# \#none **URL:** https://discuss.elastic.co/tag/none.md?page=1749 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1750 --- ## [Dec 2nd, 2019: \[EN\]\[Auditbeat\] Monitoring Linux Command Execution](https://discuss.elastic.co/t/dec-2nd-2019-en-auditbeat-monitoring-linux-command-execution/209125)
**Author:** [@json](https://discuss.elastic.co/u/json)\ **Replies:** 0\ **Last updated:** [December 2, 2019, 8:00am UTC](https://discuss.elastic.co/t/dec-2nd-2019-en-auditbeat-monitoring-linux-command-execution/209125 "2019-12-02T08:00:00Z")
The Auditbeat Auditd module can be used to capture all shell commands executed on system for all users. Monitoring shell commands is often desired on servers where end user shell activity is normally minimal. This examp… --- ## [How to get monitoring data over Kafka?](https://discuss.elastic.co/t/how-to-get-monitoring-data-over-kafka/210131)
**Author:** [@MarcusCaepio](https://discuss.elastic.co/u/MarcusCaepio)\ **Replies:** 0\ **Last updated:** [December 2, 2019, 7:58am UTC](https://discuss.elastic.co/t/how-to-get-monitoring-data-over-kafka/210131 "2019-12-02T07:58:37Z")
Hi all, in a DMZ, the beats are sending their data to a Kafka. Logstash is getting this data from the internal net out of Kafka. So the beats are not able to connect to elasticsearch itself. How do I get the beat's mon… --- ## [How can I Filter Error logs](https://discuss.elastic.co/t/how-can-i-filter-error-logs/210130)
**Author:** [@kishara](https://discuss.elastic.co/u/kishara)\ **Replies:** 0\ **Last updated:** [December 2, 2019, 7:48am UTC](https://discuss.elastic.co/t/how-can-i-filter-error-logs/210130 "2019-12-02T07:48:27Z")
How can I filter Error logs through the other logs input { beats { port =\> 5044 } } filter{ grok{ #I have no idea about GROK filter } } output { elasticsearch { hosts =\> "localhost:9200" manage\_template =\> … --- ## [Ingest node ドットを含むフィールド名の取得方法について](https://discuss.elastic.co/t/ingest-node/210126)
**Author:** [@harue](https://discuss.elastic.co/u/harue)\ **Replies:** 2\ **Last updated:** [December 2, 2019, 7:47am UTC](https://discuss.elastic.co/t/ingest-node/210126 "2019-12-02T07:47:39Z")
質問失礼致します。 Elasticsearchのingest node(Script Processor)にてシュミレーションを実施していますが、 エラーが発生します。 記載内容 POST /\_ingest/pipeline/\_simulate { "pipeline": { "processors": \[ { "script": { "source": """ … --- ## [How to apply new time format of range in kibana's request query when visualizing data](https://discuss.elastic.co/t/how-to-apply-new-time-format-of-range-in-kibanas-request-query-when-visualizing-data/210101)
**Author:** [@myohyun](https://discuss.elastic.co/u/myohyun)\ **Replies:** 2\ **Last updated:** [December 2, 2019, 7:09am UTC](https://discuss.elastic.co/t/how-to-apply-new-time-format-of-range-in-kibanas-request-query-when-visualizing-data/210101 "2019-12-02T07:09:02Z")
Hi, I have a question about changing time format in range query when visualizing data. I have a date field 'time local' and its format is "dd/MMM/YYYY:HH:mm:ss Z" ex. "time\_local": "15/Nov/2019:16:49:53 +0900", The… --- ## [LogstashのSQS input Pluginを使用してS3からファイルを取得する方法](https://discuss.elastic.co/t/logstash-sqs-input-plugin-s3/210122)
**Author:** [@t-nakata](https://discuss.elastic.co/u/t-nakata)\ **Replies:** 0\ **Last updated:** [December 2, 2019, 7:01am UTC](https://discuss.elastic.co/t/logstash-sqs-input-plugin-s3/210122 "2019-12-02T07:01:23Z")
以下のような構成で、LogstashのSQS input Pluginを使用してS3ストレージからファイルを取得したいです。 ＜構成＞ S3 -\> SQS \<- Logstash ＜実現方式案＞ ① S3ストレージにファイルを配置 ② ファイル配置を契機に、S3→SQSにイベント送信 ③ LogstashはSQSをinputとし、SQSにキューイングされている順番でS3に格納されているファイルを取得する 上記実現方式を考え… --- ## [S3の情報を取得する方法(tags設定時)](https://discuss.elastic.co/t/s3-tags/209240)
