# \#none **URL:** https://discuss.elastic.co/tag/none.md?page=1375 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1376 --- ## [Palo Alto \[SIEM\]](https://discuss.elastic.co/t/palo-alto-siem/237667)
**Author:** [@RdrgPorto](https://discuss.elastic.co/u/RdrgPorto)\ **Replies:** 2\ **Last updated:** [June 19, 2020, 2:27pm UTC](https://discuss.elastic.co/t/palo-alto-siem/237667 "2020-06-19T14:27:47Z")
Hi, everyone I have tested with Palo Alto module (Filebeat 7.5.2). I have used this module with Syslog and File inputs. Syslog - module: panw panos: enabled: true var.syslog\_host: 0.0.0.0 var.syslog\_port… --- ## [Elasticsearch input missing logs](https://discuss.elastic.co/t/elasticsearch-input-missing-logs/238071)
**Author:** [@magnalite](https://discuss.elastic.co/u/magnalite)\ **Replies:** 0\ **Last updated:** [June 22, 2020, 11:06am UTC](https://discuss.elastic.co/t/elasticsearch-input-missing-logs/238071 "2020-06-22T11:06:17Z")
I'm using the Elasticsearch input plugin to reindex through a Logstash pipeline however it appears as though it is mysteriously skipping ~20% of logs! I do not terminate the process myself and wait for it to come to comp… --- ## [Fastest way to restore ElasticSearch snapshot](https://discuss.elastic.co/t/fastest-way-to-restore-elasticsearch-snapshot/236572)
**Author:** [@bhuvaneshdct](https://discuss.elastic.co/u/bhuvaneshdct)\ **Replies:** 2\ **Last updated:** [June 22, 2020, 11:04am UTC](https://discuss.elastic.co/t/fastest-way-to-restore-elasticsearch-snapshot/236572 "2020-06-22T11:04:34Z")
I have 2 node elasticsearch cluster version 7.4. CPU 32 Memory 250G Disk IOPS 50K IOPS (SSD) Heap 32GB Snapshot size 3TB since its a bigger instance, how to change the config files to restore the snapshot in the faste… --- ## [How to debug elasticsearch logstash ingestion pipelines](https://discuss.elastic.co/t/how-to-debug-elasticsearch-logstash-ingestion-pipelines/237618)
**Author:** [@genehunter29009](https://discuss.elastic.co/u/genehunter29009)\ **Replies:** 1\ **Last updated:** [June 22, 2020, 10:28am UTC](https://discuss.elastic.co/t/how-to-debug-elasticsearch-logstash-ingestion-pipelines/237618 "2020-06-22T10:28:57Z")
Trying to use the pipelines in a beats config on logstash. The issue is its not seeing the pipeline so the data is going straight into the index unprocessed. I am sure something is wrong with the code that builds the pip… --- ## [Terms aggregation on a nested field for calculating stats based on a parent-field](https://discuss.elastic.co/t/terms-aggregation-on-a-nested-field-for-calculating-stats-based-on-a-parent-field/237932)
**Author:** [@Andy1990](https://discuss.elastic.co/u/Andy1990)\ **Replies:** 1\ **Last updated:** [June 22, 2020, 10:01am UTC](https://discuss.elastic.co/t/terms-aggregation-on-a-nested-field-for-calculating-stats-based-on-a-parent-field/237932 "2020-06-22T10:01:58Z")
Hello, in my use case i have documents with a client and a price. The client is a nested object (containing id, and acronym), the price is on the first json level of my source). I would like to calculate metric values (… --- ## [After upgrading logstash to 6.6, I get failed authentication due to: SSL handshake failed](https://discuss.elastic.co/t/after-upgrading-logstash-to-6-6-i-get-failed-authentication-due-to-ssl-handshake-failed/238052)
