# Latest **URL:** https://discuss.elastic.co/latest.md?page=873 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 874 --- ## [Delete old logs files](https://discuss.elastic.co/t/delete-old-logs-files/318317)
**Author:** [@Ludovic9](https://discuss.elastic.co/u/Ludovic9)\ **Replies:** 3\ **Last updated:** [December 2, 2022, 11:14am UTC](https://discuss.elastic.co/t/delete-old-logs-files/318317 "2022-12-02T11:14:52Z")
Hi I'm using an old version of elasticsearch (6.4.1). In /var/log/elasticsearch I have a lot of logs file since 2018 with log.gz extension. It seems using logrotate is not a good option, but instead, using the paramet… --- ## [Logstash ConfigurationError - Expect character](https://discuss.elastic.co/t/logstash-configurationerror-expect-character/320355)
**Author:** [@stefanocog](https://discuss.elastic.co/u/stefanocog)\ **Replies:** 1\ **Last updated:** [December 2, 2022, 10:47am UTC](https://discuss.elastic.co/t/logstash-configurationerror-expect-character/320355 "2022-12-02T10:47:23Z")
Hi, I've this pattern that match correctly on https://grokconstructor.appspot.com "%{TIMESTAMP\_ISO8601:timestamp}"\\|"%{DATA:tz}"\\|"%{GREEDYDATA:trans}\\: %{GREEDYDATA:transId}"\\|"%{GREEDYDATA:req}\\: %{GREEDYDATA:reqId}"\\… --- ## [Allow OpenTelemetry to connect Anonymous to Elastic APM in fleet](https://discuss.elastic.co/t/allow-opentelemetry-to-connect-anonymous-to-elastic-apm-in-fleet/320342)
**Author:** [@Aile](https://discuss.elastic.co/u/Aile)\ **Replies:** 3\ **Last updated:** [December 2, 2022, 10:44am UTC](https://discuss.elastic.co/t/allow-opentelemetry-to-connect-anonymous-to-elastic-apm-in-fleet/320342 "2022-12-02T10:44:45Z")
Kibana version: 8.5.2 Elasticsearch version: 8.5.2 APM Server version: / APM Agent language and version: Open-Telemetry Browser version: / Original install method (e.g. download page, yum, deb, from source, etc… --- ## [Drop\_event from Win firewall](https://discuss.elastic.co/t/drop-event-from-win-firewall/320334)
**Author:** [@vabe](https://discuss.elastic.co/u/vabe)\ **Replies:** 0\ **Last updated:** [December 2, 2022, 8:16am UTC](https://discuss.elastic.co/t/drop-event-from-win-firewall/320334 "2022-12-02T08:16:38Z")
Hey guys, I'm looking for help here as a last resort. Can't find a solution.. I want to drop events from Win firewall log the line is: message 2022-12-02 08:53:10 ALLOW TCP 127.0.0.1 127.0.0.1 50740 389 0 - 0 0 0 - … --- ## [Elasticsearch instability using ECK operator on openshift cluster](https://discuss.elastic.co/t/elasticsearch-instability-using-eck-operator-on-openshift-cluster/320349)
**Author:** [@brpedromaia](https://discuss.elastic.co/u/brpedromaia)\ **Replies:** 0\ **Last updated:** [December 2, 2022, 10:10am UTC](https://discuss.elastic.co/t/elasticsearch-instability-using-eck-operator-on-openshift-cluster/320349 "2022-12-02T10:10:29Z")
We are getting issues with elasticsearch pods, the pods become in a pending state twice in 4 months. sometimes, when it's loading a few dashboards on kibana the pods are restarting, we have added the ILM policy but froz… --- ## [Multiline logs into one event using logstash?](https://discuss.elastic.co/t/multiline-logs-into-one-event-using-logstash/320005)
**Author:** [@kurdit](https://discuss.elastic.co/u/kurdit)\ **Replies:** 9\ **Last updated:** [December 2, 2022, 10:14am UTC](https://discuss.elastic.co/t/multiline-logs-into-one-event-using-logstash/320005 "2022-12-02T10:14:08Z")
hi all! I have these logs: Nov 23 18:57:14 mx.host.cloud 18:57:14.756 2 SIPS-072111 SIPDATA-124634 REGISTER sip:111.222.333.444:65110 from udp\[555.666.777.888\]:65111 Nov 23 18:57:14 mx.host.cloud 18:57:14.756 2 SIPS-072… --- ## [Usually data are not enriched](https://discuss.elastic.co/t/usually-data-are-not-enriched/316435)
