# Latest **URL:** https://discuss.elastic.co/latest.md?page=1841 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1842 --- ## [Cluster status red and unassigned shards](https://discuss.elastic.co/t/cluster-status-red-and-unassigned-shards/264081)
**Author:** [@testsemd\_email](https://discuss.elastic.co/u/testsemd_email)\ **Replies:** 2\ **Last updated:** [February 12, 2021, 10:49am UTC](https://discuss.elastic.co/t/cluster-status-red-and-unassigned-shards/264081 "2021-02-12T10:49:59Z")
I updated the elastic cluster to 7.10.1. Then elasticsearch service was restarted. Then cluster status became "Red". There are two unassigned shards (same index primary and replica shards). I want to know how to make cl… --- ## [Cannot be changed from type \[float\] to \[long\] issue appears. But, we have dynamic data and it's hard to put mappings on them](https://discuss.elastic.co/t/cannot-be-changed-from-type-float-to-long-issue-appears-but-we-have-dynamic-data-and-its-hard-to-put-mappings-on-them/264105)
**Author:** [@Kruthika\_C\_S](https://discuss.elastic.co/u/Kruthika_C_S)\ **Replies:** 0\ **Last updated:** [February 12, 2021, 10:35am UTC](https://discuss.elastic.co/t/cannot-be-changed-from-type-float-to-long-issue-appears-but-we-have-dynamic-data-and-its-hard-to-put-mappings-on-them/264105 "2021-02-12T10:35:10Z")
I have a lot of unstructured data in millions. Some of them have {...data, value: \} and some have {...data, value: \} in the data. All I'm trying to say is, the data type of value can differ. In addition t… --- ## [Multiple filebeats to a server ELK in docker](https://discuss.elastic.co/t/multiple-filebeats-to-a-server-elk-in-docker/263836)
**Author:** [@Martin\_perez](https://discuss.elastic.co/u/Martin_perez)\ **Replies:** 13\ **Last updated:** [February 12, 2021, 10:17am UTC](https://discuss.elastic.co/t/multiple-filebeats-to-a-server-elk-in-docker/263836 "2021-02-12T10:17:26Z")
I'm new to elk and i want to and I want to connect my elk stack with filebeat in docker, which I already have created in docker and it is creating the records for me, because I can see them in kibana. Now what I want is… --- ## [Logstash input via website user file upload](https://discuss.elastic.co/t/logstash-input-via-website-user-file-upload/263994)
**Author:** [@Daniel\_Jankech](https://discuss.elastic.co/u/Daniel_Jankech)\ **Replies:** 2\ **Last updated:** [February 12, 2021, 10:16am UTC](https://discuss.elastic.co/t/logstash-input-via-website-user-file-upload/263994 "2021-02-12T10:16:54Z")
Hi, Im very new to the whole ELK stack and Im still learning. For my current project Im required to process some MongoDB log files uploaded by user through our website and I have trouble figuring out how I should configu… --- ## [Need help in understanding Elasticsearch configuration with TLS/SSL](https://discuss.elastic.co/t/need-help-in-understanding-elasticsearch-configuration-with-tls-ssl/263998)
**Author:** [@kasim123](https://discuss.elastic.co/u/kasim123)\ **Replies:** 5\ **Last updated:** [February 12, 2021, 9:58am UTC](https://discuss.elastic.co/t/need-help-in-understanding-elasticsearch-configuration-with-tls-ssl/263998 "2021-02-12T09:58:51Z")
Hi Team, We have a EFK cluster (7.4.x) which was setup more than a year ago with x-pack enabled. At that I followed official document and created self-signed certificates using elastisearch-certutil and that was workin… --- ## [Vega-Lite bar chart doesn't show anything for filters aggregation](https://discuss.elastic.co/t/vega-lite-bar-chart-doesnt-show-anything-for-filters-aggregation/263882)
