# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=1565 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1566 --- ## [Log4j2 syslog appender ignoring facility](https://discuss.elastic.co/t/log4j2-syslog-appender-ignoring-facility/224122)
**Author:** [@Vincent\_DOS\_SANTOS](https://discuss.elastic.co/u/Vincent_DOS_SANTOS)\ **Replies:** 0\ **Last updated:** [March 18, 2020, 1:37pm UTC](https://discuss.elastic.co/t/log4j2-syslog-appender-ignoring-facility/224122 "2020-03-18T13:37:11Z")
Hi. I tried to configure syslog appender on elasticsearch version 6.6. Here is my /etc/elasticsearch/log4j2.properties file appender.syslog.type = syslog appender.syslog.name = syslog appender.syslog.facility = local7… --- ## [How to scale up and down nodes automatically?](https://discuss.elastic.co/t/how-to-scale-up-and-down-nodes-automatically/224089)
**Author:** [@doctor](https://discuss.elastic.co/u/doctor)\ **Replies:** 2\ **Last updated:** [March 18, 2020, 1:33pm UTC](https://discuss.elastic.co/t/how-to-scale-up-and-down-nodes-automatically/224089 "2020-03-18T13:33:35Z")
Hey, I am searching for a way to scale up and down ES nodes automatically at runtime. I know I can update the "kind: Elasticsearch" yaml to change the number of nodes in the cluster but can this be done by itself? Is … --- ## [Connect to postgres dB using logstash](https://discuss.elastic.co/t/connect-to-postgres-db-using-logstash/223487)
**Author:** [@Thamini\_NellaiKumar](https://discuss.elastic.co/u/Thamini_NellaiKumar)\ **Replies:** 2\ **Last updated:** [March 18, 2020, 1:30pm UTC](https://discuss.elastic.co/t/connect-to-postgres-db-using-logstash/223487 "2020-03-18T13:30:35Z")
I have a postgres dB in one server and elk in another server. I want to load data from postgres dB to elastic search using logstash. How can I do this? In which server, should the jdbc driver be installed? --- ## [How do I grok this Cisco VPN log?](https://discuss.elastic.co/t/how-do-i-grok-this-cisco-vpn-log/224120)
**Author:** [@francescouk](https://discuss.elastic.co/u/francescouk)\ **Replies:** 0\ **Last updated:** [March 18, 2020, 1:26pm UTC](https://discuss.elastic.co/t/how-do-i-grok-this-cisco-vpn-log/224120 "2020-03-18T13:26:59Z")
For some reason I´m doing something wrong with this grok but I cannot find the problem: \<164\>Mar 18 2020 08:12:55: %ASA-4-722051: Group \ User \ IP \ IPv4 Address \ **Author:** [@Dhruvil\_Doshi](https://discuss.elastic.co/u/Dhruvil_Doshi)\ **Replies:** 0\ **Last updated:** [March 18, 2020, 1:19pm UTC](https://discuss.elastic.co/t/kafka-input-plugin-compressed-data/224114 "2020-03-18T13:19:33Z") In logstash, I am taking input from kafka. The messages in kafka are compressed. So I am getting compressed data in my elasticsearch index. Is there an way to decompress data in logstash. Data is compressed using gzip T… --- ## [Convert Number (elapsed\_time) into Time (HH:MM:SS)](https://discuss.elastic.co/t/convert-number-elapsed-time-into-time-hhss/218551)
**Author:** [@Thibaut\_M](https://discuss.elastic.co/u/Thibaut_M)\ **Replies:** 4\ **Last updated:** [March 18, 2020, 12:58pm UTC](https://discuss.elastic.co/t/convert-number-elapsed-time-into-time-hhss/218551 "2020-03-18T12:58:34Z")
Hello, Let me expose what i'm trying to achieve here. I calculate an elapsed\_time (with the elapsed plugin) between two documents. elapsed\_time is in second and i want it like this : HH:MM:SS so as an example : 80 sec =… --- ## [Elasticsearch is not reallocating shards after the primary shards were recovered. Unable to perform bulk indexing](https://discuss.elastic.co/t/elasticsearch-is-not-reallocating-shards-after-the-primary-shards-were-recovered-unable-to-perform-bulk-indexing/223971)
