# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=1228 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1229 --- ## [Multiple logs are concatenated to single event by Logstash](https://discuss.elastic.co/t/multiple-logs-are-concatenated-to-single-event-by-logstash/248947)
**Author:** [@Khushboo\_Kumari](https://discuss.elastic.co/u/Khushboo_Kumari)\ **Replies:** 2\ **Last updated:** [September 21, 2020, 3:44pm UTC](https://discuss.elastic.co/t/multiple-logs-are-concatenated-to-single-event-by-logstash/248947 "2020-09-21T15:44:20Z")
Hi all, I am using Filebeat to send Multiline logs to Logstash , Filebeat input is a file ( logs.txt), In case multiple events are published to (Logs.txt ) in a millisecond, they all are added as 1 log event to ES. Ple… --- ## [Elastic siem receive another Security Device log](https://discuss.elastic.co/t/elastic-siem-receive-another-security-device-log/249318)
**Author:** [@111387](https://discuss.elastic.co/u/111387)\ **Replies:** 1\ **Last updated:** [September 21, 2020, 3:24pm UTC](https://discuss.elastic.co/t/elastic-siem-receive-another-security-device-log/249318 "2020-09-21T15:24:28Z")
I Want to Using IPS, Anti Virus etc.. log in Elastic Siem is it possible using this log??? i want security log to logstash -\> ElasticSiem and make Correlation rules --- ## [Big logs files with TFS elasticsearch](https://discuss.elastic.co/t/big-logs-files-with-tfs-elasticsearch/248806)
**Author:** [@Freud](https://discuss.elastic.co/u/Freud)\ **Replies:** 6\ **Last updated:** [September 21, 2020, 2:54pm UTC](https://discuss.elastic.co/t/big-logs-files-with-tfs-elasticsearch/248806 "2020-09-21T14:54:55Z")
Hi, We have a TFS 2018 and since a few days elasticsearch create 5Go logs file every days. I don't know what is the matter with it. The log contain 2 type of WARN "cluster.action.shard" and "indices.cluster" Can some… --- ## [Call Kibana with data](https://discuss.elastic.co/t/call-kibana-with-data/248841)
**Author:** [@sonnenteich](https://discuss.elastic.co/u/sonnenteich)\ **Replies:** 2\ **Last updated:** [September 21, 2020, 2:51pm UTC](https://discuss.elastic.co/t/call-kibana-with-data/248841 "2020-09-21T14:51:04Z")
Hello, I am pretty new to elastic, so maybe this is a dummy question. I query my elastic with an external app and I want to show the one selected result or all queried results in Kibana. Is there away to call Kibana wi… --- ## [Inviting users by email (SMTP setup)](https://discuss.elastic.co/t/inviting-users-by-email-smtp-setup/249375)
**Author:** [@ylasri](https://discuss.elastic.co/u/ylasri)\ **Replies:** 3\ **Last updated:** [September 21, 2020, 2:45pm UTC](https://discuss.elastic.co/t/inviting-users-by-email-smtp-setup/249375 "2020-09-21T14:45:35Z")
I would like to enable smtp parameter for workplace search I provided following config : what i should use exactly in "secure-pass-phrase" the password or something else ? like here email.account: enabled: true s… --- ## [Not getting proper response from API](https://discuss.elastic.co/t/not-getting-proper-response-from-api/248758)
**Author:** [@chenna123](https://discuss.elastic.co/u/chenna123)\ **Replies:** 1\ **Last updated:** [September 21, 2020, 2:27pm UTC](https://discuss.elastic.co/t/not-getting-proper-response-from-api/248758 "2020-09-21T14:27:38Z")
Hi, I'm facing an issue with API, following these below line to invoke API from Powershell and expecting json response but I'm getting HTML response instead. API - http://xxxxxxxxx/api/saved\_objects/\_find?type=dashboar… --- ## [Set aggregation and how to visualize in Kibana](https://discuss.elastic.co/t/set-aggregation-and-how-to-visualize-in-kibana/248928)
