# Latest **URL:** https://discuss.elastic.co/latest.md?page=977 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 978 --- ## [Logstash I/O error](https://discuss.elastic.co/t/logstash-i-o-error/313858)
**Author:** [@Hardy\_Fong](https://discuss.elastic.co/u/Hardy_Fong)\ **Replies:** 0\ **Last updated:** [September 7, 2022, 8:00am UTC](https://discuss.elastic.co/t/logstash-i-o-error/313858 "2022-09-07T08:00:51Z")
Dear all , I have one elk server collecting all decive syslog, and we found one of fibre switch(DELL DS6610B) have prompt this error in starting logstash. But the weird point is we have 3 fibre switch which are same c… --- ## [Squid Logs Integration (Technical preview) ignores custom DNS processor when added under the integration's advanced configuration section](https://discuss.elastic.co/t/squid-logs-integration-technical-preview-ignores-custom-dns-processor-when-added-under-the-integrations-advanced-configuration-section/313853)
**Author:** [@ipaq](https://discuss.elastic.co/u/ipaq)\ **Replies:** 0\ **Last updated:** [September 7, 2022, 7:16am UTC](https://discuss.elastic.co/t/squid-logs-integration-technical-preview-ignores-custom-dns-processor-when-added-under-the-integrations-advanced-configuration-section/313853 "2022-09-07T07:16:47Z")
Hi elastic community, I've been discussing this issue with support for a little while however they've advised this may be a bug that could need looking into so I've been referred here. We have some routers running both… --- ## [Filebeat index](https://discuss.elastic.co/t/filebeat-index/313849)
**Author:** [@Milan\_Dangol](https://discuss.elastic.co/u/Milan_Dangol)\ **Replies:** 4\ **Last updated:** [September 7, 2022, 7:28am UTC](https://discuss.elastic.co/t/filebeat-index/313849 "2022-09-07T07:28:45Z")
Greetings everyone, I have a question regarding filebeat index. The scenarios is: I am transferring Nginx access and error logs from filebeat to my Elasticsearch server. Is the size of filbeat index is equal to the si… --- ## [请教大佬如何跨索引更新数据](https://discuss.elastic.co/t/topic/313851)
**Author:** [@chihao9332](https://discuss.elastic.co/u/chihao9332)\ **Replies:** 0\ **Last updated:** [September 7, 2022, 7:05am UTC](https://discuss.elastic.co/t/topic/313851 "2022-09-07T07:05:51Z")
问题描述：索引B中新增加了两个字段，现需要从索引A中获取这两个字段的值并赋值给B 详细情况： 1.索引A中部分字段：pro\_id, tran\_id, app\_id, type ....... 2.索引B中部分字段：app\_id, type ....... 3. 现 索引B中新增 pro\_id和tran\_id字段，要求将存量数据与索引A中数据同步 … --- ## [Metricbeat](https://discuss.elastic.co/t/metricbeat/313660)
**Author:** [@Shashi\_Prakash](https://discuss.elastic.co/u/Shashi_Prakash)\ **Replies:** 15\ **Last updated:** [September 7, 2022, 6:49am UTC](https://discuss.elastic.co/t/metricbeat/313660 "2022-09-07T06:49:59Z")
i am geting error in connecting metricbeat to kibana as it shows in logs ERROR \[kibana.stats\] stats/stats.go:82 error making http request: Get http://localhost:5601/api/status: dial tcp 127.0.0.1:5601: connection refuse… --- ## [How to create a runtime field to create an alert?](https://discuss.elastic.co/t/how-to-create-a-runtime-field-to-create-an-alert/312997)
**Author:** [@sirineb](https://discuss.elastic.co/u/sirineb)\ **Replies:** 7\ **Last updated:** [September 7, 2022, 6:48am UTC](https://discuss.elastic.co/t/how-to-create-a-runtime-field-to-create-an-alert/312997 "2022-09-07T06:48:42Z")
Hi, I've created a field with a script to set the boolean "office\_hours" to true of false depending on the log hours. My painless script is : def office; if (doc\['@timestamp'\].value.hour \< 5 || doc\['@timestamp'\].value.… --- ## [Logstash on docker does not work with auditbeat](https://discuss.elastic.co/t/logstash-on-docker-does-not-work-with-auditbeat/313657)
