# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=846 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 847 --- ## [Syslog data from external device into ELK Stack](https://discuss.elastic.co/t/syslog-data-from-external-device-into-elk-stack/282287)
**Author:** [@pooch](https://discuss.elastic.co/u/pooch)\ **Replies:** 3\ **Last updated:** [August 24, 2021, 10:03pm UTC](https://discuss.elastic.co/t/syslog-data-from-external-device-into-elk-stack/282287 "2021-08-24T22:03:49Z")
I have ELK collecting logs from all of my pods within my Kubernetes cluster. I would also like to collect logs from an external PA firewall (syslog) and have them processed into Elasticsearch. I am a bit confused on how … --- ## [How to do parallel filter search of 1M queries in minimal time?](https://discuss.elastic.co/t/how-to-do-parallel-filter-search-of-1m-queries-in-minimal-time/282023)
**Author:** [@elastic\_yogi](https://discuss.elastic.co/u/elastic_yogi)\ **Replies:** 5\ **Last updated:** [August 24, 2021, 8:43pm UTC](https://discuss.elastic.co/t/how-to-do-parallel-filter-search-of-1m-queries-in-minimal-time/282023 "2021-08-24T20:43:25Z")
Hi, I would like to search 1M filter queries in parallel in order to reduce the search time. This means a boolean query with 1M filter values, an no ordering is necessary. My index size is about 1GB, and I've stored ever… --- ## [Detection and Response for ProxyShell Activity](https://discuss.elastic.co/t/detection-and-response-for-proxyshell-activity/282407)
**Author:** [@variable](https://discuss.elastic.co/u/variable)\ **Replies:** 0\ **Last updated:** [August 24, 2021, 7:58pm UTC](https://discuss.elastic.co/t/detection-and-response-for-proxyshell-activity/282407 "2021-08-24T19:58:56Z")
Detection and Response for ProxyShell Activity Executive Summary On August 21, 2021, the Cybersecurity and Infrastructure Security Agency (CISA) released an urgent notice related to the exploitation of ProxyShell vulnera… --- ## [Can't setup Nginx reverse proxy for Kibana in Localhost](https://discuss.elastic.co/t/cant-setup-nginx-reverse-proxy-for-kibana-in-localhost/282176)
**Author:** [@Amine\_Chichi](https://discuss.elastic.co/u/Amine_Chichi)\ **Replies:** 3\ **Last updated:** [August 24, 2021, 6:57pm UTC](https://discuss.elastic.co/t/cant-setup-nginx-reverse-proxy-for-kibana-in-localhost/282176 "2021-08-24T18:57:59Z")
I want to set up a reverse proxy to access kibana using a username and a password, so I followed this tutorial. When I use the URL http://elastic.local to access kibana the timeout occurs and nothing happen. But when I … --- ## [Best practices for logstash output configuration and Elasticsearch](https://discuss.elastic.co/t/best-practices-for-logstash-output-configuration-and-elasticsearch/281642)
**Author:** [@Vinay\_Kumar2](https://discuss.elastic.co/u/Vinay_Kumar2)\ **Replies:** 1\ **Last updated:** [August 24, 2021, 6:42pm UTC](https://discuss.elastic.co/t/best-practices-for-logstash-output-configuration-and-elasticsearch/281642 "2021-08-24T18:42:31Z")
Hello, My question is related to the correct way to configure the output, for Elasticsearch. Right now my Elasticsearch cluster is one dedicated master node, 3 data nodes and acts as master eligible nodes and 1 coordi… --- ## [Formatting data as a block in logstash](https://discuss.elastic.co/t/formatting-data-as-a-block-in-logstash/282027)
