# Latest **URL:** https://discuss.elastic.co/latest.md?page=876 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 877 --- ## [Why use Filebeat before Logstash?](https://discuss.elastic.co/t/why-use-filebeat-before-logstash/320171)
**Author:** [@scantron](https://discuss.elastic.co/u/scantron)\ **Replies:** 0\ **Last updated:** [November 30, 2022, 3:48pm UTC](https://discuss.elastic.co/t/why-use-filebeat-before-logstash/320171 "2022-11-30T15:48:35Z")
Hi all, I am working with syslogs from various different networking devices all going to the same port. Filebeat does not allow you to use multiple modules to parse logs all coming in on the same port. So Logstash is ho… --- ## [Changing the timezone does not change how far the logs are from the current time](https://discuss.elastic.co/t/changing-the-timezone-does-not-change-how-far-the-logs-are-from-the-current-time/319753)
**Author:** [@Hemabh\_Ravee\_Fox](https://discuss.elastic.co/u/Hemabh_Ravee_Fox)\ **Replies:** 6\ **Last updated:** [November 30, 2022, 3:41pm UTC](https://discuss.elastic.co/t/changing-the-timezone-does-not-change-how-far-the-logs-are-from-the-current-time/319753 "2022-11-30T15:41:55Z")
I am using a locally deployed elasticsearch and kibana. When I send data to an index with the current timestamp - in kibana it is displayed as being 5:30 hours ahead of the current time. I came to understand that this i… --- ## [How to properly use two Filebeat modules listening on the same port?](https://discuss.elastic.co/t/how-to-properly-use-two-filebeat-modules-listening-on-the-same-port/320098)
**Author:** [@scantron](https://discuss.elastic.co/u/scantron)\ **Replies:** 5\ **Last updated:** [November 30, 2022, 3:39pm UTC](https://discuss.elastic.co/t/how-to-properly-use-two-filebeat-modules-listening-on-the-same-port/320098 "2022-11-30T15:39:58Z")
I currently have Fortinet and Cisco modules enabled on the same filebeat instance, and have a cisco meraki network device sending syslogs as well as fortinet firewall logs to the same port, 5514. I am using Docker with a… --- ## [Permanent filter on data view](https://discuss.elastic.co/t/permanent-filter-on-data-view/317993)
**Author:** [@Joseph\_Predignac](https://discuss.elastic.co/u/Joseph_Predignac)\ **Replies:** 2\ **Last updated:** [November 3, 2022, 9:24am UTC](https://discuss.elastic.co/t/permanent-filter-on-data-view/317993 "2022-11-03T09:24:15Z")
Hi everyone, I work with o365 logs, and I want to make exceptions on some users, some countries etc... For example, on a dashboard, I focus on login from countries except mine, to see suspicious logs. But, if I know a u… --- ## [Dotnet Client(\`Elastic.Clients.Elasticsearch\`) doesn't support knn\_search](https://discuss.elastic.co/t/dotnet-client-elastic-clients-elasticsearch-doesnt-support-knn-search/319795)
**Author:** [@Jiaxiang\_Wang](https://discuss.elastic.co/u/Jiaxiang_Wang)\ **Replies:** 3\ **Last updated:** [November 30, 2022, 3:29pm UTC](https://discuss.elastic.co/t/dotnet-client-elastic-clients-elasticsearch-doesnt-support-knn-search/319795 "2022-11-30T15:29:32Z")
I try to use elasticsearch knn\_search feature in dotnet. However, I don't think last stable version of es dotnet client Elastic.Clients.Elasticsearch(version 8.0.1) support knn\_search. I try to use Knn feature like cod… --- ## [Field conversion - Transforming Unix Time into Date](https://discuss.elastic.co/t/field-conversion-transforming-unix-time-into-date/320063)
