# Latest **URL:** https://discuss.elastic.co/latest.md?page=1924 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1925 --- ## [Extract date from timestamp field](https://discuss.elastic.co/t/extract-date-from-timestamp-field/259349)
**Author:** [@anjali28](https://discuss.elastic.co/u/anjali28)\ **Replies:** 1\ **Last updated:** [December 23, 2020, 12:40am UTC](https://discuss.elastic.co/t/extract-date-from-timestamp-field/259349 "2020-12-23T00:40:03Z")
hello, i have a time field and i want to extract date from it in my elasticsearch sql query. Below is the format of time: 2020-01-11T02:13:00.000Z which function in elasticsearch sql query will extract the date from i… --- ## [Send log records with Filebeat over TCP](https://discuss.elastic.co/t/send-log-records-with-filebeat-over-tcp/259331)
**Author:** [@AClerk](https://discuss.elastic.co/u/AClerk)\ **Replies:** 4\ **Last updated:** [December 23, 2020, 12:19am UTC](https://discuss.elastic.co/t/send-log-records-with-filebeat-over-tcp/259331 "2020-12-23T00:19:46Z")
Is there a way to send filebeats output to a TCP socket? I have tried using output.logstash As written - The Logstash output sends events directly to Logstash by using the lumberjack protocol, which runs over TCP. But… --- ## [Fail to pass data from logstash to ES](https://discuss.elastic.co/t/fail-to-pass-data-from-logstash-to-es/259424)
**Author:** [@azteker](https://discuss.elastic.co/u/azteker)\ **Replies:** 1\ **Last updated:** [December 22, 2020, 11:59pm UTC](https://discuss.elastic.co/t/fail-to-pass-data-from-logstash-to-es/259424 "2020-12-22T23:59:29Z")
The output conf in the logstash conf file is output { elasticsearch { hosts =\> \["10.28.1.17:9200"\] index =\> "event-%{+YYYY.MM.dd}" } } I run the logstash in CLI with output as stdout {codec =\> rubyd… --- ## [Help creating a bar chart using split series percentages](https://discuss.elastic.co/t/help-creating-a-bar-chart-using-split-series-percentages/259400)
**Author:** [@brookeharrislowing](https://discuss.elastic.co/u/brookeharrislowing)\ **Replies:** 2\ **Last updated:** [December 22, 2020, 11:29pm UTC](https://discuss.elastic.co/t/help-creating-a-bar-chart-using-split-series-percentages/259400 "2020-12-22T23:29:44Z")
Hi there, I am trying to make a bar graph that is split by region, showing the relevant percentage for each region. However, all of my bars come out at 100% with a legend detailing their actual percentages. I would like… --- ## [Ignore\_malformed fires mapper\_parsing\_exception for keyword type on 7.10.1 (it worked on 7.1.0)](https://discuss.elastic.co/t/ignore-malformed-fires-mapper-parsing-exception-for-keyword-type-on-7-10-1-it-worked-on-7-1-0/259142)
**Author:** [@DevFullStack](https://discuss.elastic.co/u/DevFullStack)\ **Replies:** 9\ **Last updated:** [December 22, 2020, 11:13pm UTC](https://discuss.elastic.co/t/ignore-malformed-fires-mapper-parsing-exception-for-keyword-type-on-7-10-1-it-worked-on-7-1-0/259142 "2020-12-22T23:13:04Z")
This may be a breaking change in v.7.4+ that apparently was not documented. Any thoughts on how to solve this issue with an upgrade on a logs analysis use case? The docs about the ignore\_malformed mapping parameter hav… --- ## [How can I remove the color bar from Top N?](https://discuss.elastic.co/t/how-can-i-remove-the-color-bar-from-top-n/259308)
