# Latest **URL:** https://discuss.elastic.co/latest.md?page=946 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 947 --- ## [Palo-alto парсер логов](https://discuss.elastic.co/t/palo-alto/315684)
**Author:** [@beater228](https://discuss.elastic.co/u/beater228)\ **Replies:** 0\ **Last updated:** [October 3, 2022, 12:09pm UTC](https://discuss.elastic.co/t/palo-alto/315684 "2022-10-03T12:09:12Z")
Здравствуйте, я новичок, и не так хорошо ориентируюсь на сайте, потому прошу не судите строго. Ситуация следующая: Отправляю syslog с Paloalto в logstash, логи приходят но не обрабатываются, нашел пару вариантов парсер… --- ## [Struggling with sonicwall module](https://discuss.elastic.co/t/struggling-with-sonicwall-module/315595)
**Author:** [@Philip\_Thomson1](https://discuss.elastic.co/u/Philip_Thomson1)\ **Replies:** 3\ **Last updated:** [October 3, 2022, 11:32am UTC](https://discuss.elastic.co/t/struggling-with-sonicwall-module/315595 "2022-10-03T11:32:07Z")
I am sure this is something silly, but I have been banging my head on this, I am trying to use the sonicwall module on filebeat 8.4 This is the sonicwall.yml: # Module: sonicwall # Docs: https://www.elastic.co/guide/en… --- ## [Prevent logs data loss using Cloudflare integration powered by Elastic Agent](https://discuss.elastic.co/t/prevent-logs-data-loss-using-cloudflare-integration-powered-by-elastic-agent/313562)
**Author:** [@yago82](https://discuss.elastic.co/u/yago82)\ **Replies:** 7\ **Last updated:** [October 3, 2022, 10:58am UTC](https://discuss.elastic.co/t/prevent-logs-data-loss-using-cloudflare-integration-powered-by-elastic-agent/313562 "2022-10-03T10:58:52Z")
Using the CludFlare integration, in case of Elastic failure, will the logs that have been sent to elastic be lost? Or there will be queues (or something similar) from which Elastic will restart once it is reset. Or alt… --- ## [Kibana rollup / aggregation not working](https://discuss.elastic.co/t/kibana-rollup-aggregation-not-working/315663)
**Author:** [@thirty2](https://discuss.elastic.co/u/thirty2)\ **Replies:** 1\ **Last updated:** [October 3, 2022, 9:31am UTC](https://discuss.elastic.co/t/kibana-rollup-aggregation-not-working/315663 "2022-10-03T09:31:46Z")
Hi, does anyone use Rollup? When you are using AVG metric, is it working for you? On my side it is not as originally described in this post by me. Insted of AVG values i am getting MAX. I can't belive the problem is … --- ## [Need to add Anomaly Score as Label in Swimlane view of Anomaly Detection Job when added in Dashboard](https://discuss.elastic.co/t/need-to-add-anomaly-score-as-label-in-swimlane-view-of-anomaly-detection-job-when-added-in-dashboard/315542)
**Author:** [@Sreeja\_Bose](https://discuss.elastic.co/u/Sreeja_Bose)\ **Replies:** 3\ **Last updated:** [October 3, 2022, 9:27am UTC](https://discuss.elastic.co/t/need-to-add-anomaly-score-as-label-in-swimlane-view-of-anomaly-detection-job-when-added-in-dashboard/315542 "2022-10-03T09:27:17Z")
Hi Team, I have created a multi metric anomaly detection job and added the swimlane view of anomaly detection in a dashboard. Can I to add the anomaly score as label in the swimlane view in the dashboard? ELK version … --- ## [Elasticsearch Restore Problem](https://discuss.elastic.co/t/elasticsearch-restore-problem/315669)
**Author:** [@rkazak07](https://discuss.elastic.co/u/rkazak07)\ **Replies:** 1\ **Last updated:** [October 3, 2022, 9:17am UTC](https://discuss.elastic.co/t/elasticsearch-restore-problem/315669 "2022-10-03T09:17:46Z")
Hello, I have a Cluster running in Elasticsearch 7.10.2 version. I have added a new server to this Cluster. I use it with Graylog. I get the following Log while restoring the index without a replica. and it falls into t… --- ## [Endpoint security configuration](https://discuss.elastic.co/t/endpoint-security-configuration/315486)
