# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=866 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 867 --- ## [Tanium Configuring Elasticsearch destinations](https://discuss.elastic.co/t/tanium-configuring-elasticsearch-destinations/280291)
**Author:** [@travlest](https://discuss.elastic.co/u/travlest)\ **Replies:** 1\ **Last updated:** [August 3, 2021, 10:45pm UTC](https://discuss.elastic.co/t/tanium-configuring-elasticsearch-destinations/280291 "2021-08-03T22:45:02Z")
Hi, I am new to ELK. I have deployed an ELK stack with Filebeat. Right now I would like to connect my ELK to Tanium using this documentation tanium. But I am encountering this error. I tried to find the solutions onl… --- ## [Http input plugin, url with param from field](https://discuss.elastic.co/t/http-input-plugin-url-with-param-from-field/280365)
**Author:** [@cibernicola](https://discuss.elastic.co/u/cibernicola)\ **Replies:** 6\ **Last updated:** [August 3, 2021, 10:32pm UTC](https://discuss.elastic.co/t/http-input-plugin-url-with-param-from-field/280365 "2021-08-03T22:32:25Z")
I have a standard logstash config, where I store several fields form a log. With one field I need to "ask something" to an external API with an specific url pattern, which is: staticString+variableField+staticString S… --- ## [Resolve one of the index in cluster is with Yellow status](https://discuss.elastic.co/t/resolve-one-of-the-index-in-cluster-is-with-yellow-status/280274)
**Author:** [@SabirPiludiya](https://discuss.elastic.co/u/SabirPiludiya)\ **Replies:** 3\ **Last updated:** [August 3, 2021, 9:24pm UTC](https://discuss.elastic.co/t/resolve-one-of-the-index-in-cluster-is-with-yellow-status/280274 "2021-08-03T21:24:15Z")
We are running HA Elasticsearch in k8s. Recently we found one of the indexes in the Yellow status due to Unassigned shards which leads the whole cluster state to yellow. Shard of that index status in NODE-A is STARTED a… --- ## [Put the x bar at the top](https://discuss.elastic.co/t/put-the-x-bar-at-the-top/279700)
**Author:** [@Lisouu\_13](https://discuss.elastic.co/u/Lisouu_13)\ **Replies:** 5\ **Last updated:** [August 3, 2021, 9:06pm UTC](https://discuss.elastic.co/t/put-the-x-bar-at-the-top/279700 "2021-08-03T21:06:20Z")
Hello hello, is it possible to do something like that in kibana 7.13, and if so, how to do please ? --- ## [Multiple Sql Server DB mapping with Elasticsearch Index for data transfer using Logstash](https://discuss.elastic.co/t/multiple-sql-server-db-mapping-with-elasticsearch-index-for-data-transfer-using-logstash/280364)
**Author:** [@vikashmarwal](https://discuss.elastic.co/u/vikashmarwal)\ **Replies:** 0\ **Last updated:** [August 3, 2021, 7:52pm UTC](https://discuss.elastic.co/t/multiple-sql-server-db-mapping-with-elasticsearch-index-for-data-transfer-using-logstash/280364 "2021-08-03T19:52:30Z")
We are having multiple databases in SQL Server, those are created dynamically for specific workspace. In these databases we have a DocumentDetail table. If there is one DB then I am able to map it in config to transfer t… --- ## [Logstash write to json no comma separator](https://discuss.elastic.co/t/logstash-write-to-json-no-comma-separator/280302)
**Author:** [@Hamza\_El\_Aouane](https://discuss.elastic.co/u/Hamza_El_Aouane)\ **Replies:** 3\ **Last updated:** [August 3, 2021, 7:18pm UTC](https://discuss.elastic.co/t/logstash-write-to-json-no-comma-separator/280302 "2021-08-03T19:18:57Z")
Hello everyone. I am saving my logstash events to a json file as follow: file { path =\> "path\\event-%{+yyyy.MM.dd}.json" codec =\> json everything is fine, until today that I realised that the file is not form… --- ## [Fetching listing failed](https://discuss.elastic.co/t/fetching-listing-failed/280283)