**Author:** [@larrya](https://discuss.elastic.co/u/larrya)\ **Replies:** 3\ **Last updated:** [December 22, 2020, 11:11pm UTC](https://discuss.elastic.co/t/how-can-i-remove-the-color-bar-from-top-n/259308 "2020-12-22T23:11:30Z")
I am using TSVB on Kibana 7.4.2 to show a list of tests and their pass rate using Filter Ratio. Using Top N this list displays the test name, color bar, and pass rate, sorted by pass rate. The names of the tests are trun… --- ## [Filebeat - Force filebeat to read custom log from different pod paths](https://discuss.elastic.co/t/filebeat-force-filebeat-to-read-custom-log-from-different-pod-paths/259320)
**Author:** [@David\_Fachini](https://discuss.elastic.co/u/David_Fachini)\ **Replies:** 6\ **Last updated:** [December 22, 2020, 10:41pm UTC](https://discuss.elastic.co/t/filebeat-force-filebeat-to-read-custom-log-from-different-pod-paths/259320 "2020-12-22T22:41:08Z")
Hello, using Elastic + Filebeat + kibana in kubernetes. I have a lot of products running in cluster (apache kafka, apache druid, postgresql). Checking filebeat behavior it harvest logs from /var/lib/docker/containers/ … --- ## [Elastic-Agent Install Creating a ton of folders](https://discuss.elastic.co/t/elastic-agent-install-creating-a-ton-of-folders/257421)
**Author:** [@cwobuzz](https://discuss.elastic.co/u/cwobuzz)\ **Replies:** 2\ **Last updated:** [December 22, 2020, 10:17pm UTC](https://discuss.elastic.co/t/elastic-agent-install-creating-a-ton-of-folders/257421 "2020-12-22T22:17:15Z")
I got the elastic-agent to enroll using the follow command \>elastic-agent enroll https://localhost:5601 bHRPdUlIWUJSMzJvZjZwSktjbzQ6QUY0SmpvNFZSY1MxMUZCSk82S3ZRQQ -a \\\\wsl$\\docker-desktop-data\\version-pack-data\\communit… --- ## [Logstash doesn't remove proceed gz files](https://discuss.elastic.co/t/logstash-doesnt-remove-proceed-gz-files/259347)
**Author:** [@snowline](https://discuss.elastic.co/u/snowline)\ **Replies:** 4\ **Last updated:** [December 22, 2020, 9:46pm UTC](https://discuss.elastic.co/t/logstash-doesnt-remove-proceed-gz-files/259347 "2020-12-22T21:46:11Z")
I've setup logstash as file reader for \*.gz log files in "read" mode. These files are copied from remote server to local folders every 15 minutes under user logstash. Files and folders have owner "logstash" and mode - … --- ## [Dec 20th, 2020: \[RU\] Разведочный анализ данных с Kibana](https://discuss.elastic.co/t/dec-20th-2020-ru-kibana/258244)
**Author:** [@raya](https://discuss.elastic.co/u/raya)\ **Replies:** 0\ **Last updated:** [December 20, 2020, 8:00am UTC](https://discuss.elastic.co/t/dec-20th-2020-ru-kibana/258244 "2020-12-20T08:00:19Z")
English version Специалисты в области визуализации данных часто говорят о двух типах визуализаций: разведочных и объяснительных. В Википедии разведочные визуализации описаны как “анализ основных свойств данных, нахожден… --- ## [Elasticsearch Active Directory Configuration Errors- User authentication](https://discuss.elastic.co/t/elasticsearch-active-directory-configuration-errors-user-authentication/259294)
**Author:** [@linfordwoode](https://discuss.elastic.co/u/linfordwoode)\ **Replies:** 5\ **Last updated:** [December 22, 2020, 8:51pm UTC](https://discuss.elastic.co/t/elasticsearch-active-directory-configuration-errors-user-authentication/259294 "2020-12-22T20:51:16Z")
Hello, I have been stuck on this for a couple of days now. I have tried several options from the forum but I still can't get it to work. Used this documentation https://www.elastic.co/guide/en/elasticsearch/reference/cu… --- ## [\[Ingest Node\] pipeline with id \[x\] does not exist (solved)](https://discuss.elastic.co/t/ingest-node-pipeline-with-id-x-does-not-exist-solved/54436)
