# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=945 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 946 --- ## [Logstash: формирование @timestamp, используя имя файла лога и данные самого лога](https://discuss.elastic.co/t/logstash-timestamp/273303)
**Author:** [@lkfmasd](https://discuss.elastic.co/u/lkfmasd)\ **Replies:** 1\ **Last updated:** [May 18, 2021, 2:55pm UTC](https://discuss.elastic.co/t/logstash-timestamp/273303 "2021-05-18T14:55:26Z")
Добрый день. На текущий момент поле @timestamp формируется, исходя из даты, когда данные были переданы в elastic. Подскажите пожалуйста, как в logstash полностью сформировать @timestamp при условии, что каждый файл лог… --- ## [7.12.1 threshold rule, group by field within actions](https://discuss.elastic.co/t/7-12-1-threshold-rule-group-by-field-within-actions/272209)
**Author:** [@probson](https://discuss.elastic.co/u/probson)\ **Replies:** 5\ **Last updated:** [May 18, 2021, 2:43pm UTC](https://discuss.elastic.co/t/7-12-1-threshold-rule-group-by-field-within-actions/272209 "2021-05-18T14:43:09Z")
Hi, With 7.12.1 i can see our group by field appearing in the detection event, in this case it is host.name. I have tried pushing through within the actions but it is still empty. I am trying to access this data in se… --- ## [Sorting a percentile aggregation](https://discuss.elastic.co/t/sorting-a-percentile-aggregation/273298)
**Author:** [@chapmantrain](https://discuss.elastic.co/u/chapmantrain)\ **Replies:** 0\ **Last updated:** [May 18, 2021, 1:58pm UTC](https://discuss.elastic.co/t/sorting-a-percentile-aggregation/273298 "2021-05-18T13:58:33Z")
Is it possible to sort a percentile aggregation? The query is: "size": 0, "query": { "bool": { "must": \[ { "range": { "dttm": { "gte": "now-24h", "… --- ## [Elasticsearch won't start with Ansible service module](https://discuss.elastic.co/t/elasticsearch-wont-start-with-ansible-service-module/273297)
**Author:** [@Ferencz](https://discuss.elastic.co/u/Ferencz)\ **Replies:** 0\ **Last updated:** [May 18, 2021, 1:51pm UTC](https://discuss.elastic.co/t/elasticsearch-wont-start-with-ansible-service-module/273297 "2021-05-18T13:51:48Z")
Hi all, I'm using Ansible to install Elasticsearch and when I want to start the Elasticsearch with service module it won't start but when I execute "service elasticsearch start" manually it is working normally. Ansible… --- ## [Having problem getting syslog to show on Elasticsearch](https://discuss.elastic.co/t/having-problem-getting-syslog-to-show-on-elasticsearch/273179)
**Author:** [@Praewpun](https://discuss.elastic.co/u/Praewpun)\ **Replies:** 4\ **Last updated:** [May 18, 2021, 1:41pm UTC](https://discuss.elastic.co/t/having-problem-getting-syslog-to-show-on-elasticsearch/273179 "2021-05-18T13:41:24Z")
Hi, I'm having problems trying to get syslog sent by external sources to logstash, then to elasticsearch (Kibana). I think the problem is that I don't understand what should the host and port should be specified. Here … --- ## [Unassigned\_shards":1](https://discuss.elastic.co/t/unassigned-shards-1/273083)
**Author:** [@jeyasingh\_t](https://discuss.elastic.co/u/jeyasingh_t)\ **Replies:** 3\ **Last updated:** [May 18, 2021, 1:40pm UTC](https://discuss.elastic.co/t/unassigned-shards-1/273083 "2021-05-18T13:40:01Z")
Hi, We use 6.8.1 with 3 cluster and got into this situation due to one of the hosts ran out of storage. I used the below command to address the read-only index. curl -X PUT 'http://xxxxxxxxxxxxx:9200/\_all/\_settings -H … --- ## [Applying global Time filter within a visualization to other dates](https://discuss.elastic.co/t/applying-global-time-filter-within-a-visualization-to-other-dates/273248)