**Author:** [@pedrodantas](https://discuss.elastic.co/u/pedrodantas)\ **Replies:** 4\ **Last updated:** [November 30, 2022, 3:20pm UTC](https://discuss.elastic.co/t/field-conversion-transforming-unix-time-into-date/320063 "2022-11-30T15:20:58Z")
Hello! I was wondering if there is a way to convert a field that is being received in Unix Time (long) into a fully readable Date in the Kibana environment. My application is sending JSON logs to Kibana. Two of the log… --- ## [Number of open sockets](https://discuss.elastic.co/t/number-of-open-sockets/320087)
**Author:** [@INS](https://discuss.elastic.co/u/INS)\ **Replies:** 3\ **Last updated:** [November 30, 2022, 2:19pm UTC](https://discuss.elastic.co/t/number-of-open-sockets/320087 "2022-11-30T14:19:36Z")
Hi I'm getting regularly such output \>worker0\] elasticsearch - Failed to perform request {:message=\>"Connection reset", :exception=\>Manticore::SocketException, :cause=\>java.ne \[WARN \] 2022-11-29 18:33:45.720 \[\[my\_pipel… --- ## [Help on IF statement in Kibana painless script](https://discuss.elastic.co/t/help-on-if-statement-in-kibana-painless-script/320024)
**Author:** [@auato](https://discuss.elastic.co/u/auato)\ **Replies:** 6\ **Last updated:** [November 30, 2022, 2:07pm UTC](https://discuss.elastic.co/t/help-on-if-statement-in-kibana-painless-script/320024 "2022-11-30T14:07:51Z")
This script below works fine but I would like to insert an IF statement that executes these lines of code only in the case a third '\_' character is present in the field 'measurement', otherwise it does not execute anythi… --- ## [Timelion query to string containing slash "/" -- aka: howto use regexp in timelion](https://discuss.elastic.co/t/timelion-query-to-string-containing-slash-aka-howto-use-regexp-in-timelion/320158)
**Author:** [@DrG](https://discuss.elastic.co/u/DrG)\ **Replies:** 0\ **Last updated:** [November 30, 2022, 1:58pm UTC](https://discuss.elastic.co/t/timelion-query-to-string-containing-slash-aka-howto-use-regexp-in-timelion/320158 "2022-11-30T13:58:52Z")
Hello everybody, in the database, a set of strings (stringified ids) are there, stemming from a directory view. Now I like to filter out subfolders - aka filter out those elements containing slash(es). the database co… --- ## [Service map does not show the connection between services correctly](https://discuss.elastic.co/t/service-map-does-not-show-the-connection-between-services-correctly/320154)
**Author:** [@bfaccruent](https://discuss.elastic.co/u/bfaccruent)\ **Replies:** 0\ **Last updated:** [November 30, 2022, 1:28pm UTC](https://discuss.elastic.co/t/service-map-does-not-show-the-connection-between-services-correctly/320154 "2022-11-30T13:28:06Z")
I am using OpenTelemetry in my .NET app to trace requests. When I moved from Jaeger as the collector (observability tool) to Elastic, it does not show the connection between services correctly, despite that when I dig in… --- ## [Kibana (code=exited, status=78)](https://discuss.elastic.co/t/kibana-code-exited-status-78/319819)
**Author:** [@barnabe](https://discuss.elastic.co/u/barnabe)\ **Replies:** 6\ **Last updated:** [November 30, 2022, 1:17pm UTC](https://discuss.elastic.co/t/kibana-code-exited-status-78/319819 "2022-11-30T13:17:39Z")
Hello, I have a problem, Kibana is not starting for reasons that escape me I m not sure how to describe it best so here are the log and config files for Elasticsearch and Kibana as well as the error. the error kali ~ … --- ## [Wrong timestamp and timezone in Custom Log integration](https://discuss.elastic.co/t/wrong-timestamp-and-timezone-in-custom-log-integration/320151)
