# Latest **URL:** https://discuss.elastic.co/latest.md?page=1828 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1829 --- ## [Snapshot Recovery fails due to connection issues with GCS repository](https://discuss.elastic.co/t/snapshot-recovery-fails-due-to-connection-issues-with-gcs-repository/264756)
**Author:** [@proton](https://discuss.elastic.co/u/proton)\ **Replies:** 1\ **Last updated:** [February 19, 2021, 8:01pm UTC](https://discuss.elastic.co/t/snapshot-recovery-fails-due-to-connection-issues-with-gcs-repository/264756 "2021-02-19T20:01:11Z")
Hello, I've been running into connection issues while trying to restore a snapshot from GCS repository. We have multiple clusters and other ES clusters can connect to a GCS bucket within same project on google cloud but… --- ## [Exporting to constant index name with Filebeat](https://discuss.elastic.co/t/exporting-to-constant-index-name-with-filebeat/264906)
**Author:** [@Tim\_Estes](https://discuss.elastic.co/u/Tim_Estes)\ **Replies:** 3\ **Last updated:** [February 19, 2021, 7:30pm UTC](https://discuss.elastic.co/t/exporting-to-constant-index-name-with-filebeat/264906 "2021-02-19T19:30:55Z")
From the documentation on changing the name of the index that filebeat writes to: But I was wondering if it would be possible to have filebeat write to an index name that doesn't change: output.elasticsearch.index: "… --- ## [Syntax issue with customized query](https://discuss.elastic.co/t/syntax-issue-with-customized-query/264899)
**Author:** [@Shahsha\_21](https://discuss.elastic.co/u/Shahsha_21)\ **Replies:** 0\ **Last updated:** [February 19, 2021, 6:11pm UTC](https://discuss.elastic.co/t/syntax-issue-with-customized-query/264899 "2021-02-19T18:11:08Z")
I am trying to create a Boolean query which takes in user input(stored in a variable) and appends it with an existing string for e.g. User enters: "ABC" AND "CDE" which will be stored in a temporary variable: var input… --- ## [Date Parse Fail](https://discuss.elastic.co/t/date-parse-fail/264483)
**Author:** [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Replies:** 2\ **Last updated:** [February 19, 2021, 6:55pm UTC](https://discuss.elastic.co/t/date-parse-fail/264483 "2021-02-19T18:55:00Z")
Trying to ingest the below event: {"modified": "2019-12-27 16:08:00", "published": "2015-03-08 02:59:00", "access": {"authentication": "none", "complexity": "low", "vector": "network"}, "assigner": "cve@mitre.org", "cap… --- ## [Updating the geoLite2 Database](https://discuss.elastic.co/t/updating-the-geolite2-database/264722)
**Author:** [@Falikou1](https://discuss.elastic.co/u/Falikou1)\ **Replies:** 6\ **Last updated:** [February 19, 2021, 6:42pm UTC](https://discuss.elastic.co/t/updating-the-geolite2-database/264722 "2021-02-19T18:42:30Z")
I have configured the geoLite2 Database in logstash. geoip { default\_database\_type =\> 'City' database =\> '/usr/share/logstash/GeoLite2-City/GeoLite2-City.mmdb' source =\> "src" target =\> "src\_geoip" } Is there … --- ## [Logstash events count and get alert](https://discuss.elastic.co/t/logstash-events-count-and-get-alert/264850)
**Author:** [@bdn](https://discuss.elastic.co/u/bdn)\ **Replies:** 2\ **Last updated:** [February 19, 2021, 6:16pm UTC](https://discuss.elastic.co/t/logstash-events-count-and-get-alert/264850 "2021-02-19T18:16:51Z")
I want to count events in Logstash and get me alert if events hit more than 10 times within 2mins. E.g. I have a log like below. Feb 19 15:22:01 DEVICE-01 Device is online. Feb 19 15:22:01 DEVICE-02 Device is online. F… --- ## [Combine data from multiple rows based on aggregation](https://discuss.elastic.co/t/combine-data-from-multiple-rows-based-on-aggregation/264608)
