# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=1799 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1800 --- ## [Cisco ASA Parsing - Logstash vs Filebeat?](https://discuss.elastic.co/t/cisco-asa-parsing-logstash-vs-filebeat/206666)
**Author:** [@mgotechlock](https://discuss.elastic.co/u/mgotechlock)\ **Replies:** 0\ **Last updated:** [November 5, 2019, 7:01pm UTC](https://discuss.elastic.co/t/cisco-asa-parsing-logstash-vs-filebeat/206666 "2019-11-05T19:01:31Z")
This should be more obvious but I've spent hours searching and it's not. I just want to understand the best way(s) to get ASA logs to my internal logstash server and on to my AWS S3 output bucket. Ingesting Cisco ASA fi… --- ## [Grok parse failure despite pattern working in debugger](https://discuss.elastic.co/t/grok-parse-failure-despite-pattern-working-in-debugger/206665)
**Author:** [@mfisher](https://discuss.elastic.co/u/mfisher)\ **Replies:** 0\ **Last updated:** [November 5, 2019, 6:59pm UTC](https://discuss.elastic.co/t/grok-parse-failure-despite-pattern-working-in-debugger/206665 "2019-11-05T18:59:44Z")
I've been getting grok parse failures for these messages. "message": "\<164\>Nov 05 2019 12:46:04 NGFW1-IPICHIC : %ASA-4-434003: SFR requested to reset TCP connection from outside:13.249.87.36/443 to inside:38.142.127.155… --- ## [Adding metadata to a query for slow log analysis](https://discuss.elastic.co/t/adding-metadata-to-a-query-for-slow-log-analysis/206664)
**Author:** [@rocky67z](https://discuss.elastic.co/u/rocky67z)\ **Replies:** 0\ **Last updated:** [November 5, 2019, 6:55pm UTC](https://discuss.elastic.co/t/adding-metadata-to-a-query-for-slow-log-analysis/206664 "2019-11-05T18:55:18Z")
I have reviewed the Elasticsearch reference and have been unable to identify a way to add miscellaneous metadata to a query (not as query parameters to match/filter results), but instead specifically for the purposes of … --- ## [Cluster Error: data too large - marking and sending shards](https://discuss.elastic.co/t/cluster-error-data-too-large-marking-and-sending-shards/206663)
**Author:** [@Jorge\_Rodrigo\_Bogado](https://discuss.elastic.co/u/Jorge_Rodrigo_Bogado)\ **Replies:** 0\ **Last updated:** [November 5, 2019, 6:51pm UTC](https://discuss.elastic.co/t/cluster-error-data-too-large-marking-and-sending-shards/206663 "2019-11-05T18:51:22Z")
Hi, i had a power issue and the cluster had been down for nearly 10 hours. Now I have the following outputs: http://serverip:9200/\_cluster/health cluster\_name "cluster-name" status "yellow" timed\_out false … --- ## [How to Correlate Logs](https://discuss.elastic.co/t/how-to-correlate-logs/206655)
**Author:** [@nuwancs](https://discuss.elastic.co/u/nuwancs)\ **Replies:** 0\ **Last updated:** [November 5, 2019, 5:45pm UTC](https://discuss.elastic.co/t/how-to-correlate-logs/206655 "2019-11-05T17:45:27Z")
Hi There, I'm trying to correlate requests and responses via logstash. what i am doing is keep the request in the logstash untill the response receive. then will emit the correlated event to elasticsearch. In this appr… --- ## [Getting warning messages in logstash for grok patterns](https://discuss.elastic.co/t/getting-warning-messages-in-logstash-for-grok-patterns/206589)
**Author:** [@satyam2593](https://discuss.elastic.co/u/satyam2593)\ **Replies:** 2\ **Last updated:** [November 5, 2019, 4:59pm UTC](https://discuss.elastic.co/t/getting-warning-messages-in-logstash-for-grok-patterns/206589 "2019-11-05T16:59:36Z")
I am getting the below warning messages in logstash logs and index is not creating for the same. Error:\[WARN \]\[org.logstash.execution.ShutdownWatcherExt\] {"inflight\_count"=\>0, "stalling\_threads\_info"=\>{"other"=\>\[{"threa… --- ## [Failing scripted field in Elastic 7.4.2](https://discuss.elastic.co/t/failing-scripted-field-in-elastic-7-4-2/206503)
