/265356)
**Author:** [@jmaitrehenry](https://discuss.elastic.co/u/jmaitrehenry)\ **Replies:** 0\ **Last updated:** [February 24, 2021, 2:15pm UTC](https://discuss.elastic.co/t/setting-index-mapper-dynamic-was-removed-after-version-6-0-0/265356 "2021-02-24T14:15:57Z")
Hi, I have a trouble after trying to update an index mapping with ES 7.4 and 7.9: PUT /myindex/\_mapping { "properties": { "doc": { "properties": { "transaction": { "properties": { … --- ## [Kibana RAM allocation](https://discuss.elastic.co/t/kibana-ram-allocation/265286)
**Author:** [@Farid\_N](https://discuss.elastic.co/u/Farid_N)\ **Replies:** 8\ **Last updated:** [February 24, 2021, 2:05pm UTC](https://discuss.elastic.co/t/kibana-ram-allocation/265286 "2021-02-24T14:05:19Z")
Hi there Despite of 8G RAM, my Kibana uses only 1G of RAM... How can I allocate more RAM to Kibana? What should I write in kibana.yml to determine more RAM for Kibana? --- ## [Kibana SAML iframe request canceled and redirect to the kibana page](https://discuss.elastic.co/t/kibana-saml-iframe-request-canceled-and-redirect-to-the-kibana-page/265315)
**Author:** [@vapetri](https://discuss.elastic.co/u/vapetri)\ **Replies:** 2\ **Last updated:** [February 24, 2021, 2:03pm UTC](https://discuss.elastic.co/t/kibana-saml-iframe-request-canceled-and-redirect-to-the-kibana-page/265315 "2021-02-24T14:03:16Z")
Hi, I have an issue with a Kibana(v6.8) SAML integration with Oracle OAM stack. Kibana dashboards and visualizations are used as an iframe in another application. Now when I login also via SAML in that application I s… --- ## [Index Dimensioning and Optimization (across the Cluster)](https://discuss.elastic.co/t/index-dimensioning-and-optimization-across-the-cluster/265041)
**Author:** [@wissam](https://discuss.elastic.co/u/wissam)\ **Replies:** 5\ **Last updated:** [February 24, 2021, 2:00pm UTC](https://discuss.elastic.co/t/index-dimensioning-and-optimization-across-the-cluster/265041 "2021-02-24T14:00:12Z")
Hello, We have an Elasticsearch (v7.5.3) cluster with 4 nodes (each is a VM with 16 CPUs, 32 GB of RAM and JVM heap size of 16GB) and all configured as data nodes. Our main index has around 110M records (~70 GB) that w… --- ## [Cannot connect to the Elasticsearch cluster](https://discuss.elastic.co/t/cannot-connect-to-the-elasticsearch-cluster/265348)
**Author:** [@Jeremy\_Colmenarez](https://discuss.elastic.co/u/Jeremy_Colmenarez)\ **Replies:** 2\ **Last updated:** [February 24, 2021, 1:57pm UTC](https://discuss.elastic.co/t/cannot-connect-to-the-elasticsearch-cluster/265348 "2021-02-24T13:57:12Z")
Hi everyone, im new at Elastic and i have this problem, when i open web appear this message: im loged in the linux but i dont find in which path is located the logs path required so i can start to make the troubleshoo… --- ## [Elastic security fields data not showing in Timeline](https://discuss.elastic.co/t/elastic-security-fields-data-not-showing-in-timeline/264235)
**Author:** [@ajesh](https://discuss.elastic.co/u/ajesh)\ **Replies:** 2\ **Last updated:** [February 24, 2021, 1:40pm UTC](https://discuss.elastic.co/t/elastic-security-fields-data-not-showing-in-timeline/264235 "2021-02-24T13:40:55Z")
Hi Team, We are not able to see proper data in timeline of elastic security module. issue 1: Summary not showing the correct data of detection rule Issue 2: Some field values are not showing in the timeline window… --- ## [Difference between snowball stemmer and regular stemmer](https://discuss.elastic.co/t/difference-between-snowball-stemmer-and-regular-stemmer/265346)
**Author:** [@tomsquest](https://discuss.elastic.co/u/tomsquest)\ **Replies:** 0\ **Last updated:** [February 24, 2021, 1:35pm UTC](https://discuss.elastic.co/t/difference-between-snowball-stemmer-and-regular-stemmer/265346 "2021-02-24T13:35:28Z")
Hi, Elasticsearch (and Lucene ?) has two stemmer token filters: the snowball one and the regular one. It seems in my tests that the regular stemmer is under the hood the snowball stemmer. It this really the case ? Fo… --- ## [7.11 APIs who don't need a body now return an error when provided with one](https://discuss.elastic.co/t/7-11-apis-who-dont-need-a-body-now-return-an-error-when-provided-with-one/265324)
**Author:** [@Malec](https://discuss.elastic.co/u/Malec)\ **Replies:** 2\ **Last updated:** [February 24, 2021, 1:34pm UTC](https://discuss.elastic.co/t/7-11-apis-who-dont-need-a-body-now-return-an-error-when-provided-with-one/265324 "2021-02-24T13:34:57Z")
Hi, I have been upgrading one of my clusters to 7.11.1 and much to my surprise there is a behavior change that I haven't been able to find in the breaking changes or in the "what's new" page for this release. GET \_cat/… --- ## [Kibana read role access](https://discuss.elastic.co/t/kibana-read-role-access/265337)
**Author:** [@Jawed1](https://discuss.elastic.co/u/Jawed1)\ **Replies:** 1\ **Last updated:** [February 24, 2021, 1:33pm UTC](https://discuss.elastic.co/t/kibana-read-role-access/265337 "2021-02-24T13:33:56Z")
Hello folks, I have setup EFK in aks but I am getting issue during set role in kibana dashboard. I have set cluster and index as a read permission but when I logon I can able to create dashboard, index pattern as same … --- ## [Logstash doesn't parse logs if i don't define start\_position](https://discuss.elastic.co/t/logstash-doesnt-parse-logs-if-i-dont-define-start-position/265329)
**Author:** [@rknd](https://discuss.elastic.co/u/rknd)\ **Replies:** 2\ **Last updated:** [February 24, 2021, 1:22pm UTC](https://discuss.elastic.co/t/logstash-doesnt-parse-logs-if-i-dont-define-start-position/265329 "2021-02-24T13:22:06Z")
Below is my code. When I try to run this pipeline. Pipeline is starting but not parsing the logs. I have deleted .sincedb files at (data/plugins/inputs/file). input { file { path =\> ".../directory/\*.log" … [Previous page](https://discuss.elastic.co/latest.md?page=1817) [Next page](https://discuss.elastic.co/latest.md?page=1819)