# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=1329 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1330 --- ## [ELK siem and audit log source options](https://discuss.elastic.co/t/elk-siem-and-audit-log-source-options/240973)
**Author:** [@Altug\_Bozkurt](https://discuss.elastic.co/u/Altug_Bozkurt)\ **Replies:** 1\ **Last updated:** [July 15, 2020, 10:32pm UTC](https://discuss.elastic.co/t/elk-siem-and-audit-log-source-options/240973 "2020-07-15T22:32:21Z")
Hi everyone, I am considering to try out ELK siem with audit logs but it appears the source of the audit logs has to be through auditbeat daemon provided by ELK, but i have my own daemon with additional functionalities … --- ## [Where does the SIEM saved objects reside?](https://discuss.elastic.co/t/where-does-the-siem-saved-objects-reside/241330)
**Author:** [@kelk](https://discuss.elastic.co/u/kelk)\ **Replies:** 3\ **Last updated:** [July 15, 2020, 10:09pm UTC](https://discuss.elastic.co/t/where-does-the-siem-saved-objects-reside/241330 "2020-07-15T22:09:45Z")
hi I was looking into to find Which all index-patterns SIEM app looks by default? How to modify this to include more indices? Where are the saved-objects reside? I was trying to find the objects as per the example doc,… --- ## [Logstash](https://discuss.elastic.co/t/logstash/241326)
**Author:** [@laxmikanth](https://discuss.elastic.co/u/laxmikanth)\ **Replies:** 1\ **Last updated:** [July 15, 2020, 9:25pm UTC](https://discuss.elastic.co/t/logstash/241326 "2020-07-15T21:25:57Z")
When I try to run logstash in local, noticing below error. Can some one please help me? --- ## [I wonder about logstash YYYY.MM.dd](https://discuss.elastic.co/t/i-wonder-about-logstash-yyyy-mm-dd/241073)
**Author:** [@111349](https://discuss.elastic.co/u/111349)\ **Replies:** 9\ **Last updated:** [July 15, 2020, 9:07pm UTC](https://discuss.elastic.co/t/i-wonder-about-logstash-yyyy-mm-dd/241073 "2020-07-15T21:07:22Z")
I am not sure what logstash YYYY.MM.dd is based on. I'm in asia/seoul area and I also sent a message at 1am. The 13th was 1:00 a.m. on the 14th, but there was no newly created 14-day index in elasticsearch. I searched … --- ## [Как посмотреть какие плагины установлены?](https://discuss.elastic.co/t/topic/241354)
**Author:** [@leov](https://discuss.elastic.co/u/leov)\ **Replies:** 7\ **Last updated:** [July 15, 2020, 8:40pm UTC](https://discuss.elastic.co/t/topic/241354 "2020-07-15T20:40:03Z")
подскажите пожалуйста команду чтобы посмотреть какие плагины установлены на сервере эластика. "version": "5.6.16". добиваюсь от саппорта установки плагина русской морфологии но пока безуспешно --- ## [How to debug relevance in DSL queries](https://discuss.elastic.co/t/how-to-debug-relevance-in-dsl-queries/241357)
**Author:** [@ClubberLang](https://discuss.elastic.co/u/ClubberLang)\ **Replies:** 1\ **Last updated:** [July 15, 2020, 8:09pm UTC](https://discuss.elastic.co/t/how-to-debug-relevance-in-dsl-queries/241357 "2020-07-15T20:09:33Z")
Hi, I'm working on my first set of queries, but I wish to 'debug' and see: which part of my query match what is the computed score for anything involved in the computation of the final score. For the first, it seems … --- ## [Snapshot only for data-nodes](https://discuss.elastic.co/t/snapshot-only-for-data-nodes/241345)
