# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=877 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 878 --- ## [Logstash Filter incoming data](https://discuss.elastic.co/t/logstash-filter-incoming-data/279248)
**Author:** [@Hamza\_El\_Aouane](https://discuss.elastic.co/u/Hamza_El_Aouane)\ **Replies:** 7\ **Last updated:** [July 21, 2021, 5:21pm UTC](https://discuss.elastic.co/t/logstash-filter-incoming-data/279248 "2021-07-21T17:21:27Z")
Hello Everyone, I hope you are all doing well. I am sorry to come here with this question but I could really use some experts help to solve an issue I am facing with Logstash. I will explain my situation as in detail a… --- ## [Elasticsearch Query Error : Unknown key for a START\_OBJECT in \[range\]](https://discuss.elastic.co/t/elasticsearch-query-error-unknown-key-for-a-start-object-in-range/279290)
**Author:** [@ankitdevnalkar](https://discuss.elastic.co/u/ankitdevnalkar)\ **Replies:** 0\ **Last updated:** [July 21, 2021, 5:15pm UTC](https://discuss.elastic.co/t/elasticsearch-query-error-unknown-key-for-a-start-object-in-range/279290 "2021-07-21T17:15:05Z")
I am trying to fetch the last 24 hour data by the following query. while running this queries individually, it works perfect, but when combined it gives the following error : Query: { "size": 0, "aggs": { "perc… --- ## [Geogip data problem](https://discuss.elastic.co/t/geogip-data-problem/279280)
**Author:** [@Betorov](https://discuss.elastic.co/u/Betorov)\ **Replies:** 2\ **Last updated:** [July 21, 2021, 4:56pm UTC](https://discuss.elastic.co/t/geogip-data-problem/279280 "2021-07-21T16:56:15Z")
Hi evreyone, I'am using the geoip filter to get the map value of an ip geoip {source =\> "NATDestinationIP" } It works, it create all type geoip (latitude and longitude.....) but when I look these value on kibana the… --- ## [\[FS-Repository\] Path is not accessible on master node](https://discuss.elastic.co/t/fs-repository-path-is-not-accessible-on-master-node/278219)
**Author:** [@Jonatha](https://discuss.elastic.co/u/Jonatha)\ **Replies:** 1\ **Last updated:** [July 9, 2021, 1:16am UTC](https://discuss.elastic.co/t/fs-repository-path-is-not-accessible-on-master-node/278219 "2021-07-09T01:16:26Z")
I tried to config a repository to save snapshot, but show this error: PUT \_snapshot/bkp-test { "type": "fs", "settings": { "location": "/media/test" } } { "error" : { "root\_cause" : \[ { "type" : "… --- ## [Logstash for finding combination of numbers](https://discuss.elastic.co/t/logstash-for-finding-combination-of-numbers/279207)
**Author:** [@Shreesh\_Narayanan](https://discuss.elastic.co/u/Shreesh_Narayanan)\ **Replies:** 3\ **Last updated:** [July 21, 2021, 4:50pm UTC](https://discuss.elastic.co/t/logstash-for-finding-combination-of-numbers/279207 "2021-07-21T16:50:53Z")
Hello, I'm looking for a way to write logstash code for a combination of numbers for a project , example if the input is 5 , the output needs to say 1 + 4 , where 1 means "service stopped" and 4 says "inactive" . I … --- ## [Multiple Blocklists?](https://discuss.elastic.co/t/multiple-blocklists/279196)
**Author:** [@BionicSecurityMgr](https://discuss.elastic.co/u/BionicSecurityMgr)\ **Replies:** 1\ **Last updated:** [July 21, 2021, 4:48pm UTC](https://discuss.elastic.co/t/multiple-blocklists/279196 "2021-07-21T16:48:06Z")
Is there any way to use multiple block lists? I'm thinking of a situation where we can have different Block Lists for different groups of assets without the need to use multiple Endpoint servers. We had a bad hash cause… --- ## [Configuration Comparison and Reporting options](https://discuss.elastic.co/t/configuration-comparison-and-reporting-options/279195)