**Author:** [@onTop](https://discuss.elastic.co/u/onTop)\ **Replies:** 1\ **Last updated:** [September 21, 2020, 2:24pm UTC](https://discuss.elastic.co/t/set-aggregation-and-how-to-visualize-in-kibana/248928 "2020-09-21T14:24:46Z")
Hi, I have a unique requirement. Let's say I have 2 fields in my document. Build Version Defects If X and Y are 2 build versions, I want to visualize defects that are common to X and Y and defects that are unique to … --- ## [Endpoint Security integration is sending its data always to default namespace](https://discuss.elastic.co/t/endpoint-security-integration-is-sending-its-data-always-to-default-namespace/249109)
**Author:** [@SanWieb](https://discuss.elastic.co/u/SanWieb)\ **Replies:** 1\ **Last updated:** [September 21, 2020, 2:13pm UTC](https://discuss.elastic.co/t/endpoint-security-integration-is-sending-its-data-always-to-default-namespace/249109 "2020-09-21T14:13:50Z")
Hi all, If you make a new configuration with as namespace not default but let's say 'custom'. All integrations which you add will have default as namespace 'custom', also the Elastic Endpoint Security. However, the Ela… --- ## [Customize kibana discover table](https://discuss.elastic.co/t/customize-kibana-discover-table/249129)
**Author:** [@kumar4](https://discuss.elastic.co/u/kumar4)\ **Replies:** 1\ **Last updated:** [September 21, 2020, 2:08pm UTC](https://discuss.elastic.co/t/customize-kibana-discover-table/249129 "2020-09-21T14:08:28Z")
hi, i want to know if it is possible to have a personalized visualization of the kibana dicover table, with colors or anything else that adds a decoration to be decided or if it is possible to represent data in a custom… --- ## [Log Parsing](https://discuss.elastic.co/t/log-parsing/249255)
**Author:** [@mansa](https://discuss.elastic.co/u/mansa)\ **Replies:** 5\ **Last updated:** [September 21, 2020, 2:04pm UTC](https://discuss.elastic.co/t/log-parsing/249255 "2020-09-21T14:04:08Z")
Actually we have two variety of logs. Syslogs which comes from Linux device ( start with time) Syslog but comes from cisco devices Logs which comes from cisco device start with hostname and logs which comes from linux… --- ## [Precise distinct count](https://discuss.elastic.co/t/precise-distinct-count/249374)
**Author:** [@ion\_utale](https://discuss.elastic.co/u/ion_utale)\ **Replies:** 0\ **Last updated:** [September 21, 2020, 2:02pm UTC](https://discuss.elastic.co/t/precise-distinct-count/249374 "2020-09-21T14:02:29Z")
Hi, i am just frustrated that i am unable to do an distinct count. on 6.8 Cardinality is just an approximation. I have over 20k buckets and cardinaly with precision\_threshold = 40000 is still retuning me wrong value… --- ## [Parsing whole file as a single event](https://discuss.elastic.co/t/parsing-whole-file-as-a-single-event/249317)
**Author:** [@thdesy](https://discuss.elastic.co/u/thdesy)\ **Replies:** 1\ **Last updated:** [September 21, 2020, 1:59pm UTC](https://discuss.elastic.co/t/parsing-whole-file-as-a-single-event/249317 "2020-09-21T13:59:57Z")
Hi all, I would like to monitor a directory, where per event a file is written; each event-file consists of several key=value pairs. \> /var/log/dir/history.\* \> head /var/log/dir/history.1234 key1 = value1 key… --- ## [Elasticsearch cluster going down , whenever trying to run query for more than 2 days](https://discuss.elastic.co/t/elasticsearch-cluster-going-down-whenever-trying-to-run-query-for-more-than-2-days/249309)