**Author:** [@Thomas\_Pierrot](https://discuss.elastic.co/u/Thomas_Pierrot)\ **Replies:** 2\ **Last updated:** [May 18, 2021, 1:30pm UTC](https://discuss.elastic.co/t/applying-global-time-filter-within-a-visualization-to-other-dates/273248 "2021-05-18T13:30:53Z")
Hi, I'm creating a visualization and I need to filter some dates using the same time range selected in the time picker and I simply don't know how to do so. Basically, I'm creating a visualization based on an index th… --- ## [Grok hhtp](https://discuss.elastic.co/t/grok-hhtp/273292)
**Author:** [@delacoche28](https://discuss.elastic.co/u/delacoche28)\ **Replies:** 0\ **Last updated:** [May 18, 2021, 1:28pm UTC](https://discuss.elastic.co/t/grok-hhtp/273292 "2021-05-18T13:28:06Z")
hello with this log line: HTTP/1.0" 200 285 "-" "-" 30.853 I want to have a word to have paterns like : protocole : HTPP HTTP\_VERSION: 1.0 THX --- ## [Bad Top values on Data table](https://discuss.elastic.co/t/bad-top-values-on-data-table/273276)
**Author:** [@Arethusa](https://discuss.elastic.co/u/Arethusa)\ **Replies:** 2\ **Last updated:** [May 18, 2021, 12:28pm UTC](https://discuss.elastic.co/t/bad-top-values-on-data-table/273276 "2021-05-18T12:28:37Z")
Hello, I'm on Kibana V7.12.0 I have inconsistent values on data table : Like you see, I have lot of Other value... But, I can understant why (the limits of 100 values). But you can see "RepMgr.exe" is on second posi… --- ## [Local install with ansible role](https://discuss.elastic.co/t/local-install-with-ansible-role/273274)
**Author:** [@uysalnet\_io](https://discuss.elastic.co/u/uysalnet_io)\ **Replies:** 0\ **Last updated:** [May 18, 2021, 11:47am UTC](https://discuss.elastic.co/t/local-install-with-ansible-role/273274 "2021-05-18T11:47:06Z")
Hi, I am using official ansible role to deploy cluster but I didn't understand if this role supports local installation of elasticsearch packages. By default this role using official elasticsearch repos to download pack… --- ## [Detect Horizontal Port Scan](https://discuss.elastic.co/t/detect-horizontal-port-scan/272710)
**Author:** [@pmorenosi](https://discuss.elastic.co/u/pmorenosi)\ **Replies:** 1\ **Last updated:** [May 18, 2021, 11:23am UTC](https://discuss.elastic.co/t/detect-horizontal-port-scan/272710 "2021-05-18T11:23:09Z")
Hello everyone, From the logs that I have stored in Elasticsearch from a Firewall, I need to detect a type of attack called "Horizontal Port Scan" that is defined as follows: Unique source IP address that has "N" differ… --- ## [Elastic Cloud Enterprise 2.9.2 released](https://discuss.elastic.co/t/elastic-cloud-enterprise-2-9-2-released/273271)
**Author:** [@AranK](https://discuss.elastic.co/u/AranK)\ **Replies:** 0\ **Last updated:** [May 18, 2021, 11:22am UTC](https://discuss.elastic.co/t/elastic-cloud-enterprise-2-9-2-released/273271 "2021-05-18T11:22:55Z")
We are pleased to announce that ECE 2.9.2 has been released today. This is a bugfix release. Release notes: Elastic Cloud Enterprise 2.9.2 | Elastic Cloud Enterprise Reference \[2.9\] | Elastic --- ## [Logstash Syslog input plugin | @timestamp issue](https://discuss.elastic.co/t/logstash-syslog-input-plugin-timestamp-issue/273244)