**Author:** [@Jehu\_T](https://discuss.elastic.co/u/Jehu_T)\ **Replies:** 9\ **Last updated:** [March 18, 2020, 12:27pm UTC](https://discuss.elastic.co/t/elasticsearch-is-not-reallocating-shards-after-the-primary-shards-were-recovered-unable-to-perform-bulk-indexing/223971 "2020-03-18T12:27:34Z")
We have a 5 node cluster that is not reallocating shards after the primary shards were recovered. To fix this issue we increased the heap size of the server from 80GB (160GB RAM) to 192GB (384GB RAM). This is also becaus… --- ## [Parsing logs from Fortinet WAF](https://discuss.elastic.co/t/parsing-logs-from-fortinet-waf/222794)
**Author:** [@david-vazquez](https://discuss.elastic.co/u/david-vazquez)\ **Replies:** 16\ **Last updated:** [March 18, 2020, 12:25pm UTC](https://discuss.elastic.co/t/parsing-logs-from-fortinet-waf/222794 "2020-03-18T12:25:46Z")
Hello all, Im new using ELK, so I have some doubts in some stuff I´m trying to do. I configured ELK Stack and im trying to ingest some logs to Elasticsearch. One of them are logs from Fortinet Web Application Firewall. … --- ## [Data transfer between Elasticsearch Data Nodes](https://discuss.elastic.co/t/data-transfer-between-elasticsearch-data-nodes/224106)
**Author:** [@rupam](https://discuss.elastic.co/u/rupam)\ **Replies:** 0\ **Last updated:** [March 18, 2020, 12:20pm UTC](https://discuss.elastic.co/t/data-transfer-between-elasticsearch-data-nodes/224106 "2020-03-18T12:20:59Z")
Hi Everyone, In my deployment, I have 3 node elasticsearch cluster in kubernetes environment and 5 clients are writing data to this cluster at rate of ~7MB/s per elasticsearch data node and NO READ operation is performe… --- ## [Query Shard Exception: Failed to create query](https://discuss.elastic.co/t/query-shard-exception-failed-to-create-query/224101)
**Author:** [@Raul\_Speroni](https://discuss.elastic.co/u/Raul_Speroni)\ **Replies:** 0\ **Last updated:** [March 18, 2020, 12:04pm UTC](https://discuss.elastic.co/t/query-shard-exception-failed-to-create-query/224101 "2020-03-18T12:04:25Z")
Hello, i'm having trouble with a query for some of the input (with other texts works just fine). At first i thought it might be an encoding issue, but same input with different query also works. Mapping: { "mapping":… --- ## [Indices disapeared](https://discuss.elastic.co/t/indices-disapeared/224087)
**Author:** [@Archimaine](https://discuss.elastic.co/u/Archimaine)\ **Replies:** 0\ **Last updated:** [March 18, 2020, 11:16am UTC](https://discuss.elastic.co/t/indices-disapeared/224087 "2020-03-18T11:16:53Z")
Hello, So, I put about 500Go of data in elasticsearch, snapshoted it and went on to another project for about two weeks. I now have to go back to my elasticsearch data, but every indices I created, as well as the snapsh… --- ## [Best practice logstash/filebeat](https://discuss.elastic.co/t/best-practice-logstash-filebeat/224078)
**Author:** [@ledoc](https://discuss.elastic.co/u/ledoc)\ **Replies:** 0\ **Last updated:** [March 18, 2020, 10:49am UTC](https://discuss.elastic.co/t/best-practice-logstash-filebeat/224078 "2020-03-18T10:49:40Z")
Hello there, I have question on best practice of logstash, and workspace in kibana. On my ELK test environment, I have filebeat/nxlog/gelf \> logstash \> elasticsearch (standard configuration). First, I have a lot of … --- ## [How to use kibana map in plugin made by plugin generator?](https://discuss.elastic.co/t/how-to-use-kibana-map-in-plugin-made-by-plugin-generator/224077)