**Author:** [@Marcin\_Frankiewicz](https://discuss.elastic.co/u/Marcin_Frankiewicz)\ **Replies:** 10\ **Last updated:** [December 2, 2022, 10:04am UTC](https://discuss.elastic.co/t/usually-data-are-not-enriched/316435 "2022-12-02T10:04:59Z")
Hi, Does exists some situactions, when data are not enriched ? (i'm excluding scenario when there are no matching data) Example : Can be skipped for perfomance reasons? It is possible that enrich processor in pipeline… --- ## [Need help for creating filter pattern based on custom logs](https://discuss.elastic.co/t/need-help-for-creating-filter-pattern-based-on-custom-logs/320347)
**Author:** [@Shrikant\_Dhawale](https://discuss.elastic.co/u/Shrikant_Dhawale)\ **Replies:** 0\ **Last updated:** [December 2, 2022, 10:02am UTC](https://discuss.elastic.co/t/need-help-for-creating-filter-pattern-based-on-custom-logs/320347 "2022-12-02T10:02:55Z")
Hi All, I am new to this technology started learning, need help in writing filter plugin which will parse custom logs from the server. External User(dummy-user) is Mapped to Temp User(dummy-user) with Role(s): role1 ro… --- ## [Dashboard table: color boolean cell](https://discuss.elastic.co/t/dashboard-table-color-boolean-cell/320274)
**Author:** [@emmanuel\_t](https://discuss.elastic.co/u/emmanuel_t)\ **Replies:** 2\ **Last updated:** [December 2, 2022, 9:18am UTC](https://discuss.elastic.co/t/dashboard-table-color-boolean-cell/320274 "2022-12-02T09:18:12Z")
Hello, I have boolean data in my index, that I'm rendering in a dashboard table (currently lens, but I could change to another system, as long as the final rendering looks like a table). I would like to color the boolea… --- ## [Separate filtered queries for source and destination fields in vega sankey visualization](https://discuss.elastic.co/t/separate-filtered-queries-for-source-and-destination-fields-in-vega-sankey-visualization/320251)
**Author:** [@Senol\_Kurt](https://discuss.elastic.co/u/Senol_Kurt)\ **Replies:** 1\ **Last updated:** [December 2, 2022, 8:54am UTC](https://discuss.elastic.co/t/separate-filtered-queries-for-source-and-destination-fields-in-vega-sankey-visualization/320251 "2022-12-02T08:54:01Z")
I want to create a sankey chart using a single field. Both my source and destination data are stored in that field. Is it possible to use separate filters for source and destination data? --- ## [BadRequestError(400, 'search\_phase\_execution\_exception', 'runtime error')](https://discuss.elastic.co/t/badrequesterror-400-search-phase-execution-exception-runtime-error/320340)
**Author:** [@sanjayk1241](https://discuss.elastic.co/u/sanjayk1241)\ **Replies:** 0\ **Last updated:** [December 2, 2022, 8:40am UTC](https://discuss.elastic.co/t/badrequesterror-400-search-phase-execution-exception-runtime-error/320340 "2022-12-02T08:40:20Z")
I am trying to implement the search functionality using the elasticsearch concept. I am getting the following error: BadRequestError(400, 'search\_phase\_execution\_exception', 'runtime error') I am not sure where I am d… --- ## [Filebeat Error](https://discuss.elastic.co/t/filebeat-error/320316)
**Author:** [@lucas.Jung](https://discuss.elastic.co/u/lucas.Jung)\ **Replies:** 2\ **Last updated:** [December 2, 2022, 8:30am UTC](https://discuss.elastic.co/t/filebeat-error/320316 "2022-12-02T08:30:05Z")
I set filebeat to use the ingest node of okta, but an error occurs and filebit does not run. ERROR \[esclientleg\] transport/logging.go:37 Error dialing x509: certificate signed by unknown authority {"network": "t… --- ## [Error parsing datetime using Script Processor](https://discuss.elastic.co/t/error-parsing-datetime-using-script-processor/320332)