**Author:** [@rohitarorait82](https://discuss.elastic.co/u/rohitarorait82)\ **Replies:** 6\ **Last updated:** [September 21, 2020, 1:52pm UTC](https://discuss.elastic.co/t/elasticsearch-cluster-going-down-whenever-trying-to-run-query-for-more-than-2-days/249309 "2020-09-21T13:52:20Z")
Hi All, I am new to elasticsearch, so don't much idea about it's performance, but whenever I am trying to run a visualization report for more than 2 days then it is resulting in cluster going down. We have some huge loa… --- ## [Strange behavior of s3 snapshots](https://discuss.elastic.co/t/strange-behavior-of-s3-snapshots/249367)
**Author:** [@aros](https://discuss.elastic.co/u/aros)\ **Replies:** 0\ **Last updated:** [September 21, 2020, 1:40pm UTC](https://discuss.elastic.co/t/strange-behavior-of-s3-snapshots/249367 "2020-09-21T13:40:38Z")
Hi, we lately encounters some strange behavoir of our s3 snapshots. We backup indices to wasabi using the s3 repository plugin with several repositories and slm policies registered. Each repository is registered once at… --- ## [Allow vector functions in script fields context](https://discuss.elastic.co/t/allow-vector-functions-in-script-fields-context/247884)
**Author:** [@Denne](https://discuss.elastic.co/u/Denne)\ **Replies:** 3\ **Last updated:** [September 21, 2020, 1:32pm UTC](https://discuss.elastic.co/t/allow-vector-functions-in-script-fields-context/247884 "2020-09-21T13:32:30Z")
Hi! I use for a very specific use case script fields for scoring different attributes of documents using custom painless scripts, where the query context is used for filtering non-relevant documents (in the example bel… --- ## [Окончания слова и словосочетаний](https://discuss.elastic.co/t/topic/248827)
**Author:** [@safonov](https://discuss.elastic.co/u/safonov)\ **Replies:** 5\ **Last updated:** [September 21, 2020, 1:32pm UTC](https://discuss.elastic.co/t/topic/248827 "2020-09-21T13:32:29Z")
Можно ли как-то настроить анализатор, чтобы при запросе сначала были предложения по окончанию слова, после проблема и ввода второго слова уже предложения по словосочетаниям. Спасибо! --- ## [Strange results with lte range comparison for dates in ES 6.5.0](https://discuss.elastic.co/t/strange-results-with-lte-range-comparison-for-dates-in-es-6-5-0/247855)
**Author:** [@Jeremy\_LHEZ](https://discuss.elastic.co/u/Jeremy_LHEZ)\ **Replies:** 1\ **Last updated:** [September 21, 2020, 1:11pm UTC](https://discuss.elastic.co/t/strange-results-with-lte-range-comparison-for-dates-in-es-6-5-0/247855 "2020-09-21T13:11:48Z")
Hello, I am trying to add a filter to some of my queries to make sure my results are contained in a specific date interval. My complete final query (executed in kibana) looks like this: { "query":{ … --- ## [Getting total count based on collapsed value](https://discuss.elastic.co/t/getting-total-count-based-on-collapsed-value/249358)
**Author:** [@mohanaprakash](https://discuss.elastic.co/u/mohanaprakash)\ **Replies:** 0\ **Last updated:** [September 21, 2020, 12:39pm UTC](https://discuss.elastic.co/t/getting-total-count-based-on-collapsed-value/249358 "2020-09-21T12:39:22Z")
I am new to elastic search and i am trying to extract total number of concurrent users active in the given period. For example i have a data as below User Login Time Logout Time A 2020-09-21T10:00:00 2020-09-21… --- ## [Alternative lucene query to implement rate() function in elasticsearch](https://discuss.elastic.co/t/alternative-lucene-query-to-implement-rate-function-in-elasticsearch/249143)