**Author:** [@ShaneLillie\_RAD](https://discuss.elastic.co/u/ShaneLillie_RAD)\ **Replies:** 2\ **Last updated:** [November 5, 2019, 4:40pm UTC](https://discuss.elastic.co/t/failing-scripted-field-in-elastic-7-4-2/206503 "2019-11-05T16:40:02Z")
Hi, I have the following Painless scripted field in Kibana: return doc\['a'\].size() != 0 && doc\['b'\].size() != 0 && doc\['a'\].value == doc\['b'\].value; And I'm not sure why but that is giving me the following error: No … --- ## [Logstash - Glok and stdout -\> rubydebug doesn't work](https://discuss.elastic.co/t/logstash-glok-and-stdout-rubydebug-doesnt-work/206631)
**Author:** [@Andrii\_Fon](https://discuss.elastic.co/u/Andrii_Fon)\ **Replies:** 6\ **Last updated:** [November 5, 2019, 4:34pm UTC](https://discuss.elastic.co/t/logstash-glok-and-stdout-rubydebug-doesnt-work/206631 "2019-11-05T16:34:49Z")
Hi everyone, I'm pacing days on the ELK + filebeat to make it work with my Glok filter. I have started installing ELK + filebeat, then defined logstash.conf: input { file { path =\> "D:\\ElisticLogs\\MyLog.log… --- ## [Get /myindex/\_search - return just 1 or 2 Fields not the whole Bucket or Document](https://discuss.elastic.co/t/get-myindex-search-return-just-1-or-2-fields-not-the-whole-bucket-or-document/206632)
**Author:** [@Datakids](https://discuss.elastic.co/u/Datakids)\ **Replies:** 2\ **Last updated:** [November 5, 2019, 3:55pm UTC](https://discuss.elastic.co/t/get-myindex-search-return-just-1-or-2-fields-not-the-whole-bucket-or-document/206632 "2019-11-05T15:55:42Z")
Hi all, im stuck in how to use the search in right way. What I did to get all out of my Index: PUT /myindex/\_settings { "index" : { "max\_result\_window" : 100000 } } Now with following GET Request I can show all the i… --- ## [Error when I'm launching logstash](https://discuss.elastic.co/t/error-when-im-launching-logstash/206561)
**Author:** [@lgllrd](https://discuss.elastic.co/u/lgllrd)\ **Replies:** 2\ **Last updated:** [November 5, 2019, 3:45pm UTC](https://discuss.elastic.co/t/error-when-im-launching-logstash/206561 "2019-11-05T15:45:09Z")
Hi, I'm trying to launch logstash with my .conf file but it tell me an error that I don't understand : OpenJDK 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecated in version 9.0 and will likely be remov… --- ## [Filebeat -\> Logstash match metadata](https://discuss.elastic.co/t/filebeat-logstash-match-metadata/206444)
**Author:** [@imaad](https://discuss.elastic.co/u/imaad)\ **Replies:** 3\ **Last updated:** [November 5, 2019, 3:42pm UTC](https://discuss.elastic.co/t/filebeat-logstash-match-metadata/206444 "2019-11-05T15:42:31Z")
Hi, I've noticed filebeat sends some additional metadata for each generated event such as: log.file.path and process.name. I can access to log.file.path (\[log\]\[file\]\[path\]) but not to process.name (\[process\]\[name\]). ?? … --- ## [Parse logs with timezone](https://discuss.elastic.co/t/parse-logs-with-timezone/206628)
**Author:** [@kate1](https://discuss.elastic.co/u/kate1)\ **Replies:** 0\ **Last updated:** [November 5, 2019, 2:34pm UTC](https://discuss.elastic.co/t/parse-logs-with-timezone/206628 "2019-11-05T14:34:56Z")
I'm trying to parse some logs with 2 type \ \ \ \ \ and --- Mon Sep 16 11:30:20 MSK 2019 WSLoggerQueue Left: 0, Out: 4 --- … --- ## [Status : timeout when I'm starting Elasticsearch](https://discuss.elastic.co/t/status-timeout-when-im-starting-elasticsearch/206374)