**Author:** [@NmPOuNgLfKWK2c4dDS](https://discuss.elastic.co/u/NmPOuNgLfKWK2c4dDS)\ **Replies:** 2\ **Last updated:** [July 15, 2020, 6:17pm UTC](https://discuss.elastic.co/t/snapshot-only-for-data-nodes/241345 "2020-07-15T18:17:45Z")
Hi \*. My first post here, this time I was unable to simply find answer on the net. I have ES 7.8.0 cluster, two "proper" nodes and one voting-only master-eligible. Last one is as simple as it can be - just a docker imag… --- ## [Enabling anonymous access](https://discuss.elastic.co/t/enabling-anonymous-access/239430)
**Author:** [@jjums](https://discuss.elastic.co/u/jjums)\ **Replies:** 3\ **Last updated:** [July 15, 2020, 6:03pm UTC](https://discuss.elastic.co/t/enabling-anonymous-access/239430 "2020-07-15T18:03:55Z")
Hello, I'm a beginner in using elasticsearch and kibana. I installed ver. 7.7. I want to use the function "enabling anonymous access". https://www.elastic.co/guide/en/elasticsearch/reference/7.7/anonymous-access.html … --- ## [Near duplicate document detection](https://discuss.elastic.co/t/near-duplicate-document-detection/241334)
**Author:** [@tallison](https://discuss.elastic.co/u/tallison)\ **Replies:** 1\ **Last updated:** [July 15, 2020, 5:35pm UTC](https://discuss.elastic.co/t/near-duplicate-document-detection/241334 "2020-07-15T17:35:03Z")
I have an index w ~12 million files. We have a serious duplication issue and near duplication issue. The exact duplicate problem is trivial because we store a digest. The near duplicate issue is more profound, and I'v… --- ## [ERROR: Failed to verify bootstrap password when setting built in user's password](https://discuss.elastic.co/t/error-failed-to-verify-bootstrap-password-when-setting-built-in-users-password/241341)
**Author:** [@bhavya](https://discuss.elastic.co/u/bhavya)\ **Replies:** 0\ **Last updated:** [July 15, 2020, 5:21pm UTC](https://discuss.elastic.co/t/error-failed-to-verify-bootstrap-password-when-setting-built-in-users-password/241341 "2020-07-15T17:21:45Z")
I have imported and started Elasticsearch Source Code into an IntelliJ IDEA project. I want to create the password for the built-in users To enable security, I passed -Dtests.es.xpack.security.enabled=true as a parame… --- ## [Logstash Aggregate Filter output different result each time](https://discuss.elastic.co/t/logstash-aggregate-filter-output-different-result-each-time/239303)
**Author:** [@Aberry](https://discuss.elastic.co/u/Aberry)\ **Replies:** 5\ **Last updated:** [July 15, 2020, 5:19pm UTC](https://discuss.elastic.co/t/logstash-aggregate-filter-output-different-result-each-time/239303 "2020-07-15T17:19:39Z")
I have 2 input files like below - inbound.txt: 17:03:56.662 53897 55931 17:03:56.737 53898 55932 17:03:56.814 53899 55933 17:03:56.889 53900 55934 outbound.txt: 17:03:56.887 77307 55931 17:03:56.953 77… --- ## [Get newest value per distinct field](https://discuss.elastic.co/t/get-newest-value-per-distinct-field/241157)
**Author:** [@gudmundur](https://discuss.elastic.co/u/gudmundur)\ **Replies:** 2\ **Last updated:** [July 15, 2020, 5:15pm UTC](https://discuss.elastic.co/t/get-newest-value-per-distinct-field/241157 "2020-07-15T17:15:02Z")
Greetings I want to do a query which returns the newest 1 value per distinct combination of specific underlying fields (maybe also after a certain timestamp) In the sql world I can do a query like this: select Element… --- ## [How to update dynamic mapping on existing index](https://discuss.elastic.co/t/how-to-update-dynamic-mapping-on-existing-index/241327)
