# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=927 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 928 --- ## [How Sliced Scan Works in the background?](https://discuss.elastic.co/t/how-sliced-scan-works-in-the-background/274832)
**Author:** [@arkash20](https://discuss.elastic.co/u/arkash20)\ **Replies:** 0\ **Last updated:** [June 3, 2021, 8:23am UTC](https://discuss.elastic.co/t/how-sliced-scan-works-in-the-background/274832 "2021-06-03T08:23:08Z")
Hi, I used scan method to retrieve data from a huge indice we have (200M records), using multiprocessing. For that I used sliced scan and set it to 6 slices, as the number of my shards. Now here comes the theory questi… --- ## [Elastic agent log parsing](https://discuss.elastic.co/t/elastic-agent-log-parsing/274827)
**Author:** [@Guncixx](https://discuss.elastic.co/u/Guncixx)\ **Replies:** 0\ **Last updated:** [June 3, 2021, 6:59am UTC](https://discuss.elastic.co/t/elastic-agent-log-parsing/274827 "2021-06-03T06:59:39Z")
While testing Elastic SIEM and different shippers I discovered that both filebeat and elastic agent is not parsing Ubuntu auth log completely, there are some events where user and some other fields not getting populated.… --- ## [Combining URL and field value/values](https://discuss.elastic.co/t/combining-url-and-field-value-values/274710)
**Author:** [@marija.timovska](https://discuss.elastic.co/u/marija.timovska)\ **Replies:** 25\ **Last updated:** [June 3, 2021, 8:08am UTC](https://discuss.elastic.co/t/combining-url-and-field-value-values/274710 "2021-06-03T08:08:14Z")
I would like some assistance with creating custom fields in Kibana. I am not sure why the filed I want is shown correctly in Discovery but when I want to Visualize it it changes back to how it is by default. … --- ## [Installing Elasticsearch on a VM outside of the Internet](https://discuss.elastic.co/t/installing-elasticsearch-on-a-vm-outside-of-the-internet/274756)
**Author:** [@jyde](https://discuss.elastic.co/u/jyde)\ **Replies:** 2\ **Last updated:** [June 3, 2021, 7:04am UTC](https://discuss.elastic.co/t/installing-elasticsearch-on-a-vm-outside-of-the-internet/274756 "2021-06-03T07:04:23Z")
Hi, I am tring to install ELK on a VM (let's name it foomachine) which is not connected to the Internet. With MobaXTerm, I have put the tar.gz file of the lastest version of Elasticsearch on foomachine, more precisely … --- ## [CSRF Protection in kibana 7.10.2](https://discuss.elastic.co/t/csrf-protection-in-kibana-7-10-2/274824)
**Author:** [@ravi\_yadav2](https://discuss.elastic.co/u/ravi_yadav2)\ **Replies:** 1\ **Last updated:** [June 3, 2021, 5:51am UTC](https://discuss.elastic.co/t/csrf-protection-in-kibana-7-10-2/274824 "2021-06-03T05:51:15Z")
Continuing the discussion from CSRF Protection in kibana 7.10.2: --- ## [Some logs missing in Kibana](https://discuss.elastic.co/t/some-logs-missing-in-kibana/274819)
**Author:** [@fsiu](https://discuss.elastic.co/u/fsiu)\ **Replies:** 1\ **Last updated:** [June 3, 2021, 3:39am UTC](https://discuss.elastic.co/t/some-logs-missing-in-kibana/274819 "2021-06-03T03:39:55Z")
I have an api application that uses Logstash to send logs to Kibana, all logs are successfully sent. However some logs are missing when viewing the index using Discovery - Kibana. Can you help me to identify the issue … --- ## [Elasticsearch appears to be unreachable or down](https://discuss.elastic.co/t/elasticsearch-appears-to-be-unreachable-or-down/274814)
