# Latest **URL:** https://discuss.elastic.co/latest.md?page=1997 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1998 --- ## [Indices.breaker.request advice](https://discuss.elastic.co/t/indices-breaker-request-advice/255568)
**Author:** [@lechuck](https://discuss.elastic.co/u/lechuck)\ **Replies:** 0\ **Last updated:** [November 16, 2020, 3:59pm UTC](https://discuss.elastic.co/t/indices-breaker-request-advice/255568 "2020-11-16T15:59:47Z")
Hello - a quick one hopefully! Occasionally we experience issues when end users run heavy aggregations - the parent circuit breaker is tripped and this causes issues for other clients which may be performing lighter unr… --- ## [Solution for Logstash json file input - solution pour injecter un fichier json formaté comme ci dessous](https://discuss.elastic.co/t/solution-for-logstash-json-file-input-solution-pour-injecter-un-fichier-json-formate-comme-ci-dessous/255564)
**Author:** [@pmo](https://discuss.elastic.co/u/pmo)\ **Replies:** 0\ **Last updated:** [November 16, 2020, 3:37pm UTC](https://discuss.elastic.co/t/solution-for-logstash-json-file-input-solution-pour-injecter-un-fichier-json-formate-comme-ci-dessous/255564 "2020-11-16T15:37:53Z")
I've json file that are formated like this (j'ai des fichiers json formatés comme ci dessous - les données ont été changées) \[ { "crossConnectVlanRanges": "", "productAndRelease": "FX-I.2.0", "role": "", … --- ## [Filebeat module to see system logins](https://discuss.elastic.co/t/filebeat-module-to-see-system-logins/255519)
**Author:** [@headtea](https://discuss.elastic.co/u/headtea)\ **Replies:** 4\ **Last updated:** [November 16, 2020, 12:21pm UTC](https://discuss.elastic.co/t/filebeat-module-to-see-system-logins/255519 "2020-11-16T12:21:16Z")
I have to keep track of system logins with filebeat. Filebeat has a default dashboard called \[Filebeat System\] SSH login attempts ECS which seems perfect. So to use that, I went to one of the machines, stopped filebeat, … --- ## [Apache module custom index is ignored](https://discuss.elastic.co/t/apache-module-custom-index-is-ignored/255560)
**Author:** [@JohanT](https://discuss.elastic.co/u/JohanT)\ **Replies:** 0\ **Last updated:** [November 16, 2020, 2:57pm UTC](https://discuss.elastic.co/t/apache-module-custom-index-is-ignored/255560 "2020-11-16T14:57:14Z")
Hi there, We've upgraded from filebeats 6.8.2 to 7.9.2, and all our logs are getting to ElasticSearch, yet the Apache logs are getting through with the default index (filebeat-version-date type setup) instead of the cus… --- ## [Droping log when missing time entry](https://discuss.elastic.co/t/droping-log-when-missing-time-entry/255521)
**Author:** [@iccMe](https://discuss.elastic.co/u/iccMe)\ **Replies:** 2\ **Last updated:** [November 16, 2020, 3:10pm UTC](https://discuss.elastic.co/t/droping-log-when-missing-time-entry/255521 "2020-11-16T15:10:42Z")
Hi, I was wondering if anyone could advise the best way to drop a log when the actual time is missing from the logged event. Normally the majority of the logs look like: \[19/10/2020 00:00:01\] servername - Processor… --- ## [Filebeat-\* status of 413 "cannot read property 'get' of undefined"](https://discuss.elastic.co/t/filebeat-status-of-413-cannot-read-property-get-of-undefined/254939)
**Author:** [@datawrangler](https://discuss.elastic.co/u/datawrangler)\ **Replies:** 2\ **Last updated:** [November 16, 2020, 3:04pm UTC](https://discuss.elastic.co/t/filebeat-status-of-413-cannot-read-property-get-of-undefined/254939 "2020-11-16T15:04:29Z")
Hello All, I have a very strange issue where I can't even go to: http://:5601/app/management/kibana/indexPatterns/patterns/filebeat-\* ... the screen is blank and when I press F12 I get the error messages in the subjec… --- ## [Logstash Validation Failed: 1: no requests](https://discuss.elastic.co/t/logstash-validation-failed-1-no-requests/255379)