**Author:** [@pranay\_bhatnagar](https://discuss.elastic.co/u/pranay_bhatnagar)\ **Replies:** 0\ **Last updated:** [March 18, 2020, 10:44am UTC](https://discuss.elastic.co/t/how-to-use-kibana-map-in-plugin-made-by-plugin-generator/224077 "2020-03-18T10:44:47Z")
Can you guide me how to use kibana map in plugin made by plugin generator ? I want to use Kibana map in my default plugin which is generated by plugin generator. --- ## [Immutable write only (no versionning allowed) index](https://discuss.elastic.co/t/immutable-write-only-no-versionning-allowed-index/224076)
**Author:** [@kais\_baccour](https://discuss.elastic.co/u/kais_baccour)\ **Replies:** 0\ **Last updated:** [March 18, 2020, 10:44am UTC](https://discuss.elastic.co/t/immutable-write-only-no-versionning-allowed-index/224076 "2020-03-18T10:44:38Z")
I know search guard offers this but I would like to know if there is any possibility to make an index immutable and by immutable I mean make it impossible to create a document with \_version \> 1. I would like to log docum… --- ## [Circuit breaker with durability permanent auto fixed?](https://discuss.elastic.co/t/circuit-breaker-with-durability-permanent-auto-fixed/224064)
**Author:** [@Faiz\_Ahmed\_Mushtak\_H](https://discuss.elastic.co/u/Faiz_Ahmed_Mushtak_H)\ **Replies:** 0\ **Last updated:** [March 18, 2020, 10:03am UTC](https://discuss.elastic.co/t/circuit-breaker-with-durability-permanent-auto-fixed/224064 "2020-03-18T10:03:39Z")
Where do I find out what kinds of errors lead to a transient circuit breaker exceptions vs permanent? Yesterday we got this exception, but it auto resolved surprisingly? Won't permanent exceptions require some sort of m… --- ## [Logstashのoutputをsyslogに設定時にエラー](https://discuss.elastic.co/t/logstash-output-syslog/224066)
**Author:** [@t-nakata](https://discuss.elastic.co/u/t-nakata)\ **Replies:** 0\ **Last updated:** [March 18, 2020, 10:13am UTC](https://discuss.elastic.co/t/logstash-output-syslog/224066 "2020-03-18T10:13:03Z")
logstashにて、outputをsyslogにした際に以下のエラーが発生しました。 原因についてご教示頂けないでしょうか ■confファイル内容 input { file{ path =\> "/XXX/test.log" start\_position =\> "beginning" } } output{ syslog{ host =\> "XXXXXX.co… --- ## [Circuit\_breaking\_exception Error](https://discuss.elastic.co/t/circuit-breaking-exception-error/224063)
**Author:** [@Krunal\_Panchal](https://discuss.elastic.co/u/Krunal_Panchal)\ **Replies:** 0\ **Last updated:** [March 18, 2020, 9:54am UTC](https://discuss.elastic.co/t/circuit-breaking-exception-error/224063 "2020-03-18T09:54:55Z")
0 filebeat-7.4.2-2020.03.18 W4oRgS9YSI-fRviBL-NFsw circuit\_breaking\_exception 0 filebeat-7.4.2-2020.03.17 W4oRgS9YSI-fRviBL-NFsw circuit\_breaking\_exception Type circuit\_breaking\_exception Reason \[parent\] Data … --- ## [Renaming and repackaging beats](https://discuss.elastic.co/t/renaming-and-repackaging-beats/223735)
**Author:** [@stefws](https://discuss.elastic.co/u/stefws)\ **Replies:** 1\ **Last updated:** [March 18, 2020, 9:38am UTC](https://discuss.elastic.co/t/renaming-and-repackaging-beats/223735 "2020-03-18T09:38:00Z")
Am trying to repackaged renamed versions of eg. auditbeat and filebeat v.7.6.1 using the FPM utility. But I find that most properly rpmbuild adds in symlinks under /usr/lib/.build-id to the binaries in such pacakges and… --- ## [Elastic Search not accessible using public IP](https://discuss.elastic.co/t/elastic-search-not-accessible-using-public-ip/223714)
