# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=944 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 945 --- ## [Logstash filtering drives me nuts](https://discuss.elastic.co/t/logstash-filtering-drives-me-nuts/273258)
**Author:** [@Tuckson](https://discuss.elastic.co/u/Tuckson)\ **Replies:** 7\ **Last updated:** [May 19, 2021, 10:44am UTC](https://discuss.elastic.co/t/logstash-filtering-drives-me-nuts/273258 "2021-05-19T10:44:25Z")
Hi, For some time now I have this stack, filbeats shipping logs of several application servers to elasticsearch via logstash. Logstash filtering is done in 4 pipelines. Now recently our supplier decided to change a fiel… --- ## [Bulk Requests to HTTP Input](https://discuss.elastic.co/t/bulk-requests-to-http-input/273381)
**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 0\ **Last updated:** [May 19, 2021, 10:01am UTC](https://discuss.elastic.co/t/bulk-requests-to-http-input/273381 "2021-05-19T10:01:32Z")
Hi, I have an http input configured to receive http bulk requests in application/x-ndjson format. However, logs are not flowing. The input config looks like this: input { http { codec =\> "json" … --- ## [Load data from SQL server to Elasticsearch with document\_id on local](https://discuss.elastic.co/t/load-data-from-sql-server-to-elasticsearch-with-document-id-on-local/273373)
**Author:** [@Dai\_Thai\_Hoa\_Vo](https://discuss.elastic.co/u/Dai_Thai_Hoa_Vo)\ **Replies:** 6\ **Last updated:** [May 19, 2021, 10:08am UTC](https://discuss.elastic.co/t/load-data-from-sql-server-to-elasticsearch-with-document-id-on-local/273373 "2021-05-19T10:08:04Z")
Hi every one. My local table has 3000 rows. When I config logstash output with document\_id =\> "%{countyId}". Just only lastest row is inserted to ElasticSearch. But when I not use document\_id =\> "%{countyId}" so it wo… --- ## [SIEM created and closed cases report](https://discuss.elastic.co/t/siem-created-and-closed-cases-report/270931)
**Author:** [@bnk](https://discuss.elastic.co/u/bnk)\ **Replies:** 9\ **Last updated:** [May 19, 2021, 9:53am UTC](https://discuss.elastic.co/t/siem-created-and-closed-cases-report/270931 "2021-05-19T09:53:21Z")
Hello, I looked information if there is a possibility to export info about created and closed cases (also tags associated with cases and other related info) in ELK SIEM, but I coudn't find any information. Is there a way… --- ## [What is the propper way to create in logstash checkpoint filter](https://discuss.elastic.co/t/what-is-the-propper-way-to-create-in-logstash-checkpoint-filter/273309)
**Author:** [@Enrique\_Pedroza](https://discuss.elastic.co/u/Enrique_Pedroza)\ **Replies:** 4\ **Last updated:** [May 19, 2021, 8:55am UTC](https://discuss.elastic.co/t/what-is-the-propper-way-to-create-in-logstash-checkpoint-filter/273309 "2021-05-19T08:55:21Z")
I have a ELK stack in my server, in other pc i have filebeat listening for Checkpoint syslogs. I know i have to write the filters in a .conf file. This is mine : filter{ if "checkpoint-firewall" in \[tags\] { gro… --- ## [Convert cluster to single node](https://discuss.elastic.co/t/convert-cluster-to-single-node/273368)
**Author:** [@macho](https://discuss.elastic.co/u/macho)\ **Replies:** 5\ **Last updated:** [May 19, 2021, 8:44am UTC](https://discuss.elastic.co/t/convert-cluster-to-single-node/273368 "2021-05-19T08:44:29Z")
Sorry for probably a stupid question, but I am relatively new to elasticsearch. My Problem is, I have a running cluster on three different machines. As this machines were never on the limit we want to use (at least) on… --- ## [Using different Index names in Output logstash](https://discuss.elastic.co/t/using-different-index-names-in-output-logstash/273364)