**Author:** [@Zalman\_Goldstein1](https://discuss.elastic.co/u/Zalman_Goldstein1)\ **Replies:** 0\ **Last updated:** [June 22, 2020, 9:27am UTC](https://discuss.elastic.co/t/after-upgrading-logstash-to-6-6-i-get-failed-authentication-due-to-ssl-handshake-failed/238052 "2020-06-22T09:27:58Z")
we have kafka\_2.12-2.3.0, and use logstash. after upgrading to logstash version 6.6, and plugin 7.3.2 logstash-output-kafka, we got an error of The setting ssl in plugin kafka is obsolete and is no longer available. … --- ## [Filter ruby exception occurred with no message](https://discuss.elastic.co/t/filter-ruby-exception-occurred-with-no-message/238051)
**Author:** [@sam\_rui](https://discuss.elastic.co/u/sam_rui)\ **Replies:** 0\ **Last updated:** [June 22, 2020, 9:24am UTC](https://discuss.elastic.co/t/filter-ruby-exception-occurred-with-no-message/238051 "2020-06-22T09:24:35Z")
I encountered same issue with https://discuss.elastic.co/t/ruby-exception-with-no-message/198887. following is logstash log info. following is configuration info. When I get output, the "index\_postfix" can not b… --- ## [Bar chart percentage not working](https://discuss.elastic.co/t/bar-chart-percentage-not-working/237525)
**Author:** [@mr\_searchng](https://discuss.elastic.co/u/mr_searchng)\ **Replies:** 4\ **Last updated:** [June 22, 2020, 9:15am UTC](https://discuss.elastic.co/t/bar-chart-percentage-not-working/237525 "2020-06-22T09:15:32Z")
all values seem to be one hundred percent. instead this is the way I want. --- ## [Aggregations & or query](https://discuss.elastic.co/t/aggregations-or-query/237784)
**Author:** [@gbu](https://discuss.elastic.co/u/gbu)\ **Replies:** 2\ **Last updated:** [June 22, 2020, 9:01am UTC](https://discuss.elastic.co/t/aggregations-or-query/237784 "2020-06-22T09:01:17Z")
Hi, { 'id': 1, 'productType': 'a'} { 'id': 2, 'productType': 'b'} { 'id': 3, 'productType': 'c'} we are doing a query with aggregations like { "aggs": { "productType": { … --- ## [/usr/share/elasticsearch/tmp\] does not exist](https://discuss.elastic.co/t/usr-share-elasticsearch-tmp-does-not-exist/238046)
**Author:** [@Matt\_Ayres](https://discuss.elastic.co/u/Matt_Ayres)\ **Replies:** 0\ **Last updated:** [June 22, 2020, 8:56am UTC](https://discuss.elastic.co/t/usr-share-elasticsearch-tmp-does-not-exist/238046 "2020-06-22T08:56:48Z")
Hi GUys after downloading the latest rpm and and installing for the first time I am getting this error in the logs: Jun 22 09:47:31 ssd316r.simpleservers.co.uk systemd\[1\]: Starting Elasticsearch... Jun 22 09:47:32 ssd31… --- ## [SAP .AUD log parsin](https://discuss.elastic.co/t/sap-aud-log-parsin/238041)
**Author:** [@yasin\_mohammed](https://discuss.elastic.co/u/yasin_mohammed)\ **Replies:** 0\ **Last updated:** [June 22, 2020, 8:36am UTC](https://discuss.elastic.co/t/sap-aud-log-parsin/238041 "2020-06-22T08:36:49Z")
Hi... I am trying to parse a .AUD log file of SAP through logstash. The log is in binary. Any clues on what is the encoding to use for SAP .AUD files to read them in logstash. --- ## [Elasticsearch as primary datastore for chat application](https://discuss.elastic.co/t/elasticsearch-as-primary-datastore-for-chat-application/238014)
**Author:** [@Deshmukhm](https://discuss.elastic.co/u/Deshmukhm)\ **Replies:** 1\ **Last updated:** [June 22, 2020, 8:29am UTC](https://discuss.elastic.co/t/elasticsearch-as-primary-datastore-for-chat-application/238014 "2020-06-22T08:29:56Z")
As per various articles to choose elasticsearch as a primary datasource is solely depends on the usecase. So if I want to implement chat application similar to Microsoft teams or any, Will it be a good idea to use it as … --- ## [Problem beetween elastic and logstash: csv files are saved twice](https://discuss.elastic.co/t/problem-beetween-elastic-and-logstash-csv-files-are-saved-twice/236655)
