# Latest **URL:** https://discuss.elastic.co/latest.md?page=1840 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1841 --- ## [Logstash aggregate syslog entries](https://discuss.elastic.co/t/logstash-aggregate-syslog-entries/263783)
**Author:** [@Pablo\_Marques](https://discuss.elastic.co/u/Pablo_Marques)\ **Replies:** 12\ **Last updated:** [February 12, 2021, 8:08pm UTC](https://discuss.elastic.co/t/logstash-aggregate-syslog-entries/263783 "2021-02-12T20:08:25Z")
Hello I am getting syslogs from Clearpass servers and using logstash to ingest them into elasticsearch. Some of these messages are received on multiple syslog packets, but they are really the same (big) message. I am … --- ## [MalformedCSVError: Illegal quoting in line 1](https://discuss.elastic.co/t/malformedcsverror-illegal-quoting-in-line-1/264048)
**Author:** [@checknew](https://discuss.elastic.co/u/checknew)\ **Replies:** 5\ **Last updated:** [February 12, 2021, 8:07pm UTC](https://discuss.elastic.co/t/malformedcsverror-illegal-quoting-in-line-1/264048 "2021-02-12T20:07:27Z")
Hi all, I am seeing WARNING messages when csv is pushed to logstash, I want to eliminate the WARNING messages, any help appreciated: Sample csv: 20185656,2021-02-01 17:52:47,2021-02-01 18:23:15,"Hi Test2, this is ch… --- ## [Filebeat warn issue depend to the pipeline (Index not found in kibana)](https://discuss.elastic.co/t/filebeat-warn-issue-depend-to-the-pipeline-index-not-found-in-kibana/264172)
**Author:** [@marouane](https://discuss.elastic.co/u/marouane)\ **Replies:** 0\ **Last updated:** [February 12, 2021, 6:41pm UTC](https://discuss.elastic.co/t/filebeat-warn-issue-depend-to-the-pipeline-index-not-found-in-kibana/264172 "2021-02-12T18:41:24Z")
Hello, Trying to start filebeat service I'm getting this war that prevent to get the index showing in kibana. 2021-02-04T15:50:40.400+0100 WARN \[elasticsearch\] elasticsearch/client.go:407 Cannot index event publishe… --- ## [Search not returning the intended results](https://discuss.elastic.co/t/search-not-returning-the-intended-results/264169)
**Author:** [@RicPeres](https://discuss.elastic.co/u/RicPeres)\ **Replies:** 0\ **Last updated:** [February 12, 2021, 6:35pm UTC](https://discuss.elastic.co/t/search-not-returning-the-intended-results/264169 "2021-02-12T18:35:09Z")
Hello all, Wondering if anyone can help me, I'm having problems in a search performed on elastic, the search itself is very simple however for some specific words, although, they exist in the intended doc, the hit is no… --- ## [Configure filebeat to ship elasticsearch logs to monitoring cluster in kubernetes](https://discuss.elastic.co/t/configure-filebeat-to-ship-elasticsearch-logs-to-monitoring-cluster-in-kubernetes/264161)
**Author:** [@itsron](https://discuss.elastic.co/u/itsron)\ **Replies:** 0\ **Last updated:** [February 12, 2021, 5:54pm UTC](https://discuss.elastic.co/t/configure-filebeat-to-ship-elasticsearch-logs-to-monitoring-cluster-in-kubernetes/264161 "2021-02-12T17:54:04Z")
I've 2 clusters (7.10) running on Kubernetes - 1 prod and 1 monitoring. I've successfully set up metricbeat to ship elasticsearch metrics to my monitoring cluster. Now I want to ship elasticsearch logs using filebeat to … --- ## [How do I find which event is generating this error](https://discuss.elastic.co/t/how-do-i-find-which-event-is-generating-this-error/264166)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 0\ **Last updated:** [February 12, 2021, 6:07pm UTC](https://discuss.elastic.co/t/how-do-i-find-which-event-is-generating-this-error/264166 "2021-02-12T18:07:29Z")
