# Latest **URL:** https://discuss.elastic.co/latest.md?page=1975 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1976 --- ## [Taking care of syslog PRI header in filter](https://discuss.elastic.co/t/taking-care-of-syslog-pri-header-in-filter/256732)
**Author:** [@Elitlogik](https://discuss.elastic.co/u/Elitlogik)\ **Replies:** 0\ **Last updated:** [November 26, 2020, 7:53am UTC](https://discuss.elastic.co/t/taking-care-of-syslog-pri-header-in-filter/256732 "2020-11-26T07:53:36Z")
I use kv filter on a syslog data on the form key1=value1 key2=value2 etc. However, every syslog row has a leading PRI header of key1=value1. Is there a way to: Parse the pri header and all key-value pairs. Remove… --- ## [Kibana development - migrate/upgrade plugins from 7.3.x to 7.9.x](https://discuss.elastic.co/t/kibana-development-migrate-upgrade-plugins-from-7-3-x-to-7-9-x/251741)
**Author:** [@tsvet](https://discuss.elastic.co/u/tsvet)\ **Replies:** 19\ **Last updated:** [November 26, 2020, 7:53am UTC](https://discuss.elastic.co/t/kibana-development-migrate-upgrade-plugins-from-7-3-x-to-7-9-x/251741 "2020-11-26T07:53:24Z")
Hi, I have custom plugins that are compatible with Kibana 7.3.2 . And usually moving from one version to another is not that hard (especially if it is not a major release). I have read that for version 7.9+ there is a … --- ## [How can I set x-opaque-id when I use es-sql？](https://discuss.elastic.co/t/how-can-i-set-x-opaque-id-when-i-use-es-sql/256065)
**Author:** [@ITzhangqiang](https://discuss.elastic.co/u/ITzhangqiang)\ **Replies:** 4\ **Last updated:** [November 26, 2020, 7:38am UTC](https://discuss.elastic.co/t/how-can-i-set-x-opaque-id-when-i-use-es-sql/256065 "2020-11-26T07:38:19Z")
Hi,all How can I set x-opaque-id when I use es-sql？ --- ## [Pipeline with id does not exist](https://discuss.elastic.co/t/pipeline-with-id-does-not-exist/256689)
**Author:** [@Integration](https://discuss.elastic.co/u/Integration)\ **Replies:** 2\ **Last updated:** [November 26, 2020, 7:32am UTC](https://discuss.elastic.co/t/pipeline-with-id-does-not-exist/256689 "2020-11-26T07:32:37Z")
Hello, I'm trying to configure my filebeat.yml file with a pipeline that I created, and it's not working. I created the pipeline using Ingest Node Pipelines on the ElasticSearch UI. I get this error: 'pipeline with i… --- ## [Ошибка при обновлении ElasticSearch](https://discuss.elastic.co/t/elasticsearch/256620)
**Author:** [@Jhonny-2005](https://discuss.elastic.co/u/Jhonny-2005)\ **Replies:** 2\ **Last updated:** [November 26, 2020, 6:01am UTC](https://discuss.elastic.co/t/elasticsearch/256620 "2020-11-26T06:01:25Z")
При обновлении ElasticSearch с 7.9.0 на 7.10.0 возникает ошибка. С чем может быть связано? Ранее таких ошибок не было. Что-то изменилось? $ sudo dpkg -i elasticsearch-7.10.0-amd64.deb (Reading database ... 203772 files … --- ## [How do I set number of replica to zero in metricbeat?](https://discuss.elastic.co/t/how-do-i-set-number-of-replica-to-zero-in-metricbeat/256618)
**Author:** [@Webtrend\_Inc](https://discuss.elastic.co/u/Webtrend_Inc)\ **Replies:** 1\ **Last updated:** [November 26, 2020, 5:52am UTC](https://discuss.elastic.co/t/how-do-i-set-number-of-replica-to-zero-in-metricbeat/256618 "2020-11-26T05:52:05Z")
I have only 1 node cluster and hence I need only 1 shard and 0 replica for all my indices. I cannot set the number of replica to 0 for metricbeat index. My yml file looks like this: setup.template.name: "metricbeat"… --- ## [What config will need to send mail using log4j.property settings in logstash?](https://discuss.elastic.co/t/what-config-will-need-to-send-mail-using-log4j-property-settings-in-logstash/256481)