**Author:** [@selin](https://discuss.elastic.co/u/selin)\ **Replies:** 1\ **Last updated:** [August 24, 2021, 6:36pm UTC](https://discuss.elastic.co/t/formatting-data-as-a-block-in-logstash/282027 "2021-08-24T18:36:52Z")
Below is my sample data. How can it be filter based on start time and end time using grok pattern. Any idea friends since the data came as a stream of blocks. Can you guys suggest and provid example. I need to know start… --- ## [Grok filter](https://discuss.elastic.co/t/grok-filter/282374)
**Author:** [@lexanic](https://discuss.elastic.co/u/lexanic)\ **Replies:** 1\ **Last updated:** [August 24, 2021, 6:16pm UTC](https://discuss.elastic.co/t/grok-filter/282374 "2021-08-24T18:16:02Z")
Не работает grok filter grok { match =\> { "message" =\> \[ "%{POSTFIX\_MSG\_ID:taskid}: client=(?\\[^\]\]+)\[%{IP:client\_ip}\]", "%{POSTFIX\_MSG\_ID:taskid}: message-id=\<(?\\[^\>\]+)\>.", "%{POSTFIX\_MSG… --- ## [\[Logstash\] \ on json with \[null\]](https://discuss.elastic.co/t/logstash-java-31-nil-on-json-with-null/282382)
**Author:** [@zenkovac](https://discuss.elastic.co/u/zenkovac)\ **Replies:** 2\ **Last updated:** [August 24, 2021, 6:14pm UTC](https://discuss.elastic.co/t/logstash-java-31-nil-on-json-with-null/282382 "2021-08-24T18:14:51Z")
hi, i'm experiencing an error when processing a json log which has a \[null\] value on a field. ■The log is the following (tested as valid json): {"message":{"errorMessage":"INTERNAL\_SERVER\_ERROR","errorDetail":{"message… --- ## [Creating a Utilization% Gauge](https://discuss.elastic.co/t/creating-a-utilization-gauge/282392)
**Author:** [@mericaforrestgumpsun](https://discuss.elastic.co/u/mericaforrestgumpsun)\ **Replies:** 0\ **Last updated:** [August 24, 2021, 5:11pm UTC](https://discuss.elastic.co/t/creating-a-utilization-gauge/282392 "2021-08-24T17:11:34Z")
Hey Everyone, I am struggling to make a Utilization% Gauge, that will take in an amount of second and tell me what percentage of a 24 Hours that took. I would like the gauge to also work if I changed the timescale any a… --- ## [S3 No files found in bucket](https://discuss.elastic.co/t/s3-no-files-found-in-bucket/282332)
**Author:** [@whassanwj](https://discuss.elastic.co/u/whassanwj)\ **Replies:** 4\ **Last updated:** [August 24, 2021, 3:33pm UTC](https://discuss.elastic.co/t/s3-no-files-found-in-bucket/282332 "2021-08-24T15:33:01Z")
Hi, I'm struggling with logstash conf to read from S3 bucket which has the latest date, example structure in S3 bucket as follows: apachelogs/web/2021-08-22/ apachelogs/web/2021-08-23/ apachelogs/web/2021-08-24/ Henc… --- ## [Unique Count in Kibana Metric Graph](https://discuss.elastic.co/t/unique-count-in-kibana-metric-graph/282164)
**Author:** [@RAM\_NATHAN](https://discuss.elastic.co/u/RAM_NATHAN)\ **Replies:** 1\ **Last updated:** [August 24, 2021, 3:18pm UTC](https://discuss.elastic.co/t/unique-count-in-kibana-metric-graph/282164 "2021-08-24T15:18:44Z")
Hi Im using metric graph . Its showing Unique users count as a Text. But I wanted to know who are those unique users. Is it possible in this graph or any other graph? Regards Ram --- ## [Trying to be ECS compliance in order to have visual analysis. It's hard! Help needed](https://discuss.elastic.co/t/trying-to-be-ecs-compliance-in-order-to-have-visual-analysis-its-hard-help-needed/282370)
**Author:** [@syunusic](https://discuss.elastic.co/u/syunusic)\ **Replies:** 0\ **Last updated:** [August 24, 2021, 3:04pm UTC](https://discuss.elastic.co/t/trying-to-be-ecs-compliance-in-order-to-have-visual-analysis-its-hard-help-needed/282370 "2021-08-24T15:04:13Z")
I’m renaming Fortigate’s field names from how Fortinet called them to a ECS compatible one. There is the integration section and there is also the exported field section. Which one do I have to follow? Three examples to … --- ## [Failed to execute progress listener on query failure](https://discuss.elastic.co/t/failed-to-execute-progress-listener-on-query-failure/281852)
