# Latest **URL:** https://discuss.elastic.co/latest.md?page=1885 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1886 --- ## [Azure instance type for logstash](https://discuss.elastic.co/t/azure-instance-type-for-logstash/261580)
**Author:** [@mruthyu](https://discuss.elastic.co/u/mruthyu)\ **Replies:** 0\ **Last updated:** [January 19, 2021, 6:05pm UTC](https://discuss.elastic.co/t/azure-instance-type-for-logstash/261580 "2021-01-19T18:05:21Z")
Any recommendation of Azure instance type for logstash? --- ## [\[SIEM\] Authentications table doesn't show 'Last Success/Failed Source' column if only 'source.ip' is present](https://discuss.elastic.co/t/siem-authentications-table-doesnt-show-last-success-failed-source-column-if-only-source-ip-is-present/261257)
**Author:** [@eextreemee](https://discuss.elastic.co/u/eextreemee)\ **Replies:** 6\ **Last updated:** [January 19, 2021, 5:25pm UTC](https://discuss.elastic.co/t/siem-authentications-table-doesnt-show-last-success-failed-source-column-if-only-source-ip-is-present/261257 "2021-01-19T17:25:17Z")
I found solution here but i don't know how to implement it. please help... --- ## [Make ES Queries from my Custom Kibana Plugin](https://discuss.elastic.co/t/make-es-queries-from-my-custom-kibana-plugin/261416)
**Author:** [@xenon-xenon](https://discuss.elastic.co/u/xenon-xenon)\ **Replies:** 7\ **Last updated:** [January 19, 2021, 5:10pm UTC](https://discuss.elastic.co/t/make-es-queries-from-my-custom-kibana-plugin/261416 "2021-01-19T17:10:49Z")
I'm looking for best way of create ES queries from my plugin like : without ES authentication stuff I mean best and recommended way --- ## [Message looks like it is binary when using inputs.d](https://discuss.elastic.co/t/message-looks-like-it-is-binary-when-using-inputs-d/261559)
**Author:** [@gungazoo](https://discuss.elastic.co/u/gungazoo)\ **Replies:** 1\ **Last updated:** [January 19, 2021, 4:57pm UTC](https://discuss.elastic.co/t/message-looks-like-it-is-binary-when-using-inputs-d/261559 "2021-01-19T16:57:44Z")
If I have filebeat.yml file follow a file and send it to Elasticsearch it seems to work fine but if I use the inputs.d format then the message looks like it is binary. It could just be a font problem. I don't understan… --- ## [\[ Creating new rule \]: ERROR Authentication using apikey failed - api key has been invalidated](https://discuss.elastic.co/t/creating-new-rule-error-authentication-using-apikey-failed-api-key-has-been-invalidated/261407)
**Author:** [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)\ **Replies:** 4\ **Last updated:** [January 19, 2021, 4:53pm UTC](https://discuss.elastic.co/t/creating-new-rule-error-authentication-using-apikey-failed-api-key-has-been-invalidated/261407 "2021-01-19T16:53:45Z")
Hello, I am using elasticsearch, kibana and beats version 7.10.1 with a Trial license, I am trying to create a new Match rule and in my elasticsearch node I am getting this error: \[2021-01-18T11:33:18,032\]\[WARN \]\[o.e… --- ## [Apm server not detected](https://discuss.elastic.co/t/apm-server-not-detected/261508)
**Author:** [@L0Gal](https://discuss.elastic.co/u/L0Gal)\ **Replies:** 3\ **Last updated:** [January 19, 2021, 9:47am UTC](https://discuss.elastic.co/t/apm-server-not-detected/261508 "2021-01-19T09:47:43Z")
Kibana version: 7.10.1 Elasticsearch version: 7.10.1 APM Server version: 7.10.1 Original install method and version: Package manager on Ubuntu 20.04 Focal Fossa Fresh install or upgraded from other version?: Fresh H… --- ## [Parse JSON input file, extract fields and write them in output file](https://discuss.elastic.co/t/parse-json-input-file-extract-fields-and-write-them-in-output-file/261543)
