# Latest **URL:** https://discuss.elastic.co/latest.md?page=1871 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1872 --- ## [All documents via Cylance module are failing to extract fields](https://discuss.elastic.co/t/all-documents-via-cylance-module-are-failing-to-extract-fields/262437)
**Author:** [@10FoyfBqA](https://discuss.elastic.co/u/10FoyfBqA)\ **Replies:** 0\ **Last updated:** [January 28, 2021, 1:54am UTC](https://discuss.elastic.co/t/all-documents-via-cylance-module-are-failing-to-extract-fields/262437 "2021-01-28T01:54:59Z")
I'm trying to configure the Cylance module in Filebeat, but it is not extracting any fields from log messages, and all documents have the value dissect\_parsing\_error in the log.flags. I have setup a filebeat collector l… --- ## [Curator date match does not meet provided criteria](https://discuss.elastic.co/t/curator-date-match-does-not-meet-provided-criteria/262300)
**Author:** [@kyle\_che](https://discuss.elastic.co/u/kyle_che)\ **Replies:** 2\ **Last updated:** [January 28, 2021, 12:09am UTC](https://discuss.elastic.co/t/curator-date-match-does-not-meet-provided-criteria/262300 "2021-01-28T00:09:05Z")
I'm trying to run curator and getting "does not meet provided criteria. Removing from list." Any idea on why the pattern below is not matching the index name? 3: action: delete\_indices description: \>- De… --- ## [Jolokia agent id and name](https://discuss.elastic.co/t/jolokia-agent-id-and-name/262430)
**Author:** [@bucks](https://discuss.elastic.co/u/bucks)\ **Replies:** 0\ **Last updated:** [January 27, 2021, 11:40pm UTC](https://discuss.elastic.co/t/jolokia-agent-id-and-name/262430 "2021-01-27T23:40:05Z")
Hello All - We are trying Jolokia for capturing JVM metrics. When we configure Jolokia to receive data from multiple JVMs it is hard to identify the which JVM is sending the data. Jolokia documentation says that we hav… --- ## [Writing API update for setting number of replicas to 0](https://discuss.elastic.co/t/writing-api-update-for-setting-number-of-replicas-to-0/261595)
**Author:** [@txmrlevine](https://discuss.elastic.co/u/txmrlevine)\ **Replies:** 5\ **Last updated:** [January 27, 2021, 11:13pm UTC](https://discuss.elastic.co/t/writing-api-update-for-setting-number-of-replicas-to-0/261595 "2021-01-27T23:13:42Z")
We are trying to eliminate replicas in our non-prod environment to save space and we do not need the replicas. we know this is counter to the fault tolerance but it is something we must do. I found this on the document… --- ## [Unable to access my Elastic account - says terminated](https://discuss.elastic.co/t/unable-to-access-my-elastic-account-says-terminated/262422)
**Author:** [@Stud21](https://discuss.elastic.co/u/Stud21)\ **Replies:** 1\ **Last updated:** [January 27, 2021, 10:59pm UTC](https://discuss.elastic.co/t/unable-to-access-my-elastic-account-says-terminated/262422 "2021-01-27T22:59:12Z")
Hi, I have been enrolled by Leidos for the Elastic training/certification course for a year. However, when I access https://cloud.elastic.co/home using my patds12@gmail.com account, the status shows as Terminated. I am … --- ## [Nested Document Search Query (searching across filtered nested documents)](https://discuss.elastic.co/t/nested-document-search-query-searching-across-filtered-nested-documents/262420)