**Author:** [@riahc3](https://discuss.elastic.co/u/riahc3)\ **Replies:** 15\ **Last updated:** [August 24, 2021, 2:31pm UTC](https://discuss.elastic.co/t/failed-to-execute-progress-listener-on-query-failure/281852 "2021-08-24T14:31:16Z")
Although my Elasticsearch SEEMS to be working correctly, Im getting this error in the logs Failed to execute progress listener on query failure Basically I go to Discover, pick any index and this gets logged. I try to … --- ## [Can I put the label value outside the vertical bar?](https://discuss.elastic.co/t/can-i-put-the-label-value-outside-the-vertical-bar/282077)
**Author:** [@El\_busc](https://discuss.elastic.co/u/El_busc)\ **Replies:** 5\ **Last updated:** [August 24, 2021, 1:52pm UTC](https://discuss.elastic.co/t/can-i-put-the-label-value-outside-the-vertical-bar/282077 "2021-08-24T13:52:16Z")
Hello in previous versions of kibana it was possible to choose where the bar label would be, but in the current version I'm not able to do that, is there any way to put the label value above the bar and would it be possi… --- ## [Logstash KV filter - Wrong parsing](https://discuss.elastic.co/t/logstash-kv-filter-wrong-parsing/282333)
**Author:** [@vasek](https://discuss.elastic.co/u/vasek)\ **Replies:** 4\ **Last updated:** [August 24, 2021, 12:37pm UTC](https://discuss.elastic.co/t/logstash-kv-filter-wrong-parsing/282333 "2021-08-24T12:37:26Z")
Hello, I'm using KV filter in Logstash. Logstash configuration: filter { #PARSING LOG #------------------------------------------ grok { patterns\_dir =\> \["/etc/logstash/grok-patterns"\] break\_on\_mat… --- ## [Elasticsearch response order consistency issues](https://discuss.elastic.co/t/elasticsearch-response-order-consistency-issues/281767)
**Author:** [@govind\_kr](https://discuss.elastic.co/u/govind_kr)\ **Replies:** 15\ **Last updated:** [August 24, 2021, 9:36am UTC](https://discuss.elastic.co/t/elasticsearch-response-order-consistency-issues/281767 "2021-08-24T09:36:55Z")
I have been facing issues related to es response order which is getting reshuffled even though I am not querying on the fields (I have made them non-indexed so as to ignore them in scoring) and performing dfs\_query\_then\_… --- ## [Too many scroll contexts with \_update\_by\_query and/or \_delete\_by\_query](https://discuss.elastic.co/t/too-many-scroll-contexts-with-update-by-query-and-or-delete-by-query/282325)
**Author:** [@tomkirk](https://discuss.elastic.co/u/tomkirk)\ **Replies:** 0\ **Last updated:** [August 24, 2021, 9:34am UTC](https://discuss.elastic.co/t/too-many-scroll-contexts-with-update-by-query-and-or-delete-by-query/282325 "2021-08-24T09:34:24Z")
Hello, I've had an issue recently in my Elasticsearch cluster of getting this error: Trying to create too many scroll contexts. Must be less than or equal to: \[500\] None of our \_search queries use that feature, but I … --- ## [Change log4j2.properties logging location?](https://discuss.elastic.co/t/change-log4j2-properties-logging-location/282319)
**Author:** [@riahc3](https://discuss.elastic.co/u/riahc3)\ **Replies:** 0\ **Last updated:** [August 24, 2021, 8:53am UTC](https://discuss.elastic.co/t/change-log4j2-properties-logging-location/282319 "2021-08-24T08:53:35Z")
Hello This really doesnt fit anywhere I think I want to configure log4j2.properties for both elastic and Logstash to write logs in a daily format (2021.08.24-log-name) and to another location. I know log4j2 uses varia… --- ## [How to check what compression codec some of document use](https://discuss.elastic.co/t/how-to-check-what-compression-codec-some-of-document-use/282302)
