# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=992 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 993 --- ## [Using grok filter to parse log file](https://discuss.elastic.co/t/using-grok-filter-to-parse-log-file/269138)
**Author:** [@bab](https://discuss.elastic.co/u/bab)\ **Replies:** 3\ **Last updated:** [April 4, 2021, 1:20pm UTC](https://discuss.elastic.co/t/using-grok-filter-to-parse-log-file/269138 "2021-04-04T13:20:02Z")
Hi guys, i'm trying to parse the following log files, i succeed to filter all fields unless the last one, can some one help pls, thank you. Log file: 1;2;06-19-15;start inbound processing;50034744;1;ok;2021-03-18 16:1… --- ## [Give path as an argument](https://discuss.elastic.co/t/give-path-as-an-argument/269173)
**Author:** [@vincedt09](https://discuss.elastic.co/u/vincedt09)\ **Replies:** 1\ **Last updated:** [April 4, 2021, 12:50pm UTC](https://discuss.elastic.co/t/give-path-as-an-argument/269173 "2021-04-04T12:50:52Z")
Hi! Is there a way to give path as an argument? I was thinking at something like this: input { file { path =\> argv sincedb\_path =\> "NUL" start\_position =\> "beginning" } } logsta… --- ## [Logstash filter with grok](https://discuss.elastic.co/t/logstash-filter-with-grok/269056)
**Author:** [@Automation\_Scripts](https://discuss.elastic.co/u/Automation_Scripts)\ **Replies:** 1\ **Last updated:** [April 1, 2021, 4:39pm UTC](https://discuss.elastic.co/t/logstash-filter-with-grok/269056 "2021-04-01T16:39:29Z")
I have used grok debugger and I've identified the pattern i need for getting the filed id.orig\_h My log looks like this: 1295981543.337241 CCBr9k1C1bSaHQbUhh 192.168.3.131 55954 65.55.17.37 80 tcp http 1.776718 1837 24… --- ## [Don't save in ES logs that have in tag \_grokparsefailure or \_dateparsefailure](https://discuss.elastic.co/t/dont-save-in-es-logs-that-have-in-tag-grokparsefailure-or-dateparsefailure/269141)
**Author:** [@Automation\_Scripts](https://discuss.elastic.co/u/Automation_Scripts)\ **Replies:** 2\ **Last updated:** [April 4, 2021, 5:20am UTC](https://discuss.elastic.co/t/dont-save-in-es-logs-that-have-in-tag-grokparsefailure-or-dateparsefailure/269141 "2021-04-04T05:20:42Z")
Hi, How can i filter the logs that are saved within ES in order to have only valid data that has no grok parse failure or date parse error? My approach is bellow output { if ("\_grokparsefailure" not in \[tags\]) or ("\_… --- ## [Logstash pipeline schedule](https://discuss.elastic.co/t/logstash-pipeline-schedule/269139)
**Author:** [@Farid\_N](https://discuss.elastic.co/u/Farid_N)\ **Replies:** 3\ **Last updated:** [April 4, 2021, 5:18am UTC](https://discuss.elastic.co/t/logstash-pipeline-schedule/269139 "2021-04-04T05:18:45Z")
Hi there I\`ve faced with a problem... I have a running Logstash with multiple pipelines. I just want to run one of these pipelines from 00:00 am until 08:00 am everyday According to Logstash documentation, pipeline co… --- ## [Shrink How to avoid stop writing](https://discuss.elastic.co/t/shrink-how-to-avoid-stop-writing/269154)
**Author:** [@asasas234](https://discuss.elastic.co/u/asasas234)\ **Replies:** 2\ **Last updated:** [April 4, 2021, 2:27am UTC](https://discuss.elastic.co/t/shrink-how-to-avoid-stop-writing/269154 "2021-04-04T02:27:30Z")
I have 1 index with 2 primary shards, I want to narrow it down to 1 shard, I learned through search that it is recommended to achieve through shrink api, but shrink will stop writing, is there any solution to stop writin… --- ## [Count array size in all document](https://discuss.elastic.co/t/count-array-size-in-all-document/269108)