**Author:** [@suy1993](https://discuss.elastic.co/u/suy1993)\ **Replies:** 0\ **Last updated:** [January 27, 2021, 9:38pm UTC](https://discuss.elastic.co/t/nested-document-search-query-searching-across-filtered-nested-documents/262420 "2021-01-27T21:38:43Z")
I have nested document like {id:123, name:"abc", attendance\[{class: "physics", Joined: "2021-01- 21", "grade": "pass"} , {class: "chemistry", Joined: "2021-01- 13", "grade": "NA"}, {class: "maths", Joined: "2021-01- … --- ## [Change the index name for the App Search indices](https://discuss.elastic.co/t/change-the-index-name-for-the-app-search-indices/262162)
**Author:** [@sanju1323](https://discuss.elastic.co/u/sanju1323)\ **Replies:** 3\ **Last updated:** [January 27, 2021, 9:35pm UTC](https://discuss.elastic.co/t/change-the-index-name-for-the-app-search-indices/262162 "2021-01-27T21:35:00Z")
Hi Team, when we index the data to App Search Engine, it is creating an index in Elasticsearch with some hexa-decimal name. We want to index the data with specific naming conventions. So, is there a way to modify it or… --- ## [Roll up index](https://discuss.elastic.co/t/roll-up-index/262010)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 4\ **Last updated:** [January 27, 2021, 9:30pm UTC](https://discuss.elastic.co/t/roll-up-index/262010 "2021-01-27T21:30:55Z")
I have turn on roll up job for testing when I do GET /\_rollup/job/\_all I can see it is running. it says started but I don't see any rollup index. I don't see any index named metricbeat-rollup how do I confirm that it… --- ## [Python read all index pattern](https://discuss.elastic.co/t/python-read-all-index-pattern/262293)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 4\ **Last updated:** [January 27, 2021, 9:30pm UTC](https://discuss.elastic.co/t/python-read-all-index-pattern/262293 "2021-01-27T21:30:02Z")
is there a python call to read all index patterns I can read all indexes but I want to read patterns name for example I have index-1, index-2, index-3 and index pattern is index-\* and I use that for all visulization. … --- ## [Regular Expression on Env Var](https://discuss.elastic.co/t/regular-expression-on-env-var/262295)
**Author:** [@hQWeedEater](https://discuss.elastic.co/u/hQWeedEater)\ **Replies:** 1\ **Last updated:** [January 27, 2021, 5:08pm UTC](https://discuss.elastic.co/t/regular-expression-on-env-var/262295 "2021-01-27T17:08:17Z")
processors: - add\_fields: fields: custom\_value: "${COMPUTERNAME}" Is it possible to use regex on {COMPUTERNAME} to only return the first X characters or last X characters? I tried adding the above process… --- ## [How to distribute search requests by date](https://discuss.elastic.co/t/how-to-distribute-search-requests-by-date/262405)
**Author:** [@ozgun](https://discuss.elastic.co/u/ozgun)\ **Replies:** 2\ **Last updated:** [January 27, 2021, 8:54pm UTC](https://discuss.elastic.co/t/how-to-distribute-search-requests-by-date/262405 "2021-01-27T20:54:27Z")
Hello, I have daily indexes in the format of "payments-2021-01-27". When I search documents I send a time based query and I want to distribute search requests to the matched indexes by date. For example when I search l… --- ## [Exporting/Importing Saved Objects in Kibana 7.1](https://discuss.elastic.co/t/exporting-importing-saved-objects-in-kibana-7-1/262410)
**Author:** [@Colby\_Dozier](https://discuss.elastic.co/u/Colby_Dozier)\ **Replies:** 3\ **Last updated:** [January 27, 2021, 8:15pm UTC](https://discuss.elastic.co/t/exporting-importing-saved-objects-in-kibana-7-1/262410 "2021-01-27T20:15:59Z")
We are stuck with 7.1 being the newest version of Kibana we can use in our environment. I'm attempting to import multiple saved objects that was exported by hand in Kibana into a JSON file. This would be done during stan… --- ## [Composite aggs with an after key in a large index take forever](https://discuss.elastic.co/t/composite-aggs-with-an-after-key-in-a-large-index-take-forever/262412)