**Author:** [@lgllrd](https://discuss.elastic.co/u/lgllrd)\ **Replies:** 3\ **Last updated:** [November 5, 2019, 2:33pm UTC](https://discuss.elastic.co/t/status-timeout-when-im-starting-elasticsearch/206374 "2019-11-05T14:33:13Z")
Hi ! I just begin to learn the environment ELK one week ago and try to install Elasticsearch on my Debian 10 'Buster'. But I have a really big problem, when I'm doing "systemctl start elasticsearch.service" I got : A… --- ## [Elasticsearch 7 mappping on Elasticsearch 6](https://discuss.elastic.co/t/elasticsearch-7-mappping-on-elasticsearch-6/203681)
**Author:** [@pavolloffay](https://discuss.elastic.co/u/pavolloffay)\ **Replies:** 7\ **Last updated:** [November 5, 2019, 2:30pm UTC](https://discuss.elastic.co/t/elasticsearch-7-mappping-on-elasticsearch-6/203681 "2019-11-05T14:30:44Z")
Hello, is it possible to use Elasticsearch 7 mapping (with no types) on any version of Elasticsearch 6? For instance this mapping: { "mappings":{ "properties":{ "serviceName":{ "type":"keyword", … --- ## [How to change the json objects mapping to geo\_point](https://discuss.elastic.co/t/how-to-change-the-json-objects-mapping-to-geo-point/205438)
**Author:** [@irobot678](https://discuss.elastic.co/u/irobot678)\ **Replies:** 2\ **Last updated:** [November 5, 2019, 2:15pm UTC](https://discuss.elastic.co/t/how-to-change-the-json-objects-mapping-to-geo-point/205438 "2019-11-05T14:15:13Z")
HI, i'm using elk stack of version 7.1.1 with x-pack installed and I have follwing json data in elasticsearch { "id":"someid", "geometry":{ "type": "Point", "coordinates":\[ -76, -10… --- ## [Max size by index?¿](https://discuss.elastic.co/t/max-size-by-index/206411)
**Author:** [@Daniel\_Glez](https://discuss.elastic.co/u/Daniel_Glez)\ **Replies:** 3\ **Last updated:** [November 5, 2019, 2:14pm UTC](https://discuss.elastic.co/t/max-size-by-index/206411 "2019-11-05T14:14:06Z")
Hi, sorry for my kid question. I have just a node with elasticsearch, also a logstash with filebeat in varius nodes. My ask is: ¿I can limit the total size of index? I haven´t may HDD and I need limit it. Any idea? I… --- ## [In ES how can we find that which process is going currently if cpu load is high](https://discuss.elastic.co/t/in-es-how-can-we-find-that-which-process-is-going-currently-if-cpu-load-is-high/204057)
**Author:** [@Ekta](https://discuss.elastic.co/u/Ekta)\ **Replies:** 2\ **Last updated:** [November 5, 2019, 2:12pm UTC](https://discuss.elastic.co/t/in-es-how-can-we-find-that-which-process-is-going-currently-if-cpu-load-is-high/204057 "2019-11-05T14:12:33Z")
Hi everyone, I m new in ES, I want to that which process is currently running when CPU load is high or any time. --- ## [Quickstart ECK SecurityContext.RunAsUser is forbidden](https://discuss.elastic.co/t/quickstart-eck-securitycontext-runasuser-is-forbidden/206622)
**Author:** [@nfickas](https://discuss.elastic.co/u/nfickas)\ **Replies:** 0\ **Last updated:** [November 5, 2019, 2:04pm UTC](https://discuss.elastic.co/t/quickstart-eck-securitycontext-runasuser-is-forbidden/206622 "2019-11-05T14:04:52Z")
I am currently trying to deploy Elasticsearch onto my kubernetes cluster that is managed via PKS. I was able to successfully start the elastic-operator and install the CRD's. When attempting to deploy an Elasticsearch cl… --- ## [Rollup Aggregation Mismatch in results](https://discuss.elastic.co/t/rollup-aggregation-mismatch-in-results/206621)