**Author:** [@Giovanni\_Di\_Lembo](https://discuss.elastic.co/u/Giovanni_Di_Lembo)\ **Replies:** 7\ **Last updated:** [April 3, 2021, 8:49pm UTC](https://discuss.elastic.co/t/count-array-size-in-all-document/269108 "2021-04-03T20:49:19Z")
Hi all and sorry for my poor english I have a document like { "uuid": "SkDHvXr9ES", "userRole": "9qvfWg3isp", "devices":\[ {"uuid": "hwb258pc7x", "macAddress":\["9DGSsuAX4M", "ChypSa8tWx", "fIWrArQyDA", "PQjcvOkHYh… --- ## [Date filter does not work](https://discuss.elastic.co/t/date-filter-does-not-work/269148)
**Author:** [@Andrey\_RF](https://discuss.elastic.co/u/Andrey_RF)\ **Replies:** 3\ **Last updated:** [April 3, 2021, 6:32pm UTC](https://discuss.elastic.co/t/date-filter-does-not-work/269148 "2021-04-03T18:32:34Z")
I use grok and date filter to set correct @timestamp. It works in simple case. But when I added if condition @timestamp no longer installed from the message. filter { if 'backend.info.log' in \[log\]\[file\]\[path\] { g… --- ## [Aggregation by host displays hash instead of hostname](https://discuss.elastic.co/t/aggregation-by-host-displays-hash-instead-of-hostname/269158)
**Author:** [@desoul](https://discuss.elastic.co/u/desoul)\ **Replies:** 0\ **Last updated:** [April 3, 2021, 4:21pm UTC](https://discuss.elastic.co/t/aggregation-by-host-displays-hash-instead-of-hostname/269158 "2021-04-03T16:21:19Z")
Hello, i try to get unique agent hostnames, grouped with its logfile paths (i have Filebeat agents with system.yml configuration). Here is a query: curl -u myUser:myPassword-X GET "myELKhostname:9237/filebeat\*/\_search?p… --- ## [How to simulate the failure of elasticsearch？](https://discuss.elastic.co/t/how-to-simulate-the-failure-of-elasticsearch/269149)
**Author:** [@asasas234](https://discuss.elastic.co/u/asasas234)\ **Replies:** 0\ **Last updated:** [April 3, 2021, 12:30pm UTC](https://discuss.elastic.co/t/how-to-simulate-the-failure-of-elasticsearch/269149 "2021-04-03T12:30:44Z")
I found that for some simple failures, I can do it easily with the help of tools, such as network partitioning, nodes being killed, but there are still many abnormal cases that are not good to simulate, for example, ther… --- ## [Logstash is not processing logs](https://discuss.elastic.co/t/logstash-is-not-processing-logs/269084)
**Author:** [@James\_P](https://discuss.elastic.co/u/James_P)\ **Replies:** 1\ **Last updated:** [April 3, 2021, 7:49am UTC](https://discuss.elastic.co/t/logstash-is-not-processing-logs/269084 "2021-04-03T07:49:10Z")
Hi, Logstash was installed and was receiving logs from filebeat and syslog file stream. Currently logstash starts up successfully but no logs are being processed. \[2021-04-02T08:48:29,269\]\[INFO \]\[logstash.runner … --- ## [SIgma rules for Elastic SIEM](https://discuss.elastic.co/t/sigma-rules-for-elastic-siem/268453)
**Author:** [@kmz161](https://discuss.elastic.co/u/kmz161)\ **Replies:** 4\ **Last updated:** [April 3, 2021, 4:42am UTC](https://discuss.elastic.co/t/sigma-rules-for-elastic-siem/268453 "2021-04-03T04:42:49Z")
Hello! I need to use Sigma rules repo for my SIEM. How I can translate sigma to elastic? And how I can perform auto update sigma rules? --- ## [Kibana - Pipeline Editor](https://discuss.elastic.co/t/kibana-pipeline-editor/269134)
