# \#none **URL:** https://discuss.elastic.co/tag/none.md?page=1104 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1105 --- ## [How to only send an alert when severity is high](https://discuss.elastic.co/t/how-to-only-send-an-alert-when-severity-is-high/259263)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 5\ **Last updated:** [December 22, 2020, 6:40pm UTC](https://discuss.elastic.co/t/how-to-only-send-an-alert-when-severity-is-high/259263 "2020-12-22T18:40:59Z")
Hello, So I created this rule that triggers on Azure risky signins: Ans as you can see I made an override for the azure.signinlogs.properties.risk\_level\_during\_signin field. But now the alert I configured triggers o… --- ## [Searching then sorting in a multi-indices search](https://discuss.elastic.co/t/searching-then-sorting-in-a-multi-indices-search/259419)
**Author:** [@Chris\_Grim](https://discuss.elastic.co/u/Chris_Grim)\ **Replies:** 0\ **Last updated:** [December 22, 2020, 6:31pm UTC](https://discuss.elastic.co/t/searching-then-sorting-in-a-multi-indices-search/259419 "2020-12-22T18:31:08Z")
Hi, I am trying to create a general search on my site that users can start typing in a name and it will search three indices, an event, an organizer and a city list. Currently I have GET /events,city\_lists,organizers/\_… --- ## [GROK Help This setting must be a hash](https://discuss.elastic.co/t/grok-help-this-setting-must-be-a-hash/259408)
**Author:** [@fastxl](https://discuss.elastic.co/u/fastxl)\ **Replies:** 1\ **Last updated:** [December 22, 2020, 4:55pm UTC](https://discuss.elastic.co/t/grok-help-this-setting-must-be-a-hash/259408 "2020-12-22T16:55:34Z")
Need help trying to break down some data. This is the data being sent {"timestamp": "2020-11-17T19:02:19.352Z","sequence": 2460137,"deviceName": "OKUMA.MachiningCenterMA650-EAST","deviceUUID": "OKUMA.MachiningCenterMA65… --- ## [Trace http\_request problem](https://discuss.elastic.co/t/trace-http-request-problem/259410)
**Author:** [@bayucandra](https://discuss.elastic.co/u/bayucandra)\ **Replies:** 0\ **Last updated:** [December 22, 2020, 4:37pm UTC](https://discuss.elastic.co/t/trace-http-request-problem/259410 "2020-12-22T16:37:58Z")
Hi, I am an elastic cloud user with a budgeted cluster :slight\_smile: Could someone please help me, how to find out which requests to my Elastic search cluster which causing the following problem: { "statusCod… --- ## [Logstash crashing](https://discuss.elastic.co/t/logstash-crashing/259403)
**Author:** [@lquin1978](https://discuss.elastic.co/u/lquin1978)\ **Replies:** 1\ **Last updated:** [December 22, 2020, 4:19pm UTC](https://discuss.elastic.co/t/logstash-crashing/259403 "2020-12-22T16:19:06Z")
We have just started getting the following error \[2020-12-22T15:57:08,056\]\[ERROR\]\[logstash.javapipeline \]\[main\] Pipeline worker error, the pipeline will be stopped {:pipeline\_id=\>"main", :error=\>"", :exception=\>Java:… --- ## [Nested for loop in logstash / calling logstash filters from ruby](https://discuss.elastic.co/t/nested-for-loop-in-logstash-calling-logstash-filters-from-ruby/259404)
**Author:** [@aerodynamic](https://discuss.elastic.co/u/aerodynamic)\ **Replies:** 0\ **Last updated:** [December 22, 2020, 3:59pm UTC](https://discuss.elastic.co/t/nested-for-loop-in-logstash-calling-logstash-filters-from-ruby/259404 "2020-12-22T15:59:43Z")
Hello, Currenly I'm dealing with a development roadblock to shorten a pipeline config. The logic in any other programming language would be a nested for loop. An iteration over values on array A for each value in array… --- ## [Merge data from several csv sources](https://discuss.elastic.co/t/merge-data-from-several-csv-sources/259381)
