# \#none **URL:** https://discuss.elastic.co/tag/none.md?page=1213 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1214 --- ## [Yarn start not starting up](https://discuss.elastic.co/t/yarn-start-not-starting-up/250426)
**Author:** [@anjana1](https://discuss.elastic.co/u/anjana1)\ **Replies:** 4\ **Last updated:** [October 1, 2020, 7:26pm UTC](https://discuss.elastic.co/t/yarn-start-not-starting-up/250426 "2020-10-01T19:26:29Z")
i am trying to follow https://www.elastic.co/guide/en/kibana/7.9/development-getting-started.html . But when i do yarn kbn bootstrap I get the below error. Instead of cloning I downloaded the branch. \[4/5\] Linking depen… --- ## [Logstash started but filebeat says connection refused](https://discuss.elastic.co/t/logstash-started-but-filebeat-says-connection-refused/250732)
**Author:** [@Sravan\_Kumar\_Guduru](https://discuss.elastic.co/u/Sravan_Kumar_Guduru)\ **Replies:** 0\ **Last updated:** [October 1, 2020, 7:07pm UTC](https://discuss.elastic.co/t/logstash-started-but-filebeat-says-connection-refused/250732 "2020-10-01T19:07:50Z")
Interestingly my logstash is running when I tried ps -ef | grep logstash and when my filebeat tries to send the logs it is getting connection refused error. When I even do telent , i get below error message \[root@Ganes… --- ## [Filebeat is not sending logs to Logstash, logstash is localhost](https://discuss.elastic.co/t/filebeat-is-not-sending-logs-to-logstash-logstash-is-localhost/250586)
**Author:** [@Sravan\_Kumar\_Guduru](https://discuss.elastic.co/u/Sravan_Kumar_Guduru)\ **Replies:** 4\ **Last updated:** [October 1, 2020, 7:06pm UTC](https://discuss.elastic.co/t/filebeat-is-not-sending-logs-to-logstash-logstash-is-localhost/250586 "2020-10-01T19:06:46Z")
Hi All, I am having trouble with my filebeat/logstash. connectivity seems to be inconsistenst. When i try it in debug mode it works fine but when i use it with systemctl start it fails . Below are my filebeat and logst… --- ## [Custom table color](https://discuss.elastic.co/t/custom-table-color/250594)
**Author:** [@anjana1](https://discuss.elastic.co/u/anjana1)\ **Replies:** 6\ **Last updated:** [October 1, 2020, 6:33pm UTC](https://discuss.elastic.co/t/custom-table-color/250594 "2020-10-01T18:33:41Z")
Kibana version : 7.9 Elasticsearch version : 7.9 APM Server version : 7.9 APM Agent language and version : java 1.8 Fresh install or upgraded from other version? fresh install Is there anything special in your … --- ## [Sort Elasticsearch output in Logstash](https://discuss.elastic.co/t/sort-elasticsearch-output-in-logstash/250723)
**Author:** [@Nikopoulos](https://discuss.elastic.co/u/Nikopoulos)\ **Replies:** 0\ **Last updated:** [October 1, 2020, 4:53pm UTC](https://discuss.elastic.co/t/sort-elasticsearch-output-in-logstash/250723 "2020-10-01T16:53:16Z")
I have 2 logstash pipelines. The first one uploads log lines in elasticsearch using csv filter. These are the columns \[timestamp,machine,application\]. The other pipeline gets data from elasticsearch, sorts them by timest… --- ## [Event with multiple patterns](https://discuss.elastic.co/t/event-with-multiple-patterns/250700)
**Author:** [@fluss](https://discuss.elastic.co/u/fluss)\ **Replies:** 1\ **Last updated:** [October 1, 2020, 3:44pm UTC](https://discuss.elastic.co/t/event-with-multiple-patterns/250700 "2020-10-01T15:44:28Z")
Hello, I have an event as on below: Rule 'device' failed for user 'user45' reason 'Rule1:OS not found'. grok { match =\> \["event","%{GREEDYDATA}reason '%{GREEDYDATA:rule}:%{GREEDYDATA:reason}'."\] } rule: Rule1 reas… --- ## [Logstash - If %{statement} has "value"](https://discuss.elastic.co/t/logstash-if-statement-has-value/250702)
