# Latest **URL:** https://discuss.elastic.co/latest.md?page=884 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 885 --- ## [Logstash stopped processing](https://discuss.elastic.co/t/logstash-stopped-processing/319641)
**Author:** [@shubham.s](https://discuss.elastic.co/u/shubham.s)\ **Replies:** 10\ **Last updated:** [November 24, 2022, 7:27am UTC](https://discuss.elastic.co/t/logstash-stopped-processing/319641 "2022-11-24T07:27:29Z")
Hi, The elasticsearch and kibana are working as intentional but after installing and configuring logstash in centos , the service stops \[2022-11-23T15:20:38,842\]\[INFO \]\[logstash.runner \] Log4j configuration pa… --- ## [How will create a global variable in logstash?](https://discuss.elastic.co/t/how-will-create-a-global-variable-in-logstash/319705)
**Author:** [@Rakhshunda\_Noorein\_J](https://discuss.elastic.co/u/Rakhshunda_Noorein_J)\ **Replies:** 0\ **Last updated:** [November 24, 2022, 7:08am UTC](https://discuss.elastic.co/t/how-will-create-a-global-variable-in-logstash/319705 "2022-11-24T07:08:57Z")
Hello, My config is like this - input{ http\_poller{ // here I have mentioned API url and authorisation tags =\> \["tag1"\] } http\_poller{ // here I have mentioned API url and authorisation tags =\> \["tag2"\] } http\_poller{ … --- ## [Ingest only ERROR and warning logs to elastic search](https://discuss.elastic.co/t/ingest-only-error-and-warning-logs-to-elastic-search/319634)
**Author:** [@rahul\_sirugudi](https://discuss.elastic.co/u/rahul_sirugudi)\ **Replies:** 2\ **Last updated:** [November 24, 2022, 4:55am UTC](https://discuss.elastic.co/t/ingest-only-error-and-warning-logs-to-elastic-search/319634 "2022-11-24T04:55:28Z")
Hi I am trying to ingest only ERROR and warning logs to Elasticsearch. Currently filebeat is shipping logs to log stash, i am using grok pattern. grok { match =\> { "message" =\> "%{IPV4:ip} - \\\[%{TIMESTAMP\_ISO8601:timest… --- ## [Logstash tcp plugin](https://discuss.elastic.co/t/logstash-tcp-plugin/319584)
**Author:** [@SilasMuniz1](https://discuss.elastic.co/u/SilasMuniz1)\ **Replies:** 3\ **Last updated:** [November 24, 2022, 12:08am UTC](https://discuss.elastic.co/t/logstash-tcp-plugin/319584 "2022-11-24T00:08:35Z")
Hello, I need convert a data field to date field. I am working in restore processed, where I get an old file and insert into elasticsearch by logstash. I received a file with this date format \[06/Jun/2022:13:20:01 -03… --- ## [Packetbeat Adding Output Fields from YML config file](https://discuss.elastic.co/t/packetbeat-adding-output-fields-from-yml-config-file/319686)
**Author:** [@dbh1985](https://discuss.elastic.co/u/dbh1985)\ **Replies:** 0\ **Last updated:** [November 23, 2022, 9:57pm UTC](https://discuss.elastic.co/t/packetbeat-adding-output-fields-from-yml-config-file/319686 "2022-11-23T21:57:12Z")
How can I configure the packetbeat yml file to add a field "username" if an output field exists "agent.hostname" equal to a specific value? Here's what I got so far, but unable to start service afterwards: I've put thi… --- ## [EQL match event A only if event B does not occur within maxspan](https://discuss.elastic.co/t/eql-match-event-a-only-if-event-b-does-not-occur-within-maxspan/319684)
**Author:** [@jyoung15](https://discuss.elastic.co/u/jyoung15)\ **Replies:** 0\ **Last updated:** [November 23, 2022, 9:17pm UTC](https://discuss.elastic.co/t/eql-match-event-a-only-if-event-b-does-not-occur-within-maxspan/319684 "2022-11-23T21:17:41Z")
Hi, My question is similar to https://discuss.elastic.co/t/creating-alert-when-event-didnt-occur/282195, which was never really resolved. I'm looking to see if there are any other suggestions how to handle this. Basica… --- ## [Possible to hide "panel filters" in Kibana 8.5.x?](https://discuss.elastic.co/t/possible-to-hide-panel-filters-in-kibana-8-5-x/319082)