**Author:** [@MickD](https://discuss.elastic.co/u/MickD)\ **Replies:** 4\ **Last updated:** [December 22, 2020, 3:16pm UTC](https://discuss.elastic.co/t/merge-data-from-several-csv-sources/259381 "2020-12-22T15:16:36Z")
Hello, I'm new to ELK so please apologies if my question is trivial. I have 3 CSV files with data that I would like to merge. In each file, each row represent a data which can be father or child of a row in another fi… --- ## [Problem creating a template 7.5](https://discuss.elastic.co/t/problem-creating-a-template-7-5/259397)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 2\ **Last updated:** [December 22, 2020, 3:00pm UTC](https://discuss.elastic.co/t/problem-creating-a-template-7-5/259397 "2020-12-22T15:00:54Z")
Hi, when I try to create an index template I get this error, I have checked multiple times and seems to be all ok. { "error": { "root\_cause": \[ { "type": "parse\_exception", "reason": "unknown… --- ## [Index template](https://discuss.elastic.co/t/index-template/259161)
**Author:** [@Norman\_Khine](https://discuss.elastic.co/u/Norman_Khine)\ **Replies:** 4\ **Last updated:** [December 22, 2020, 2:45pm UTC](https://discuss.elastic.co/t/index-template/259161 "2020-12-22T14:45:30Z")
Hello, i have the following template for one of my indexes: PUT \_template/template\_analytics-prod { "index\_patterns": \[ "analytics-prod-\*" \], "settings": { "number\_of\_shards": 2, "number\_of\_replicas": … --- ## [WatcherのActionで時刻を扱う方法](https://discuss.elastic.co/t/watcher-action/259332)
**Author:** [@t-nakata](https://discuss.elastic.co/u/t-nakata)\ **Replies:** 1\ **Last updated:** [December 22, 2020, 2:44pm UTC](https://discuss.elastic.co/t/watcher-action/259332 "2020-12-22T14:44:44Z")
KibanaのWatcherを使用し、特定条件下でEメールを送信するような以下のActionの定義を行っています "actions": { "send\_email": { "email": { "profile": "standard", "to": \[ "XXXXX@XXX.com" \], "subject": "XXXXX"… --- ## [Overwrite message field issue in grok match](https://discuss.elastic.co/t/overwrite-message-field-issue-in-grok-match/259300)
**Author:** [@Muhammad\_Faisal](https://discuss.elastic.co/u/Muhammad_Faisal)\ **Replies:** 3\ **Last updated:** [December 22, 2020, 2:22pm UTC](https://discuss.elastic.co/t/overwrite-message-field-issue-in-grok-match/259300 "2020-12-22T14:22:03Z")
i want to overwrite message field , but it only overwrites last match i.e. IP and is not overwriting first match i.e. number \`input { stdin{} } filter { grok { match =\> { "message" =\> "%{DATA}(?\(\\d{9,12})|… --- ## [Kibana iframes issue](https://discuss.elastic.co/t/kibana-iframes-issue/257320)
**Author:** [@Iyashwant](https://discuss.elastic.co/u/Iyashwant)\ **Replies:** 1\ **Last updated:** [December 22, 2020, 2:03pm UTC](https://discuss.elastic.co/t/kibana-iframes-issue/257320 "2020-12-22T14:03:22Z")
I have created a website which displays an iframe of the kibana dashboard and I have a filter option in my website and it shows a side bar with an iframe of another dashboard in kibana with only filters visualization. W… --- ## [Logstash configuration advice needed](https://discuss.elastic.co/t/logstash-configuration-advice-needed/259376)
