# Latest **URL:** https://discuss.elastic.co/latest.md?page=1935 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1936 --- ## [Runing 2 different logstash config at the same time](https://discuss.elastic.co/t/runing-2-different-logstash-config-at-the-same-time/258889)
**Author:** [@Arezki76](https://discuss.elastic.co/u/Arezki76)\ **Replies:** 0\ **Last updated:** [December 16, 2020, 3:50pm UTC](https://discuss.elastic.co/t/runing-2-different-logstash-config-at-the-same-time/258889 "2020-12-16T15:50:26Z")
Hi, I have 2 different config files, one to track logs files, and another to interact with DB to build a dashboard. I want to start logstash for these 2 config files, to generates 2 differents indices. Can someone tel… --- ## [Split visualizations on Dynamic properties](https://discuss.elastic.co/t/split-visualizations-on-dynamic-properties/258812)
**Author:** [@Mohammed\_Farhan\_Ejaz](https://discuss.elastic.co/u/Mohammed_Farhan_Ejaz)\ **Replies:** 1\ **Last updated:** [December 16, 2020, 3:50pm UTC](https://discuss.elastic.co/t/split-visualizations-on-dynamic-properties/258812 "2020-12-16T15:50:21Z")
How can we split a visualization example, a vertical bar graph based on the properties of the document? I have multiple documents each with some dynamic properties example Document 1 { ... "requ… --- ## [Elasticsearch.service problem](https://discuss.elastic.co/t/elasticsearch-service-problem/258831)
**Author:** [@salva12](https://discuss.elastic.co/u/salva12)\ **Replies:** 3\ **Last updated:** [December 16, 2020, 3:44pm UTC](https://discuss.elastic.co/t/elasticsearch-service-problem/258831 "2020-12-16T15:44:43Z")
Dec 16 08:49:58 104-45-22-197.cprapid.com systemd-entrypoint\[18969\]: at org.elasticsearch.core.internal.io.IOUtils.close(IOUtils.java:99) Dec 16 08:49:58 104-45-22-197.cprapid.com systemd-entrypoint\[18969\]: at org.elasti… --- ## [Best practice for Engine Lifecycle Management in App Search](https://discuss.elastic.co/t/best-practice-for-engine-lifecycle-management-in-app-search/258179)
**Author:** [@ismarslomic](https://discuss.elastic.co/u/ismarslomic)\ **Replies:** 8\ **Last updated:** [December 16, 2020, 3:42pm UTC](https://discuss.elastic.co/t/best-practice-for-engine-lifecycle-management-in-app-search/258179 "2020-12-16T15:42:36Z")
I´m using App Search to create engine, write and read documents. So no direct interaction with Elasticsearch at all. The question is what would be the best practice to define "Engine Lifecycle Management"? I can´t see t… --- ## [Aggregation over a paginated query](https://discuss.elastic.co/t/aggregation-over-a-paginated-query/258792)
**Author:** [@solenom85](https://discuss.elastic.co/u/solenom85)\ **Replies:** 2\ **Last updated:** [December 16, 2020, 3:41pm UTC](https://discuss.elastic.co/t/aggregation-over-a-paginated-query/258792 "2020-12-16T15:41:47Z")
Hi. I have a question regarding to running an aggregation on a paginated query. For example, this query: { "size": 0, "from": 100, "query": { "match\_all": {} }, … --- ## [Change default page size in SearchProvider](https://discuss.elastic.co/t/change-default-page-size-in-searchprovider/258882)
**Author:** [@ismarslomic](https://discuss.elastic.co/u/ismarslomic)\ **Replies:** 1\ **Last updated:** [December 16, 2020, 3:27pm UTC](https://discuss.elastic.co/t/change-default-page-size-in-searchprovider/258882 "2020-12-16T15:27:46Z")
Is it possible to change the default page size (10 pages) in SearchProvider? I could not find any relevant Configuration option in the search-ui doc --- ## [Index lifecycle error, security\_exception: Adding an alias is not allowed when the alias has more permissions than any of the indices](https://discuss.elastic.co/t/index-lifecycle-error-security-exception-adding-an-alias-is-not-allowed-when-the-alias-has-more-permissions-than-any-of-the-indices/258275)