**Author:** [@stillfreem](https://discuss.elastic.co/u/stillfreem)\ **Replies:** 1\ **Last updated:** [May 18, 2021, 11:04am UTC](https://discuss.elastic.co/t/logstash-syslog-input-plugin-timestamp-issue/273244 "2021-05-18T11:04:13Z")
Hi, I faced a brick wall and I seem to not be able to overcome it. My scenario FW logs coming to a server where they are caught by Syslog-ng Syslog-ng passes the logs to Logstash on the same server Currently, as a test… --- ## [Elastic search duplicate document with same Id and different routing](https://discuss.elastic.co/t/elastic-search-duplicate-document-with-same-id-and-different-routing/273242)
**Author:** [@Mohanapriya\_Gopal1](https://discuss.elastic.co/u/Mohanapriya_Gopal1)\ **Replies:** 2\ **Last updated:** [May 18, 2021, 10:39am UTC](https://discuss.elastic.co/t/elastic-search-duplicate-document-with-same-id-and-different-routing/273242 "2021-05-18T10:39:55Z")
While indexing using logstash from db to elastic, we got duplicate documents with same Id and different routing.how canwe fix this --- ## [Influence of Master Nodes and Large Cluster State on Search](https://discuss.elastic.co/t/influence-of-master-nodes-and-large-cluster-state-on-search/273103)
**Author:** [@itays](https://discuss.elastic.co/u/itays)\ **Replies:** 7\ **Last updated:** [May 18, 2021, 10:35am UTC](https://discuss.elastic.co/t/influence-of-master-nodes-and-large-cluster-state-on-search/273103 "2021-05-18T10:35:06Z")
Hey, We are running in production an elasticsearch cluster. The setup is: 10 data nodes - 8 cpus and 64G ram, half is heap 3 master nodes - 4 cpus and 16g ram, half is heap In our cluster we have large number of indi… --- ## [Want to create an index already present in index management using API](https://discuss.elastic.co/t/want-to-create-an-index-already-present-in-index-management-using-api/273212)
**Author:** [@Changra](https://discuss.elastic.co/u/Changra)\ **Replies:** 3\ **Last updated:** [May 18, 2021, 10:03am UTC](https://discuss.elastic.co/t/want-to-create-an-index-already-present-in-index-management-using-api/273212 "2021-05-18T10:03:11Z")
Hi Team, I am trying to create index which is already present in the index management using API . But I am unable to execute any API . Please Help me with it. --- ## [Split data into into two sets (test/train)](https://discuss.elastic.co/t/split-data-into-into-two-sets-test-train/273236)
**Author:** [@eliase](https://discuss.elastic.co/u/eliase)\ **Replies:** 3\ **Last updated:** [May 18, 2021, 9:01am UTC](https://discuss.elastic.co/t/split-data-into-into-two-sets-test-train/273236 "2021-05-18T09:01:49Z")
Hi, for machine learning validation I would like to split the data in elastic search into two sets. The random score in combination with the size parameter would give me one set but how can I obtain all other documents… --- ## [Geo\_point automatically](https://discuss.elastic.co/t/geo-point-automatically/273183)
**Author:** [@Emi\_lie](https://discuss.elastic.co/u/Emi_lie)\ **Replies:** 4\ **Last updated:** [May 18, 2021, 8:40am UTC](https://discuss.elastic.co/t/geo-point-automatically/273183 "2021-05-18T08:40:00Z")
Hello, I struggle to add the geo\_point to my index, automatically. All the solutions I found, official and unofficial, indicate that it is necessary to pass by the devTools to make a PUT of the index. But I use elastic… --- ## [UDP packets cover 50% of packetbeat logs](https://discuss.elastic.co/t/udp-packets-cover-50-of-packetbeat-logs/272689)