**Author:** [@Tosh](https://discuss.elastic.co/u/Tosh)\ **Replies:** 3\ **Last updated:** [November 16, 2020, 3:04pm UTC](https://discuss.elastic.co/t/logstash-validation-failed-1-no-requests/255379 "2020-11-16T15:04:11Z")
Hi , Logstash gives below error intermittently and then stops processing data after a while . Logstash version : 7.0.1 Elastic version : 7.0.1 Java : JDK8 Could it be due to malformed requests ? We do see some malfo… --- ## [Proper configuration of "server.host", "elasticsearch.host", and "network.host" settings on multinode cluster in production](https://discuss.elastic.co/t/proper-configuration-of-server-host-elasticsearch-host-and-network-host-settings-on-multinode-cluster-in-production/255378)
**Author:** [@Dennis1](https://discuss.elastic.co/u/Dennis1)\ **Replies:** 2\ **Last updated:** [November 16, 2020, 2:56pm UTC](https://discuss.elastic.co/t/proper-configuration-of-server-host-elasticsearch-host-and-network-host-settings-on-multinode-cluster-in-production/255378 "2020-11-16T14:56:55Z")
Hello, I'm building a multi-node elastic stack cluster with the following nodes: 3 master-eligible nodes (with all default roles) 1 coordinating-only node with Kibana additional data/ingest-dedicated nodes as needed A… --- ## [Logstash monitoring not showing one pipeline](https://discuss.elastic.co/t/logstash-monitoring-not-showing-one-pipeline/255559)
**Author:** [@mtudisco](https://discuss.elastic.co/u/mtudisco)\ **Replies:** 0\ **Last updated:** [November 16, 2020, 2:56pm UTC](https://discuss.elastic.co/t/logstash-monitoring-not-showing-one-pipeline/255559 "2020-11-16T14:56:12Z")
Hi, I have two machines with logstash Machine 1: only logstash 7.7 with 4 pipelines, one of them called "main" Machine 2: logstash 7.3, kibana 7.3 and elasticsearch 7.3. Logstash only one pipeline called "main" On bo… --- ## [Reindex / Consolidate Indizes](https://discuss.elastic.co/t/reindex-consolidate-indizes/255544)
**Author:** [@ksremo](https://discuss.elastic.co/u/ksremo)\ **Replies:** 4\ **Last updated:** [November 16, 2020, 2:53pm UTC](https://discuss.elastic.co/t/reindex-consolidate-indizes/255544 "2020-11-16T14:53:12Z")
How to migrate from multiple timebased indizes \-\ to a single \ index without losing data? --- ## ["Migrating .kibana\_3 saved objects to .kibana\_4" - 7.9.3 upgrade to 7.10](https://discuss.elastic.co/t/migrating-kibana-3-saved-objects-to-kibana-4-7-9-3-upgrade-to-7-10/255259)
**Author:** [@PublicName](https://discuss.elastic.co/u/PublicName)\ **Replies:** 3\ **Last updated:** [November 16, 2020, 2:51pm UTC](https://discuss.elastic.co/t/migrating-kibana-3-saved-objects-to-kibana-4-7-9-3-upgrade-to-7-10/255259 "2020-11-16T14:51:52Z")
Deleting the .kibana\_4 and restarting the kibana instance leaves me in a permanent death loop. This will run for 3+ hours and do nothing. Nothing happens checking the journlctl logs this is what always shows up "Migratin… --- ## [Issues setting up Lab for Observability Fundamentals](https://discuss.elastic.co/t/issues-setting-up-lab-for-observability-fundamentals/252563)