**Author:** [@grra](https://discuss.elastic.co/u/grra)\ **Replies:** 1\ **Last updated:** [February 12, 2021, 9:38am UTC](https://discuss.elastic.co/t/vega-lite-bar-chart-doesnt-show-anything-for-filters-aggregation/263882 "2021-02-12T09:38:13Z")
Hello, In my Vega-Lit spec I do a query which returns the following response: "aggregations" : { "my-groups" : { "buckets" : { "group-1" : { "doc\_count" : 16958 }, "group-2… --- ## [Kibana bar chart doesn't work for filters aggregation](https://discuss.elastic.co/t/kibana-bar-chart-doesnt-work-for-filters-aggregation/263633)
**Author:** [@elster](https://discuss.elastic.co/u/elster)\ **Replies:** 10\ **Last updated:** [February 12, 2021, 9:31am UTC](https://discuss.elastic.co/t/kibana-bar-chart-doesnt-work-for-filters-aggregation/263633 "2021-02-12T09:31:00Z")
Dear experts, I created several Vega (lite) barcharts using this code: { $schema: https://vega.github.io/schema/vega-lite/v2.json title: Login Method Distribution data: { url: { } format: {property: "aggr… --- ## [Parsing error on ilm](https://discuss.elastic.co/t/parsing-error-on-ilm/264099)
**Author:** [@jamesp220291](https://discuss.elastic.co/u/jamesp220291)\ **Replies:** 0\ **Last updated:** [February 12, 2021, 9:06am UTC](https://discuss.elastic.co/t/parsing-error-on-ilm/264099 "2021-02-12T09:06:16Z")
hey had this iLM working now for months. all of a sudden getting this error - mapper\_parsing\_exception: Failed to parse mapping \[\_doc\]: unknown parameter \[ignore\_above\] on mapper \[mem\] of type \[long\] anyone know wh… --- ## [Get elasticsearch hostname in watcher](https://discuss.elastic.co/t/get-elasticsearch-hostname-in-watcher/264093)
**Author:** [@bernhard.fluehmann](https://discuss.elastic.co/u/bernhard.fluehmann)\ **Replies:** 0\ **Last updated:** [February 12, 2021, 8:28am UTC](https://discuss.elastic.co/t/get-elasticsearch-hostname-in-watcher/264093 "2021-02-12T08:28:03Z")
I need to get the hostname of the elasticsearch node which executes a watch. As far as it seems it is not available as a ctx variable. As well it seems not possible to get it directly by painless. Does anybody know how t… --- ## [Auditbeat 7.11 on Ubuntu doesn't read /var/log/btmp](https://discuss.elastic.co/t/auditbeat-7-11-on-ubuntu-doesnt-read-var-log-btmp/264092)
**Author:** [@Supp0rt](https://discuss.elastic.co/u/Supp0rt)\ **Replies:** 0\ **Last updated:** [February 12, 2021, 8:26am UTC](https://discuss.elastic.co/t/auditbeat-7-11-on-ubuntu-doesnt-read-var-log-btmp/264092 "2021-02-12T08:26:50Z")
Hi, I installed auditbeat 7.11.2 on Ubuntu 16.04 and Centos 7 to read login from file /var/log/wtmp and /var/log/btmp . On Centos 7 all registers are read correctly. On Ubuntu, only login and logout are collected. No… --- ## [7.11: Expected two arguments specifying path to ES\_PATH\_CONF and plugins directory](https://discuss.elastic.co/t/7-11-expected-two-arguments-specifying-path-to-es-path-conf-and-plugins-directory/263986)
**Author:** [@Denis\_Lamanov](https://discuss.elastic.co/u/Denis_Lamanov)\ **Replies:** 2\ **Last updated:** [February 12, 2021, 8:26am UTC](https://discuss.elastic.co/t/7-11-expected-two-arguments-specifying-path-to-es-path-conf-and-plugins-directory/263986 "2021-02-12T08:26:10Z")
Вчера вечером решил обновить 7.10.2(windows 2016) на свежий 7.11 Прощёлкал как всегда далее и на этапе запуска сервиса облом. В ивентах: Service cannot be started. Elastic.ProcessHosts.Process.StartupException: Could n… --- ## [Filebeat configuration (o365 module) is not working](https://discuss.elastic.co/t/filebeat-configuration-o365-module-is-not-working/264089)
