# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=955 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 956 --- ## [Readiness probe failed: Waiting for elasticsearch cluster to become ready](https://discuss.elastic.co/t/readiness-probe-failed-waiting-for-elasticsearch-cluster-to-become-ready/272273)
**Author:** [@vbharath2007](https://discuss.elastic.co/u/vbharath2007)\ **Replies:** 1\ **Last updated:** [May 7, 2021, 9:42am UTC](https://discuss.elastic.co/t/readiness-probe-failed-waiting-for-elasticsearch-cluster-to-become-ready/272273 "2021-05-07T09:42:59Z")
Hi, I'm running ELK stack using helm charts through the elastic community operator git repo. My ES is a single node cluster, today morning suddenly the pod failed and unable to bring up and receiving the below from the … --- ## [Registry.data.string is null](https://discuss.elastic.co/t/registry-data-string-is-null/272085)
**Author:** [@Nil\_Battey\_Sannata](https://discuss.elastic.co/u/Nil_Battey_Sannata)\ **Replies:** 3\ **Last updated:** [May 7, 2021, 9:39am UTC](https://discuss.elastic.co/t/registry-data-string-is-null/272085 "2021-05-07T09:39:36Z")
As per below logs from endpoint the field name from kibana registry.data.string should contain the value of data string from ImagePath, but it is giving Null value. the data which I want to be in registry.data.string it … --- ## [Mapping is different then discover shows](https://discuss.elastic.co/t/mapping-is-different-then-discover-shows/272330)
**Author:** [@alidrsn](https://discuss.elastic.co/u/alidrsn)\ **Replies:** 3\ **Last updated:** [May 7, 2021, 9:31am UTC](https://discuss.elastic.co/t/mapping-is-different-then-discover-shows/272330 "2021-05-07T09:31:05Z")
Hi there, I am trying to index data which is coming from logstash and ingesting with my ingest-pipeline. I am using index template to use some mapping fields. One of them is response\_time. When i check it from dev to… --- ## [Set Kibana index per Kibana space per beat via API](https://discuss.elastic.co/t/set-kibana-index-per-kibana-space-per-beat-via-api/272395)
**Author:** [@phlegx](https://discuss.elastic.co/u/phlegx)\ **Replies:** 0\ **Last updated:** [May 7, 2021, 9:06am UTC](https://discuss.elastic.co/t/set-kibana-index-per-kibana-space-per-beat-via-api/272395 "2021-05-07T09:06:01Z")
It is possible to set the index per Kibana space for logAlias and metricAlias like this: $ curl -X POST http://your-kibana.example.com/s/\/api/saved\_objects/infrastructure-ui-source/default -H 'kbn-xsrf: true'… --- ## [Filebeat no connection could be made because the target machine actively refused it](https://discuss.elastic.co/t/filebeat-no-connection-could-be-made-because-the-target-machine-actively-refused-it/272302)
**Author:** [@Rashmika\_Gamage](https://discuss.elastic.co/u/Rashmika_Gamage)\ **Replies:** 9\ **Last updated:** [May 7, 2021, 8:55am UTC](https://discuss.elastic.co/t/filebeat-no-connection-could-be-made-because-the-target-machine-actively-refused-it/272302 "2021-05-07T08:55:23Z")
Hi all, I am trying to read logs from beats to logstash in the same machine. I am getting an error no connection could be made because the target machine actively refused it My logstash conf file input { beats … --- ## [Installing Elasticsearch cluster in docker environment](https://discuss.elastic.co/t/installing-elasticsearch-cluster-in-docker-environment/272381)
**Author:** [@mruthyu](https://discuss.elastic.co/u/mruthyu)\ **Replies:** 0\ **Last updated:** [May 7, 2021, 7:43am UTC](https://discuss.elastic.co/t/installing-elasticsearch-cluster-in-docker-environment/272381 "2021-05-07T07:43:25Z")
Would like to know the details related to installing the elasticsearch cluster in docker environment. Considering 3 VMs and having elasticsearch master and data nodes on each of these servers as containers, and also pos… --- ## [Nested Query summation aggregation for a subset received in the source](https://discuss.elastic.co/t/nested-query-summation-aggregation-for-a-subset-received-in-the-source/272038)