**Author:** [@abdallah](https://discuss.elastic.co/u/abdallah)\ **Replies:** 0\ **Last updated:** [June 3, 2021, 2:53am UTC](https://discuss.elastic.co/t/elasticsearch-appears-to-be-unreachable-or-down/274814 "2021-06-03T02:53:32Z")
Hi, we suddenly lost the connection between our two logstash servers and the Elasticsearch nodes. The odd thing is that from logstash you can curl, telnet and ping the ElasticSearch nodes, but there is no sending logsta… --- ## [Logstash read file in what order?](https://discuss.elastic.co/t/logstash-read-file-in-what-order/274549)
**Author:** [@theirfan](https://discuss.elastic.co/u/theirfan)\ **Replies:** 21\ **Last updated:** [June 3, 2021, 2:52am UTC](https://discuss.elastic.co/t/logstash-read-file-in-what-order/274549 "2021-06-03T02:52:37Z")
Hi All, Would like to know how logstash "input" reads files from a directory. I have files which are created based on size limit and each new log creation is appended with the creation date in it's name. Ex: file-010… --- ## [Aggregation\[Serial Diff\]を指定のLineグラフでのマイナス表示改善について](https://discuss.elastic.co/t/aggregation-serial-diff-line/274693)
**Author:** [@K.taka99](https://discuss.elastic.co/u/K.taka99)\ **Replies:** 0\ **Last updated:** [June 2, 2021, 1:19am UTC](https://discuss.elastic.co/t/aggregation-serial-diff-line/274693 "2021-06-02T01:19:01Z")
filebeatにてjstat -gcを取集し、kibanaのVisualizeにてLineグラフを表示させています。 YGCとFGCにAggregation\[Serial Diff\]を指定してLineグラフで表示しているので、 収集先のサーバーを再起動した場合、jstatの値が初期化されるため、グラフがマイナス値になることがあります。 この様な場合の回避方法はありますでしょうか？ AdvancedのJSON inputにてスク… --- ## [Watcherのconditionに変数を設定する方法について](https://discuss.elastic.co/t/watcher-condition/274472)
**Author:** [@t-nakata](https://discuss.elastic.co/u/t-nakata)\ **Replies:** 2\ **Last updated:** [June 3, 2021, 12:25am UTC](https://discuss.elastic.co/t/watcher-condition/274472 "2021-06-03T00:25:00Z")
watcherのconditionに変数を設定する方法についてご教示頂けないでしょうか。 実現したいこと 参考： { "condition" : { "compare" : { "ctx.payload.hits.total" : { "gte" : 5 } } } } 例えば、上記の「5」という定数の代わりに、inputとなるインデックスAのNUMフィールド… --- ## [\[o.e.b.Bootstrap \] \[node1\] node validation exception](https://discuss.elastic.co/t/o-e-b-bootstrap-node1-node-validation-exception/274740)
**Author:** [@mohamed\_el\_mannouti](https://discuss.elastic.co/u/mohamed_el_mannouti)\ **Replies:** 1\ **Last updated:** [June 3, 2021, 12:08am UTC](https://discuss.elastic.co/t/o-e-b-bootstrap-node1-node-validation-exception/274740 "2021-06-03T00:08:48Z")
right after restarting my server --- ## [Elastic license - security menu not showing up in kibana](https://discuss.elastic.co/t/elastic-license-security-menu-not-showing-up-in-kibana/274738)
**Author:** [@smm](https://discuss.elastic.co/u/smm)\ **Replies:** 2\ **Last updated:** [June 3, 2021, 12:08am UTC](https://discuss.elastic.co/t/elastic-license-security-menu-not-showing-up-in-kibana/274738 "2021-06-03T00:08:37Z")
Hi there, if have a valid commercial (not basic) license for elasticsearch. Nevertheless I have no security menu in kibana under stack management as I know it. This is an unexpected behaviour. Detail: 1-node-monitorin… --- ## [Error : circuit\_breaking\_exception](https://discuss.elastic.co/t/error-circuit-breaking-exception/274741)