**Author:** [@ttyser](https://discuss.elastic.co/u/ttyser)\ **Replies:** 7\ **Last updated:** [October 3, 2022, 9:13am UTC](https://discuss.elastic.co/t/endpoint-security-configuration/315486 "2022-10-03T09:13:38Z")
Hello all, I have an agent deployed via fleet on red hat server and I want to use the endpoint security there. I did add the endpoint security integration under the policy the red hat agent is bound to. Now it seems like… --- ## [How to read logs contineously from azure evnet hub](https://discuss.elastic.co/t/how-to-read-logs-contineously-from-azure-evnet-hub/315660)
**Author:** [@Anusha\_Kusanghi](https://discuss.elastic.co/u/Anusha_Kusanghi)\ **Replies:** 0\ **Last updated:** [October 3, 2022, 7:27am UTC](https://discuss.elastic.co/t/how-to-read-logs-contineously-from-azure-evnet-hub/315660 "2022-10-03T07:27:40Z")
Hie Everyone, I have an integration where I have to read logs that are generated/store in azure event hub. Will the below configuration will read logs as an when new log is generated in the hub ? If now what I'm loo… --- ## [Filebeat sends encrypted logs from snort to elastic](https://discuss.elastic.co/t/filebeat-sends-encrypted-logs-from-snort-to-elastic/315625)
**Author:** [@mahmoudmaani](https://discuss.elastic.co/u/mahmoudmaani)\ **Replies:** 1\ **Last updated:** [October 3, 2022, 7:21am UTC](https://discuss.elastic.co/t/filebeat-sends-encrypted-logs-from-snort-to-elastic/315625 "2022-10-03T07:21:05Z")
Hello, Snort logs on Kibana are encrypted as you can see below. Even when I try to run cat /var/log/snort/snort.log.166425312 on snort itself I will get the same output. The only way to show the output is by running… --- ## [Storing personal and inventory data in ES or DB for custom plugin](https://discuss.elastic.co/t/storing-personal-and-inventory-data-in-es-or-db-for-custom-plugin/315656)
**Author:** [@Sheereen](https://discuss.elastic.co/u/Sheereen)\ **Replies:** 0\ **Last updated:** [October 3, 2022, 6:24am UTC](https://discuss.elastic.co/t/storing-personal-and-inventory-data-in-es-or-db-for-custom-plugin/315656 "2022-10-03T06:24:18Z")
Hi, I am developing my own external custom plugin in React. My logging data for monitoring and all is stored is ES only, as expected. But I'm confused about where to store my personal information of customers and their… --- ## [Elastic cluster issue!](https://discuss.elastic.co/t/elastic-cluster-issue/314953)
**Author:** [@Shubham\_Singh](https://discuss.elastic.co/u/Shubham_Singh)\ **Replies:** 19\ **Last updated:** [October 2, 2022, 5:38pm UTC](https://discuss.elastic.co/t/elastic-cluster-issue/314953 "2022-10-02T17:38:41Z")
We are seeing CPU spikes for our Elastic cluster and in logs we see this error continuously. We also get a circuit breaker exception in kibana when CPU spikes up. What could be wrong with our cluster \[2022-09-22T13:40:3… --- ## [Kibana metric plot with dynamic text based on the data](https://discuss.elastic.co/t/kibana-metric-plot-with-dynamic-text-based-on-the-data/313565)
**Author:** [@eleven\_e](https://discuss.elastic.co/u/eleven_e)\ **Replies:** 13\ **Last updated:** [October 3, 2022, 5:48am UTC](https://discuss.elastic.co/t/kibana-metric-plot-with-dynamic-text-based-on-the-data/313565 "2022-10-03T05:48:21Z")
In the kibana dashboard visualization I need an metric plot to show the dynamic text based on the data. With the previous month gain. --- ## [\_delete\_by\_query documentation suggestion](https://discuss.elastic.co/t/delete-by-query-documentation-suggestion/315642)