**Author:** [@hermlam](https://discuss.elastic.co/u/hermlam)\ **Replies:** 0\ **Last updated:** [November 30, 2022, 1:04pm UTC](https://discuss.elastic.co/t/wrong-timestamp-and-timezone-in-custom-log-integration/320151 "2022-11-30T13:04:53Z")
Hi, I have Raspberry Pi’s in different timezones writing logs to a Syslog server. The logs from the Syslog server are being collected by Elastic Agent and are correctly stored in the system.syslog Index Logs look like: … --- ## [Retrieve selected fields from a search - Does it work?](https://discuss.elastic.co/t/retrieve-selected-fields-from-a-search-does-it-work/320133)
**Author:** [@Grigio\_Basi](https://discuss.elastic.co/u/Grigio_Basi)\ **Replies:** 1\ **Last updated:** [November 30, 2022, 12:54pm UTC](https://discuss.elastic.co/t/retrieve-selected-fields-from-a-search-does-it-work/320133 "2022-11-30T12:54:37Z")
I have user's index. Okay. I wonna get limited list of my index fields. I read documentation and found it. I use \_source query and it doesn't work { "\_source": { "includes": \[ "is\_online"\], "excludes": \["logi… --- ## [Elastic Multi tenancy shared index](https://discuss.elastic.co/t/elastic-multi-tenancy-shared-index/319770)
**Author:** [@Zedson.Sagar](https://discuss.elastic.co/u/Zedson.Sagar)\ **Replies:** 7\ **Last updated:** [November 30, 2022, 12:27pm UTC](https://discuss.elastic.co/t/elastic-multi-tenancy-shared-index/319770 "2022-11-30T12:27:29Z")
Hi, we are planning to use Elasticsearch in a multi tenant environment. Based on the article here - https://www.elastic.co/blog/found-multi-tenancy We want to use a shared index model for all the tenants but are stumb… --- ## [Aggregation on flattened fields slows down due bulk writing](https://discuss.elastic.co/t/aggregation-on-flattened-fields-slows-down-due-bulk-writing/320149)
**Author:** [@Asym](https://discuss.elastic.co/u/Asym)\ **Replies:** 1\ **Last updated:** [November 30, 2022, 12:21pm UTC](https://discuss.elastic.co/t/aggregation-on-flattened-fields-slows-down-due-bulk-writing/320149 "2022-11-30T12:21:06Z")
Hi! While working with aggregation on flattened fields, we encountered a problem. We have a cluster, with 3 nodes, number of shards - 10, number of replicas - 2 and ~7 mln documents. Average aggregation (with flattene… --- ## [ElasticSearchAPIConnector - snippet or highlight query](https://discuss.elastic.co/t/elasticsearchapiconnector-snippet-or-highlight-query/320147)
**Author:** [@tavaradhan](https://discuss.elastic.co/u/tavaradhan)\ **Replies:** 0\ **Last updated:** [November 30, 2022, 11:36am UTC](https://discuss.elastic.co/t/elasticsearchapiconnector-snippet-or-highlight-query/320147 "2022-11-30T11:36:59Z")
hi, I am experimenting with ElasticsearchAPIConnector using SearchUI on a small document base. I want to get the full field returned with highlights. The field is less than 1000 characters long. I tried using highlight … --- ## [Дублирует новые дата ноды](https://discuss.elastic.co/t/topic/318436)
**Author:** [@cheportan](https://discuss.elastic.co/u/cheportan)\ **Replies:** 2\ **Last updated:** [November 30, 2022, 11:36am UTC](https://discuss.elastic.co/t/topic/318436 "2022-11-30T11:36:54Z")
Здравствуйте, я новичок и у меня возникла проблема, имеется 5 дата нод в кластере, в связи с избытком свободного пространства встал вопрос добавить еще пару нод, после клонирования меняется ip и host\_name виртуальной маш… --- ## [Visualization Color change from 6.0 to 7.0](https://discuss.elastic.co/t/visualization-color-change-from-6-0-to-7-0/319868)