**Author:** [@hayo](https://discuss.elastic.co/u/hayo)\ **Replies:** 6\ **Last updated:** [February 19, 2021, 6:07pm UTC](https://discuss.elastic.co/t/combine-data-from-multiple-rows-based-on-aggregation/264608 "2021-02-19T18:07:02Z")
I have searched but was not able to find the answer or i just didnt see it! I have data like: BookTitle | Author | Category A | Writer1 | Thriller A | Writer1 | Action B | Writer1 | Science fiction B … --- ## [Unable to index a json string (array of json objects) to elastic search](https://discuss.elastic.co/t/unable-to-index-a-json-string-array-of-json-objects-to-elastic-search/264851)
**Author:** [@schawla](https://discuss.elastic.co/u/schawla)\ **Replies:** 7\ **Last updated:** [February 19, 2021, 5:47pm UTC](https://discuss.elastic.co/t/unable-to-index-a-json-string-array-of-json-objects-to-elastic-search/264851 "2021-02-19T17:47:10Z")
I have an array of objects in the form of a single json string something like "\[{"id": 1, "name":"test"}, {"id": 2, "name":"test2"}\]" I want to be able to bulk index this json string directly to elastic search without … --- ## [Incrementing param value within a script](https://discuss.elastic.co/t/incrementing-param-value-within-a-script/264888)
**Author:** [@Marc\_Pereira](https://discuss.elastic.co/u/Marc_Pereira)\ **Replies:** 2\ **Last updated:** [February 19, 2021, 5:42pm UTC](https://discuss.elastic.co/t/incrementing-param-value-within-a-script/264888 "2021-02-19T17:42:27Z")
This is a simplified version of the problem. "should": \[ { "script\_score": { "query": { "match\_all": {} }, "script": { "source": ""… --- ## [How to map list of values correctly to show them in Grafana?](https://discuss.elastic.co/t/how-to-map-list-of-values-correctly-to-show-them-in-grafana/264895)
**Author:** [@dewell](https://discuss.elastic.co/u/dewell)\ **Replies:** 0\ **Last updated:** [February 19, 2021, 5:34pm UTC](https://discuss.elastic.co/t/how-to-map-list-of-values-correctly-to-show-them-in-grafana/264895 "2021-02-19T17:34:44Z")
Hello, I try to keep it simple. I receive a variable number of float values embedded in a communication protocol via logstash and created a mapping for an elasticsearch index. Via Grafana I connect to the index and I get… --- ## [Filebeat processors not dropping events](https://discuss.elastic.co/t/filebeat-processors-not-dropping-events/264875)
**Author:** [@Rahul\_Dankhara](https://discuss.elastic.co/u/Rahul_Dankhara)\ **Replies:** 2\ **Last updated:** [February 19, 2021, 4:41pm UTC](https://discuss.elastic.co/t/filebeat-processors-not-dropping-events/264875 "2021-02-19T16:41:53Z")
Hi Team, I am using filebeat 7.9.3 to ship events. I do want to drop events that contains any of the below key-value pairs. I am using processors to do the same, but somehow it is not working for me. processors:… --- ## [Nest .Sort() doesnt seem to except a list? Any work arounds?](https://discuss.elastic.co/t/nest-sort-doesnt-seem-to-except-a-list-any-work-arounds/264603)
**Author:** [@Adam\_Whittaker](https://discuss.elastic.co/u/Adam_Whittaker)\ **Replies:** 1\ **Last updated:** [February 19, 2021, 4:15pm UTC](https://discuss.elastic.co/t/nest-sort-doesnt-seem-to-except-a-list-any-work-arounds/264603 "2021-02-19T16:15:46Z")
Hello, I am using ElasticSearch Nest Fluent DSL and cant seem to figure out how to create a list of Sorts that the .Sort() accepts. I have an array of sorts and i want to convert them to work with Nest a bit like you c… --- ## [Beats - Export dashboards to file](https://discuss.elastic.co/t/beats-export-dashboards-to-file/264857)