**Author:** [@talbehat](https://discuss.elastic.co/u/talbehat)\ **Replies:** 4\ **Last updated:** [November 26, 2020, 5:51am UTC](https://discuss.elastic.co/t/what-config-will-need-to-send-mail-using-log4j-property-settings-in-logstash/256481 "2020-11-26T05:51:28Z")
currently logstash create plain.log, how can send mail using log4j2.property file. any idea? --- ## [Auditbeat chroot jail support](https://discuss.elastic.co/t/auditbeat-chroot-jail-support/256677)
**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Replies:** 1\ **Last updated:** [November 26, 2020, 5:45am UTC](https://discuss.elastic.co/t/auditbeat-chroot-jail-support/256677 "2020-11-26T05:45:23Z")
Hi All, I was wondering if there is any documentation on getting Auditbeat to collect information from chroot jails? Based on how chroot jails work, it doesn't seem like there is a straight forward way of getting Auditb… --- ## [Kibana alerts on Resolution](https://discuss.elastic.co/t/kibana-alerts-on-resolution/255396)
**Author:** [@Basilis\_Ch](https://discuss.elastic.co/u/Basilis_Ch)\ **Replies:** 1\ **Last updated:** [November 26, 2020, 5:37am UTC](https://discuss.elastic.co/t/kibana-alerts-on-resolution/255396 "2020-11-26T05:37:04Z")
I can read in the documentation: Kibana alerts tracks and persists the state of each detected condition through alert instances . This makes it possible to mute and throttle individual instances, and detect changes in s… --- ## [Kibana Alerts vs Watcher](https://discuss.elastic.co/t/kibana-alerts-vs-watcher/256551)
**Author:** [@fran6ssl](https://discuss.elastic.co/u/fran6ssl)\ **Replies:** 2\ **Last updated:** [November 26, 2020, 5:31am UTC](https://discuss.elastic.co/t/kibana-alerts-vs-watcher/256551 "2020-11-26T05:31:57Z")
Hi, I would like to know what is included with Kibana Alerts in the Basic Plan ? I need to setup email alerts when certain conditions are met. For exemple, send an email when a new log entry exists where the user ha… --- ## [KIbana indicies always missing by a random time](https://discuss.elastic.co/t/kibana-indicies-always-missing-by-a-random-time/256624)
**Author:** [@Junedi\_Rajagukguk](https://discuss.elastic.co/u/Junedi_Rajagukguk)\ **Replies:** 2\ **Last updated:** [November 26, 2020, 5:26am UTC](https://discuss.elastic.co/t/kibana-indicies-always-missing-by-a-random-time/256624 "2020-11-26T05:26:36Z")
Hi i still cant find the solution for this issue, can anybody help me. my indices always reset, so i always miss logdata in kibana for the past days, even the data in log servers still exist. here the configuration … --- ## [Enable HTTPS on Kibana on Docker](https://discuss.elastic.co/t/enable-https-on-kibana-on-docker/256139)
**Author:** [@Elitlogik](https://discuss.elastic.co/u/Elitlogik)\ **Replies:** 2\ **Last updated:** [November 26, 2020, 5:19am UTC](https://discuss.elastic.co/t/enable-https-on-kibana-on-docker/256139 "2020-11-26T05:19:09Z")
I've used this for deploying the ELK: https://github.com/deviantony/docker-elk I have my cert and private key, but I have no idea where to store them and how to write the path according to this: https://www.elastic.co/g… --- ## [Logstashでログメッセージが欠損している可能性について](https://discuss.elastic.co/t/logstash/255795)