**Author:** [@solarcore](https://discuss.elastic.co/u/solarcore)\ **Replies:** 3\ **Last updated:** [August 24, 2021, 8:59am UTC](https://discuss.elastic.co/t/how-to-check-what-compression-codec-some-of-document-use/282302 "2021-08-24T08:59:49Z")
If i have some index, and i had default value of the codec in settings, then i change this setting to best\_compression, so my question is: How to check one document in an index, to know what codec this document use, defa… --- ## [Synchronize index with sql table](https://discuss.elastic.co/t/synchronize-index-with-sql-table/282239)
**Author:** [@franckfct](https://discuss.elastic.co/u/franckfct)\ **Replies:** 1\ **Last updated:** [August 24, 2021, 5:17am UTC](https://discuss.elastic.co/t/synchronize-index-with-sql-table/282239 "2021-08-24T05:17:02Z")
Hello, I have a table on a database (SAP HANA), I can request it with sql without any problems. This table can be modified at any time by drop/update or insert. Is there a way to keep the index up to date natively, wit… --- ## [Why the number of closed index affects write performance?](https://discuss.elastic.co/t/why-the-number-of-closed-index-affects-write-performance/282219)
**Author:** [@wulixuan](https://discuss.elastic.co/u/wulixuan)\ **Replies:** 10\ **Last updated:** [August 24, 2021, 4:21am UTC](https://discuss.elastic.co/t/why-the-number-of-closed-index-affects-write-performance/282219 "2021-08-24T04:21:48Z")
Hello: I am now testing the write performance of ES(v7.13.4), the number of shards written is constant, I added many empty indexes(shard number is 3). Then I find that the write performance is degraded even if the index… --- ## [Does Elastic Search support Mobile Number variation (ex: US Format that has special character)](https://discuss.elastic.co/t/does-elastic-search-support-mobile-number-variation-ex-us-format-that-has-special-character/282245)
**Author:** [@Pathak18](https://discuss.elastic.co/u/Pathak18)\ **Replies:** 2\ **Last updated:** [August 24, 2021, 3:43am UTC](https://discuss.elastic.co/t/does-elastic-search-support-mobile-number-variation-ex-us-format-that-has-special-character/282245 "2021-08-24T03:43:39Z")
Hi, US mobile phone number data can be saved in multiple formats like (XXX) XXX-XXXX OR +1 (XXX) XXX-XXXX OR XXX-XXX-XXXX OR +1 XXX-XXX-XXXX OR XXXXXXXXXX. How to ensure which DataType(OOB) would be ideal to be used o… --- ## [Kibana cluster with nginx not working](https://discuss.elastic.co/t/kibana-cluster-with-nginx-not-working/282232)
**Author:** [@selin](https://discuss.elastic.co/u/selin)\ **Replies:** 2\ **Last updated:** [August 24, 2021, 1:20am UTC](https://discuss.elastic.co/t/kibana-cluster-with-nginx-not-working/282232 "2021-08-24T01:20:45Z")
Hi bro and sis, I would need to set kibana cluster. Is there any idea how can it be done. A single kibana no issue. But cluster after login i hitting 401 error. I not sure why exactly. I point both kibana to same yaml f… --- ## [Logstash http\_poller body escape double and single quotation marks](https://discuss.elastic.co/t/logstash-http-poller-body-escape-double-and-single-quotation-marks/282039)
**Author:** [@zhyp](https://discuss.elastic.co/u/zhyp)\ **Replies:** 2\ **Last updated:** [August 24, 2021, 1:38am UTC](https://discuss.elastic.co/t/logstash-http-poller-body-escape-double-and-single-quotation-marks/282039 "2021-08-24T01:38:21Z")
Hi I used logstash http\_ poller calls the SQL API of elasticsearch. There are double quotation marks and single quotation marks in the body. Here is the body I tested. body =\> '{"query": "SELECT \* FROM test WHERE name… --- ## [How do I create a boolean "OR" filter?](https://discuss.elastic.co/t/how-do-i-create-a-boolean-or-filter/282281)