**Author:** [@siginigin](https://discuss.elastic.co/u/siginigin)\ **Replies:** 3\ **Last updated:** [February 19, 2021, 4:09pm UTC](https://discuss.elastic.co/t/beats-export-dashboards-to-file/264857 "2021-02-19T16:09:12Z")
Hi, I'm working on automation of beats deployment with ansible. I don't want to give all the beats access to neither kibana nor elasticsearch, just logstash. So I decided to grab all the dashboards delivered with beats … --- ## [Vega chart in Kibana 7.9 doesn't change with different date ranges](https://discuss.elastic.co/t/vega-chart-in-kibana-7-9-doesnt-change-with-different-date-ranges/264783)
**Author:** [@ElasticQuestion\_1234](https://discuss.elastic.co/u/ElasticQuestion_1234)\ **Replies:** 1\ **Last updated:** [February 19, 2021, 3:53pm UTC](https://discuss.elastic.co/t/vega-chart-in-kibana-7-9-doesnt-change-with-different-date-ranges/264783 "2021-02-19T15:53:04Z")
I used Vega-lite command to create a time series chart. However, the chart doesn't change no matter which date range I select. It always show the whole set of data. I set "%timefield%": "timestamp", which is the name of … --- ## [Logstash 7.9.1 file input plugin is not able to read json file](https://discuss.elastic.co/t/logstash-7-9-1-file-input-plugin-is-not-able-to-read-json-file/264548)
**Author:** [@sagarpatel](https://discuss.elastic.co/u/sagarpatel)\ **Replies:** 6\ **Last updated:** [February 19, 2021, 3:25pm UTC](https://discuss.elastic.co/t/logstash-7-9-1-file-input-plugin-is-not-able-to-read-json-file/264548 "2021-02-19T15:25:40Z")
I have created sample.conf file for reading json file but it is not showing any output. below is my sample.cong file input { file { path =\> "C:\\Users\\Sagar\\sample.json" start\_position =\> "beginning" codec =\> "js… --- ## [DSL Query, Multiple conditions for must\_not, 'or, and'](https://discuss.elastic.co/t/dsl-query-multiple-conditions-for-must-not-or-and/264876)
**Author:** [@gneves](https://discuss.elastic.co/u/gneves)\ **Replies:** 0\ **Last updated:** [February 19, 2021, 3:31pm UTC](https://discuss.elastic.co/t/dsl-query-multiple-conditions-for-must-not-or-and/264876 "2021-02-19T15:31:25Z")
Hello guys im having some trouble to create multiple conditions. Ill give some pseudo examples in order to show my idea. "must\_not": \[ { "match": { … --- ## [Elastic Endpoint shipping application and service logs](https://discuss.elastic.co/t/elastic-endpoint-shipping-application-and-service-logs/264693)
**Author:** [@The1WhoPrtNocks](https://discuss.elastic.co/u/The1WhoPrtNocks)\ **Replies:** 5\ **Last updated:** [February 19, 2021, 3:32pm UTC](https://discuss.elastic.co/t/elastic-endpoint-shipping-application-and-service-logs/264693 "2021-02-19T15:32:40Z")
Hi All, Currently I can not see a way to configure the endpoint agent to collect logs from sub categories of "Applications and Services". Is this something I am missing or a feature that will come in the future ? Thank… --- ## [Exchange logs](https://discuss.elastic.co/t/exchange-logs/261413)
**Author:** [@baddack](https://discuss.elastic.co/u/baddack)\ **Replies:** 4\ **Last updated:** [February 19, 2021, 3:29pm UTC](https://discuss.elastic.co/t/exchange-logs/261413 "2021-02-19T15:29:06Z")
Hello everyone ! I create this new topic today beacause I have an issue with message tracking in Exchange logs. Indeed I want to make a top10 senders for example but when I am looking to Exchange's logs there are many e… --- ## [Turn on and off elastic nodes in non business hours](https://discuss.elastic.co/t/turn-on-and-off-elastic-nodes-in-non-business-hours/264703)