**Author:** [@benlin](https://discuss.elastic.co/u/benlin)\ **Replies:** 0\ **Last updated:** [January 27, 2021, 7:48pm UTC](https://discuss.elastic.co/t/composite-aggs-with-an-after-key-in-a-large-index-take-forever/262412 "2021-01-27T19:48:34Z")
I'm running into an issue where composite aggs with an after key seem to run forever on large indices (several 100m docs) when the same agg without an after key runs just fine. So this runs in seconds: { "size": 0, … --- ## [\_jsonparsefailure on reading json](https://discuss.elastic.co/t/jsonparsefailure-on-reading-json/262335)
**Author:** [@logstash123](https://discuss.elastic.co/u/logstash123)\ **Replies:** 2\ **Last updated:** [January 27, 2021, 7:03pm UTC](https://discuss.elastic.co/t/jsonparsefailure-on-reading-json/262335 "2021-01-27T19:03:45Z")
Dear community, I need to parse a JSON of the following format: { "commitId": "xxxxxxx", "author": { "name": "", "email": "", "date": "" }, "committer": { "name": "", "email": "", "date"… --- ## [How to configure ELK to receive logs from multiple servers](https://discuss.elastic.co/t/how-to-configure-elk-to-receive-logs-from-multiple-servers/262383)
**Author:** [@huzaifa224](https://discuss.elastic.co/u/huzaifa224)\ **Replies:** 3\ **Last updated:** [January 27, 2021, 7:01pm UTC](https://discuss.elastic.co/t/how-to-configure-elk-to-receive-logs-from-multiple-servers/262383 "2021-01-27T19:01:13Z")
I have multiple servers in which filebeat is installed and sending their logs to ELK. In kibana multiple server's logs are showing on single logs page which is every complicated to identify which log is coming from whic… --- ## [Throttle filter is not throttling correctly](https://discuss.elastic.co/t/throttle-filter-is-not-throttling-correctly/262402)
**Author:** [@holobolo0815](https://discuss.elastic.co/u/holobolo0815)\ **Replies:** 0\ **Last updated:** [January 27, 2021, 5:32pm UTC](https://discuss.elastic.co/t/throttle-filter-is-not-throttling-correctly/262402 "2021-01-27T17:32:07Z")
With reference to https://discuss.elastic.co/t/throttle-filter-notify-on-throttle/261861 When doing this: if \[srcip\] and \[dstip\] and \[dstport\] { throttle { # decorates event if OUTSIDE bounds key =\> "%{%filter\_ma… --- ## [Date Match is setting incorrect timestamp / not actually setting timestamp](https://discuss.elastic.co/t/date-match-is-setting-incorrect-timestamp-not-actually-setting-timestamp/262363)
**Author:** [@beirtipol](https://discuss.elastic.co/u/beirtipol)\ **Replies:** 5\ **Last updated:** [January 27, 2021, 5:57pm UTC](https://discuss.elastic.co/t/date-match-is-setting-incorrect-timestamp-not-actually-setting-timestamp/262363 "2021-01-27T17:57:24Z")
I have the following filter in my logstash pipeline: date { match =\> \[ "\[fields\]\[serverrequest\]\[starttime\]", "UNIX\_MS" \] tag\_on\_failure =\> \[ "serverrequest\_logstyle\_dateparsefailure" \] } However, th… --- ## [Issue with HTTP Poller : ConfigurationError: Invalid URL](https://discuss.elastic.co/t/issue-with-http-poller-configurationerror-invalid-url/262328)
**Author:** [@AmarKolhapuri](https://discuss.elastic.co/u/AmarKolhapuri)\ **Replies:** 2\ **Last updated:** [January 27, 2021, 5:51pm UTC](https://discuss.elastic.co/t/issue-with-http-poller-configurationerror-invalid-url/262328 "2021-01-27T17:51:52Z")
I am facing error with invalid URL for below http\_poller code. input { http\_poller{ urls =\> { test2 =\> { method =\> get user =\> "weblogic" password =\> "welcome1" urls =\> "http://weblogic:7001/management/wls/lates… --- ## [\[ Error parsing CSV \] : :exception=\>#\](https://discuss.elastic.co/t/error-parsing-csv-exception-csv-illegal-quoting-in-line-1/262370)