**Author:** [@RapTvin](https://discuss.elastic.co/u/RapTvin)\ **Replies:** 1\ **Last updated:** [May 7, 2021, 7:16am UTC](https://discuss.elastic.co/t/nested-query-summation-aggregation-for-a-subset-received-in-the-source/272038 "2021-05-07T07:16:41Z")
Hello everyone, I am trying for a an aggregated summation query on a nested object on the basis of a variable inside it and the summation on another variable present inside it. Till now I have been able to segregate the … --- ## [Not able to query MongoDB.Bson.ObjectId using ElasticSearch Nest Client](https://discuss.elastic.co/t/not-able-to-query-mongodb-bson-objectid-using-elasticsearch-nest-client/272375)
**Author:** [@zeeshan](https://discuss.elastic.co/u/zeeshan)\ **Replies:** 0\ **Last updated:** [May 7, 2021, 7:08am UTC](https://discuss.elastic.co/t/not-able-to-query-mongodb-bson-objectid-using-elasticsearch-nest-client/272375 "2021-05-07T07:08:58Z")
I have an field of type ObjectId (MongoDB.Bson) in my model, and when I index it elastic search server, it looks like following structure in Elastic Search: My question is, how can query (using NEST client) to match t… --- ## [Alternative for Delete By Query or Solution for Performance improvement](https://discuss.elastic.co/t/alternative-for-delete-by-query-or-solution-for-performance-improvement/272298)
**Author:** [@mrunalini](https://discuss.elastic.co/u/mrunalini)\ **Replies:** 5\ **Last updated:** [May 7, 2021, 7:06am UTC](https://discuss.elastic.co/t/alternative-for-delete-by-query-or-solution-for-performance-improvement/272298 "2021-05-07T07:06:29Z")
Hi , We have index in ELK ,where we are storing transaction details ,where we want to delete some records after some time. As quantity of requests is so high ,its taking so much time to complete the execution of the De… --- ## [How do I modify collect specific processes and top 10 processes in metricbeat's system module?](https://discuss.elastic.co/t/how-do-i-modify-collect-specific-processes-and-top-10-processes-in-metricbeats-system-module/272364)
**Author:** [@jongpyo.lee](https://discuss.elastic.co/u/jongpyo.lee)\ **Replies:** 2\ **Last updated:** [May 7, 2021, 7:01am UTC](https://discuss.elastic.co/t/how-do-i-modify-collect-specific-processes-and-top-10-processes-in-metricbeats-system-module/272364 "2021-05-07T07:01:51Z")
I have a question when collecting data from the system module. When collecting processes, I would like to collect the top 10 CPU and memory information. When collecting processes, I want to collect a specific process.n… --- ## [Help with grok pattern](https://discuss.elastic.co/t/help-with-grok-pattern/272351)
**Author:** [@Rahul\_A](https://discuss.elastic.co/u/Rahul_A)\ **Replies:** 1\ **Last updated:** [May 7, 2021, 6:32am UTC](https://discuss.elastic.co/t/help-with-grok-pattern/272351 "2021-05-07T06:32:36Z")
Hi friends, I'm a newbie with grok filter and need help parsing the log message. Here is my log message: 2016-07-11T23:56:42.000+00:00 INFO ALERT|ECE002|5 Error with transaction for session -464410bf-37bf-475a-afc0-49… --- ## [My Docker Elasticsearch Keeps Failing Looking For JAVA?](https://discuss.elastic.co/t/my-docker-elasticsearch-keeps-failing-looking-for-java/272334)
**Author:** [@cis4life](https://discuss.elastic.co/u/cis4life)\ **Replies:** 2\ **Last updated:** [May 7, 2021, 6:13am UTC](https://discuss.elastic.co/t/my-docker-elasticsearch-keeps-failing-looking-for-java/272334 "2021-05-07T06:13:12Z")
Good Day, I'm trying to stand up a demo / test install of ES on Docker for Mac. I have a M1 (ARM) MacBook. When I try to do the docker compose up I get the following error... Attaching to elasticsearch, kibana elast… --- ## [System module 추가시 모든 프로세스 정보 수집하면서 특정 프로세스 수집한 결과와 상위 10개의 프로세스 (Top 10 프로세스)를 함께 수집하고 싶습니다](https://discuss.elastic.co/t/system-module-10-top-10/272363)