**Author:** [@PatrickKik](https://discuss.elastic.co/u/PatrickKik)\ **Replies:** 13\ **Last updated:** [December 22, 2020, 8:10pm UTC](https://discuss.elastic.co/t/ingest-node-pipeline-with-id-x-does-not-exist-solved/54436 "2020-12-22T20:10:32Z")
SOLVED Just minutes before the release of 5.0.0-alpha4 I found this bug. I tried it in \`5.0.0-alpha4' and it works fine. That's nice. But it still feels like I have lost some time... :weary: I'm using elasticsearch-5.… --- ## [When a JDBC input start, drops the previous if not completed?](https://discuss.elastic.co/t/when-a-jdbc-input-start-drops-the-previous-if-not-completed/259416)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 3\ **Last updated:** [December 22, 2020, 8:01pm UTC](https://discuss.elastic.co/t/when-a-jdbc-input-start-drops-the-previous-if-not-completed/259416 "2020-12-22T20:01:31Z")
Lets say I got to index data from a week ago, and I use a schedule of 5 minutes in JDB input, and the data of a week cant be indexed in those 5 minutes, the data ingestion will be stopped at five minutes, and start agai… --- ## [Installing all of the Rules from GitHub](https://discuss.elastic.co/t/installing-all-of-the-rules-from-github/259304)
**Author:** [@AirJordan](https://discuss.elastic.co/u/AirJordan)\ **Replies:** 2\ **Last updated:** [December 22, 2020, 7:25pm UTC](https://discuss.elastic.co/t/installing-all-of-the-rules-from-github/259304 "2020-12-22T19:25:41Z")
I see there is a https://github.com/elastic/detection-rules. It seems like when I installed Endpoint Security and did generate rules it created a lot of the rules. Yeah some are still missing. Is there a way to get the l… --- ## [How to only send an alert when severity is high](https://discuss.elastic.co/t/how-to-only-send-an-alert-when-severity-is-high/259263)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 5\ **Last updated:** [December 22, 2020, 6:40pm UTC](https://discuss.elastic.co/t/how-to-only-send-an-alert-when-severity-is-high/259263 "2020-12-22T18:40:59Z")
Hello, So I created this rule that triggers on Azure risky signins: Ans as you can see I made an override for the azure.signinlogs.properties.risk\_level\_during\_signin field. But now the alert I configured triggers o… --- ## [Searching then sorting in a multi-indices search](https://discuss.elastic.co/t/searching-then-sorting-in-a-multi-indices-search/259419)
**Author:** [@Chris\_Grim](https://discuss.elastic.co/u/Chris_Grim)\ **Replies:** 0\ **Last updated:** [December 22, 2020, 6:31pm UTC](https://discuss.elastic.co/t/searching-then-sorting-in-a-multi-indices-search/259419 "2020-12-22T18:31:08Z")
Hi, I am trying to create a general search on my site that users can start typing in a name and it will search three indices, an event, an organizer and a city list. Currently I have GET /events,city\_lists,organizers/\_… --- ## [Elasticsearch docker-entrypoint.sh script overwrite](https://discuss.elastic.co/t/elasticsearch-docker-entrypoint-sh-script-overwrite/259414)
**Author:** [@NK2812](https://discuss.elastic.co/u/NK2812)\ **Replies:** 0\ **Last updated:** [December 22, 2020, 6:07pm UTC](https://discuss.elastic.co/t/elasticsearch-docker-entrypoint-sh-script-overwrite/259414 "2020-12-22T18:07:08Z")
Hi, I need to run few commands when container starts, so I would like add those commands in docker-entrypoint.sh script. I am using Elasticsearch version 7.9.2, I tried to create the cluster without adding my custom co… --- ## [GROK Help This setting must be a hash](https://discuss.elastic.co/t/grok-help-this-setting-must-be-a-hash/259408)