**Author:** [@Prasanth\_V](https://discuss.elastic.co/u/Prasanth_V)\ **Replies:** 2\ **Last updated:** [August 3, 2021, 7:08pm UTC](https://discuss.elastic.co/t/fetching-listing-failed/280283 "2021-08-03T19:08:52Z")
Could you pls suggest on below error?.. --- ## [Unable to see file system metrics in kibana even the data present](https://discuss.elastic.co/t/unable-to-see-file-system-metrics-in-kibana-even-the-data-present/280253)
**Author:** [@shan1](https://discuss.elastic.co/u/shan1)\ **Replies:** 1\ **Last updated:** [August 3, 2021, 7:06pm UTC](https://discuss.elastic.co/t/unable-to-see-file-system-metrics-in-kibana-even-the-data-present/280253 "2021-08-03T19:06:24Z")
There is file system data present in indexes but not showing up in dashboard when we query. Except filesystem metrics it's fetching all metrics like cpu, memory and IOps. Please provide some suggestion --- ## [Elastic Cloud Trial Unable to remove greyed out Agent](https://discuss.elastic.co/t/elastic-cloud-trial-unable-to-remove-greyed-out-agent/279666)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 4\ **Last updated:** [August 3, 2021, 7:04pm UTC](https://discuss.elastic.co/t/elastic-cloud-trial-unable-to-remove-greyed-out-agent/279666 "2021-08-03T19:04:13Z")
Hello, Playing around with Elastic Cloud trial and noticed I have an Agent in Fleet which I cannot remove: The offline agent seems to remain unselectable and offline. How can I remove it? Grtz Willem --- ## [How can I avoid alerts for an instance of a rule in advance?](https://discuss.elastic.co/t/how-can-i-avoid-alerts-for-an-instance-of-a-rule-in-advance/280231)
**Author:** [@norgro2601](https://discuss.elastic.co/u/norgro2601)\ **Replies:** 1\ **Last updated:** [August 3, 2021, 7:02pm UTC](https://discuss.elastic.co/t/how-can-i-avoid-alerts-for-an-instance-of-a-rule-in-advance/280231 "2021-08-03T19:02:57Z")
Hi, I have rules that run and create an alert for several hosts. When there is a planned maintenance window, I cannot mute the rule for one alert/instance, because the alert instance for that host is only visible when t… --- ## [Extend Wazuh OVA storage](https://discuss.elastic.co/t/extend-wazuh-ova-storage/280085)
**Author:** [@Barry\_Dupont](https://discuss.elastic.co/u/Barry_Dupont)\ **Replies:** 1\ **Last updated:** [August 3, 2021, 6:42pm UTC](https://discuss.elastic.co/t/extend-wazuh-ova-storage/280085 "2021-08-03T18:42:26Z")
I was wondering what is the proper way to extend VM storage(40Gb): I already have a root partition under "/". can i extend this partition or should i add a new partition and mount than just change log file path in elast… --- ## [Index templates](https://discuss.elastic.co/t/index-templates/279952)
**Author:** [@ailengcon](https://discuss.elastic.co/u/ailengcon)\ **Replies:** 1\ **Last updated:** [August 3, 2021, 6:35pm UTC](https://discuss.elastic.co/t/index-templates/279952 "2021-08-03T18:35:25Z")
When I ingest my index from MongoDb via monstache, the indexing is causing some of the documents not being indexed because it can't map the fields right. I have being trying (for days) to figure out the index template o… --- ## [Metadata to be displayed on graph and show all x-axis values](https://discuss.elastic.co/t/metadata-to-be-displayed-on-graph-and-show-all-x-axis-values/279750)
