# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=1067 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1068 --- ## [Logstash 7.2.0 install error](https://discuss.elastic.co/t/logstash-7-2-0-install-error/188356)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 7\ **Last updated:** [January 29, 2021, 11:33pm UTC](https://discuss.elastic.co/t/logstash-7-2-0-install-error/188356 "2021-01-29T23:33:41Z")
I was upgrading whole stack to 7.2.0 and got following error Updating / installing... 1:logstash-1:7.2.0-1 ################################# \[ 17%\] Using provided startup.options file: /etc/logstash/star… --- ## [JSON Parsing Of Filtered Syslog JSON Objects Fails](https://discuss.elastic.co/t/json-parsing-of-filtered-syslog-json-objects-fails/261959)
**Author:** [@InfosecAtom](https://discuss.elastic.co/u/InfosecAtom)\ **Replies:** 2\ **Last updated:** [January 29, 2021, 10:42pm UTC](https://discuss.elastic.co/t/json-parsing-of-filtered-syslog-json-objects-fails/261959 "2021-01-29T22:42:45Z")
I am using the following config and seeing no output. Non-JSON object containing Syslog entries, as well as JSON object containing Syslog entries, are both being dropped. If I comment out the JSON parse then the JSON obj… --- ## [Bulk indexing of signals failed in Kibana 7.10.2](https://discuss.elastic.co/t/bulk-indexing-of-signals-failed-in-kibana-7-10-2/262373)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 7\ **Last updated:** [January 29, 2021, 9:29pm UTC](https://discuss.elastic.co/t/bulk-indexing-of-signals-failed-in-kibana-7-10-2/262373 "2021-01-29T21:29:30Z")
Hello, Just noticed our custom SIEM rules seem to throw errors, such as: Bulk Indexing of signals failed: reason: "No mapping found for \[@timestamp\] in order to sort on" type: "query\_shard\_exception" name: "Elastic Aud… --- ## [Logstash is not ingesting data in real time](https://discuss.elastic.co/t/logstash-is-not-ingesting-data-in-real-time/262642)
**Author:** [@shoaib\_akram](https://discuss.elastic.co/u/shoaib_akram)\ **Replies:** 1\ **Last updated:** [January 29, 2021, 8:23pm UTC](https://discuss.elastic.co/t/logstash-is-not-ingesting-data-in-real-time/262642 "2021-01-29T20:23:11Z")
Hi Everyone, I am ingesting data from thousands of file with logstash into elasticsearch and files are parallely updating and updating records are not ingesting in real time. Please help me out what i need to change se… --- ## [Redis in elk](https://discuss.elastic.co/t/redis-in-elk/262076)
**Author:** [@Tuckson](https://discuss.elastic.co/u/Tuckson)\ **Replies:** 7\ **Last updated:** [January 29, 2021, 3:22pm UTC](https://discuss.elastic.co/t/redis-in-elk/262076 "2021-01-29T15:22:21Z")
Hi, I have this elk stack running, 8 datanodes, 4 ingestnodes, 4 logstashes en a shitload of applications that send data from multiple servers via filebeat. The size of these applications vary from 4 servers to 24 on … --- ## [Enterprise Search SAML login Unauthorized](https://discuss.elastic.co/t/enterprise-search-saml-login-unauthorized/262406)
**Author:** [@jvo](https://discuss.elastic.co/u/jvo)\ **Replies:** 1\ **Last updated:** [January 29, 2021, 7:15pm UTC](https://discuss.elastic.co/t/enterprise-search-saml-login-unauthorized/262406 "2021-01-29T19:15:45Z")
I followed the above documentation on configuring the SAML with a Google SAML app. Logging into Kibana with SAML works now, but I'm having issues with the SAML authentication for Enterprise Search. This is the response… --- ## [Filter visualisation not providing full terms list, autocomplete settings are not making any differences](https://discuss.elastic.co/t/filter-visualisation-not-providing-full-terms-list-autocomplete-settings-are-not-making-any-differences/262618)