**Author:** [@gmlewis0](https://discuss.elastic.co/u/gmlewis0)\ **Replies:** 8\ **Last updated:** [November 16, 2020, 2:50pm UTC](https://discuss.elastic.co/t/issues-setting-up-lab-for-observability-fundamentals/252563 "2020-11-16T14:50:22Z")
Hi, I just signed up this morning for the Observability Fundamentals class and am running into issues trying to set the lab up. I followed the initial instructions to log into strigo and the machine appeared to start and… --- ## [CPU and Load Average high after enabling filebeat Apache module](https://discuss.elastic.co/t/cpu-and-load-average-high-after-enabling-filebeat-apache-module/254651)
**Author:** [@ajesh](https://discuss.elastic.co/u/ajesh)\ **Replies:** 1\ **Last updated:** [November 16, 2020, 2:45pm UTC](https://discuss.elastic.co/t/cpu-and-load-average-high-after-enabling-filebeat-apache-module/254651 "2020-11-16T14:45:54Z")
Hi There, Our elasticsearch (Ver 7.9) consist of 4 Nodes (2 Hot and 2 Warm ) . We are using auditbeat ,winlogbeat and filebeat for sending data to the nodes. We recently started integrating apache access and error logs … --- ## [Configure Kibana to use proxy](https://discuss.elastic.co/t/configure-kibana-to-use-proxy/253419)
**Author:** [@Yustas](https://discuss.elastic.co/u/Yustas)\ **Replies:** 4\ **Last updated:** [November 16, 2020, 2:45pm UTC](https://discuss.elastic.co/t/configure-kibana-to-use-proxy/253419 "2020-11-16T14:45:41Z")
Hello I have fresh cluster installation from docker images. Docker images version's - 7.9.3 Server work in isolated network. When i try look available plugins from kibana, application try connect directly to https://… --- ## [How to Connect sharepoint on premise to elastic workplace search](https://discuss.elastic.co/t/how-to-connect-sharepoint-on-premise-to-elastic-workplace-search/249012)
**Author:** [@lakshmiteja\_salapu](https://discuss.elastic.co/u/lakshmiteja_salapu)\ **Replies:** 4\ **Last updated:** [November 16, 2020, 2:32pm UTC](https://discuss.elastic.co/t/how-to-connect-sharepoint-on-premise-to-elastic-workplace-search/249012 "2020-11-16T14:32:44Z")
I have created a custom api on workplace search. I understood posting csv files to workplacesearch using key and token. But I am trying to understand how to connect sharepoint which is on premise in our company to elasti… --- ## [Transasctions per second, how to present data to users using formats they are familiar with](https://discuss.elastic.co/t/transasctions-per-second-how-to-present-data-to-users-using-formats-they-are-familiar-with/255252)
**Author:** [@asenecal2keys](https://discuss.elastic.co/u/asenecal2keys)\ **Replies:** 2\ **Last updated:** [November 16, 2020, 2:17pm UTC](https://discuss.elastic.co/t/transasctions-per-second-how-to-present-data-to-users-using-formats-they-are-familiar-with/255252 "2020-11-16T14:17:12Z")
Throughout our design documents we refer to transaction per seconds but when it comes time to view dashboards and visualizations I can't seem to find an easy way to display that information. With the interval selection t… --- ## [V1beta1 Beats and the note about upgrades](https://discuss.elastic.co/t/v1beta1-beats-and-the-note-about-upgrades/255103)
**Author:** [@SeanPlacchetti](https://discuss.elastic.co/u/SeanPlacchetti)\ **Replies:** 3\ **Last updated:** [November 16, 2020, 1:37pm UTC](https://discuss.elastic.co/t/v1beta1-beats-and-the-note-about-upgrades/255103 "2020-11-16T13:37:04Z")
Hello, I can't tell if the note in the documentation about Operator upgrades running on Openshift 3.11 applies to the Beats or just the Elasticsearch deployments through ECK. Our Beat yamls are based on the quickstarts … --- ## ["Monitoring Kubernetes and Docker Container Logs" lab - cluster not up](https://discuss.elastic.co/t/monitoring-kubernetes-and-docker-container-logs-lab-cluster-not-up/255532)