**Author:** [@parinitha.nagaraja](https://discuss.elastic.co/u/parinitha.nagaraja)\ **Replies:** 1\ **Last updated:** [August 3, 2021, 6:24pm UTC](https://discuss.elastic.co/t/metadata-to-be-displayed-on-graph-and-show-all-x-axis-values/279750 "2021-08-03T18:24:32Z")
Hello, How do I add metadata so that it can be seen to the user just by looking at the chart. For example, I want to be able to show version number associated with each build number. (see graph) Also, how can I adj… --- ## [Logstash: добавить новое поле "response\_delay" к логу со значением, где значение - это разница времени ответа и запроса из сообщения лога](https://discuss.elastic.co/t/logstash-response-delay/280336)
**Author:** [@cva](https://discuss.elastic.co/u/cva)\ **Replies:** 2\ **Last updated:** [August 3, 2021, 6:04pm UTC](https://discuss.elastic.co/t/logstash-response-delay/280336 "2021-08-03T18:04:09Z")
Логи собираются при помощи filebeat multiline, далее отправляются в logstash. Как мне "распарсить" сообщение лога, чтобы получить дату запроса (2021-08-03 10:54:36.4512|INFO|logfile|Запрос:slight\_smile: и ответа (2021-08… --- ## [Possible to have elastic security read existing data/index?](https://discuss.elastic.co/t/possible-to-have-elastic-security-read-existing-data-index/280018)
**Author:** [@rconroy](https://discuss.elastic.co/u/rconroy)\ **Replies:** 7\ **Last updated:** [August 3, 2021, 5:39pm UTC](https://discuss.elastic.co/t/possible-to-have-elastic-security-read-existing-data-index/280018 "2021-08-03T17:39:29Z")
I have what is possibly an odd question but I'm new with elastic security/siem and thought I would ask. Is it possible to have the elastic security read a different data stream or ingestion other than the agents? For e… --- ## [\_grokparsefailure is occurring even after the grok pattern is success](https://discuss.elastic.co/t/grokparsefailure-is-occurring-even-after-the-grok-pattern-is-success/280352)
**Author:** [@vaseemQA](https://discuss.elastic.co/u/vaseemQA)\ **Replies:** 0\ **Last updated:** [August 3, 2021, 4:51pm UTC](https://discuss.elastic.co/t/grokparsefailure-is-occurring-even-after-the-grok-pattern-is-success/280352 "2021-08-03T16:51:02Z")
Hi Team, I'm using logstash 6.8.3, and I'm trying to parse ES slow logs and my sample field is a ES source\_query which looks like {"from":0,"size":0,"post\_filter":{"bool":{"must":\[{"term":{"someId":{"value":1234,"boost… --- ## [Aggregate destination ip addresses and destination ports](https://discuss.elastic.co/t/aggregate-destination-ip-addresses-and-destination-ports/280342)
**Author:** [@Marco\_Lazzarotto](https://discuss.elastic.co/u/Marco_Lazzarotto)\ **Replies:** 0\ **Last updated:** [August 3, 2021, 3:38pm UTC](https://discuss.elastic.co/t/aggregate-destination-ip-addresses-and-destination-ports/280342 "2021-08-03T15:38:23Z")
I'm collecting hundreds of thousands of logs from a firewall (Cisco ASA). On every log record, among other details, I have destination ip addresses and destination ports. Now, I need to have an aggregated list of all d… --- ## [Kibana alerts are not saved after modify them](https://discuss.elastic.co/t/kibana-alerts-are-not-saved-after-modify-them/278296)
**Author:** [@Felipe\_Illanes](https://discuss.elastic.co/u/Felipe_Illanes)\ **Replies:** 3\ **Last updated:** [August 3, 2021, 3:09pm UTC](https://discuss.elastic.co/t/kibana-alerts-are-not-saved-after-modify-them/278296 "2021-08-03T15:09:19Z")
Hi there, first of all thank you for the help. Second, i have an issue when i try to save a new query in the section of Alerts and Actions in KIbana. I'll explain with images... After i updated the query, and add and… --- ## [Remove labels (or ownership) from secret](https://discuss.elastic.co/t/remove-labels-or-ownership-from-secret/280293)
