# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=855 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 856 --- ## ["Could not index event" due to "field already exists"](https://discuss.elastic.co/t/could-not-index-event-due-to-field-already-exists/281229)
**Author:** [@looknleap](https://discuss.elastic.co/u/looknleap)\ **Replies:** 8\ **Last updated:** [August 13, 2021, 9:24pm UTC](https://discuss.elastic.co/t/could-not-index-event-due-to-field-already-exists/281229 "2021-08-13T21:24:22Z")
Data path: Windows Sysmon --\> Winlogbeat --\> Logstash --\> Elasticsearch Problem: Certain new events are unable to be indexed: "status"=\>400, "error"=\>{"type"=\>"illegal\_argument\_exception", "reason"=\>"field \[process.pe.… --- ## [Logstash filter for varying number of disks info in the logs](https://discuss.elastic.co/t/logstash-filter-for-varying-number-of-disks-info-in-the-logs/281400)
**Author:** [@Shreesh\_Narayanan](https://discuss.elastic.co/u/Shreesh_Narayanan)\ **Replies:** 6\ **Last updated:** [August 13, 2021, 9:16pm UTC](https://discuss.elastic.co/t/logstash-filter-for-varying-number-of-disks-info-in-the-logs/281400 "2021-08-13T21:16:38Z")
Hello, i have a couple of log lines which go like this , that have varying number of disks 1628868082.953|7ec93a454940| disk-usage: \[1\]=46% \[2\]=44% \[3\]=52% \[4\]=52% \[5\]=46% \[6\]=40% \[7\]=45% \[8\]=48% 1628868082.953|7ec93a… --- ## [Detection Rules don't alert](https://discuss.elastic.co/t/detection-rules-dont-alert/280736)
**Author:** [@omlette](https://discuss.elastic.co/u/omlette)\ **Replies:** 4\ **Last updated:** [August 13, 2021, 8:41pm UTC](https://discuss.elastic.co/t/detection-rules-dont-alert/280736 "2021-08-13T20:41:53Z")
I'm setting up detection rules, so I wanted to start small and verify that the workflows was functioning, so I've enabled the Whoami Process Activity. I've run the whoami command several times over the last several hours… --- ## [How to maintain processes in Strigo](https://discuss.elastic.co/t/how-to-maintain-processes-in-strigo/281170)
**Author:** [@goredb](https://discuss.elastic.co/u/goredb)\ **Replies:** 3\ **Last updated:** [August 13, 2021, 7:25pm UTC](https://discuss.elastic.co/t/how-to-maintain-processes-in-strigo/281170 "2021-08-13T19:25:31Z")
Hi, My experience with Strigo is that all processes are killed when Strigo is paused in any way (either automatically or manual pause). As a result all data ingest etc is stopped. This happens despite that they are sta… --- ## [Observability Engineer Lab 6.1: No Influencers or data displayed](https://discuss.elastic.co/t/observability-engineer-lab-6-1-no-influencers-or-data-displayed/279542)
**Author:** [@StashLogs](https://discuss.elastic.co/u/StashLogs)\ **Replies:** 9\ **Last updated:** [August 13, 2021, 7:19pm UTC](https://discuss.elastic.co/t/observability-engineer-lab-6-1-no-influencers-or-data-displayed/279542 "2021-08-13T19:19:55Z")
Hello, I am having some trouble following lab 6.1 for Observability Engineer course. Creating the Uptime heartbeat job or the 3 jobs for the apm-\* index results in nothing but blank screens. Screenshots below. Any… --- ## [Unexpected error with Beats input plugin](https://discuss.elastic.co/t/unexpected-error-with-beats-input-plugin/281255)
