# \#none **URL:** https://discuss.elastic.co/tag/none.md?page=1666 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1667 --- ## [Virtual Machine Hosts and ECS](https://discuss.elastic.co/t/virtual-machine-hosts-and-ecs/216477)
**Author:** [@Micah\_Hunsberger](https://discuss.elastic.co/u/Micah_Hunsberger)\ **Replies:** 0\ **Last updated:** [January 24, 2020, 6:33pm UTC](https://discuss.elastic.co/t/virtual-machine-hosts-and-ecs/216477 "2020-01-24T18:33:59Z")
If I have events coming from a Virtual Machine and want to enrich the events with information about the host it is running on, in ECS, where would I put that information? For example, the add\_host\_metadata processor for… --- ## [Logstash monitorin in kibana](https://discuss.elastic.co/t/logstash-monitorin-in-kibana/216070)
**Author:** [@mende](https://discuss.elastic.co/u/mende)\ **Replies:** 4\ **Last updated:** [January 24, 2020, 6:22pm UTC](https://discuss.elastic.co/t/logstash-monitorin-in-kibana/216070 "2020-01-24T18:22:12Z")
Hi Team, I installed logstash version 7.4.2 in through Kubernetes my elastic cluster and kibana running well. If I see the monitoring in kibana dashboard, its showing only elastic cluster and kibana but its not showin… --- ## [Logstash \_split\_type\_failure](https://discuss.elastic.co/t/logstash-split-type-failure/216018)
**Author:** [@ramypala](https://discuss.elastic.co/u/ramypala)\ **Replies:** 7\ **Last updated:** [January 24, 2020, 6:12pm UTC](https://discuss.elastic.co/t/logstash-split-type-failure/216018 "2020-01-24T18:12:32Z")
My Raw Data {"records":\[{"parent":"","made\_sla":"true","caused\_by":"","watch\_list":"","upon\_reject":"cancel","sys\_updated\_on":"2020-01-22 05:47:33","child\_incidents":"0","u\_incident\_age\_in\_days":"1970-07-21 00:13:56","ho… --- ## [Failed to open Kibana in Linux](https://discuss.elastic.co/t/failed-to-open-kibana-in-linux/216344)
**Author:** [@Yiw](https://discuss.elastic.co/u/Yiw)\ **Replies:** 4\ **Last updated:** [January 24, 2020, 5:59pm UTC](https://discuss.elastic.co/t/failed-to-open-kibana-in-linux/216344 "2020-01-24T17:59:24Z")
Hi, I just installed Metricbeat, Elasticsearch and Kibana in Linux (Ubuntu). I can run Elasticsearch well. However, every time I run Kibana, the Elasticsearch was killed. I do not change any configuration by the way. Is … --- ## [Query and/or access object property](https://discuss.elastic.co/t/query-and-or-access-object-property/216472)
**Author:** [@styxtb1598](https://discuss.elastic.co/u/styxtb1598)\ **Replies:** 0\ **Last updated:** [January 24, 2020, 5:35pm UTC](https://discuss.elastic.co/t/query-and-or-access-object-property/216472 "2020-01-24T17:35:23Z")
I'm very new to ES and using the API for searching. I have an set of logs that have an object's properties In my c# query, I am trying to access the fields.ui.Message field. How can I do that? I get the top level stuf… --- ## [Create documents from array field](https://discuss.elastic.co/t/create-documents-from-array-field/216320)
**Author:** [@nino](https://discuss.elastic.co/u/nino)\ **Replies:** 6\ **Last updated:** [January 24, 2020, 5:11pm UTC](https://discuss.elastic.co/t/create-documents-from-array-field/216320 "2020-01-24T17:11:15Z")
Hello all, this is the output of my pipeline that process a file. I've succesfully extract the lines i want from the file, each file per day and n number of lines each day and split the lines into and array. { "host… --- ## [JVM error in JDBC input logstash](https://discuss.elastic.co/t/jvm-error-in-jdbc-input-logstash/216466)
**Author:** [@rguptarg](https://discuss.elastic.co/u/rguptarg)\ **Replies:** 1\ **Last updated:** [January 24, 2020, 5:08pm UTC](https://discuss.elastic.co/t/jvm-error-in-jdbc-input-logstash/216466 "2020-01-24T17:08:53Z")
Hi Team, We are using JDBC input for oracle connectivity and executing multiple queries. Now I am getting JVM error in logs. Can you suggest RAM for JDBC input, to avoid this error. Current RAM size in 15GB and logsta… --- ## [Ingest pipeline, rename a field that has a dynamic part](https://discuss.elastic.co/t/ingest-pipeline-rename-a-field-that-has-a-dynamic-part/215488)