**Author:** [@m14](https://discuss.elastic.co/u/m14)\ **Replies:** 0\ **Last updated:** [December 2, 2022, 8:02am UTC](https://discuss.elastic.co/t/error-parsing-datetime-using-script-processor/320332 "2022-12-02T08:02:34Z")
Hi, I need to get the date and time from the log record. In JavaScript I can just do the following: var d = new Date("Oct 27, 2022 1:39:57 PM"); But the script processor seems nto to be able to do this. When I try (… --- ## [Dec 2nd 2022: \[EN\] The no-data user experience in Kibana](https://discuss.elastic.co/t/dec-2nd-2022-en-the-no-data-user-experience-in-kibana/319322)
**Author:** [@majagrubic](https://discuss.elastic.co/u/majagrubic)\ **Replies:** 0\ **Last updated:** [December 2, 2022, 8:00am UTC](https://discuss.elastic.co/t/dec-2nd-2022-en-the-no-data-user-experience-in-kibana/319322 "2022-12-02T08:00:17Z")
Over the past few years, Kibana grew both as a product and a codebase. We have added more apps and more solutions. Inadvertently, this led to a situation where multiple teams were building the same thing in a differen… --- ## [Linux Fundamentals course - Networking part is locked](https://discuss.elastic.co/t/linux-fundamentals-course-networking-part-is-locked/320236)
**Author:** [@sl3vin](https://discuss.elastic.co/u/sl3vin)\ **Replies:** 4\ **Last updated:** [December 2, 2022, 7:52am UTC](https://discuss.elastic.co/t/linux-fundamentals-course-networking-part-is-locked/320236 "2022-12-02T07:52:03Z")
Hello Training-Team, I just completed your Linux Fundamentals course and I have some problems accessing the challenge 6 – Networking. I couldn’t find the necessary flag to unlock this section. Not in the Linux I Fundame… --- ## [Multiple ingest pipeline in index template](https://discuss.elastic.co/t/multiple-ingest-pipeline-in-index-template/319793)
**Author:** [@kmz161](https://discuss.elastic.co/u/kmz161)\ **Replies:** 2\ **Last updated:** [December 2, 2022, 7:28am UTC](https://discuss.elastic.co/t/multiple-ingest-pipeline-in-index-template/319793 "2022-12-02T07:28:14Z")
Hello! I have index template and need attach 2 ingest pipelines to him. How I can do it? My current config { "index": { "default\_pipeline": "netflow-pipeline" } } --- ## [Is this a bug of Elasticsearch sorting?](https://discuss.elastic.co/t/is-this-a-bug-of-elasticsearch-sorting/320317)
**Author:** [@howe\_xiao](https://discuss.elastic.co/u/howe_xiao)\ **Replies:** 3\ **Last updated:** [December 2, 2022, 7:25am UTC](https://discuss.elastic.co/t/is-this-a-bug-of-elasticsearch-sorting/320317 "2022-12-02T07:25:46Z")
Problem Description: A field of keyword type causes a shard retrieval failure with differernt size and from value. Environment：Node-4, Shard-8, Version-8.0 This is my query DSL on Kibana: POST myIndex/\_search { "fro… --- ## [Dense vector doesn't support synthetic source](https://discuss.elastic.co/t/dense-vector-doesnt-support-synthetic-source/320321)
**Author:** [@ruslaniv](https://discuss.elastic.co/u/ruslaniv)\ **Replies:** 4\ **Last updated:** [December 2, 2022, 6:42am UTC](https://discuss.elastic.co/t/dense-vector-doesnt-support-synthetic-source/320321 "2022-12-02T06:42:59Z")
According to this: Dense vector field type | Elasticsearch Guide \[8.5\] | Elastic dense\_vector field is supposed to support synthetic source. I just tried to create an index with the mapping like this: "mappings": { … --- ## [Custom TCP server to receive incoming binary data to Elastic?](https://discuss.elastic.co/t/custom-tcp-server-to-receive-incoming-binary-data-to-elastic/320322)