**Author:** [@panagiss](https://discuss.elastic.co/u/panagiss)\ **Replies:** 8\ **Last updated:** [August 13, 2021, 7:10pm UTC](https://discuss.elastic.co/t/unexpected-error-with-beats-input-plugin/281255 "2021-08-13T19:10:40Z")
Previously i used JSON data from a file (that were previously taken by beats) to test my logstash conf and filtering. I had no problems, but when i try to read straight from auditbeat with the Beats input plugin, Logstas… --- ## [Cloudwatch log group stream using logstash to ES](https://discuss.elastic.co/t/cloudwatch-log-group-stream-using-logstash-to-es/281378)
**Author:** [@connectgeeks](https://discuss.elastic.co/u/connectgeeks)\ **Replies:** 1\ **Last updated:** [August 13, 2021, 3:27pm UTC](https://discuss.elastic.co/t/cloudwatch-log-group-stream-using-logstash-to-es/281378 "2021-08-13T15:27:29Z")
Hi I'm using logstash-7.14.0-1.x86\_64 version and would like to stream cloudwatch loggroup to ES. When I'm trying to use plugin bin/logstash-plugin install logstash-input-cloudwatch it doesn't seems to work for log grou… --- ## [Почему не работает nested запрос с must\_not?](https://discuss.elastic.co/t/nested-must-not/281315)
**Author:** [@IvanTushin](https://discuss.elastic.co/u/IvanTushin)\ **Replies:** 1\ **Last updated:** [August 13, 2021, 3:12pm UTC](https://discuss.elastic.co/t/nested-must-not/281315 "2021-08-13T15:12:35Z")
Добрый день коллеги! У меня есть следующий запрос: { "query": { "bool": { "filter": \[ { "nested": { "path": "customer", … --- ## [Use logstash to synchronize json files to elactissearch without data](https://discuss.elastic.co/t/use-logstash-to-synchronize-json-files-to-elactissearch-without-data/281138)
**Author:** [@zhyp](https://discuss.elastic.co/u/zhyp)\ **Replies:** 3\ **Last updated:** [August 13, 2021, 2:53pm UTC](https://discuss.elastic.co/t/use-logstash-to-synchronize-json-files-to-elactissearch-without-data/281138 "2021-08-13T14:53:30Z")
There is no data, even when the file is changed, the console does not output changes. This is my conf file, test.conf input { file { path =\> "D:\\logstash\\test\\demo.log" codec =\> "json" } } output { elasticsearc… --- ## [Enroll and start the Elastic Agent - Windows](https://discuss.elastic.co/t/enroll-and-start-the-elastic-agent-windows/281275)
**Author:** [@alenraz05](https://discuss.elastic.co/u/alenraz05)\ **Replies:** 6\ **Last updated:** [August 13, 2021, 2:05pm UTC](https://discuss.elastic.co/t/enroll-and-start-the-elastic-agent-windows/281275 "2021-08-13T14:05:42Z")
Hi I can not find the elastic-agent.exe in the winlogbeat-7.14.0-windows-x86\_64 folder --- ## [Elasticsearch query and aggregation](https://discuss.elastic.co/t/elasticsearch-query-and-aggregation/281356)
**Author:** [@masakazu.ohtsuka](https://discuss.elastic.co/u/masakazu.ohtsuka)\ **Replies:** 0\ **Last updated:** [August 13, 2021, 12:55pm UTC](https://discuss.elastic.co/t/elasticsearch-query-and-aggregation/281356 "2021-08-13T12:55:01Z")
Elasticsearch responds with buckets that should be filtered out by the query. What's wrong? The request is: curl -kv --max-time 60 -H "Content-Type: application/json" "http://elasticsearch.example.com/jp-2021.0\*/\_searc… --- ## [Характеристики виртуальной машины для logstash](https://discuss.elastic.co/t/logstash/281348)
**Author:** [@111498](https://discuss.elastic.co/u/111498)\ **Replies:** 0\ **Last updated:** [August 13, 2021, 12:12pm UTC](https://discuss.elastic.co/t/logstash/281348 "2021-08-13T12:12:38Z")
Нужна виртуальная машина для logstash. Также будет использоваться плагин lumberjack. Сколько CPU, RAM, и диска надо для этого, если учитывать что: EPS=1000, Bandwidth usage=400kb/s PPS=15 ? --- ## [Logstash import file from url](https://discuss.elastic.co/t/logstash-import-file-from-url/281067)
