# Latest **URL:** https://discuss.elastic.co/latest.md?page=899 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 900 --- ## [Sorting identical timestamp of logs in kibana](https://discuss.elastic.co/t/sorting-identical-timestamp-of-logs-in-kibana/318746)
**Author:** [@Bikash\_Swain](https://discuss.elastic.co/u/Bikash_Swain)\ **Replies:** 0\ **Last updated:** [November 11, 2022, 1:57pm UTC](https://discuss.elastic.co/t/sorting-identical-timestamp-of-logs-in-kibana/318746 "2022-11-11T13:57:36Z")
Hi , I have filebeat-logstash-ES-kibana setup for index abc\* for one of the application log. In log file we have many occurrences of identical timestamp for messages/logs. sample log file below. when we are searching … --- ## [Rollup with max/min aggregation on @timestamp field typed as "float"](https://discuss.elastic.co/t/rollup-with-max-min-aggregation-on-timestamp-field-typed-as-float/317735)
**Author:** [@ISim](https://discuss.elastic.co/u/ISim)\ **Replies:** 3\ **Last updated:** [November 11, 2022, 1:46pm UTC](https://discuss.elastic.co/t/rollup-with-max-min-aggregation-on-timestamp-field-typed-as-float/317735 "2022-11-11T13:46:44Z")
Hello all, I have a index with accounting events with @timestamp (type "date"). There is a high volume of events so I created rollup job (elasticsearch 7.17.3) with "date\_histogram" : { "d… --- ## [Logstash Syslog output plugin streaming adds additional headers](https://discuss.elastic.co/t/logstash-syslog-output-plugin-streaming-adds-additional-headers/318719)
**Author:** [@Anandh\_Kumar](https://discuss.elastic.co/u/Anandh_Kumar)\ **Replies:** 1\ **Last updated:** [November 11, 2022, 1:45pm UTC](https://discuss.elastic.co/t/logstash-syslog-output-plugin-streaming-adds-additional-headers/318719 "2022-11-11T13:45:43Z")
Hi We are using Logstash syslog output plugin v3.0.5 to stream audit log to a external SIEM server using TCP with SSL. It is observed that there are additional headers automatically appended by the plugin to the origina… --- ## [CEF message parsing](https://discuss.elastic.co/t/cef-message-parsing/318743)
**Author:** [@d\_c](https://discuss.elastic.co/u/d_c)\ **Replies:** 0\ **Last updated:** [November 11, 2022, 1:14pm UTC](https://discuss.elastic.co/t/cef-message-parsing/318743 "2022-11-11T13:14:15Z")
Hello, I'm using TCP Input plugin with CEF codec to receive CEF messages. Problem is, that some messages are not parsed parsed correctly. Message isn't processed as whole, but it's split at blankspace character within m… --- ## [Import saved objects through API](https://discuss.elastic.co/t/import-saved-objects-through-api/315481)
**Author:** [@hemmerlin](https://discuss.elastic.co/u/hemmerlin)\ **Replies:** 2\ **Last updated:** [October 14, 2022, 4:00pm UTC](https://discuss.elastic.co/t/import-saved-objects-through-api/315481 "2022-10-14T16:00:32Z")
Hello, To summarize this post, I'm able to import Kibana saved objects using the web UI, but I face some issues importing them using the API. We use a dashboard.ndjson file which is the result of a saved object export … --- ## [Scaling elastic search for read heavy applications](https://discuss.elastic.co/t/scaling-elastic-search-for-read-heavy-applications/317597)
**Author:** [@himesh](https://discuss.elastic.co/u/himesh)\ **Replies:** 11\ **Last updated:** [November 11, 2022, 12:03pm UTC](https://discuss.elastic.co/t/scaling-elastic-search-for-read-heavy-applications/317597 "2022-11-11T12:03:37Z")
We have Node JS (Nest JS / Express) - based application services on the GCP cloud. We are using Elasticsearch to support full-text search on a blog/news website. Our requirement is to support 2000 reads per second mini… --- ## [I wanted to have the top 10 API's with more latency in elastic dashboard](https://discuss.elastic.co/t/i-wanted-to-have-the-top-10-apis-with-more-latency-in-elastic-dashboard/318734)
