# \#none **URL:** https://discuss.elastic.co/tag/none.md?page=1095 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1096 --- ## [JDBC\_Streaming plugin issue](https://discuss.elastic.co/t/jdbc-streaming-plugin-issue/260149)
**Author:** [@Ashok\_Botcha](https://discuss.elastic.co/u/Ashok_Botcha)\ **Replies:** 0\ **Last updated:** [January 5, 2021, 2:29am UTC](https://discuss.elastic.co/t/jdbc-streaming-plugin-issue/260149 "2021-01-05T02:29:26Z")
Hi, I am trying below sample logstash config, Output also pasted below. data related to table C not coming inside B, Can you suggest if anything wrong with config ? CONFIG: \`input { jdbc { ....... statement =\> "SELE… --- ## [Can logstash's Google Cloud Storage output plugin do persistent transmission after restart machine?](https://discuss.elastic.co/t/can-logstashs-google-cloud-storage-output-plugin-do-persistent-transmission-after-restart-machine/260139)
**Author:** [@iooi](https://discuss.elastic.co/u/iooi)\ **Replies:** 0\ **Last updated:** [January 4, 2021, 11:45pm UTC](https://discuss.elastic.co/t/can-logstashs-google-cloud-storage-output-plugin-do-persistent-transmission-after-restart-machine/260139 "2021-01-04T23:45:41Z")
Using this config for logstash's output. It's using /tmp/logstash-gcs as a local folder. Send to GCS when file become 1024 kbytes. input { beats { port =\> 5044 } } filter {} output { google\_cloud\_storage { … --- ## [7.x How do remove duplicates in search after query?](https://discuss.elastic.co/t/7-x-how-do-remove-duplicates-in-search-after-query/259692)
**Author:** [@Adin\_Sijamija](https://discuss.elastic.co/u/Adin_Sijamija)\ **Replies:** 1\ **Last updated:** [January 5, 2021, 12:54am UTC](https://discuss.elastic.co/t/7-x-how-do-remove-duplicates-in-search-after-query/259692 "2021-01-05T00:54:39Z")
I have several indexes spread across 3 shards that hold my data. I want to make a SearchAfter where I fetch 50 rows ordered by start time. When I run it I am returned 50 hits but half of them are duplicates as the data i… --- ## [EC2 metrics are not showing in inventory while creating Alerts](https://discuss.elastic.co/t/ec2-metrics-are-not-showing-in-inventory-while-creating-alerts/260140)
**Author:** [@minu.ajith](https://discuss.elastic.co/u/minu.ajith)\ **Replies:** 0\ **Last updated:** [January 5, 2021, 12:41am UTC](https://discuss.elastic.co/t/ec2-metrics-are-not-showing-in-inventory-while-creating-alerts/260140 "2021-01-05T00:41:44Z")
Hi, I was trying to create alerts for EC2 CPU usage. The metrics for aws.ec2.cpu.total.pct is appearing fine in Kibana. However, when I am trying to create an alert for the following condition and run a preview Invento… --- ## [Kibana not recognize my fields](https://discuss.elastic.co/t/kibana-not-recognize-my-fields/260088)
**Author:** [@learn\_and\_try](https://discuss.elastic.co/u/learn_and_try)\ **Replies:** 1\ **Last updated:** [January 5, 2021, 12:38am UTC](https://discuss.elastic.co/t/kibana-not-recognize-my-fields/260088 "2021-01-05T00:38:36Z")
hi guys i am new in elk and Kibana i am tried to put data via Logstah config file: this is the mapping details: "map\_date":{ "type": "date", "format": "yyyy-MM-dd HH:mm:ss||yyyy-MM-dd||epoch\_millis" }, when i … --- ## [Checkpoint Firewall Logs](https://discuss.elastic.co/t/checkpoint-firewall-logs/260133)
**Author:** [@somerandomitperson](https://discuss.elastic.co/u/somerandomitperson)\ **Replies:** 5\ **Last updated:** [January 5, 2021, 12:07am UTC](https://discuss.elastic.co/t/checkpoint-firewall-logs/260133 "2021-01-05T00:07:42Z")
This is my first experience with Elastic. I am trying to set up a Kibana dashboard and create dashboards for my Checkpoint firewall. The built in checkpoint module does not parse logs from my firewall. I have looked into… --- ## [Data Table Time Offset](https://discuss.elastic.co/t/data-table-time-offset/260124)