I have thousands of event coming from metricbeat to logstash. then I do some parsing. but every on/off I getting following errors. is there a easy way to find out which event is it? An exceptionCaught() event was fire… --- ## [Query string cross\_fields synonyms](https://discuss.elastic.co/t/query-string-cross-fields-synonyms/264059)
**Author:** [@wboult](https://discuss.elastic.co/u/wboult)\ **Replies:** 0\ **Last updated:** [February 11, 2021, 10:24pm UTC](https://discuss.elastic.co/t/query-string-cross-fields-synonyms/264059 "2021-02-11T22:24:06Z")
I am using the query string cross\_fields query type to provide a simple search UI that queries many different fields as though they are one big field. I want to make it possible to have different analyzers for some of t… --- ## [Many Elasticsearch threads in WAITING parking state](https://discuss.elastic.co/t/many-elasticsearch-threads-in-waiting-parking-state/264154)
**Author:** [@shreedhan](https://discuss.elastic.co/u/shreedhan)\ **Replies:** 1\ **Last updated:** [February 12, 2021, 5:23pm UTC](https://discuss.elastic.co/t/many-elasticsearch-threads-in-waiting-parking-state/264154 "2021-02-12T17:23:48Z")
Hi, We are running a ES cluster on 6.8 and we are still using TCP client. I know it's deprecated and move to REST client but we have not got around to it yet. In addition, we have a service which uses Elastic4s library… --- ## [Azure Marketplace - Elasticsearch managed service failing](https://discuss.elastic.co/t/azure-marketplace-elasticsearch-managed-service-failing/264143)
**Author:** [@Campbell](https://discuss.elastic.co/u/Campbell)\ **Replies:** 1\ **Last updated:** [February 12, 2021, 5:03pm UTC](https://discuss.elastic.co/t/azure-marketplace-elasticsearch-managed-service-failing/264143 "2021-02-12T17:03:32Z")
All, I'm trying to subscribe to the Elasticsearch Managed Service from the Azure Marketplace and I'm hitting some errors. It seems that the options available during subscription are limited (plan, resource group etc.),… --- ## [Probleme de synchronisation entre logstash et kibana](https://discuss.elastic.co/t/probleme-de-synchronisation-entre-logstash-et-kibana/264107)
**Author:** [@hugoboubou](https://discuss.elastic.co/u/hugoboubou)\ **Replies:** 10\ **Last updated:** [February 12, 2021, 4:39pm UTC](https://discuss.elastic.co/t/probleme-de-synchronisation-entre-logstash-et-kibana/264107 "2021-02-12T16:39:07Z")
Bonjour à tous, Je souhaite analyser différents types de logs. Qui proviennent de plusieurs agents beats. Actuellement j'ai deux patterns grok pour les traiter. Les voici : match =\> { "message" =\> "(?\%{YEAR… --- ## [How to convert two inserted values in kibana in a single Geopoint](https://discuss.elastic.co/t/how-to-convert-two-inserted-values-in-kibana-in-a-single-geopoint/264153)
**Author:** [@Mheni](https://discuss.elastic.co/u/Mheni)\ **Replies:** 3\ **Last updated:** [February 12, 2021, 4:30pm UTC](https://discuss.elastic.co/t/how-to-convert-two-inserted-values-in-kibana-in-a-single-geopoint/264153 "2021-02-12T16:30:33Z")
I Insert 2 values(Lat and Long) in Kibana and I want to convert them in a single Geopoint . The Aim is to present them using a heatMap. --- ## [ElasticsearchDeprecationWarning: Need some clarification to make corrections](https://discuss.elastic.co/t/elasticsearchdeprecationwarning-need-some-clarification-to-make-corrections/264136)
**Author:** [@varshap](https://discuss.elastic.co/u/varshap)\ **Replies:** 3\ **Last updated:** [February 12, 2021, 4:11pm UTC](https://discuss.elastic.co/t/elasticsearchdeprecationwarning-need-some-clarification-to-make-corrections/264136 "2021-02-12T16:11:33Z")
Hi Guys, I am new to ES, I recently integrated ES in my Django project by following. https://django-elasticsearch-dsl.readthedocs.io/en/latest/quickstart.html Versions used: django-elasticsearch-dsl==7.1.4 django-el… --- ## [Kibana 7.4.0 all indices vanish at the end of each day](https://discuss.elastic.co/t/kibana-7-4-0-all-indices-vanish-at-the-end-of-each-day/264148)