**Author:** [@wedkarz014](https://discuss.elastic.co/u/wedkarz014)\ **Replies:** 4\ **Last updated:** [January 24, 2020, 4:37pm UTC](https://discuss.elastic.co/t/ingest-pipeline-rename-a-field-that-has-a-dynamic-part/215488 "2020-01-24T16:37:55Z")
hi, I have a metrics with fields which look like that: prometheus.xyz-dev.label.name prometheus.xyz-dev.tomcat\_global\_error\_total.value prometheus.xyz-dev.tomcat\_global\_received\_bytes\_total.value prometheus.xyz-dev.to… --- ## [Picking up a configuration file change](https://discuss.elastic.co/t/picking-up-a-configuration-file-change/214219)
**Author:** [@JanKowalik](https://discuss.elastic.co/u/JanKowalik)\ **Replies:** 24\ **Last updated:** [January 24, 2020, 4:37pm UTC](https://discuss.elastic.co/t/picking-up-a-configuration-file-change/214219 "2020-01-24T16:37:01Z")
Hi, It seems that ECK does not pickup configuration changes. How do I make it pick it up? Do I restart the nodes? How can I do it via ECK? Thanks --- ## [Search on "copy\_to"-"keyword" Field and Get/View indexed data of the "copy\_to"-"keyword"-Field (not "\_source")](https://discuss.elastic.co/t/search-on-copy-to-keyword-field-and-get-view-indexed-data-of-the-copy-to-keyword-field-not-source/216419)
**Author:** [@mero](https://discuss.elastic.co/u/mero)\ **Replies:** 1\ **Last updated:** [January 24, 2020, 4:22pm UTC](https://discuss.elastic.co/t/search-on-copy-to-keyword-field-and-get-view-indexed-data-of-the-copy-to-keyword-field-not-source/216419 "2020-01-24T16:22:45Z")
Hi together, is there a possibility to see or view the indexed data stored in an elasticsearch index? I have a Field which is filled by using "copy\_to" of other Fields ("Keyword") and now i have a query that is not fin… --- ## [Audit authentication failed](https://discuss.elastic.co/t/audit-authentication-failed/216467)
**Author:** [@Ludovic9](https://discuss.elastic.co/u/Ludovic9)\ **Replies:** 0\ **Last updated:** [January 24, 2020, 4:05pm UTC](https://discuss.elastic.co/t/audit-authentication-failed/216467 "2020-01-24T16:05:23Z")
Hi, I'm using elk stack in version 6.8.3, I have enabled security function, it's OK. Each beats needs an account to send logs to elasticsearch. But I would like to track the authentication failed from agent and from Ki… --- ## [Null Field Name](https://discuss.elastic.co/t/null-field-name/216457)
**Author:** [@kdp494](https://discuss.elastic.co/u/kdp494)\ **Replies:** 0\ **Last updated:** [January 24, 2020, 3:36pm UTC](https://discuss.elastic.co/t/null-field-name/216457 "2020-01-24T15:36:31Z")
Hello, I am getting an error message "field name cannot be an empty string" for a number of documents coming into logstash. I am attempting to remove the null fields with a mutate filter: mutate { remove\_field =\> \[ "\[… --- ## [Fetch search history from cluster in Elasticsearch 7.5](https://discuss.elastic.co/t/fetch-search-history-from-cluster-in-elasticsearch-7-5/216431)
**Author:** [@Palani\_rajan\_Ravicha](https://discuss.elastic.co/u/Palani_rajan_Ravicha)\ **Replies:** 1\ **Last updated:** [January 24, 2020, 3:16pm UTC](https://discuss.elastic.co/t/fetch-search-history-from-cluster-in-elasticsearch-7-5/216431 "2020-01-24T15:16:05Z")
I need to show all search history in front-end.Is there any api to fetch all search history in Elasticsearch 7.5? --- ## [Grok regex for a few words](https://discuss.elastic.co/t/grok-regex-for-a-few-words/216435)
**Author:** [@111249](https://discuss.elastic.co/u/111249)\ **Replies:** 2\ **Last updated:** [January 24, 2020, 3:16pm UTC](https://discuss.elastic.co/t/grok-regex-for-a-few-words/216435 "2020-01-24T15:16:04Z")
My line from filebeat looks like this: 2020-01-09T15: 19: 09.939859Z message = \\"Some 'message' here \\", ourProductID = 'AS6167527'. What should the regular expression look like to get the message field? I currently ha… --- ## [Easy example with histogram](https://discuss.elastic.co/t/easy-example-with-histogram/216422)
**Author:** [@icirco](https://discuss.elastic.co/u/icirco)\ **Replies:** 1\ **Last updated:** [January 24, 2020, 3:04pm UTC](https://discuss.elastic.co/t/easy-example-with-histogram/216422 "2020-01-24T15:04:11Z")
hello, I'm using Elastic 7.5, I have an indice with fields : site pourcent\_ok site : site1, site2, site3... pourcent\_ok : 98.4, 99.5, 100, 80.2 ... How to build a graph with : on axis X : the sites on axis Y : t… --- ## [Multiple size attributes in a query per index](https://discuss.elastic.co/t/multiple-size-attributes-in-a-query-per-index/216440)