**Author:** [@stevezemlicka](https://discuss.elastic.co/u/stevezemlicka)\ **Replies:** 2\ **Last updated:** [January 4, 2021, 10:53pm UTC](https://discuss.elastic.co/t/data-table-time-offset/260124 "2021-01-04T22:53:10Z")
I have been building a dashboard with a couple of indexes. After evaluation, it turns out one of the indexes seems to be off by 1hr. For all of my timelion visualizations, this was corrected by modifying each reference… --- ## [Which is better - requests or elasticsearch](https://discuss.elastic.co/t/which-is-better-requests-or-elasticsearch/259974)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 1\ **Last updated:** [January 4, 2021, 10:35pm UTC](https://discuss.elastic.co/t/which-is-better-requests-or-elasticsearch/259974 "2021-01-04T22:35:13Z")
Inside python I can use two different method to retrieve the data. one with requests.get or can use elasticsarch module. for requests.get I can use sql query. while in elasticsearch I have to use REST code. which one … --- ## [Mutate gsub regex pattern help](https://discuss.elastic.co/t/mutate-gsub-regex-pattern-help/260122)
**Author:** [@S3l3ct3d](https://discuss.elastic.co/u/S3l3ct3d)\ **Replies:** 6\ **Last updated:** [January 4, 2021, 10:27pm UTC](https://discuss.elastic.co/t/mutate-gsub-regex-pattern-help/260122 "2021-01-04T22:27:12Z")
I am having an issue with the regex pattern in mutate gsub function. My current filter is below filter { # Log types are "SIEM\_EVENTS", "TTP\_EVENTS", "AUDIT\_EVENTS". mutate { gsub =\> \[ "\[message\]", "^\<\\d+\>", "" \] … --- ## [Multiple Workplace search instances](https://discuss.elastic.co/t/multiple-workplace-search-instances/259930)
**Author:** [@EJLegarda](https://discuss.elastic.co/u/EJLegarda)\ **Replies:** 1\ **Last updated:** [January 4, 2021, 8:57pm UTC](https://discuss.elastic.co/t/multiple-workplace-search-instances/259930 "2021-01-04T20:57:07Z")
Newbie here.. Let’s say there are 4 content sources defined in workplace, is it possible to have a workplace search page with sources 1, 2 & 3 and have another workplace search page with sources 3 & 4, and other search p… --- ## [\[7.10\] ingest\_admin pour certains index seulement](https://discuss.elastic.co/t/7-10-ingest-admin-pour-certains-index-seulement/260096)
**Author:** [@dao](https://discuss.elastic.co/u/dao)\ **Replies:** 5\ **Last updated:** [January 4, 2021, 8:40pm UTC](https://discuss.elastic.co/t/7-10-ingest-admin-pour-certains-index-seulement/260096 "2021-01-04T20:40:12Z")
Bonjour, je veux donner l'autorisation à certains utilisateurs d'injecter des données (machine learning/data visualizer/file) Je veux toutefois n'autoriser cela que pour certain index de type customer\_index\_\* et interd… --- ## [Multiple Different Clients](https://discuss.elastic.co/t/multiple-different-clients/258935)
**Author:** [@austinsonger](https://discuss.elastic.co/u/austinsonger)\ **Replies:** 4\ **Last updated:** [January 4, 2021, 7:25pm UTC](https://discuss.elastic.co/t/multiple-different-clients/258935 "2021-01-04T19:25:00Z")
Is it possible to use a single instance of Elastic SIEM to monitor two different companies networks and separate them so their information will be separated? --- ## [Stuck on "going to run"](https://discuss.elastic.co/t/stuck-on-going-to-run/258262)