**Author:** [@jongpyo.lee](https://discuss.elastic.co/u/jongpyo.lee)\ **Replies:** 0\ **Last updated:** [May 7, 2021, 4:42am UTC](https://discuss.elastic.co/t/system-module-10-top-10/272363 "2021-05-07T04:42:32Z")
system module 의 데이터 수집시 궁금한 사항이 있어서 질문드립니다. processes 수집 할 때 CPU, Memory 정보 Top 10 상위 결과를 수집하고 싶습니다. processes 수집 할 때 특정 process.name 을 수집하고 싶습니다. (ex. Notepad\*, xyz.exe) 두가지의 수집 대상을 함께 수집하여 Visualize를 만들고자 하는데 System… --- ## [Logstash reading syslog from filebeat](https://discuss.elastic.co/t/logstash-reading-syslog-from-filebeat/272354)
**Author:** [@lachlan.simpson](https://discuss.elastic.co/u/lachlan.simpson)\ **Replies:** 1\ **Last updated:** [May 7, 2021, 4:22am UTC](https://discuss.elastic.co/t/logstash-reading-syslog-from-filebeat/272354 "2021-05-07T04:22:11Z")
Using RHEL8, ELK 7.12, I have filebeat 7.12 set up on a RH7 workstation, configured with the syslog plugin and delivering data to logstash. The data is coming into logstash, but it's raw - the message field isn't being … --- ## [\[WARN \] 2021-05-06 23:01:18.054 \[\[marketdata\_fix\_pipeline\]\>worker0\] split - Only String and Array types are splittable. field:\[layers\]\[fix\] is of type = Hash](https://discuss.elastic.co/t/warn-2021-05-06-2318-054-marketdata-fix-pipeline-worker0-split-only-string-and-array-types-are-splittable-field-layers-fix-is-of-type-hash/272344)
**Author:** [@wmei](https://discuss.elastic.co/u/wmei)\ **Replies:** 3\ **Last updated:** [May 7, 2021, 12:16am UTC](https://discuss.elastic.co/t/warn-2021-05-06-2318-054-marketdata-fix-pipeline-worker0-split-only-string-and-array-types-are-splittable-field-layers-fix-is-of-type-hash/272344 "2021-05-07T00:16:08Z")
Hi, I am getting this warning message and I believe it is because some of the events do not have a \[layers\]\[fix\]. \[WARN \] 2021-05-06 23:01:18.054 \[\[marketdata\_fix\_pipeline\]\>worker0\] split - Only String and Array types … --- ## [How to discard specific event from storing or correlation in SIEM to save resources](https://discuss.elastic.co/t/how-to-discard-specific-event-from-storing-or-correlation-in-siem-to-save-resources/271716)
**Author:** [@zoot](https://discuss.elastic.co/u/zoot)\ **Replies:** 1\ **Last updated:** [May 6, 2021, 11:02pm UTC](https://discuss.elastic.co/t/how-to-discard-specific-event-from-storing-or-correlation-in-siem-to-save-resources/271716 "2021-05-06T23:02:20Z")
Hi, In SIEM systems events can be discard or filter to safe diskspace and avoid overloading SIEM from noisy events. This way SIEM resources can be managed at optimum levels. For example windows event 5156 from all agen… --- ## [Brute Force Detection Rule](https://discuss.elastic.co/t/brute-force-detection-rule/271713)
**Author:** [@filip.wozniak](https://discuss.elastic.co/u/filip.wozniak)\ **Replies:** 3\ **Last updated:** [May 6, 2021, 11:00pm UTC](https://discuss.elastic.co/t/brute-force-detection-rule/271713 "2021-05-06T23:00:32Z")
Greetings! I'm using WinlogBeats with configured Sysmon. I want to write my own rule: If any user in last 5 minutes failed to login 5 times, Detection should trigger. So I tried this: This is threshold rule, but I… --- ## [Logstash Elasticsearch Input](https://discuss.elastic.co/t/logstash-elasticsearch-input/272336)