**Author:** [@Vinothkumar\_Ganeshan](https://discuss.elastic.co/u/Vinothkumar_Ganeshan)\ **Replies:** 0\ **Last updated:** [November 5, 2019, 1:58pm UTC](https://discuss.elastic.co/t/rollup-aggregation-mismatch-in-results/206621 "2019-11-05T13:58:35Z")
ELK - 7.4.1 I have indices in the form of clicks-2019-07-01 date format. I created an index as clicks-2019-07\* and rollup with the aggregation to find the value count of specific term id. Index: clicks-2019-07\* … --- ## [Sorting on value from script field](https://discuss.elastic.co/t/sorting-on-value-from-script-field/206377)
**Author:** [@hiimcarsten](https://discuss.elastic.co/u/hiimcarsten)\ **Replies:** 4\ **Last updated:** [November 5, 2019, 1:51pm UTC](https://discuss.elastic.co/t/sorting-on-value-from-script-field/206377 "2019-11-05T13:51:55Z")
Hello everyone, The result of my executed query should be a number of documents including script fields, and optionally some sorting. The script fields rely on real-time data I am passing in the params, so the script fi… --- ## [Elasticsearch Search queries are slow for the first few attempts](https://discuss.elastic.co/t/elasticsearch-search-queries-are-slow-for-the-first-few-attempts/206620)
**Author:** [@pjaikumar](https://discuss.elastic.co/u/pjaikumar)\ **Replies:** 0\ **Last updated:** [November 5, 2019, 1:29pm UTC](https://discuss.elastic.co/t/elasticsearch-search-queries-are-slow-for-the-first-few-attempts/206620 "2019-11-05T13:29:22Z")
Hi, We are facing a latency issue with queries where it takes up-to 9 secs for the first time and then slowly it reduces to 5s,3s..etc and eventually it comes lighting fast with less than 150 millisecond. Again it goes … --- ## [Monitoring SaaS application, browser beat?](https://discuss.elastic.co/t/monitoring-saas-application-browser-beat/206616)
**Author:** [@Ron.Janssen](https://discuss.elastic.co/u/Ron.Janssen)\ **Replies:** 0\ **Last updated:** [November 5, 2019, 1:10pm UTC](https://discuss.elastic.co/t/monitoring-saas-application-browser-beat/206616 "2019-11-05T13:10:46Z")
Do we have a solution to monitor the performance of a SaaS application? I have tried using Heartbeat, but there is an annoying IAM (Identity and Access Management) system in the flow. Using Heartbeat I monitor the IAM i… --- ## [Elasticsearch shard rebalancing not working properly, should we delete a shard manually in ES?](https://discuss.elastic.co/t/elasticsearch-shard-rebalancing-not-working-properly-should-we-delete-a-shard-manually-in-es/206614)
**Author:** [@yash.tandon](https://discuss.elastic.co/u/yash.tandon)\ **Replies:** 0\ **Last updated:** [November 5, 2019, 1:00pm UTC](https://discuss.elastic.co/t/elasticsearch-shard-rebalancing-not-working-properly-should-we-delete-a-shard-manually-in-es/206614 "2019-11-05T13:00:31Z")
--- ## [With FSCrawler 2.7 I am not able to index pdf and other types of documents which worked fine with 2.6](https://discuss.elastic.co/t/with-fscrawler-2-7-i-am-not-able-to-index-pdf-and-other-types-of-documents-which-worked-fine-with-2-6/206246)
**Author:** [@rkmohapatra](https://discuss.elastic.co/u/rkmohapatra)\ **Replies:** 8\ **Last updated:** [November 5, 2019, 12:35pm UTC](https://discuss.elastic.co/t/with-fscrawler-2-7-i-am-not-able-to-index-pdf-and-other-types-of-documents-which-worked-fine-with-2-6/206246 "2019-11-05T12:35:44Z")
FSCrawler log says this. \[Elasticsearch exception \[type=mapper\_parsing\_exception, reason=failed to parse\]\]; nested: ElasticsearchException\[Elasticsearch exception \[type=illegal\_argument\_exception, reason=Malformed conte… --- ## [\_id is consuming a lot of the fielddata memory](https://discuss.elastic.co/t/id-is-consuming-a-lot-of-the-fielddata-memory/205933)