**Author:** [@fantonio](https://discuss.elastic.co/u/fantonio)\ **Replies:** 1\ **Last updated:** [January 19, 2021, 4:29pm UTC](https://discuss.elastic.co/t/parse-json-input-file-extract-fields-and-write-them-in-output-file/261543 "2021-01-19T16:29:34Z")
I have an input file where each line is a JSON object like the following: { "status\_code" =\> "200", "method" =\> "GET", "country" =\> "US", "field" =\> "something", } T… --- ## [How do I keep my log level field from wrapping?](https://discuss.elastic.co/t/how-do-i-keep-my-log-level-field-from-wrapping/261479)
**Author:** [@Robert\_DiFalco](https://discuss.elastic.co/u/Robert_DiFalco)\ **Replies:** 3\ **Last updated:** [January 19, 2021, 4:25pm UTC](https://discuss.elastic.co/t/how-do-i-keep-my-log-level-field-from-wrapping/261479 "2021-01-19T16:25:39Z")
How do I prevent Kibana from wrapping the level field? I am using filebeat to post data. I'm assuming the only way is to make the field name longer? Really? --- ## [Max Size of engine in AppSearch](https://discuss.elastic.co/t/max-size-of-engine-in-appsearch/261569)
**Author:** [@Subhasis\_Dash](https://discuss.elastic.co/u/Subhasis_Dash)\ **Replies:** 3\ **Last updated:** [January 19, 2021, 4:15pm UTC](https://discuss.elastic.co/t/max-size-of-engine-in-appsearch/261569 "2021-01-19T16:15:19Z")
What is the total max size that an engine can have, is there a limit to it and if yes, is it configurable? --- ## [Multiple Enterprise Search Instances](https://discuss.elastic.co/t/multiple-enterprise-search-instances/261541)
**Author:** [@pesc](https://discuss.elastic.co/u/pesc)\ **Replies:** 1\ **Last updated:** [January 19, 2021, 4:14pm UTC](https://discuss.elastic.co/t/multiple-enterprise-search-instances/261541 "2021-01-19T16:14:07Z")
Hi Is it possible to setup multiple EnterpriseSearch Instance on a Elasticsearch Cluster? What I'd like to do: Server01: Part of Elasticsearch-Cluster (192.168.0.1:9200) + EnterpiseSearch (192.168.0.1:3200) Server02:… --- ## [Filebeat is not reading the log file in real time](https://discuss.elastic.co/t/filebeat-is-not-reading-the-log-file-in-real-time/261270)
**Author:** [@Tek\_Chand](https://discuss.elastic.co/u/Tek_Chand)\ **Replies:** 13\ **Last updated:** [January 19, 2021, 4:00pm UTC](https://discuss.elastic.co/t/filebeat-is-not-reading-the-log-file-in-real-time/261270 "2021-01-19T16:00:40Z")
Hello Team, We setup new elasticsearch cluster with version 7.10 and beats version is also 7.10. When we setup the cluster it was working fine and we were getting the logs on kibana dashboard in real time. But now we … --- ## [No es posible borrar un index pattern en Kibana](https://discuss.elastic.co/t/no-es-posible-borrar-un-index-pattern-en-kibana/261296)
**Author:** [@Leo78](https://discuss.elastic.co/u/Leo78)\ **Replies:** 2\ **Last updated:** [January 19, 2021, 3:54pm UTC](https://discuss.elastic.co/t/no-es-posible-borrar-un-index-pattern-en-kibana/261296 "2021-01-19T15:54:07Z")
Hola comunidad, buenas tardes. Admito que soy nuevo en Kibana, por tanto requiero de sus sugerencias. La cuestión es simple, lo que yo quiero es borrar un index-pattern para poder volver a crearlo desde cero. Hago c… --- ## [ECK elasticsearch - 500](https://discuss.elastic.co/t/eck-elasticsearch-500/261462)