**Author:** [@IneedHelp](https://discuss.elastic.co/u/IneedHelp)\ **Replies:** 5\ **Last updated:** [June 22, 2020, 8:27am UTC](https://discuss.elastic.co/t/problem-beetween-elastic-and-logstash-csv-files-are-saved-twice/236655 "2020-06-22T08:27:13Z")
Hello ! I use ELK to parse log file and csv file but yesterday a little problem appeared. All the data in my csv file were saved twice so a 1000 lines document is now a 2000 lines document. In fact you just have to divi… --- ## [Fatal error: \[config validation of server.uuid\]: must be a valid uuid](https://discuss.elastic.co/t/fatal-error-config-validation-of-server-uuid-must-be-a-valid-uuid/237866)
**Author:** [@pr0b3l](https://discuss.elastic.co/u/pr0b3l)\ **Replies:** 1\ **Last updated:** [June 22, 2020, 8:11am UTC](https://discuss.elastic.co/t/fatal-error-config-validation-of-server-uuid-must-be-a-valid-uuid/237866 "2020-06-22T08:11:06Z")
Hello guys! I setup prod.server (7.6 version all stack): Using Kibana in a production environment | Kibana Guide \[7.6\] | Elastic Settings unique across each Kibana instance: server.uuid server.name server.uuid in … --- ## [Netflow codec. Wrong data](https://discuss.elastic.co/t/netflow-codec-wrong-data/238029)
**Author:** [@swb](https://discuss.elastic.co/u/swb)\ **Replies:** 0\ **Last updated:** [June 22, 2020, 7:52am UTC](https://discuss.elastic.co/t/netflow-codec-wrong-data/238029 "2020-06-22T07:52:21Z")
Hello friends, We want to replace our old system for viewing Netflow (Nfsen) information with ELK. For this, we used the netflow module for Logstash. But we see fewer packets and bytes than it actually is. For example: … --- ## [Kibana sorts big numbers wrong](https://discuss.elastic.co/t/kibana-sorts-big-numbers-wrong/237326)
**Author:** [@jbeyer](https://discuss.elastic.co/u/jbeyer)\ **Replies:** 7\ **Last updated:** [June 22, 2020, 8:07am UTC](https://discuss.elastic.co/t/kibana-sorts-big-numbers-wrong/237326 "2020-06-22T08:07:24Z")
For a test, I inserted 1000 docs into elasticsearch index. One column has a consecutive number (3. column in the screen shot). This column is sorted ascending in Kibana. After the 253. row Kibana breaks the order and sho… --- ## [Logstash output to redis](https://discuss.elastic.co/t/logstash-output-to-redis/237892)
**Author:** [@kase](https://discuss.elastic.co/u/kase)\ **Replies:** 2\ **Last updated:** [June 22, 2020, 8:03am UTC](https://discuss.elastic.co/t/logstash-output-to-redis/237892 "2020-06-22T08:03:09Z")
Hi there, my logstash will get lots of data from other's API, after filter these data, logstash will output to redis. I want to ask some questions: redis is a key-value database, how to let logstash know which is key… --- ## [Winlogbeat index pattern not showing up on kibana](https://discuss.elastic.co/t/winlogbeat-index-pattern-not-showing-up-on-kibana/237608)
**Author:** [@norup](https://discuss.elastic.co/u/norup)\ **Replies:** 1\ **Last updated:** [June 22, 2020, 7:51am UTC](https://discuss.elastic.co/t/winlogbeat-index-pattern-not-showing-up-on-kibana/237608 "2020-06-22T07:51:26Z")
I can see the index has been made here, but it looks like theres 0 documents in it. But for some reason its not showing up here I have run the command .\\winlogbeat.exe setup --index-management -E output.logstash.en… --- ## [Elasticsearch Log Files](https://discuss.elastic.co/t/elasticsearch-log-files/238015)
