# \#none **URL:** https://discuss.elastic.co/tag/none.md?page=1465 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1466 --- ## [Need Help for Creating Watcher for identifying occurence of same event](https://discuss.elastic.co/t/need-help-for-creating-watcher-for-identifying-occurence-of-same-event/231460)
**Author:** [@Rohit\_Kumbhar](https://discuss.elastic.co/u/Rohit_Kumbhar)\ **Replies:** 0\ **Last updated:** [May 7, 2020, 6:20am UTC](https://discuss.elastic.co/t/need-help-for-creating-watcher-for-identifying-occurence-of-same-event/231460 "2020-05-07T06:20:19Z")
Hey, I want to create a watcher that will give me alert for multiple occurrence of same value in field name for example there are 100 events in last 15 mins and out of those 100 events 10 events have same username ( … --- ## [Kibana UI customization and changes in home page](https://discuss.elastic.co/t/kibana-ui-customization-and-changes-in-home-page/230960)
**Author:** [@Potter\_Ginny](https://discuss.elastic.co/u/Potter_Ginny)\ **Replies:** 4\ **Last updated:** [May 7, 2020, 7:08am UTC](https://discuss.elastic.co/t/kibana-ui-customization-and-changes-in-home-page/230960 "2020-05-07T07:08:23Z")
Hello there, We updated the Kibana UI just by modifying some text to see if our changes will reflect, since we initially wanted to add more elements/ components on the home page such as more texts and links. In this sp… --- ## [Download Elasticsearch plugin behind proxy](https://discuss.elastic.co/t/download-elasticsearch-plugin-behind-proxy/231283)
**Author:** [@haythem](https://discuss.elastic.co/u/haythem)\ **Replies:** 3\ **Last updated:** [May 7, 2020, 7:03am UTC](https://discuss.elastic.co/t/download-elasticsearch-plugin-behind-proxy/231283 "2020-05-07T07:03:58Z")
Hi guys , i was wondering how to add proxy parameters to elasticsearch to download plugin ? i've tried following these steps but nothing happened https://www.elastic.co/guide/en/elasticsearch/plugins/current/\_other\_comma… --- ## [How to make logstash listen to port less than 1024](https://discuss.elastic.co/t/how-to-make-logstash-listen-to-port-less-than-1024/231467)
**Author:** [@Hari\_Krishna](https://discuss.elastic.co/u/Hari_Krishna)\ **Replies:** 0\ **Last updated:** [May 7, 2020, 6:59am UTC](https://discuss.elastic.co/t/how-to-make-logstash-listen-to-port-less-than-1024/231467 "2020-05-07T06:59:24Z")
i have my logs sent to port 514. But i get the following error. May 05 14:36:24 ubuntu logstash\[7187\]: \[2020-05-05T14:36:24,423\]\[INFO \]\[logstash.inputs.syslog \]\[main\] Starting syslog tcp listener {:address=\>"0.0.0.0:51… --- ## [I can create a document with a '/' in the ID but I can't delete it](https://discuss.elastic.co/t/i-can-create-a-document-with-a-in-the-id-but-i-cant-delete-it/231441)
**Author:** [@Sarang\_Dharmapurikar](https://discuss.elastic.co/u/Sarang_Dharmapurikar)\ **Replies:** 1\ **Last updated:** [May 7, 2020, 6:23am UTC](https://discuss.elastic.co/t/i-can-create-a-document-with-a-in-the-id-but-i-cant-delete-it/231441 "2020-05-07T06:23:32Z")
Hi folks, I tried to PUT a document in elastic index and I used a document ID that's: abc/xyz so it has a / in it. It gets created fine. But I'm not able to delete the document with that ID. Probably because the / is … --- ## [AIX and Solaris Beat Agent](https://discuss.elastic.co/t/aix-and-solaris-beat-agent/228035)
**Author:** [@darkwingzero](https://discuss.elastic.co/u/darkwingzero)\ **Replies:** 2\ **Last updated:** [May 7, 2020, 5:57am UTC](https://discuss.elastic.co/t/aix-and-solaris-beat-agent/228035 "2020-05-07T05:57:26Z")
Hi Elastic Partners, What are the option to crawl and ship logs from AIX and solaris Os to logstash? Thank you! --- ## [Cluster state is yellow due to unassigned shrads](https://discuss.elastic.co/t/cluster-state-is-yellow-due-to-unassigned-shrads/230462)