**Author:** [@d.silwon](https://discuss.elastic.co/u/d.silwon)\ **Replies:** 2\ **Last updated:** [December 22, 2020, 12:17pm UTC](https://discuss.elastic.co/t/logstash-configuration-advice-needed/259376 "2020-12-22T12:17:08Z")
Dears, I need your advice in case of configuration of Logstash. Currently the configuration looks like this one: cat /etc/logstash/conf.d/logstash.conf input { beats { port =\> 5044 ssl =\> true ssl\_certif… --- ## [Displaying numbers as 1M,1B,1K in kibana](https://discuss.elastic.co/t/displaying-numbers-as-1m-1b-1k-in-kibana/259227)
**Author:** [@RamyaGowda](https://discuss.elastic.co/u/RamyaGowda)\ **Replies:** 6\ **Last updated:** [December 22, 2020, 12:12pm UTC](https://discuss.elastic.co/t/displaying-numbers-as-1m-1b-1k-in-kibana/259227 "2020-12-22T12:12:37Z")
Hi Team, I'm are using Visual builder to show some metrices over the time, as these number are very big I have customized the format as "0.0a" It shows the number in proper format ,but the issue is with the abbreviati… --- ## [Logstash replace string and insert new line](https://discuss.elastic.co/t/logstash-replace-string-and-insert-new-line/259377)
**Author:** [@Muhammad\_Faisal](https://discuss.elastic.co/u/Muhammad_Faisal)\ **Replies:** 0\ **Last updated:** [December 22, 2020, 11:49am UTC](https://discuss.elastic.co/t/logstash-replace-string-and-insert-new-line/259377 "2020-12-22T11:49:35Z")
hi guys, need to replace all occurrences of | with newline in field , gsub does not accept \\n or \\r...any idea as it will replace it with actual \\n mutate { gsub =\> \[ "message", "|", "\\n" \]}\` --- ## [Unable to parse the mule logs in logstash](https://discuss.elastic.co/t/unable-to-parse-the-mule-logs-in-logstash/259265)
**Author:** [@vinodkumar](https://discuss.elastic.co/u/vinodkumar)\ **Replies:** 10\ **Last updated:** [December 22, 2020, 7:31am UTC](https://discuss.elastic.co/t/unable-to-parse-the-mule-logs-in-logstash/259265 "2020-12-22T07:31:57Z")
Hi Team, I am trying to parse the mule application logs logstash, tried different options but unable to achieve it. My sample logs: 2020-12-18 10:27:10,666 \[\[hl7v2-ORU-message-processor-api\].hl7v2-fhir-api-flowsFlow.s… --- ## [Path "/usr/share/logstash/data" must be a writable directory -- Most secure way to make it so?](https://discuss.elastic.co/t/path-usr-share-logstash-data-must-be-a-writable-directory-most-secure-way-to-make-it-so/259338)
**Author:** [@danibe](https://discuss.elastic.co/u/danibe)\ **Replies:** 0\ **Last updated:** [December 22, 2020, 7:38am UTC](https://discuss.elastic.co/t/path-usr-share-logstash-data-must-be-a-writable-directory-most-secure-way-to-make-it-so/259338 "2020-12-22T07:38:56Z")
Running '/usr/share/logstash/bin/logstash' as root works perfectly but obviously is not the recommended long term mode of use. So, I did: chown -R logstash:logstash conf.d chmod -R 775 /usr/share/logstash/data sudo use… --- ## [Does the .tar.gz archive include the systemd module?](https://discuss.elastic.co/t/does-the-tar-gz-archive-include-the-systemd-module/259372)
**Author:** [@JDP](https://discuss.elastic.co/u/JDP)\ **Replies:** 2\ **Last updated:** [December 22, 2020, 11:20am UTC](https://discuss.elastic.co/t/does-the-tar-gz-archive-include-the-systemd-module/259372 "2020-12-22T11:20:58Z")
Hi all, I have a working installation of Elasticsearch 7.10.1 on Debian 10.7, which was installed via the tar.gz archive into /opt/elasticseach, however I'm having trouble using systemd to control startup\\shutdown. Bec… --- ## [How to hide inspect option from the visualization](https://discuss.elastic.co/t/how-to-hide-inspect-option-from-the-visualization/259223)