**Author:** [@ethical20](https://discuss.elastic.co/u/ethical20)\ **Replies:** 7\ **Last updated:** [May 18, 2021, 8:34am UTC](https://discuss.elastic.co/t/udp-packets-cover-50-of-packetbeat-logs/272689 "2021-05-18T08:34:24Z")
Hi, I can see that 50% of my packetbeat logs are from network.transport: udp . In terms of SIEM perspective do I need this types of logs in kibana? (I don't use any VOIP or streaming services on my monitored machine.) … --- ## [Failed to parse date field](https://discuss.elastic.co/t/failed-to-parse-date-field/272657)
**Author:** [@KarlWolf](https://discuss.elastic.co/u/KarlWolf)\ **Replies:** 4\ **Last updated:** [May 18, 2021, 6:09am UTC](https://discuss.elastic.co/t/failed-to-parse-date-field/272657 "2021-05-18T06:09:10Z")
Hello, I'm new in topic ELK stuff and I try to solve my problem with date parsing. I have two fields with date and time stamp which I connected together. Then I want mark that pool as Date and send to Elastic: My Log l… --- ## [Can we connect one Logstash node with Both Licensed & Open source elastic stack?](https://discuss.elastic.co/t/can-we-connect-one-logstash-node-with-both-licensed-open-source-elastic-stack/273162)
**Author:** [@muralikrishna](https://discuss.elastic.co/u/muralikrishna)\ **Replies:** 2\ **Last updated:** [May 18, 2021, 2:51am UTC](https://discuss.elastic.co/t/can-we-connect-one-logstash-node-with-both-licensed-open-source-elastic-stack/273162 "2021-05-18T02:51:51Z")
Hi All, I would like to understand, If we can connect one Logstash node with Both Licensed & Open source elasticsearch nodes at a time ? currently we are using licensed elasticsearch for centralized pipelined managemen… --- ## [Updating OS packages when using ansible role](https://discuss.elastic.co/t/updating-os-packages-when-using-ansible-role/273213)
**Author:** [@biggtimber](https://discuss.elastic.co/u/biggtimber)\ **Replies:** 2\ **Last updated:** [May 18, 2021, 1:53am UTC](https://discuss.elastic.co/t/updating-os-packages-when-using-ansible-role/273213 "2021-05-18T01:53:09Z")
How is it recommended to run OS updates on the ES nodes that are maintained by the ansible role. Should the ES and Java packages be version locked, and will that effect upgrading the nodes later? --- ## [Easiest Way To Install Elastic... apt-get install or wget](https://discuss.elastic.co/t/easiest-way-to-install-elastic-apt-get-install-or-wget/272879)
**Author:** [@cis4life](https://discuss.elastic.co/u/cis4life)\ **Replies:** 13\ **Last updated:** [May 18, 2021, 12:13am UTC](https://discuss.elastic.co/t/easiest-way-to-install-elastic-apt-get-install-or-wget/272879 "2021-05-18T00:13:16Z")
Good Day, In your opinion, what is the easiest way to get Elasticsearch 6.18.5 onto Ubuntu 18.04 servers. I'm looking at this ES guide here... Install Elasticsearch with Debian Package | Elasticsearch Guide \[6.8\] | Ela… --- ## [Threat hunting with suricata, ElasticSecurity](https://discuss.elastic.co/t/threat-hunting-with-suricata-elasticsecurity/273148)
**Author:** [@111387](https://discuss.elastic.co/u/111387)\ **Replies:** 1\ **Last updated:** [May 17, 2021, 11:51pm UTC](https://discuss.elastic.co/t/threat-hunting-with-suricata-elasticsecurity/273148 "2021-05-17T23:51:07Z")
Good morning. I have built a suricata, and I am delivering events to elasticsearch with filebeat. There are various detection rules in elasticsecurity, but among them, detection rules for suricata (ET Rule) do not exis… --- ## [How to avoid jvm error in python elasticsearch rest client](https://discuss.elastic.co/t/how-to-avoid-jvm-error-in-python-elasticsearch-rest-client/273161)