**Author:** [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)\ **Replies:** 2\ **Last updated:** [January 27, 2021, 4:55pm UTC](https://discuss.elastic.co/t/error-parsing-csv-exception-csv-illegal-quoting-in-line-1/262370 "2021-01-27T16:55:12Z")
Hello, I am trying to parse some csv logs using logstash and I am getting this error: \[WARN \] 2021-01-27 14:05:31.217 \[\[main\]\>worker2\] csv - Error parsing csv {:field=\>"message", :source=\>"\\"2020-12-24 00:01:23\\", \\"29… --- ## [Grok pattern to extract the fields from the log file](https://discuss.elastic.co/t/grok-pattern-to-extract-the-fields-from-the-log-file/262326)
**Author:** [@shiv97](https://discuss.elastic.co/u/shiv97)\ **Replies:** 1\ **Last updated:** [January 27, 2021, 4:54pm UTC](https://discuss.elastic.co/t/grok-pattern-to-extract-the-fields-from-the-log-file/262326 "2021-01-27T16:54:43Z")
Hi Everyone, I am having one log file and I need to parse the message field into multiple subfields for that I need grok parser please look at the log file below:- message:{"level":"info","ts":1611311978.7658348,"calle… --- ## [Array values into single field](https://discuss.elastic.co/t/array-values-into-single-field/262348)
**Author:** [@Stevek](https://discuss.elastic.co/u/Stevek)\ **Replies:** 1\ **Last updated:** [January 27, 2021, 4:50pm UTC](https://discuss.elastic.co/t/array-values-into-single-field/262348 "2021-01-27T16:50:36Z")
Hello, I struggle to extract IPs from JSON, I need to extract all IPs from array/s(regardless of count) into one field. Below the part of JSON I want to extract data from: "source": { "explicit": { … --- ## [Logstash writer permissions](https://discuss.elastic.co/t/logstash-writer-permissions/262397)
**Author:** [@iccMe](https://discuss.elastic.co/u/iccMe)\ **Replies:** 0\ **Last updated:** [January 27, 2021, 4:49pm UTC](https://discuss.elastic.co/t/logstash-writer-permissions/262397 "2021-01-27T16:49:23Z")
Hi, Looking for advice. I have created a new logstash writer user and created the appropriate role with permissions as per: https://www.elastic.co/guide/en/logstash/7.3/ls-security.html for a managed ILM index. The onl… --- ## [@timestamp not match with the log date](https://discuss.elastic.co/t/timestamp-not-match-with-the-log-date/262272)
**Author:** [@Riyanka](https://discuss.elastic.co/u/Riyanka)\ **Replies:** 3\ **Last updated:** [January 27, 2021, 4:46pm UTC](https://discuss.elastic.co/t/timestamp-not-match-with-the-log-date/262272 "2021-01-27T16:46:34Z")
The timestamp does not match with the actual log time in kibana @timestamp January 26th 2021, 23:38:10.426 message \[2021-01-22 09:53:09\] php.CRITICAL: Uncaught Error: Call to a member function getName() on null… --- ## [Convert string to number with decimal](https://discuss.elastic.co/t/convert-string-to-number-with-decimal/262163)
**Author:** [@jayv](https://discuss.elastic.co/u/jayv)\ **Replies:** 2\ **Last updated:** [January 27, 2021, 4:42pm UTC](https://discuss.elastic.co/t/convert-string-to-number-with-decimal/262163 "2021-01-27T16:42:26Z")
Hi there, can anyone help me mutate a string into a decimal-formatted number for geo-points? For example, I have a CSV with fields containing: -115168598 ....which needs to be: -115.168598 My first attempt just gave m… --- ## [Oracle to Elastic search date conversion #logstash](https://discuss.elastic.co/t/oracle-to-elastic-search-date-conversion-logstash/262368)