**Author:** [@BionicSecurityMgr](https://discuss.elastic.co/u/BionicSecurityMgr)\ **Replies:** 1\ **Last updated:** [July 21, 2021, 4:41pm UTC](https://discuss.elastic.co/t/configuration-comparison-and-reporting-options/279195 "2021-07-21T16:41:20Z")
New to EndGame aka Elastic Endpoint Security (EES). Inherited an on-premise stack. Question - does EES include a policy comparison or export function? My intention is to quickly compare policies by comparing the options… --- ## [Shards per node, Heap, 100% CPU....help please](https://discuss.elastic.co/t/shards-per-node-heap-100-cpu-help-please/279109)
**Author:** [@kk123](https://discuss.elastic.co/u/kk123)\ **Replies:** 4\ **Last updated:** [July 21, 2021, 4:24pm UTC](https://discuss.elastic.co/t/shards-per-node-heap-100-cpu-help-please/279109 "2021-07-21T16:24:06Z")
Hi, I have a 2 node cluster with 1500 indices. Indices persist over time. This was set up by a third party... but now I am having the problem that the master node becomes unresponsive (100% CPU) and the only way to reco… --- ## [Where to see all the executed queries ran against my ES](https://discuss.elastic.co/t/where-to-see-all-the-executed-queries-ran-against-my-es/279235)
**Author:** [@hello5346](https://discuss.elastic.co/u/hello5346)\ **Replies:** 3\ **Last updated:** [July 21, 2021, 3:58pm UTC](https://discuss.elastic.co/t/where-to-see-all-the-executed-queries-ran-against-my-es/279235 "2021-07-21T15:58:01Z")
Hello all, Where can I see all the queries ran against my elastic search cluster. Thanks --- ## [Issues creating Index patterns in Kibana](https://discuss.elastic.co/t/issues-creating-index-patterns-in-kibana/278725)
**Author:** [@mikeg123](https://discuss.elastic.co/u/mikeg123)\ **Replies:** 11\ **Last updated:** [July 21, 2021, 3:13pm UTC](https://discuss.elastic.co/t/issues-creating-index-patterns-in-kibana/278725 "2021-07-21T15:13:29Z")
Hello, I've created a new index and index pattern in filebeat.yml file and send data to Elastic search running in aws container. when I go to Kibana I can see the new index getting created under 'Index Management', but… --- ## [Connecting UiPath to Elastic](https://discuss.elastic.co/t/connecting-uipath-to-elastic/278288)
**Author:** [@Dzious](https://discuss.elastic.co/u/Dzious)\ **Replies:** 1\ **Last updated:** [July 21, 2021, 3:03pm UTC](https://discuss.elastic.co/t/connecting-uipath-to-elastic/278288 "2021-07-21T15:03:22Z")
Hi, I've been struggling for a while now trying to connect UiPath/Orchestrator to Elastic. On their documentation they explicitly say that it's possible to output logs to Elastic. Unfortunately i still did not managed … --- ## [Lock certain dashboard and saved searches](https://discuss.elastic.co/t/lock-certain-dashboard-and-saved-searches/279276)
**Author:** [@Saeed\_Ektesabi1](https://discuss.elastic.co/u/Saeed_Ektesabi1)\ **Replies:** 1\ **Last updated:** [July 21, 2021, 2:40pm UTC](https://discuss.elastic.co/t/lock-certain-dashboard-and-saved-searches/279276 "2021-07-21T14:40:54Z")
Hello, I have a Kibana environment in which I have created several dashboards and saved searches. My Kibana also has several users which they can create their own dashboards or saved search. Is there a way for me to "… --- ## [How to strip events from message field? Logstash syslog](https://discuss.elastic.co/t/how-to-strip-events-from-message-field-logstash-syslog/279110)