**Author:** [@negiadventures](https://discuss.elastic.co/u/negiadventures)\ **Replies:** 3\ **Last updated:** [January 24, 2020, 3:01pm UTC](https://discuss.elastic.co/t/multiple-size-attributes-in-a-query-per-index/216440 "2020-01-24T15:01:00Z")
Hi, I want to display results from two indices with same structure and put a limit of 500 records. The problem is that out of 500, I want to show 450 from index1 and 50 from index2. Is there a way in which we can achiev… --- ## [Grok crash if line ending by backslash](https://discuss.elastic.co/t/grok-crash-if-line-ending-by-backslash/216441)
**Author:** [@djgreg13](https://discuss.elastic.co/u/djgreg13)\ **Replies:** 1\ **Last updated:** [January 24, 2020, 3:00pm UTC](https://discuss.elastic.co/t/grok-crash-if-line-ending-by-backslash/216441 "2020-01-24T15:00:42Z")
Hello, i have a field pushed by a beat with this content "D:\\Logs\\IIS\\test.domain.com\\20191219.log So i write the following grok for extract test.domain.com grok { match =\> { "\[log\]… --- ## [Add Horizontal line in Vertical Bar Chart](https://discuss.elastic.co/t/add-horizontal-line-in-vertical-bar-chart/216306)
**Author:** [@SMS](https://discuss.elastic.co/u/SMS)\ **Replies:** 2\ **Last updated:** [January 24, 2020, 2:30pm UTC](https://discuss.elastic.co/t/add-horizontal-line-in-vertical-bar-chart/216306 "2020-01-24T14:30:27Z")
I created vertical bar chart (Kibana 7.5) and I would like to add one of my static field as a horizontal line. How can I add it? --- ## [Help with Logstash xml filter plug in](https://discuss.elastic.co/t/help-with-logstash-xml-filter-plug-in/216131)
**Author:** [@byoungman](https://discuss.elastic.co/u/byoungman)\ **Replies:** 8\ **Last updated:** [January 24, 2020, 2:16pm UTC](https://discuss.elastic.co/t/help-with-logstash-xml-filter-plug-in/216131 "2020-01-24T14:16:24Z")
I'm having trouble parsing out fields from my xml file using the logstash xml filter plugin. Here is my xml file data-- 733812 JVM|Garbage Collection|Number of Minor Collections Per Min Application Infrastructure… --- ## [Centralized Syslog management for Cisco Switches](https://discuss.elastic.co/t/centralized-syslog-management-for-cisco-switches/216253)
**Author:** [@xkazuuma](https://discuss.elastic.co/u/xkazuuma)\ **Replies:** 5\ **Last updated:** [January 24, 2020, 1:48pm UTC](https://discuss.elastic.co/t/centralized-syslog-management-for-cisco-switches/216253 "2020-01-24T13:48:35Z")
Hello everyone! I set up an ELK-Stack which is already running, receiving some logs and also showing everything in kibana. But I have problems with the filtering and properly use of the data because everything is just i… --- ## [Query cache gets invalidated](https://discuss.elastic.co/t/query-cache-gets-invalidated/216032)
**Author:** [@royal\_man](https://discuss.elastic.co/u/royal_man)\ **Replies:** 10\ **Last updated:** [January 24, 2020, 1:41pm UTC](https://discuss.elastic.co/t/query-cache-gets-invalidated/216032 "2020-01-24T13:41:43Z")
I am making this query with request\_cache=true { "query": { "bool": { "should": \[ { "term": { "status": "online" } }, { "term": { … --- ## [Elastic request timeout after disconnecting half cluster](https://discuss.elastic.co/t/elastic-request-timeout-after-disconnecting-half-cluster/216418)
**Author:** [@d4nnyx](https://discuss.elastic.co/u/d4nnyx)\ **Replies:** 0\ **Last updated:** [January 24, 2020, 12:46pm UTC](https://discuss.elastic.co/t/elastic-request-timeout-after-disconnecting-half-cluster/216418 "2020-01-24T12:46:57Z")
Hello guys, I have 16 data nodes in Elastic Stack cluster divided to 2 datacenters, all indices have one replica (2 copies in each DC). If I disconnect all nodes from one DC, Elastic is unavailable for a while, Kibana c… --- ## [Kibana plugin development - server changes](https://discuss.elastic.co/t/kibana-plugin-development-server-changes/216268)
**Author:** [@dreszczyk](https://discuss.elastic.co/u/dreszczyk)\ **Replies:** 4\ **Last updated:** [January 24, 2020, 12:14pm UTC](https://discuss.elastic.co/t/kibana-plugin-development-server-changes/216268 "2020-01-24T12:14:01Z")
hello there I'm developing a plugin for kibana which would query elastic and display the data just like the dashboard, but in a slightly different way. I figured that i need to use a server in kibana to communicate wit… --- ## [Using replace in Logstash](https://discuss.elastic.co/t/using-replace-in-logstash/216227)