**Author:** [@hilt86](https://discuss.elastic.co/u/hilt86)\ **Replies:** 7\ **Last updated:** [January 4, 2021, 7:14pm UTC](https://discuss.elastic.co/t/stuck-on-going-to-run/258262 "2021-01-04T19:14:05Z")
I have a detection rule that looks for indicator matches on a filebeat-misp index and every so often it will get stuck on "going to run" with a date that is in the past. If it is failing then I'm none the wiser but I'd … --- ## [Problems with Lab 3 in Lab Guide: Sentiment Analysis and Brand Monitoring](https://discuss.elastic.co/t/problems-with-lab-3-in-lab-guide-sentiment-analysis-and-brand-monitoring/259747)
**Author:** [@pbroek](https://discuss.elastic.co/u/pbroek)\ **Replies:** 1\ **Last updated:** [January 4, 2021, 7:00pm UTC](https://discuss.elastic.co/t/problems-with-lab-3-in-lab-guide-sentiment-analysis-and-brand-monitoring/259747 "2021-01-04T19:00:15Z")
Hello, I am working on lab 3 in Sentiment Analysis and Brand Monitoring. Until Lab 3 question 3 everythin gs is clear. But In Lab 3 question 3 there is no mentioning about starting the lab3.conf. So I started the lab3… --- ## [Logstash multiline pattern](https://discuss.elastic.co/t/logstash-multiline-pattern/259997)
**Author:** [@Muhammad\_Faisal](https://discuss.elastic.co/u/Muhammad_Faisal)\ **Replies:** 3\ **Last updated:** [January 4, 2021, 6:19pm UTC](https://discuss.elastic.co/t/logstash-multiline-pattern/259997 "2021-01-04T18:19:49Z")
hi guys, i have a log file which consists of below pattern , i need to treat all lines of this log file as 1 aggregate event.file will close after 30 minutes and then new log will start..which pattern will work here...… --- ## [Logstash do not import file](https://discuss.elastic.co/t/logstash-do-not-import-file/260114)
**Author:** [@Sad\_Creem](https://discuss.elastic.co/u/Sad_Creem)\ **Replies:** 2\ **Last updated:** [January 4, 2021, 6:15pm UTC](https://discuss.elastic.co/t/logstash-do-not-import-file/260114 "2021-01-04T18:15:30Z")
Is Logstash have a limit for max line characters leight? I have 12 mb json file wich content single line json with multi objects. Logstash do not work with this file i'am dont know why no error no debug string just sta… --- ## [Fix broken cluster with elasticsearch-node detach-cluster not working](https://discuss.elastic.co/t/fix-broken-cluster-with-elasticsearch-node-detach-cluster-not-working/260070)
**Author:** [@ebuildy](https://discuss.elastic.co/u/ebuildy)\ **Replies:** 17\ **Last updated:** [January 4, 2021, 5:58pm UTC](https://discuss.elastic.co/t/fix-broken-cluster-with-elasticsearch-node-detach-cluster-not-working/260070 "2021-01-04T17:58:28Z")
I want to fix a broken cluster (when a node cannot join because differente cluster UUID by exemple) without removing all data folder (the dirty solution I can see every time....), currently I am testing it, using officia… --- ## [Alerting visualization in kibana](https://discuss.elastic.co/t/alerting-visualization-in-kibana/260074)
**Author:** [@anjali28](https://discuss.elastic.co/u/anjali28)\ **Replies:** 3\ **Last updated:** [January 4, 2021, 4:55pm UTC](https://discuss.elastic.co/t/alerting-visualization-in-kibana/260074 "2021-01-04T16:55:16Z")
Hello, i want to create a visual representing the application status up in green mode and when down in red mode. Data is in boolean format for UP it is 1 and down it is 0 Description : From which visualization i can… --- ## [Multipe host output using keystore passwords](https://discuss.elastic.co/t/multipe-host-output-using-keystore-passwords/260090)