**Author:** [@mohsin106](https://discuss.elastic.co/u/mohsin106)\ **Replies:** 1\ **Last updated:** [April 2, 2021, 9:18pm UTC](https://discuss.elastic.co/t/kibana-pipeline-editor/269134 "2021-04-02T21:18:56Z")
Hi, I'm using Kibana 7.11.1 and I edit my pipelines under the Logstash Pipeline UI. I was wondering if there is a document somewhere that lists available shortcuts that can be used inside of the pipeline editor. Specifi… --- ## [QueryShardException No mapping found for \[failed\]](https://discuss.elastic.co/t/queryshardexception-no-mapping-found-for-failed/269111)
**Author:** [@MdRashid](https://discuss.elastic.co/u/MdRashid)\ **Replies:** 1\ **Last updated:** [April 2, 2021, 8:47pm UTC](https://discuss.elastic.co/t/queryshardexception-no-mapping-found-for-failed/269111 "2021-04-02T20:47:56Z")
Hi All, I have deploy my ES on Azure Kubernetes Services AKS after deploying i got error all shards failed Caused by: org.elasticsearch.index.query.QueryShardException: No mapping found for \[failed\] in order to sort o… --- ## [How to know Elasticsearch daily log intake?](https://discuss.elastic.co/t/how-to-know-elasticsearch-daily-log-intake/269104)
**Author:** [@mahesh.yerawar](https://discuss.elastic.co/u/mahesh.yerawar)\ **Replies:** 3\ **Last updated:** [April 2, 2021, 8:47pm UTC](https://discuss.elastic.co/t/how-to-know-elasticsearch-daily-log-intake/269104 "2021-04-02T20:47:01Z")
Hi, I'm looking to understand how much data is getting ingested to our ELK cluster on a daily basis. anyone has any idea how to get these details? Thank you. --- ## [Enhanced Table computed column issue](https://discuss.elastic.co/t/enhanced-table-computed-column-issue/269000)
**Author:** [@bab](https://discuss.elastic.co/u/bab)\ **Replies:** 3\ **Last updated:** [April 2, 2021, 6:27pm UTC](https://discuss.elastic.co/t/enhanced-table-computed-column-issue/269000 "2021-04-02T18:27:36Z")
i'm trying to get the duration in s using the formula but is not working, can someone help pls, thank you. --- ## [Endpoint Security supported on ARM Linux (AARCH64)?](https://discuss.elastic.co/t/endpoint-security-supported-on-arm-linux-aarch64/269127)
**Author:** [@danmcq](https://discuss.elastic.co/u/danmcq)\ **Replies:** 2\ **Last updated:** [April 2, 2021, 6:21pm UTC](https://discuss.elastic.co/t/endpoint-security-supported-on-arm-linux-aarch64/269127 "2021-04-02T18:21:21Z")
I have been trying, unsuccessfully, to get Endpoint Security up and running on an ARM64 Ubuntu Linux 20.04 system. The elastic-agent is installed and working, but the Endpoint Security client never seems to download/inst… --- ## [FATAL Error: Unable to complete saved object migrations for the \[.kibana\] index. TypeError: Cannot read property 'error' of undefined](https://discuss.elastic.co/t/fatal-error-unable-to-complete-saved-object-migrations-for-the-kibana-index-typeerror-cannot-read-property-error-of-undefined/269066)
**Author:** [@elk\_usr](https://discuss.elastic.co/u/elk_usr)\ **Replies:** 2\ **Last updated:** [April 2, 2021, 6:07pm UTC](https://discuss.elastic.co/t/fatal-error-unable-to-complete-saved-object-migrations-for-the-kibana-index-typeerror-cannot-read-property-error-of-undefined/269066 "2021-04-02T18:07:47Z")
Hello, I am trying to install Kibana7.12.0 on a new Win10 laptop that has elasticsearch7.12.0 already installed and running. However, Kibana install fails about halfway giving below fatal error Any help on this is g… --- ## [Need help to aggregate a text field into a visualization](https://discuss.elastic.co/t/need-help-to-aggregate-a-text-field-into-a-visualization/269034)
