# \#none **URL:** https://discuss.elastic.co/tag/none.md?page=1159 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1160 --- ## [Get Logs From SAP Cloud Plateform Cockpit](https://discuss.elastic.co/t/get-logs-from-sap-cloud-plateform-cockpit/254910)
**Author:** [@med1](https://discuss.elastic.co/u/med1)\ **Replies:** 0\ **Last updated:** [November 10, 2020, 12:54pm UTC](https://discuss.elastic.co/t/get-logs-from-sap-cloud-plateform-cockpit/254910 "2020-11-10T12:54:37Z")
Hello Colleagues , I would like to extract logs from SAP cloud plateform cockpit using open source logging platform Elasticsearch, Logstash, Kibana . Did someone has any idea regarding this topic . Thanks . Mohamed … --- ## [Elasticsearch 7.9.3 on Mac dies when inserting documents fast](https://discuss.elastic.co/t/elasticsearch-7-9-3-on-mac-dies-when-inserting-documents-fast/254809)
**Author:** [@Toontje](https://discuss.elastic.co/u/Toontje)\ **Replies:** 7\ **Last updated:** [November 10, 2020, 12:41pm UTC](https://discuss.elastic.co/t/elasticsearch-7-9-3-on-mac-dies-when-inserting-documents-fast/254809 "2020-11-10T12:41:53Z")
I use node-red to transform an existing JSON document and insert individual small JSON document using the POST command. Apparently i do this too fast because after a few seconds port 9200 stops responding. What is best … --- ## [Elasticsearch is not started in server](https://discuss.elastic.co/t/elasticsearch-is-not-started-in-server/254888)
**Author:** [@nagaraju.sbd](https://discuss.elastic.co/u/nagaraju.sbd)\ **Replies:** 8\ **Last updated:** [November 10, 2020, 11:32am UTC](https://discuss.elastic.co/t/elasticsearch-is-not-started-in-server/254888 "2020-11-10T11:32:34Z")
elasticsearch.service: main process exited, code=exited, status=78/n/a Failed to start Elasticsearch. --- ## [Delete old documents](https://discuss.elastic.co/t/delete-old-documents/254591)
**Author:** [@smruthip](https://discuss.elastic.co/u/smruthip)\ **Replies:** 3\ **Last updated:** [November 10, 2020, 11:23am UTC](https://discuss.elastic.co/t/delete-old-documents/254591 "2020-11-10T11:23:46Z")
Is there a way to delete old documents based on a filed which has timestamp? What I want to do is just keep the latest document per id example id. timestamp 1 1pm 1 2pm 1 3pm 1 4pm 2. 3pm 2. 4pm 2. 6pm … --- ## [Missing Elasticsearch menu in Kibana](https://discuss.elastic.co/t/missing-elasticsearch-menu-in-kibana/254799)
**Author:** [@Lorenzo\_Allori](https://discuss.elastic.co/u/Lorenzo_Allori)\ **Replies:** 5\ **Last updated:** [November 10, 2020, 10:29am UTC](https://discuss.elastic.co/t/missing-elasticsearch-menu-in-kibana/254799 "2020-11-10T10:29:58Z")
Hello I created a new installation from docker using: elasticsearch:7.8.0 kibana:7.8.0 these two docker images. But when i use kibana I cannot see the Elasticsearch menu (access to index patterns etc.=). Is it possi… --- ## [Express logs are parsed as nginx.access logs](https://discuss.elastic.co/t/express-logs-are-parsed-as-nginx-access-logs/254886)
**Author:** [@Djiit](https://discuss.elastic.co/u/Djiit)\ **Replies:** 2\ **Last updated:** [November 10, 2020, 9:37am UTC](https://discuss.elastic.co/t/express-logs-are-parsed-as-nginx-access-logs/254886 "2020-11-10T09:37:58Z")
Hi there, I'm tuning my logs display/parsing in Kibana and I'm not sure how to instruct Kibana to display correctly logs from an Express app (NodeJS). The app uses Pino logger + @elastic/pino-ecs-format. Every time I s… --- ## [\_async\_search thowing access denieds in elasticsearch audit logs](https://discuss.elastic.co/t/async-search-thowing-access-denieds-in-elasticsearch-audit-logs/254811)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 2\ **Last updated:** [November 10, 2020, 8:38am UTC](https://discuss.elastic.co/t/async-search-thowing-access-denieds-in-elasticsearch-audit-logs/254811 "2020-11-10T08:38:36Z")
Hello, So I made a SIEM rule which triggers on access\_denied in event.action on Elastic audit logs. And so I discovered the user \_async\_search triggers this rule. I guess I can safely exclude this, but I'm curious… --- ## [Search analyser + preserve special characters](https://discuss.elastic.co/t/search-analyser-preserve-special-characters/254883)
