# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=940 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 941 --- ## [Logstash and filebeat](https://discuss.elastic.co/t/logstash-and-filebeat/273614)
**Author:** [@Francisco\_Ramirez](https://discuss.elastic.co/u/Francisco_Ramirez)\ **Replies:** 1\ **Last updated:** [May 21, 2021, 10:52pm UTC](https://discuss.elastic.co/t/logstash-and-filebeat/273614 "2021-05-21T22:52:50Z")
Hi Folks I configured elasticsearch and kibana for visualizate event from wazuh, now i want see this event into the module siem. best regards --- ## [Parse logs](https://discuss.elastic.co/t/parse-logs/273706)
**Author:** [@sergio\_junior](https://discuss.elastic.co/u/sergio_junior)\ **Replies:** 1\ **Last updated:** [May 21, 2021, 10:06pm UTC](https://discuss.elastic.co/t/parse-logs/273706 "2021-05-21T22:06:12Z")
hello guys, i need help. I am trying to separate these values ​​from within the message {"message": "File accessed: \\" / Photos / Readme.md \\ "", "@ version": "1", "tags": \["beats\_input\_codec\_plain\_applied", "\_ jsonpar… --- ## [CSV Input - Some fields are multiline - LR vs CRLF](https://discuss.elastic.co/t/csv-input-some-fields-are-multiline-lr-vs-crlf/273691)
**Author:** [@uklipse](https://discuss.elastic.co/u/uklipse)\ **Replies:** 0\ **Last updated:** [May 21, 2021, 7:28pm UTC](https://discuss.elastic.co/t/csv-input-some-fields-are-multiline-lr-vs-crlf/273691 "2021-05-21T19:28:29Z")
I am trying input a csv file that certain fields can be multiline. When I paste the sample data into Notepad++ and display end of line characters, I can see the actual csv line separates using CRLF but the new lines with… --- ## [Translation EUI in kibana plugin](https://discuss.elastic.co/t/translation-eui-in-kibana-plugin/273682)
**Author:** [@kirienko.m](https://discuss.elastic.co/u/kirienko.m)\ **Replies:** 3\ **Last updated:** [May 21, 2021, 7:26pm UTC](https://discuss.elastic.co/t/translation-eui-in-kibana-plugin/273682 "2021-05-21T19:26:23Z")
Hello! I am created plugin with translations ru-RU. I want to translate the core.euiSuperUpdateButton.refreshButtonLabel, but i translate only in kibana Discover and not in my plugin. The EuiSuperDatePicker translating o… --- ## [Querying API On Input With Variables](https://discuss.elastic.co/t/querying-api-on-input-with-variables/273688)
**Author:** [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Replies:** 1\ **Last updated:** [May 21, 2021, 5:30pm UTC](https://discuss.elastic.co/t/querying-api-on-input-with-variables/273688 "2021-05-21T17:30:33Z")
I am trying to hit a HTTP API with time constraints included. The API allows you to pull results since a specified time in the format of yyyy-MM-dd'T'HH:mm:ss:SSS z. Is there an input that would allow me to specify thi… --- ## [Maximums for searchAfter (and scroll) size parameter?](https://discuss.elastic.co/t/maximums-for-searchafter-and-scroll-size-parameter/273591)
**Author:** [@elastic\_yogi](https://discuss.elastic.co/u/elastic_yogi)\ **Replies:** 3\ **Last updated:** [May 21, 2021, 5:23pm UTC](https://discuss.elastic.co/t/maximums-for-searchafter-and-scroll-size-parameter/273591 "2021-05-21T17:23:24Z")
Hi, I'm curious about ES 7.12 searchAfter and scroll. Both of these have a size parameter. What's the recommended limit to this parameter? I see none given, so I take it's a function of memory and cluster capacity someho… --- ## [Csv header skip\_header =\> "true" not working](https://discuss.elastic.co/t/csv-header-skip-header-true-not-working/273100)