**Author:** [@trubisky](https://discuss.elastic.co/u/trubisky)\ **Replies:** 5\ **Last updated:** [April 2, 2021, 5:14pm UTC](https://discuss.elastic.co/t/need-help-to-aggregate-a-text-field-into-a-visualization/269034 "2021-04-02T17:14:22Z")
Hi All, I've spent a ton of time on this and I feel like it should be relatively simple but for some reason I'm not able to find the solution. I'll also add that I am fairly novice at visualizations. The docs looks sim… --- ## [APM is working, but not User Experience](https://discuss.elastic.co/t/apm-is-working-but-not-user-experience/266376)
**Author:** [@A\_Chichi](https://discuss.elastic.co/u/A_Chichi)\ **Replies:** 21\ **Last updated:** [April 2, 2021, 5:00pm UTC](https://discuss.elastic.co/t/apm-is-working-but-not-user-experience/266376 "2021-04-02T17:00:45Z")
Hello, I have a small problem with the "User Experienc" tab indeed, I set up APM on my Python/Flask application. APM works perfectly : However, when I go to the "User Experience" tab I see nothing: Also, in the "w… --- ## [Help me writing grok filter for the pattern](https://discuss.elastic.co/t/help-me-writing-grok-filter-for-the-pattern/268794)
**Author:** [@abhishek\_s1](https://discuss.elastic.co/u/abhishek_s1)\ **Replies:** 8\ **Last updated:** [April 2, 2021, 3:39pm UTC](https://discuss.elastic.co/t/help-me-writing-grok-filter-for-the-pattern/268794 "2021-04-02T15:39:21Z")
I've http log of the form 10.255.255.255 - jira \[11/Mar/2021:10:00:03 -0800\] "GET /svn/repos/branches/feature-IPv6-TWLP-3.2/ZProxyHealthManager.cpp HTTP/1.1" 200 29110 & my pattern is: %{IPORHOST:client\_ip} %{HTTPDUS… --- ## [Filter one value with other value](https://discuss.elastic.co/t/filter-one-value-with-other-value/269103)
**Author:** [@domra](https://discuss.elastic.co/u/domra)\ **Replies:** 1\ **Last updated:** [April 2, 2021, 2:42pm UTC](https://discuss.elastic.co/t/filter-one-value-with-other-value/269103 "2021-04-02T14:42:38Z")
Hi! I want to apply a filter to an TSVB metric visualization where I filter all documents, where one value is between a offset of another value. something like this: valueA: \[valueB-1 TO valueB+1\] Is something like th… --- ## [Unable to create scripted filed](https://discuss.elastic.co/t/unable-to-create-scripted-filed/269101)
**Author:** [@Dinesh\_Sharma](https://discuss.elastic.co/u/Dinesh_Sharma)\ **Replies:** 7\ **Last updated:** [April 2, 2021, 2:12pm UTC](https://discuss.elastic.co/t/unable-to-create-scripted-filed/269101 "2021-04-02T14:12:46Z")
Hi, I was trying to create an scripted field. Where I was implementing the following logic which is return true if IP is equal to Pi\_IP. ''' if (doc\['IP.kayword'\].value == doc\['Pi\_IP.keyword'\].value) { retrun "true"; … --- ## [Pipeline has lesser fields than Filebeat directly to Elasticsearch](https://discuss.elastic.co/t/pipeline-has-lesser-fields-than-filebeat-directly-to-elasticsearch/269054)
**Author:** [@Automation\_Scripts](https://discuss.elastic.co/u/Automation_Scripts)\ **Replies:** 0\ **Last updated:** [April 1, 2021, 4:04pm UTC](https://discuss.elastic.co/t/pipeline-has-lesser-fields-than-filebeat-directly-to-elasticsearch/269054 "2021-04-01T16:04:17Z")
Hi team, I have a pipeline like this: filebeat =\>kafka =\>logstask=\>elasticsearch (ELK7.12) Why I have a smaller amounts of fileds than filebeat directly =\>elasticsearch (ELK7.11.1) Whenever I check the fields from ECS… --- ## [Ngram vs wildcard (Using ngrams instead of wildcards)](https://discuss.elastic.co/t/ngram-vs-wildcard-using-ngrams-instead-of-wildcards/260809)