**Author:** [@Luukv](https://discuss.elastic.co/u/Luukv)\ **Replies:** 3\ **Last updated:** [January 29, 2021, 6:29pm UTC](https://discuss.elastic.co/t/filter-visualisation-not-providing-full-terms-list-autocomplete-settings-are-not-making-any-differences/262618 "2021-01-29T18:29:42Z")
Hello, In the past months I have made several filter/control panel visualisations for multiple dashboards. These have all worked well, but with the most recent one I've ran into some problems. We were experiencing some… --- ## [Kibana scripted fields](https://discuss.elastic.co/t/kibana-scripted-fields/262675)
**Author:** [@Gokul6](https://discuss.elastic.co/u/Gokul6)\ **Replies:** 1\ **Last updated:** [January 29, 2021, 6:20pm UTC](https://discuss.elastic.co/t/kibana-scripted-fields/262675 "2021-01-29T18:20:53Z")
i have several boolean fields like weekDays.friday.is24HourService, weekDays.saturday.is24HourService in my index. i am getting the day of week using \[doc\['@timestamp'\].value.dayOfWeek\] which returns a numeric value, fo… --- ## [Cannot search the documentation with Chromium](https://discuss.elastic.co/t/cannot-search-the-documentation-with-chromium/262575)
**Author:** [@Karel\_Cech](https://discuss.elastic.co/u/Karel_Cech)\ **Replies:** 3\ **Last updated:** [January 29, 2021, 5:17pm UTC](https://discuss.elastic.co/t/cannot-search-the-documentation-with-chromium/262575 "2021-01-29T17:17:23Z")
Hi, I just can't search the docs lately with Chromium on Ubuntu 20.04. Firefox does work. When typing a keyword in the search box, Swifttype basic auth login dialog appears. From there it only leads to a 401. Chr… --- ## [Split field and add new fields](https://discuss.elastic.co/t/split-field-and-add-new-fields/262571)
**Author:** [@jtillman2020](https://discuss.elastic.co/u/jtillman2020)\ **Replies:** 3\ **Last updated:** [January 29, 2021, 5:01pm UTC](https://discuss.elastic.co/t/split-field-and-add-new-fields/262571 "2021-01-29T17:01:51Z")
I have a string field named "One". \<165\>Original Address=1.1.1.1 1 2021-01-28T15:08:03.136-05:00 DeviceName - - - - fpc3 DHCP Packet Drop: Packet src ip/mac 192.168.123.1/54:48:10:db:86:b6 I use mutate { split =\> … --- ## [Grok not parsing any pattern](https://discuss.elastic.co/t/grok-not-parsing-any-pattern/262669)
**Author:** [@werther158](https://discuss.elastic.co/u/werther158)\ **Replies:** 0\ **Last updated:** [January 29, 2021, 4:14pm UTC](https://discuss.elastic.co/t/grok-not-parsing-any-pattern/262669 "2021-01-29T16:14:02Z")
Hi, I'm trying to parse some apache logs like this: 46.105.14.53 - - \[20/May/2015:21:05:15 +0000\] "GET /blog/tags/puppet?flav=rss20 HTTP/1.1" 200 14872 "-" "UniversalFeedParser/4.2-pre-314-svn +http://feedparser.org/" F… --- ## [Action export selected signals to csv](https://discuss.elastic.co/t/action-export-selected-signals-to-csv/262497)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 7\ **Last updated:** [January 29, 2021, 4:04pm UTC](https://discuss.elastic.co/t/action-export-selected-signals-to-csv/262497 "2021-01-29T16:04:29Z")
hello, Just a thought for a SIEM feature. We have colleagues with limited or no acces to Elastic / Kibana. But sometimes they do need to get a list of some signals. Imho it would be super handy to be able to quickly exp… --- ## [Grok pattern to parse to multiple values](https://discuss.elastic.co/t/grok-pattern-to-parse-to-multiple-values/262651)