**Author:** [@SergiiZagrunnyi](https://discuss.elastic.co/u/SergiiZagrunnyi)\ **Replies:** 1\ **Last updated:** [December 16, 2020, 3:22pm UTC](https://discuss.elastic.co/t/index-lifecycle-error-security-exception-adding-an-alias-is-not-allowed-when-the-alias-has-more-permissions-than-any-of-the-indices/258275 "2020-12-16T15:22:00Z")
Hi here We have elastic cloud deployment and configured ILM for the APM indexes The policy fails on shrink action, failed step - aliases Its not clear why that happens and what can we do with that? ILM policy "apm… --- ## [Aggregates on collapse](https://discuss.elastic.co/t/aggregates-on-collapse/258883)
**Author:** [@Philh-gbg](https://discuss.elastic.co/u/Philh-gbg)\ **Replies:** 0\ **Last updated:** [December 16, 2020, 3:17pm UTC](https://discuss.elastic.co/t/aggregates-on-collapse/258883 "2020-12-16T15:17:33Z")
New user looking for help, I know that aggregates don't work on the collapse results but I can't seem to find a way to achieve the same affect directly. We have a relatively simple dataset that contains multiple entries … --- ## [Unable to create url using generated API Key](https://discuss.elastic.co/t/unable-to-create-url-using-generated-api-key/258844)
**Author:** [@Kfir\_Stri](https://discuss.elastic.co/u/Kfir_Stri)\ **Replies:** 3\ **Last updated:** [December 16, 2020, 3:00pm UTC](https://discuss.elastic.co/t/unable-to-create-url-using-generated-api-key/258844 "2020-12-16T15:00:43Z")
Hello :slight\_smile: I'm trying to generate a short url using the REST api, and trying to authenticate using an API key i've generated before, no matter which cluster roles or indices priviliges I specify in the API key… --- ## [Request for new output format on time duration field](https://discuss.elastic.co/t/request-for-new-output-format-on-time-duration-field/258870)
**Author:** [@gaz1](https://discuss.elastic.co/u/gaz1)\ **Replies:** 2\ **Last updated:** [December 16, 2020, 2:44pm UTC](https://discuss.elastic.co/t/request-for-new-output-format-on-time-duration-field/258870 "2020-12-16T14:44:56Z")
Hi there! I'm not sure where to post this so if someone knows a better place for this topic please let me know. I need to do some basic calculation and visualization on Kibana with this number format field (e.g. Avera… --- ## [Support for wso2-synapse](https://discuss.elastic.co/t/support-for-wso2-synapse/258862)
**Author:** [@jvkassi](https://discuss.elastic.co/u/jvkassi)\ **Replies:** 2\ **Last updated:** [December 16, 2020, 2:43pm UTC](https://discuss.elastic.co/t/support-for-wso2-synapse/258862 "2020-12-16T14:43:06Z")
Hello, I need to know if apm-agent-java can support wso2-synapse ? Here are the list of dependencies Do i need to upgrade the spring version or jetty ? or apache synapse ? There are many dependencies for this proj… --- ## [Watcher Schedule](https://discuss.elastic.co/t/watcher-schedule/258874)
**Author:** [@Farid\_N](https://discuss.elastic.co/u/Farid_N)\ **Replies:** 1\ **Last updated:** [December 16, 2020, 2:36pm UTC](https://discuss.elastic.co/t/watcher-schedule/258874 "2020-12-16T14:36:07Z")
Hi I wrote a watcher with this trigger: "trigger": { "schedule": { "daily": { "at": \[ "06:35" \] } } }, I just want this watcher run at 06:35 everyday morning. But whe… --- ## [Kibana reverse proxy](https://discuss.elastic.co/t/kibana-reverse-proxy/258856)