**Author:** [@mohsin](https://discuss.elastic.co/u/mohsin)\ **Replies:** 1\ **Last updated:** [April 2, 2021, 1:56pm UTC](https://discuss.elastic.co/t/ngram-vs-wildcard-using-ngrams-instead-of-wildcards/260809 "2021-04-02T13:56:06Z")
We are using spring-data-elasticsearch in our Project we have the autocomplete function for the search textbox. When we type into the search text field, we will fetch suggestions by performing a wild card search with t… --- ## [Is there any option to define multiple key value pairs based on delimeter while ingesting files through FSCrawler in Elasticsearch?](https://discuss.elastic.co/t/is-there-any-option-to-define-multiple-key-value-pairs-based-on-delimeter-while-ingesting-files-through-fscrawler-in-elasticsearch/261383)
**Author:** [@Nirmal\_Raj](https://discuss.elastic.co/u/Nirmal_Raj)\ **Replies:** 3\ **Last updated:** [April 2, 2021, 1:49pm UTC](https://discuss.elastic.co/t/is-there-any-option-to-define-multiple-key-value-pairs-based-on-delimeter-while-ingesting-files-through-fscrawler-in-elasticsearch/261383 "2021-04-02T13:49:14Z")
I'm trying to ingest multiple extension files like (.pdf, .doc, .docx, .csv) using FSCrawler in Elasticsearch . After ingesting, all the details inside the files mapped under one key value pair called content. Is there … --- ## [Elasticsearch thread\_pool is growing over and over](https://discuss.elastic.co/t/elasticsearch-thread-pool-is-growing-over-and-over/266078)
**Author:** [@nuzolx](https://discuss.elastic.co/u/nuzolx)\ **Replies:** 3\ **Last updated:** [April 2, 2021, 1:39pm UTC](https://discuss.elastic.co/t/elasticsearch-thread-pool-is-growing-over-and-over/266078 "2021-04-02T13:39:17Z")
Hi all, I am a newbie with Elastic. I cannot find all my documents in my research. If I repeat the same search, after a while, it's okay. I understood that it could come from the 'refresh'. But sometimes the waiting tim… --- ## [Best way to maintain total count for rollup documents?](https://discuss.elastic.co/t/best-way-to-maintain-total-count-for-rollup-documents/269109)
**Author:** [@hsalim](https://discuss.elastic.co/u/hsalim)\ **Replies:** 0\ **Last updated:** [April 2, 2021, 1:37pm UTC](https://discuss.elastic.co/t/best-way-to-maintain-total-count-for-rollup-documents/269109 "2021-04-02T13:37:54Z")
Hello, I am performing Elastic rollups on an index with the following streaming documents and fields. Rollup is on Field 1: Field1 Field2 doc1 1200 a doc2 1200 b doc3 1200 c doc4 … --- ## [Alert and connect mail format error](https://discuss.elastic.co/t/alert-and-connect-mail-format-error/268998)
**Author:** [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Replies:** 9\ **Last updated:** [April 2, 2021, 1:26pm UTC](https://discuss.elastic.co/t/alert-and-connect-mail-format-error/268998 "2021-04-02T13:26:14Z")
Hi all i have some question I was trying the version 7.12 for the first time, what interest me the most was that kibana finally have mail format for the siem rule, well i try cortext.alert just like how they show on gi… --- ## [Sending data from logstash to ElasticSearch (ECK): Certificate issue](https://discuss.elastic.co/t/sending-data-from-logstash-to-elasticsearch-eck-certificate-issue/269106)
**Author:** [@kelk](https://discuss.elastic.co/u/kelk)\ **Replies:** 0\ **Last updated:** [April 2, 2021, 1:25pm UTC](https://discuss.elastic.co/t/sending-data-from-logstash-to-elasticsearch-eck-certificate-issue/269106 "2021-04-02T13:25:11Z")
have setup operator based elasticsearch & kibana.. but since logstash is not within ECK, running logstash as standalone. Unfortunately, i'm trying it hard to find to connect to Elasticsearch due to certificate issue. ou… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=991) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=993)