**Author:** [@Deny7](https://discuss.elastic.co/u/Deny7)\ **Replies:** 5\ **Last updated:** [January 29, 2021, 3:49pm UTC](https://discuss.elastic.co/t/grok-pattern-to-parse-to-multiple-values/262651 "2021-01-29T15:49:29Z")
Hi, I have log line like this: ",session":"kred06@gmail.com" Grok Pattern: (,"session":"(%{DATA:name}@%{DATA:company})?")? and I want to split the email to values name and company and also save email as whole to s… --- ## [Need to execute watcher alert based on each element of array](https://discuss.elastic.co/t/need-to-execute-watcher-alert-based-on-each-element-of-array/262592)
**Author:** [@Sumit\_Kumar1](https://discuss.elastic.co/u/Sumit_Kumar1)\ **Replies:** 1\ **Last updated:** [January 29, 2021, 3:39pm UTC](https://discuss.elastic.co/t/need-to-execute-watcher-alert-based-on-each-element-of-array/262592 "2021-01-29T15:39:34Z")
Need to execute watcher alert based on each element of array. I am using chain input . First search provides me list of array . So, for each element of the array i need to make a search on each iteration . My result of… --- ## [Masking logic is not working](https://discuss.elastic.co/t/masking-logic-is-not-working/261827)
**Author:** [@shree2](https://discuss.elastic.co/u/shree2)\ **Replies:** 10\ **Last updated:** [January 29, 2021, 3:31pm UTC](https://discuss.elastic.co/t/masking-logic-is-not-working/261827 "2021-01-29T15:31:49Z")
Hi, I want to mask the few fields input is coming from json . Please find the configuration below. input { file { path =\> "xxx/sample.log" } } filter { mutate { gsub =\> \["message", "PASSWORD:((?=.\[a-z\])(?=.\[… --- ## [Persistent queue and kafka](https://discuss.elastic.co/t/persistent-queue-and-kafka/262662)
**Author:** [@bovy89](https://discuss.elastic.co/u/bovy89)\ **Replies:** 0\ **Last updated:** [January 29, 2021, 3:31pm UTC](https://discuss.elastic.co/t/persistent-queue-and-kafka/262662 "2021-01-29T15:31:35Z")
Hi, we are using logstash with persistent queue feature enabled and the following setup: filebeat ---\> logstash (with PQ) ---\> elasticsearch Now we are moving to a kafka based setup like that: filebeat ---\> kafka ---… --- ## [Get current active users in the application using Elastic/Kibana Visualization](https://discuss.elastic.co/t/get-current-active-users-in-the-application-using-elastic-kibana-visualization/262030)
**Author:** [@SAKA\_RAM\_DEWASI](https://discuss.elastic.co/u/SAKA_RAM_DEWASI)\ **Replies:** 3\ **Last updated:** [January 29, 2021, 3:27pm UTC](https://discuss.elastic.co/t/get-current-active-users-in-the-application-using-elastic-kibana-visualization/262030 "2021-01-29T15:27:03Z")
Hi all, I am new to elastic and kibana. I want to get current active users in web application using audit logs stored in elastic index. We capture login and logout event of user in audit log and stored as document in el… --- ## [Not parsing apache access and error logs](https://discuss.elastic.co/t/not-parsing-apache-access-and-error-logs/262535)
**Author:** [@kevintts](https://discuss.elastic.co/u/kevintts)\ **Replies:** 2\ **Last updated:** [January 29, 2021, 2:58pm UTC](https://discuss.elastic.co/t/not-parsing-apache-access-and-error-logs/262535 "2021-01-29T14:58:49Z")
I am using filebeat to send apache logs to logstash on my elastic server. I can see the log entries with event.dataset set to apache.access , but they aren't being parsed, so no info in dashboard apache screens. Also, wh… --- ## [Kibana Timezone incompatiblities](https://discuss.elastic.co/t/kibana-timezone-incompatiblities/262649)