**Author:** [@aryon](https://discuss.elastic.co/u/aryon)\ **Replies:** 11\ **Last updated:** [November 5, 2019, 12:28pm UTC](https://discuss.elastic.co/t/id-is-consuming-a-lot-of-the-fielddata-memory/205933 "2019-11-05T12:28:05Z")
Hello, I have a 3 node cluster (16 vCPU, 64 GB of RAM, 3 Tb of data per node, JVM Heap at 30GB) with 450 indices (1 primary shard and 1 replica per indice). Following an upgrade from 6.7 to 6.8, the activation of TLS o… --- ## [Parent Aggregation Doc Count At Child Level](https://discuss.elastic.co/t/parent-aggregation-doc-count-at-child-level/206441)
**Author:** [@Justin\_Cross1](https://discuss.elastic.co/u/Justin_Cross1)\ **Replies:** 0\ **Last updated:** [November 4, 2019, 4:41pm UTC](https://discuss.elastic.co/t/parent-aggregation-doc-count-at-child-level/206441 "2019-11-04T16:41:50Z")
I am using parent-child mapping and have a query using has\_parent where I search on parent fields and it returns the children. Then in there I also have a filter on the child fields as well. That is working good. But n… --- ## [Can we use ELK under basic license for develope and sell our software and use ELK us monitoring module?](https://discuss.elastic.co/t/can-we-use-elk-under-basic-license-for-develope-and-sell-our-software-and-use-elk-us-monitoring-module/206595)
**Author:** [@111209](https://discuss.elastic.co/u/111209)\ **Replies:** 0\ **Last updated:** [November 5, 2019, 11:15am UTC](https://discuss.elastic.co/t/can-we-use-elk-under-basic-license-for-develope-and-sell-our-software-and-use-elk-us-monitoring-module/206595 "2019-11-05T11:15:38Z")
I\`m not lawyer so sorry if my question is some stupid. But can we use ELK under basic license for develope and sell our software and use ELK us monitoring module ? --- ## [\\ELK was unexpected at this time](https://discuss.elastic.co/t/elk-was-unexpected-at-this-time/206541)
**Author:** [@lohit18](https://discuss.elastic.co/u/lohit18)\ **Replies:** 6\ **Last updated:** [November 5, 2019, 10:37am UTC](https://discuss.elastic.co/t/elk-was-unexpected-at-this-time/206541 "2019-11-05T10:37:27Z")
I am Getting Error while running application as elasticsearch from command prompt Error : \\ELK was unexpected at this time. Java -verison java version "1.8.0\_201" Java(TM) SE Runtime Environment (build 1.8.0\_201-b09… --- ## [How to update hashmap data in ElasticSearch using API Update in Java](https://discuss.elastic.co/t/how-to-update-hashmap-data-in-elasticsearch-using-api-update-in-java/206533)
**Author:** [@Javeed\_Shaik](https://discuss.elastic.co/u/Javeed_Shaik)\ **Replies:** 0\ **Last updated:** [November 5, 2019, 7:13am UTC](https://discuss.elastic.co/t/how-to-update-hashmap-data-in-elasticsearch-using-api-update-in-java/206533 "2019-11-05T07:13:56Z")
I am trying to update data in Elastic Search Server using the following Code. The code is written on Java 1.8. and Elastic Search version 6.2.1 I have used the following to insert the data in elastic search. HashMap\ **Author:** [@manish97](https://discuss.elastic.co/u/manish97)\ **Replies:** 0\ **Last updated:** [November 5, 2019, 9:48am UTC](https://discuss.elastic.co/t/filebeat-is-sending-multiple-messages-to-elasticsearch/206578 "2019-11-05T09:48:58Z") I wrote a multiline pattern to read multiple lines of a log .Now when i start the filebeat I see the same line twice on my kibana dashboard. filebeat multiline pattern multiline.pattern: '^\[\[:space:\]\]Event:\[\[:space:\]\]… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1798) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1800)