**Author:** [@rcowart](https://discuss.elastic.co/u/rcowart)\ **Replies:** 3\ **Last updated:** [November 23, 2022, 7:32pm UTC](https://discuss.elastic.co/t/possible-to-hide-panel-filters-in-kibana-8-5-x/319082 "2022-11-23T19:32:12Z")
This "panel filters" thing has been added in Kibana 8.5. Is there any configuration option to hide this? We find that it... does not to add any real value is distracting takes up valuable screen real estate --- ## [Kibana is not starting](https://discuss.elastic.co/t/kibana-is-not-starting/319649)
**Author:** [@venkata\_pavan\_kalyan](https://discuss.elastic.co/u/venkata_pavan_kalyan)\ **Replies:** 1\ **Last updated:** [November 23, 2022, 7:41pm UTC](https://discuss.elastic.co/t/kibana-is-not-starting/319649 "2022-11-23T19:41:18Z")
Kibana is not starting from ansible kibana service is starting when ansible role executed after playbook execution completed automatically kibana service stopping immediately cmd: /usr/bin/nohup ./kibana & --- ## [Failure to change the password to elk](https://discuss.elastic.co/t/failure-to-change-the-password-to-elk/319672)
**Author:** [@jihen\_barbouche](https://discuss.elastic.co/u/jihen_barbouche)\ **Replies:** 1\ **Last updated:** [November 23, 2022, 7:36pm UTC](https://discuss.elastic.co/t/failure-to-change-the-password-to-elk/319672 "2022-11-23T19:36:37Z")
hello there , i enabled the xpack and i want to change the password but i have this error connection failure to https://...:9200/\_security/\_authentication?pretty failed: connection refused --- ## [How to iterate through json array and print a formatted string?](https://discuss.elastic.co/t/how-to-iterate-through-json-array-and-print-a-formatted-string/319676)
**Author:** [@learningelastic](https://discuss.elastic.co/u/learningelastic)\ **Replies:** 1\ **Last updated:** [November 23, 2022, 6:27pm UTC](https://discuss.elastic.co/t/how-to-iterate-through-json-array-and-print-a-formatted-string/319676 "2022-11-23T18:27:47Z")
I'm learning how to use logstash and I got things to mostly work. But I want to learn how to iterate through a json array and print a formatted result set. For example, I created a file called /root/test.log with the fo… --- ## [Logstash x handling duplicate](https://discuss.elastic.co/t/logstash-x-handling-duplicate/319604)
**Author:** [@lchan](https://discuss.elastic.co/u/lchan)\ **Replies:** 2\ **Last updated:** [November 23, 2022, 5:27pm UTC](https://discuss.elastic.co/t/logstash-x-handling-duplicate/319604 "2022-11-23T17:27:26Z")
Hi all, I am trying to increase number of logstash servers for redundancy and want to know if using fingerprint would achieve it. Does this basically sending the same stream of logs/messages via multiple logstash serve… --- ## [Retrieve records and update a field at the same time](https://discuss.elastic.co/t/retrieve-records-and-update-a-field-at-the-same-time/319465)
**Author:** [@xef](https://discuss.elastic.co/u/xef)\ **Replies:** 8\ **Last updated:** [November 23, 2022, 5:35pm UTC](https://discuss.elastic.co/t/retrieve-records-and-update-a-field-at-the-same-time/319465 "2022-11-23T17:35:38Z")
Is there anyway when making a query in Elasticsearch, to update a field (such as say a counter++) in each record that is selected by the query. Thanks --- ## [Include session variables in the connection string for jdbc\_static fails](https://discuss.elastic.co/t/include-session-variables-in-the-connection-string-for-jdbc-static-fails/319631)