**Author:** [@Bugsbee](https://discuss.elastic.co/u/Bugsbee)\ **Replies:** 2\ **Last updated:** [May 21, 2021, 4:50pm UTC](https://discuss.elastic.co/t/csv-header-skip-header-true-not-working/273100 "2021-05-21T16:50:31Z")
hello all, Im trying to use skip\_header =\> "true", this is because in kibana/discover the header is also coming out as a value. so i tried to add this parameter and it does not seem to working. In my case, this header… --- ## [Updating index gives number of documents in the index cannot exceed 2147483519](https://discuss.elastic.co/t/updating-index-gives-number-of-documents-in-the-index-cannot-exceed-2147483519/273547)
**Author:** [@NLSVTN](https://discuss.elastic.co/u/NLSVTN)\ **Replies:** 7\ **Last updated:** [May 21, 2021, 4:31pm UTC](https://discuss.elastic.co/t/updating-index-gives-number-of-documents-in-the-index-cannot-exceed-2147483519/273547 "2021-05-21T16:31:28Z")
We are trying to write 42522080 documents into Elasticsearch in python using Hail: mt = hl.import\_vcf(dataset\_path, reference\_genome='GRCh' + genome\_version, force\_bgz=True, min\_partitions=500) mt = hl.split\_mul… --- ## [Monitoring Snowflake with Elastic (EFK on self managed AWS setup)](https://discuss.elastic.co/t/monitoring-snowflake-with-elastic-efk-on-self-managed-aws-setup/273558)
**Author:** [@maheshe](https://discuss.elastic.co/u/maheshe)\ **Replies:** 1\ **Last updated:** [May 21, 2021, 3:25pm UTC](https://discuss.elastic.co/t/monitoring-snowflake-with-elastic-efk-on-self-managed-aws-setup/273558 "2021-05-21T15:25:15Z")
We have a requirement to monitor Snowflake with Elastic stack. We are using a 7.9 self managed EFK stack on EKS-Kubernetes. Any suggestions and guidance to integrate with snowflake will be helpful. Thanks --- ## [Is it possible to upgrade log4j from 2.11.1 to latest non-vul-ner-able version?](https://discuss.elastic.co/t/is-it-possible-to-upgrade-log4j-from-2-11-1-to-latest-non-vul-ner-able-version/273602)
**Author:** [@Elango\_P](https://discuss.elastic.co/u/Elango_P)\ **Replies:** 2\ **Last updated:** [May 21, 2021, 1:03pm UTC](https://discuss.elastic.co/t/is-it-possible-to-upgrade-log4j-from-2-11-1-to-latest-non-vul-ner-able-version/273602 "2021-05-21T13:03:12Z")
Found that ES internally using log4j 2.11.1 which is hitting this NVD - CVE-2020-9488. As we are more concerned about security issues, is there any plan to upgrade this in ES v6.8.x or latest versions of ES ? Or manuall… --- ## [GROK URIPATHPARAM SPLIT](https://discuss.elastic.co/t/grok-uripathparam-split/273662)
**Author:** [@Rahul\_Aggarwal](https://discuss.elastic.co/u/Rahul_Aggarwal)\ **Replies:** 0\ **Last updated:** [May 21, 2021, 12:00pm UTC](https://discuss.elastic.co/t/grok-uripathparam-split/273662 "2021-05-21T12:00:57Z")
I've been searching and reading the documentation but I can't seem to find further split my URIPATH into multiple parts. How this will achieve? My Sample URIPATH's are below: /article/india/13-naxals-were-neutralized-… --- ## [Grok - Value could appear or not. multiple rules?](https://discuss.elastic.co/t/grok-value-could-appear-or-not-multiple-rules/273548)
**Author:** [@legolas\_bilbao](https://discuss.elastic.co/u/legolas_bilbao)\ **Replies:** 2\ **Last updated:** [May 21, 2021, 12:45pm UTC](https://discuss.elastic.co/t/grok-value-could-appear-or-not-multiple-rules/273548 "2021-05-21T12:45:16Z")
I'm working with some logs from squid but one value could appear or not 1621232309.575 1 172.99.6.74 TCP\_MEM\_HIT/206 3096 GET http://storage.googleapis.com/ - HIER\_NONE/- application/octet-stream 1621232309.575 … --- ## [Log file doesnt read](https://discuss.elastic.co/t/log-file-doesnt-read/273665)