**Author:** [@anjali28](https://discuss.elastic.co/u/anjali28)\ **Replies:** 8\ **Last updated:** [December 22, 2020, 11:15am UTC](https://discuss.elastic.co/t/how-to-hide-inspect-option-from-the-visualization/259223 "2020-12-22T11:15:32Z")
\-I have created a dashboard in default space. -Created a role with read only permission and given access the role to a user. -When i login from user , i see the dashboard in read only mode but if we can hide the "OPTIO… --- ## [Search template inclusion](https://discuss.elastic.co/t/search-template-inclusion/259374)
**Author:** [@jetnet](https://discuss.elastic.co/u/jetnet)\ **Replies:** 0\ **Last updated:** [December 22, 2020, 11:15am UTC](https://discuss.elastic.co/t/search-template-inclusion/259374 "2020-12-22T11:15:15Z")
We use several search templates with the same query: { ... } section. I'm wondering, if it is possible to store that part as another template and include it in the main ones? Thanks! --- ## [Elastic Maps - Drill Down option to another dashboard](https://discuss.elastic.co/t/elastic-maps-drill-down-option-to-another-dashboard/259226)
**Author:** [@RamyaGowda](https://discuss.elastic.co/u/RamyaGowda)\ **Replies:** 2\ **Last updated:** [December 22, 2020, 11:14am UTC](https://discuss.elastic.co/t/elastic-maps-drill-down-option-to-another-dashboard/259226 "2020-12-22T11:14:08Z")
Hi Team, In current version of kibana ,maps doesn't have an option of drilldown to another page. This is a great feature which gives more insights to user if it gives drilldown option. We have an use case to display g… --- ## [Painless Script Caching Question](https://discuss.elastic.co/t/painless-script-caching-question/259361)
**Author:** [@Arthur\_Zheng](https://discuss.elastic.co/u/Arthur_Zheng)\ **Replies:** 0\ **Last updated:** [December 22, 2020, 10:14am UTC](https://discuss.elastic.co/t/painless-script-caching-question/259361 "2020-12-22T10:14:17Z")
We are using es 7.1. We have an error “Too many dynamic script compilations within”。 It can be fixed by increase some params： script.context.$CONTEXT.max\_compilations\_rate My question is ： Es 7.1 Supports a monitori… --- ## [Decode kafka message](https://discuss.elastic.co/t/decode-kafka-message/259355)
**Author:** [@lstoneir](https://discuss.elastic.co/u/lstoneir)\ **Replies:** 0\ **Last updated:** [December 22, 2020, 9:47am UTC](https://discuss.elastic.co/t/decode-kafka-message/259355 "2020-12-22T09:47:13Z")
Hi there i have a logstash config like this: input{ kafka { bootstrap\_servers =\> "localhost:9092" topics =\> \["xx"\] client\_id =\> "v1" group\_id =\> "v1-g" } } out… --- ## [Login directly to a certain dashboard](https://discuss.elastic.co/t/login-directly-to-a-certain-dashboard/259317)
**Author:** [@Amphagory](https://discuss.elastic.co/u/Amphagory)\ **Replies:** 1\ **Last updated:** [December 22, 2020, 9:17am UTC](https://discuss.elastic.co/t/login-directly-to-a-certain-dashboard/259317 "2020-12-22T09:17:50Z")
Hello, I know you can set in Kibana.yml to login directly to the dashboard page. I was wondering if you can specify a particular dashboard name or something similar? I have several spaces with each with a dashboard of… --- ## [Kibana did not load properly while connecting with VPN](https://discuss.elastic.co/t/kibana-did-not-load-properly-while-connecting-with-vpn/259343)