**Author:** [@Todor\_Popov](https://discuss.elastic.co/u/Todor_Popov)\ **Replies:** 3\ **Last updated:** [February 19, 2021, 3:27pm UTC](https://discuss.elastic.co/t/turn-on-and-off-elastic-nodes-in-non-business-hours/264703 "2021-02-19T15:27:17Z")
Hi, is it possible to have the elastic cloud stopped for non business hours? Completely to avoid charges? I guess alternative to that may be to resize it to smaller node size when there is no traffic? Thanx. --- ## [Crawler is crashing](https://discuss.elastic.co/t/crawler-is-crashing/264629)
**Author:** [@hilt86](https://discuss.elastic.co/u/hilt86)\ **Replies:** 3\ **Last updated:** [February 18, 2021, 10:54pm UTC](https://discuss.elastic.co/t/crawler-is-crashing/264629 "2021-02-18T22:54:02Z")
I'm getting a "Unexpected error while running the crawl, check system logs for details" in the crawler logs when trying to crawl a list of 1000 sites. Does anyone know which logs I should check as this is the crawler log… --- ## [Configure filebeat nginx module with ansible role](https://discuss.elastic.co/t/configure-filebeat-nginx-module-with-ansible-role/264661)
**Author:** [@elster](https://discuss.elastic.co/u/elster)\ **Replies:** 3\ **Last updated:** [February 19, 2021, 2:21pm UTC](https://discuss.elastic.co/t/configure-filebeat-nginx-module-with-ansible-role/264661 "2021-02-19T14:21:48Z")
Dear experts, Can you please lead me into the right direction how I have to customize the GitHub - elastic/ansible-beats: Ansible Beats Role role so that the nginx module is enabled and working? Thanks and br, Elmar --- ## [Logstash grok multiple pattern , multi-line](https://discuss.elastic.co/t/logstash-grok-multiple-pattern-multi-line/264860)
**Author:** [@Daniel\_Jankech](https://discuss.elastic.co/u/Daniel_Jankech)\ **Replies:** 1\ **Last updated:** [February 19, 2021, 1:30pm UTC](https://discuss.elastic.co/t/logstash-grok-multiple-pattern-multi-line/264860 "2021-02-19T13:30:01Z")
Hello everyone , Im using grok to parse log file consisting of multiple pattern lines , these multiple lines represent one task being done in the system. My question is how should I do this if I need to add fields to the… --- ## [Monitor file download over 10mb](https://discuss.elastic.co/t/monitor-file-download-over-10mb/264766)
**Author:** [@stravze](https://discuss.elastic.co/u/stravze)\ **Replies:** 4\ **Last updated:** [February 19, 2021, 1:14pm UTC](https://discuss.elastic.co/t/monitor-file-download-over-10mb/264766 "2021-02-19T13:14:56Z")
i'm totally new to Elastic stack and the beats family. I need to alert on either just files downloaded of files download over 10mb i've installed filebeat and auditbeat and still can't work how you do this Any advice … --- ## [Jdbc connection to MS-SQL server with windows credentials](https://discuss.elastic.co/t/jdbc-connection-to-ms-sql-server-with-windows-credentials/264542)
**Author:** [@ravnen.flyver](https://discuss.elastic.co/u/ravnen.flyver)\ **Replies:** 1\ **Last updated:** [February 19, 2021, 1:10pm UTC](https://discuss.elastic.co/t/jdbc-connection-to-ms-sql-server-with-windows-credentials/264542 "2021-02-19T13:10:29Z")
I am sitting on a WindownServer(2019) where I connect to a Windown sql 2016 server. On my WindownServer I can connect to the SQL server through MS SQL Management Studio, so firewall and all that is ok. And my Windown AD… --- ## [Elasticsearch 7.3.1 - Help on three nodes cluster - Master not discovered yet](https://discuss.elastic.co/t/elasticsearch-7-3-1-help-on-three-nodes-cluster-master-not-discovered-yet/264706)