**Author:** [@Sankpra34](https://discuss.elastic.co/u/Sankpra34)\ **Replies:** 1\ **Last updated:** [September 21, 2020, 11:59am UTC](https://discuss.elastic.co/t/alternative-lucene-query-to-implement-rate-function-in-elasticsearch/249143 "2020-09-21T11:59:45Z")
I need to convert my PromQL query from my Grafana dashboard into Elasticsearch supported Lucene's query. Currently, there is no such function that can be used as rate() function. Is there any way to implement rate() func… --- ## [Request failed with a 400 error. \[x\_content\_parse\_exception\] Failed to build \[xpack/rollup/jobconfig\] after last required field arrived](https://discuss.elastic.co/t/request-failed-with-a-400-error-x-content-parse-exception-failed-to-build-xpack-rollup-jobconfig-after-last-required-field-arrived/249252)
**Author:** [@piyalkuet](https://discuss.elastic.co/u/piyalkuet)\ **Replies:** 1\ **Last updated:** [September 21, 2020, 11:53am UTC](https://discuss.elastic.co/t/request-failed-with-a-400-error-x-content-parse-exception-failed-to-build-xpack-rollup-jobconfig-after-last-required-field-arrived/249252 "2020-09-21T11:53:58Z")
Dear all, I am facing issues creating a rollup job for big indexes. While saving it gives me a exception "Request failed with a 400 error. \[x\_content\_parse\_exception\] Failed to build \[xpack/rollup/jobconfig\] after last r… --- ## [Tutorial for creating watcher scripts in Painless lab](https://discuss.elastic.co/t/tutorial-for-creating-watcher-scripts-in-painless-lab/248815)
**Author:** [@Babadofar](https://discuss.elastic.co/u/Babadofar)\ **Replies:** 2\ **Last updated:** [September 21, 2020, 11:16am UTC](https://discuss.elastic.co/t/tutorial-for-creating-watcher-scripts-in-painless-lab/248815 "2020-09-21T11:16:54Z")
Not sure where this question really belongs, but anyway. Creating complex alerts in watcher, using multi level aggregations and painless scripts for the condition is a little unwieldy. The Painless Lab could be used to… --- ## [Metricbeat System Dashboard not refreshing automatically](https://discuss.elastic.co/t/metricbeat-system-dashboard-not-refreshing-automatically/249338)
**Author:** [@pankaj0172](https://discuss.elastic.co/u/pankaj0172)\ **Replies:** 4\ **Last updated:** [September 21, 2020, 11:10am UTC](https://discuss.elastic.co/t/metricbeat-system-dashboard-not-refreshing-automatically/249338 "2020-09-21T11:10:02Z")
Hi, Can someone please help with me refreshing System Metricbeat Dashboard automatically as it's not refreshing automatically, I have to manually update every time to see the data. --- ## [Cluster RED, unassigned shards](https://discuss.elastic.co/t/cluster-red-unassigned-shards/248951)
**Author:** [@alkarp](https://discuss.elastic.co/u/alkarp)\ **Replies:** 3\ **Last updated:** [September 21, 2020, 10:42am UTC](https://discuss.elastic.co/t/cluster-red-unassigned-shards/248951 "2020-09-21T10:42:02Z")
After complete cluster restart have all the indices shards unassigned. 662 indices 820 shards in summary 3 master nodes 3 data nodes Master and data nodes are up, and it says "can\_allocate" : "yes", however shards s… --- ## [Logstash - Symantec Pipeline](https://discuss.elastic.co/t/logstash-symantec-pipeline/249334)
**Author:** [@amolmegheELK](https://discuss.elastic.co/u/amolmegheELK)\ **Replies:** 0\ **Last updated:** [September 21, 2020, 9:55am UTC](https://discuss.elastic.co/t/logstash-symantec-pipeline/249334 "2020-09-21T09:55:36Z")
Hello, I am using ELK 6.8.0, and i am performing the logstash Pipeline for symantec. earlier indices created as per pipeline and our custom requirements . however newly created indices is different from old one. Older i… --- ## [I need help: Search query for single custom object array with words and values sorted decending](https://discuss.elastic.co/t/i-need-help-search-query-for-single-custom-object-array-with-words-and-values-sorted-decending/249333)