**Author:** [@MorpheusPgh](https://discuss.elastic.co/u/MorpheusPgh)\ **Replies:** 2\ **Last updated:** [November 30, 2022, 11:20am UTC](https://discuss.elastic.co/t/visualization-color-change-from-6-0-to-7-0/319868 "2022-11-30T11:20:47Z")
I am importing my Visualizations from a Previous version of Kibana. Red was the Default first color, and in the latest release (7.17.4) the color schemes are completely different. How do I get a return to the colors I … --- ## [ILM, conditions field is empty](https://discuss.elastic.co/t/ilm-conditions-field-is-empty/319570)
**Author:** [@vitkon](https://discuss.elastic.co/u/vitkon)\ **Replies:** 2\ **Last updated:** [November 30, 2022, 8:17am UTC](https://discuss.elastic.co/t/ilm-conditions-field-is-empty/319570 "2022-11-30T08:17:08Z")
Hi, team! I created an ILM PUT \_ilm/policy/120-days-default { "policy": { "phases": { "hot": { "min\_age": "0ms", "actions": { "rollover": { "max\_primary\_shard\_size": "… --- ## [Logstash Scheduled Task](https://discuss.elastic.co/t/logstash-scheduled-task/319822)
**Author:** [@smam](https://discuss.elastic.co/u/smam)\ **Replies:** 2\ **Last updated:** [November 30, 2022, 11:04am UTC](https://discuss.elastic.co/t/logstash-scheduled-task/319822 "2022-11-30T11:04:33Z")
I read this post: Running Logstash on Windows | Logstash Reference \[8.5\] | Elastic And configured my Server to run Logstash every day. First question: I know that you can run logstash once and then just wait for new d… --- ## [Auditbeat get package vendor](https://discuss.elastic.co/t/auditbeat-get-package-vendor/320139)
**Author:** [@robdiluca](https://discuss.elastic.co/u/robdiluca)\ **Replies:** 0\ **Last updated:** [November 30, 2022, 10:56am UTC](https://discuss.elastic.co/t/auditbeat-get-package-vendor/320139 "2022-11-30T10:56:49Z")
Hi all, I'm trying to use Auditbeat's system module to get currently installed packages on monitored hosts. While being very useful, I noticed it does not send any information about the package vendor. Here what I obta… --- ## [Unable to see Timeline Section](https://discuss.elastic.co/t/unable-to-see-timeline-section/320070)
**Author:** [@milos1](https://discuss.elastic.co/u/milos1)\ **Replies:** 2\ **Last updated:** [November 30, 2022, 10:49am UTC](https://discuss.elastic.co/t/unable-to-see-timeline-section/320070 "2022-11-30T10:49:33Z")
Trying to visualize the Timeline Section under Security Menu, it automatically redirects me on Get Started page, as you can see from the image in attachment. --- ## [Elasticsearch Kibana API - Case Management filtering via API requests](https://discuss.elastic.co/t/elasticsearch-kibana-api-case-management-filtering-via-api-requests/320136)
**Author:** [@yzaritskyi](https://discuss.elastic.co/u/yzaritskyi)\ **Replies:** 1\ **Last updated:** [November 30, 2022, 10:30am UTC](https://discuss.elastic.co/t/elasticsearch-kibana-api-case-management-filtering-via-api-requests/320136 "2022-11-30T10:30:12Z")
Hey all! I'm investigating the REST API of Kibana. I'm interested in the implementation of some automatization processes using our SOAR. I have configured the Webhook for Case Management, and now I get the Cases when s… --- ## [How to create a polar plot with degree (0-360 ° )](https://discuss.elastic.co/t/how-to-create-a-polar-plot-with-degree-0-360/320134)
**Author:** [@Lolo](https://discuss.elastic.co/u/Lolo)\ **Replies:** 0\ **Last updated:** [November 30, 2022, 9:51am UTC](https://discuss.elastic.co/t/how-to-create-a-polar-plot-with-degree-0-360/320134 "2022-11-30T09:51:42Z")
Hi I want to create a polar chart using data with degree 0-360° and plot some line (aggregated as heatmap line). then, I would like to filter on it (for example in the North, from 330° to 30°). how can I create someth… --- ## [Index mapping limit](https://discuss.elastic.co/t/index-mapping-limit/320127)