**Author:** [@ChinigamiHunter](https://discuss.elastic.co/u/ChinigamiHunter)\ **Replies:** 8\ **Last updated:** [August 13, 2021, 12:10pm UTC](https://discuss.elastic.co/t/logstash-import-file-from-url/281067 "2021-08-13T12:10:22Z")
I am new to Elasticsearch and Logstash, i just need to parse json data from url. Json link is : https://www.circl.lu/doc/misp/feed-osint/0165e5d7-51e6-4c2e-a382-1dd1e706f7bb.json this is my logstash conf file: input {… --- ## [Current timestamp in Kibana Dev Tools](https://discuss.elastic.co/t/current-timestamp-in-kibana-dev-tools/281247)
**Author:** [@Luca\_Frost](https://discuss.elastic.co/u/Luca_Frost)\ **Replies:** 1\ **Last updated:** [August 13, 2021, 11:43am UTC](https://discuss.elastic.co/t/current-timestamp-in-kibana-dev-tools/281247 "2021-08-13T11:43:13Z")
Hi All, Apologies if this question has already been answered. Is it possible to create a new document using the Kibana Dev Console and set the timestamp field to now, much in the same way as datetime.now() in python. P… --- ## [Logstash 7.14.0 "invalid byte sequence in UTF-8" in logstash.javapipeline](https://discuss.elastic.co/t/logstash-7-14-0-invalid-byte-sequence-in-utf-8-in-logstash-javapipeline/280976)
**Author:** [@cknz](https://discuss.elastic.co/u/cknz)\ **Replies:** 4\ **Last updated:** [August 13, 2021, 10:56am UTC](https://discuss.elastic.co/t/logstash-7-14-0-invalid-byte-sequence-in-utf-8-in-logstash-javapipeline/280976 "2021-08-13T10:56:25Z")
Came into work today and noticed that our Logstash pipeline (on all two hosts) had halted with the following error in the logs. Aug 11 00:22:40 its-elk-p03.uod.otago.ac.nz logstash\[20536\]: \[2021-08-11T00:22:40,141\]\[ERRO… --- ## [Plugin error (tanium)](https://discuss.elastic.co/t/plugin-error-tanium/281300)
**Author:** [@travlest](https://discuss.elastic.co/u/travlest)\ **Replies:** 2\ **Last updated:** [August 13, 2021, 9:14am UTC](https://discuss.elastic.co/t/plugin-error-tanium/281300 "2021-08-13T09:14:51Z")
Hi, before this, I have a problem with connecting ELK stack to Tanium. But it has already been solving with an index pattern on kibana. the server that I've tried is a dummy server with little data. now, I am trying t… --- ## [Partial bulk insert into elasticsearch using rest API](https://discuss.elastic.co/t/partial-bulk-insert-into-elasticsearch-using-rest-api/281295)
**Author:** [@santosh\_varma](https://discuss.elastic.co/u/santosh_varma)\ **Replies:** 6\ **Last updated:** [August 13, 2021, 9:38am UTC](https://discuss.elastic.co/t/partial-bulk-insert-into-elasticsearch-using-rest-api/281295 "2021-08-13T09:38:32Z")
Hi All, I am trying to bulk insert data into elastic search batch wise(say 10 records at once). Out of these I am having one record which is invalid. The rest client is rolling back all the 10 records. I want to save th… --- ## [How to ingest complex JSON objects with tables in ES?](https://discuss.elastic.co/t/how-to-ingest-complex-json-objects-with-tables-in-es/281327)