**Author:** [@MarcBT](https://discuss.elastic.co/u/MarcBT)\ **Replies:** 1\ **Last updated:** [October 3, 2022, 5:40am UTC](https://discuss.elastic.co/t/delete-by-query-documentation-suggestion/315642 "2022-10-03T05:40:48Z")
IMO, the \_delete\_by\_query page should mention that if an index is moved out of 'hot' phase by ILM, the delete will fail with "FORBIDDEN/8/index write (api)". --- ## [Custom Similarity for Percolate Query](https://discuss.elastic.co/t/custom-similarity-for-percolate-query/315654)
**Author:** [@aneeshkoya](https://discuss.elastic.co/u/aneeshkoya)\ **Replies:** 0\ **Last updated:** [October 3, 2022, 5:37am UTC](https://discuss.elastic.co/t/custom-similarity-for-percolate-query/315654 "2022-10-03T05:37:12Z")
I created a percolation index with a custom similarity in its settings and a mapping to use this custom similarity: { "my-index": { "settings": { "index": { "similarity": { "idfless": { … --- ## [Manually configure security, divergence in the documentation](https://discuss.elastic.co/t/manually-configure-security-divergence-in-the-documentation/315601)
**Author:** [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Replies:** 1\ **Last updated:** [October 3, 2022, 2:38am UTC](https://discuss.elastic.co/t/manually-configure-security-divergence-in-the-documentation/315601 "2022-10-03T02:38:35Z")
Hello, I'm creating a new cluster using 8.4 and configuring the security features manually. I've created the certificates for the transport and http protocol and everything works as expected, the cluster starts up and … --- ## [Saved Objects / API](https://discuss.elastic.co/t/saved-objects-api/315639)
**Author:** [@cyberzlo](https://discuss.elastic.co/u/cyberzlo)\ **Replies:** 1\ **Last updated:** [October 2, 2022, 11:32pm UTC](https://discuss.elastic.co/t/saved-objects-api/315639 "2022-10-02T23:32:37Z")
Hi, is this possible to perform Kibana " Saved Objects" (export all objects) via curl etc? It whould be great for backup purposes. --- ## [What's the cause of this problem and what's the solution?](https://discuss.elastic.co/t/whats-the-cause-of-this-problem-and-whats-the-solution/315641)
**Author:** [@morad\_della3](https://discuss.elastic.co/u/morad_della3)\ **Replies:** 0\ **Last updated:** [October 2, 2022, 8:59pm UTC](https://discuss.elastic.co/t/whats-the-cause-of-this-problem-and-whats-the-solution/315641 "2022-10-02T20:59:57Z")
i installed elastic and kibana 8.4.1 in ubuntu 22.04 and when i try to do sudo apt update or sudo apt install unzip i get this error E: Conflicting values set for option Signed-By regarding source https://artif… --- ## [Problems with installing/starting current Elasticsearch on ubuntu](https://discuss.elastic.co/t/problems-with-installing-starting-current-elasticsearch-on-ubuntu/315632)
**Author:** [@besucher80](https://discuss.elastic.co/u/besucher80)\ **Replies:** 3\ **Last updated:** [October 2, 2022, 3:22pm UTC](https://discuss.elastic.co/t/problems-with-installing-starting-current-elasticsearch-on-ubuntu/315632 "2022-10-02T15:22:10Z")
hi, i have installed elasticsearch like here: https://www.elastic.co/guide/en/elasticsearch/reference/current/deb.html Now i want to start it with: sudo systemctl start elasticsearch.service But this always fail. In t… --- ## [How match indexof in query?](https://discuss.elastic.co/t/how-match-indexof-in-query/315615)