**Author:** [@PaulRudin](https://discuss.elastic.co/u/PaulRudin)\ **Replies:** 2\ **Last updated:** [January 19, 2021, 3:46pm UTC](https://discuss.elastic.co/t/eck-elasticsearch-500/261462 "2021-01-19T15:46:02Z")
I had elasticsearch running in a cluster and all was well... however now I get 500s and the logs are full of stack traces. The first few lines: "at org.elasticsearch.xpack.security.authc.AuthenticationService.authenti… --- ## [Elasticsearch raw events](https://discuss.elastic.co/t/elasticsearch-raw-events/261052)
**Author:** [@karanp](https://discuss.elastic.co/u/karanp)\ **Replies:** 2\ **Last updated:** [January 19, 2021, 3:41pm UTC](https://discuss.elastic.co/t/elasticsearch-raw-events/261052 "2021-01-19T15:41:08Z")
So we have to create visualizations on raw event data in Elasticsearch. The data would include all the stages for that data in the same index for historical uses. The question is how do we look at data and only get the m… --- ## [Logstash text to array conversion](https://discuss.elastic.co/t/logstash-text-to-array-conversion/261393)
**Author:** [@thotakura2](https://discuss.elastic.co/u/thotakura2)\ **Replies:** 1\ **Last updated:** [January 19, 2021, 3:30pm UTC](https://discuss.elastic.co/t/logstash-text-to-array-conversion/261393 "2021-01-19T15:30:38Z")
Hi all, I am trying to index data from MySQL and one of the fields is delimited by ; and ,. I want to convert it into array by delimiting it with both the characters. Currently i am using the following filter: filt… --- ## [\[Winlogbeat 7.10.1 dashboards\]: could not locate some index pattern fields](https://discuss.elastic.co/t/winlogbeat-7-10-1-dashboards-could-not-locate-some-index-pattern-fields/259961)
**Author:** [@Abdelhalim](https://discuss.elastic.co/u/Abdelhalim)\ **Replies:** 5\ **Last updated:** [January 19, 2021, 3:28pm UTC](https://discuss.elastic.co/t/winlogbeat-7-10-1-dashboards-could-not-locate-some-index-pattern-fields/259961 "2021-01-19T15:28:17Z")
Hello, I am using Elasticsearch, kibana and winlogbeat, all version 7.10.1 I configured winlogbeat and run: .\\winlogbeat.exe setup -e and I had no error in my winlogbeat logs, but in kibana there are some dashboards wo… --- ## [Multiple field formatters](https://discuss.elastic.co/t/multiple-field-formatters/261468)
**Author:** [@pfennema](https://discuss.elastic.co/u/pfennema)\ **Replies:** 2\ **Last updated:** [January 19, 2021, 9:53am UTC](https://discuss.elastic.co/t/multiple-field-formatters/261468 "2021-01-19T09:53:58Z")
I currently have a dashboard (thanks to the enhanced table plugin) which shows a percentage in the table. The percentage is calculated by combining 2 fields into a scripted field ('percentage'). If the percentage is belo… --- ## [Restrict the kibana user for one machine only](https://discuss.elastic.co/t/restrict-the-kibana-user-for-one-machine-only/261546)
**Author:** [@mrunalini](https://discuss.elastic.co/u/mrunalini)\ **Replies:** 2\ **Last updated:** [January 19, 2021, 3:10pm UTC](https://discuss.elastic.co/t/restrict-the-kibana-user-for-one-machine-only/261546 "2021-01-19T15:10:23Z")
HI , My basic requirement here is to restrict any Kibana user for one machine only ,so that same user can not login from different machine at the same time. is there any setting needs to modify in kibana.yml file or an… --- ## [Cron+curator+logrotate are not work?](https://discuss.elastic.co/t/cron-curator-logrotate-are-not-work/261409)