**Author:** [@Liam\_Aird](https://discuss.elastic.co/u/Liam_Aird)\ **Replies:** 0\ **Last updated:** [November 10, 2020, 9:19am UTC](https://discuss.elastic.co/t/search-analyser-preserve-special-characters/254883 "2020-11-10T09:19:07Z")
Hi, I am having somewhat of an issue here that I cannot seem to solve after a few different attempts and days worth of googling. I am using the synonyms filter - and read that it would be better to do so search time in… --- ## [Building block rules/use case](https://discuss.elastic.co/t/building-block-rules-use-case/254737)
**Author:** [@probson](https://discuss.elastic.co/u/probson)\ **Replies:** 7\ **Last updated:** [November 10, 2020, 9:13am UTC](https://discuss.elastic.co/t/building-block-rules-use-case/254737 "2020-11-10T09:13:40Z")
Hi, I am trying to understand the building block rules. Should we be able to create a rule that triggers if multiple building block rules trigger? If so how would I go about it? Thanks Phil --- ## [Logstash conf for parsing ignored](https://discuss.elastic.co/t/logstash-conf-for-parsing-ignored/254879)
**Author:** [@Andex](https://discuss.elastic.co/u/Andex)\ **Replies:** 0\ **Last updated:** [November 10, 2020, 9:08am UTC](https://discuss.elastic.co/t/logstash-conf-for-parsing-ignored/254879 "2020-11-10T09:08:52Z")
Hi , i have a problem with logstash. I receive filebeat jboss log but these don't go trough the conf (with grok filter) but they go on elasticsearch without parsing. I don't know why my conf is ignored. I try to chang… --- ## [Ingest nodes don't load balance the pipeline load](https://discuss.elastic.co/t/ingest-nodes-dont-load-balance-the-pipeline-load/254876)
**Author:** [@keshara](https://discuss.elastic.co/u/keshara)\ **Replies:** 0\ **Last updated:** [November 10, 2020, 9:01am UTC](https://discuss.elastic.co/t/ingest-nodes-dont-load-balance-the-pipeline-load/254876 "2020-11-10T09:01:46Z")
Hi, I have a ECK cluster where maintaining dedicated two ingest nodes, specially to isolate and get my pipelines working across them. While it is running I noticed only one node being utilized 100% cpu where the other o… --- ## [Delete by query](https://discuss.elastic.co/t/delete-by-query/254847)
**Author:** [@vikramaddagulla](https://discuss.elastic.co/u/vikramaddagulla)\ **Replies:** 1\ **Last updated:** [November 10, 2020, 8:40am UTC](https://discuss.elastic.co/t/delete-by-query/254847 "2020-11-10T08:40:34Z")
Hello, I would like to delete some data in the index older than a certain time... I am trying to use the delete by query index...However, before trying to delete the data, I am trying to view the data older than the ti… --- ## [Создание кластера Elasticsearch 7.2 из single-node с сохранением данных](https://discuss.elastic.co/t/elasticsearch-7-2-single-node/253669)
**Author:** [@zuser](https://discuss.elastic.co/u/zuser)\ **Replies:** 6\ **Last updated:** [November 10, 2020, 8:38am UTC](https://discuss.elastic.co/t/elasticsearch-7-2-single-node/253669 "2020-11-10T08:38:27Z")
Доброго времени суток! Исходная такова, есть elasticsearch 7.2 в режиме single-node, с данными. Необходимо создать географически распределенный отказоустойчивый кластер из 2х мастер/дата нод и одной мастер ноды. Прошу… --- ## [Why logstash generator input generated elasticsearch index size remains constant?](https://discuss.elastic.co/t/why-logstash-generator-input-generated-elasticsearch-index-size-remains-constant/254870)
**Author:** [@elasticheart](https://discuss.elastic.co/u/elasticheart)\ **Replies:** 0\ **Last updated:** [November 10, 2020, 8:35am UTC](https://discuss.elastic.co/t/why-logstash-generator-input-generated-elasticsearch-index-size-remains-constant/254870 "2020-11-10T08:35:47Z")
Hi, I have the latest elastic stack and I am using Logstash's generator input plugin to generate dummy data and I am pushing it to an elasticsearch index testindex. I have ILM policy and template configured for testinde… --- ## [Logstash Elapsed filter](https://discuss.elastic.co/t/logstash-elapsed-filter/254858)
**Author:** [@melorium](https://discuss.elastic.co/u/melorium)\ **Replies:** 0\ **Last updated:** [November 10, 2020, 7:26am UTC](https://discuss.elastic.co/t/logstash-elapsed-filter/254858 "2020-11-10T07:26:42Z")
Hi. I have problem with elapsed filter il tried everything but it random miss events. It matches around 75% of all events only and different everytime I sent the log in. Starting Logstash with one worker also. Can I … --- ## [Can i use notification for logstash's error or warn logs?](https://discuss.elastic.co/t/can-i-use-notification-for-logstashs-error-or-warn-logs/254742)