**Author:** [@vishakh](https://discuss.elastic.co/u/vishakh)\ **Replies:** 3\ **Last updated:** [May 6, 2021, 9:52pm UTC](https://discuss.elastic.co/t/logstash-elasticsearch-input/272336 "2021-05-06T21:52:21Z")
I'm trying to extract (or) export logs from Elasticsearch via Logstash I would like to write the extracted logs to a file input { elasticsearch { hosts =\> "elasticsearch.domain.com:9200" query =\> '{ "size": 5… --- ## [Create one custom document if no data is retrive from the JDBC input](https://discuss.elastic.co/t/create-one-custom-document-if-no-data-is-retrive-from-the-jdbc-input/272326)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 1\ **Last updated:** [May 6, 2021, 6:12pm UTC](https://discuss.elastic.co/t/create-one-custom-document-if-no-data-is-retrive-from-the-jdbc-input/272326 "2021-05-06T18:12:39Z")
Hi, Its is posible to index one custom document if no data id retrieve from a database? how can logstash do this? --- ## [Can't access Detections from a different space](https://discuss.elastic.co/t/cant-access-detections-from-a-different-space/272118)
**Author:** [@ManuelF](https://discuss.elastic.co/u/ManuelF)\ **Replies:** 9\ **Last updated:** [May 6, 2021, 8:55pm UTC](https://discuss.elastic.co/t/cant-access-detections-from-a-different-space/272118 "2021-05-06T20:55:49Z")
Hi, \*Running ELK 7.11.2 Standalone I am trying to setup a user to have access to Security in a separate space. I have been following all directions from the official documentation, but the user can't access the "Detect… --- ## [Unable to index a file (Word document) greater than 45 MB](https://discuss.elastic.co/t/unable-to-index-a-file-word-document-greater-than-45-mb/272220)
**Author:** [@saqib619](https://discuss.elastic.co/u/saqib619)\ **Replies:** 5\ **Last updated:** [May 6, 2021, 6:59pm UTC](https://discuss.elastic.co/t/unable-to-index-a-file-word-document-greater-than-45-mb/272220 "2021-05-06T18:59:21Z")
We are trying to index a file (word document) which is \> 45 MB . It is failing throwing an exception as below: Maximum timeout reached while retrying request. Call: Status code unknown from: PUT /test\_index6/\_doc/16601?… --- ## [Index template order fields seems not to work](https://discuss.elastic.co/t/index-template-order-fields-seems-not-to-work/271778)
**Author:** [@Adriann](https://discuss.elastic.co/u/Adriann)\ **Replies:** 6\ **Last updated:** [May 6, 2021, 6:07pm UTC](https://discuss.elastic.co/t/index-template-order-fields-seems-not-to-work/271778 "2021-05-06T18:07:33Z")
Hello, I have few templates each for every index name based on the module name for ilm management. I notice that after the update to 7.12.1 all my indices have applied templates with order value 10 event though there a… --- ## [ECK Operator 1.4 stuck in deployment - Error: no matches for kind "EnterpriseSearch" in version "enterpriseseach.k8s.elastic.co/v1"](https://discuss.elastic.co/t/eck-operator-1-4-stuck-in-deployment-error-no-matches-for-kind-enterprisesearch-in-version-enterpriseseach-k8s-elastic-co-v1/271818)
**Author:** [@Jorge\_Alvarado](https://discuss.elastic.co/u/Jorge_Alvarado)\ **Replies:** 4\ **Last updated:** [May 6, 2021, 5:34pm UTC](https://discuss.elastic.co/t/eck-operator-1-4-stuck-in-deployment-error-no-matches-for-kind-enterprisesearch-in-version-enterpriseseach-k8s-elastic-co-v1/271818 "2021-05-06T17:34:51Z")
Hi, I am trying to deploy eck operator 1.4 but it gets stuck. Using eck operator 1.3.2 deployment works as expected. Also, I've using latest version of elasticsearch 7.12.0 and kibana version 7.12.0. I have attached the… --- ## [Parsing nested json not happening properly](https://discuss.elastic.co/t/parsing-nested-json-not-happening-properly/272282)
**Author:** [@Blason](https://discuss.elastic.co/u/Blason)\ **Replies:** 2\ **Last updated:** [May 6, 2021, 3:20pm UTC](https://discuss.elastic.co/t/parsing-nested-json-not-happening-properly/272282 "2021-05-06T15:20:51Z")
Hi Folks, I am trying to parse modsecurity audit logs which are natively being logged in JSON format. However when I am using logstash to ingest in elastic stack those appears like below and actual needed fields are not… --- ## [How to remove original message field after parsing using json filter](https://discuss.elastic.co/t/how-to-remove-original-message-field-after-parsing-using-json-filter/272306)