**Author:** [@Saravana37](https://discuss.elastic.co/u/Saravana37)\ **Replies:** 4\ **Last updated:** [May 19, 2021, 8:21am UTC](https://discuss.elastic.co/t/using-different-index-names-in-output-logstash/273364 "2021-05-19T08:21:08Z")
Hello All , I want to re-use the config lines in output logstash as shown below. I am using if condition but is throwing some error. Please help me out. output { elasticsearch { hosts =\> \["https://… --- ## [Exporting GCP stackdriver log to elasticsearch on premise](https://discuss.elastic.co/t/exporting-gcp-stackdriver-log-to-elasticsearch-on-premise/273343)
**Author:** [@soufiane\_adn](https://discuss.elastic.co/u/soufiane_adn)\ **Replies:** 5\ **Last updated:** [May 19, 2021, 7:45am UTC](https://discuss.elastic.co/t/exporting-gcp-stackdriver-log-to-elasticsearch-on-premise/273343 "2021-05-19T07:45:29Z")
Hello team, can we export logs from google cloud GCP (stackdriver) to an elasticsearch on premise? I found the link below, but they assume that elasticsearch is established on elastic cloud, on my case I have a local c… --- ## [Performance Issues in Multi-Level Terms Aggregation](https://discuss.elastic.co/t/performance-issues-in-multi-level-terms-aggregation/273369)
**Author:** [@Prasiddha](https://discuss.elastic.co/u/Prasiddha)\ **Replies:** 0\ **Last updated:** [May 19, 2021, 7:11am UTC](https://discuss.elastic.co/t/performance-issues-in-multi-level-terms-aggregation/273369 "2021-05-19T07:11:23Z")
For the introduction, we are running into a performance issues when multi-level terms aggregation is being applied. We’re trying to implement multi-level Terms aggregation, up-to 5 levels and running into performance is… --- ## [How to confirm audit logging is enabled](https://discuss.elastic.co/t/how-to-confirm-audit-logging-is-enabled/272888)
**Author:** [@knagasri](https://discuss.elastic.co/u/knagasri)\ **Replies:** 3\ **Last updated:** [May 19, 2021, 6:40am UTC](https://discuss.elastic.co/t/how-to-confirm-audit-logging-is-enabled/272888 "2021-05-19T06:40:56Z")
I had deployed elasticsearch-operator(1.3.0) with elasticsearch 7.9.0 in GKE. I have used below line in my elasticsearch.yaml to enable audit logging: xpack.security.audit.enabled: true As per the documentation(Enabli… --- ## [Wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo apt-key add - no response loading for long time](https://discuss.elastic.co/t/wget-qo-https-artifacts-elastic-co-gpg-key-elasticsearch-sudo-apt-key-add-no-response-loading-for-long-time/273230)
**Author:** [@Rahul\_Ravichandran](https://discuss.elastic.co/u/Rahul_Ravichandran)\ **Replies:** 2\ **Last updated:** [May 19, 2021, 1:52am UTC](https://discuss.elastic.co/t/wget-qo-https-artifacts-elastic-co-gpg-key-elasticsearch-sudo-apt-key-add-no-response-loading-for-long-time/273230 "2021-05-19T01:52:44Z")
Hey guys Im trying to install logstash and the very first command is wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo apt-key add - as given in the steps to install in this link Installing Logstash… --- ## [Can we send a query with ignorable field to Elasticsearch?](https://discuss.elastic.co/t/can-we-send-a-query-with-ignorable-field-to-elasticsearch/272975)