**Author:** [@DawitCh](https://discuss.elastic.co/u/DawitCh)\ **Replies:** 0\ **Last updated:** [June 22, 2020, 6:54am UTC](https://discuss.elastic.co/t/elasticsearch-log-files/238015 "2020-06-22T06:54:33Z")
I have a custom path to store Elasticsearch log files (around 5 GB). It already full and I don't know how to clear it automatically. For the data, I already set ILM so it never reaches 60%. I don't know is it has log ret… --- ## [Logstashでファイルオープンに失敗](https://discuss.elastic.co/t/logstash/238009)
**Author:** [@t-nakata](https://discuss.elastic.co/u/t-nakata)\ **Replies:** 0\ **Last updated:** [June 22, 2020, 6:20am UTC](https://discuss.elastic.co/t/logstash/238009 "2020-06-22T06:20:33Z")
logstashでシスログに以下のエラーが発生しました。原因をご教示頂けないでしょうか \[filewatch.tailmode.handlers.create\]\[\<ログ名\>\] failed to open /XXX/XXX/XXX.log: #\, \["org/jruby/RubyIO.java:1239:in sysopen'",… --- ## [How to customize time range for a particular visualization in a dasboard in kibana version 7.7 OSS license](https://discuss.elastic.co/t/how-to-customize-time-range-for-a-particular-visualization-in-a-dasboard-in-kibana-version-7-7-oss-license/238008)
**Author:** [@Mayank\_Damani](https://discuss.elastic.co/u/Mayank_Damani)\ **Replies:** 0\ **Last updated:** [June 22, 2020, 6:16am UTC](https://discuss.elastic.co/t/how-to-customize-time-range-for-a-particular-visualization-in-a-dasboard-in-kibana-version-7-7-oss-license/238008 "2020-06-22T06:16:51Z")
Hello, According to my requirement i need to customize the time range of some visualizations in my dashboard apart from dashboard time range. This feature exist in Kibana version 7.6 but as upgraded to 7.7 OSS license v… --- ## [Very high CPU usage on one Elasticsearch Java.exe](https://discuss.elastic.co/t/very-high-cpu-usage-on-one-elasticsearch-java-exe/237072)
**Author:** [@Manikandan\_Selvaraj](https://discuss.elastic.co/u/Manikandan_Selvaraj)\ **Replies:** 21\ **Last updated:** [June 22, 2020, 6:16am UTC](https://discuss.elastic.co/t/very-high-cpu-usage-on-one-elasticsearch-java-exe/237072 "2020-06-22T06:16:20Z")
Hi Team, I have very limited data in Elastic search. I have hosted my elastic search in VM. Most of the time Java usage more CPU usage. So My site getting slow due to this. My elastic search version - 2.3.2 Why it hap… --- ## [Logstash doesn't start due to Charset issue](https://discuss.elastic.co/t/logstash-doesnt-start-due-to-charset-issue/237291)
**Author:** [@sahere37](https://discuss.elastic.co/u/sahere37)\ **Replies:** 5\ **Last updated:** [June 22, 2020, 6:15am UTC](https://discuss.elastic.co/t/logstash-doesnt-start-due-to-charset-issue/237291 "2020-06-22T06:15:00Z")
hi all I installed logstash v. 6.6 on windows. my config file is as following: input { beats { port =\> 5044 } } output { elasticsearch { hosts =\> \["localhost:9200"\] index =\> "my\_log" … --- ## [Kibana API endpoint for AWS](https://discuss.elastic.co/t/kibana-api-endpoint-for-aws/237051)
**Author:** [@Lamppost](https://discuss.elastic.co/u/Lamppost)\ **Replies:** 6\ **Last updated:** [June 22, 2020, 5:35am UTC](https://discuss.elastic.co/t/kibana-api-endpoint-for-aws/237051 "2020-06-22T05:35:30Z")
Hi, I have created an elastic search cluster on aws and am using kibana to visualize the data. I can't seem to figure out how to use the Kibana API for saved objects with my AWS endpoint. The Kibana URL given to me by A… --- ## [Logstash multiple ruby filter](https://discuss.elastic.co/t/logstash-multiple-ruby-filter/237758)