**Author:** [@Sandeep4](https://discuss.elastic.co/u/Sandeep4)\ **Replies:** 1\ **Last updated:** [May 6, 2021, 2:51pm UTC](https://discuss.elastic.co/t/how-to-remove-original-message-field-after-parsing-using-json-filter/272306 "2021-05-06T14:51:50Z")
First try:- filter { mutate { gsub =\> \[ "message", "^\\w+\`string\`", "" \] } json { source =\> "message" remove\_field =\> "message" } } Second try:- filter { mutate { gsub =\> \[ "message", "^\\w+\`string\`",… --- ## [Is it possible to replicate the index WITHOUT yellow status? (replication disabled due to faster reindex)](https://discuss.elastic.co/t/is-it-possible-to-replicate-the-index-without-yellow-status-replication-disabled-due-to-faster-reindex/272308)
**Author:** [@astrodi](https://discuss.elastic.co/u/astrodi)\ **Replies:** 2\ **Last updated:** [May 6, 2021, 2:42pm UTC](https://discuss.elastic.co/t/is-it-possible-to-replicate-the-index-without-yellow-status-replication-disabled-due-to-faster-reindex/272308 "2021-05-06T14:42:15Z")
Hi there, due to speedup of re-indexing, I'm setting "number\_of\_replicas": 0 while re-indexing is running. Once finished, than I'm setting 1 replica: PUT bmpf\_claim\_docs\_v2/\_settings { "number\_of\_replicas": 1 } U… --- ## [Text Embedding in Elastic Search](https://discuss.elastic.co/t/text-embedding-in-elastic-search/272242)
**Author:** [@harry\_richard](https://discuss.elastic.co/u/harry_richard)\ **Replies:** 1\ **Last updated:** [May 6, 2021, 2:42pm UTC](https://discuss.elastic.co/t/text-embedding-in-elastic-search/272242 "2021-05-06T14:42:36Z")
Hi All, I have implemented text embedding using doc 2 vec and stored the vectors in elastic search , using cosine similarity I am trying to search for similar texts. But the issue is whenver I am giving a same text twi… --- ## [Cannot read property 'get' of undefined](https://discuss.elastic.co/t/cannot-read-property-get-of-undefined/272199)
**Author:** [@Aqib\_Rehman](https://discuss.elastic.co/u/Aqib_Rehman)\ **Replies:** 3\ **Last updated:** [May 6, 2021, 1:47pm UTC](https://discuss.elastic.co/t/cannot-read-property-get-of-undefined/272199 "2021-05-06T13:47:12Z")
Hi, I'm using Suricata to collect logs on Kibana, after connecting Suricata with Elastic via filebeat, Kibana cannot visualize logs with following error: Cannot read property 'get' of undefined. It receives data but cann… --- ## [Turn on SIEM in Kibana 7.10.2](https://discuss.elastic.co/t/turn-on-siem-in-kibana-7-10-2/271346)
**Author:** [@Atul\_Chadha](https://discuss.elastic.co/u/Atul_Chadha)\ **Replies:** 4\ **Last updated:** [May 6, 2021, 1:15pm UTC](https://discuss.elastic.co/t/turn-on-siem-in-kibana-7-10-2/271346 "2021-05-06T13:15:25Z")
I was able to turn off / on SIEM in kibana 7.8.1 under spaces however this seems to be gone in 7.10.2 How can i enable SIEM in Kibana 7.10.2 ? 7.8.1 7.10.2 --- ## [JSON filter swallowing events with no errors](https://discuss.elastic.co/t/json-filter-swallowing-events-with-no-errors/272221)
**Author:** [@brian\_m](https://discuss.elastic.co/u/brian_m)\ **Replies:** 2\ **Last updated:** [May 6, 2021, 1:14pm UTC](https://discuss.elastic.co/t/json-filter-swallowing-events-with-no-errors/272221 "2021-05-06T13:14:45Z")
Hello, I'm trying to do some testing on ingesting JSON data, and having trouble with the JSON filter. My pipeline configuration is below (output filter has been modified to remove credentials and IPs) input { http {}… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=954) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=956)