**Author:** [@DENMODSupport](https://discuss.elastic.co/u/DENMODSupport)\ **Replies:** 18\ **Last updated:** [May 7, 2020, 5:12am UTC](https://discuss.elastic.co/t/cluster-state-is-yellow-due-to-unassigned-shrads/230462 "2020-05-07T05:12:31Z")
Since there are 207 unassigned shrads, my cluster status became yellow. I ran the API "\_cluster/allocation/explain" and got below results. { "index": "en\_y\_29", "shard": 1, "primary": false, "current\_state": "unassi… --- ## [Exact match for string field](https://discuss.elastic.co/t/exact-match-for-string-field/230556)
**Author:** [@pyerunka](https://discuss.elastic.co/u/pyerunka)\ **Replies:** 8\ **Last updated:** [May 7, 2020, 3:51am UTC](https://discuss.elastic.co/t/exact-match-for-string-field/230556 "2020-05-07T03:51:01Z")
Hello, Can anyone help me to find out how we can get exact search term match using query? I have two field in my index. contentid Title So if i provide full value for contentid and title in query so it should give m… --- ## [How to combine exact search and wildcard in elasticsearch simple\_query\_string](https://discuss.elastic.co/t/how-to-combine-exact-search-and-wildcard-in-elasticsearch-simple-query-string/231445)
**Author:** [@111330](https://discuss.elastic.co/u/111330)\ **Replies:** 0\ **Last updated:** [May 7, 2020, 3:41am UTC](https://discuss.elastic.co/t/how-to-combine-exact-search-and-wildcard-in-elasticsearch-simple-query-string/231445 "2020-05-07T03:41:16Z")
I tried: GET /\_search { "query": { "simple\_query\_string" : { "query": "\\"sometext\*\\"", "fields": \["name"\], "default\_operator": "and", "quote\_field\_suffix": '.raw', "analyze\_… --- ## [The inserted data is not sorted correctly in kibana](https://discuss.elastic.co/t/the-inserted-data-is-not-sorted-correctly-in-kibana/231239)
**Author:** [@wajika](https://discuss.elastic.co/u/wajika)\ **Replies:** 2\ **Last updated:** [May 7, 2020, 2:48am UTC](https://discuss.elastic.co/t/the-inserted-data-is-not-sorted-correctly-in-kibana/231239 "2020-05-07T02:48:44Z")
The data is stored in kafka and pushed to elasticsearch by logstash --- ## [Logstash Filter with wrong result for deal with lots event at the same time](https://discuss.elastic.co/t/logstash-filter-with-wrong-result-for-deal-with-lots-event-at-the-same-time/231113)
**Author:** [@stanwang](https://discuss.elastic.co/u/stanwang)\ **Replies:** 2\ **Last updated:** [May 7, 2020, 2:42am UTC](https://discuss.elastic.co/t/logstash-filter-with-wrong-result-for-deal-with-lots-event-at-the-same-time/231113 "2020-05-07T02:42:11Z")
Hi, I use Winlogbeat to transmit Windows Event Log. My Logstash Filter use for parsing the "message" in the Json. The message content will like this, "RuleName: technique\_id=T1047,technique\_name=Windows Management Inst… --- ## [APM http context transferred to gRPC context](https://discuss.elastic.co/t/apm-http-context-transferred-to-grpc-context/231421)
**Author:** [@Evan\_Something](https://discuss.elastic.co/u/Evan_Something)\ **Replies:** 1\ **Last updated:** [May 7, 2020, 1:50am UTC](https://discuss.elastic.co/t/apm-http-context-transferred-to-grpc-context/231421 "2020-05-07T01:50:07Z")
Kibana version: 7.5.1 Elasticsearch version: 7.5.1 APM Server version: 7.5.1 APM Agent language and version: any Is there anything special in your setup? Working empty Elastic cluster in kubernetes/containers. I… --- ## [Kibana React - error when importing](https://discuss.elastic.co/t/kibana-react-error-when-importing/231431)