**Author:** [@mammodde](https://discuss.elastic.co/u/mammodde)\ **Replies:** 5\ **Last updated:** [September 7, 2022, 6:48am UTC](https://discuss.elastic.co/t/logstash-on-docker-does-not-work-with-auditbeat/313657 "2022-09-07T06:48:04Z")
Hi, I am currently trying to configure a docker with Logstash by sending there logs with auditbeat installed on my pc. The problem is that I constantly receive the same error when I do .\\auditbeat.exe setup -e Exiting: … --- ## [Fail to run pre-built alerts due to non-existing fields](https://discuss.elastic.co/t/fail-to-run-pre-built-alerts-due-to-non-existing-fields/313801)
**Author:** [@sirineb](https://discuss.elastic.co/u/sirineb)\ **Replies:** 0\ **Last updated:** [September 6, 2022, 1:53pm UTC](https://discuss.elastic.co/t/fail-to-run-pre-built-alerts-due-to-non-existing-fields/313801 "2022-09-06T13:53:35Z")
Hi, I am trying to use the pre-built alerts in Security \> Rules but the alert " Remote Computer Account DnsHostName Update" doesn't work. Here's the execution log of the rule "Remote Computer Account DnsHostName Updat… --- ## [Grok pattern - sometimes nesting bracket](https://discuss.elastic.co/t/grok-pattern-sometimes-nesting-bracket/313797)
**Author:** [@elkuser1234](https://discuss.elastic.co/u/elkuser1234)\ **Replies:** 2\ **Last updated:** [September 7, 2022, 6:34am UTC](https://discuss.elastic.co/t/grok-pattern-sometimes-nesting-bracket/313797 "2022-09-07T06:34:08Z")
Hi I have a difficult log for me. Because sometimes I have nested bracket and sometimes i don't How to parse it in a grok. \[2022-09-05 17:27:24,537\] \[apps-thread | test-policy\] WARN \[2022-09-06 14:19:25,708\] \[App (ap… --- ## [Reverting Index Logging Settings](https://discuss.elastic.co/t/reverting-index-logging-settings/313770)
**Author:** [@nutcno](https://discuss.elastic.co/u/nutcno)\ **Replies:** 1\ **Last updated:** [September 7, 2022, 5:50am UTC](https://discuss.elastic.co/t/reverting-index-logging-settings/313770 "2022-09-07T05:50:15Z")
I want to add new index settings for all indices to add some additional configs to debug/info/warn and trace. So like below I have this curl command - curl -XPUT 'http://localhost:9200/\_all/\_settings?preserve\_existing=… --- ## [Is it possible to set Alert IDs in Kibana Alerting similar to watcher?](https://discuss.elastic.co/t/is-it-possible-to-set-alert-ids-in-kibana-alerting-similar-to-watcher/292665)
**Author:** [@Simon\_Becker](https://discuss.elastic.co/u/Simon_Becker)\ **Replies:** 1\ **Last updated:** [September 7, 2022, 5:01am UTC](https://discuss.elastic.co/t/is-it-possible-to-set-alert-ids-in-kibana-alerting-similar-to-watcher/292665 "2022-09-07T05:01:33Z")
Hello Elastic Team, I was super excited about the new Kibana alerting feature. Since I am a fan of automation I created in the past my watcher alerts with ansible calling the watcher api. This was quite easy since you… --- ## [Can we pull up logs using Web API either through filebeat or logstash?](https://discuss.elastic.co/t/can-we-pull-up-logs-using-web-api-either-through-filebeat-or-logstash/313841)
**Author:** [@Blason](https://discuss.elastic.co/u/Blason)\ **Replies:** 4\ **Last updated:** [September 7, 2022, 3:48am UTC](https://discuss.elastic.co/t/can-we-pull-up-logs-using-web-api-either-through-filebeat-or-logstash/313841 "2022-09-07T03:48:44Z")
Hi Team, I need to pull up the logs using web API; can someone suggest a method by which I could pull up the logs using web api? Or do I need to write a script and then pull up the logs? TIA Blason R --- ## [Xpack.security.transport.ssl setup issue](https://discuss.elastic.co/t/xpack-security-transport-ssl-setup-issue/313757)