**Author:** [@legolas\_bilbao](https://discuss.elastic.co/u/legolas_bilbao)\ **Replies:** 0\ **Last updated:** [May 21, 2021, 12:33pm UTC](https://discuss.elastic.co/t/log-file-doesnt-read/273665 "2021-05-21T12:33:19Z")
HI everybody, I wanna read and deploy data from file logs but when i started the logstash service appears the following data Logstash.log \[2021-05-21T13:50:38,097\]\[INFO \]\[logstash.inputs.file \]\[squid\] No sincedb\_… --- ## [Is there a way to export \_ttl from docs?](https://discuss.elastic.co/t/is-there-a-way-to-export-ttl-from-docs/273028)
**Author:** [@rschirin](https://discuss.elastic.co/u/rschirin)\ **Replies:** 9\ **Last updated:** [May 21, 2021, 10:49am UTC](https://discuss.elastic.co/t/is-there-a-way-to-export-ttl-from-docs/273028 "2021-05-21T10:49:09Z")
Hey there, if \_ttl expiration value is configured within the documents of an index, is there a way to export/reindex those documents with the \_ttl value of that moment? For instance, using Logstash elasticsearch input … --- ## [How can i schedule logstash every two hours for jdbc input plugin?](https://discuss.elastic.co/t/how-can-i-schedule-logstash-every-two-hours-for-jdbc-input-plugin/272973)
**Author:** [@sreedhar1](https://discuss.elastic.co/u/sreedhar1)\ **Replies:** 5\ **Last updated:** [May 21, 2021, 10:40am UTC](https://discuss.elastic.co/t/how-can-i-schedule-logstash-every-two-hours-for-jdbc-input-plugin/272973 "2021-05-21T10:40:01Z")
How can i schedule logstash every two hours for jdbc input plugin? --- ## [Metadata name in VolumeClaimTemplates](https://discuss.elastic.co/t/metadata-name-in-volumeclaimtemplates/273650)
**Author:** [@pkaramol](https://discuss.elastic.co/u/pkaramol)\ **Replies:** 1\ **Last updated:** [May 21, 2021, 10:30am UTC](https://discuss.elastic.co/t/metadata-name-in-volumeclaimtemplates/273650 "2021-05-21T10:30:21Z")
Assuming I want to make 1 nodeSet of 2-role nodes masters/data and 1 nodeSet with data nodes as follows: - name: master config: node.roles: \["master", "data"\] count: 3 volumeClaimTemplates: - met… --- ## [What is the usage of parameter 'delimiter' in metricbeat graphite module?](https://discuss.elastic.co/t/what-is-the-usage-of-parameter-delimiter-in-metricbeat-graphite-module/273626)
**Author:** [@bertr](https://discuss.elastic.co/u/bertr)\ **Replies:** 1\ **Last updated:** [May 21, 2021, 10:28am UTC](https://discuss.elastic.co/t/what-is-the-usage-of-parameter-delimiter-in-metricbeat-graphite-module/273626 "2021-05-21T10:28:16Z")
I am looking at the graphite module for metricbeat. I understand what all parameters do/mean except for the delimiter parameter. I copy a yml below for clearity: - module: graphite metricsets: - server protocol:… --- ## [Can't use specific date field as primary time field](https://discuss.elastic.co/t/cant-use-specific-date-field-as-primary-time-field/273542)
**Author:** [@Travis](https://discuss.elastic.co/u/Travis)\ **Replies:** 3\ **Last updated:** [May 21, 2021, 9:22am UTC](https://discuss.elastic.co/t/cant-use-specific-date-field-as-primary-time-field/273542 "2021-05-21T09:22:35Z")
Hello ! I have the field "Generated Time" in my message. I want to use it as primary date field in Kibana. To do so, I create my index pattern and choose "Generated Time" as primary date field. But once in Discover, no… --- ## [Kibana Lens 7.12 - Mixed Bar/Line Option in Lens to show Daily as Bar and Moving Avg as line](https://discuss.elastic.co/t/kibana-lens-7-12-mixed-bar-line-option-in-lens-to-show-daily-as-bar-and-moving-avg-as-line/273037)