**Author:** [@Muecker](https://discuss.elastic.co/u/Muecker)\ **Replies:** 1\ **Last updated:** [November 23, 2022, 4:24pm UTC](https://discuss.elastic.co/t/include-session-variables-in-the-connection-string-for-jdbc-static-fails/319631 "2022-11-23T16:24:05Z")
Hello, i want to use the jdbc\_static plugin from logstash, but it throws an error: \[2022-11-22T13:36:19,153\]\[WARN \]\[org.mariadb.jdbc.message.server.ErrorPacket\]\[pipeline\_name\] Error: 1064-42000: You have an error in you… --- ## [Azure Private link APM agent connectivity issue](https://discuss.elastic.co/t/azure-private-link-apm-agent-connectivity-issue/319668)
**Author:** [@RafaelPrade](https://discuss.elastic.co/u/RafaelPrade)\ **Replies:** 4\ **Last updated:** [November 23, 2022, 3:29pm UTC](https://discuss.elastic.co/t/azure-private-link-apm-agent-connectivity-issue/319668 "2022-11-23T15:29:40Z")
Hello, I am using a private link with our Elastic cloud instance on azure running on version 7.14. I am trying to add an APM Java agent to one of our servers. The Example configuration file given in Kibana includes the p… --- ## [Kibana start but not accessible](https://discuss.elastic.co/t/kibana-start-but-not-accessible/319666)
**Author:** [@mohamedjmal](https://discuss.elastic.co/u/mohamedjmal)\ **Replies:** 2\ **Last updated:** [November 23, 2022, 3:13pm UTC](https://discuss.elastic.co/t/kibana-start-but-not-accessible/319666 "2022-11-23T15:13:10Z")
elasticsearch and kibana started successfully but the kibana interface does not show anything this is the kibana log , tell me that the host is "elastic1.sifast.local" but it is the ip adress in the kibana.yml ela… --- ## [Split filepath to a new field](https://discuss.elastic.co/t/split-filepath-to-a-new-field/319657)
**Author:** [@nestro](https://discuss.elastic.co/u/nestro)\ **Replies:** 2\ **Last updated:** [November 23, 2022, 2:51pm UTC](https://discuss.elastic.co/t/split-filepath-to-a-new-field/319657 "2022-11-23T14:51:56Z")
Hi! I use Filebeat on a central Syslog server which collects logs from all network devices. Filebeat is configured to collect the logs (which are arrenged by days in the month) from this server and sends them to Logstash… --- ## [Fleet server goes down when elastic search node used to enroll the fleet server goes down](https://discuss.elastic.co/t/fleet-server-goes-down-when-elastic-search-node-used-to-enroll-the-fleet-server-goes-down/317162)
**Author:** [@shi](https://discuss.elastic.co/u/shi)\ **Replies:** 1\ **Last updated:** [October 26, 2022, 6:23pm UTC](https://discuss.elastic.co/t/fleet-server-goes-down-when-elastic-search-node-used-to-enroll-the-fleet-server-goes-down/317162 "2022-10-26T18:23:09Z")
We have 3 elasticsearch nodes and a client node. node 1, node 2, node 3 We added all the elasticsearch nodes as output in fleet settings so that even when one elasticsearch node goes down, the fleet will sent the dat… --- ## [Forward logs from rsyslog to Elasticsearch](https://discuss.elastic.co/t/forward-logs-from-rsyslog-to-elasticsearch/319597)
**Author:** [@vassiliy.vins](https://discuss.elastic.co/u/vassiliy.vins)\ **Replies:** 2\ **Last updated:** [November 23, 2022, 1:18pm UTC](https://discuss.elastic.co/t/forward-logs-from-rsyslog-to-elasticsearch/319597 "2022-11-23T13:18:52Z")
Hi! Need to use rsyslog to send data to Elasticsearh. Could you provide link to documentation? Manual? Thank you, Regards, Vassiliy --- ## [Seccomp default policy is missing clock\_nanosleep](https://discuss.elastic.co/t/seccomp-default-policy-is-missing-clock-nanosleep/319637)