**Author:** [@Tabriz](https://discuss.elastic.co/u/Tabriz)\ **Replies:** 3\ **Last updated:** [January 19, 2021, 3:05pm UTC](https://discuss.elastic.co/t/cron-curator-logrotate-are-not-work/261409 "2021-01-19T15:05:13Z")
l made a schedule for delete old logs from elasticsearch. The command is that 30 0 \* \* \* curator delete indices --time-unit days --timestring '%Y.%m.%d' --older-than 270 but the command doesn't wokr and even the logrot… --- ## [Elastic Contributor Program: Tips for creating written content](https://discuss.elastic.co/t/elastic-contributor-program-tips-for-creating-written-content/261185)
**Author:** [@riferrei](https://discuss.elastic.co/u/riferrei)\ **Replies:** 0\ **Last updated:** [January 14, 2021, 10:17pm UTC](https://discuss.elastic.co/t/elastic-contributor-program-tips-for-creating-written-content/261185 "2021-01-14T22:17:47Z")
If you are planning to submit a written content (articles, blogs, tutorials, workshops) for the Elastic Contributor Program but don't know how — I created the resources below to help you with this :partying\_face: :pag… --- ## [How can I easily implement pseudo-relevance feedback in a full-text search application?](https://discuss.elastic.co/t/how-can-i-easily-implement-pseudo-relevance-feedback-in-a-full-text-search-application/261564)
**Author:** [@Soumya\_Ranjan\_Sahoo](https://discuss.elastic.co/u/Soumya_Ranjan_Sahoo)\ **Replies:** 0\ **Last updated:** [January 19, 2021, 3:01pm UTC](https://discuss.elastic.co/t/how-can-i-easily-implement-pseudo-relevance-feedback-in-a-full-text-search-application/261564 "2021-01-19T15:01:33Z")
Hi, I want to implement pseudo-relevance feedback, together with a bm25 ranking function, for a full-text search application. Is there any reference that I can look up for implementing this? I have just one field in my … --- ## [How to secure communication between APM agent and APM server?](https://discuss.elastic.co/t/how-to-secure-communication-between-apm-agent-and-apm-server/261527)
**Author:** [@d.silwon](https://discuss.elastic.co/u/d.silwon)\ **Replies:** 6\ **Last updated:** [January 19, 2021, 2:53pm UTC](https://discuss.elastic.co/t/how-to-secure-communication-between-apm-agent-and-apm-server/261527 "2021-01-19T14:53:51Z")
I want to avoid that anyone can send anything to APM server port. Do you have any experience in this case? I case of communication between APM server and ELK we are using ssl certificates. Best Regads, Dan --- ## [\[ URLHaus threat intelligence \]: create a new rule](https://discuss.elastic.co/t/urlhaus-threat-intelligence-create-a-new-rule/260857)
**Author:** [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)\ **Replies:** 17\ **Last updated:** [January 19, 2021, 2:49pm UTC](https://discuss.elastic.co/t/urlhaus-threat-intelligence-create-a-new-rule/260857 "2021-01-19T14:49:23Z")
Hello, I am using logsatsh to enrich my SIEM with malicious Urls that I downloaded from URLHaus, and I wanna create a rule that send an alert everytime a user connect to one of the malicious urls. The problem is that … --- ## [Conflicting data between Index Dashboard and ML anomaly detection job](https://discuss.elastic.co/t/conflicting-data-between-index-dashboard-and-ml-anomaly-detection-job/261282)
**Author:** [@emad101](https://discuss.elastic.co/u/emad101)\ **Replies:** 6\ **Last updated:** [January 19, 2021, 2:45pm UTC](https://discuss.elastic.co/t/conflicting-data-between-index-dashboard-and-ml-anomaly-detection-job/261282 "2021-01-19T14:45:06Z")
Hello All, I am trying to create a watcher to detect a high volume of error records. When I check through the index it shows that there are no Data for Dec 20th and Jan 10th, however, the watcher detected that there are… --- ## [Logstash fails to start](https://discuss.elastic.co/t/logstash-fails-to-start/261558)