**Author:** [@Anton\_1](https://discuss.elastic.co/u/Anton_1)\ **Replies:** 1\ **Last updated:** [November 16, 2020, 1:25pm UTC](https://discuss.elastic.co/t/monitoring-kubernetes-and-docker-container-logs-lab-cluster-not-up/255532 "2020-11-16T13:25:27Z")
Going through training "Welcome to Monitoring Kubernetes and Docker Container Logs" (Lab 1, step 5) - docker ps command Only the container that I manually started is shown. The rest of kindest containers are not start… --- ## [Where is the docker image of the 7.10?](https://discuss.elastic.co/t/where-is-the-docker-image-of-the-7-10/255477)
**Author:** [@flavienbwk](https://discuss.elastic.co/u/flavienbwk)\ **Replies:** 1\ **Last updated:** [November 16, 2020, 9:23am UTC](https://discuss.elastic.co/t/where-is-the-docker-image-of-the-7-10/255477 "2020-11-16T09:23:44Z")
Hi, Does anybody know why the docker image of the 7.10 has not been released yet on the Docker hub ? Is it planned ? Thank you, --- ## [Fleet integration Suggestions](https://discuss.elastic.co/t/fleet-integration-suggestions/255270)
**Author:** [@pixelsquared](https://discuss.elastic.co/u/pixelsquared)\ **Replies:** 1\ **Last updated:** [November 16, 2020, 12:56pm UTC](https://discuss.elastic.co/t/fleet-integration-suggestions/255270 "2020-11-16T12:56:42Z")
Hi, I have some Ideas for fleet integrations: Winlogbeat Heartbeat OSquery Docker AuditBeat OPNsense Firewall Logs Thanks --- ## [Filebeat missing container k8 metadata](https://discuss.elastic.co/t/filebeat-missing-container-k8-metadata/255530)
**Author:** [@mo\_ct](https://discuss.elastic.co/u/mo_ct)\ **Replies:** 0\ **Last updated:** [November 16, 2020, 12:52pm UTC](https://discuss.elastic.co/t/filebeat-missing-container-k8-metadata/255530 "2020-11-16T12:52:42Z")
When running batch of short-lived containers (which are same docker images), on some (random) occasions k8 metadata tags are missing from some of them Also there are no errors on the Filebeat service itself when filebea… --- ## [Heartbeat url monitor](https://discuss.elastic.co/t/heartbeat-url-monitor/255524)
**Author:** [@psganeshk](https://discuss.elastic.co/u/psganeshk)\ **Replies:** 1\ **Last updated:** [November 16, 2020, 12:39pm UTC](https://discuss.elastic.co/t/heartbeat-url-monitor/255524 "2020-11-16T12:39:33Z")
Error 401 Unauthorized Response Body Body size is 381B. {"error":{"root\_cause":\[{"type":"security\_exception","reason":"missing authentication credentials for REST request \[/\]","header":{"WWW-Authenticate":"Basic real… --- ## [SIEM Rule Use Case](https://discuss.elastic.co/t/siem-rule-use-case/255475)
**Author:** [@Ameer\_Mukadam](https://discuss.elastic.co/u/Ameer_Mukadam)\ **Replies:** 1\ **Last updated:** [November 16, 2020, 12:29pm UTC](https://discuss.elastic.co/t/siem-rule-use-case/255475 "2020-11-16T12:29:27Z")
Hi, I have a use case which I am not yet sure can be fulfilled by Elastic SIEM. I have created some different behavioral rules to detect ransomware activities and they work such as the deletion of restore of files and m… --- ## [Signal - multiple login failure from same user](https://discuss.elastic.co/t/signal-multiple-login-failure-from-same-user/255517)
**Author:** [@jancodenew](https://discuss.elastic.co/u/jancodenew)\ **Replies:** 1\ **Last updated:** [November 16, 2020, 12:24pm UTC](https://discuss.elastic.co/t/signal-multiple-login-failure-from-same-user/255517 "2020-11-16T12:24:57Z")
Please help me to create a signal for below logic. Alert if there is more than 3 login failure from same user in last 5min. I have mentioned below the watcher query written for same above logic. “query”: { “bool”: { … --- ## [Why Filebeat is not picking up multiline ISO timestamp pattern but picking when pattern is defined manually?](https://discuss.elastic.co/t/why-filebeat-is-not-picking-up-multiline-iso-timestamp-pattern-but-picking-when-pattern-is-defined-manually/255036)