**Author:** [@gatewaymaster](https://discuss.elastic.co/u/gatewaymaster)\ **Replies:** 0\ **Last updated:** [November 11, 2022, 11:24am UTC](https://discuss.elastic.co/t/i-wanted-to-have-the-top-10-apis-with-more-latency-in-elastic-dashboard/318734 "2022-11-11T11:24:25Z")
Hi Guyz, I am completely new to elastic, our application is hosted in kubernetes and all the logs are sending to elastic, we wanted to create a dashboard an done of the requirement is that in our gateway, we do get lots… --- ## [Suricata SIEM](https://discuss.elastic.co/t/suricata-siem/318733)
**Author:** [@Ryhal\_Kumar](https://discuss.elastic.co/u/Ryhal_Kumar)\ **Replies:** 0\ **Last updated:** [November 11, 2022, 11:15am UTC](https://discuss.elastic.co/t/suricata-siem/318733 "2022-11-11T11:15:32Z")
I am running a suricata siem with suricata,elasticsearch,kibana and filebeat. But there are few issues, while the dashboard is running it is fine but when I run a ddos attack using kali it stops working and shows alert o… --- ## [Any performance difference between "must\_not" clause and "query\_string" with NOT operator?](https://discuss.elastic.co/t/any-performance-difference-between-must-not-clause-and-query-string-with-not-operator/318729)
**Author:** [@astrodi](https://discuss.elastic.co/u/astrodi)\ **Replies:** 0\ **Last updated:** [November 11, 2022, 11:09am UTC](https://discuss.elastic.co/t/any-performance-difference-between-must-not-clause-and-query-string-with-not-operator/318729 "2022-11-11T11:09:39Z")
Hi there, I'm wondering, if there is any performance gain using must\_not clause over to query\_string using NOT operator (will be used inside filter and should clause). query\_string has obviously shorter scripture, no r… --- ## [Input/output error when creating snapshot](https://discuss.elastic.co/t/input-output-error-when-creating-snapshot/318721)
**Author:** [@lifer](https://discuss.elastic.co/u/lifer)\ **Replies:** 1\ **Last updated:** [November 11, 2022, 10:48am UTC](https://discuss.elastic.co/t/input-output-error-when-creating-snapshot/318721 "2022-11-11T10:48:38Z")
Hi! We have a 3-nodes self-hosted ES 8.5 cluster, and when we make daily snapshots few shards fail every time with the following error: INTERNAL\_SERVER\_ERROR: UncategorizedExecutionException\[Failed execution\]; nested:… --- ## [Pipeline getting terminated with OrgJrubyExceptions::ThreadKill](https://discuss.elastic.co/t/pipeline-getting-terminated-with-orgjrubyexceptions-threadkill/318724)
**Author:** [@Hafis](https://discuss.elastic.co/u/Hafis)\ **Replies:** 0\ **Last updated:** [November 11, 2022, 10:25am UTC](https://discuss.elastic.co/t/pipeline-getting-terminated-with-orgjrubyexceptions-threadkill/318724 "2022-11-11T10:25:45Z")
Hi Am using logstash 8.4.0 with csv filter. Am facing an issue that logstash is getting killed itself. From the logs I can see that the pipeline is getting terminated. Below I have pasted sample logs. \[2022-11-11T06:40… --- ## [Upgrade to apm-server 8: Error response from daemon: unable to find user apm-server: no matching entries in passwd file](https://discuss.elastic.co/t/upgrade-to-apm-server-8-error-response-from-daemon-unable-to-find-user-apm-server-no-matching-entries-in-passwd-file/318658)