**Author:** [@ilang](https://discuss.elastic.co/u/ilang)\ **Replies:** 0\ **Last updated:** [July 15, 2020, 3:42pm UTC](https://discuss.elastic.co/t/how-to-update-dynamic-mapping-on-existing-index/241327 "2020-07-15T15:42:34Z")
Hi guys, I am trying to update the dynamic mapping to "strict" on an existing index. To do so I tried to run the following query: PUT /dev-jira-fetcher/\_mappings { "dynamic": "strict" } I also tried this one: PUT… --- ## [How can I have an review of my index content on a specific field?](https://discuss.elastic.co/t/how-can-i-have-an-review-of-my-index-content-on-a-specific-field/241297)
**Author:** [@vic22](https://discuss.elastic.co/u/vic22)\ **Replies:** 4\ **Last updated:** [July 15, 2020, 3:10pm UTC](https://discuss.elastic.co/t/how-can-i-have-an-review-of-my-index-content-on-a-specific-field/241297 "2020-07-15T15:10:24Z")
Hello everyone ! I hope that you have a great day! I would like to ask you a particular question. It sounds easy, but, in contrario, it is quite complex... In my Elasticsearch index, I would like to know for a specifi… --- ## [Logstash Jdbc Input Plugin format for timestamp in prepared statement](https://discuss.elastic.co/t/logstash-jdbc-input-plugin-format-for-timestamp-in-prepared-statement/241307)
**Author:** [@styks90](https://discuss.elastic.co/u/styks90)\ **Replies:** 1\ **Last updated:** [July 15, 2020, 2:47pm UTC](https://discuss.elastic.co/t/logstash-jdbc-input-plugin-format-for-timestamp-in-prepared-statement/241307 "2020-07-15T14:47:27Z")
We are looking to use prepared statements with the Jdbc input plugin, where the source database is a Db2 instance. So far we've not been using prepared statements, so that the relevant part of the (working) config looks… --- ## [How to get current time as unix timestamp for script use](https://discuss.elastic.co/t/how-to-get-current-time-as-unix-timestamp-for-script-use/240723)
**Author:** [@Quentin\_L\_eilde](https://discuss.elastic.co/u/Quentin_L_eilde)\ **Replies:** 2\ **Last updated:** [July 15, 2020, 2:31pm UTC](https://discuss.elastic.co/t/how-to-get-current-time-as-unix-timestamp-for-script-use/240723 "2020-07-15T14:31:52Z")
Hello, I have three fields: date\_start (type: date) date\_end (type: date) permanent (type: bool) I would like to return all documents with theses conditions: date\_start \<= now AND date\_end \>= now OR date\_start \<= … --- ## [AWS Elasticsearch snapshot stuck in state IN\_PROGRESS](https://discuss.elastic.co/t/aws-elasticsearch-snapshot-stuck-in-state-in-progress/241289)
**Author:** [@dorinand](https://discuss.elastic.co/u/dorinand)\ **Replies:** 2\ **Last updated:** [July 15, 2020, 2:16pm UTC](https://discuss.elastic.co/t/aws-elasticsearch-snapshot-stuck-in-state-in-progress/241289 "2020-07-15T14:16:24Z")
I am using ElasticService from AWS. I am receiving Snapshot failure status in Overall health. I can see, there is one snapshot that is stuctk for almost 2 days. id … --- ## [Not able to start Elasticsearch, no matter what I do](https://discuss.elastic.co/t/not-able-to-start-elasticsearch-no-matter-what-i-do/240847)
**Author:** [@prajwalgmpp](https://discuss.elastic.co/u/prajwalgmpp)\ **Replies:** 7\ **Last updated:** [July 15, 2020, 2:15pm UTC](https://discuss.elastic.co/t/not-able-to-start-elasticsearch-no-matter-what-i-do/240847 "2020-07-15T14:15:42Z")
Running Ubuntu 20.04 on Oracle VM. Deployed two Ubuntu instances on AWS. I will list out all the steps I did. Please let me know where I have gone wrong. Copied the pem file to home directory cp ~/Downloads/TetraSear… --- ## [How to resize an ECK cluster](https://discuss.elastic.co/t/how-to-resize-an-eck-cluster/241306)