**Author:** [@headtea](https://discuss.elastic.co/u/headtea)\ **Replies:** 2\ **Last updated:** [October 1, 2020, 3:22pm UTC](https://discuss.elastic.co/t/logstash-if-statement-has-value/250702 "2020-10-01T15:22:12Z")
In Logstash, I'm trying to set a condition where if within a file named "cowrie.json", if a new message is received that starts with "login attempt\*" - send an email. This is what I tried: output { if \[log\]\[file\]\[pat… --- ## [Linux auditd grokking without auditbeat (but from files)](https://discuss.elastic.co/t/linux-auditd-grokking-without-auditbeat-but-from-files/250710)
**Author:** [@kelk](https://discuss.elastic.co/u/kelk)\ **Replies:** 0\ **Last updated:** [October 1, 2020, 3:21pm UTC](https://discuss.elastic.co/t/linux-auditd-grokking-without-auditbeat-but-from-files/250710 "2020-10-01T15:21:52Z")
We have quite lot of devices sending auditd dataset via syslog and/or filebeats (where we don't have control to install auditbeat). Does anyone have a auditd module for parsing the dataset and enrichment within logstash?… --- ## [UNABLE TO UPDATE THE DOCUMENT USING MONGODB LOGSTASH PLUGIN](https://discuss.elastic.co/t/unable-to-update-the-document-using-mongodb-logstash-plugin/250695)
**Author:** [@Raja\_Kushwah](https://discuss.elastic.co/u/Raja_Kushwah)\ **Replies:** 1\ **Last updated:** [October 1, 2020, 3:21pm UTC](https://discuss.elastic.co/t/unable-to-update-the-document-using-mongodb-logstash-plugin/250695 "2020-10-01T15:21:05Z")
Hi, I am trying to migrate the data using logstash mongodb plugin .. I am able to migrate the data but it is failing while updating the data in mongo db as it is creating a new document while i am trying to append or up… --- ## [How to expose elasticsearch externally](https://discuss.elastic.co/t/how-to-expose-elasticsearch-externally/250704)
**Author:** [@Kay\_Khan](https://discuss.elastic.co/u/Kay_Khan)\ **Replies:** 0\ **Last updated:** [October 1, 2020, 3:02pm UTC](https://discuss.elastic.co/t/how-to-expose-elasticsearch-externally/250704 "2020-10-01T15:02:49Z")
Hi i would like to expose my elasticsearch cluster in kubernetes created using ECK so it can be accessed externally. I have a requriement to setup Functionbeat to ship aws lambda cloudwatch logs to elastcsearch. Please… --- ## [CEF codec plugin](https://discuss.elastic.co/t/cef-codec-plugin/250644)
**Author:** [@david.preston](https://discuss.elastic.co/u/david.preston)\ **Replies:** 1\ **Last updated:** [October 1, 2020, 2:29pm UTC](https://discuss.elastic.co/t/cef-codec-plugin/250644 "2020-10-01T14:29:43Z")
Hi I'd like to use the CEF codec as a filter plugin - is this possible? In a similar way that you have a json input codec, and a json filter plugin. I would like to check the message is a CEF message, and process appr… --- ## [Elastic api is not working in elk6](https://discuss.elastic.co/t/elastic-api-is-not-working-in-elk6/248751)
**Author:** [@rajkumar.m](https://discuss.elastic.co/u/rajkumar.m)\ **Replies:** 5\ **Last updated:** [October 1, 2020, 2:26pm UTC](https://discuss.elastic.co/t/elastic-api-is-not-working-in-elk6/248751 "2020-10-01T14:26:49Z")
Hi Team, I am unable to create search by using elastic API, the same thing is wokring on ELK5 but not working in ELK6. Please help. Please find the below command & error: curl -H 'Authorization:Basic XXXXXXXXXX' -H … --- ## [License question - am I basic or open source?](https://discuss.elastic.co/t/license-question-am-i-basic-or-open-source/247692)