**Author:** [@talbehat](https://discuss.elastic.co/u/talbehat)\ **Replies:** 5\ **Last updated:** [November 10, 2020, 7:14am UTC](https://discuss.elastic.co/t/can-i-use-notification-for-logstashs-error-or-warn-logs/254742 "2020-11-10T07:14:40Z")
for example : \[2020-11-09T16:30:46,039\]\[WARN \]\[org.logstash.instrument.metrics.gauge.LazyDelegatingGauge\]\[main\] A gauge metric of an unknown type (org.jruby.specialized.RubyArrayOneObject) has been create for key: clust… --- ## [Elasticsearch moving node out of cluster](https://discuss.elastic.co/t/elasticsearch-moving-node-out-of-cluster/254653)
**Author:** [@RAM\_NATHAN](https://discuss.elastic.co/u/RAM_NATHAN)\ **Replies:** 18\ **Last updated:** [November 10, 2020, 7:13am UTC](https://discuss.elastic.co/t/elasticsearch-moving-node-out-of-cluster/254653 "2020-11-10T07:13:08Z")
Hi I have a cluster by name "as\_elasticsearch" and I have deleted a node from that cluster as below curl -XPUT P.P.P.P:9200/\_cluster/settings -H 'Content-Type: application/json' -d '{ "transient" :{ "cluster.routing.… --- ## [Pvc s should not deleted while deleting a cluster](https://discuss.elastic.co/t/pvc-s-should-not-deleted-while-deleting-a-cluster/254846)
**Author:** [@knagasri](https://discuss.elastic.co/u/knagasri)\ **Replies:** 6\ **Last updated:** [November 10, 2020, 7:01am UTC](https://discuss.elastic.co/t/pvc-s-should-not-deleted-while-deleting-a-cluster/254846 "2020-11-10T07:01:41Z")
While deleting a elasticsearch cluster, pvcs are also getting deleted. Is there any annotation that would remain pvc after deleting cluster? --- ## [Primary shard size higher than replicas](https://discuss.elastic.co/t/primary-shard-size-higher-than-replicas/254852)
**Author:** [@Susheem\_Koul](https://discuss.elastic.co/u/Susheem_Koul)\ **Replies:** 0\ **Last updated:** [November 10, 2020, 6:48am UTC](https://discuss.elastic.co/t/primary-shard-size-higher-than-replicas/254852 "2020-11-10T06:48:14Z")
Hi, We've been observing some strange behaviour on our ES Cluster for the last few weeks with the primary for a shard having a much higher size than the replica. Here's the output for shard details API. Notice shard 2 … --- ## [Logstash Integration with Azure](https://discuss.elastic.co/t/logstash-integration-with-azure/254851)
**Author:** [@manish9](https://discuss.elastic.co/u/manish9)\ **Replies:** 0\ **Last updated:** [November 10, 2020, 6:21am UTC](https://discuss.elastic.co/t/logstash-integration-with-azure/254851 "2020-11-10T06:21:59Z")
Can you please help me in finding a way to integrate the logs from different services in Azure to Logstash? --- ## [Logstash-input-file read all txt data](https://discuss.elastic.co/t/logstash-input-file-read-all-txt-data/254845)
**Author:** [@xiaoping1993](https://discuss.elastic.co/u/xiaoping1993)\ **Replies:** 0\ **Last updated:** [November 10, 2020, 3:59am UTC](https://discuss.elastic.co/t/logstash-input-file-read-all-txt-data/254845 "2020-11-10T03:59:10Z")
I want to read all txt data,so I set configuration: codec =\> multiline { pattern =\> "EOF" negate =\> true what =\> "previous" auto\_flush\_interval =\> 1 charset=\>"GBK" } but I can get all txt data except the Last lin… --- ## [Start from scratch every time you read a file for window logstash-input-file](https://discuss.elastic.co/t/start-from-scratch-every-time-you-read-a-file-for-window-logstash-input-file/254512)
**Author:** [@xiaoping1993](https://discuss.elastic.co/u/xiaoping1993)\ **Replies:** 3\ **Last updated:** [November 10, 2020, 3:55am UTC](https://discuss.elastic.co/t/start-from-scratch-every-time-you-read-a-file-for-window-logstash-input-file/254512 "2020-11-10T03:55:31Z")
I know if linux just set sincedb\_path =\> "/dev/null" but my os is window,and I find a method set sincedb\_path =\> "NUL",and it's not useful so if I want to realized this effect ,how I can do --- ## [SIEM feature request](https://discuss.elastic.co/t/siem-feature-request/254504)