**Author:** [@riahc3](https://discuss.elastic.co/u/riahc3)\ **Replies:** 0\ **Last updated:** [February 12, 2021, 7:59am UTC](https://discuss.elastic.co/t/filebeat-configuration-o365-module-is-not-working/264089 "2021-02-12T07:59:22Z")
Hello Im trying to configure the 0365 module with this: # List of content-types to fetch. By default all known content-types # are retrieved: var.content\_type: - "Audit.AzureActiveDirectory" # - "Audit.Exchange" … --- ## [Filebeat to ingest raw cloudtrail logs](https://discuss.elastic.co/t/filebeat-to-ingest-raw-cloudtrail-logs/264086)
**Author:** [@p1k4chu](https://discuss.elastic.co/u/p1k4chu)\ **Replies:** 0\ **Last updated:** [February 12, 2021, 7:36am UTC](https://discuss.elastic.co/t/filebeat-to-ingest-raw-cloudtrail-logs/264086 "2021-02-12T07:36:02Z")
Hello, I have raw cloudtrail logs in archives stored on a disk. How can I ingest them to elasticsearch instead of S3 input or direct cloudtrail input. --- ## [Need to setup cpu,memory,disk dashboards in kibana](https://discuss.elastic.co/t/need-to-setup-cpu-memory-disk-dashboards-in-kibana/263295)
**Author:** [@charanteja](https://discuss.elastic.co/u/charanteja)\ **Replies:** 6\ **Last updated:** [February 12, 2021, 6:17am UTC](https://discuss.elastic.co/t/need-to-setup-cpu-memory-disk-dashboards-in-kibana/263295 "2021-02-12T06:17:29Z")
I am fairly new to ELK and going thru dis portal is kind of helping me a little bit. I saw you are active and knowledgable in ELK. Could you help me in setting my visualization so I could set up the dashboards for my ne… --- ## [Indexing time issue after upgrading 7.7.1 to 7.10.1](https://discuss.elastic.co/t/indexing-time-issue-after-upgrading-7-7-1-to-7-10-1/261777)
**Author:** [@Evgeny\_Dekhtyarev](https://discuss.elastic.co/u/Evgeny_Dekhtyarev)\ **Replies:** 4\ **Last updated:** [February 12, 2021, 5:22am UTC](https://discuss.elastic.co/t/indexing-time-issue-after-upgrading-7-7-1-to-7-10-1/261777 "2021-02-12T05:22:51Z")
Hello everyone! Thanks for your product! We have several Elasticsearch clusters and one of them has a problem when upgrading from 7.7.1 to 7.10.1. We needed an update due to a problem with the circuit breaker (https:/… --- ## [How to enable kibana\_system user for kibana application](https://discuss.elastic.co/t/how-to-enable-kibana-system-user-for-kibana-application/263949)
**Author:** [@kasim123](https://discuss.elastic.co/u/kasim123)\ **Replies:** 6\ **Last updated:** [February 12, 2021, 5:20am UTC](https://discuss.elastic.co/t/how-to-enable-kibana-system-user-for-kibana-application/263949 "2021-02-12T05:20:00Z")
Hi Team, We have one EFK stack running on 7.4.X version with X-pack security enabled and we defined elastic user for kibana application and everything works so far. Now we are trying to use 7.9 version of EFK with same… --- ## [Parsing USG Pro Firewall logs using GROK](https://discuss.elastic.co/t/parsing-usg-pro-firewall-logs-using-grok/264078)
**Author:** [@jaysbeekay](https://discuss.elastic.co/u/jaysbeekay)\ **Replies:** 2\ **Last updated:** [February 12, 2021, 4:36am UTC](https://discuss.elastic.co/t/parsing-usg-pro-firewall-logs-using-grok/264078 "2021-02-12T04:36:31Z")
I have managed to stand up an ELK stack on an Ubuntu host to bring in my NGINX logs, which is all working well. I have now tried to expand this to bring in firewall logs from my USG Pro Firewall and am running into some… --- ## [Elasticsearch.py scanerror](https://discuss.elastic.co/t/elasticsearch-py-scanerror/264074)