**Author:** [@amcsi](https://discuss.elastic.co/u/amcsi)\ **Replies:** 1\ **Last updated:** [November 11, 2022, 10:21am UTC](https://discuss.elastic.co/t/upgrade-to-apm-server-8-error-response-from-daemon-unable-to-find-user-apm-server-no-matching-entries-in-passwd-file/318658 "2022-11-11T10:21:13Z")
I'm using the ELK stack in Docker and I upgraded from 7.17 to 8.5. I'm getting this error message in journalctl, and APM-Server never starts: Error response from daemon: unable to find user apm-server: no matching entri… --- ## [Use Filebeat in MacOS M1 to ship extracted win evtx file to docker ELK](https://discuss.elastic.co/t/use-filebeat-in-macos-m1-to-ship-extracted-win-evtx-file-to-docker-elk/318723)
**Author:** [@Roger\_Huang](https://discuss.elastic.co/u/Roger_Huang)\ **Replies:** 0\ **Last updated:** [November 11, 2022, 10:19am UTC](https://discuss.elastic.co/t/use-filebeat-in-macos-m1-to-ship-extracted-win-evtx-file-to-docker-elk/318723 "2022-11-11T10:19:09Z")
Hi all, I am new to ELK. I know this may sounds weird. But I am doing some POC and testing by extracting a Sysmon EVTX from a windows server. The workstation I am using a Mac M1. I installed filebeat in Mac and wanted … --- ## [Master not discovered or elected yet](https://discuss.elastic.co/t/master-not-discovered-or-elected-yet/318706)
**Author:** [@usilva](https://discuss.elastic.co/u/usilva)\ **Replies:** 3\ **Last updated:** [November 11, 2022, 9:12am UTC](https://discuss.elastic.co/t/master-not-discovered-or-elected-yet/318706 "2022-11-11T09:12:46Z")
{"type": "server", "timestamp": "2022-11-11T05:46:01,375Z", "level": "WARN", "component": "o.e.c.c.ClusterFormationFailureHelper", "cluster.name": "elasticsearch", "node.name": "elasticsearch-master-0", "message": "mas… --- ## [Extract data from elasticsearch and store into mongodb](https://discuss.elastic.co/t/extract-data-from-elasticsearch-and-store-into-mongodb/318337)
**Author:** [@chinmoy\_padhi](https://discuss.elastic.co/u/chinmoy_padhi)\ **Replies:** 4\ **Last updated:** [November 11, 2022, 7:44am UTC](https://discuss.elastic.co/t/extract-data-from-elasticsearch-and-store-into-mongodb/318337 "2022-11-11T07:44:32Z")
Hi, I'm looking for an option to extract data from Elasticsearch and store into the mongodb using some python script. Please help me with that. --- ## [Winlogbeat events not parsed](https://discuss.elastic.co/t/winlogbeat-events-not-parsed/318518)
**Author:** [@vitkon](https://discuss.elastic.co/u/vitkon)\ **Replies:** 1\ **Last updated:** [November 11, 2022, 9:08am UTC](https://discuss.elastic.co/t/winlogbeat-events-not-parsed/318518 "2022-11-11T09:08:50Z")
Hello, I am using elasticstack v8. The messages are sent from winlogbeat -\> logstash -\> elastic. The message is arrived unparsed. Logstash config: input { beats { port =\> "5044" … --- ## [Watcher로 slack 연동 문의](https://discuss.elastic.co/t/watcher-slack/318717)
**Author:** [@wodhgud](https://discuss.elastic.co/u/wodhgud)\ **Replies:** 0\ **Last updated:** [November 11, 2022, 8:45am UTC](https://discuss.elastic.co/t/watcher-slack/318717 "2022-11-11T08:45:52Z")
안녕하세요 watcher 기능 관련하여 문의사항이 있습니다. { "trigger": { "schedule": { "interval": "10s" } }, "input": { "search": { "request": { "search\_type": "query\_then\_fetch", "indices": \[ "metricbeat-\*" \], "rest\_total\_hits\_… --- ## [Elastic Dashboard code of Elastic.co](https://discuss.elastic.co/t/elastic-dashboard-code-of-elastic-co/318688)