**Author:** [@d3v3lop3r](https://discuss.elastic.co/u/d3v3lop3r)\ **Replies:** 4\ **Last updated:** [January 29, 2021, 1:21pm UTC](https://discuss.elastic.co/t/kibana-timezone-incompatiblities/262649 "2021-01-29T13:21:24Z")
Hello there, Iam trying to make my Data visible in the Discover Tab of Kibana and it's just not working out for me. Iam sitting on a project for my studies and built a weather station. The station submits its data once… --- ## [Many or single pipeline performance with querys](https://discuss.elastic.co/t/many-or-single-pipeline-performance-with-querys/262650)
**Author:** [@pereyrdi](https://discuss.elastic.co/u/pereyrdi)\ **Replies:** 0\ **Last updated:** [January 29, 2021, 1:18pm UTC](https://discuss.elastic.co/t/many-or-single-pipeline-performance-with-querys/262650 "2021-01-29T13:18:21Z")
Hello everyone, Im working updating configurations of logstash and Im wondering with method is more performance. For example Multiple pipelines going to a single pipepile to do some checks (sql querys) before ingest i… --- ## [New password or recover password](https://discuss.elastic.co/t/new-password-or-recover-password/262510)
**Author:** [@Gustavo](https://discuss.elastic.co/u/Gustavo)\ **Replies:** 3\ **Last updated:** [January 29, 2021, 12:59pm UTC](https://discuss.elastic.co/t/new-password-or-recover-password/262510 "2021-01-29T12:59:58Z")
How to set a new default password for enterprise search access; because the password I had generated is no longer working. I tried the command ENT\_SEARCH\_DEFAULT\_PASSWORD = 5eqbxcqczhxx1mgw bin/enterprise-search and I… --- ## [Stats endpoint fails after creating an index](https://discuss.elastic.co/t/stats-endpoint-fails-after-creating-an-index/262562)
**Author:** [@tommyzli](https://discuss.elastic.co/u/tommyzli)\ **Replies:** 1\ **Last updated:** [January 29, 2021, 12:58pm UTC](https://discuss.elastic.co/t/stats-endpoint-fails-after-creating-an-index/262562 "2021-01-29T12:58:48Z")
Hi Elasticsearch version 7.6 I have a cluster with 3 master only nodes, 20 data nodes, and one index with 10 shards and 10 replicas. After I create a new index called profiles\_v1 with 10 shards and 0 replicas, the stat… --- ## [Streaming pipeline](https://discuss.elastic.co/t/streaming-pipeline/262628)
**Author:** [@vincent2mots](https://discuss.elastic.co/u/vincent2mots)\ **Replies:** 0\ **Last updated:** [January 29, 2021, 10:25am UTC](https://discuss.elastic.co/t/streaming-pipeline/262628 "2021-01-29T10:25:35Z")
Hi experts! I made a data pipeline using Filebeat and Logstash. I was expecting to see the data streamed from the log file into Elasticsearch but it's not the case. When new lines are inserted into the log file, I some… --- ## [Reg csv file import into Elasticsearch using Logstash](https://discuss.elastic.co/t/reg-csv-file-import-into-elasticsearch-using-logstash/261449)
**Author:** [@mohanss08](https://discuss.elastic.co/u/mohanss08)\ **Replies:** 12\ **Last updated:** [January 29, 2021, 9:06am UTC](https://discuss.elastic.co/t/reg-csv-file-import-into-elasticsearch-using-logstash/261449 "2021-01-29T09:06:04Z")
Hello Support team, I have query regarding csv file upload into elasticsearch using logstash. With this fourm https://www.bmc.com/blogs/elasticsearch-load-csv-logstash/ Able to import our csv files into elasticsearch … --- ## [How to specify subpath to logstash host in filebeat.yml](https://discuss.elastic.co/t/how-to-specify-subpath-to-logstash-host-in-filebeat-yml/262501)