**Author:** [@diego.ss](https://discuss.elastic.co/u/diego.ss)\ **Replies:** 0\ **Last updated:** [February 12, 2021, 2:02am UTC](https://discuss.elastic.co/t/elasticsearch-py-scanerror/264074 "2021-02-12T02:02:34Z")
Hello, I'm having a similar problem with elasticsearch-py as in the discussion below, except for the fact that my problem is with the version 6. https://discuss.elastic.co/t/elasticsearch-dsl-python-scanerror/201980. … --- ## [Logstash kv field\_split regex](https://discuss.elastic.co/t/logstash-kv-field-split-regex/264058)
**Author:** [@newmember](https://discuss.elastic.co/u/newmember)\ **Replies:** 2\ **Last updated:** [February 12, 2021, 1:10am UTC](https://discuss.elastic.co/t/logstash-kv-field-split-regex/264058 "2021-02-12T01:10:26Z")
I am using logstash 2.4.0 for business reasons. Does the field\_split split on each of these characters: (,\\r,\\n,|,\\n,),\\t OR using regex does the split recognize the OR option in the brackets? (\\r\\n|\\n)\\t kv { … --- ## [Thread waitedTime is more while connecting to elastic](https://discuss.elastic.co/t/thread-waitedtime-is-more-while-connecting-to-elastic/264024)
**Author:** [@Sumaiya](https://discuss.elastic.co/u/Sumaiya)\ **Replies:** 1\ **Last updated:** [February 12, 2021, 12:59am UTC](https://discuss.elastic.co/t/thread-waitedtime-is-more-while-connecting-to-elastic/264024 "2021-02-12T00:59:04Z")
Hello All , One of our spring boot micro service connecting to elastic has high response time , while the took time itself is 50ms the service response time is high . After taking couple of threaddumps I see there are i… --- ## [Syslog cef + logstash + security device logs parsing issues](https://discuss.elastic.co/t/syslog-cef-logstash-security-device-logs-parsing-issues/264070)
**Author:** [@Xor44](https://discuss.elastic.co/u/Xor44)\ **Replies:** 0\ **Last updated:** [February 12, 2021, 12:39am UTC](https://discuss.elastic.co/t/syslog-cef-logstash-security-device-logs-parsing-issues/264070 "2021-02-12T00:39:47Z")
Hello , I'm beginning with logstash, I need a help to understand why CEF logs sent by security equipment are not parsed correctly. I am using the filter below but some fields are not named correctly. here is an sample … --- ## [SAML Returning 304 Error](https://discuss.elastic.co/t/saml-returning-304-error/264033)
**Author:** [@teej](https://discuss.elastic.co/u/teej)\ **Replies:** 1\ **Last updated:** [February 11, 2021, 11:53pm UTC](https://discuss.elastic.co/t/saml-returning-304-error/264033 "2021-02-11T23:53:52Z")
Hi, I have a system currently using AD to authenticate users. Recently, they've asked for SAML to be used as a primary realm. Problem is when I try to bring up Kibana I get "Error 403 - Forbidden". The logs show: {"ty… --- ## [Compare a vector to a list of vectors contained in each document](https://discuss.elastic.co/t/compare-a-vector-to-a-list-of-vectors-contained-in-each-document/263905)
**Author:** [@flavienbwk](https://discuss.elastic.co/u/flavienbwk)\ **Replies:** 1\ **Last updated:** [February 11, 2021, 11:04pm UTC](https://discuss.elastic.co/t/compare-a-vector-to-a-list-of-vectors-contained-in-each-document/263905 "2021-02-11T23:04:54Z")
Hi, Each of my documents contain a list of dense\_vectors inside a nested object : words.vector I try to compare my input vector to all documents' words.vector properties. I currently try with the following but elastic… --- ## [Unsupported version after upgrade to 7.11](https://discuss.elastic.co/t/unsupported-version-after-upgrade-to-7-11/264064)
**Author:** [@gdoctor](https://discuss.elastic.co/u/gdoctor)\ **Replies:** 1\ **Last updated:** [February 11, 2021, 7:31pm UTC](https://discuss.elastic.co/t/unsupported-version-after-upgrade-to-7-11/264064 "2021-02-11T19:31:41Z")
I had used ECK to install elasticsearch version 7.9 and successfully upgraded to 7.10. I just attempted to upgrade again to 7.11 and am getting the error "unsupported\_distribution". I never setup any licensing, so unless… --- ## [Azure Activity logs issue](https://discuss.elastic.co/t/azure-activity-logs-issue/264061)