**Author:** [@saravana\_hariharan](https://discuss.elastic.co/u/saravana_hariharan)\ **Replies:** 4\ **Last updated:** [January 24, 2020, 12:09pm UTC](https://discuss.elastic.co/t/using-replace-in-logstash/216227 "2020-01-24T12:09:08Z")
if \[score\] \>= "35" mutate replace =\> \[ "score","Success" \] my error is if score Greater than equal to 35 value considered as success so im displaying graph in success, but it only shows 35 to 99 values in label nam… --- ## [How to change current possition of rollup job indexer](https://discuss.elastic.co/t/how-to-change-current-possition-of-rollup-job-indexer/216413)
**Author:** [@birko](https://discuss.elastic.co/u/birko)\ **Replies:** 0\ **Last updated:** [January 24, 2020, 11:51am UTC](https://discuss.elastic.co/t/how-to-change-current-possition-of-rollup-job-indexer/216413 "2020-01-24T11:51:03Z")
Hello, is it possible to manually change position of indexer in rollup job configuration? When I get rollup job details, there is status.current\_position, with latest timestamp. I have an issue with rollup job, which ca… --- ## [Unable to send full event to syslog](https://discuss.elastic.co/t/unable-to-send-full-event-to-syslog/215339)
**Author:** [@Necus](https://discuss.elastic.co/u/Necus)\ **Replies:** 3\ **Last updated:** [January 24, 2020, 11:38am UTC](https://discuss.elastic.co/t/unable-to-send-full-event-to-syslog/215339 "2020-01-24T11:38:17Z")
Hi, I'm trying to send Windows logs through Windows Event Forwarder, through Winlogbeat and Logstash to syslog. (System1-\>System2 with Winlogbeat-\>Logstash-\>syslog). For some reason event which appear in syslog is cropp… --- ## [Customized Index pattern](https://discuss.elastic.co/t/customized-index-pattern/216247)
**Author:** [@Yashwant\_Shettigar](https://discuss.elastic.co/u/Yashwant_Shettigar)\ **Replies:** 2\ **Last updated:** [January 24, 2020, 11:32am UTC](https://discuss.elastic.co/t/customized-index-pattern/216247 "2020-01-24T11:32:06Z")
Hello, I have a centralized ELK server, where data is getting shipped via winlogbeat and filebeat installed on client machines. Now I am trying to route cisco-asa devices logs to this server. Upto some extent I am bit s… --- ## [Logstash java.lang.IllegalStateException](https://discuss.elastic.co/t/logstash-java-lang-illegalstateexception/216407)
**Author:** [@Nusko](https://discuss.elastic.co/u/Nusko)\ **Replies:** 0\ **Last updated:** [January 24, 2020, 11:14am UTC](https://discuss.elastic.co/t/logstash-java-lang-illegalstateexception/216407 "2020-01-24T11:14:05Z")
Hello, I am new to logstash (and so ELK in general). I was trying to set ELK for netflow and I am constantly facing following error: \[ERROR\]\[logstash.agent \] An exception happened when converging configuratio… --- ## [Filter entries in an aggregation by wildcard string?](https://discuss.elastic.co/t/filter-entries-in-an-aggregation-by-wildcard-string/216406)
**Author:** [@very\_sneaky](https://discuss.elastic.co/u/very_sneaky)\ **Replies:** 0\ **Last updated:** [January 24, 2020, 11:07am UTC](https://discuss.elastic.co/t/filter-entries-in-an-aggregation-by-wildcard-string/216406 "2020-01-24T11:07:31Z")
hey all, I'm having trouble formulating a query, and I'm hoping someone can help. This is the format of my data: { "srcIp": "192.168.0.54", "dstIp": "74.125.195.147", "srcMac": \["ec:f4:bb:4f:b0:96", "0a:f7:b… --- ## [I ask different questions. They close my card. is this how you work? Please read carefully](https://discuss.elastic.co/t/i-ask-different-questions-they-close-my-card-is-this-how-you-work-please-read-carefully/216379)
**Author:** [@mr\_searchng](https://discuss.elastic.co/u/mr_searchng)\ **Replies:** 1\ **Last updated:** [January 24, 2020, 11:00am UTC](https://discuss.elastic.co/t/i-ask-different-questions-they-close-my-card-is-this-how-you-work-please-read-carefully/216379 "2020-01-24T11:00:05Z")
Continuing the discussion from Where does the page load?: [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1665) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1667)