**Author:** [@onkarborade](https://discuss.elastic.co/u/onkarborade)\ **Replies:** 1\ **Last updated:** [January 27, 2021, 4:29pm UTC](https://discuss.elastic.co/t/oracle-to-elastic-search-date-conversion-logstash/262368 "2021-01-27T16:29:28Z")
Hi, Trying to insert records from Oracle db to Elastic search using logstash I am getting default date format of field from oracle database is 2021-01-27T12:39:01.867Z and I want to save a field in elastic search in … --- ## [Logstash randomly skipping files](https://discuss.elastic.co/t/logstash-randomly-skipping-files/262228)
**Author:** [@Rutger2000](https://discuss.elastic.co/u/Rutger2000)\ **Replies:** 3\ **Last updated:** [January 27, 2021, 4:25pm UTC](https://discuss.elastic.co/t/logstash-randomly-skipping-files/262228 "2021-01-27T16:25:38Z")
I'm using logstash to ingest data into Elasticsearch and view it in Kibana. Every hour I receive multiple files in a folder which then are processed by logstash. We notice that logstash sometimes skips a file, as far as … --- ## [Logstash JOSN parsing faile](https://discuss.elastic.co/t/logstash-josn-parsing-faile/262395)
**Author:** [@motyha](https://discuss.elastic.co/u/motyha)\ **Replies:** 0\ **Last updated:** [January 27, 2021, 4:15pm UTC](https://discuss.elastic.co/t/logstash-josn-parsing-faile/262395 "2021-01-27T16:15:24Z")
Hi i have some issue with JSON parsing that i create by Python the JSON file and CONF file uploaded the problem that the json file split the raws in the message {...} how do i make logstash parse the JSON that eve… --- ## [Upper limits on Filebeat harvesting](https://discuss.elastic.co/t/upper-limits-on-filebeat-harvesting/262389)
**Author:** [@beirtipol](https://discuss.elastic.co/u/beirtipol)\ **Replies:** 0\ **Last updated:** [January 27, 2021, 3:38pm UTC](https://discuss.elastic.co/t/upper-limits-on-filebeat-harvesting/262389 "2021-01-27T15:38:31Z")
I have a system which produces separate log files of all RMI calls and SQL executions. This is very useful for tracing of client requests. The loggers are set to roll the file every 10mb, which equals 36,000 lines on ave… --- ## [Filebeat ships only the first path mentioned from filebeat.yml](https://discuss.elastic.co/t/filebeat-ships-only-the-first-path-mentioned-from-filebeat-yml/262388)
**Author:** [@ranjini](https://discuss.elastic.co/u/ranjini)\ **Replies:** 0\ **Last updated:** [January 27, 2021, 3:35pm UTC](https://discuss.elastic.co/t/filebeat-ships-only-the-first-path-mentioned-from-filebeat-yml/262388 "2021-01-27T15:35:48Z")
Please find my filebeat conf. ################### Filebeat Configuration Example ################### # filebeat config for dco project # ############################# Filebeat ########… --- ## [ECE expanding ECE node (adding RAM and CPU to VM)](https://discuss.elastic.co/t/ece-expanding-ece-node-adding-ram-and-cpu-to-vm/261572)
**Author:** [@Zerobot](https://discuss.elastic.co/u/Zerobot)\ **Replies:** 1\ **Last updated:** [January 20, 2021, 9:36pm UTC](https://discuss.elastic.co/t/ece-expanding-ece-node-adding-ram-and-cpu-to-vm/261572 "2021-01-20T21:36:41Z")
HI! I'm about to install ECE in my org! But I'd like to ask about one thing - about 6 months ago I was actively POCing ECE in my org, it was ECE v2.5 if I remember correctly. In that version I was not able to expand RAM… [Previous page](https://discuss.elastic.co/latest.md?page=1870) [Next page](https://discuss.elastic.co/latest.md?page=1872)