**Author:** [@bn1980](https://discuss.elastic.co/u/bn1980)\ **Replies:** 6\ **Last updated:** [October 1, 2020, 2:10pm UTC](https://discuss.elastic.co/t/license-question-am-i-basic-or-open-source/247692 "2020-10-01T14:10:47Z")
I have installed ELK stack on FreeBSD using pkg manager. Kibana reports my license as BASIC. I don't appear to have the suricata module. Can someone please confirm which license i have? --- ## [Searching through PDF attachments and other documents in ElasticSearch with one query](https://discuss.elastic.co/t/searching-through-pdf-attachments-and-other-documents-in-elasticsearch-with-one-query/250519)
**Author:** [@Bertrand\_Nau](https://discuss.elastic.co/u/Bertrand_Nau)\ **Replies:** 5\ **Last updated:** [October 1, 2020, 1:46pm UTC](https://discuss.elastic.co/t/searching-through-pdf-attachments-and-other-documents-in-elasticsearch-with-one-query/250519 "2020-10-01T13:46:57Z")
Hello everybody, I'm using the ingest-attachment plugin to parse PDF files in an ElasticSearch 7 cluster. Each PDF file gives additional informations to an already existing document. I try to create a query which retri… --- ## [Wrong timestamp on kibana](https://discuss.elastic.co/t/wrong-timestamp-on-kibana/249979)
**Author:** [@leostereo](https://discuss.elastic.co/u/leostereo)\ **Replies:** 6\ **Last updated:** [October 1, 2020, 1:35pm UTC](https://discuss.elastic.co/t/wrong-timestamp-on-kibana/249979 "2020-10-01T13:35:01Z")
Hi , guys. I can not properly set time on my kibana web. As you can see on picture bellow , timestamp on kibana and timestamp on elasticsearch returned document has a 3 hours difference. Other: Both , kiabana and ela… --- ## [Return only needed fields in response without metadata](https://discuss.elastic.co/t/return-only-needed-fields-in-response-without-metadata/250639)
**Author:** [@Nick\_Name](https://discuss.elastic.co/u/Nick_Name)\ **Replies:** 3\ **Last updated:** [October 1, 2020, 1:24pm UTC](https://discuss.elastic.co/t/return-only-needed-fields-in-response-without-metadata/250639 "2020-10-01T13:24:37Z")
Can I specify my SearchSourceBuilder or SearchRequest for return in SearchResponse only fields without metadata? Include fields and Exclude don't work. I want to return only code.keyword and id.keyword fields in response… --- ## [Upgrading from 2.4 -\> 7.9, Synonym reserved words?](https://discuss.elastic.co/t/upgrading-from-2-4-7-9-synonym-reserved-words/250197)
**Author:** [@ronchalant](https://discuss.elastic.co/u/ronchalant)\ **Replies:** 2\ **Last updated:** [October 1, 2020, 1:22pm UTC](https://discuss.elastic.co/t/upgrading-from-2-4-7-9-synonym-reserved-words/250197 "2020-10-01T13:22:35Z")
We're doing a big upgrade on various indexes, going from 2.4 -\> 7.9. One thing we're running into is we had a number of synonyms that had the words 'and' and 'or' in them, and they're being rejected by 7.9. One of them… --- ## [Bootstrap checks failed](https://discuss.elastic.co/t/bootstrap-checks-failed/250679)
**Author:** [@muthug](https://discuss.elastic.co/u/muthug)\ **Replies:** 4\ **Last updated:** [October 1, 2020, 1:11pm UTC](https://discuss.elastic.co/t/bootstrap-checks-failed/250679 "2020-10-01T13:11:48Z")
\[2020-10-01T14:44:51,442\]\[INFO \]\[o.e.e.NodeEnvironment \] \[graylogES-1\] using \[1\] data paths, mounts \[\[/opt (/dev/mapper/vg00-lvopt)\]\], net usable\_space \[12.8gb\], net total\_space \[25.4gb\], types \[ext4\] \[2020-10-01T14:… --- ## [Querying parent-child documents](https://discuss.elastic.co/t/querying-parent-child-documents/250631)