**Author:** [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Replies:** 3\ **Last updated:** [November 10, 2020, 2:51am UTC](https://discuss.elastic.co/t/siem-feature-request/254504 "2020-11-10T02:51:13Z")
Hi all, i have noticed that the api search in elastic using the console is really fast compare to how the kibana search. I was wondering if there is any difference in how kibana KQL search with the text box and the api … --- ## [DNS filter is not working](https://discuss.elastic.co/t/dns-filter-is-not-working/254781)
**Author:** [@jhansibalu](https://discuss.elastic.co/u/jhansibalu)\ **Replies:** 1\ **Last updated:** [November 10, 2020, 2:20am UTC](https://discuss.elastic.co/t/dns-filter-is-not-working/254781 "2020-11-10T02:20:53Z")
Hi here I am trying to resolve the hostname to host ipaddress Here is my dns configuration in filter block mutate { rename =\> {"host" =\> "\[host\]\[hostname\]"} add\_field =\> {"\[host\]\[ipaddress\]" =\> "%{\[host\]\[hostname\]}"… --- ## [Grok Extractor Help](https://discuss.elastic.co/t/grok-extractor-help/254798)
**Author:** [@Micah\_Bailey](https://discuss.elastic.co/u/Micah_Bailey)\ **Replies:** 1\ **Last updated:** [November 10, 2020, 2:20am UTC](https://discuss.elastic.co/t/grok-extractor-help/254798 "2020-11-10T02:20:02Z")
I am new to Grok Extractors and I am trying to extract some fields from Logstash. Example Message: Nov 9 08:53:00 192.168.131.6 rsgpchkd\[867\]: Portforwarding for rsgcadc123215 on /dev/pts/0, destination 10.208.203.30:… --- ## [Data Volume](https://discuss.elastic.co/t/data-volume/254808)
**Author:** [@lks](https://discuss.elastic.co/u/lks)\ **Replies:** 4\ **Last updated:** [November 10, 2020, 2:10am UTC](https://discuss.elastic.co/t/data-volume/254808 "2020-11-10T02:10:11Z")
on the open source version, How much data does Elastic stack handle? Can I import a pipe delimited data in Kibana? What is the max volume size of data that I can import in Kibana? --- ## [Два Elasticsearch на одном хосте. Серты и порты](https://discuss.elastic.co/t/elasticsearch/252719)
**Author:** [@Sergei\_Frolov](https://discuss.elastic.co/u/Sergei_Frolov)\ **Replies:** 8\ **Last updated:** [November 10, 2020, 1:33am UTC](https://discuss.elastic.co/t/elasticsearch/252719 "2020-11-10T01:33:14Z")
Добрый день! Скажите пожалуйста, как правильно разместить на одном хосте два Elasticsearch? Как выпустить серты для каждого, с учетом того, что серты выпускаются на ip или на dns? Или два Elasticsearch могут работать с… --- ## [Unique count and bucket aggregation with top hits](https://discuss.elastic.co/t/unique-count-and-bucket-aggregation-with-top-hits/254698)
**Author:** [@smruthip](https://discuss.elastic.co/u/smruthip)\ **Replies:** 3\ **Last updated:** [November 9, 2020, 5:28pm UTC](https://discuss.elastic.co/t/unique-count-and-bucket-aggregation-with-top-hits/254698 "2020-11-09T17:28:48Z")
Hi all, I want to display unique count of container\_id's for each state. I want to do a bucket aggregation to get the latest state of the container and then do a unique count of the containers for each state to get the… --- ## [Implement collocation in ElasticSearch](https://discuss.elastic.co/t/implement-collocation-in-elasticsearch/254118)
**Author:** [@a22xel](https://discuss.elastic.co/u/a22xel)\ **Replies:** 1\ **Last updated:** [November 9, 2020, 10:16pm UTC](https://discuss.elastic.co/t/implement-collocation-in-elasticsearch/254118 "2020-11-09T22:16:16Z")
I am new in Elastic Search Usage I am trying to do an analyser or an ingest pipeline that would create collocations of words ( unigram, bigrams, trigrams with a step up to 2 ) . I am aware it's feasible in python but I a… --- ## [How to "recreate" events from an index by just changing time?](https://discuss.elastic.co/t/how-to-recreate-events-from-an-index-by-just-changing-time/254761)
**Author:** [@kelk](https://discuss.elastic.co/u/kelk)\ **Replies:** 1\ **Last updated:** [November 9, 2020, 10:06pm UTC](https://discuss.elastic.co/t/how-to-recreate-events-from-an-index-by-just-changing-time/254761 "2020-11-09T22:06:21Z")
hi We have some "enriched" events in an index from last month for a customer product checkout. The enrichment has happened in "elastic beats" && "logstash" and not entirely in my control. So I cannot simulate the \_raw e… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1158) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1160)