**Author:** [@fastxl](https://discuss.elastic.co/u/fastxl)\ **Replies:** 1\ **Last updated:** [December 22, 2020, 4:55pm UTC](https://discuss.elastic.co/t/grok-help-this-setting-must-be-a-hash/259408 "2020-12-22T16:55:34Z")
Need help trying to break down some data. This is the data being sent {"timestamp": "2020-11-17T19:02:19.352Z","sequence": 2460137,"deviceName": "OKUMA.MachiningCenterMA650-EAST","deviceUUID": "OKUMA.MachiningCenterMA65… --- ## [Trace http\_request problem](https://discuss.elastic.co/t/trace-http-request-problem/259410)
**Author:** [@bayucandra](https://discuss.elastic.co/u/bayucandra)\ **Replies:** 0\ **Last updated:** [December 22, 2020, 4:37pm UTC](https://discuss.elastic.co/t/trace-http-request-problem/259410 "2020-12-22T16:37:58Z")
Hi, I am an elastic cloud user with a budgeted cluster :slight\_smile: Could someone please help me, how to find out which requests to my Elastic search cluster which causing the following problem: { "statusCod… --- ## [Error: Failed to start Filebeat sends log files to Logstash or directly to Elasticsearch](https://discuss.elastic.co/t/error-failed-to-start-filebeat-sends-log-files-to-logstash-or-directly-to-elasticsearch/259409)
**Author:** [@Jonathan\_Davis](https://discuss.elastic.co/u/Jonathan_Davis)\ **Replies:** 0\ **Last updated:** [December 22, 2020, 4:35pm UTC](https://discuss.elastic.co/t/error-failed-to-start-filebeat-sends-log-files-to-logstash-or-directly-to-elasticsearch/259409 "2020-12-22T16:35:22Z")
Good time of the day! I have got a problem with a launch of Filebeat. It doen't want to start. Here is a text of error: '''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''… --- ## [Logstash crashing](https://discuss.elastic.co/t/logstash-crashing/259403)
**Author:** [@lquin1978](https://discuss.elastic.co/u/lquin1978)\ **Replies:** 1\ **Last updated:** [December 22, 2020, 4:19pm UTC](https://discuss.elastic.co/t/logstash-crashing/259403 "2020-12-22T16:19:06Z")
We have just started getting the following error \[2020-12-22T15:57:08,056\]\[ERROR\]\[logstash.javapipeline \]\[main\] Pipeline worker error, the pipeline will be stopped {:pipeline\_id=\>"main", :error=\>"", :exception=\>Java:… --- ## [Filebeat F5 AFM Module Log Format](https://discuss.elastic.co/t/filebeat-f5-afm-module-log-format/259106)
**Author:** [@cyber\_crab](https://discuss.elastic.co/u/cyber_crab)\ **Replies:** 4\ **Last updated:** [December 22, 2020, 4:15pm UTC](https://discuss.elastic.co/t/filebeat-f5-afm-module-log-format/259106 "2020-12-22T16:15:56Z")
We're currently trying to get the bigipafm fileset in the F5 module to parse the logs that are incoming from the F5 appliance. The documentation is missing the required log format, as well as the F5 AFM versions that are… --- ## [Curl argument list too long](https://discuss.elastic.co/t/curl-argument-list-too-long/259407)
**Author:** [@Pankaj\_Jadhav](https://discuss.elastic.co/u/Pankaj_Jadhav)\ **Replies:** 0\ **Last updated:** [December 22, 2020, 4:13pm UTC](https://discuss.elastic.co/t/curl-argument-list-too-long/259407 "2020-12-22T16:13:43Z")
mapping=(\ **Author:** [@aerodynamic](https://discuss.elastic.co/u/aerodynamic)\ **Replies:** 0\ **Last updated:** [December 22, 2020, 3:59pm UTC](https://discuss.elastic.co/t/nested-for-loop-in-logstash-calling-logstash-filters-from-ruby/259404 "2020-12-22T15:59:43Z") Hello, Currenly I'm dealing with a development roadblock to shorten a pipeline config. The logic in any other programming language would be a nested for loop. An iteration over values on array A for each value in array… --- ## [Data Stream has empty index](https://discuss.elastic.co/t/data-stream-has-empty-index/259292)