**Author:** [@adiel\_siman\_tov](https://discuss.elastic.co/u/adiel_siman_tov)\ **Replies:** 1\ **Last updated:** [December 22, 2020, 9:10am UTC](https://discuss.elastic.co/t/kibana-did-not-load-properly-while-connecting-with-vpn/259343 "2020-12-22T09:10:29Z")
Hi I'm using Kibana 7.2.0 on K8S behind AWS load balancer, and it works fine till yesterday. Usually I'm connecting with my work VPN to Kibana, but from yesterday it just show the error: 'Kibana did not load properly'… --- ## [Integer field behaving as string](https://discuss.elastic.co/t/integer-field-behaving-as-string/259280)
**Author:** [@wissam](https://discuss.elastic.co/u/wissam)\ **Replies:** 2\ **Last updated:** [December 22, 2020, 9:08am UTC](https://discuss.elastic.co/t/integer-field-behaving-as-string/259280 "2020-12-22T09:08:33Z")
Hi, I'm facing a weird problem with field types in Elasticsearch (7.5.3). I have a field of type "integer" (explicitly mapped), but every time I try to update it via a painless script by doing ctx.\_source.myfield += 1,… --- ## [Does Protections and settings work separately in Endpoint Security integration?](https://discuss.elastic.co/t/does-protections-and-settings-work-separately-in-endpoint-security-integration/259318)
**Author:** [@roh](https://discuss.elastic.co/u/roh)\ **Replies:** 1\ **Last updated:** [December 22, 2020, 8:19am UTC](https://discuss.elastic.co/t/does-protections-and-settings-work-separately-in-endpoint-security-integration/259318 "2020-12-22T08:19:22Z")
Hi all! There's two configuration when you click Endpoint Security integration. One is "Protections" and the other one is "Settings". My question is : If you disable malware protection, does agent only collects events… --- ## [Login from external application to kibana](https://discuss.elastic.co/t/login-from-external-application-to-kibana/259336)
**Author:** [@Rohit\_Kumbhar](https://discuss.elastic.co/u/Rohit_Kumbhar)\ **Replies:** 1\ **Last updated:** [December 22, 2020, 8:12am UTC](https://discuss.elastic.co/t/login-from-external-application-to-kibana/259336 "2020-12-22T08:12:51Z")
Hi, I need help for login from external application to Kibana with the same credentials . I don't want my application users to login again in kibana. My Application user's login credentials are saved in postgresql. Ple… --- ## [Opsgenie SIEM Case connector](https://discuss.elastic.co/t/opsgenie-siem-case-connector/257889)
**Author:** [@Felipe\_Fuller](https://discuss.elastic.co/u/Felipe_Fuller)\ **Replies:** 1\ **Last updated:** [December 22, 2020, 8:11am UTC](https://discuss.elastic.co/t/opsgenie-siem-case-connector/257889 "2020-12-22T08:11:04Z")
Hi! I'm trying to create a connector to push cases to Jira's Opsgenie from Elastic SIEM. Is it possible? The idea is to do the same that Jiras connector does, but adapted to Opsgenie. Thank you in advance! --- ## [Dec 22nd, 2020: \[DE\] Index-Patterns und ihre Tradeoffs für Logs, Metriken und Traces](https://discuss.elastic.co/t/dec-22nd-2020-de-index-patterns-und-ihre-tradeoffs-fur-logs-metriken-und-traces/258155)
**Author:** [@xeraa](https://discuss.elastic.co/u/xeraa)\ **Replies:** 0\ **Last updated:** [December 22, 2020, 8:00am UTC](https://discuss.elastic.co/t/dec-22nd-2020-de-index-patterns-und-ihre-tradeoffs-fur-logs-metriken-und-traces/258155 "2020-12-22T08:00:03Z")
Zeitserien-Daten, wie Logs, Metriken und Traces, sind einer der Hauptanwendungsfälle des Elastic Stack. Doch wie strukturiert man diese Daten am besten, um neben performantem Schreiben und Lesen noch andere Anforderungen… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1103) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1105)