**Author:** [@mcosta](https://discuss.elastic.co/u/mcosta)\ **Replies:** 4\ **Last updated:** [January 4, 2021, 4:29pm UTC](https://discuss.elastic.co/t/multipe-host-output-using-keystore-passwords/260090 "2021-01-04T16:29:29Z")
Hi All, I need to configure logstash (ver 7.7) to write to two elastisearch. I have two separate output blocks, one for each elasticsearch but how do I configure password retrieval from keystore, since documentation ref… --- ## [Kibana Build "ERROR \[bootstrap\] failed":](https://discuss.elastic.co/t/kibana-build-error-bootstrap-failed/259776)
**Author:** [@Dhruvil\_Doshi](https://discuss.elastic.co/u/Dhruvil_Doshi)\ **Replies:** 3\ **Last updated:** [January 4, 2021, 4:07pm UTC](https://discuss.elastic.co/t/kibana-build-error-bootstrap-failed/259776 "2021-01-04T16:07:28Z")
I have downloaded kibana 7.10 from Github. I am not able to build kibana. After running, yarn kbn bootstrap I am getting below error. yarn run v1.22.5 $ node scripts/kbn bootstrap info \[kibana\] running yarn $ node… --- ## [ELastic Endpoint Security Agent not visible in Kibana Security App](https://discuss.elastic.co/t/elastic-endpoint-security-agent-not-visible-in-kibana-security-app/259631)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 2\ **Last updated:** [January 4, 2021, 3:49pm UTC](https://discuss.elastic.co/t/elastic-endpoint-security-agent-not-visible-in-kibana-security-app/259631 "2021-01-04T15:49:14Z")
Hello, Tried to install an Elastic Agent on my home Windows 10. Deployed the Agent through fleet. with a system, windows and endpoint policy. But when I go to Security Administration, it says "Endpoints are enrollin… --- ## [Logstash plugin is installed and listed but not found by logstash](https://discuss.elastic.co/t/logstash-plugin-is-installed-and-listed-but-not-found-by-logstash/259895)
**Author:** [@Travis](https://discuss.elastic.co/u/Travis)\ **Replies:** 3\ **Last updated:** [January 4, 2021, 3:43pm UTC](https://discuss.elastic.co/t/logstash-plugin-is-installed-and-listed-but-not-found-by-logstash/259895 "2021-01-04T15:43:34Z")
Hello Elasticians ! I installed syslog output plug in (logstash-output-syslog-3.0.5.gem) using offline method as I don't have wan access on target server. Plug in has been successfully installed and is listed with lo… --- ## [Resizable Table Legends and Multiple Terms aggregations](https://discuss.elastic.co/t/resizable-table-legends-and-multiple-terms-aggregations/260039)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 2\ **Last updated:** [January 4, 2021, 3:40pm UTC](https://discuss.elastic.co/t/resizable-table-legends-and-multiple-terms-aggregations/260039 "2021-01-04T15:40:55Z")
Hello, In Grafana we have the option to show legends as a table, showing a lot of useful aggregated info, for example: I have tried many things to achieve the same in Kibana, but never managed to get even close to w… --- ## [Will my "%{GREEDYDATA:\[log\_message\]}" overwrides all my other grok filters?](https://discuss.elastic.co/t/will-my-greedydata-log-message-overwrides-all-my-other-grok-filters/260063)
**Author:** [@yulaika](https://discuss.elastic.co/u/yulaika)\ **Replies:** 1\ **Last updated:** [January 4, 2021, 2:43pm UTC](https://discuss.elastic.co/t/will-my-greedydata-log-message-overwrides-all-my-other-grok-filters/260063 "2021-01-04T14:43:13Z")
grok { match =\> { "message" =\> \[ "(?\<\[log\]\[timestamp\]\>%{YEAR}-%{MONTHNUM}-%{MONTHDAY}%{SPACE}%{TIME}) \\\[%{NOTSPACE:\[LOG\]\[LEVEL\]}\\\] %{GREEDYDATA:\[log\_message\]}" , "(?\<\[log\]\[timestamp\]\>%{YEA… --- ## [Need help displaying two different counts on the same chart](https://discuss.elastic.co/t/need-help-displaying-two-different-counts-on-the-same-chart/259264)