**Author:** [@renadoz](https://discuss.elastic.co/u/renadoz)\ **Replies:** 0\ **Last updated:** [February 11, 2021, 10:35pm UTC](https://discuss.elastic.co/t/azure-activity-logs-issue/264061 "2021-02-11T22:35:40Z")
Dear Community, I am having an issue with getting azure activity logs in Kibana in a proper format. It is like azure activity logs are not fully reflected on kibana side. Although it is the same log, several fields ar… --- ## [Forced Awareness Setting](https://discuss.elastic.co/t/forced-awareness-setting/264060)
**Author:** [@abdulazizali77](https://discuss.elastic.co/u/abdulazizali77)\ **Replies:** 0\ **Last updated:** [February 11, 2021, 10:27pm UTC](https://discuss.elastic.co/t/forced-awareness-setting/264060 "2021-02-11T22:27:35Z")
Hi Currently im testing 7.2 from a zip file in a development environment on Windows 10. I apologize if this has been thoroughly explained elsewhere but Ive looked at a few of the old forced awareness topics here and i … --- ## [Grok for time with UUUU](https://discuss.elastic.co/t/grok-for-time-with-uuuu/264040)
**Author:** [@newmember](https://discuss.elastic.co/u/newmember)\ **Replies:** 2\ **Last updated:** [February 11, 2021, 9:57pm UTC](https://discuss.elastic.co/t/grok-for-time-with-uuuu/264040 "2021-02-11T21:57:28Z")
I am reading this in the grok patterns pages but I dont see a syntax for the time format. # datestamp is YYYY/MM/DD-HH:MM:SS.UUUU (or something like it) Is there a grok pattern for this time format? 10:02:19.9830 --- ## [Long and float fields showing up as text fields in Kibana](https://discuss.elastic.co/t/long-and-float-fields-showing-up-as-text-fields-in-kibana/263921)
**Author:** [@asnyameeteen](https://discuss.elastic.co/u/asnyameeteen)\ **Replies:** 0\ **Last updated:** [February 10, 2021, 6:37pm UTC](https://discuss.elastic.co/t/long-and-float-fields-showing-up-as-text-fields-in-kibana/263921 "2021-02-10T18:37:49Z")
Running Kibana version 5.5.2. My current setup is Logstash is taking the logs from Docker containers, runs grok filters before sending the logs to elasticsearch. The specific logs that I need to show up as long, float a… --- ## [New index name after rollover](https://discuss.elastic.co/t/new-index-name-after-rollover/264055)
**Author:** [@Yenii\_Ceri](https://discuss.elastic.co/u/Yenii_Ceri)\ **Replies:** 0\ **Last updated:** [February 11, 2021, 9:04pm UTC](https://discuss.elastic.co/t/new-index-name-after-rollover/264055 "2021-02-11T21:04:02Z")
Hi, I'm creating a hot worm architecture cluster, I would like to implement ILM with rollover but I which to have a different name for the indexes after rollover: For example with an index name: winlogbeat-10, the name… --- ## [Translate Filter plugin for a real CSV](https://discuss.elastic.co/t/translate-filter-plugin-for-a-real-csv/263940)
**Author:** [@jchaves506](https://discuss.elastic.co/u/jchaves506)\ **Replies:** 3\ **Last updated:** [February 11, 2021, 8:02pm UTC](https://discuss.elastic.co/t/translate-filter-plugin-for-a-real-csv/263940 "2021-02-11T20:02:10Z")
Hello I have a big CSV file(10 columns, 40Mb) that I want to use as a dictionary using the translate filter. I'm already doing that with a little csv files (2 columns, 4kb) and that is working fine. I'm doing it like th… [Previous page](https://discuss.elastic.co/latest.md?page=1840) [Next page](https://discuss.elastic.co/latest.md?page=1842)