**Author:** [@stevedearl](https://discuss.elastic.co/u/stevedearl)\ **Replies:** 9\ **Last updated:** [May 21, 2021, 8:00am UTC](https://discuss.elastic.co/t/kibana-lens-7-12-mixed-bar-line-option-in-lens-to-show-daily-as-bar-and-moving-avg-as-line/273037 "2021-05-21T08:00:42Z")
Hi All, I'm using Kibana to show the count of events for various services received over time. I've been displaying this as a bar chart no problem but would like to also include a moving 7 day average as a line so that t… --- ## [Load more than 1 million row from SQL Server to ES with Logstash](https://discuss.elastic.co/t/load-more-than-1-million-row-from-sql-server-to-es-with-logstash/273627)
**Author:** [@Dai\_Thai\_Hoa\_Vo](https://discuss.elastic.co/u/Dai_Thai_Hoa_Vo)\ **Replies:** 1\ **Last updated:** [May 21, 2021, 7:48am UTC](https://discuss.elastic.co/t/load-more-than-1-million-row-from-sql-server-to-es-with-logstash/273627 "2021-05-21T07:48:26Z")
Hi every one. I have one case that my table has more 1 million rows in SQL Server and I used logstash JDBC to load them to Elastic Search. It work fine but run very slow. This is my file config. input { jdbc { jdbc\_dr… --- ## [Logstash input s3 Time difference in data acceptance](https://discuss.elastic.co/t/logstash-input-s3-time-difference-in-data-acceptance/273616)
**Author:** [@xiaoloutingfengyu](https://discuss.elastic.co/u/xiaoloutingfengyu)\ **Replies:** 0\ **Last updated:** [May 21, 2021, 6:26am UTC](https://discuss.elastic.co/t/logstash-input-s3-time-difference-in-data-acceptance/273616 "2021-05-21T06:26:37Z")
Logstash receives data from aws-s3, but kibana data is dozens of minutes later than the data on S3. How to modify it? --- ## [Is there a way to create visualizations/dashboards automatically via API calls?](https://discuss.elastic.co/t/is-there-a-way-to-create-visualizations-dashboards-automatically-via-api-calls/273379)
**Author:** [@Shreesh\_Narayanan](https://discuss.elastic.co/u/Shreesh_Narayanan)\ **Replies:** 3\ **Last updated:** [May 21, 2021, 6:16am UTC](https://discuss.elastic.co/t/is-there-a-way-to-create-visualizations-dashboards-automatically-via-api-calls/273379 "2021-05-21T06:16:47Z")
I have just started off with ELK stack , i have a bunch of data that needs to be visualized, while it is easy on doing it in the GUI, i was wondering if there a way to create visualizations /dashboards automatically via… --- ## [Good practices with Beats and Logstash](https://discuss.elastic.co/t/good-practices-with-beats-and-logstash/273296)
**Author:** [@mar-ro](https://discuss.elastic.co/u/mar-ro)\ **Replies:** 2\ **Last updated:** [May 21, 2021, 6:15am UTC](https://discuss.elastic.co/t/good-practices-with-beats-and-logstash/273296 "2021-05-21T06:15:48Z")
Hello to all of you! I have the following question about which option is better to be able to register two types of logs in elastic search. Let's say for example that I want to log the nginx and crontab logs. In addit… --- ## [Kibana Control visual "No matching indices found" error](https://discuss.elastic.co/t/kibana-control-visual-no-matching-indices-found-error/273553)
**Author:** [@Nisha2297](https://discuss.elastic.co/u/Nisha2297)\ **Replies:** 2\ **Last updated:** [May 21, 2021, 5:26am UTC](https://discuss.elastic.co/t/kibana-control-visual-no-matching-indices-found-error/273553 "2021-05-21T05:26:18Z")
While creating the Control visual in Kibana, I am facing "No matching indices found" error everytime I create a new visual. The index which I am using is totally different than the indices shown in the error. Please ref… --- ## [Kibana visual flexibility](https://discuss.elastic.co/t/kibana-visual-flexibility/273485)