**Author:** [@izaneuski](https://discuss.elastic.co/u/izaneuski)\ **Replies:** 2\ **Last updated:** [November 23, 2022, 1:03pm UTC](https://discuss.elastic.co/t/seccomp-default-policy-is-missing-clock-nanosleep/319637 "2022-11-23T13:03:27Z")
On some ubuntu hosts I'm facing high CPU consumption by auditbeat(7.16.3&8.5.1) and journalbeat(7.15.2) with default config. During investigation with strace found out: clock\_nanosleep(CLOCK\_REALTIME, 0, {tv\_sec=0, tv\_… --- ## [Observability Apps on AWS](https://discuss.elastic.co/t/observability-apps-on-aws/319209)
**Author:** [@MicaT](https://discuss.elastic.co/u/MicaT)\ **Replies:** 2\ **Last updated:** [November 23, 2022, 12:59pm UTC](https://discuss.elastic.co/t/observability-apps-on-aws/319209 "2022-11-23T12:59:38Z")
Hello everyone, I'm new here and in the field of observability. I manage many apps in different AWS services. I have difficulties to monioring all those apps. And I decided to set up ELK stack. This picture show … --- ## [Cyclic reference eror while dissecting source.nat.port](https://discuss.elastic.co/t/cyclic-reference-eror-while-dissecting-source-nat-port/319656)
**Author:** [@GeorgeGkinis](https://discuss.elastic.co/u/GeorgeGkinis)\ **Replies:** 1\ **Last updated:** [November 23, 2022, 12:42pm UTC](https://discuss.elastic.co/t/cyclic-reference-eror-while-dissecting-source-nat-port/319656 "2022-11-23T12:42:47Z")
i all! I get the following output when starting filebeat with one processor: .... {"log.level":"error","@timestamp":"2022-11-23T13:29:24.875+0100","log.origin":{"file.name":"instance/beat.go","file.line":1057},"message… --- ## [Field data type for multi\_match query with type phrase](https://discuss.elastic.co/t/field-data-type-for-multi-match-query-with-type-phrase/319652)
**Author:** [@ChristopherHS](https://discuss.elastic.co/u/ChristopherHS)\ **Replies:** 0\ **Last updated:** [November 23, 2022, 11:44am UTC](https://discuss.elastic.co/t/field-data-type-for-multi-match-query-with-type-phrase/319652 "2022-11-23T11:44:45Z")
Hello, I have the following query: { "size": 40, "from": 0, "query": { "bool": { "must": \[ { "multi\_match": { "query": "my sea… --- ## [Mixed line types JSON and Plain Text in the same file with multiline](https://discuss.elastic.co/t/mixed-line-types-json-and-plain-text-in-the-same-file-with-multiline/319648)
**Author:** [@sirReeall](https://discuss.elastic.co/u/sirReeall)\ **Replies:** 0\ **Last updated:** [November 23, 2022, 10:53am UTC](https://discuss.elastic.co/t/mixed-line-types-json-and-plain-text-in-the-same-file-with-multiline/319648 "2022-11-23T10:53:45Z")
Hello, I've got log files that can contain plain text lines from a Java application and JSON lines. To complicate matters the plain text lines can be multiline , for example a Java stack trace, so I'm using the multili… --- ## [Logstash Not sending data to Elasticsearch](https://discuss.elastic.co/t/logstash-not-sending-data-to-elasticsearch/319643)
**Author:** [@abkonred](https://discuss.elastic.co/u/abkonred)\ **Replies:** 0\ **Last updated:** [November 23, 2022, 10:37am UTC](https://discuss.elastic.co/t/logstash-not-sending-data-to-elasticsearch/319643 "2022-11-23T10:37:41Z")
Hi Team, I have created a pipeline and sending data from filebeat to logstash and to Elasticsearch. and I have created one custom field from filebeat to filter the data. Not sue why it is not sending data to "apa" index… --- ## [Elastic Cloud vs Azure Monitor](https://discuss.elastic.co/t/elastic-cloud-vs-azure-monitor/319642)