**Author:** [@Nikolas1306](https://discuss.elastic.co/u/Nikolas1306)\ **Replies:** 1\ **Last updated:** [October 2, 2022, 12:20pm UTC](https://discuss.elastic.co/t/how-match-indexof-in-query/315615 "2022-10-02T12:20:30Z")
i've used this GET /myindex/\_search { "query": { "match\_phrase\_prefix": { "message": "my text\*" } } } but not have results i' ve always #! Elasticsearch built-in security features are not enabled. … --- ## [Pushing data through python to elastic search](https://discuss.elastic.co/t/pushing-data-through-python-to-elastic-search/315489)
**Author:** [@Shashank02](https://discuss.elastic.co/u/Shashank02)\ **Replies:** 6\ **Last updated:** [October 2, 2022, 3:06am UTC](https://discuss.elastic.co/t/pushing-data-through-python-to-elastic-search/315489 "2022-10-02T03:06:33Z")
I'm trying to push some data that I've collected through Python into Elasticsearch but it's showing this error:- "ValueError: Can't specify the options 'http\_auth' via a dictionary in 'hosts', only 'host', 'path\_prefix',… --- ## [How to connect Google Colab to Elasticsearch](https://discuss.elastic.co/t/how-to-connect-google-colab-to-elasticsearch/315618)
**Author:** [@shivang.ahd](https://discuss.elastic.co/u/shivang.ahd)\ **Replies:** 2\ **Last updated:** [October 1, 2022, 6:21pm UTC](https://discuss.elastic.co/t/how-to-connect-google-colab-to-elasticsearch/315618 "2022-10-01T18:21:29Z")
Hi, How to connect Google Colab to Elasticsearch. I have followed few ways, but getting error for all the ways. One of the code is as below:- !pip install Elasticsearch -q # download elasticsearch !wget https://arti… --- ## [Filebeat cannot communicate with Kibana](https://discuss.elastic.co/t/filebeat-cannot-communicate-with-kibana/315508)
**Author:** [@mahmoudmaani](https://discuss.elastic.co/u/mahmoudmaani)\ **Replies:** 8\ **Last updated:** [October 1, 2022, 4:41pm UTC](https://discuss.elastic.co/t/filebeat-cannot-communicate-with-kibana/315508 "2022-10-01T16:41:25Z")
Hello everyone, Filebeat is not working with my setup when I try to run ./filebeat setup -e I get the below error message. I have Elastic and Kibana installed on a single host and they are working well also, I have… --- ## [Adding Site Alternate Name (SAN) to the docker run command](https://discuss.elastic.co/t/adding-site-alternate-name-san-to-the-docker-run-command/315497)
**Author:** [@Mark\_Parrish](https://discuss.elastic.co/u/Mark_Parrish)\ **Replies:** 1\ **Last updated:** [October 1, 2022, 3:36pm UTC](https://discuss.elastic.co/t/adding-site-alternate-name-san-to-the-docker-run-command/315497 "2022-10-01T15:36:35Z")
I used the following command to bring up a elasticsearch node. It is straight out of the instructions (link). docker run -d / --name es01 / --net elastic / -p 9200:9200 -p 9300:9300 / -it / docker.elast… --- ## [Can Replica shards be used for Disaster Recovery](https://discuss.elastic.co/t/can-replica-shards-be-used-for-disaster-recovery/315620)
**Author:** [@hiruni.insyncit.net](https://discuss.elastic.co/u/hiruni.insyncit.net)\ **Replies:** 1\ **Last updated:** [October 1, 2022, 3:14pm UTC](https://discuss.elastic.co/t/can-replica-shards-be-used-for-disaster-recovery/315620 "2022-10-01T15:14:48Z")
Hi, We don't have backup in our cluster. Can we you replicas for disaster recovery purpose..? Elasticsearch version: 8.12 Thank you...! --- ## [Additional java process in ES8.4](https://discuss.elastic.co/t/additional-java-process-in-es8-4/315619)