**Author:** [@harue](https://discuss.elastic.co/u/harue)\ **Replies:** 4\ **Last updated:** [December 2, 2019, 6:57am UTC](https://discuss.elastic.co/t/s3-tags/209240 "2019-12-02T06:57:58Z")
再度質問を失礼させて頂きます。 S3→SQS→Filebeat→Logstash→Elasticsearchの連携時、 filebeat.ymlでS3バケット名・ファイル名毎にtagsを設定し連携しようとしています。 以下の定義情報の元、疎通すると意図しないインデックスデータが登録されます。 filebeat.yml #=========================== Filebeat inputs ==========… --- ## [Accessing array of object in painless script , search query \[ES 6.4\]](https://discuss.elastic.co/t/accessing-array-of-object-in-painless-script-search-query-es-6-4/209559)
**Author:** [@kushal](https://discuss.elastic.co/u/kushal)\ **Replies:** 3\ **Last updated:** [December 2, 2019, 6:35am UTC](https://discuss.elastic.co/t/accessing-array-of-object-in-painless-script-search-query-es-6-4/209559 "2019-12-02T06:35:56Z")
Documents have an array of objects, which i need to iterate over in order to compute the final score. Basic mapping is following \< { "settings": { "number\_of\_shards": 1, "numbe… --- ## [Sum aggregation on field by distinct value of another field with high cardinality](https://discuss.elastic.co/t/sum-aggregation-on-field-by-distinct-value-of-another-field-with-high-cardinality/210111)
**Author:** [@artur](https://discuss.elastic.co/u/artur)\ **Replies:** 0\ **Last updated:** [December 2, 2019, 5:51am UTC](https://discuss.elastic.co/t/sum-aggregation-on-field-by-distinct-value-of-another-field-with-high-cardinality/210111 "2019-12-02T05:51:40Z")
I have a document like this: { "\_id": 1, "factor": 100, "field\_with\_high\_cardinality": 1000 } I know that for each unique field\_with\_high\_cardinality the factor is always the same. I need to calculate… --- ## [Elasticsearch not starting when i deleted few indices](https://discuss.elastic.co/t/elasticsearch-not-starting-when-i-deleted-few-indices/210110)
**Author:** [@pankaj90](https://discuss.elastic.co/u/pankaj90)\ **Replies:** 0\ **Last updated:** [December 2, 2019, 5:51am UTC](https://discuss.elastic.co/t/elasticsearch-not-starting-when-i-deleted-few-indices/210110 "2019-12-02T05:51:18Z")
I accidentally deleted few indices from elastic-search data but not it's not starting the service. i'm getting error while starting the service which was " attempt to resurrect connection to dead ES instances" when i che… --- ## [POST \_analyze error](https://discuss.elastic.co/t/post-analyze-error/210054)
**Author:** [@xyx](https://discuss.elastic.co/u/xyx)\ **Replies:** 5\ **Last updated:** [December 2, 2019, 5:34am UTC](https://discuss.elastic.co/t/post-analyze-error/210054 "2019-12-02T05:34:58Z")
The analyzer does not work，So who can help me.Thanks!Here is my error and example: (1)error: { "error": { "root\_cause": \[ { "type": "x\_content\_parse\_exception", "reason": "\[3:12\] \[analyze\_request\] failed to parse … --- ## [Elasticsearch takes long time to update simple index](https://discuss.elastic.co/t/elasticsearch-takes-long-time-to-update-simple-index/210104)
**Author:** [@katara](https://discuss.elastic.co/u/katara)\ **Replies:** 0\ **Last updated:** [December 2, 2019, 5:03am UTC](https://discuss.elastic.co/t/elasticsearch-takes-long-time-to-update-simple-index/210104 "2019-12-02T05:03:49Z")
I have installed ES and Logstash 7.2.0 in 2 servers and I tried pushing a simple text file from Logstash to ES. The Logstash seems to send the data quickly, however, the ES takes about 5 mins (everytime) to update this d… --- ## [\[QUESTION\] What is the default sorting between ES 1.7.x and 7.x?](https://discuss.elastic.co/t/question-what-is-the-default-sorting-between-es-1-7-x-and-7-x/210100)