**Author:** [@elasticheart](https://discuss.elastic.co/u/elasticheart)\ **Replies:** 2\ **Last updated:** [November 16, 2020, 12:17pm UTC](https://discuss.elastic.co/t/why-filebeat-is-not-picking-up-multiline-iso-timestamp-pattern-but-picking-when-pattern-is-defined-manually/255036 "2020-11-16T12:17:24Z")
Hi, I have log lines like below; \[2020-11-11T11:19:00+05:30\] \[INFO\] \[msg1\] \[msg2\] \[msg3\] \[msg4\] \[msg5\] \[msg6\] \[msg7\] \[msg8\] \[msg9\] The msg9 attribute may contain multi-line message, so I have decided to configure mult… --- ## [Compare two fields in SIEM](https://discuss.elastic.co/t/compare-two-fields-in-siem/253927)
**Author:** [@borna\_talebi](https://discuss.elastic.co/u/borna_talebi)\ **Replies:** 13\ **Last updated:** [November 16, 2020, 11:50am UTC](https://discuss.elastic.co/t/compare-two-fields-in-siem/253927 "2020-11-16T11:50:59Z")
Hi, I want to trigger an alarm if two fields have the same value. is it possible or I have to use watcher? --- ## [Cluster with separate roles docker/ansible](https://discuss.elastic.co/t/cluster-with-separate-roles-docker-ansible/254977)
**Author:** [@vinci](https://discuss.elastic.co/u/vinci)\ **Replies:** 1\ **Last updated:** [November 16, 2020, 11:25am UTC](https://discuss.elastic.co/t/cluster-with-separate-roles-docker-ansible/254977 "2020-11-16T11:25:41Z")
Hello, I'm trying to set up an elasticsearch cluster with 3 nodes, one master, the other two data. I'm doing this all through ansible and in order to also set up the ssl connection between the nodes, I'm making use of a… --- ## [Kibana Geo\_json Map](https://discuss.elastic.co/t/kibana-geo-json-map/255482)
**Author:** [@Farid\_N](https://discuss.elastic.co/u/Farid_N)\ **Replies:** 5\ **Last updated:** [November 16, 2020, 11:25am UTC](https://discuss.elastic.co/t/kibana-geo-json-map/255482 "2020-11-16T11:25:31Z")
Hi Unfortunately, I can not import a JSON file to kibana map Could you please help me what should I do for this issue: I have downloaded many many JSON file... but every time I faced with this message :frowning: --- ## [Boolean Logic in Synonym Set?](https://discuss.elastic.co/t/boolean-logic-in-synonym-set/255384)
**Author:** [@ALK1](https://discuss.elastic.co/u/ALK1)\ **Replies:** 1\ **Last updated:** [November 16, 2020, 11:20am UTC](https://discuss.elastic.co/t/boolean-logic-in-synonym-set/255384 "2020-11-16T11:20:02Z")
Hi all, I’m trying to create a synonym set for an acronym so it will match against an exact phrase, like "United Stated of America" for USA. It seems I can’t put quotation marks in the synonym set fields. Does anyone kn… --- ## [Want to attend the webinar, but the pre-requistive is difficut at present](https://discuss.elastic.co/t/want-to-attend-the-webinar-but-the-pre-requistive-is-difficut-at-present/255474)
**Author:** [@Joseph\_John](https://discuss.elastic.co/u/Joseph_John)\ **Replies:** 2\ **Last updated:** [November 16, 2020, 11:15am UTC](https://discuss.elastic.co/t/want-to-attend-the-webinar-but-the-pre-requistive-is-difficut-at-present/255474 "2020-11-16T11:15:46Z")
Dear APM team I am Joseph John. I want to attend the webinar of APM for python application, Instrument and monitor a Python application using APM | Elastic Videos but the pre- requistive of company email registra… [Previous page](https://discuss.elastic.co/latest.md?page=1996) [Next page](https://discuss.elastic.co/latest.md?page=1998)