**Author:** [@Josh\_Creek](https://discuss.elastic.co/u/Josh_Creek)\ **Replies:** 7\ **Last updated:** [February 12, 2021, 4:08pm UTC](https://discuss.elastic.co/t/kibana-7-4-0-all-indices-vanish-at-the-end-of-each-day/264148 "2021-02-12T16:08:14Z")
I have been using ELK in Docker for several years now, with zero issues. I am currently running a couple of entirely separate Dockerized ELK stacks, on entirely different servers running different environments, and am ex… --- ## [Logstash JDBC file permission errors, cannot send data to elastic](https://discuss.elastic.co/t/logstash-jdbc-file-permission-errors-cannot-send-data-to-elastic/263810)
**Author:** [@wlbsxnlp22](https://discuss.elastic.co/u/wlbsxnlp22)\ **Replies:** 5\ **Last updated:** [February 12, 2021, 3:43pm UTC](https://discuss.elastic.co/t/logstash-jdbc-file-permission-errors-cannot-send-data-to-elastic/263810 "2021-02-12T15:43:28Z")
Hi, I keep getting errors when running JDBC, it seems to complain about being unable to read to files on disc but I have checked the permissions and there is write access. The problem seems to become worse when having a… --- ## [XML load with Logstash into Elasticsearch](https://discuss.elastic.co/t/xml-load-with-logstash-into-elasticsearch/263767)
**Author:** [@hiba](https://discuss.elastic.co/u/hiba)\ **Replies:** 4\ **Last updated:** [February 12, 2021, 3:28pm UTC](https://discuss.elastic.co/t/xml-load-with-logstash-into-elasticsearch/263767 "2021-02-12T15:28:06Z")
Hi , I have tried to create a load process with Logstash from an XML file to Elasticsearch. i use ELK 7.9.0 on windows. this is my config file : input { file { path =\> "C:/Talend/workspace/data/giata/geography/geog… --- ## [Persistent Queueing Performance](https://discuss.elastic.co/t/persistent-queueing-performance/264149)
**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 0\ **Last updated:** [February 12, 2021, 3:15pm UTC](https://discuss.elastic.co/t/persistent-queueing-performance/264149 "2021-02-12T15:15:39Z")
Hi, As I understand it, persistent queue operations are single threaded. And that tallies with what I've seen during performance tests. Can I ask, are there plans to make persistent queues multi-threaded? If so, how far… --- ## [Plugin configuration](https://discuss.elastic.co/t/plugin-configuration/264079)
**Author:** [@rwxr\_xr\_x](https://discuss.elastic.co/u/rwxr_xr_x)\ **Replies:** 2\ **Last updated:** [February 12, 2021, 3:14pm UTC](https://discuss.elastic.co/t/plugin-configuration/264079 "2021-02-12T15:14:05Z")
Hello, I'm converting a plugin built for ES 2.1.1 to ES 7.10. I'm running into a strange issue. I need to pass: plugin-name.enable: true If I add it to elasticsearch.yml file, the configuration is available in my plu… --- ## [Use Tool tip with Grid Aggregations on Map](https://discuss.elastic.co/t/use-tool-tip-with-grid-aggregations-on-map/264142)
**Author:** [@Baptiste\_Orsoni](https://discuss.elastic.co/u/Baptiste_Orsoni)\ **Replies:** 1\ **Last updated:** [February 12, 2021, 3:03pm UTC](https://discuss.elastic.co/t/use-tool-tip-with-grid-aggregations-on-map/264142 "2021-02-12T15:03:52Z")
Hello Everyone, I'm using maps in Kibana, precisely the Grid Aggregations because I'll like to see my hits with circle markers whose size depends of the count. But I'd also like to see some informations on the tooltip o… --- ## [Elasticsearch throwing some overhead warning in logs](https://discuss.elastic.co/t/elasticsearch-throwing-some-overhead-warning-in-logs/264137)