**Author:** [@gjahagir](https://discuss.elastic.co/u/gjahagir)\ **Replies:** 2\ **Last updated:** [November 30, 2022, 9:25am UTC](https://discuss.elastic.co/t/index-mapping-limit/320127 "2022-11-30T09:25:00Z")
Hi, I'm new to elastic and exploring its possibilities to incorporate into our application. Ours is a multi tenant application and based on several blogs we narrowed down to use Shared index model of elastic where all … --- ## [Unable to connect to logstash from filebeat](https://discuss.elastic.co/t/unable-to-connect-to-logstash-from-filebeat/320131)
**Author:** [@Neelam\_Zanvar](https://discuss.elastic.co/u/Neelam_Zanvar)\ **Replies:** 0\ **Last updated:** [November 30, 2022, 9:21am UTC](https://discuss.elastic.co/t/unable-to-connect-to-logstash-from-filebeat/320131 "2022-11-30T09:21:47Z")
Hi I've setup filebeat on the machine A elasticsearch and kibana on machine B and logstash on machine C. When i try to send logs from filebeat to logstash i am getting a connection refused error in status. all the servi… --- ## [We would love to hear your feedback!](https://discuss.elastic.co/t/we-would-love-to-hear-your-feedback/320130)
**Author:** [@Akhilesh\_Pokhariyal](https://discuss.elastic.co/u/Akhilesh_Pokhariyal)\ **Replies:** 0\ **Last updated:** [November 30, 2022, 9:19am UTC](https://discuss.elastic.co/t/we-would-love-to-hear-your-feedback/320130 "2022-11-30T09:19:20Z")
Hi, As the Product Manager responsible for the Storage Explorer feature, I would appreciate your feedback on its value. We have introduced this feature to help our APM users understand the storage footprint of each inst… --- ## [Rollup Jobs losing data](https://discuss.elastic.co/t/rollup-jobs-losing-data/320072)
**Author:** [@nicfr9](https://discuss.elastic.co/u/nicfr9)\ **Replies:** 1\ **Last updated:** [November 30, 2022, 9:09am UTC](https://discuss.elastic.co/t/rollup-jobs-losing-data/320072 "2022-11-30T09:09:01Z")
Hi everybody, I have a big problem with rollup jobs. When I try to execute a rollup job of 51 million recors, I don't get the expected result. I have various terms and metrics to aggregate; down below you can check th… --- ## [Bulk Observable giving refresh error on inserting documents](https://discuss.elastic.co/t/bulk-observable-giving-refresh-error-on-inserting-documents/319726)
**Author:** [@ali\_haider](https://discuss.elastic.co/u/ali_haider)\ **Replies:** 3\ **Last updated:** [November 30, 2022, 9:01am UTC](https://discuss.elastic.co/t/bulk-observable-giving-refresh-error-on-inserting-documents/319726 "2022-11-30T09:01:06Z")
Hi, I am using Elastic Cloud Elastic Stack version : 7.17 NEST Nuget Package : 7.17 I am consuming bulk Observable indexing with and trying to insert records in bulk and facing the following error The Exception mes… --- ## [How do I write correct query in nested document?](https://discuss.elastic.co/t/how-do-i-write-correct-query-in-nested-document/320065)
**Author:** [@john2022](https://discuss.elastic.co/u/john2022)\ **Replies:** 0\ **Last updated:** [November 29, 2022, 3:45pm UTC](https://discuss.elastic.co/t/how-do-i-write-correct-query-in-nested-document/320065 "2022-11-29T15:45:08Z")
I have two indices: country and person PUT person { "mappings": { "properties": { "info": { "type": "nested", "properties": { "int\_val": {"type": "integer"}, "str\_val": {… [Previous page](https://discuss.elastic.co/latest.md?page=875) [Next page](https://discuss.elastic.co/latest.md?page=877)