**Author:** [@frankshad](https://discuss.elastic.co/u/frankshad)\ **Replies:** 0\ **Last updated:** [October 1, 2022, 2:25pm UTC](https://discuss.elastic.co/t/additional-java-process-in-es8-4/315619 "2022-10-01T14:25:41Z")
I'm trying a fresh install of ES8.4 on Debian 11, starting using systemctl start elasticsearch. I notice that there are now two Java processes permanently running, where on all previous versions I have used (up to 8.2) t… --- ## [Filtered Log messages show up as empty fields in Kibana](https://discuss.elastic.co/t/filtered-log-messages-show-up-as-empty-fields-in-kibana/315399)
**Author:** [@Chma](https://discuss.elastic.co/u/Chma)\ **Replies:** 1\ **Last updated:** [October 1, 2022, 2:02am UTC](https://discuss.elastic.co/t/filtered-log-messages-show-up-as-empty-fields-in-kibana/315399 "2022-10-01T02:02:28Z")
I have filtered my log message using grok. But when I check Kibana, I find the new fields on the left side of the page, but they are empty. I am also getting the \_grokparsefailure tag. Here's an example of my log messag… --- ## [How to mock an index?](https://discuss.elastic.co/t/how-to-mock-an-index/315580)
**Author:** [@sajidb](https://discuss.elastic.co/u/sajidb)\ **Replies:** 1\ **Last updated:** [October 1, 2022, 12:08am UTC](https://discuss.elastic.co/t/how-to-mock-an-index/315580 "2022-10-01T00:08:08Z")
I want to create an integration test in C#10 (.NET 6) that does some tests on the Elasticsearch index but I can't do it with the real data. I want to mock an index or create an index with dummy data and then test it by g… --- ## [Does a log have a message space limit when processed by logstash with the xml filter?](https://discuss.elastic.co/t/does-a-log-have-a-message-space-limit-when-processed-by-logstash-with-the-xml-filter/315608)
**Author:** [@erwin339](https://discuss.elastic.co/u/erwin339)\ **Replies:** 0\ **Last updated:** [September 30, 2022, 10:13pm UTC](https://discuss.elastic.co/t/does-a-log-have-a-message-space-limit-when-processed-by-logstash-with-the-xml-filter/315608 "2022-09-30T22:13:35Z")
I am working with an xml that contains very large logs (more than 1500 lines) and others with only one line, the large logs are giving me an error "Error parsing xml with XmlSimple", I have other logs with the same struc… --- ## [Extending multi-match for nested Object objects in MongoDB](https://discuss.elastic.co/t/extending-multi-match-for-nested-object-objects-in-mongodb/315471)
**Author:** [@scheung38](https://discuss.elastic.co/u/scheung38)\ **Replies:** 7\ **Last updated:** [September 30, 2022, 6:23pm UTC](https://discuss.elastic.co/t/extending-multi-match-for-nested-object-objects-in-mongodb/315471 "2022-09-30T18:23:16Z")
Given this works, but how to extend this multi\_match to nested ObjectID objects in a MongoDB database: GET address\*/\_search/ { "query": { "multi\_match" : { "query": "york", "fields": \[ "outward\_code"… --- ## [Stuck on \[Bucket max\] cardinality estimate required for \[influencers\] \[response\_time\_cat\] but not supplied](https://discuss.elastic.co/t/stuck-on-bucket-max-cardinality-estimate-required-for-influencers-response-time-cat-but-not-supplied/315533)
**Author:** [@Souvik\_Das](https://discuss.elastic.co/u/Souvik_Das)\ **Replies:** 3\ **Last updated:** [September 30, 2022, 5:22pm UTC](https://discuss.elastic.co/t/stuck-on-bucket-max-cardinality-estimate-required-for-influencers-response-time-cat-but-not-supplied/315533 "2022-09-30T17:22:39Z")
Hi team, I have created a runtime field (categorical field) in the Datafeed of ml job to use it as an influencer for the anomalies. I am able to find the field in the influencer section but after that when I tried to fi… [Previous page](https://discuss.elastic.co/latest.md?page=945) [Next page](https://discuss.elastic.co/latest.md?page=947)