**Author:** [@rknd](https://discuss.elastic.co/u/rknd)\ **Replies:** 5\ **Last updated:** [May 17, 2021, 11:13pm UTC](https://discuss.elastic.co/t/how-to-avoid-jvm-error-in-python-elasticsearch-rest-client/273161 "2021-05-17T23:13:28Z")
I have 10 elasticsearch nodes in one server(cluster), all nodes have 2gb jvm heap size. I have a python rest client for elasticsearch. With that client I fetch datas from elasticsearch and re-indexing with new datas. I… --- ## [Possible to only find new entries since last search?](https://discuss.elastic.co/t/possible-to-only-find-new-entries-since-last-search/273173)
**Author:** [@Sandra\_Schlichting](https://discuss.elastic.co/u/Sandra_Schlichting)\ **Replies:** 1\ **Last updated:** [May 17, 2021, 11:12pm UTC](https://discuss.elastic.co/t/possible-to-only-find-new-entries-since-last-search/273173 "2021-05-17T23:12:11Z")
Dear all =) Does anyone know if it is possible to make a query that searched for error\_event:1 and the next time I run it, it only shows the new entries since last search? Hugs, Sandra =) --- ## [Authentication to realm default\_file failed](https://discuss.elastic.co/t/authentication-to-realm-default-file-failed/205237)
**Author:** [@pabloborh](https://discuss.elastic.co/u/pabloborh)\ **Replies:** 4\ **Last updated:** [May 17, 2021, 10:29pm UTC](https://discuss.elastic.co/t/authentication-to-realm-default-file-failed/205237 "2021-05-17T22:29:13Z")
Hi! I have a elasticsearch cluster deployed with ECK. The pods are logging: level": "WARN", "component": "o.e.x.s.a.AuthenticationService", "cluster.name": "elasticsearch", "node.name": "elasticsearch-es-data-6ff4cgt49… --- ## [Search plugin with custom query getting IllegalAccessError](https://discuss.elastic.co/t/search-plugin-with-custom-query-getting-illegalaccesserror/273221)
**Author:** [@elelliot](https://discuss.elastic.co/u/elelliot)\ **Replies:** 0\ **Last updated:** [May 17, 2021, 8:55pm UTC](https://discuss.elastic.co/t/search-plugin-with-custom-query-getting-illegalaccesserror/273221 "2021-05-17T20:55:00Z")
I'm having an issue with installing a custom query in my elasticsearch plugin. For my use case, I have a custom query PayloadPhraseQuery that uses many of the other existing Lucene phrase query code. However when I run … --- ## [Logstash install and startup error](https://discuss.elastic.co/t/logstash-install-and-startup-error/273208)
**Author:** [@MKirby](https://discuss.elastic.co/u/MKirby)\ **Replies:** 7\ **Last updated:** [May 17, 2021, 7:46pm UTC](https://discuss.elastic.co/t/logstash-install-and-startup-error/273208 "2021-05-17T19:46:19Z")
Good Afternoon; I am new to the ELK tools and am in the midst of a proof of concept using them. I am testing on a Windows 10 Professional box and have been able to install and get running both ElasticSearch and Kibana… --- ## [Analyzing profiling results](https://discuss.elastic.co/t/analyzing-profiling-results/273071)
**Author:** [@alexs1](https://discuss.elastic.co/u/alexs1)\ **Replies:** 4\ **Last updated:** [May 17, 2021, 4:51pm UTC](https://discuss.elastic.co/t/analyzing-profiling-results/273071 "2021-05-17T16:51:26Z")
Hello, I'm migrating a cluster from an old one, and for some reason, after reindexing by best practices (than I know), performance are slower in the new cluster. the first has 500GB- 5 shards and 1 replica the new clu… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=944) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=946)