**Author:** [@joneslee85](https://discuss.elastic.co/u/joneslee85)\ **Replies:** 0\ **Last updated:** [December 2, 2019, 4:14am UTC](https://discuss.elastic.co/t/question-what-is-the-default-sorting-between-es-1-7-x-and-7-x/210100 "2019-12-02T04:14:37Z")
I am working on migrating from ES 1.7 to 7.4. There is one issue I picked up that is related to sorting. In ES 1.7, if returned documents share same \_score, the results are seems to be ordered randomly. Whilst ES 7.4 wo… --- ## [Updating slow query log in production environment](https://discuss.elastic.co/t/updating-slow-query-log-in-production-environment/210099)
**Author:** [@Manikant](https://discuss.elastic.co/u/Manikant)\ **Replies:** 0\ **Last updated:** [December 2, 2019, 3:16am UTC](https://discuss.elastic.co/t/updating-slow-query-log-in-production-environment/210099 "2019-12-02T03:16:29Z")
Hi All, we are using Elastic Search 5.6 and want to know what elastic queries is running for search API in production environment. we run below command for slow query logs. curl -XPUT http://localhost:9200/\_cluster/se… --- ## [Search against analyzed text vs keyword array field](https://discuss.elastic.co/t/search-against-analyzed-text-vs-keyword-array-field/210096)
**Author:** [@chanakagl](https://discuss.elastic.co/u/chanakagl)\ **Replies:** 0\ **Last updated:** [December 2, 2019, 2:54am UTC](https://discuss.elastic.co/t/search-against-analyzed-text-vs-keyword-array-field/210096 "2019-12-02T02:54:18Z")
Hi, I have a text field which contains millions of ids in comma separated, EX :- "field1: "1254,4578,578795,451546,3658,5689,........" I'm currently analyzed above field with punctuation tokenizer and do the match qu… --- ## [Elastic Cloud Service Selection](https://discuss.elastic.co/t/elastic-cloud-service-selection/209746)
**Author:** [@Gilad\_Gecht](https://discuss.elastic.co/u/Gilad_Gecht)\ **Replies:** 3\ **Last updated:** [December 1, 2019, 10:11pm UTC](https://discuss.elastic.co/t/elastic-cloud-service-selection/209746 "2019-12-01T22:11:13Z")
Hi, after messing around with AWS's Elasticsearch service, my colleagues and I have decided to try a different approach. This was due to AWS's service not supporting CSV files reporting. We came across the Elastic Clou… --- ## [How to understand all this stack?](https://discuss.elastic.co/t/how-to-understand-all-this-stack/210082)
**Author:** [@Sebastien\_S](https://discuss.elastic.co/u/Sebastien_S)\ **Replies:** 0\ **Last updated:** [December 1, 2019, 7:53pm UTC](https://discuss.elastic.co/t/how-to-understand-all-this-stack/210082 "2019-12-01T19:53:18Z")
Hi, i'm running across all documentation, forum topics, FAQ and i still didn't found usefull high level / overall architecture documentation. The Elastic stack look great. I tried a trial cloud account in order to get … --- ## [Filter path is applied only to the first request of ScrollAPI](https://discuss.elastic.co/t/filter-path-is-applied-only-to-the-first-request-of-scrollapi/210076)
**Author:** [@RazmikGevorgyan](https://discuss.elastic.co/u/RazmikGevorgyan)\ **Replies:** 0\ **Last updated:** [December 1, 2019, 6:42pm UTC](https://discuss.elastic.co/t/filter-path-is-applied-only-to-the-first-request-of-scrollapi/210076 "2019-12-01T18:42:39Z")
Hi Nest ScollAPI uses defined filter path only in the first request. Next requests don't contain filter path and fetch too much. Used filter path (e.g. FilterPath = new string\[\] { "hits.hits.\_source", "hits.hits.\_sco… --- ## [Failed to parse date field from kibana](https://discuss.elastic.co/t/failed-to-parse-date-field-from-kibana/210067)