**Author:** [@Priyam\_Maheshwari](https://discuss.elastic.co/u/Priyam_Maheshwari)\ **Replies:** 1\ **Last updated:** [October 1, 2020, 1:08pm UTC](https://discuss.elastic.co/t/querying-parent-child-documents/250631 "2020-10-01T13:08:46Z")
I have a following index which stores the course details (I have truncated some attributes for brevity): { "settings": { "index": { "number\_of\_replicas": "1", "number\_of\_shards": "1" } }, "alia… --- ## [Harvester could not be started on new file: /usr/share/apps/logs/sample.log](https://discuss.elastic.co/t/harvester-could-not-be-started-on-new-file-usr-share-apps-logs-sample-log/250648)
**Author:** [@jaraws](https://discuss.elastic.co/u/jaraws)\ **Replies:** 0\ **Last updated:** [October 1, 2020, 10:32am UTC](https://discuss.elastic.co/t/harvester-could-not-be-started-on-new-file-usr-share-apps-logs-sample-log/250648 "2020-10-01T10:32:21Z")
I am getting following error while starting Filebeat container. 2020-10-01 ERROR log/input.go:519 Harvester could not be started on new file: /usr/share/apps/logs/sample.log, Err: registry already stopped … --- ## [Roll up index does not populate Time field](https://discuss.elastic.co/t/roll-up-index-does-not-populate-time-field/249681)
**Author:** [@zaratustra689](https://discuss.elastic.co/u/zaratustra689)\ **Replies:** 3\ **Last updated:** [October 1, 2020, 12:57pm UTC](https://discuss.elastic.co/t/roll-up-index-does-not-populate-time-field/249681 "2020-10-01T12:57:12Z")
Hi! I'm new to Roll Up index feature and I'm trying to configure some basic index so that I can start doing queries and visualizations. I'm using ElasticSearch Stack in version 6.6.2 with the sample web logs that comes… --- ## [Change 'total\_auto\_throttle\_in\_bytes' in Elasticsearch](https://discuss.elastic.co/t/change-total-auto-throttle-in-bytes-in-elasticsearch/249463)
**Author:** [@Bahar\_Yilmaz](https://discuss.elastic.co/u/Bahar_Yilmaz)\ **Replies:** 3\ **Last updated:** [October 1, 2020, 12:35pm UTC](https://discuss.elastic.co/t/change-total-auto-throttle-in-bytes-in-elasticsearch/249463 "2020-10-01T12:35:21Z")
Is there any way to change ' total\_auto\_throttle\_in\_bytes' value in Elasticsearch. Is this value changable ? Thanks in advance. --- ## [Complex query with priorities](https://discuss.elastic.co/t/complex-query-with-priorities/250667)
**Author:** [@Patrik\_Vaclavek](https://discuss.elastic.co/u/Patrik_Vaclavek)\ **Replies:** 0\ **Last updated:** [October 1, 2020, 12:00pm UTC](https://discuss.elastic.co/t/complex-query-with-priorities/250667 "2020-10-01T12:00:24Z")
Hello, I am struggling to figure this out. I've got products with many prices based on available discounts and price lists with assigned priorities. The 'price' part mapping looks like this: "price": { "properties"… --- ## [Export kibana viisualization using api](https://discuss.elastic.co/t/export-kibana-viisualization-using-api/250009)
**Author:** [@liorg2](https://discuss.elastic.co/u/liorg2)\ **Replies:** 5\ **Last updated:** [October 1, 2020, 11:47am UTC](https://discuss.elastic.co/t/export-kibana-viisualization-using-api/250009 "2020-10-01T11:47:37Z")
Hello Is there any way to make an api/ curl request to Kibana, and get a graph image (any type of visualization)? --- ## [Configure logstash to show logs from port 5002](https://discuss.elastic.co/t/configure-logstash-to-show-logs-from-port-5002/250205)