**Author:** [@Apurv\_Jain](https://discuss.elastic.co/u/Apurv_Jain)\ **Replies:** 2\ **Last updated:** [March 18, 2020, 9:13am UTC](https://discuss.elastic.co/t/elastic-search-not-accessible-using-public-ip/223714 "2020-03-18T09:13:26Z")
Hi, I have installed Elastic Search on RHEL 6.9. I am facing a weird issue, I am running elastic on port 17000. when I am trying to access ElasticSearch through IP address it says Connection Refused, from internal as we… --- ## [Separate indexes for grok filters](https://discuss.elastic.co/t/separate-indexes-for-grok-filters/224034)
**Author:** [@nikhilesh](https://discuss.elastic.co/u/nikhilesh)\ **Replies:** 3\ **Last updated:** [March 18, 2020, 8:35am UTC](https://discuss.elastic.co/t/separate-indexes-for-grok-filters/224034 "2020-03-18T08:35:00Z")
I am wondering how to create separated indexes for different logs fetched into logstash (which were later passed onto elasticsearch), so that in kibana, In my case, I have a few client servers (each of which is installe… --- ## [Reindex parsing failure how to debug](https://discuss.elastic.co/t/reindex-parsing-failure-how-to-debug/224046)
**Author:** [@calanon](https://discuss.elastic.co/u/calanon)\ **Replies:** 0\ **Last updated:** [March 18, 2020, 8:33am UTC](https://discuss.elastic.co/t/reindex-parsing-failure-how-to-debug/224046 "2020-03-18T08:33:48Z")
I tried to reindex today with the following: POST \_reindex { "source": { "index": "var\_log\_nginx\_access-2020.03.16" }, "dest": { "index": "var\_log\_nginx\_access-2020.03.16-new" } } After this I get the f… --- ## [Machine learning et valeurs nulles](https://discuss.elastic.co/t/machine-learning-et-valeurs-nulles/223984)
**Author:** [@rbeg](https://discuss.elastic.co/u/rbeg)\ **Replies:** 3\ **Last updated:** [March 18, 2020, 8:33am UTC](https://discuss.elastic.co/t/machine-learning-et-valeurs-nulles/223984 "2020-03-18T08:33:27Z")
Bonjour, J'utilise Machine Learning pour remonter des alertes lorsque des courbes de trafic web sont anormales. Par exemple s'il y a trop de trafic ou pas assez. Je fait pour ça la somme (count) du nombre de connexions… --- ## [Restoring ES 7.6.1 snapshot into ES 7.1.1](https://discuss.elastic.co/t/restoring-es-7-6-1-snapshot-into-es-7-1-1/223523)
**Author:** [@Daniele\_Renda](https://discuss.elastic.co/u/Daniele_Renda)\ **Replies:** 2\ **Last updated:** [March 18, 2020, 8:22am UTC](https://discuss.elastic.co/t/restoring-es-7-6-1-snapshot-into-es-7-1-1/223523 "2020-03-18T08:22:01Z")
Hi, I'd like to know if there is a way to restore a manual snapshot made with ES 7.6.1 into ES 7.1.1. I tried and I got the error: the snapshot was created with Elasticsearch version \[7.6.1\] which is higher than the ve… --- ## [Deleting field mapping](https://discuss.elastic.co/t/deleting-field-mapping/223974)
**Author:** [@m-o-t-h](https://discuss.elastic.co/u/m-o-t-h)\ **Replies:** 2\ **Last updated:** [March 18, 2020, 8:10am UTC](https://discuss.elastic.co/t/deleting-field-mapping/223974 "2020-03-18T08:10:43Z")
Elastic/Kibana vs: 6.7.1 I'm searching for solution for fixing mapping explosion in index pattern. Indices under this contains logs from Winlogbeat. There is one problematic field: Pipelineexecutiondetailsforcommandline… --- ## [Regarding I/O](https://discuss.elastic.co/t/regarding-i-o/224043)