**Author:** [@Anonymous\_Soul](https://discuss.elastic.co/u/Anonymous_Soul)\ **Replies:** 4\ **Last updated:** [May 19, 2021, 2:18am UTC](https://discuss.elastic.co/t/can-we-send-a-query-with-ignorable-field-to-elasticsearch/272975 "2021-05-19T02:18:44Z")
Hi Team, Suppose we are a team with 100 other teams querying our cluster, either through Kibana or Elasticsearch APIs Can we identify those with a special field like a uniqueID specific to one team but those fields are… --- ## [Problem upgrading to 7.12.1](https://discuss.elastic.co/t/problem-upgrading-to-7-12-1/273353)
**Author:** [@Jerry\_Hoffmeister](https://discuss.elastic.co/u/Jerry_Hoffmeister)\ **Replies:** 4\ **Last updated:** [May 19, 2021, 2:14am UTC](https://discuss.elastic.co/t/problem-upgrading-to-7-12-1/273353 "2021-05-19T02:14:24Z")
Hi, I'm upgrading a single node, dev instance of elasticsearch running 6.4.2 to 7.12.1 as the first step in getting ready to upgrade our prod cluster. I was able to upgrade from 6.4.2 -\> 6.8.15 without issue but on upg… --- ## [Visualisation: Term, field not in list](https://discuss.elastic.co/t/visualisation-term-field-not-in-list/273116)
**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Replies:** 4\ **Last updated:** [May 19, 2021, 1:43am UTC](https://discuss.elastic.co/t/visualisation-term-field-not-in-list/273116 "2021-05-19T01:43:09Z")
I am trying to make a standard time on x axis stacked bar chart but when I try and split the bar the on a term the field I want to use is not listed. here is a sample raw record (trimmed for brevity). Important fields… --- ## [ES Index Insert-Update Issues](https://discuss.elastic.co/t/es-index-insert-update-issues/272989)
**Author:** [@vikramnr](https://discuss.elastic.co/u/vikramnr)\ **Replies:** 2\ **Last updated:** [May 19, 2021, 1:30am UTC](https://discuss.elastic.co/t/es-index-insert-update-issues/272989 "2021-05-19T01:30:05Z")
We have an index which updated every 5th minutes and at that 5th min the same index is updated six times for different sets of columns.We are using upsert to update and insert, if the value is not present. We also have \_… --- ## [Regarding the security of the ELK stack docker images](https://discuss.elastic.co/t/regarding-the-security-of-the-elk-stack-docker-images/272895)
**Author:** [@signum](https://discuss.elastic.co/u/signum)\ **Replies:** 2\ **Last updated:** [May 19, 2021, 1:14am UTC](https://discuss.elastic.co/t/regarding-the-security-of-the-elk-stack-docker-images/272895 "2021-05-19T01:14:06Z")
Hi, I am trying out the docker version of the ELK stack, and have noted that when I scan it using trivy / "docker scan", it is showing some OS related vulnerabilities for libraries such curl etc. Can I understand if thes… --- ## [Specifying endpoint for performing reading/writing operations](https://discuss.elastic.co/t/specifying-endpoint-for-performing-reading-writing-operations/273304)
**Author:** [@pkaramol](https://discuss.elastic.co/u/pkaramol)\ **Replies:** 1\ **Last updated:** [May 19, 2021, 1:13am UTC](https://discuss.elastic.co/t/specifying-endpoint-for-performing-reading-writing-operations/273304 "2021-05-19T01:13:07Z")
Assuming we are trying to perform a read and/or a write operation on an es cluster reachable at https://my-es-cluster Assuming this cluster is deployed on kubernetes and we have a way to directly reach a master service… --- ## [A little confused about JAVA requirement to install ES 6.8.15 in a clean Ubuntu 18.04 server](https://discuss.elastic.co/t/a-little-confused-about-java-requirement-to-install-es-6-8-15-in-a-clean-ubuntu-18-04-server/273306)