**Author:** [@jvidin](https://discuss.elastic.co/u/jvidin)\ **Replies:** 1\ **Last updated:** [June 3, 2021, 12:07am UTC](https://discuss.elastic.co/t/error-circuit-breaking-exception/274741 "2021-06-03T00:07:55Z")
Hi all , Im new to elastic , im recently receiving this error with some frequency. I have a cluster of 3 and all indices set to shards=2 and replicas=2 Should i look into some special setting to overpass such error ? … --- ## [Search not adhering to time limits - searching many indexes](https://discuss.elastic.co/t/search-not-adhering-to-time-limits-searching-many-indexes/274665)
**Author:** [@P\_Larsen](https://discuss.elastic.co/u/P_Larsen)\ **Replies:** 3\ **Last updated:** [June 2, 2021, 11:14pm UTC](https://discuss.elastic.co/t/search-not-adhering-to-time-limits-searching-many-indexes/274665 "2021-06-02T23:14:53Z")
We have a search that we see running that has a time limit what appears to be 4 mins set but it is accessing indexes from way back in the past. What could be the issue? Grabbed from listing running tasks indices:data/… --- ## [Logstash, syslog, ECS and Kibana Logs / SIEM](https://discuss.elastic.co/t/logstash-syslog-ecs-and-kibana-logs-siem/274789)
**Author:** [@egli](https://discuss.elastic.co/u/egli)\ **Replies:** 4\ **Last updated:** [June 2, 2021, 11:08pm UTC](https://discuss.elastic.co/t/logstash-syslog-ecs-and-kibana-logs-siem/274789 "2021-06-02T23:08:42Z")
Hi, I have logstash working as a central syslog server using syslog\_pri plugin and sending the events to elasticsearch. I would like to ingest those syslog events and adhere to ECS so it is possible to use Kibana Logs o… --- ## [Dateparsefailure error logstash](https://discuss.elastic.co/t/dateparsefailure-error-logstash/274806)
**Author:** [@byakko1234](https://discuss.elastic.co/u/byakko1234)\ **Replies:** 0\ **Last updated:** [June 2, 2021, 10:57pm UTC](https://discuss.elastic.co/t/dateparsefailure-error-logstash/274806 "2021-06-02T22:57:30Z")
Hi everyone. I´m trying to use the date filter without any luck. I want to create a new field that is the combination of the %{date} and %{time} in my grok and have this new field to have a date type value. Any help is… --- ## [Drop events if regex does not match in ElasticSearch](https://discuss.elastic.co/t/drop-events-if-regex-does-not-match-in-elasticsearch/274803)
**Author:** [@pbreda](https://discuss.elastic.co/u/pbreda)\ **Replies:** 0\ **Last updated:** [June 2, 2021, 10:31pm UTC](https://discuss.elastic.co/t/drop-events-if-regex-does-not-match-in-elasticsearch/274803 "2021-06-02T22:31:49Z")
I'm getting events from Filebeat directly to ElasticSearch for metrics live viewing in the Observability menu, however I can't drop out the events I'm not interested like I would be able to using Logstash. I'm receiving … --- ## [Crawlink 100k domain names](https://discuss.elastic.co/t/crawlink-100k-domain-names/273313)
**Author:** [@Remi\_Poulenard](https://discuss.elastic.co/u/Remi_Poulenard)\ **Replies:** 3\ **Last updated:** [June 2, 2021, 8:28pm UTC](https://discuss.elastic.co/t/crawlink-100k-domain-names/273313 "2021-06-02T20:28:34Z")
Hello, I'm interested to know if it is possible to crawl ~100k domain names. If so, it is possible to add / remove domains by using an API ? Also I would be really interested for a possibility to schedule the crawling … --- ## [Sql\_last\_value and implicit time zoned data](https://discuss.elastic.co/t/sql-last-value-and-implicit-time-zoned-data/274797)