**Author:** [@kelk](https://discuss.elastic.co/u/kelk)\ **Replies:** 2\ **Last updated:** [November 11, 2022, 7:13am UTC](https://discuss.elastic.co/t/elastic-dashboard-code-of-elastic-co/318688 "2022-11-11T07:13:25Z")
Just checking the stock ticker of Elastic https://ir.elastic.co/stock/stock-quote/default.aspx Any chance to get the code of the above ? Looks nice and clean and blazing fast. cheers --- ## [Network devices like switch and firewall logs not visible in ELk](https://discuss.elastic.co/t/network-devices-like-switch-and-firewall-logs-not-visible-in-elk/318711)
**Author:** [@vrkumar79](https://discuss.elastic.co/u/vrkumar79)\ **Replies:** 0\ **Last updated:** [November 11, 2022, 6:48am UTC](https://discuss.elastic.co/t/network-devices-like-switch-and-firewall-logs-not-visible-in-elk/318711 "2022-11-11T06:48:25Z")
network devices like switches and firewall logs are not visible in Elk. we are using customized UDP ports for each location, --- ## [How to resize image file in watcher](https://discuss.elastic.co/t/how-to-resize-image-file-in-watcher/318703)
**Author:** [@minkiyo](https://discuss.elastic.co/u/minkiyo)\ **Replies:** 0\ **Last updated:** [November 11, 2022, 2:51am UTC](https://discuss.elastic.co/t/how-to-resize-image-file-in-watcher/318703 "2022-11-11T02:51:00Z")
I want to add image file in email using watcher. but It's only added very big size image file. I think the width and height in img src don't seem to work. Would you please explain how to resize image file in watcher?? … --- ## [Kibana unavailable](https://discuss.elastic.co/t/kibana-unavailable/316552)
**Author:** [@not\_correct](https://discuss.elastic.co/u/not_correct)\ **Replies:** 8\ **Last updated:** [October 14, 2022, 1:26pm UTC](https://discuss.elastic.co/t/kibana-unavailable/316552 "2022-10-14T13:26:45Z")
Hi, I am running into an issue: the kibana is not available. When I check the log it gives me the error that kibana version is not compliant with the version of elasticsearch. It looks like I have to downgrade it in ord… --- ## [Elastic 8.4 / PFSense Agent](https://discuss.elastic.co/t/elastic-8-4-pfsense-agent/318238)
**Author:** [@010101](https://discuss.elastic.co/u/010101)\ **Replies:** 2\ **Last updated:** [November 11, 2022, 1:39am UTC](https://discuss.elastic.co/t/elastic-8-4-pfsense-agent/318238 "2022-11-11T01:39:11Z")
So... I setup according to this pfSense | Elastic docs Pointed my firewall at ELK stack But 0 data Are there any instructions on how to get this going? --- ## [Elasticsearch8.5.0 jar hell problem](https://discuss.elastic.co/t/elasticsearch8-5-0-jar-hell-problem/318619)
**Author:** [@asasas234](https://discuss.elastic.co/u/asasas234)\ **Replies:** 1\ **Last updated:** [November 11, 2022, 1:10am UTC](https://discuss.elastic.co/t/elasticsearch8-5-0-jar-hell-problem/318619 "2022-11-11T01:10:51Z")
warning: ignoring JAVA\_HOME=/home/lizhibo/.sdkman/candidates/java/current; using bundled JDK java=/home/lizhibo/elasticsearch-8.5.0/jdk/bin/java \[2022-11-10T15:23:01,353\]\[ERROR\]\[o.e.b.Elasticsearch \] \[node-1\] fatal … --- ## [Filebeat Apache module not showing data on Dashboards when using Logstash](https://discuss.elastic.co/t/filebeat-apache-module-not-showing-data-on-dashboards-when-using-logstash/318594)
**Author:** [@Carlos\_T](https://discuss.elastic.co/u/Carlos_T)\ **Replies:** 12\ **Last updated:** [November 10, 2022, 11:08pm UTC](https://discuss.elastic.co/t/filebeat-apache-module-not-showing-data-on-dashboards-when-using-logstash/318594 "2022-11-10T23:08:08Z")
Good afternoon all. I've recently installed a filebeat and enabled the system and apache modules. After that I set the filebeat.yml to point to ES and Kibana and run the 'filebeat setup -e' Everything went as expecte… --- ## [Three Node Elastic Cluster balance issue](https://discuss.elastic.co/t/three-node-elastic-cluster-balance-issue/318680)