**Author:** [@eeijlar](https://discuss.elastic.co/u/eeijlar)\ **Replies:** 2\ **Last updated:** [January 28, 2021, 4:24pm UTC](https://discuss.elastic.co/t/how-to-specify-subpath-to-logstash-host-in-filebeat-yml/262501 "2021-01-28T16:24:44Z")
I am trying to ship logs to logstash from filebeat. With reference to: In the filebeat.yml, it says to use this for the host: output.logstash: hosts: \["127.0.0.1:5044"\] My logstash URL has /logstash appending o… --- ## [How to load balance an ES-cluster with 70+nodes and 70+ replica shards?](https://discuss.elastic.co/t/how-to-load-balance-an-es-cluster-with-70-nodes-and-70-replica-shards/262608)
**Author:** [@niidy](https://discuss.elastic.co/u/niidy)\ **Replies:** 1\ **Last updated:** [January 29, 2021, 8:16am UTC](https://discuss.elastic.co/t/how-to-load-balance-an-es-cluster-with-70-nodes-and-70-replica-shards/262608 "2021-01-29T08:16:42Z")
My es is 70+nodes and there is an index with a pri shard and 70+ replica shards, because there is no new data written, but there are a lot of queries. but now, only some of them are 80+ cpu and 20+ load (my node is 16c … --- ## [New document in one index should update a value in another index](https://discuss.elastic.co/t/new-document-in-one-index-should-update-a-value-in-another-index/262601)
**Author:** [@Parimelazhagan\_Vinay](https://discuss.elastic.co/u/Parimelazhagan_Vinay)\ **Replies:** 1\ **Last updated:** [January 29, 2021, 8:14am UTC](https://discuss.elastic.co/t/new-document-in-one-index-should-update-a-value-in-another-index/262601 "2021-01-29T08:14:30Z")
Hi All, I am new elasticsearch. Any help on the below use case would be helpful. I have the data which is flowing into one index say index\_raw ELK Dev 1.0 Time1 ELK Dev 2.0 Time2 ELK Stage 1.0 Time3 Now I wanted t… --- ## [Custom authentication plugin for Elastic search(7.10.0)](https://discuss.elastic.co/t/custom-authentication-plugin-for-elastic-search-7-10-0/262315)
**Author:** [@Hargovind](https://discuss.elastic.co/u/Hargovind)\ **Replies:** 5\ **Last updated:** [January 29, 2021, 8:11am UTC](https://discuss.elastic.co/t/custom-authentication-plugin-for-elastic-search-7-10-0/262315 "2021-01-29T08:11:46Z")
Hi everyone, I need to secure my elasticsearch server with custom authentication. pls help me to create a plugin for custom authentication in elasticsearch. Thanks. --- ## [MongoDB logs no more displayed in Kibana Filebeat MongoDB dashboard after 7.10 migration](https://discuss.elastic.co/t/mongodb-logs-no-more-displayed-in-kibana-filebeat-mongodb-dashboard-after-7-10-migration/262344)
**Author:** [@ORich](https://discuss.elastic.co/u/ORich)\ **Replies:** 5\ **Last updated:** [January 29, 2021, 7:37am UTC](https://discuss.elastic.co/t/mongodb-logs-no-more-displayed-in-kibana-filebeat-mongodb-dashboard-after-7-10-migration/262344 "2021-01-29T07:37:31Z")
Dear experts, after migration from 6.5.4 to 7.10.2, I cannot display anymore my logs collected by the default Filebeat MongoDB module in Kibana Dashboard Overview \[Filebeat MongoDB\]. I notice some updates in the provid… --- ## [How to get response header with cookie from POST request to Kibana REST API /internal/security/login](https://discuss.elastic.co/t/how-to-get-response-header-with-cookie-from-post-request-to-kibana-rest-api-internal-security-login/262530)
**Author:** [@gaetano](https://discuss.elastic.co/u/gaetano)\ **Replies:** 1\ **Last updated:** [January 29, 2021, 7:12am UTC](https://discuss.elastic.co/t/how-to-get-response-header-with-cookie-from-post-request-to-kibana-rest-api-internal-security-login/262530 "2021-01-29T07:12:27Z")
My goal is to skip login page in Kibana. With an HTTP request, I would to login in Kibana using the REST API /internal/security/login. The request is come from my Angular application and to bypass CORS and multi-origi… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1066) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1068)