**Author:** [@kumaresanr](https://discuss.elastic.co/u/kumaresanr)\ **Replies:** 1\ **Last updated:** [December 2, 2022, 5:47am UTC](https://discuss.elastic.co/t/custom-tcp-server-to-receive-incoming-binary-data-to-elastic/320322 "2022-12-02T05:47:58Z")
I have the following requirement. I run a traffic proxy and the traffic proxy bundle some stats into a custom binary format and can send them to an endpoint via TCP socket. I cannot install a filebeat or such sort in th… --- ## [Pipeline queue is getting filled and never able to control, using below drop filter plugin](https://discuss.elastic.co/t/pipeline-queue-is-getting-filled-and-never-able-to-control-using-below-drop-filter-plugin/320287)
**Author:** [@rravitech](https://discuss.elastic.co/u/rravitech)\ **Replies:** 2\ **Last updated:** [December 2, 2022, 5:01am UTC](https://discuss.elastic.co/t/pipeline-queue-is-getting-filled-and-never-able-to-control-using-below-drop-filter-plugin/320287 "2022-12-02T05:01:19Z")
I am trying to implement 2 pipelines, when one is about to get blocked, i am trying to drop events form that pipeline. So that the other one, which is half filled or healthy will keep receiving the events. Here in th… --- ## [Pushing of data into elastic search dashboard using Python](https://discuss.elastic.co/t/pushing-of-data-into-elastic-search-dashboard-using-python/320214)
**Author:** [@Shashank02](https://discuss.elastic.co/u/Shashank02)\ **Replies:** 4\ **Last updated:** [December 2, 2022, 4:54am UTC](https://discuss.elastic.co/t/pushing-of-data-into-elastic-search-dashboard-using-python/320214 "2022-12-02T04:54:50Z")
I am working on a project which collects twitter data. So, up until now, what I did is I collected some tweets and then stored them in a CSV format and uploaded it to the elastic cloud. I am now working on automatically … --- ## [How to change scroll time in spring data repository](https://discuss.elastic.co/t/how-to-change-scroll-time-in-spring-data-repository/320314)
**Author:** [@mzinboy](https://discuss.elastic.co/u/mzinboy)\ **Replies:** 0\ **Last updated:** [December 2, 2022, 2:54am UTC](https://discuss.elastic.co/t/how-to-change-scroll-time-in-spring-data-repository/320314 "2022-12-02T02:54:54Z")
Dear all, dev info: elasticsearch 7.17.1 spring boot 2.6.12 spring-data-elasticsearch 4.3.7 I have a code as below: public interface LogRepository\ extends ElasticsearchRepository\ Stream\ findScro… --- ## [【Kibana】The line graph problem](https://discuss.elastic.co/t/kibana-the-line-graph-problem/320245)
**Author:** [@ydbdyds](https://discuss.elastic.co/u/ydbdyds)\ **Replies:** 2\ **Last updated:** [December 2, 2022, 2:36am UTC](https://discuss.elastic.co/t/kibana-the-line-graph-problem/320245 "2022-12-02T02:36:11Z")
I had a problem drawing with Kibana ，Every day I generate a document that looks like the following data structure { "reports":\[ { "url":"test1", "method":"get", "val1":40… --- ## [App search Analytics in Kibana (logs-app\_search.analytics-default)](https://discuss.elastic.co/t/app-search-analytics-in-kibana-logs-app-search-analytics-default/317657)
**Author:** [@moassafiri](https://discuss.elastic.co/u/moassafiri)\ **Replies:** 1\ **Last updated:** [November 4, 2022, 3:17am UTC](https://discuss.elastic.co/t/app-search-analytics-in-kibana-logs-app-search-analytics-default/317657 "2022-11-04T03:17:14Z")
Is there a way to Filter based on the Engine name from the logs-app\_search.analytics-default Data stream? I can see labels.engine\_id; but this returns a UUID which is not user-friendly. Especially when doing Drill-downs … --- ## [Connect Render.com Log Stream to Elastic Cloud](https://discuss.elastic.co/t/connect-render-com-log-stream-to-elastic-cloud/319704)