**Author:** [@Yoav\_Ben\_Moha](https://discuss.elastic.co/u/Yoav_Ben_Moha)\ **Replies:** 1\ **Last updated:** [December 1, 2019, 6:55pm UTC](https://discuss.elastic.co/t/failed-to-parse-date-field-from-kibana/210067 "2019-12-01T18:55:55Z")
I have created a template with 3 fields. The last one is DATE format. The template index created successfully: PUT \_template/test\_index\_template { "index\_patterns" : \["test-\*"\], "settings": { "number\_of\_shards": … --- ## [Java High Level Rest Client Cross cluster search](https://discuss.elastic.co/t/java-high-level-rest-client-cross-cluster-search/210053)
**Author:** [@Mahdi\_Davoodi](https://discuss.elastic.co/u/Mahdi_Davoodi)\ **Replies:** 3\ **Last updated:** [December 1, 2019, 5:30pm UTC](https://discuss.elastic.co/t/java-high-level-rest-client-cross-cluster-search/210053 "2019-12-01T17:30:09Z")
how to search in multi cluster (cross cluster search) by using java high level rest client? --- ## [RDS to Elasticsearch - Setting up Logstash in a highly available/redundant architecture](https://discuss.elastic.co/t/rds-to-elasticsearch-setting-up-logstash-in-a-highly-available-redundant-architecture/210070)
**Author:** [@dshenoy](https://discuss.elastic.co/u/dshenoy)\ **Replies:** 0\ **Last updated:** [December 1, 2019, 4:12pm UTC](https://discuss.elastic.co/t/rds-to-elasticsearch-setting-up-logstash-in-a-highly-available-redundant-architecture/210070 "2019-12-01T16:12:41Z")
I am looking into a highly available solution to feed in AWS RDS transactions into my Elasticsearch repository. There are some articles on this topic. For example: But this is not a flexible and agile in the long-t… --- ## [\[BUG?\] Discrepancy in boolean-type keys in aggregation buckets between ES 1.7.x and 7.x](https://discuss.elastic.co/t/bug-discrepancy-in-boolean-type-keys-in-aggregation-buckets-between-es-1-7-x-and-7-x/210060)
**Author:** [@joneslee85](https://discuss.elastic.co/u/joneslee85)\ **Replies:** 1\ **Last updated:** [December 1, 2019, 1:57pm UTC](https://discuss.elastic.co/t/bug-discrepancy-in-boolean-type-keys-in-aggregation-buckets-between-es-1-7-x-and-7-x/210060 "2019-12-01T13:57:22Z")
Hi all I have a simple field purchased as type boolean in my index mapping. When I generate aggregation for: ... "aggs": { "terms" : { "field" : "purchased" } } ... the results I have in ES 1.7.5 is: "aggregations": … --- ## [Upgrade from 6.8.3 to 7.X.X results in "failed to apply updated cluster state"](https://discuss.elastic.co/t/upgrade-from-6-8-3-to-7-x-x-results-in-failed-to-apply-updated-cluster-state/207111)
**Author:** [@ricferr1976](https://discuss.elastic.co/u/ricferr1976)\ **Replies:** 12\ **Last updated:** [December 1, 2019, 11:09am UTC](https://discuss.elastic.co/t/upgrade-from-6-8-3-to-7-x-x-results-in-failed-to-apply-updated-cluster-state/207111 "2019-12-01T11:09:21Z")
Hello. We had a 6.8.3 single node with a lot of data (yes, I know that offers no fault tolerance but its a known limitation) and I tried to upgrade it to 7.4.2. We followed the step by step in https://www.elastic.co/gu… --- ## [Connecting to %s using SSL with verify\_certs=False is insecure](https://discuss.elastic.co/t/connecting-to-s-using-ssl-with-verify-certs-false-is-insecure/209776)