**Author:** [@Nisha2297](https://discuss.elastic.co/u/Nisha2297)\ **Replies:** 2\ **Last updated:** [May 21, 2021, 4:41am UTC](https://discuss.elastic.co/t/kibana-visual-flexibility/273485 "2021-05-21T04:41:12Z")
Is it possible to create the below table chart in Kibana? As much as I explored, Kibana only creates a simple table visual and this type of grouping(ABC,XYZ,OTHER) of field is not possible. --- ## [Context-aware Markdown panels via attribute value of antecedent element and attribute selector in custom CSS?](https://discuss.elastic.co/t/context-aware-markdown-panels-via-attribute-value-of-antecedent-element-and-attribute-selector-in-custom-css/273539)
**Author:** [@GrahamHannington](https://discuss.elastic.co/u/GrahamHannington)\ **Replies:** 5\ **Last updated:** [May 21, 2021, 3:51am UTC](https://discuss.elastic.co/t/context-aware-markdown-panels-via-attribute-value-of-antecedent-element-and-attribute-selector-in-custom-css/273539 "2021-05-21T03:51:39Z")
I have a TSVB Markdown panel that consists of a list of links to related dashboards. I'm inserting that panel at the top of each of the related dashboards. I'm in denial about having to create a separate version of that… --- ## [Collecting syslog from several different vendors](https://discuss.elastic.co/t/collecting-syslog-from-several-different-vendors/273497)
**Author:** [@Christer\_Palmen](https://discuss.elastic.co/u/Christer_Palmen)\ **Replies:** 2\ **Last updated:** [May 21, 2021, 3:39am UTC](https://discuss.elastic.co/t/collecting-syslog-from-several-different-vendors/273497 "2021-05-21T03:39:44Z")
Hello. We have got an task of setting up an Elasticstack server that collects as a start syslog from different vendors in their environment, visualize it in Kibana and forward the syslogs to a CERT department As a sta… --- ## [Logstash-plugin-s3 接收数据有延迟30分钟](https://discuss.elastic.co/t/logstash-plugin-s3-30/273599)
**Author:** [@xiaoloutingfengyu](https://discuss.elastic.co/u/xiaoloutingfengyu)\ **Replies:** 0\ **Last updated:** [May 21, 2021, 2:39am UTC](https://discuss.elastic.co/t/logstash-plugin-s3-30/273599 "2021-05-21T02:39:05Z")
使用logstash的s3插件接受aws上的数据，数据接受有延迟，延迟时间如果超过半小时会继续接受，直到和真实时间相差10分钟左右停止接受，然后等相差超过30分钟时logstash-plugin-s3会再次接受数据。请问这个问题如何调整，我想要接受的数据和真实时间相差不超过5分钟。 --- ## [Elasticsearch/kibana mapping multi-layered/nested data](https://discuss.elastic.co/t/elasticsearch-kibana-mapping-multi-layered-nested-data/272821)
**Author:** [@stcdarrell](https://discuss.elastic.co/u/stcdarrell)\ **Replies:** 1\ **Last updated:** [May 21, 2021, 12:21am UTC](https://discuss.elastic.co/t/elasticsearch-kibana-mapping-multi-layered-nested-data/272821 "2021-05-21T00:21:32Z")
hi, i'm having some issues wrapping my head around how to map this data in elasticsearch/kibana: I'm pulling query data from VirusTotal.com's API on malware. here is a SMALL portion of a HUGE chunk of the query: (1) … --- ## [Correlation Matrix](https://discuss.elastic.co/t/correlation-matrix/273583)
**Author:** [@dxenakis](https://discuss.elastic.co/u/dxenakis)\ **Replies:** 1\ **Last updated:** [May 20, 2021, 9:36pm UTC](https://discuss.elastic.co/t/correlation-matrix/273583 "2021-05-20T21:36:38Z")
Hi, I have weather data into my elasticsearch from different weather forecast sites. In practice i use (scrapy) spiders in order to crawl the data from the sites and store them to elasticsearch. The index field struct… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=939) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=941)