**Author:** [@cheching](https://discuss.elastic.co/u/cheching)\ **Replies:** 3\ **Last updated:** [September 7, 2022, 2:50am UTC](https://discuss.elastic.co/t/xpack-security-transport-ssl-setup-issue/313757 "2022-09-07T02:50:09Z")
Hi Team, Need yours assist to look into below issue, I'm using self hosted Kibana & Elasticsearch as well. But I have an error after I generated the certificates and copy it into the etc/elasticsearch/certs path. And af… --- ## [Import CA Cert as PrivateKeyEntry to HTTP Keystore - Solve Unable to create enrollment token Error](https://discuss.elastic.co/t/import-ca-cert-as-privatekeyentry-to-http-keystore-solve-unable-to-create-enrollment-token-error/313780)
**Author:** [@aold619](https://discuss.elastic.co/u/aold619)\ **Replies:** 3\ **Last updated:** [September 7, 2022, 2:48am UTC](https://discuss.elastic.co/t/import-ca-cert-as-privatekeyentry-to-http-keystore-solve-unable-to-create-enrollment-token-error/313780 "2022-09-07T02:48:40Z")
Problem Yesterday I installed Elasticsearch for the first time, and after I configured the security manully according to the docs: Basic Security / Basic Security plus HTTPS, I try to generate token for Kibana, and I met… --- ## [If possible to increase that ILM Condition](https://discuss.elastic.co/t/if-possible-to-increase-that-ilm-condition/313440)
**Author:** [@yasar](https://discuss.elastic.co/u/yasar)\ **Replies:** 4\ **Last updated:** [September 7, 2022, 2:45am UTC](https://discuss.elastic.co/t/if-possible-to-increase-that-ilm-condition/313440 "2022-09-07T02:45:04Z")
Hi team, we are having that 5.1 TB Hot node and 8.34 TB warm node in production with below condition Condition 1: 2 Days Condition 2: 50 GB We are using 4.5 TB disk Usage only and we can see more spaces are free in o… --- ## [Add Custom Anomaly Jobs to Kibana Metric Inventory](https://discuss.elastic.co/t/add-custom-anomaly-jobs-to-kibana-metric-inventory/313805)
**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Replies:** 0\ **Last updated:** [September 6, 2022, 2:38pm UTC](https://discuss.elastic.co/t/add-custom-anomaly-jobs-to-kibana-metric-inventory/313805 "2022-09-06T14:38:25Z")
Hi All, I was wondering if there is a way to have Custom Anomaly Jobs to the Observability -\> Metrics -\> Inventory section. Context: Kibana 8.3.2 If I have a custom anomaly job that matches a host, it doesn't show up … --- ## [Input Controls in dark mode in v.8.4.1](https://discuss.elastic.co/t/input-controls-in-dark-mode-in-v-8-4-1/313760)
**Author:** [@m-amano](https://discuss.elastic.co/u/m-amano)\ **Replies:** 2\ **Last updated:** [September 7, 2022, 1:14am UTC](https://discuss.elastic.co/t/input-controls-in-dark-mode-in-v-8-4-1/313760 "2022-09-07T01:14:28Z")
I upgraded ElastcCloud v.7.17.6 to v.8.4.1. Input controls seem to be not a better look and became unreadable in the suggestion list. The same data is in the suggestion list in v.7.17.6. --- ## [Auditbeat dashboard in kibana shows empty results](https://discuss.elastic.co/t/auditbeat-dashboard-in-kibana-shows-empty-results/313782)
**Author:** [@Sargu\_Xcode](https://discuss.elastic.co/u/Sargu_Xcode)\ **Replies:** 2\ **Last updated:** [September 7, 2022, 1:07am UTC](https://discuss.elastic.co/t/auditbeat-dashboard-in-kibana-shows-empty-results/313782 "2022-09-07T01:07:56Z")
Hi All , I am trying to build a monitoring system for auditctl using auditbeat on Elasticsearch 7.8.1 and Kibana 7.8.1. Everything is successfully setup , including auditbeat. But the auditbeat dashboard seems empty whe… --- ## [Only one log is output from auditbeat](https://discuss.elastic.co/t/only-one-log-is-output-from-auditbeat/313726)