**Author:** [@cis4life](https://discuss.elastic.co/u/cis4life)\ **Replies:** 2\ **Last updated:** [May 19, 2021, 1:11am UTC](https://discuss.elastic.co/t/a-little-confused-about-java-requirement-to-install-es-6-8-15-in-a-clean-ubuntu-18-04-server/273306 "2021-05-19T01:11:45Z")
I'm about to install ES 6.8.15 on a CLEAN ubuntu 18.04 server. I know I need JAVA, the question is when i stood up a clean VM with Ubuntu 18.04, It DOES NOT have any JAVA installed at all. So I'm going to have to insta… --- ## [Gauge vusualization](https://discuss.elastic.co/t/gauge-vusualization/272912)
**Author:** [@DivinLobo](https://discuss.elastic.co/u/DivinLobo)\ **Replies:** 3\ **Last updated:** [May 18, 2021, 10:12pm UTC](https://discuss.elastic.co/t/gauge-vusualization/272912 "2021-05-18T22:12:46Z")
I've recently started trying out Elasticsearch and Kibana and I am trying out the Gauge graph I am taking the average value of a field and set up the custom ranges like so. I would Like to Know if it is possible t… --- ## [Grok patterns with quotation marks](https://discuss.elastic.co/t/grok-patterns-with-quotation-marks/273003)
**Author:** [@qttv](https://discuss.elastic.co/u/qttv)\ **Replies:** 17\ **Last updated:** [May 18, 2021, 10:01pm UTC](https://discuss.elastic.co/t/grok-patterns-with-quotation-marks/273003 "2021-05-18T22:01:48Z")
Good Evening, I'm trying to extrapolate some fields from the following log message: { "message": "Throw: Il prodotto estratto non è presente tra quelli del menu a tendina in fase di emissione della proposta", "level":… --- ## [Showing image in markdown with api call](https://discuss.elastic.co/t/showing-image-in-markdown-with-api-call/272906)
**Author:** [@DILIP\_SHARMA](https://discuss.elastic.co/u/DILIP_SHARMA)\ **Replies:** 3\ **Last updated:** [May 18, 2021, 9:34pm UTC](https://discuss.elastic.co/t/showing-image-in-markdown-with-api-call/272906 "2021-05-18T21:34:41Z")
hi i am trying to show s3 images in Kibana markdown if i direct pass image URL like below , its showing image without any issue - !\[test\](imageurl) But i m using signed URL , for that i m passing API path in markdown … --- ## [Disabling controls in dashboard](https://discuss.elastic.co/t/disabling-controls-in-dashboard/273027)
**Author:** [@Alexandre.Bernier](https://discuss.elastic.co/u/Alexandre.Bernier)\ **Replies:** 4\ **Last updated:** [May 18, 2021, 5:15pm UTC](https://discuss.elastic.co/t/disabling-controls-in-dashboard/273027 "2021-05-18T17:15:23Z")
Hello there, I'm running the stack 7.10 and I would like to know if there is a way to disable a control in a dashboard? Since we can't pre-filter a control (issue #17301) to display a single value or exclude differents… --- ## [Grokparsefailure on logstash](https://discuss.elastic.co/t/grokparsefailure-on-logstash/273047)
**Author:** [@srk1](https://discuss.elastic.co/u/srk1)\ **Replies:** 8\ **Last updated:** [May 18, 2021, 5:12pm UTC](https://discuss.elastic.co/t/grokparsefailure-on-logstash/273047 "2021-05-18T17:12:29Z")
Hi ES users, i'm trying to send a simple log using filebeat on to ES via logstash and i'm experiencing grokparsefailure errors on kibana. Can someone please assist on what type of grok filter needs to be used? Below is t… --- ## [Duplicate logstash-\*](https://discuss.elastic.co/t/duplicate-logstash/271474)
**Author:** [@Bency\_Mathew](https://discuss.elastic.co/u/Bency_Mathew)\ **Replies:** 2\ **Last updated:** [May 18, 2021, 4:27pm UTC](https://discuss.elastic.co/t/duplicate-logstash/271474 "2021-05-18T16:27:59Z")
f there are two pattern's with same name, say for example logstash- (deafult)\* logstash-\* field\_id shows up in logstash- (\* default ) FieldID shows up in logstash-\* (Once we delete the non-default index logstash-\* … --- ## [Notifications:banner](https://discuss.elastic.co/t/notifications-banner/273259)