**Author:** [@prox](https://discuss.elastic.co/u/prox)\ **Replies:** 0\ **Last updated:** [September 21, 2020, 9:54am UTC](https://discuss.elastic.co/t/i-need-help-search-query-for-single-custom-object-array-with-words-and-values-sorted-decending/249333 "2020-09-21T09:54:42Z")
I am currently troubled by creating an elasticsearch query that searches firstly the "customPayload", sort by the word value. It is currently enough if it only works with single word search terms. If possible I also want… --- ## [Grok Multiline file](https://discuss.elastic.co/t/grok-multiline-file/248302)
**Author:** [@LuigiDelavega](https://discuss.elastic.co/u/LuigiDelavega)\ **Replies:** 4\ **Last updated:** [September 11, 2020, 2:57pm UTC](https://discuss.elastic.co/t/grok-multiline-file/248302 "2020-09-11T14:57:28Z")
Hi there, I'm looking to grok mails which were not sent. So i would like the entire file to be read as one log with 5 fields : From, To, Date, Subject and the rest as Message. Here is what it looks like: From: TEXT To… --- ## [Unable to Disable G1 GC logging to stdout RHEL6](https://discuss.elastic.co/t/unable-to-disable-g1-gc-logging-to-stdout-rhel6/247291)
**Author:** [@lzukel](https://discuss.elastic.co/u/lzukel)\ **Replies:** 5\ **Last updated:** [September 21, 2020, 9:44am UTC](https://discuss.elastic.co/t/unable-to-disable-g1-gc-logging-to-stdout-rhel6/247291 "2020-09-21T09:44:20Z")
I am unable to disable the GC logging from Elasticsearch 7.x to stdout. elasticsearch startup command: /usr/share/elasticsearch/jdk//bin/java -Xshare:auto -Des.networkaddress.cache.ttl=60 -Des.networkaddress.cache.nega… --- ## [Disaster recovery is supported by elastic operator](https://discuss.elastic.co/t/disaster-recovery-is-supported-by-elastic-operator/248950)
**Author:** [@knagasri](https://discuss.elastic.co/u/knagasri)\ **Replies:** 1\ **Last updated:** [September 21, 2020, 9:39am UTC](https://discuss.elastic.co/t/disaster-recovery-is-supported-by-elastic-operator/248950 "2020-09-21T09:39:54Z")
Did elastic operator :1.2.1 supports disaster recovery. If supports how to achieve it. --- ## [Не работают стоп слова](https://discuss.elastic.co/t/topic/247972)
**Author:** [@Ivan\_Filonenko](https://discuss.elastic.co/u/Ivan_Filonenko)\ **Replies:** 10\ **Last updated:** [September 21, 2020, 8:36am UTC](https://discuss.elastic.co/t/topic/247972 "2020-09-21T08:36:38Z")
Continuing the discussion from Не работают стоп слова: У меня схожая проблема, что и описанная выше. Только в индексе есть все нужные настройки, а поиск все равно осуществляется без стоп-слов. Вот так выглядят настройк… --- ## [How to chose the number of shards and replica](https://discuss.elastic.co/t/how-to-chose-the-number-of-shards-and-replica/249321)
**Author:** [@Abdelhalim](https://discuss.elastic.co/u/Abdelhalim)\ **Replies:** 2\ **Last updated:** [September 21, 2020, 8:25am UTC](https://discuss.elastic.co/t/how-to-chose-the-number-of-shards-and-replica/249321 "2020-09-21T08:25:47Z")
Hello everybody, Could you tell me please what is the best rule to calculate the number of shards for the index ? I found this rule but I don't know if it's the best one: 20 Shards max for each 1 GB of heap on each nod… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1227) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1229)