**Author:** [@pkaramol](https://discuss.elastic.co/u/pkaramol)\ **Replies:** 6\ **Last updated:** [August 3, 2021, 2:58pm UTC](https://discuss.elastic.co/t/remove-labels-or-ownership-from-secret/280293 "2021-08-03T14:58:34Z")
I want to edit / remove those labels from the elastic user secret eck.k8s.elastic.co/credentials: "true" eck.k8s.elastic.co/owner-kind: Elasticsearch eck.k8s.elastic.co/owner-name: myClusterName eck.k8s.… --- ## [Possible collision with user-defined field 'parameter' and built-in fields](https://discuss.elastic.co/t/possible-collision-with-user-defined-field-parameter-and-built-in-fields/280330)
**Author:** [@macs](https://discuss.elastic.co/u/macs)\ **Replies:** 0\ **Last updated:** [August 3, 2021, 2:25pm UTC](https://discuss.elastic.co/t/possible-collision-with-user-defined-field-parameter-and-built-in-fields/280330 "2021-08-03T14:25:42Z")
Hey, I am working on an app where we tried to append a Logstash Marker with the custom key "parameter", containing a string with some information about where in the application the log event occured. Unfortunately, sinc… --- ## [Mapping private IP Address to geolocation with GeoIP Processor](https://discuss.elastic.co/t/mapping-private-ip-address-to-geolocation-with-geoip-processor/279981)
**Author:** [@Vannessa\_Kemeni](https://discuss.elastic.co/u/Vannessa_Kemeni)\ **Replies:** 4\ **Last updated:** [August 3, 2021, 11:54am UTC](https://discuss.elastic.co/t/mapping-private-ip-address-to-geolocation-with-geoip-processor/279981 "2021-08-03T11:54:55Z")
Hello, i am using a tool, that uses Elastic search. For retrieving the geolocaton of the IP Address a Json file was created that uses the GeoIP Processor. I updated this file in order to set the geolocation of the priva… --- ## [Elasticsearch input plugin size](https://discuss.elastic.co/t/elasticsearch-input-plugin-size/280163)
**Author:** [@JFO\_90](https://discuss.elastic.co/u/JFO_90)\ **Replies:** 7\ **Last updated:** [August 3, 2021, 11:15am UTC](https://discuss.elastic.co/t/elasticsearch-input-plugin-size/280163 "2021-08-03T11:15:25Z")
Hi, I have a logstash configuration from which I'm trying to extract elasticsearch information with the elasticsearch input plugin. The problem that i have is that despite indicating a size, it always returns all the do… --- ## [Disk.indices is higher than disk.used in cat allocation](https://discuss.elastic.co/t/disk-indices-is-higher-than-disk-used-in-cat-allocation/279853)
**Author:** [@sandeepkanabar](https://discuss.elastic.co/u/sandeepkanabar)\ **Replies:** 13\ **Last updated:** [August 3, 2021, 11:02am UTC](https://discuss.elastic.co/t/disk-indices-is-higher-than-disk-used-in-cat-allocation/279853 "2021-08-03T11:02:35Z")
When I run the following command: GET \_cat/allocation?v&s=disk.indices&h=shards,disk.indices,disk.used,disk.available,disk.total,disk.percent it shows the following output: shards disk.indices disk.used disk.total dis… --- ## [More documentation on enterprise-search config options?](https://discuss.elastic.co/t/more-documentation-on-enterprise-search-config-options/280056)
**Author:** [@matp](https://discuss.elastic.co/u/matp)\ **Replies:** 2\ **Last updated:** [August 3, 2021, 10:41am UTC](https://discuss.elastic.co/t/more-documentation-on-enterprise-search-config-options/280056 "2021-08-03T10:41:30Z")
I have elasticsearch and enterprise-search both running. In order to get them running together (with basic license) I had to enable SSL on the elasticsearch side in order to use API key as required by enterprise search … --- ## [How would be filter plugin for this desired output](https://discuss.elastic.co/t/how-would-be-filter-plugin-for-this-desired-output/280301)