**Author:** [@etva](https://discuss.elastic.co/u/etva)\ **Replies:** 0\ **Last updated:** [June 2, 2021, 7:23pm UTC](https://discuss.elastic.co/t/sql-last-value-and-implicit-time-zoned-data/274797 "2021-06-02T19:23:43Z")
Hi all, MySql server is UTC : now() give UTC date . sql\_last\_value is stored in UTC in file ( from MySQL ? ) But data I have to compare to sql\_last \_value are locale date as string. I can't use CONVERT\_TZ with named … --- ## [NEED TO READ ONLY THE NEWEST FILE IN EACH FOLDER](https://discuss.elastic.co/t/need-to-read-only-the-newest-file-in-each-folder/274714)
**Author:** [@Daniel\_Lopez](https://discuss.elastic.co/u/Daniel_Lopez)\ **Replies:** 3\ **Last updated:** [June 2, 2021, 5:51pm UTC](https://discuss.elastic.co/t/need-to-read-only-the-newest-file-in-each-folder/274714 "2021-06-02T17:51:47Z")
Hi guys!! I need to configure logstash to read only the newest file in folders, when I restart always read all files, and I couldn't understand why, files are in NAS, and I mount folders before start reading. This is m… --- ## [Kibana debian package not starting (chroot error)](https://discuss.elastic.co/t/kibana-debian-package-not-starting-chroot-error/266437)
**Author:** [@ea1987](https://discuss.elastic.co/u/ea1987)\ **Replies:** 13\ **Last updated:** [June 2, 2021, 5:19pm UTC](https://discuss.elastic.co/t/kibana-debian-package-not-starting-chroot-error/266437 "2021-06-02T17:19:48Z")
Kibana version: 7.11 (current) Installation on: ubuntu (WSL2) Error on: start Kibana.log: chroot: cannot change root directory to '': No such file or directory NB: Elasticsearch is running fine. Can you please help … --- ## [Available Fields - Kibana - Parse data for dashboard built](https://discuss.elastic.co/t/available-fields-kibana-parse-data-for-dashboard-built/274674)
**Author:** [@momo1104](https://discuss.elastic.co/u/momo1104)\ **Replies:** 3\ **Last updated:** [June 2, 2021, 3:27pm UTC](https://discuss.elastic.co/t/available-fields-kibana-parse-data-for-dashboard-built/274674 "2021-06-02T15:27:34Z")
I've ingested ddos dataset from kaggle.com into kibana and it seems like not all the metadata available is useful for me to create a dashboard visualizing the ddos attacks. What am I missing? The config file as follows … --- ## [Using KV and Grok to parse complex data](https://discuss.elastic.co/t/using-kv-and-grok-to-parse-complex-data/274769)
**Author:** [@blackberrySherbet](https://discuss.elastic.co/u/blackberrySherbet)\ **Replies:** 1\ **Last updated:** [June 2, 2021, 3:07pm UTC](https://discuss.elastic.co/t/using-kv-and-grok-to-parse-complex-data/274769 "2021-06-02T15:07:37Z")
Hi, My data is structured like this- INFO {"datetime": "2021-06-1 22:13:29.469000", data:{"val1":3.14, "val2": 2.17}} INFO {"datetime": "2021-06-1 21:14:00.469000", data:{"val3":9}} I want to use logstash to process … --- ## [SIEM prebuilt rules](https://discuss.elastic.co/t/siem-prebuilt-rules/274724)
**Author:** [@tarekilani](https://discuss.elastic.co/u/tarekilani)\ **Replies:** 2\ **Last updated:** [June 2, 2021, 2:43pm UTC](https://discuss.elastic.co/t/siem-prebuilt-rules/274724 "2021-06-02T14:43:17Z")
Hello, I'm searching for prebuild rules for elastic SIEM, i found that i can use elastic provided rules : But i would like to know if there is any other source to get pre build rules for elastic SIEM, for example rul… --- ## [Pipeline not communicate](https://discuss.elastic.co/t/pipeline-not-communicate/274766)