**Author:** [@elastic\_yogi](https://discuss.elastic.co/u/elastic_yogi)\ **Replies:** 6\ **Last updated:** [August 24, 2021, 1:16am UTC](https://discuss.elastic.co/t/how-do-i-create-a-boolean-or-filter/282281 "2021-08-24T01:16:40Z")
I'd like to filter for EITHER (OR) of two values, but a filter appears to require (AND) a document to contain EACH value. I'm using a bool query currently, and should appears to be the only way to do an OR expression. Ho… --- ## [Kibana selective loading of visualizations](https://discuss.elastic.co/t/kibana-selective-loading-of-visualizations/282208)
**Author:** [@katja1](https://discuss.elastic.co/u/katja1)\ **Replies:** 1\ **Last updated:** [August 23, 2021, 10:57pm UTC](https://discuss.elastic.co/t/kibana-selective-loading-of-visualizations/282208 "2021-08-23T22:57:00Z")
Hi, Is selective loading of visualizations possible in Kibana - meaning for example, if I select a filter and there are some visualizations on dashboard that do not have any data after filtering, then this visualization… --- ## [ESSingleNodeTestCase - Java 11 - Does not start Elastic](https://discuss.elastic.co/t/essinglenodetestcase-java-11-does-not-start-elastic/282279)
**Author:** [@Liyaqat\_M](https://discuss.elastic.co/u/Liyaqat_M)\ **Replies:** 0\ **Last updated:** [August 23, 2021, 10:09pm UTC](https://discuss.elastic.co/t/essinglenodetestcase-java-11-does-not-start-elastic/282279 "2021-08-23T22:09:53Z")
Hi, I am trying to test the messages that I would post to our Elastic Search server and decided to use: ESSingleNodeTestCase. After sorting out the dependencies I was able to compile and start the test. As far as I un… --- ## [Kibana: Get delta t in a visualization](https://discuss.elastic.co/t/kibana-get-delta-t-in-a-visualization/282277)
**Author:** [@Saliinger](https://discuss.elastic.co/u/Saliinger)\ **Replies:** 0\ **Last updated:** [August 23, 2021, 10:02pm UTC](https://discuss.elastic.co/t/kibana-get-delta-t-in-a-visualization/282277 "2021-08-23T22:02:33Z")
Hello. I have this visualization using TSVB Is possible to get the time when metrics are equal to 0 and put it in a TSVB table? I mean: Get the time when metric turns to 0 for X time and show in a TSVB table how ma… --- ## [Curl command to logstash](https://discuss.elastic.co/t/curl-command-to-logstash/282266)
**Author:** [@bamsom](https://discuss.elastic.co/u/bamsom)\ **Replies:** 1\ **Last updated:** [August 23, 2021, 9:35pm UTC](https://discuss.elastic.co/t/curl-command-to-logstash/282266 "2021-08-23T21:35:38Z")
I am running a curl command which gives me a numeric output. I have the input setup as exec \> command \> curl. I am outputting that data into Elastic search. I see the message as the numeric output. When I try to visualiz… --- ## [S3 Output Plugin: Correct Way to manage codec](https://discuss.elastic.co/t/s3-output-plugin-correct-way-to-manage-codec/282103)
**Author:** [@Hammond95](https://discuss.elastic.co/u/Hammond95)\ **Replies:** 1\ **Last updated:** [August 23, 2021, 5:21pm UTC](https://discuss.elastic.co/t/s3-output-plugin-correct-way-to-manage-codec/282103 "2021-08-23T17:21:01Z")
Hi everyone, I have the following problem: We have in place a pipeline which consist of: \[PrestoDB Clusters\] ==auditing==\> \[Kafka\] \<== \[Logstash\] ==\> Elastic + S3 The auditing messages on kafka are basically json mes… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=845) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=847)