**Author:** [@AbelAlejandro](https://discuss.elastic.co/u/AbelAlejandro)\ **Replies:** 0\ **Last updated:** [August 13, 2021, 9:24am UTC](https://discuss.elastic.co/t/how-to-ingest-complex-json-objects-with-tables-in-es/281327 "2021-08-13T09:24:13Z")
I'm trying to define a format for my logs and these must include lists of objects. When I upload my log file to ElasticSearch, it doesn't know how to parse the lists and I don't see how to configure this. Example NDJSON… --- ## [Question about failed authentication logging](https://discuss.elastic.co/t/question-about-failed-authentication-logging/281319)
**Author:** [@borna\_talebi](https://discuss.elastic.co/u/borna_talebi)\ **Replies:** 1\ **Last updated:** [August 13, 2021, 8:53am UTC](https://discuss.elastic.co/t/question-about-failed-authentication-logging/281319 "2021-08-13T08:53:53Z")
Hi I want to enable logging when a user failed to log in via Kibana web UI. But I'm sure where should I enable it. The documents were a bit confusing so I'm not sure should I make changes to elasticsearch.yml or kibana… --- ## [Logstash multiline codec ignores last line of log file](https://discuss.elastic.co/t/logstash-multiline-codec-ignores-last-line-of-log-file/281318)
**Author:** [@san2597](https://discuss.elastic.co/u/san2597)\ **Replies:** 0\ **Last updated:** [August 13, 2021, 8:19am UTC](https://discuss.elastic.co/t/logstash-multiline-codec-ignores-last-line-of-log-file/281318 "2021-08-13T08:19:51Z")
My logstash config has a mix of multiline and single line events that are being parsed correctly, reading a log file. I'm using multiline codec as follows: input { file { ..... ..... codec =\> multiline {… --- ## [Elastic search commands](https://discuss.elastic.co/t/elastic-search-commands/281139)
**Author:** [@chris.aw](https://discuss.elastic.co/u/chris.aw)\ **Replies:** 5\ **Last updated:** [August 13, 2021, 8:18am UTC](https://discuss.elastic.co/t/elastic-search-commands/281139 "2021-08-13T08:18:56Z")
Hi, is there a way to allow search commands like: "/help, /categories" etc etc? Thank you for the help in advance --- ## [Pushing Logs form Azure Storage to Elastic via Logstash](https://discuss.elastic.co/t/pushing-logs-form-azure-storage-to-elastic-via-logstash/281312)
**Author:** [@Kosodrom](https://discuss.elastic.co/u/Kosodrom)\ **Replies:** 0\ **Last updated:** [August 13, 2021, 7:55am UTC](https://discuss.elastic.co/t/pushing-logs-form-azure-storage-to-elastic-via-logstash/281312 "2021-08-13T07:55:51Z")
Hi there, currently I am evaluating the possibility to collect logs, which reside in azure blob storage to Logstash. I came across this plug-in here: azure-diagnostics-tools/Logstash/logstash-input-azureblob at master … --- ## [Объединение 3 анализаторов в 1](https://discuss.elastic.co/t/3-1/280764)
**Author:** [@ForeverRED66](https://discuss.elastic.co/u/ForeverRED66)\ **Replies:** 12\ **Last updated:** [August 13, 2021, 7:44am UTC](https://discuss.elastic.co/t/3-1/280764 "2021-08-13T07:44:55Z")
Добрый день, есть цель объединить 3 анализатора в 1 для будущих индексов, я с этим не сталкивался в процессе работы да и с эластиком в принципе то же редко, по идее у меня цель 3 анализатора. Может кто поможет с этим де… --- ## [Unpredictable work of terminate\_after](https://discuss.elastic.co/t/unpredictable-work-of-terminate-after/281306)
**Author:** [@romanenkoss](https://discuss.elastic.co/u/romanenkoss)\ **Replies:** 0\ **Last updated:** [August 13, 2021, 7:20am UTC](https://discuss.elastic.co/t/unpredictable-work-of-terminate-after/281306 "2021-08-13T07:20:28Z")
Hi team, I have an index with 4 billion docs, 200 shards, I want to use terminate\_after=500000 if I correctly understood request must terminate after 100kk docs, when the count of docs is more than 100kk it's working fi… --- ## [More than 1 shard not getting assigned to a node](https://discuss.elastic.co/t/more-than-1-shard-not-getting-assigned-to-a-node/279797)