**Author:** [@frank\_rib](https://discuss.elastic.co/u/frank_rib)\ **Replies:** 0\ **Last updated:** [June 2, 2021, 2:27pm UTC](https://discuss.elastic.co/t/pipeline-not-communicate/274766 "2021-06-02T14:27:46Z")
Hello expert, In order to parse openbsd events I chosed to use pipeline to pipleline communications, I have three pipelines named input which point to openbsd\_2\_ecs pipleline and this last point to output pipeline. Ple… --- ## [Different version between Elasticsearch and Logstash](https://discuss.elastic.co/t/different-version-between-elasticsearch-and-logstash/274567)
**Author:** [@111475](https://discuss.elastic.co/u/111475)\ **Replies:** 5\ **Last updated:** [June 2, 2021, 1:51pm UTC](https://discuss.elastic.co/t/different-version-between-elasticsearch-and-logstash/274567 "2021-06-02T13:51:10Z")
Is it okay to run Logstash with version(7.13.0) different from our Elasticsearch version(7.10.2)? --- ## [Configuration file](https://discuss.elastic.co/t/configuration-file/274758)
**Author:** [@Krunal](https://discuss.elastic.co/u/Krunal)\ **Replies:** 0\ **Last updated:** [June 2, 2021, 1:40pm UTC](https://discuss.elastic.co/t/configuration-file/274758 "2021-06-02T13:40:55Z")
Hello Expert, I am having csv file with more than 5 tables in it... i would like extract data from 2 of them. but column names are different and data structure is different..... and one more thing that i would like to a… --- ## [Kibana Navbar logo customization](https://discuss.elastic.co/t/kibana-navbar-logo-customization/274447)
**Author:** [@Long\_Nguyen](https://discuss.elastic.co/u/Long_Nguyen)\ **Replies:** 1\ **Last updated:** [June 2, 2021, 1:27pm UTC](https://discuss.elastic.co/t/kibana-navbar-logo-customization/274447 "2021-06-02T13:27:46Z")
I was trying to change the Navbar logo of Kibana using this guide Custom Logo Kibana 7.10.0 (guide) I'm wondering if my logo is larger, is there any way to modify the size of the flex box in order to show my logo more c… --- ## [Metric beat oracle module configuration](https://discuss.elastic.co/t/metric-beat-oracle-module-configuration/273673)
**Author:** [@mrunalini](https://discuss.elastic.co/u/mrunalini)\ **Replies:** 13\ **Last updated:** [June 2, 2021, 12:55pm UTC](https://discuss.elastic.co/t/metric-beat-oracle-module-configuration/273673 "2021-06-02T12:55:52Z")
Hi Everyone, I have configure my Orcacle.yml file in module.d folder with all required details ,also started the metricbeat. Still i am not able to see anything in my my oracle dashboard . is there any more setting i … --- ## [Dynamic value in index mappings override dynamic value setted in dynamic template \[ES 7.6.2\]](https://discuss.elastic.co/t/dynamic-value-in-index-mappings-override-dynamic-value-setted-in-dynamic-template-es-7-6-2/274752)
**Author:** [@Saief](https://discuss.elastic.co/u/Saief)\ **Replies:** 0\ **Last updated:** [June 2, 2021, 12:46pm UTC](https://discuss.elastic.co/t/dynamic-value-in-index-mappings-override-dynamic-value-setted-in-dynamic-template-es-7-6-2/274752 "2021-06-02T12:46:13Z")
Hello, I created a dynamic template to avoid adding specific new fields that have object type ( that match a particular pattern ) in the index mapping ( without touching the \_source ). This is the body of my query : \> … [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=926) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=928)