**Author:** [@karthik\_s2](https://discuss.elastic.co/u/karthik_s2)\ **Replies:** 0\ **Last updated:** [January 19, 2021, 2:32pm UTC](https://discuss.elastic.co/t/logstash-fails-to-start/261558 "2021-01-19T14:32:34Z")
When i tired to start with the command (logstash.bat -f logstash.conf) in the prompt. The below output is written and logstash doesn't start. Using JAVA\_HOME defined java: C:\\Program Files\\Java\\jdk1.8.0\_221; WARNING, … --- ## [Redundancy in logstash for syslog devices](https://discuss.elastic.co/t/redundancy-in-logstash-for-syslog-devices/261557)
**Author:** [@Atul\_Chadha](https://discuss.elastic.co/u/Atul_Chadha)\ **Replies:** 0\ **Last updated:** [January 19, 2021, 2:32pm UTC](https://discuss.elastic.co/t/redundancy-in-logstash-for-syslog-devices/261557 "2021-01-19T14:32:10Z")
We are in process of upgrading our ELK stack to 7.6 and i need suggestions on configuration for network devices ( Big IP LTM ) for example. The current config has one logstash IP as syslog server , in an event of failur… --- ## [Kibana Alerts issue](https://discuss.elastic.co/t/kibana-alerts-issue/261375)
**Author:** [@Sarmad](https://discuss.elastic.co/u/Sarmad)\ **Replies:** 3\ **Last updated:** [January 19, 2021, 2:25pm UTC](https://discuss.elastic.co/t/kibana-alerts-issue/261375 "2021-01-19T14:25:38Z")
Hi, I am trying to setup built-in kibana alerts (Stack management -\> Alerts) and have followed the same steps as mentioned in the documentation, but the kibana service doesn't run again when I reload it. Here are the k… --- ## [Custom Plugin in restricted network](https://discuss.elastic.co/t/custom-plugin-in-restricted-network/261556)
**Author:** [@mastersmit](https://discuss.elastic.co/u/mastersmit)\ **Replies:** 0\ **Last updated:** [January 19, 2021, 2:17pm UTC](https://discuss.elastic.co/t/custom-plugin-in-restricted-network/261556 "2021-01-19T14:17:52Z")
I was trying to write a custom plugin, however when i am trying to build bundle install it is saying unable to connect to online ruby gems. Is there a way to avoid going to the official source of ruby gems, as downloadi… --- ## [Logstash - replace @timestamp](https://discuss.elastic.co/t/logstash-replace-timestamp/261553)
**Author:** [@iccMe](https://discuss.elastic.co/u/iccMe)\ **Replies:** 2\ **Last updated:** [January 19, 2021, 2:16pm UTC](https://discuss.elastic.co/t/logstash-replace-timestamp/261553 "2021-01-19T14:16:49Z")
Hi, Looking for help with a date and time filter in logstash. I created a new Time field putting together a previous date and time field that I subsequently drop. The new Time field looks like the below in my output: "… --- ## [Why \`elastic-es-default-0\` (which is the pod name for my Elasticsearch) becomes a "host"?](https://discuss.elastic.co/t/why-elastic-es-default-0-which-is-the-pod-name-for-my-elasticsearch-becomes-a-host/261490)
**Author:** [@fzyzcjy](https://discuss.elastic.co/u/fzyzcjy)\ **Replies:** 1\ **Last updated:** [January 19, 2021, 2:12pm UTC](https://discuss.elastic.co/t/why-elastic-es-default-0-which-is-the-pod-name-for-my-elasticsearch-becomes-a-host/261490 "2021-01-19T14:12:08Z")
It behaves like a host... For example, see the screenshot. The test-one-01106 is a real kubernetes worker machine, but the elastic-es-default-0 is not... Thanks! [Previous page](https://discuss.elastic.co/latest.md?page=1884) [Next page](https://discuss.elastic.co/latest.md?page=1886)