**Author:** [@srivatsa](https://discuss.elastic.co/u/srivatsa)\ **Replies:** 2\ **Last updated:** [August 13, 2021, 7:11am UTC](https://discuss.elastic.co/t/more-than-1-shard-not-getting-assigned-to-a-node/279797 "2021-08-13T07:11:36Z")
ES version - 6.8 Setup - 3 nodes with default rack\_id I am trying to logically separate out clusters inside the single cluster by using the rack\_id awareness attribute, the problem I am facing is that only one shard is… --- ## [서브쿼리같은 elastice query 구문 만들기](https://discuss.elastic.co/t/elastice-query/281000)
**Author:** [@ruddms](https://discuss.elastic.co/u/ruddms)\ **Replies:** 2\ **Last updated:** [August 13, 2021, 6:44am UTC](https://discuss.elastic.co/t/elastice-query/281000 "2021-08-13T06:44:18Z")
안녕하세요 document id값으로 해당 document의 embedVector 필드 (type은 dense\_vector)의 값을 알아내고 알아낸 embedVector 필드 값으로 script\_score 사용해서 index에 존재하는 모든 document의 embedVector 필드와 cosineSimilarity를 계산하고 싶은데 이런 과정을 하나의 쿼리로 작성할 수 있을까요? 코드… --- ## [Update documents and field mapping](https://discuss.elastic.co/t/update-documents-and-field-mapping/280277)
**Author:** [@Dheeraj\_Gupta](https://discuss.elastic.co/u/Dheeraj_Gupta)\ **Replies:** 3\ **Last updated:** [August 3, 2021, 10:11am UTC](https://discuss.elastic.co/t/update-documents-and-field-mapping/280277 "2021-08-03T10:11:26Z")
I am using elasticsearch for some batch processing. The general gist of steps involved are: 1 Fetche each document from index A 2 Search index B by filtering data using attributes of document returned in step 1. 3. P… --- ## [Elasticsearch engineer certification - new topics](https://discuss.elastic.co/t/elasticsearch-engineer-certification-new-topics/281276)
**Author:** [@jerrymj](https://discuss.elastic.co/u/jerrymj)\ **Replies:** 1\ **Last updated:** [August 13, 2021, 5:33am UTC](https://discuss.elastic.co/t/elasticsearch-engineer-certification-new-topics/281276 "2021-08-13T05:33:55Z")
How can I find / learn topics that are marked in asterisk ( \* ) ? I am looking for free options to learn these topics. --- ## [Мониторинг очереди Postfix](https://discuss.elastic.co/t/postfix/281280)
**Author:** [@KaPBaJIOJI](https://discuss.elastic.co/u/KaPBaJIOJI)\ **Replies:** 0\ **Last updated:** [August 13, 2021, 3:35am UTC](https://discuss.elastic.co/t/postfix/281280 "2021-08-13T03:35:38Z")
Хочу мониторить очередь писем, для этого пишу в файл следующую инфу "data", "hostname", "count" Wed Aug 11 11:18:44 smtp01 72 Wed Aug 11 11:43:45 smtp01 71 Wed Aug 11 13:49:38 smtp01 72 Wed Aug 11 13:51:09 smtp01 7… --- ## [Using rsyslog server & reporting agent name](https://discuss.elastic.co/t/using-rsyslog-server-reporting-agent-name/281270)
**Author:** [@droidus](https://discuss.elastic.co/u/droidus)\ **Replies:** 1\ **Last updated:** [August 12, 2021, 10:34pm UTC](https://discuss.elastic.co/t/using-rsyslog-server-reporting-agent-name/281270 "2021-08-12T22:34:44Z")
I am using a rsyslog server. I have several of my machines forwardring their logs there, then elastic picks them up. I am going through one of the records, and notice that the hostname is rsyslog, but then when I look … [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=854) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=856)