**Author:** [@ohoroyoi](https://discuss.elastic.co/u/ohoroyoi)\ **Replies:** 4\ **Last updated:** [June 22, 2020, 5:15am UTC](https://discuss.elastic.co/t/logstash-multiple-ruby-filter/237758 "2020-06-22T05:15:17Z")
I'm bringing table A and B from postgres. I want to apply the ruby filter in different forms. How should I set it up? input { jdbc { tags =\> table A } jdbc { tags =\> table B } } filter { ruby { code=\>… --- ## [Logstash Netflow Codec support for Multiple Definition files](https://discuss.elastic.co/t/logstash-netflow-codec-support-for-multiple-definition-files/237998)
**Author:** [@bniranjanbhat](https://discuss.elastic.co/u/bniranjanbhat)\ **Replies:** 0\ **Last updated:** [June 22, 2020, 4:41am UTC](https://discuss.elastic.co/t/logstash-netflow-codec-support-for-multiple-definition-files/237998 "2020-06-22T04:41:09Z")
Hi All, I am trying to get the netflow codec work with multiple definition files. I understand that "netflow\_definitions" configuration option is a valid file system path. However, when I try to configure this path as… --- ## [When index rollover by ilm, the date can't be update](https://discuss.elastic.co/t/when-index-rollover-by-ilm-the-date-cant-be-update/236133)
**Author:** [@111258](https://discuss.elastic.co/u/111258)\ **Replies:** 2\ **Last updated:** [June 22, 2020, 3:40am UTC](https://discuss.elastic.co/t/when-index-rollover-by-ilm-the-date-cant-be-update/236133 "2020-06-22T03:40:24Z")
I can use ilm to rollover index by date on none prod env, like this: POST rehearsal-k8s-logs/\_rollover?dry\_run { "conditions" : { "max\_age": "1d", "max\_size": "20gb" } } --- { "acknowledged" : false, "… --- ## [Kibana 7.8 New Feature (Drilldown)..How about going back UP?](https://discuss.elastic.co/t/kibana-7-8-new-feature-drilldown-how-about-going-back-up/237966)
**Author:** [@tenet\_testuser1](https://discuss.elastic.co/u/tenet_testuser1)\ **Replies:** 1\ **Last updated:** [June 22, 2020, 1:45am UTC](https://discuss.elastic.co/t/kibana-7-8-new-feature-drilldown-how-about-going-back-up/237966 "2020-06-22T01:45:36Z")
Hello, This feature, much awaited (personally), was great news to see in 7.8. https://www.elastic.co/guide/en/kibana/7.8/drilldowns.html#drilldowns-example However, Once I drilldown, there seems to be no-option to dri… --- ## [コンテナ再起動させると、Filebeatのログ収集が止まる](https://discuss.elastic.co/t/filebeat/236437)
**Author:** [@Negi700](https://discuss.elastic.co/u/Negi700)\ **Replies:** 4\ **Last updated:** [June 22, 2020, 12:45am UTC](https://discuss.elastic.co/t/filebeat/236437 "2020-06-22T00:45:50Z")
Kubernetes上のTomcatのコンテナのログを、Filebeatのコンテナで収集しています。 Tomcatのコンテナ再起動後、収集対象のログは更新されているのに、ログ収集のインスタンスが、 ログ更新を検知していないようで、Filebeatのログ収集が開始されません。。 ほかのアプリのログ収集も、同様に、コンテナの再起動をかけるとログ収集が止まります。 暫定対処として、アプリのコンテナ再起動後、Filebeatのコンテナ再… --- ## [Logs from Firewall CheckPoint](https://discuss.elastic.co/t/logs-from-firewall-checkpoint/237835)
**Author:** [@julianksanchez](https://discuss.elastic.co/u/julianksanchez)\ **Replies:** 8\ **Last updated:** [June 21, 2020, 3:37pm UTC](https://discuss.elastic.co/t/logs-from-firewall-checkpoint/237835 "2020-06-21T15:37:23Z")
Hello, I am new in Elastic, and I want to send the logs of our firewalls CheckPoint to logstash. I configurate the log exporter in CheckPoint, however we dont know how received and configurate this information in logsta… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1374) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1376)