**Author:** [@Kay\_Khan](https://discuss.elastic.co/u/Kay_Khan)\ **Replies:** 1\ **Last updated:** [July 15, 2020, 2:14pm UTC](https://discuss.elastic.co/t/how-to-resize-an-eck-cluster/241306 "2020-07-15T14:14:53Z")
I have an elasticsearch cluster which has the storage field set to 10Gi, i want to resize this cluster (for testing purposes to 15Gi). However after changing the storage value from 10Gi to 15Gi i can see that the cluster… --- ## [How to restore elasticsearch s3 snapshot on a different cluster](https://discuss.elastic.co/t/how-to-restore-elasticsearch-s3-snapshot-on-a-different-cluster/241153)
**Author:** [@Kay\_Khan](https://discuss.elastic.co/u/Kay_Khan)\ **Replies:** 3\ **Last updated:** [July 15, 2020, 1:58pm UTC](https://discuss.elastic.co/t/how-to-restore-elasticsearch-s3-snapshot-on-a-different-cluster/241153 "2020-07-15T13:58:51Z")
I have an Elastic Cloud on Kubernetes (ECK) setup and i have also setup snapshots which are stored on s3. I want to restore these snapshots on s3 to a local version of ECK i have running on minikube. So how do i restore… --- ## [How to stop logstash gracefully when using kubernetes](https://discuss.elastic.co/t/how-to-stop-logstash-gracefully-when-using-kubernetes/241288)
**Author:** [@benz](https://discuss.elastic.co/u/benz)\ **Replies:** 1\ **Last updated:** [July 15, 2020, 1:54pm UTC](https://discuss.elastic.co/t/how-to-stop-logstash-gracefully-when-using-kubernetes/241288 "2020-07-15T13:54:26Z")
Hi, We are running logstash as statefulset over k8s. I am looking for a way to stop logstash only after it finish process all in-flight events. We already use: enable\_auto\_commit =\> "false" for kafka input so I guess… --- ## [Visualization with kibana](https://discuss.elastic.co/t/visualization-with-kibana/238999)
**Author:** [@inchirah](https://discuss.elastic.co/u/inchirah)\ **Replies:** 1\ **Last updated:** [July 15, 2020, 1:46pm UTC](https://discuss.elastic.co/t/visualization-with-kibana/238999 "2020-07-15T13:46:35Z")
Hello, I want to visualize a simple bar chart with y-axis "taux"(percentage) one value, and in the x-axis a constant "seuil". Could you please help me. --- ## [Get file name from index based on content search in index](https://discuss.elastic.co/t/get-file-name-from-index-based-on-content-search-in-index/241283)
**Author:** [@Krishna\_Sai\_Nag\_G](https://discuss.elastic.co/u/Krishna_Sai_Nag_G)\ **Replies:** 21\ **Last updated:** [July 15, 2020, 1:34pm UTC](https://discuss.elastic.co/t/get-file-name-from-index-based-on-content-search-in-index/241283 "2020-07-15T13:34:52Z")
Hi, Thanks in advance i have loaded pdf files into index, all the data in the pdf file is treated as content in index. now i want the file name based on the content search. suppose if i search for football in the co… --- ## [List of string must match all provided values](https://discuss.elastic.co/t/list-of-string-must-match-all-provided-values/240351)
**Author:** [@Nicolas\_Rey](https://discuss.elastic.co/u/Nicolas_Rey)\ **Replies:** 13\ **Last updated:** [July 15, 2020, 1:07pm UTC](https://discuss.elastic.co/t/list-of-string-must-match-all-provided-values/240351 "2020-07-15T13:07:30Z")
Hi, I'm new to Elastic Search, and I simply would like to make a query that filter all entries that have exactly all the supplied values (not an OR but an AND). Here is an example of my document \[ { "Areas" : … --- ## [Sum nested values and filter / sort by them](https://discuss.elastic.co/t/sum-nested-values-and-filter-sort-by-them/241284)