**Author:** [@Ganesh2303](https://discuss.elastic.co/u/Ganesh2303)\ **Replies:** 3\ **Last updated:** [February 12, 2021, 3:01pm UTC](https://discuss.elastic.co/t/elasticsearch-throwing-some-overhead-warning-in-logs/264137 "2021-02-12T15:01:57Z")
HI Team, we are getting below response in elasticsearch log , anyone can help me on this why im getting this kind of error on it, \[2021-02-12T07:29:17,371\]\[WARN \]\[o.e.m.j.JvmGcMonitorService\] \[datanode1\] \[gc\]\[242917\] … --- ## [How to give access to Security Cases of one Kibana Space to the users in another Kibana Space?](https://discuss.elastic.co/t/how-to-give-access-to-security-cases-of-one-kibana-space-to-the-users-in-another-kibana-space/264032)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 1\ **Last updated:** [February 12, 2021, 2:38pm UTC](https://discuss.elastic.co/t/how-to-give-access-to-security-cases-of-one-kibana-space-to-the-users-in-another-kibana-space/264032 "2021-02-12T14:38:07Z")
Hello, Is it possible to give access to Security Cases of one Kibana Space to the users in another Kibana Space? For example we have an engineer team Kibana where the detections are running, but our security officers a… --- ## [Searchable snapshots in ECK - Enterprise license only?](https://discuss.elastic.co/t/searchable-snapshots-in-eck-enterprise-license-only/264138)
**Author:** [@sc75651](https://discuss.elastic.co/u/sc75651)\ **Replies:** 1\ **Last updated:** [February 12, 2021, 2:12pm UTC](https://discuss.elastic.co/t/searchable-snapshots-in-eck-enterprise-license-only/264138 "2021-02-12T14:12:11Z")
Is Searchable snapshots in ECK - Enterprise license only? --- ## [How to use date\_histogram to aggregate documents that span multiple period based on two date fields](https://discuss.elastic.co/t/how-to-use-date-histogram-to-aggregate-documents-that-span-multiple-period-based-on-two-date-fields/264135)
**Author:** [@Lekishor](https://discuss.elastic.co/u/Lekishor)\ **Replies:** 0\ **Last updated:** [February 12, 2021, 1:42pm UTC](https://discuss.elastic.co/t/how-to-use-date-histogram-to-aggregate-documents-that-span-multiple-period-based-on-two-date-fields/264135 "2021-02-12T13:42:39Z")
Hi, So I have documents defined based on the following mapping: documents: "ID": { "type": "integer" }, "Start": { "type": "date", "format": "strict\_date\_optional\_t… --- ## [Unable to run logstash 7.10 on custom java path](https://discuss.elastic.co/t/unable-to-run-logstash-7-10-on-custom-java-path/264130)
**Author:** [@Suddhasil\_Sarkar](https://discuss.elastic.co/u/Suddhasil_Sarkar)\ **Replies:** 0\ **Last updated:** [February 12, 2021, 12:59pm UTC](https://discuss.elastic.co/t/unable-to-run-logstash-7-10-on-custom-java-path/264130 "2021-02-12T12:59:46Z")
Hi ELK Gurus, Need help- I was trying to run my logstash with customized JVM which is not happening. I set JAVA\_HOME pointing to my custom path "/app/platform/java/" but logstash is running with default java 11 - "/usr/… --- ## ["\_shard\_stores" returns empty](https://discuss.elastic.co/t/shard-stores-returns-empty/263966)
**Author:** [@gruselglatz](https://discuss.elastic.co/u/gruselglatz)\ **Replies:** 3\ **Last updated:** [February 12, 2021, 12:25pm UTC](https://discuss.elastic.co/t/shard-stores-returns-empty/263966 "2021-02-12T12:25:36Z")
Hey, when I try to GET /\_shard\_stores i always get an empty response. I tried it with the elastic user or every other user. My cluster is Green and i have some 1000 shards allocated. I wanted to know where a shard live… --- ## [After two nodes fail, Master cannot be assigned to the third one](https://discuss.elastic.co/t/after-two-nodes-fail-master-cannot-be-assigned-to-the-third-one/264030)