**Author:** [@dcenaculo](https://discuss.elastic.co/u/dcenaculo)\ **Replies:** 3\ **Last updated:** [February 19, 2021, 12:57pm UTC](https://discuss.elastic.co/t/elasticsearch-7-3-1-help-on-three-nodes-cluster-master-not-discovered-yet/264706 "2021-02-19T12:57:55Z")
Hi, I had Elasticsearch working well on the PORSCHE node. Then I tried to add two more nodes, OPEL and MORRIS. All on the same subnet. PORSCHE: 10.146.114.66 MORRIS: 10.146.114.89 OPEL: 10.146.114.88 This … --- ## [Xpack without SSL/Certificates](https://discuss.elastic.co/t/xpack-without-ssl-certificates/264773)
**Author:** [@madduck](https://discuss.elastic.co/u/madduck)\ **Replies:** 4\ **Last updated:** [February 19, 2021, 12:51pm UTC](https://discuss.elastic.co/t/xpack-without-ssl-certificates/264773 "2021-02-19T12:51:48Z")
Hi gang, with upgrading our environments to 7.11 I tackled an old issue of mine: Trying to get our dev. cluster running with the xpack features active but without the need for those pesky certificates all the time. The… --- ## [Filebeat not sending logs to logstash (port 5044 )](https://discuss.elastic.co/t/filebeat-not-sending-logs-to-logstash-port-5044/264514)
**Author:** [@syrine\_chelly](https://discuss.elastic.co/u/syrine_chelly)\ **Replies:** 17\ **Last updated:** [February 19, 2021, 12:50pm UTC](https://discuss.elastic.co/t/filebeat-not-sending-logs-to-logstash-port-5044/264514 "2021-02-19T12:50:58Z")
My filebeat is reading the log file but it 's not sending anything to logstash Here are my filebeats.yml: filebeat.inputs: # Each - is an input. Most options can be set at the input level, so # you can use different … --- ## [Kubernetes - Number of deployments not matching reality](https://discuss.elastic.co/t/kubernetes-number-of-deployments-not-matching-reality/264665)
**Author:** [@dantonag](https://discuss.elastic.co/u/dantonag)\ **Replies:** 1\ **Last updated:** [February 19, 2021, 12:38pm UTC](https://discuss.elastic.co/t/kubernetes-number-of-deployments-not-matching-reality/264665 "2021-02-19T12:38:02Z")
Hello, one of our "clients" has installed metricbeat 7.6.2 on an Openshift cluster, but he's lamenting that the number of deployments he sees through one of the default metricbeat dashboards (the view name is "Deploymen… --- ## [D365 cloud based solution](https://discuss.elastic.co/t/d365-cloud-based-solution/264664)
**Author:** [@Raj\_Kumar](https://discuss.elastic.co/u/Raj_Kumar)\ **Replies:** 1\ **Last updated:** [February 19, 2021, 12:02pm UTC](https://discuss.elastic.co/t/d365-cloud-based-solution/264664 "2021-02-19T12:02:43Z")
Hi There, Is it possible to extract the Dynamics 365 logs via filebeat? like Office 365 Hello, we're looking to better secure our Dynamics 365 instance, and we're wondering what were good options for logging admin e… --- ## [Possible to have KQL in Elastic?](https://discuss.elastic.co/t/possible-to-have-kql-in-elastic/264842)
**Author:** [@Sandra\_Schlichting](https://discuss.elastic.co/u/Sandra_Schlichting)\ **Replies:** 1\ **Last updated:** [February 19, 2021, 11:21am UTC](https://discuss.elastic.co/t/possible-to-have-kql-in-elastic/264842 "2021-02-19T11:21:05Z")
Dear all =) Is it possible to "execute" KQL in Elasticsearch? If not, does there exist a script/translator, so KQL can be converted to Lucene? Hugs, Sandra =) [Previous page](https://discuss.elastic.co/latest.md?page=1827) [Next page](https://discuss.elastic.co/latest.md?page=1829)