**Author:** [@Tasu](https://discuss.elastic.co/u/Tasu)\ **Replies:** 3\ **Last updated:** [November 26, 2020, 4:55am UTC](https://discuss.elastic.co/t/logstash/255795 "2020-11-26T04:55:08Z")
Filebeat,Logstash,Elasticserchを使用してAPサーバで発行するログをログ管理サーバで取得しているのですが、APサーバで発行したログ数と、ElasticSearchに取り込まれたログ数が一致しないという事象が発生しています。ElasticSearchのメモリを増強しましたが事象が解決せず、Logstashが問題なのではないかと考えているのですが、原因が特定できていません。どなたかアドバイス頂けないでしょうか？ … --- ## [Kibana 7.10 - Error connecting to package registry](https://discuss.elastic.co/t/kibana-7-10-error-connecting-to-package-registry/256701)
**Author:** [@teej](https://discuss.elastic.co/u/teej)\ **Replies:** 2\ **Last updated:** [November 26, 2020, 4:53am UTC](https://discuss.elastic.co/t/kibana-7-10-error-connecting-to-package-registry/256701 "2020-11-26T04:53:15Z")
Currently running Kibana 7.10 and the logs are getting filled with the following message: "error","plugins","ingestManager"\],"pid":11460,"message":"Error connecting to package registry: request to https://epr.elastic.c… --- ## [Search for dinamically field name in dashboard](https://discuss.elastic.co/t/search-for-dinamically-field-name-in-dashboard/256713)
**Author:** [@Philippe\_Geraldeli\_A](https://discuss.elastic.co/u/Philippe_Geraldeli_A)\ **Replies:** 1\ **Last updated:** [November 26, 2020, 4:44am UTC](https://discuss.elastic.co/t/search-for-dinamically-field-name-in-dashboard/256713 "2020-11-26T04:44:01Z")
I'm using kibana 6.2 and because of the problem that arrays are not well supported, i changed my json like that: {"array1" : \[ { "array2" : \[ {"nam… --- ## [Too Many Scroll Context ERROR but found no active scroll context](https://discuss.elastic.co/t/too-many-scroll-context-error-but-found-no-active-scroll-context/256598)
**Author:** [@zchar](https://discuss.elastic.co/u/zchar)\ **Replies:** 1\ **Last updated:** [November 26, 2020, 3:34am UTC](https://discuss.elastic.co/t/too-many-scroll-context-error-but-found-no-active-scroll-context/256598 "2020-11-26T03:34:33Z")
Hi team, Recently, I upgraded my ES cluster from 7.4.2 to 7.6.2. Then I found "Too Many Scroll Context ..." error always occurred and scroll search is not available on my cluster. I followed the exception tips and turn… --- ## [When i add extended.plugins=lang-mustache in plugin-descriptor.properties im getting below error](https://discuss.elastic.co/t/when-i-add-extended-plugins-lang-mustache-in-plugin-descriptor-properties-im-getting-below-error/256439)
**Author:** [@rakeshdkaatkar](https://discuss.elastic.co/u/rakeshdkaatkar)\ **Replies:** 1\ **Last updated:** [November 26, 2020, 1:16am UTC](https://discuss.elastic.co/t/when-i-add-extended-plugins-lang-mustache-in-plugin-descriptor-properties-im-getting-below-error/256439 "2020-11-26T01:16:38Z")
java.lang.IllegalStateException: Plugin \[search-engine-plugin\] cannot extend non-extensible plugin \[lang-mustache\] at org.elasticsearch.plugins.PluginsService.loadBundle(PluginsService.java:624) at org.elasticsearch.pl… --- ## [Upgrade to 7.10 new beats writing to former indices/index patterns?](https://discuss.elastic.co/t/upgrade-to-7-10-new-beats-writing-to-former-indices-index-patterns/256719)
**Author:** [@rgeisman](https://discuss.elastic.co/u/rgeisman)\ **Replies:** 0\ **Last updated:** [November 26, 2020, 12:10am UTC](https://discuss.elastic.co/t/upgrade-to-7-10-new-beats-writing-to-former-indices-index-patterns/256719 "2020-11-26T00:10:18Z")
Hello all. I just upgraded the Elastic stack we have across the board to 7.10. Logstash and 5 Elastic nodes with auditbeat, metricbeat, and filebeat. After upgrade I took the necessary steps and stopped the output to … --- ## [Stopping automatic update of beats via public elasticsearch reop](https://discuss.elastic.co/t/stopping-automatic-update-of-beats-via-public-elasticsearch-reop/255908)