**Author:** [@Mateusz\_Koper](https://discuss.elastic.co/u/Mateusz_Koper)\ **Replies:** 3\ **Last updated:** [February 12, 2021, 12:20pm UTC](https://discuss.elastic.co/t/after-two-nodes-fail-master-cannot-be-assigned-to-the-third-one/264030 "2021-02-12T12:20:16Z")
Hi, In our organization, we've set up 3 nodes, two of them are storing the data, and the last one is a kind of 'Tiebreaker'. When one of the node fails, Master is easily switched to the other machine, and everything se… --- ## [Use 2 variable in a math expression](https://discuss.elastic.co/t/use-2-variable-in-a-math-expression/264041)
**Author:** [@Mike\_Clarke](https://discuss.elastic.co/u/Mike_Clarke)\ **Replies:** 4\ **Last updated:** [February 12, 2021, 12:17pm UTC](https://discuss.elastic.co/t/use-2-variable-in-a-math-expression/264041 "2021-02-12T12:17:09Z")
I am running 7.9.1 and am trying to perform math with 2 variables like below. Is this possible? filters | timefilter field="@timestamp" from="now-1d" to="now" | var\_set name="completed" value={escount index="index\_1" q… --- ## [Elasticsearch script breaking change query Accessing missing document value](https://discuss.elastic.co/t/elasticsearch-script-breaking-change-query-accessing-missing-document-value/264096)
**Author:** [@sardar\_nale](https://discuss.elastic.co/u/sardar_nale)\ **Replies:** 1\ **Last updated:** [February 12, 2021, 11:43am UTC](https://discuss.elastic.co/t/elasticsearch-script-breaking-change-query-accessing-missing-document-value/264096 "2021-02-12T11:43:34Z")
Hi all, We are using elastic version 7.10.2 and it is migrated from 6.8.6. I want to compare two fields from a same document using Scripting .Below query was working in elastic version 6.8.6 now after upgrade to 7.10 i… --- ## [User\_bundle from internal Artifactory problem](https://discuss.elastic.co/t/user-bundle-from-internal-artifactory-problem/263087)
**Author:** [@Zerobot](https://discuss.elastic.co/u/Zerobot)\ **Replies:** 1\ **Last updated:** [February 3, 2021, 1:47pm UTC](https://discuss.elastic.co/t/user-bundle-from-internal-artifactory-problem/263087 "2021-02-03T13:47:42Z")
Hi! I'm trying to add a custom cacerts.zip User\_Bundle to my ELK deployment in our ECE. Elasticsearch is bootlooping and the reason is an untrusted certificate. "elasticsearch": { "user\_bundles": \[ { … --- ## [Optimizing segment merging](https://discuss.elastic.co/t/optimizing-segment-merging/264111)
**Author:** [@buncieboy](https://discuss.elastic.co/u/buncieboy)\ **Replies:** 0\ **Last updated:** [February 12, 2021, 11:03am UTC](https://discuss.elastic.co/t/optimizing-segment-merging/264111 "2021-02-12T11:03:38Z")
When we index our data from our database (using the HibernateSearch-ElasticSearch implementation) we found we were getting a large amount of segments (20-30). On our current data we found that force-merging the data (2 i… --- ## [Split an array of arrays](https://discuss.elastic.co/t/split-an-array-of-arrays/263724)
**Author:** [@opellulo](https://discuss.elastic.co/u/opellulo)\ **Replies:** 4\ **Last updated:** [February 12, 2021, 10:52am UTC](https://discuss.elastic.co/t/split-an-array-of-arrays/263724 "2021-02-12T10:52:00Z")
Hi all, I'm currently working on parsing a really nasty xml stream: events come in single file form, can get up to 5000 lines and, most important, includes arrays of arrays which crucially hold the data I need to parse … [Previous page](https://discuss.elastic.co/latest.md?page=1839) [Next page](https://discuss.elastic.co/latest.md?page=1841)