**Author:** [@vikram\_singh](https://discuss.elastic.co/u/vikram_singh)\ **Replies:** 4\ **Last updated:** [December 16, 2020, 2:26pm UTC](https://discuss.elastic.co/t/kibana-reverse-proxy/258856 "2020-12-16T14:26:30Z")
Hi, I am implementing apache reverse proxy on kibana. I want to make url http:url:5601/app/kibana to http:url/app/kibana. Thanks --- ## [「APM .NET Agent」の「ASP.NET」の設定方法](https://discuss.elastic.co/t/apm-net-agent-asp-net/258235)
**Author:** [@mukai](https://discuss.elastic.co/u/mukai)\ **Replies:** 3\ **Last updated:** [December 16, 2020, 2:09pm UTC](https://discuss.elastic.co/t/apm-net-agent-asp-net/258235 "2020-12-16T14:09:48Z")
こんにちは。 ASP.NET (Full .NET Framework)に、elasticのAPM Agentを導入したいと考えています。 関連する部分のドキュメントを見たのですが、他のソフトと違い詳細な手順が書かれておらず、うまく設定できません。 (何をダウンロードするか・具体的にどこの設定ファイルにどの様に書けば動作するかの例) 日本語・英語は問いませんので、何か参考になりそうな記事(実践例・手順書)がありまし… --- ## [How to parse the mod security log.. plz help](https://discuss.elastic.co/t/how-to-parse-the-mod-security-log-plz-help/258869)
**Author:** [@sujeetjha](https://discuss.elastic.co/u/sujeetjha)\ **Replies:** 0\ **Last updated:** [December 16, 2020, 1:58pm UTC](https://discuss.elastic.co/t/how-to-parse-the-mod-security-log-plz-help/258869 "2020-12-16T13:58:38Z")
hey i want to parse mod\_security log using logstash. when i have checked the logstash it is working fine. logstash.service - logstash Loaded: loaded (/etc/systemd/system/logstash.service; enabled; vendor preset: en… --- ## [How to search Kibana for abc="def" in message string](https://discuss.elastic.co/t/how-to-search-kibana-for-abc-def-in-message-string/258744)
**Author:** [@dbaddorf](https://discuss.elastic.co/u/dbaddorf)\ **Replies:** 2\ **Last updated:** [December 16, 2020, 1:32pm UTC](https://discuss.elastic.co/t/how-to-search-kibana-for-abc-def-in-message-string/258744 "2020-12-16T13:32:58Z")
I'm sure that this is a simple question, but I'm certainly a newbie. I can't seem to get the right syntax. I have syslog data in Elastic Search which looks like the following: message: \<190\>date=2020-12-15 time=12:17… --- ## [ELK 791 Docker compose and security](https://discuss.elastic.co/t/elk-791-docker-compose-and-security/258821)
**Author:** [@vincent2mots](https://discuss.elastic.co/u/vincent2mots)\ **Replies:** 1\ **Last updated:** [December 16, 2020, 12:57pm UTC](https://discuss.elastic.co/t/elk-791-docker-compose-and-security/258821 "2020-12-16T12:57:37Z")
Hi there! I would like to test the security functionnalities within a docker-compose stack. Here is my stack : version: '2' services: # Noeud nodeB1 nodeToutSeul: image: docker.elastic.co/elasticsearch/elastics… --- ## [ServiceNow Ticket data to ElasticSearch](https://discuss.elastic.co/t/servicenow-ticket-data-to-elasticsearch/258817)
**Author:** [@nottyheadedboss](https://discuss.elastic.co/u/nottyheadedboss)\ **Replies:** 4\ **Last updated:** [December 16, 2020, 10:59am UTC](https://discuss.elastic.co/t/servicenow-ticket-data-to-elasticsearch/258817 "2020-12-16T10:59:15Z")
Hi All I am a ElasticSearch noob... I am trying to upload data from ServiceNow to ElasticSearch... I am facing some issues with the data and the conf file I tried to take assistance from @Gauti who assisted me with the… --- ## [Matching a Dollar Sign with a Wildcard using KQL](https://discuss.elastic.co/t/matching-a-dollar-sign-with-a-wildcard-using-kql/258819)