**Author:** [@mgfeal](https://discuss.elastic.co/u/mgfeal)\ **Replies:** 0\ **Last updated:** [November 23, 2022, 10:10am UTC](https://discuss.elastic.co/t/elastic-cloud-vs-azure-monitor/319642 "2022-11-23T10:10:01Z")
Hello, We have hired Elastic Cloud to monitor our on-premises platform. We are migrating our software to Azure. So far we have been working with Azure Monitor, Application Insights, Workbooks... but we haven't spent muc… --- ## [HTTPJSON input : get only new records](https://discuss.elastic.co/t/httpjson-input-get-only-new-records/319598)
**Author:** [@djesus](https://discuss.elastic.co/u/djesus)\ **Replies:** 0\ **Last updated:** [November 23, 2022, 12:24am UTC](https://discuss.elastic.co/t/httpjson-input-get-only-new-records/319598 "2022-11-23T00:24:17Z")
hi everyone! im trying to get audit logs from a cloud api, the logs on the api are always the same unless there is a new login happening. while using the httpjson input im always getting all data again, creating multip… --- ## [Elasticsearch disk keep getting full when using data-stream](https://discuss.elastic.co/t/elasticsearch-disk-keep-getting-full-when-using-data-stream/319276)
**Author:** [@MyNameHasDiactrics](https://discuss.elastic.co/u/MyNameHasDiactrics)\ **Replies:** 2\ **Last updated:** [November 23, 2022, 9:16am UTC](https://discuss.elastic.co/t/elasticsearch-disk-keep-getting-full-when-using-data-stream/319276 "2022-11-23T09:16:50Z")
This morning I woke up to this: This is not the first time that it happens, and when it happens it blocks everything: I cannot access Kibana, Elasticsearch doesn't answer at all, this means I also cannot delete data u… --- ## [And of array items in terms query](https://discuss.elastic.co/t/and-of-array-items-in-terms-query/319633)
**Author:** [@chirag\_bansal](https://discuss.elastic.co/u/chirag_bansal)\ **Replies:** 0\ **Last updated:** [November 23, 2022, 9:07am UTC](https://discuss.elastic.co/t/and-of-array-items-in-terms-query/319633 "2022-11-23T09:07:17Z")
Hi, I need to know that whether an AND functionality of terms query exists or not? For example - { "terms": { "color": \[ blue, red, black \] } } The above query will return all t… --- ## [APM Server configuration for 8.x and future ES versions](https://discuss.elastic.co/t/apm-server-configuration-for-8-x-and-future-es-versions/319554)
**Author:** [@natbronislavska](https://discuss.elastic.co/u/natbronislavska)\ **Replies:** 2\ **Last updated:** [November 23, 2022, 8:08am UTC](https://discuss.elastic.co/t/apm-server-configuration-for-8-x-and-future-es-versions/319554 "2022-11-23T08:08:40Z")
We are using IaC approach for our Elastic configuration and we have all resources defined in YAML files. It is very important for us to have it this way. Our APM configuration looks as below: apm.yaml: apiVersion: apm.… --- ## [Authentication of \[elastic\] was terminated by realm \[reserved\]](https://discuss.elastic.co/t/authentication-of-elastic-was-terminated-by-realm-reserved/319621)
**Author:** [@Elitlogik](https://discuss.elastic.co/u/Elitlogik)\ **Replies:** 0\ **Last updated:** [November 23, 2022, 7:32am UTC](https://discuss.elastic.co/t/authentication-of-elastic-was-terminated-by-realm-reserved/319621 "2022-11-23T07:32:57Z")
Authentication of \[elastic\] was terminated by realm \[reserved\] - failed to authenticate user \[elastic\] | @timestamp=2022-11-23T07:21:04.573Z log.level=INFO ecs.version=1.2.0 service.name=ES\_ECS event.dataset=elasticsear… [Previous page](https://discuss.elastic.co/latest.md?page=883) [Next page](https://discuss.elastic.co/latest.md?page=885)