**Author:** [@njanashia](https://discuss.elastic.co/u/njanashia)\ **Replies:** 3\ **Last updated:** [January 4, 2021, 1:40pm UTC](https://discuss.elastic.co/t/need-help-displaying-two-different-counts-on-the-same-chart/259264 "2021-01-04T13:40:37Z")
I want to display sales and refunds counts for the same day on the same chart like it is shown on the first picture. The corresponding date fields for sales and refunds are detail\_trans\_date and detail\_refund\_date. I ha… --- ## [Can't find data when doing simple KQL query ( can see the log in general search)](https://discuss.elastic.co/t/cant-find-data-when-doing-simple-kql-query-can-see-the-log-in-general-search/260034)
**Author:** [@umen](https://discuss.elastic.co/u/umen)\ **Replies:** 3\ **Last updated:** [January 4, 2021, 1:01pm UTC](https://discuss.elastic.co/t/cant-find-data-when-doing-simple-kql-query-can-see-the-log-in-general-search/260034 "2021-01-04T13:01:56Z")
im using the filebeat-\* index . when i watch the logs in discover i can see logs from the pods when i try to create simple query to get logs by namespace/name/container name i don't get any result i follow this threa… --- ## [Respect bootstrapNewHistoryUUID option when restoring from snapshot](https://discuss.elastic.co/t/respect-bootstrapnewhistoryuuid-option-when-restoring-from-snapshot/259498)
**Author:** [@asce0705](https://discuss.elastic.co/u/asce0705)\ **Replies:** 9\ **Last updated:** [January 4, 2021, 12:23pm UTC](https://discuss.elastic.co/t/respect-bootstrapnewhistoryuuid-option-when-restoring-from-snapshot/259498 "2021-01-04T12:23:09Z")
Shall we enable bootstrapNewHistoryUUID option in SnapshotRecoverySource, which disable bootstraping new history uuid of the primary shard index when set false. In some environment, the primary shard may be restored fro… --- ## [Multiple resources on conf](https://discuss.elastic.co/t/multiple-resources-on-conf/260079)
**Author:** [@Sunflower](https://discuss.elastic.co/u/Sunflower)\ **Replies:** 6\ **Last updated:** [January 4, 2021, 11:40am UTC](https://discuss.elastic.co/t/multiple-resources-on-conf/260079 "2021-01-04T11:40:59Z")
Hi, I have multiple resources that I want to configure to send Syslog to Logstash and then send it to S3. I'd appreciate hearing your thoughts regarding the two following options: Multiple resources on the input, eac… --- ## [Max payload issue](https://discuss.elastic.co/t/max-payload-issue/260084)
**Author:** [@Dainius](https://discuss.elastic.co/u/Dainius)\ **Replies:** 1\ **Last updated:** [January 4, 2021, 11:29am UTC](https://discuss.elastic.co/t/max-payload-issue/260084 "2021-01-04T11:29:33Z")
Hey guys, I would like to sort out one issue I have. I get max payload error while trying to refresh index pattern in Kibana. Of course I have already increased server.maxPayloadBytes: value in kibana config file, but m… --- ## [Perform boolean operation on result sets of two queries](https://discuss.elastic.co/t/perform-boolean-operation-on-result-sets-of-two-queries/260083)
**Author:** [@tejas1\_shah](https://discuss.elastic.co/u/tejas1_shah)\ **Replies:** 0\ **Last updated:** [January 4, 2021, 11:20am UTC](https://discuss.elastic.co/t/perform-boolean-operation-on-result-sets-of-two-queries/260083 "2021-01-04T11:20:48Z")
Hello, I am creating a solution based on elastic search based on user inputs for a text. The results are to be shown in 3 groups - one group containing the exact match, second group containing only the stemmed results … [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1094) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1096)