**Author:** [@hpicass0](https://discuss.elastic.co/u/hpicass0)\ **Replies:** 1\ **Last updated:** [December 16, 2020, 12:43pm UTC](https://discuss.elastic.co/t/matching-a-dollar-sign-with-a-wildcard-using-kql/258819 "2020-12-16T12:43:18Z")
Hi, Hoping you guys are safe and well I'm trying to exclude any username that has $ at the end of it using Kibnana Query Language I've done a lot of testing with the following, but it doesn't seem to work and not us… --- ## [Source.keyboard in Kibana](https://discuss.elastic.co/t/source-keyboard-in-kibana/258850)
**Author:** [@DeerOnKeyboard](https://discuss.elastic.co/u/DeerOnKeyboard)\ **Replies:** 1\ **Last updated:** [December 16, 2020, 12:35pm UTC](https://discuss.elastic.co/t/source-keyboard-in-kibana/258850 "2020-12-16T12:35:00Z")
Hello everyone! Is the first time I use Kibana so I'm a bit lost. I'm trying to complete an assignment for university. I have to specify which sources are the tweets coming from. In logstash I configurated full\_tweet an… --- ## [Machine learning "actual" value doesn't match values displayed in a vizualization](https://discuss.elastic.co/t/machine-learning-actual-value-doesnt-match-values-displayed-in-a-vizualization/258658)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 7\ **Last updated:** [December 16, 2020, 12:27pm UTC](https://discuss.elastic.co/t/machine-learning-actual-value-doesnt-match-values-displayed-in-a-vizualization/258658 "2020-12-16T12:27:09Z")
In amonaly detection I get an actual value of "75.0" when I go to a visualization of the raw data I cant find that actual value, I was thinking that maybe the agregation was blurring the value, but I choose a smaller int… --- ## [Unable to convert string/text fields to integer](https://discuss.elastic.co/t/unable-to-convert-string-text-fields-to-integer/258788)
**Author:** [@Mauro\_Tridici](https://discuss.elastic.co/u/Mauro_Tridici)\ **Replies:** 0\ **Last updated:** [December 15, 2020, 10:25pm UTC](https://discuss.elastic.co/t/unable-to-convert-string-text-fields-to-integer/258788 "2020-12-15T22:25:17Z")
Dear All, two days ago I started using "Logstash exec plugin" to launch a bash script and save provided information in elasticsearch. At this moment, it seems working as expected, but I'm not able to convert "quota" an… --- ## [Is possible to get zabbix data to kibana dashboard](https://discuss.elastic.co/t/is-possible-to-get-zabbix-data-to-kibana-dashboard/258799)
**Author:** [@psganeshk](https://discuss.elastic.co/u/psganeshk)\ **Replies:** 3\ **Last updated:** [December 16, 2020, 12:05pm UTC](https://discuss.elastic.co/t/is-possible-to-get-zabbix-data-to-kibana-dashboard/258799 "2020-12-16T12:05:36Z")
Can you advise is possible to send data from zabbix agent to kibana dashboard --- ## [Logstash pipelines taking longer duration to start](https://discuss.elastic.co/t/logstash-pipelines-taking-longer-duration-to-start/258776)
**Author:** [@Sreekanth3](https://discuss.elastic.co/u/Sreekanth3)\ **Replies:** 2\ **Last updated:** [December 16, 2020, 11:38am UTC](https://discuss.elastic.co/t/logstash-pipelines-taking-longer-duration-to-start/258776 "2020-12-16T11:38:03Z")
Hi all, I am using a logstash with 8 pipelines and if restart the logstash it is taking around 45 minutes to get started and bound to 9600 port. The logstash version is 7.7.0 . I'm looking to optimize the logstash to … --- ## [Recover index from ../nodes/0/indices/ to new cluster](https://discuss.elastic.co/t/recover-index-from-nodes-0-indices-to-new-cluster/258836)