**Author:** [@Jurilz](https://discuss.elastic.co/u/Jurilz)\ **Replies:** 1\ **Last updated:** [December 22, 2020, 3:18pm UTC](https://discuss.elastic.co/t/data-stream-has-empty-index/259292 "2020-12-22T15:18:06Z")
Good day, I'm currently trying to configure and use lifecycle policies for my indices and was following this instruction (https://www.elastic.co/guide/en/elasticsearch/reference/current/set-up-lifecycle-policy.html). A… --- ## [Merge data from several csv sources](https://discuss.elastic.co/t/merge-data-from-several-csv-sources/259381)
**Author:** [@MickD](https://discuss.elastic.co/u/MickD)\ **Replies:** 4\ **Last updated:** [December 22, 2020, 3:16pm UTC](https://discuss.elastic.co/t/merge-data-from-several-csv-sources/259381 "2020-12-22T15:16:36Z")
Hello, I'm new to ELK so please apologies if my question is trivial. I have 3 CSV files with data that I would like to merge. In each file, each row represent a data which can be father or child of a row in another fi… --- ## [Problem creating a template 7.5](https://discuss.elastic.co/t/problem-creating-a-template-7-5/259397)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 2\ **Last updated:** [December 22, 2020, 3:00pm UTC](https://discuss.elastic.co/t/problem-creating-a-template-7-5/259397 "2020-12-22T15:00:54Z")
Hi, when I try to create an index template I get this error, I have checked multiple times and seems to be all ok. { "error": { "root\_cause": \[ { "type": "parse\_exception", "reason": "unknown… --- ## [Index template](https://discuss.elastic.co/t/index-template/259161)
**Author:** [@Norman\_Khine](https://discuss.elastic.co/u/Norman_Khine)\ **Replies:** 4\ **Last updated:** [December 22, 2020, 2:45pm UTC](https://discuss.elastic.co/t/index-template/259161 "2020-12-22T14:45:30Z")
Hello, i have the following template for one of my indexes: PUT \_template/template\_analytics-prod { "index\_patterns": \[ "analytics-prod-\*" \], "settings": { "number\_of\_shards": 2, "number\_of\_replicas": … --- ## [WatcherのActionで時刻を扱う方法](https://discuss.elastic.co/t/watcher-action/259332)
**Author:** [@t-nakata](https://discuss.elastic.co/u/t-nakata)\ **Replies:** 1\ **Last updated:** [December 22, 2020, 2:44pm UTC](https://discuss.elastic.co/t/watcher-action/259332 "2020-12-22T14:44:44Z")
KibanaのWatcherを使用し、特定条件下でEメールを送信するような以下のActionの定義を行っています "actions": { "send\_email": { "email": { "profile": "standard", "to": \[ "XXXXX@XXX.com" \], "subject": "XXXXX"… --- ## [Filebeat Fortinet have error message](https://discuss.elastic.co/t/filebeat-fortinet-have-error-message/258261)
**Author:** [@fadjar340](https://discuss.elastic.co/u/fadjar340)\ **Replies:** 7\ **Last updated:** [December 22, 2020, 2:34pm UTC](https://discuss.elastic.co/t/filebeat-fortinet-have-error-message/258261 "2020-12-22T14:34:04Z")
Hi @P1llus, I saw you're the person that give more comment on Filebeat Fortinet module, so I directly ask for help. I just send my fortinet log into my rsyslog server and save it into the file then I enabled the fortin… [Previous page](https://discuss.elastic.co/latest.md?page=1923) [Next page](https://discuss.elastic.co/latest.md?page=1925)