**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 0\ **Last updated:** [March 18, 2020, 7:56am UTC](https://discuss.elastic.co/t/regarding-i-o/224043 "2020-03-18T07:56:59Z")
Hi, Can I ask, what is the goto beats collector for monitoring disk i/o utilisation? I'd like to monitor the responsiveness of the disk subsystem on our elasticsearch nodes. Thx D --- ## [Wrong timestamp in Kibaba dashboard](https://discuss.elastic.co/t/wrong-timestamp-in-kibaba-dashboard/223985)
**Author:** [@anjana1](https://discuss.elastic.co/u/anjana1)\ **Replies:** 1\ **Last updated:** [March 18, 2020, 6:32am UTC](https://discuss.elastic.co/t/wrong-timestamp-in-kibaba-dashboard/223985 "2020-03-18T06:32:14Z")
Kibana version : 7.6 Elasticsearch version : 7.6 APM Server version : 7.3.2 APM Agent language and version : java 1.9.0 Fresh install or upgraded from other version? fresh install Is there anything special in your s… --- ## [How to find out memory usage while aggregating some fields?](https://discuss.elastic.co/t/how-to-find-out-memory-usage-while-aggregating-some-fields/223895)
**Author:** [@AshokBachchan](https://discuss.elastic.co/u/AshokBachchan)\ **Replies:** 4\ **Last updated:** [March 18, 2020, 6:10am UTC](https://discuss.elastic.co/t/how-to-find-out-memory-usage-while-aggregating-some-fields/223895 "2020-03-18T06:10:10Z")
Hello Everyone, We are facing some latency issues while aggregating on some fields, due to this it is getting Java heap issue. I have few queries on these, we have 30GB Java heap for data node, index size was 100GB per… --- ## [Fsccrawler Document ID](https://discuss.elastic.co/t/fsccrawler-document-id/224021)
**Author:** [@pyerunka](https://discuss.elastic.co/u/pyerunka)\ **Replies:** 1\ **Last updated:** [March 18, 2020, 5:39am UTC](https://discuss.elastic.co/t/fsccrawler-document-id/224021 "2020-03-18T05:39:53Z")
Hello, Can anyone help me in this? I wanted to check that, when we index any folder using FSCrawler, for each file in he folder separate document id is generated or for all the files or attachments in the folder only o… --- ## [Aggregation date using RestHighLevelClient](https://discuss.elastic.co/t/aggregation-date-using-resthighlevelclient/223871)
**Author:** [@zhonghuafy](https://discuss.elastic.co/u/zhonghuafy)\ **Replies:** 1\ **Last updated:** [March 18, 2020, 5:26am UTC](https://discuss.elastic.co/t/aggregation-date-using-resthighlevelclient/223871 "2020-03-18T05:26:14Z")
I'm trying to implement sql below: select format(date,'yyyy-MM-dd'), count(\*) group by format(date,'yyyy-MM-dd') using RestHighLevelClient java code: SearchSourceBuilder sourceBuilder = new SearchSourceBuilder();… --- ## [Message queue for ELK Stack on Windows](https://discuss.elastic.co/t/message-queue-for-elk-stack-on-windows/224025)
**Author:** [@nityaraj06](https://discuss.elastic.co/u/nityaraj06)\ **Replies:** 0\ **Last updated:** [March 18, 2020, 4:51am UTC](https://discuss.elastic.co/t/message-queue-for-elk-stack-on-windows/224025 "2020-03-18T04:51:33Z")
Hi, I have been exploring about adding a message queue to my ELK stack on Windows server 2016 Redis seems to be a good option to use but it seems like it is not compatible with Windows. Could you please suggest a messa… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1564) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1566)