**Author:** [@heikis](https://discuss.elastic.co/u/heikis)\ **Replies:** 2\ **Last updated:** [December 16, 2020, 11:10am UTC](https://discuss.elastic.co/t/recover-index-from-nodes-0-indices-to-new-cluster/258836 "2020-12-16T11:10:15Z")
Hello. How complicated is it to recover an index that exists in ../nodes/0/indices/ ? For example I have the index data but the cluster that the index was related to is gone? Could I create a new cluster and reindex the… --- ## [Fundamentals of Securing Elasticsearch lab not working](https://discuss.elastic.co/t/fundamentals-of-securing-elasticsearch-lab-not-working/258849)
**Author:** [@Ambrotd](https://discuss.elastic.co/u/Ambrotd)\ **Replies:** 1\ **Last updated:** [December 16, 2020, 11:29am UTC](https://discuss.elastic.co/t/fundamentals-of-securing-elasticsearch-lab-not-working/258849 "2020-12-16T11:29:10Z")
Hi I am trying to connect to server1 as stated in the lab docu but it seems down I have tried to restart the enviroment like 5 times and the server1 is down. --- ## [Logstash is not working - mutate,remove\_field](https://discuss.elastic.co/t/logstash-is-not-working-mutate-remove-field/258852)
**Author:** [@KyungJin\_Joo](https://discuss.elastic.co/u/KyungJin_Joo)\ **Replies:** 0\ **Last updated:** [December 16, 2020, 11:10am UTC](https://discuss.elastic.co/t/logstash-is-not-working-mutate-remove-field/258852 "2020-12-16T11:10:59Z")
winlogbeat-my computer logstash-(GCP Compute Engine) Winlogbeat sends sysmon field from logstash. Filtering is as follows, It was written in a format that maps the ProcessCreate event. However, writing this way work… --- ## [Filebeat not sending logs anymore](https://discuss.elastic.co/t/filebeat-not-sending-logs-anymore/257246)
**Author:** [@toms130](https://discuss.elastic.co/u/toms130)\ **Replies:** 1\ **Last updated:** [December 16, 2020, 10:56am UTC](https://discuss.elastic.co/t/filebeat-not-sending-logs-anymore/257246 "2020-12-16T10:56:55Z")
Hi there, I've gor problem with a filebeat instance which ends to stop sending logs after smome time. Here is my setup : type: log enabled: true paths: - /opt/TalendRemoteEngine/TalendJobServersFiles/jobexecu… --- ## [Metricbeat AWS Module estimated costs](https://discuss.elastic.co/t/metricbeat-aws-module-estimated-costs/257863)
**Author:** [@Jurilz](https://discuss.elastic.co/u/Jurilz)\ **Replies:** 2\ **Last updated:** [December 16, 2020, 10:43am UTC](https://discuss.elastic.co/t/metricbeat-aws-module-estimated-costs/257863 "2020-12-16T10:43:53Z")
Good day, I'm thinking about the using metricbeats AWS module to collect and display metrics of one or several EC2 instances. And therefore I have to estimate the costs of AWS charges on CloudWatch API requests. Let's … --- ## [How to do match multiple nested object in one document with inner hits highlighted in elasticsearch](https://discuss.elastic.co/t/how-to-do-match-multiple-nested-object-in-one-document-with-inner-hits-highlighted-in-elasticsearch/258842)
**Author:** [@Code\_Wizard](https://discuss.elastic.co/u/Code_Wizard)\ **Replies:** 0\ **Last updated:** [December 16, 2020, 10:42am UTC](https://discuss.elastic.co/t/how-to-do-match-multiple-nested-object-in-one-document-with-inner-hits-highlighted-in-elasticsearch/258842 "2020-12-16T10:42:07Z")
How do I write a query with two search terms which matches nested objects with inner hits highlighted. Below is the sample usecase: I have a mapping: "mappings": { "properties": { "grocery\_name": { … [Previous page](https://discuss.elastic.co/latest.md?page=1934) [Next page](https://discuss.elastic.co/latest.md?page=1936)