**Author:** [@aurantiacus](https://discuss.elastic.co/u/aurantiacus)\ **Replies:** 3\ **Last updated:** [September 7, 2022, 12:58am UTC](https://discuss.elastic.co/t/only-one-log-is-output-from-auditbeat/313726 "2022-09-07T00:58:41Z")
I am using auditbeat (6.4) on windows 10. I have specified the C drive as the monitoring destination. Other computers output a lot of data in 'file\_integrity'. When I start auditbeat on only one computer, I get only o… --- ## [Upgrade steps 8.3 - 8.4](https://discuss.elastic.co/t/upgrade-steps-8-3-8-4/313716)
**Author:** [@ymoriarty](https://discuss.elastic.co/u/ymoriarty)\ **Replies:** 4\ **Last updated:** [September 6, 2022, 11:35pm UTC](https://discuss.elastic.co/t/upgrade-steps-8-3-8-4/313716 "2022-09-06T23:35:57Z")
Where are the instructions to upgrade Elasticsearch, Kibana and Enterprise Search from 8.3 to 8.4.x? I am running this on prem on a single host with the basic license. I have search all over your site and do not find a… --- ## [Does search perform faster if we use a lower number for setResultsPerPage() in Search-UI?](https://discuss.elastic.co/t/does-search-perform-faster-if-we-use-a-lower-number-for-setresultsperpage-in-search-ui/313615)
**Author:** [@Beratna](https://discuss.elastic.co/u/Beratna)\ **Replies:** 2\ **Last updated:** [September 6, 2022, 11:25pm UTC](https://discuss.elastic.co/t/does-search-perform-faster-if-we-use-a-lower-number-for-setresultsperpage-in-search-ui/313615 "2022-09-06T23:25:54Z")
Hello there, Currently using App Search with search-ui react library and was wondering if using a small number for the setResultsPerPage function reduces search time. Thanks! --- ## [Change local ip address to "any text" in elasticsearch logs](https://discuss.elastic.co/t/change-local-ip-address-to-any-text-in-elasticsearch-logs/313771)
**Author:** [@kurdit](https://discuss.elastic.co/u/kurdit)\ **Replies:** 6\ **Last updated:** [September 6, 2022, 10:36pm UTC](https://discuss.elastic.co/t/change-local-ip-address-to-any-text-in-elasticsearch-logs/313771 "2022-09-06T22:36:54Z")
hi all! we collect nginx access logs in elasticsearch. here is an example of incoming nginx access logs: kibana-linux.elk.com 10.211.45.45 - \[05/Sep/2022:15:26:54 +0300\] UNIX-TIME-1662380814.467 "GET /internal/security… --- ## [Kibana - Metricbeat Calculate time in application](https://discuss.elastic.co/t/kibana-metricbeat-calculate-time-in-application/313832)
**Author:** [@Matt.Wash](https://discuss.elastic.co/u/Matt.Wash)\ **Replies:** 0\ **Last updated:** [September 6, 2022, 10:00pm UTC](https://discuss.elastic.co/t/kibana-metricbeat-calculate-time-in-application/313832 "2022-09-06T22:00:44Z")
I am trying to get a total time a user has spent in an application through metricbeat process.name field. I am able to show the following, but cannot work out a way to calculate a total time in the application. Any idea… --- ## [Asciifolding analyzer doesn't seem to be working](https://discuss.elastic.co/t/asciifolding-analyzer-doesnt-seem-to-be-working/313830)
**Author:** [@Chris\_Grim](https://discuss.elastic.co/u/Chris_Grim)\ **Replies:** 0\ **Last updated:** [September 6, 2022, 9:17pm UTC](https://discuss.elastic.co/t/asciifolding-analyzer-doesnt-seem-to-be-working/313830 "2022-09-06T21:17:56Z")
Hi All, I am trying to setup asciifolding so a word like séance will appear when someone types in seance. In my mapping I have $mapping-\>search\_as\_you\_type('name', \['analyzer' =\> 'standard\_asciifolding'\]); … --- ## [How to sum across all intermediate aggregate buckets?](https://discuss.elastic.co/t/how-to-sum-across-all-intermediate-aggregate-buckets/313829)