**Author:** [@Paul\_Gege](https://discuss.elastic.co/u/Paul_Gege)\ **Replies:** 2\ **Last updated:** [May 7, 2020, 1:40am UTC](https://discuss.elastic.co/t/kibana-react-error-when-importing/231431 "2020-05-07T01:40:06Z")
Hi all, I'm trying to explore what "kibana-react" does. I went through the github code (https://github.com/elastic/kibana/tree/master/src/plugins/kibana\_react) and tried to follow the instructions from the readme and ap… --- ## [X-pack-transport , x-pack-core.jar for the 6.5.4 version](https://discuss.elastic.co/t/x-pack-transport-x-pack-core-jar-for-the-6-5-4-version/231380)
**Author:** [@rthangaraj5](https://discuss.elastic.co/u/rthangaraj5)\ **Replies:** 1\ **Last updated:** [May 7, 2020, 1:39am UTC](https://discuss.elastic.co/t/x-pack-transport-x-pack-core-jar-for-the-6-5-4-version/231380 "2020-05-07T01:39:07Z")
Hi Team, I have added the x-pack-transport.jar, x-pack-core.jar 6.5.4 version. do we required the License ? Pls check and tell me .if require how can we get the License? --- ## [SSL/TSL configurations for elasticsearch-6.2.4](https://discuss.elastic.co/t/ssl-tsl-configurations-for-elasticsearch-6-2-4/231412)
**Author:** [@hatif\_naqvi](https://discuss.elastic.co/u/hatif_naqvi)\ **Replies:** 1\ **Last updated:** [May 7, 2020, 1:30am UTC](https://discuss.elastic.co/t/ssl-tsl-configurations-for-elasticsearch-6-2-4/231412 "2020-05-07T01:30:51Z")
Hi All, I have a quick question. Can we enable SSL/TSL in elasticsearch-6.2.4, I've basic/free version. Your response will be appreciated. --- ## [Add new field data using Regex](https://discuss.elastic.co/t/add-new-field-data-using-regex/231205)
**Author:** [@JeremyP](https://discuss.elastic.co/u/JeremyP)\ **Replies:** 2\ **Last updated:** [May 7, 2020, 1:26am UTC](https://discuss.elastic.co/t/add-new-field-data-using-regex/231205 "2020-05-07T01:26:54Z")
Hello, I'm trying to do something rather simple by extracting a Microsoft KB from a string (in my case, the summary field), and adding it to a new field called "patch". I have the regex, just not sure what filter to use… --- ## [Error executing action \`run\` on resource 'bash\[shutdown logstash\]'](https://discuss.elastic.co/t/error-executing-action-run-on-resource-bash-shutdown-logstash/227224)
**Author:** [@manoj123](https://discuss.elastic.co/u/manoj123)\ **Replies:** 0\ **Last updated:** [April 9, 2020, 1:19am UTC](https://discuss.elastic.co/t/error-executing-action-run-on-resource-bash-shutdown-logstash/227224 "2020-04-09T01:19:55Z")
Noticed an error on logstash server while running chef-client. Chef is failing due to this error "Error executing action run on resource 'bash\[shutdown logstash\]' " \` Recipe: tmo-logstash::default bash\[logstash\_fix… --- ## [Elatic mapper\_parsing\_exception](https://discuss.elastic.co/t/elatic-mapper-parsing-exception/231414)
**Author:** [@savvy](https://discuss.elastic.co/u/savvy)\ **Replies:** 1\ **Last updated:** [May 7, 2020, 12:25am UTC](https://discuss.elastic.co/t/elatic-mapper-parsing-exception/231414 "2020-05-07T00:25:40Z")
\[2020-05-06T17:16:33,007\]\[WARN \]\[logstash.outputs.elasticsearch\]\[mykafka\] Could not index event to Elasticsearch. {:status=\>400, :action=\>\["index", {:\_id=\>nil, :\_index=\>"mydata-day-2020.05.06-113", :routing=\>nil, :\_type=\>… --- ## [Using update API to change the contents of a text field](https://discuss.elastic.co/t/using-update-api-to-change-the-contents-of-a-text-field/231418)