**Author:** [@RaonyO](https://discuss.elastic.co/u/RaonyO)\ **Replies:** 7\ **Last updated:** [July 21, 2021, 2:21pm UTC](https://discuss.elastic.co/t/how-to-strip-events-from-message-field-logstash-syslog/279110 "2021-07-21T14:21:08Z")
hello guys, i'm trying to send logs from a syslog-ng server to logstash and logstash to elasticsearch, but all events are coming in the message field. Is it possible to separate these events to create a new field for eac… --- ## [Filtering, sorting and paginate nested object list](https://discuss.elastic.co/t/filtering-sorting-and-paginate-nested-object-list/279078)
**Author:** [@nickcigna](https://discuss.elastic.co/u/nickcigna)\ **Replies:** 1\ **Last updated:** [July 21, 2021, 2:20pm UTC](https://discuss.elastic.co/t/filtering-sorting-and-paginate-nested-object-list/279078 "2021-07-21T14:20:02Z")
Hello everybody, I have an index that contains documents with the following structure. ///SHOWS INDEX { "\_id", "artists":\[ -----\> NESTED OBJECT LIST { "id": "1", "name": "text" }, { "id": "2", "… --- ## [Multiple field names into single field name in elasticsearch](https://discuss.elastic.co/t/multiple-field-names-into-single-field-name-in-elasticsearch/279237)
**Author:** [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\ **Replies:** 1\ **Last updated:** [July 21, 2021, 2:05pm UTC](https://discuss.elastic.co/t/multiple-field-names-into-single-field-name-in-elasticsearch/279237 "2021-07-21T14:05:29Z")
Hi all, I'm working on a project where we need to a field to read multiple field names as same field name. Is there a way where we can configure multiple field names into one field using some method? For example, we h… --- ## [Elasticsearch ingest pipeline - not extract data passed from filebeat](https://discuss.elastic.co/t/elasticsearch-ingest-pipeline-not-extract-data-passed-from-filebeat/279039)
**Author:** [@samiusan](https://discuss.elastic.co/u/samiusan)\ **Replies:** 12\ **Last updated:** [July 21, 2021, 1:55pm UTC](https://discuss.elastic.co/t/elasticsearch-ingest-pipeline-not-extract-data-passed-from-filebeat/279039 "2021-07-21T13:55:19Z")
Hi, I'm slowly teaching myself the Elastic stack. Current project is attempting to ingest and modelling alerts from snort3 against the elastic common schema. I've run into an issue where an ingest pipeline is not correc… --- ## [Filter to select lines that contain a certain word which begins with "ANS" and which can end with a series of numbers or letters](https://discuss.elastic.co/t/filter-to-select-lines-that-contain-a-certain-word-which-begins-with-ans-and-which-can-end-with-a-series-of-numbers-or-letters/279259)
**Author:** [@boubou](https://discuss.elastic.co/u/boubou)\ **Replies:** 1\ **Last updated:** [July 21, 2021, 1:31pm UTC](https://discuss.elastic.co/t/filter-to-select-lines-that-contain-a-certain-word-which-begins-with-ans-and-which-can-end-with-a-series-of-numbers-or-letters/279259 "2021-07-21T13:31:02Z")
Hello everybody, I would like to create a filter who select lines that contain a certain word which begins with "ANS" and which can end with a series of numbers or letters. For example, I have a Tag who contains these … --- ## [ElasticSIEM unable to find \[logs-endpoint.alerts](https://discuss.elastic.co/t/elasticsiem-unable-to-find-logs-endpoint-alerts/277681)
**Author:** [@MKirby](https://discuss.elastic.co/u/MKirby)\ **Replies:** 11\ **Last updated:** [July 21, 2021, 1:20pm UTC](https://discuss.elastic.co/t/elasticsiem-unable-to-find-logs-endpoint-alerts/277681 "2021-07-21T13:20:49Z")
I have been able to start using the elastic SIEM recently, and am having the following message show up in my Kibana, both in the UI as well as in the command line when I start the service. \ log \[15:02:19.220\] \[erro… --- ## [Install specific version of ES on homebrew](https://discuss.elastic.co/t/install-specific-version-of-es-on-homebrew/279234)