**Author:** [@davidgAID](https://discuss.elastic.co/u/davidgAID)\ **Replies:** 0\ **Last updated:** [September 6, 2022, 9:07pm UTC](https://discuss.elastic.co/t/how-to-sum-across-all-intermediate-aggregate-buckets/313829 "2022-09-06T21:07:21Z")
I have an index like this (simplified): { "entity\_id": {"type": "keyword"}, "attr1": { "properties": { "attr1\_id": {"type": "keyword"}, "attr1\_type": {"type": "keyword"}, … --- ## [Apache Access Logs with Filebeats-\>Logstash-\>EL\<-Kibana: Throws errors at default dashboard](https://discuss.elastic.co/t/apache-access-logs-with-filebeats-logstash-el-kibana-throws-errors-at-default-dashboard/313585)
**Author:** [@SirStephanikus](https://discuss.elastic.co/u/SirStephanikus)\ **Replies:** 10\ **Last updated:** [September 6, 2022, 8:39pm UTC](https://discuss.elastic.co/t/apache-access-logs-with-filebeats-logstash-el-kibana-throws-errors-at-default-dashboard/313585 "2022-09-06T20:39:12Z")
Hello Everyone While I'm trying to deep dive into ELK, I followed a video course that is unfortunately outdated... My ELK version is 8.3.3 However, the lab goal is this: Use filebeat to parse some apache access logs,… --- ## [Packetbeat DNS response time nanoseconds instead of microseconds](https://discuss.elastic.co/t/packetbeat-dns-response-time-nanoseconds-instead-of-microseconds/313710)
**Author:** [@mayer](https://discuss.elastic.co/u/mayer)\ **Replies:** 4\ **Last updated:** [September 6, 2022, 8:33pm UTC](https://discuss.elastic.co/t/packetbeat-dns-response-time-nanoseconds-instead-of-microseconds/313710 "2022-09-06T20:33:44Z")
Dear All, I am running ELK stack 8.4.1 on latest Debian. Kibana/Packetbeat shows nice data in the DNS overview. When I move the mouse at DNS Min/Max/Avg Response Time Histogram over the graph I see for example max resp… --- ## [Logstash plugin install error](https://discuss.elastic.co/t/logstash-plugin-install-error/313611)
**Author:** [@zapatannico](https://discuss.elastic.co/u/zapatannico)\ **Replies:** 1\ **Last updated:** [September 3, 2022, 10:20pm UTC](https://discuss.elastic.co/t/logstash-plugin-install-error/313611 "2022-09-03T22:20:36Z")
Hello im new with logstash, im trying to install syslog plugin but i always get this error, someone could help me? \\logstash\\bin\>logstash-plugin install "Using bundled JDK: C:\\logstash\\jdk\\bin\\java.exe" jruby: warning:… --- ## [Missing field from my sqs queue](https://discuss.elastic.co/t/missing-field-from-my-sqs-queue/312746)
**Author:** [@nexus1](https://discuss.elastic.co/u/nexus1)\ **Replies:** 4\ **Last updated:** [September 6, 2022, 7:21pm UTC](https://discuss.elastic.co/t/missing-field-from-my-sqs-queue/312746 "2022-09-06T19:21:14Z")
We are running Elasticsearch on Kubernetes using the Elastic Cloud Operator. We use the input sqs plugin to pull events for our SQS queues Recently, we discovered the logs from one of our queues have the field aws.sqs.… --- ## [Filebeat limit processing events](https://discuss.elastic.co/t/filebeat-limit-processing-events/313485)
**Author:** [@amandagmsd](https://discuss.elastic.co/u/amandagmsd)\ **Replies:** 3\ **Last updated:** [September 6, 2022, 7:08pm UTC](https://discuss.elastic.co/t/filebeat-limit-processing-events/313485 "2022-09-06T19:08:16Z")
Hi, Is there a way to increase the number of processing events of filebeat? Example: I have a configuration for filebeat to read aws cloudwatch logs, but the biggest number that is on log debug is 100 for processing e… [Previous page](https://discuss.elastic.co/latest.md?page=976) [Next page](https://discuss.elastic.co/latest.md?page=978)