**Author:** [@Tim\_Estes](https://discuss.elastic.co/u/Tim_Estes)\ **Replies:** 6\ **Last updated:** [May 7, 2020, 12:15am UTC](https://discuss.elastic.co/t/using-update-api-to-change-the-contents-of-a-text-field/231418 "2020-05-07T00:15:22Z")
Hello, I have the following schema for an index, with some example documents. My use-case is that I'm indexing a book and I am indexing by page. I'm trying to update the contents of a page if the user decides to edit a … --- ## [Logstash and elastic cloud](https://discuss.elastic.co/t/logstash-and-elastic-cloud/231424)
**Author:** [@Holguinmora](https://discuss.elastic.co/u/Holguinmora)\ **Replies:** 1\ **Last updated:** [May 6, 2020, 11:21pm UTC](https://discuss.elastic.co/t/logstash-and-elastic-cloud/231424 "2020-05-06T23:21:53Z")
Hi I just get a subscription to elk cloud but I haven´t been able to get or find or use Logstash. Is Logstash included in the elk cloud? If so where can I found ir? Do I need to run some code in the shell? Or do I nee… --- ## [Return value True or False based on Kibana Script](https://discuss.elastic.co/t/return-value-true-or-false-based-on-kibana-script/231400)
**Author:** [@vdalvi](https://discuss.elastic.co/u/vdalvi)\ **Replies:** 2\ **Last updated:** [May 6, 2020, 11:20pm UTC](https://discuss.elastic.co/t/return-value-true-or-false-based-on-kibana-script/231400 "2020-05-06T23:20:25Z")
Hi, How can I aggregate to return value as True if doc\_count != 0 and False if doc\_count == 0 in Kibana response? Below is my query { "query": { "range": { "timestamp": { "gte": "now-1h/h" } … --- ## [Do I need to setup built-in users and licensing a second time when setting up a second node on another system (eg EC2 instance)?](https://discuss.elastic.co/t/do-i-need-to-setup-built-in-users-and-licensing-a-second-time-when-setting-up-a-second-node-on-another-system-eg-ec2-instance/231381)
**Author:** [@syost](https://discuss.elastic.co/u/syost)\ **Replies:** 1\ **Last updated:** [May 6, 2020, 9:55pm UTC](https://discuss.elastic.co/t/do-i-need-to-setup-built-in-users-and-licensing-a-second-time-when-setting-up-a-second-node-on-another-system-eg-ec2-instance/231381 "2020-05-06T21:55:59Z")
Background I'm following along in your "Fundamentals of Securing Elasticsearch" tutorial as part of your "learn-at-home" initiaitve but doing so from my own environment. I'm currently confused on a couple concepts concer… --- ## [How to move index to new server without direct connection?](https://discuss.elastic.co/t/how-to-move-index-to-new-server-without-direct-connection/231397)
**Author:** [@guibarati](https://discuss.elastic.co/u/guibarati)\ **Replies:** 1\ **Last updated:** [May 6, 2020, 9:53pm UTC](https://discuss.elastic.co/t/how-to-move-index-to-new-server-without-direct-connection/231397 "2020-05-06T21:53:00Z")
Is it possible to move index data through file transfer? I need to move a few indices to a new server but the current and new server networks don't have connectivity to each other. How can I save the index in a manner t… --- ## [How to use regex](https://discuss.elastic.co/t/how-to-use-regex/231250)
**Author:** [@user2416](https://discuss.elastic.co/u/user2416)\ **Replies:** 7\ **Last updated:** [May 6, 2020, 9:46pm UTC](https://discuss.elastic.co/t/how-to-use-regex/231250 "2020-05-06T21:46:07Z")
Hi, I am trying to match multiple fileds with multiple values and also trying to match some values using regex. Below is my query. But its not working. Can someone help me with this query. { "query": { "bool": { … --- ## [Timelines Event Renderer - Why I don't see this in my timeline](https://discuss.elastic.co/t/timelines-event-renderer-why-i-dont-see-this-in-my-timeline/231258)