**Author:** [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\ **Replies:** 1\ **Last updated:** [July 21, 2021, 1:15pm UTC](https://discuss.elastic.co/t/install-specific-version-of-es-on-homebrew/279234 "2021-07-21T13:15:11Z")
Hi all, I'm working in a project where we are using previous version of Elasticsearch i.e 7.11.1 . I'm supposed to use same version. When I try to download Elasticsearch on my MAC using homebrew services, I download la… --- ## [Unable to show empty buckets when using Date Histogram on @timestamp field](https://discuss.elastic.co/t/unable-to-show-empty-buckets-when-using-date-histogram-on-timestamp-field/279238)
**Author:** [@prathamesh7](https://discuss.elastic.co/u/prathamesh7)\ **Replies:** 4\ **Last updated:** [July 21, 2021, 10:32am UTC](https://discuss.elastic.co/t/unable-to-show-empty-buckets-when-using-date-histogram-on-timestamp-field/279238 "2021-07-21T10:32:00Z")
Hi Team, I am retrieving results of a query for last 7 days in visualisation, but in the response i am not seeing results for empty buckets i.e its not showing any result for that day when there is no data. There is no … --- ## [Logstash goes wrong after add filter](https://discuss.elastic.co/t/logstash-goes-wrong-after-add-filter/278730)
**Author:** [@quyennguyen](https://discuss.elastic.co/u/quyennguyen)\ **Replies:** 26\ **Last updated:** [July 21, 2021, 10:20am UTC](https://discuss.elastic.co/t/logstash-goes-wrong-after-add-filter/278730 "2021-07-21T10:20:07Z")
Hello everyone, I install Logstash in Ubuntu 18 with two conf.d file input and output. Everything run normally. But when I add 10-syslog-filter.conf something went wrong. 02-beat-input.conf input { beats { host… --- ## [How to remove backslash from weird formatted json](https://discuss.elastic.co/t/how-to-remove-backslash-from-weird-formatted-json/279084)
**Author:** [@MaxenceVacheron](https://discuss.elastic.co/u/MaxenceVacheron)\ **Replies:** 4\ **Last updated:** [July 21, 2021, 10:11am UTC](https://discuss.elastic.co/t/how-to-remove-backslash-from-weird-formatted-json/279084 "2021-07-21T10:11:19Z")
Hello :raised\_hand\_with\_fingers\_splayed:, I have the following (valid) formatted json of which I can't change the formatting : \[{ "id": "1", "sn": "00:1E:C0:8D:9A:CD", "log": "{\\"date\\":\\"16\\/04\\/2021\\",\\"t… --- ## [How to search \\t \\r \\n in elasticsearch?](https://discuss.elastic.co/t/how-to-search-t-r-n-in-elasticsearch/278984)
**Author:** [@MarvinLiu](https://discuss.elastic.co/u/MarvinLiu)\ **Replies:** 1\ **Last updated:** [July 19, 2021, 9:14am UTC](https://discuss.elastic.co/t/how-to-search-t-r-n-in-elasticsearch/278984 "2021-07-19T09:14:23Z")
I want to search \\t \\r \\n in my doc, how to input in query string syntax. It seems "\\n" can work , "\\n","\\n" not work , Is there any other choises? POST /test6/\_doc/2 { "id": 1002, "name": "test1", "desc"… --- ## [Change interval while viewing a dashboard, without editing?](https://discuss.elastic.co/t/change-interval-while-viewing-a-dashboard-without-editing/279158)
**Author:** [@GrahamHannington](https://discuss.elastic.co/u/GrahamHannington)\ **Replies:** 2\ **Last updated:** [July 21, 2021, 7:50am UTC](https://discuss.elastic.co/t/change-interval-while-viewing-a-dashboard-without-editing/279158 "2021-07-21T07:50:26Z")
Background to this question Feedback from a user viewing a Kibana dashboard I've developed: can we set the interval of time-based charts to 1 hour? An excerpt of my response: Yes. However, I have deliberately set t… --- ## [Elastic search Data fetch](https://discuss.elastic.co/t/elastic-search-data-fetch/279231)