**Author:** [@Bency\_Mathew](https://discuss.elastic.co/u/Bency_Mathew)\ **Replies:** 1\ **Last updated:** [May 18, 2021, 4:23pm UTC](https://discuss.elastic.co/t/notifications-banner/273259 "2021-05-18T16:23:09Z")
Adding notifications:banner to kibana.yml.j2 file fails notifications.banner: "Steps to raise a \[Wiki access request for Kibana \](Wiki URL) --- ## [Multi\_terms aggregation gives me an error](https://discuss.elastic.co/t/multi-terms-aggregation-gives-me-an-error/272328)
**Author:** [@pmsearcher](https://discuss.elastic.co/u/pmsearcher)\ **Replies:** 3\ **Last updated:** [May 18, 2021, 4:13pm UTC](https://discuss.elastic.co/t/multi-terms-aggregation-gives-me-an-error/272328 "2021-05-18T16:13:31Z")
Hello ! I'm trying to use ElasticSearch v. 7.11.1 on Windows 10. I don't know how to make multi\_terms aggregation work. This query: { "aggs": { "test\_agg": { "multi\_terms": { "terms": \[{ "… --- ## [Elastic endpoint is not sending to TLS protected cluster](https://discuss.elastic.co/t/elastic-endpoint-is-not-sending-to-tls-protected-cluster/273080)
**Author:** [@Bert\_Colemont](https://discuss.elastic.co/u/Bert_Colemont)\ **Replies:** 3\ **Last updated:** [May 18, 2021, 3:52pm UTC](https://discuss.elastic.co/t/elastic-endpoint-is-not-sending-to-tls-protected-cluster/273080 "2021-05-18T15:52:18Z")
Hi all, I have managed to setup an elastic cluster with 3 nodes. Kibana is running on node-1 Now I installed the elastic endpoint agent to my windows machine. .\\elastic-agent.exe install -f --kibana-url=http://elasti… --- ## [Listen loop error: #\](https://discuss.elastic.co/t/listen-loop-error-ioerror-closed-stream/273314)
**Author:** [@Carlos\_Velasquez](https://discuss.elastic.co/u/Carlos_Velasquez)\ **Replies:** 0\ **Last updated:** [May 18, 2021, 3:49pm UTC](https://discuss.elastic.co/t/listen-loop-error-ioerror-closed-stream/273314 "2021-05-18T15:49:51Z")
Hi, When I start the logstash (manual invocation), I receive the folowing error. the version i'm using is 7.12.1 and Centos 8 Operating System: CentOS Linux 8 CPE OS Name: cpe:/o:centos:centos:8 K… --- ## [Replay rule on old index dates](https://discuss.elastic.co/t/replay-rule-on-old-index-dates/272857)
**Author:** [@priamai](https://discuss.elastic.co/u/priamai)\ **Replies:** 9\ **Last updated:** [May 18, 2021, 2:56pm UTC](https://discuss.elastic.co/t/replay-rule-on-old-index-dates/272857 "2021-05-18T14:56:34Z")
Hi there, I have 90 days worth of windows event logs (partitioned per day) and a set of rules that I want to apply on those days. I noticed that when I activate a rule it can only go forward in time, is there a way to … --- ## [Logstash: формирование @timestamp, используя имя файла лога и данные самого лога](https://discuss.elastic.co/t/logstash-timestamp/273303)
**Author:** [@lkfmasd](https://discuss.elastic.co/u/lkfmasd)\ **Replies:** 1\ **Last updated:** [May 18, 2021, 2:55pm UTC](https://discuss.elastic.co/t/logstash-timestamp/273303 "2021-05-18T14:55:26Z")
Добрый день. На текущий момент поле @timestamp формируется, исходя из даты, когда данные были переданы в elastic. Подскажите пожалуйста, как в logstash полностью сформировать @timestamp при условии, что каждый файл лог… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=943) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=945)