**Author:** [@Lusca\_lusca](https://discuss.elastic.co/u/Lusca_lusca)\ **Replies:** 19\ **Last updated:** [October 1, 2020, 11:44am UTC](https://discuss.elastic.co/t/configure-logstash-to-show-logs-from-port-5002/250205 "2020-10-01T11:44:56Z")
I am knew to ELK and I can't see the logs coming from port 5002 on kibana. Can anyone please help me configure logstash to send the logs to kibana? --- ## [Encrypting traffic between browser and kibana](https://discuss.elastic.co/t/encrypting-traffic-between-browser-and-kibana/250569)
**Author:** [@Joe\_Monaco](https://discuss.elastic.co/u/Joe_Monaco)\ **Replies:** 4\ **Last updated:** [October 1, 2020, 11:34am UTC](https://discuss.elastic.co/t/encrypting-traffic-between-browser-and-kibana/250569 "2020-10-01T11:34:19Z")
https://www.elastic.co/guide/en/kibana/current/configuring-tls.html provides steps to enable encryption between browser and kibana. Following these instructions on a 7.9.2 instance and using a server certificate/private… --- ## [Double documents?](https://discuss.elastic.co/t/double-documents/248991)
**Author:** [@Tuckson](https://discuss.elastic.co/u/Tuckson)\ **Replies:** 13\ **Last updated:** [October 1, 2020, 10:56am UTC](https://discuss.elastic.co/t/double-documents/248991 "2020-10-01T10:56:48Z")
Hi, For some reason, all documents end up twice in my indexes. and I do not have the slightest idea why... I mean... Even the doc\_id seems the same. Consider these 2: Both exactly the same. When I log this on the a… --- ## [Failed to parse field \[datasize\] of type \[integer\] in document with id](https://discuss.elastic.co/t/failed-to-parse-field-datasize-of-type-integer-in-document-with-id/250650)
**Author:** [@martb](https://discuss.elastic.co/u/martb)\ **Replies:** 0\ **Last updated:** [October 1, 2020, 10:56am UTC](https://discuss.elastic.co/t/failed-to-parse-field-datasize-of-type-integer-in-document-with-id/250650 "2020-10-01T10:56:16Z")
Hi, I'm getting the following error from logstash. The field is mapped as an integer and the number is only 11 digits long. Is this mapped as the correct type? Please advise. \[2020-10-01T10:10:18,893\]\[WARN \]\[logstash.o… --- ## [System Requirements](https://discuss.elastic.co/t/system-requirements/250649)
**Author:** [@PatNae](https://discuss.elastic.co/u/PatNae)\ **Replies:** 0\ **Last updated:** [October 1, 2020, 10:42am UTC](https://discuss.elastic.co/t/system-requirements/250649 "2020-10-01T10:42:33Z")
Hi all I am working on a project where data is delivered to elasticsearch using winlogbeat - logstash - kiibana. There are 4 source servers, each 1 file with 1 GB, so 4 \* 1 GB, these data should be stored 180 Tg, so 411… --- ## [Manage Logstash using API](https://discuss.elastic.co/t/manage-logstash-using-api/250638)
**Author:** [@pchakour](https://discuss.elastic.co/u/pchakour)\ **Replies:** 0\ **Last updated:** [October 1, 2020, 9:59am UTC](https://discuss.elastic.co/t/manage-logstash-using-api/250638 "2020-10-01T09:59:25Z")
Hello ! I have a little question about Logstash management. I want to know if an API exists on Logstash to create, delete or edit a pipeline ? The ony API that I found in the documentation is dedicated to the Logstash… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1212) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1214)