**Author:** [@stefnats](https://discuss.elastic.co/u/stefnats)\ **Replies:** 5\ **Last updated:** [July 15, 2020, 12:54pm UTC](https://discuss.elastic.co/t/sum-nested-values-and-filter-sort-by-them/241284 "2020-07-15T12:54:26Z")
Hi, as in this thread, my problem is pretty similar: I have a product index with a nested sales\_per\_day array. It looks something like this: PUT /products { "mappings": { "properties": { "sales\_per\_day… --- ## [Tag \["\_parsegrokfailure"\] anyone could help me?](https://discuss.elastic.co/t/tag-parsegrokfailure-anyone-could-help-me/241190)
**Author:** [@Khaled3500](https://discuss.elastic.co/u/Khaled3500)\ **Replies:** 5\ **Last updated:** [July 15, 2020, 12:51pm UTC](https://discuss.elastic.co/t/tag-parsegrokfailure-anyone-could-help-me/241190 "2020-07-15T12:51:54Z")
Hello, I created a grok pattern and it works well on grok debugger but when i add to filter inside the pipeline it pass the restart phase for the service but on kibana it give this tag \["\_grokparsefailure"\] i tried to de… --- ## [Elasticsearch term aggregations : use case for a single field](https://discuss.elastic.co/t/elasticsearch-term-aggregations-use-case-for-a-single-field/240672)
**Author:** [@vic22](https://discuss.elastic.co/u/vic22)\ **Replies:** 2\ **Last updated:** [July 15, 2020, 12:40pm UTC](https://discuss.elastic.co/t/elasticsearch-term-aggregations-use-case-for-a-single-field/240672 "2020-07-15T12:40:02Z")
Hello everyone, I try to understand term aggregations in Elasticsearch, and I don't know how to fix an particular use case : let me explain ! I try to catch all the element and their "key" values of a single field with… --- ## [Kibana Plugin Not working](https://discuss.elastic.co/t/kibana-plugin-not-working/241180)
**Author:** [@PRACHI\_GUPTA](https://discuss.elastic.co/u/PRACHI_GUPTA)\ **Replies:** 5\ **Last updated:** [July 15, 2020, 12:38pm UTC](https://discuss.elastic.co/t/kibana-plugin-not-working/241180 "2020-07-15T12:38:34Z")
I have integrated one custom kibana plugin but I can not find that in my kibana tool. I have setup the development environment, ran yarn kbn bootstrap and yarn start. I am not getting any issue. I checked in kibana bund… --- ## [Get specific string from field in logstash](https://discuss.elastic.co/t/get-specific-string-from-field-in-logstash/241276)
**Author:** [@tungpzostar](https://discuss.elastic.co/u/tungpzostar)\ **Replies:** 4\ **Last updated:** [July 15, 2020, 12:29pm UTC](https://discuss.elastic.co/t/get-specific-string-from-field-in-logstash/241276 "2020-07-15T12:29:45Z")
Hello, I'm new to logstash and I'm having trouble with this. I configured filebeat to receive Nginx log: This is sample input: "log": { "offset": 2234788, "file": { "path": "/nginxlogs/nginx.abc.1234.a… --- ## [How can I change the display of data in kibana from logstash?](https://discuss.elastic.co/t/how-can-i-change-the-display-of-data-in-kibana-from-logstash/241286)
**Author:** [@menes](https://discuss.elastic.co/u/menes)\ **Replies:** 1\ **Last updated:** [July 15, 2020, 12:12pm UTC](https://discuss.elastic.co/t/how-can-i-change-the-display-of-data-in-kibana-from-logstash/241286 "2020-07-15T12:12:04Z")
Good afternoon. Logstash passes a numeric value in the form of 10000 to elasticsearch, but in kibana it is displayed as 10, 000 can I configure logstash to display numeric values by default without a separator in kibana… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1328) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1330)