**Author:** [@rgeisman](https://discuss.elastic.co/u/rgeisman)\ **Replies:** 2\ **Last updated:** [November 26, 2020, 12:03am UTC](https://discuss.elastic.co/t/stopping-automatic-update-of-beats-via-public-elasticsearch-reop/255908 "2020-11-26T00:03:08Z")
Hello all. When we first installed ELK on our series of boxes the external Elasticsearch repo was used for Linux and installed. Unfortunately we are seeing that the beats on this box (Metricbeat, etc) are updating ON T… --- ## [Date Mapping Parse Failure](https://discuss.elastic.co/t/date-mapping-parse-failure/256469)
**Author:** [@nara1](https://discuss.elastic.co/u/nara1)\ **Replies:** 2\ **Last updated:** [November 25, 2020, 11:29pm UTC](https://discuss.elastic.co/t/date-mapping-parse-failure/256469 "2020-11-25T23:29:50Z")
Hello there, I am trying to send a date in the format 2020-10-29T05:36:06.143Z\[UTC\]. My mapping looks like this: "timeStamp": { "type": "date" } And I am getting the following error: Elasticsearch excep… --- ## [Data\_detection setting in the ECS index template](https://discuss.elastic.co/t/data-detection-setting-in-the-ecs-index-template/256715)
**Author:** [@Chris\_Stone](https://discuss.elastic.co/u/Chris_Stone)\ **Replies:** 1\ **Last updated:** [November 25, 2020, 11:07pm UTC](https://discuss.elastic.co/t/data-detection-setting-in-the-ecs-index-template/256715 "2020-11-25T23:07:08Z")
Hi, I posted first in the Logstash category, and it looks like this might be more Elasticsearch related... I am collecting http access logs and wanting to place some date headers into date type fields. I've tried a coup… --- ## [Vega Kibana Tree Visualization ignore missing parent node](https://discuss.elastic.co/t/vega-kibana-tree-visualization-ignore-missing-parent-node/256712)
**Author:** [@ejmath12](https://discuss.elastic.co/u/ejmath12)\ **Replies:** 3\ **Last updated:** [November 25, 2020, 9:34pm UTC](https://discuss.elastic.co/t/vega-kibana-tree-visualization-ignore-missing-parent-node/256712 "2020-11-25T21:34:32Z")
Is there a way to gracefully handle missing parent node in kibana/vega tree visualization? For example, if the below json represents data, since X is non existent parent is it possible to ignore that link? \[ {"id": "A… --- ## [Date type fields not being created though date format conversion works](https://discuss.elastic.co/t/date-type-fields-not-being-created-though-date-format-conversion-works/256709)
**Author:** [@Chris\_Stone](https://discuss.elastic.co/u/Chris_Stone)\ **Replies:** 2\ **Last updated:** [November 25, 2020, 8:21pm UTC](https://discuss.elastic.co/t/date-type-fields-not-being-created-though-date-format-conversion-works/256709 "2020-11-25T20:21:50Z")
Hi, I am collecting http access logs and wanting to place some date headers into date type fields. I've tried a couple of things, shown below, but while the date format is converted properly, the resulting field is still… --- ## [Problem with deployment docker-compose](https://discuss.elastic.co/t/problem-with-deployment-docker-compose/256678)
**Author:** [@javig12](https://discuss.elastic.co/u/javig12)\ **Replies:** 1\ **Last updated:** [November 25, 2020, 8:18pm UTC](https://discuss.elastic.co/t/problem-with-deployment-docker-compose/256678 "2020-11-25T20:18:41Z")
Hello Community, I got this error: kib01 | 2020-11-25T15:23:45.708146631Z {"type":"log","@timestamp":"2020-11-25T15:23:45Z","tags":\["warning","elasticsearch","monitoring"\],"pid":6,"message":"Unable to revive connect… --- ## [RequestElaspedTime](https://discuss.elastic.co/t/requestelaspedtime/256369)