**Author:** [@alex\_sws](https://discuss.elastic.co/u/alex_sws)\ **Replies:** 6\ **Last updated:** [November 10, 2022, 10:08pm UTC](https://discuss.elastic.co/t/three-node-elastic-cluster-balance-issue/318680 "2022-11-10T22:08:58Z")
I have a 3 node elastic cluster with each node having equal disk space (250 Gb) but for some reason two of the nodes have significant more data usage then the others. When reviewing the servers, all the data usage is tie… --- ## [Unable to get rule triggered](https://discuss.elastic.co/t/unable-to-get-rule-triggered/317448)
**Author:** [@GUruisaDog](https://discuss.elastic.co/u/GUruisaDog)\ **Replies:** 6\ **Last updated:** [November 10, 2022, 8:53pm UTC](https://discuss.elastic.co/t/unable-to-get-rule-triggered/317448 "2022-11-10T20:53:34Z")
My current version of ES Security is on 7.16.1. I was trying to setup a threshold rule, and everything goes well. I could see the result from the preview and such. However, after created the rule and activate the rule, n… --- ## [Can filebeat's o365 module fetch windows defender logs](https://discuss.elastic.co/t/can-filebeats-o365-module-fetch-windows-defender-logs/317575)
**Author:** [@sriramb12](https://discuss.elastic.co/u/sriramb12)\ **Replies:** 2\ **Last updated:** [November 10, 2022, 8:35pm UTC](https://discuss.elastic.co/t/can-filebeats-o365-module-fetch-windows-defender-logs/317575 "2022-11-10T20:35:50Z")
Hello Team I am looking for some insights on fetching windwos defender logs via filebeat (o365 module) Currently the o365 config (yml) lists these: List of content-types to fetch. By default all known content-types # … --- ## [Network Condition Not Working?](https://discuss.elastic.co/t/network-condition-not-working/318369)
**Author:** [@chapmanjc](https://discuss.elastic.co/u/chapmanjc)\ **Replies:** 7\ **Last updated:** [November 10, 2022, 7:03pm UTC](https://discuss.elastic.co/t/network-condition-not-working/318369 "2022-11-10T19:03:10Z")
Hello all, I've set up an an Elastic Agent and I am using the Microsoft DHCP module. Everything is working great except there is a slight issue in regards to going into the "Advanced Options" inside of the Integration.… --- ## [Watcher for no log event](https://discuss.elastic.co/t/watcher-for-no-log-event/318407)
**Author:** [@yago82](https://discuss.elastic.co/u/yago82)\ **Replies:** 1\ **Last updated:** [November 10, 2022, 6:32pm UTC](https://discuss.elastic.co/t/watcher-for-no-log-event/318407 "2022-11-10T18:32:55Z")
Hello everybody, I'm trying to create a watcher that counts the presence or absence of events for a set of applications. The condition should report all applications that have not received any logs / events within an ho… --- ## [How to handle "ef" and "num\_candidates" parameters in hnsw search](https://discuss.elastic.co/t/how-to-handle-ef-and-num-candidates-parameters-in-hnsw-search/318681)
**Author:** [@wole](https://discuss.elastic.co/u/wole)\ **Replies:** 1\ **Last updated:** [November 10, 2022, 6:23pm UTC](https://discuss.elastic.co/t/how-to-handle-ef-and-num-candidates-parameters-in-hnsw-search/318681 "2022-11-10T18:23:36Z")
Hi team, I am in the process of learning how to use ANN search (with HNSW) on Elasticsearch: in order to do so I am comparing the results I obtain with Elasticsearch and the faiss implementation of the algorithm (using … [Previous page](https://discuss.elastic.co/latest.md?page=898) [Next page](https://discuss.elastic.co/latest.md?page=900)