**Author:** [@Srujan\_L](https://discuss.elastic.co/u/Srujan_L)\ **Replies:** 0\ **Last updated:** [August 3, 2021, 10:25am UTC](https://discuss.elastic.co/t/how-would-be-filter-plugin-for-this-desired-output/280301 "2021-08-03T10:25:34Z")
my input file looks like {"msg1":"\\"abcd\\" : \\"msg2\\""} {"msg1":"\\"Dhhdk\\" : \\"msg3\\""} {"msg1":"\\"Djskdh\\" : \\"msg2\\""} {"msg1":"\\"ksgdh\\" : \\"msg\\""} {"msg1":"\\"hxvdb\\" : \\"msg\\""} my desired output should be like {… --- ## [Disable Fuzziness in Query](https://discuss.elastic.co/t/disable-fuzziness-in-query/280073)
**Author:** [@usman1](https://discuss.elastic.co/u/usman1)\ **Replies:** 3\ **Last updated:** [August 3, 2021, 9:11am UTC](https://discuss.elastic.co/t/disable-fuzziness-in-query/280073 "2021-08-03T09:11:07Z")
I am fetching results with the following query where search is being done on Strings (Recipe name): let body2 = { size: 200, from: 0, sort : \[ { "@timestamp" : {"order": "desc", "form… --- ## [ES\_JAVA\_OPTS is ignore or not set](https://discuss.elastic.co/t/es-java-opts-is-ignore-or-not-set/280190)
**Author:** [@purushothamkdr143](https://discuss.elastic.co/u/purushothamkdr143)\ **Replies:** 1\ **Last updated:** [August 3, 2021, 8:54am UTC](https://discuss.elastic.co/t/es-java-opts-is-ignore-or-not-set/280190 "2021-08-03T08:54:09Z")
Hi Team, I had setup elasticsearch cluster(version 6.8.14) using eck operator. I wanted to use more heapsize so I had set ES\_JAVA\_OPTS as "-Xms6g -Xmx6g". but it is taking the default heapsize which is 1g. Kindly help m… --- ## [Rest API Issues with downloading visualisation/dashboard as png](https://discuss.elastic.co/t/rest-api-issues-with-downloading-visualisation-dashboard-as-png/280165)
**Author:** [@Vajb12](https://discuss.elastic.co/u/Vajb12)\ **Replies:** 3\ **Last updated:** [August 3, 2021, 7:17am UTC](https://discuss.elastic.co/t/rest-api-issues-with-downloading-visualisation-dashboard-as-png/280165 "2021-08-03T07:17:31Z")
HI Team, We are trying to download a kibana dashboard using the RESTAPI. http://localhost:5601/app/kibana#/dashboard/export?dashboard=7adfa750-4c81-11e8-b3d7-01146121b73d By specifying the dashboard id, Im able to do… --- ## [Details of Top N records](https://discuss.elastic.co/t/details-of-top-n-records/280224)
**Author:** [@ddramireddy](https://discuss.elastic.co/u/ddramireddy)\ **Replies:** 1\ **Last updated:** [August 3, 2021, 7:09am UTC](https://discuss.elastic.co/t/details-of-top-n-records/280224 "2021-08-03T07:09:21Z")
Hi, I have an index with following schema: GroupName,Time,Value Example values: G1 2020-01-01 1:00:00. 10 G2 2020-01-01 1:00:00. 15 G3 2020-01-01 1:00:00. 20 G1 2020-01-01 2:00:00. 10 G2 2020-01-01 2:00:00. 20 G… --- ## [API/endpoint to get analyzer/filter details](https://discuss.elastic.co/t/api-endpoint-to-get-analyzer-filter-details/280254)
**Author:** [@mattkallo](https://discuss.elastic.co/u/mattkallo)\ **Replies:** 1\ **Last updated:** [August 3, 2021, 7:06am UTC](https://discuss.elastic.co/t/api-endpoint-to-get-analyzer-filter-details/280254 "2021-08-03T07:06:35Z")
I have a synonyms analyzer with 2 filters configured to read from synonyms mapping files. I use the /\_analyze API to see how the analyzer processes text. But is there a way to get a summary of configured filters or ana… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=865) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=867)