**Author:** [@hilo21](https://discuss.elastic.co/u/hilo21)\ **Replies:** 3\ **Last updated:** [May 6, 2020, 9:14pm UTC](https://discuss.elastic.co/t/timelines-event-renderer-why-i-dont-see-this-in-my-timeline/231258 "2020-05-06T21:14:15Z")
So, I was parsing Fortigate events in a compliant way to ECS with some enrichment by adding categorization fields with logstash but instead of getting this : I get this : Even though I respected categorization fiel… --- ## [Unable to write to Elasticsearch from Spark Java](https://discuss.elastic.co/t/unable-to-write-to-elasticsearch-from-spark-java/231230)
**Author:** [@angryninja](https://discuss.elastic.co/u/angryninja)\ **Replies:** 2\ **Last updated:** [May 6, 2020, 8:53pm UTC](https://discuss.elastic.co/t/unable-to-write-to-elasticsearch-from-spark-java/231230 "2020-05-06T20:53:45Z")
Hi, I have been following the documentation for writing data from Spark / Java into Elasticsearch mentioned here : https://www.elastic.co/guide/en/elasticsearch/hadoop/current/spark.html#spark-sql But every time the do… --- ## [Filebeat v7.6.2 didn't send log to output](https://discuss.elastic.co/t/filebeat-v7-6-2-didnt-send-log-to-output/231406)
**Author:** [@lishiji56](https://discuss.elastic.co/u/lishiji56)\ **Replies:** 0\ **Last updated:** [May 6, 2020, 8:49pm UTC](https://discuss.elastic.co/t/filebeat-v7-6-2-didnt-send-log-to-output/231406 "2020-05-06T20:49:05Z")
Filebeat can't send any log to logstash. No error can be found from the debug mode. Any one knows what is the issue? Here is the filebeat.yml configuration: filebeat.inputs: type: log tags: \["test1"\] document\_type:… --- ## [False Positive - RPC (Remote Procedure Call) to the Internet (Kuery)](https://discuss.elastic.co/t/false-positive-rpc-remote-procedure-call-to-the-internet-kuery/231178)
**Author:** [@Gary\_Blackwell](https://discuss.elastic.co/u/Gary_Blackwell)\ **Replies:** 2\ **Last updated:** [May 6, 2020, 8:46pm UTC](https://discuss.elastic.co/t/false-positive-rpc-remote-procedure-call-to-the-internet-kuery/231178 "2020-05-06T20:46:47Z")
There is a built-in detection rule watching for TCP traffic on port 135 to the Internet. network.transport: tcp and destination.port: 135 and (network.direction: outbound or (source.ip:(10.0.0.0/8 or 172.16.0.0/12 or 19… --- ## [Create new index pattern: Reticulating splines](https://discuss.elastic.co/t/create-new-index-pattern-reticulating-splines/226779)
**Author:** [@yurig](https://discuss.elastic.co/u/yurig)\ **Replies:** 4\ **Last updated:** [May 6, 2020, 8:32pm UTC](https://discuss.elastic.co/t/create-new-index-pattern-reticulating-splines/226779 "2020-05-06T20:32:55Z")
I am running Kibana/Elastic version 6.4.2 on Windows and trying to create a new index pattern by going to Management --\> Index patterns --\> Create index pattern. The window gets stuck on 'Checking for Elasticsearch data… --- ## [Logstash Output to Elasticsearch - Try Once Logic](https://discuss.elastic.co/t/logstash-output-to-elasticsearch-try-once-logic/231403)
**Author:** [@seth.yes](https://discuss.elastic.co/u/seth.yes)\ **Replies:** 0\ **Last updated:** [May 6, 2020, 8:14pm UTC](https://discuss.elastic.co/t/logstash-output-to-elasticsearch-try-once-logic/231403 "2020-05-06T20:14:34Z")
I have a cluster that processes around 200k netflow records every second. Due to this volume of throughput, the ES cluster intermittently gets behind on indexing, returning a 503. This increases the pipeline latency, as … [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1464) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1466)