**Author:** [@Mike\_Cann](https://discuss.elastic.co/u/Mike_Cann)\ **Replies:** 5\ **Last updated:** [December 1, 2022, 11:59pm UTC](https://discuss.elastic.co/t/connect-render-com-log-stream-to-elastic-cloud/319704 "2022-12-01T23:59:26Z")
Hi I would like to push my logs from Render.com so that they are viewable / tailable etc in Elastic Cloud. Render.com sends to a syslog drain (Log Streams | Render · Cloud Hosting for Developers) in a standard (RFC5424)… --- ## [Math in Metric Visualization](https://discuss.elastic.co/t/math-in-metric-visualization/320249)
**Author:** [@Tim\_Mobley](https://discuss.elastic.co/u/Tim_Mobley)\ **Replies:** 1\ **Last updated:** [December 1, 2022, 11:14pm UTC](https://discuss.elastic.co/t/math-in-metric-visualization/320249 "2022-12-01T23:14:47Z")
I am trying to create a metric visualization that shows the system memory in GB (from Metricbeat's system.memory field). However, I was it to display in GB and the field value is shown in bytes (binary). How/where do I a… --- ## [Elastic search error : bad certificate](https://discuss.elastic.co/t/elastic-search-error-bad-certificate/320212)
**Author:** [@mangeshmj1992](https://discuss.elastic.co/u/mangeshmj1992)\ **Replies:** 1\ **Last updated:** [December 1, 2022, 11:03pm UTC](https://discuss.elastic.co/t/elastic-search-error-bad-certificate/320212 "2022-12-01T23:03:56Z")
Hello team, We are getting bad certificate issue in 2 elk nodes out of 7. Can you please help me to identify what is exact issue here. \[2022-12-01T14:11:59,261\]\[WARN \]\[o.e.h.AbstractHttpServerTransport\] \[ELKDPCPRD001\] … --- ## [Syntax for Pipeline Processor Condition in Kibana](https://discuss.elastic.co/t/syntax-for-pipeline-processor-condition-in-kibana/320303)
**Author:** [@wpm](https://discuss.elastic.co/u/wpm)\ **Replies:** 1\ **Last updated:** [December 1, 2022, 10:50pm UTC](https://discuss.elastic.co/t/syntax-for-pipeline-processor-condition-in-kibana/320303 "2022-12-01T22:50:52Z")
I would like to write a pipeline that drops the field "A" from a document when its value is the string "None". I want to do this in the Kibana UI. I figure I need a Remove processor when runs on the condition that A == … --- ## [Specific filter for different windows EventID](https://discuss.elastic.co/t/specific-filter-for-different-windows-eventid/320301)
**Author:** [@Marsidi](https://discuss.elastic.co/u/Marsidi)\ **Replies:** 0\ **Last updated:** [December 1, 2022, 10:08pm UTC](https://discuss.elastic.co/t/specific-filter-for-different-windows-eventid/320301 "2022-12-01T22:08:10Z")
Hi all, I am collecting logs from different windows channels, and for different EventID I want to use different filter files. For example: If 'channel' is 'sysmon': If 'EventID' is 1: use sysmon1\_filter fi… --- ## [Elasticsearch cluster setup with 7.5.1](https://discuss.elastic.co/t/elasticsearch-cluster-setup-with-7-5-1/320210)
**Author:** [@Suraj\_Jannu](https://discuss.elastic.co/u/Suraj_Jannu)\ **Replies:** 1\ **Last updated:** [December 1, 2022, 10:09pm UTC](https://discuss.elastic.co/t/elasticsearch-cluster-setup-with-7-5-1/320210 "2022-12-01T22:09:16Z")
Hello, I am trying to set up a 3-node elasticsearch cluster of version 7.5.1. I have 1 master node, 1 data node, and 1 client node. Each instance of elasticsearch.yml configuration is as below. Master node path.data:… [Previous page](https://discuss.elastic.co/latest.md?page=872) [Next page](https://discuss.elastic.co/latest.md?page=874)