**Author:** [@dfoot](https://discuss.elastic.co/u/dfoot)\ **Replies:** 8\ **Last updated:** [November 25, 2020, 8:01pm UTC](https://discuss.elastic.co/t/requestelaspedtime/256369 "2020-11-25T20:01:25Z")
Recently upgraded log message include field requestElapsedTime to replaced elapsed\_tme but from index pattern for requestElaspedTIme the type is 'string' only not 'number' for metric result. I've added below on logstash… --- ## [Unable to discover master and lots of certificate errors](https://discuss.elastic.co/t/unable-to-discover-master-and-lots-of-certificate-errors/256385)
**Author:** [@Charles\_Ferguson](https://discuss.elastic.co/u/Charles_Ferguson)\ **Replies:** 3\ **Last updated:** [November 25, 2020, 7:31pm UTC](https://discuss.elastic.co/t/unable-to-discover-master-and-lots-of-certificate-errors/256385 "2020-11-25T19:31:38Z")
I have cluster where there is no master able to be found since about 4 days ago and I don't know how it got into this state or how to recover. I am still pretty green on this stack and have tried a few things such as del… --- ## [Missing data in log - Source field is always Null](https://discuss.elastic.co/t/missing-data-in-log-source-field-is-always-null/256705)
**Author:** [@hilne1](https://discuss.elastic.co/u/hilne1)\ **Replies:** 0\ **Last updated:** [November 25, 2020, 7:12pm UTC](https://discuss.elastic.co/t/missing-data-in-log-source-field-is-always-null/256705 "2020-11-25T19:12:57Z")
Hi, I'm using ELK stack in docker swarm with 6 filebeat, 1 logstash, 1 elasticsearch and 1 kibana. All is in version 7.6.1. I have a problem when receiving data (cf the photo below) All logs are sending with empty … --- ## [Logstash 7.10 fails with date filter UNIX\_MS - failed to parse date field strict\_date\_optional\_time](https://discuss.elastic.co/t/logstash-7-10-fails-with-date-filter-unix-ms-failed-to-parse-date-field-strict-date-optional-time/256583)
**Author:** [@dfrewin](https://discuss.elastic.co/u/dfrewin)\ **Replies:** 2\ **Last updated:** [November 25, 2020, 6:55pm UTC](https://discuss.elastic.co/t/logstash-7-10-fails-with-date-filter-unix-ms-failed-to-parse-date-field-strict-date-optional-time/256583 "2020-11-25T18:55:59Z")
Initially logstash was running when we were on 6.8 but as soon as we upgraded to 7.9.3 it started failing. Using salesforce logstash plugin error msg retrieves the time value successfully, but looks to fail when sending… --- ## [Filebeat 7.10 is not harvesting](https://discuss.elastic.co/t/filebeat-7-10-is-not-harvesting/256182)
**Author:** [@elkwhat](https://discuss.elastic.co/u/elkwhat)\ **Replies:** 16\ **Last updated:** [November 25, 2020, 6:50pm UTC](https://discuss.elastic.co/t/filebeat-7-10-is-not-harvesting/256182 "2020-11-25T18:50:24Z")
Hi, I got a weird problem that i would like to share. I have one filebeat instance trying to harvest a particular file and its just doing nothing. Here's my filebeat config - # ============================== Filebea… --- ## [Issues with Elastic Agent](https://discuss.elastic.co/t/issues-with-elastic-agent/256578)
**Author:** [@abdeslam.mazouz](https://discuss.elastic.co/u/abdeslam.mazouz)\ **Replies:** 2\ **Last updated:** [November 25, 2020, 6:29pm UTC](https://discuss.elastic.co/t/issues-with-elastic-agent/256578 "2020-11-25T18:29:40Z")
What do you think about this; Elastic agent shows up in SIEM under administration for some servers but not all. Even if they are suing the same config and managed from Fleet. The agent piece working but the endpoint secu… [Previous page](https://discuss.elastic.co/latest.md?page=1974) [Next page](https://discuss.elastic.co/latest.md?page=1976)