**Author:** [@Hamendra\_Sunthwal](https://discuss.elastic.co/u/Hamendra_Sunthwal)\ **Replies:** 0\ **Last updated:** [July 21, 2021, 7:19am UTC](https://discuss.elastic.co/t/elastic-search-data-fetch/279231 "2021-07-21T07:19:07Z")
I am using below script to fetch data from Elastic search, I want to know how the data is being fetched from Magento to ES. This script get me product details in Output, but for some product the data is incorrect i need… --- ## [Dissector mapping field not found in event](https://discuss.elastic.co/t/dissector-mapping-field-not-found-in-event/279179)
**Author:** [@gongon](https://discuss.elastic.co/u/gongon)\ **Replies:** 13\ **Last updated:** [July 21, 2021, 6:59am UTC](https://discuss.elastic.co/t/dissector-mapping-field-not-found-in-event/279179 "2021-07-21T06:59:16Z")
Hi, I used the dissect filter and it worked .Now it does not. The only change is the upgrate of mac Os Catalina to mac OS Big Sur v 11.4 A message is displayed : Dissector mapping field not found in event Could you … --- ## [Logstash POS Log Transaction (TLogs) to JSON](https://discuss.elastic.co/t/logstash-pos-log-transaction-tlogs-to-json/279213)
**Author:** [@Anil\_Khiani](https://discuss.elastic.co/u/Anil_Khiani)\ **Replies:** 2\ **Last updated:** [July 21, 2021, 5:45am UTC](https://discuss.elastic.co/t/logstash-pos-log-transaction-tlogs-to-json/279213 "2021-07-21T05:45:59Z")
Hi Everyone, I have below log from IBM 4690 POS systems generating Transaction Logs (TLogs) as below "::p:�:�:�:�:U:!a" ":p::D::�::�::�::!a:U: P:�:�:#:�:�:",":�!8qg4:�:�P:�::�",":�!8qg4:�:�P:�:�F:�",":�!8qg4:�:�:�::d",… --- ## [請教如何令filebeat做到多個indexes配上不同template和ilm](https://discuss.elastic.co/t/filebeat-indexes-template-ilm/277106)
**Author:** [@cecil](https://discuss.elastic.co/u/cecil)\ **Replies:** 2\ **Last updated:** [July 21, 2021, 3:33am UTC](https://discuss.elastic.co/t/filebeat-indexes-template-ilm/277106 "2021-07-21T03:33:45Z")
我是新手，已測試了filebeat如何取得多個不同log源，也試了單一ilm是怎樣發生，也稍為明白template的用途。 現在有一個以下問題，目標是在同一伺服器上，把/var/log/syslog和/var/log/auth.log經filebeat分別套用在不同template上，然後各自也配不同ilm 例如syslog的ilm是hot 1day, delete 30days，而auth.log的ilm是hot 30 day, … --- ## [Kibana 7.10.2 build from src code failing due to socket hang up](https://discuss.elastic.co/t/kibana-7-10-2-build-from-src-code-failing-due-to-socket-hang-up/278982)
**Author:** [@shivani\_aggarwal](https://discuss.elastic.co/u/shivani_aggarwal)\ **Replies:** 2\ **Last updated:** [July 21, 2021, 5:13am UTC](https://discuss.elastic.co/t/kibana-7-10-2-build-from-src-code-failing-due-to-socket-hang-up/278982 "2021-07-21T05:13:10Z")
Hi, Kibana version: 7.10.2 I am trying to build kibana-oss rpm from src code (for centos env) following the procedure from developer guide. The required pre-req dependencies (git,gcc etc) are installed, kibana bootstr… --- ## [RUBY Filter to event.set each entity in an Array](https://discuss.elastic.co/t/ruby-filter-to-event-set-each-entity-in-an-array/277749)
**Author:** [@Dallas\_Toth](https://discuss.elastic.co/u/Dallas_Toth)\ **Replies:** 2\ **Last updated:** [July 21, 2021, 12:42am UTC](https://discuss.elastic.co/t/ruby-filter-to-event-set-each-entity-in-an-array/277749 "2021-07-21T00:42:44Z")
I am stuck on how to use a Ruby script to manipulate a field with in an array. If anyone can help with this I need to take the Field "\[body\]\[entities\]\[sentiment\]\[confidence\]" and \* 100 and add that as another Field "\[bod… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=876) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=878)