**Author:** [@EZprogramming](https://discuss.elastic.co/u/EZprogramming)\ **Replies:** 3\ **Last updated:** [November 28, 2019, 5:17am UTC](https://discuss.elastic.co/t/connecting-to-s-using-ssl-with-verify-certs-false-is-insecure/209776 "2019-11-28T05:17:09Z")
Here is my python code for connecting to Elasticsearch: from elasticsearch import Elasticsearch es = Elasticsearch(\[HOST\], http\_auth = (str(USERNAME), str(PASSWORD)), scheme = "https", port=443) Error: /usr/local/lib… --- ## [Generating geo\_point based on a couple float](https://discuss.elastic.co/t/generating-geo-point-based-on-a-couple-float/210045)
**Author:** [@Claudio\_Grasso](https://discuss.elastic.co/u/Claudio_Grasso)\ **Replies:** 0\ **Last updated:** [December 1, 2019, 4:27am UTC](https://discuss.elastic.co/t/generating-geo-point-based-on-a-couple-float/210045 "2019-12-01T04:27:17Z")
Hi guys, I need to import a MySQL table into ES where the table has one longitud and one longitud rows. It is pretty much the same use case as the one described in: so I followed the same steps and I obtained a field… --- ## [Elaticsearch Memory consumption increasing too much in ELK 7](https://discuss.elastic.co/t/elaticsearch-memory-consumption-increasing-too-much-in-elk-7/210037)
**Author:** [@shivani\_aggarwal](https://discuss.elastic.co/u/shivani_aggarwal)\ **Replies:** 1\ **Last updated:** [November 30, 2019, 7:45pm UTC](https://discuss.elastic.co/t/elaticsearch-memory-consumption-increasing-too-much-in-elk-7/210037 "2019-11-30T19:45:52Z")
Hi, I have upgraded ELK from version 6.6.1 to 7.0.1 in kubernetes environment.There are 11 nodes in the cluster - 3 master pods, 3 data pods & 5 client pods. I see memory consumption of elasticsearch is increasing indef… --- ## [Prioritising pages belonging to a folder](https://discuss.elastic.co/t/prioritising-pages-belonging-to-a-folder/209889)
**Author:** [@thack](https://discuss.elastic.co/u/thack)\ **Replies:** 2\ **Last updated:** [November 30, 2019, 7:15pm UTC](https://discuss.elastic.co/t/prioritising-pages-belonging-to-a-folder/209889 "2019-11-30T19:15:08Z")
We have a folder inside which are all our course pages. That folder is /course/ How do I prioritise all content in this folder when corresponding with search queries? For example, if someone types in 'art', I want our… --- ## [Push JSON into elasticsearch directly](https://discuss.elastic.co/t/push-json-into-elasticsearch-directly/210035)
**Author:** [@Sundaramoorthy\_Anand](https://discuss.elastic.co/u/Sundaramoorthy_Anand)\ **Replies:** 0\ **Last updated:** [November 30, 2019, 5:30pm UTC](https://discuss.elastic.co/t/push-json-into-elasticsearch-directly/210035 "2019-11-30T17:30:49Z")
My architecture is Filebeat (remote) \> logstash (Beats input, grok filter and output file plugin) \> stores the passed data as json in .log file Sample log lines 0.0.111.12 16.0.0.199 58 58 0.0.111.12 HTTP/1.1 - POST … --- ## [The best hardware requirements for a real production environment](https://discuss.elastic.co/t/the-best-hardware-requirements-for-a-real-production-environment/210018)
**Author:** [@kumar4](https://discuss.elastic.co/u/kumar4)\ **Replies:** 2\ **Last updated:** [November 30, 2019, 3:57pm UTC](https://discuss.elastic.co/t/the-best-hardware-requirements-for-a-real-production-environment/210018 "2019-11-30T15:57:14Z")
Hello my friends, I want to install ELK in a real environment for collecting data from different sources and I want to know the hardware requirements (CPU, RAM, Storage) i mean the best hardware requirements (not the min… --- ## [How elastic store he indexed data](https://discuss.elastic.co/t/how-elastic-store-he-indexed-data/210030)
**Author:** [@kumar4](https://discuss.elastic.co/u/kumar4)\ **Replies:** 1\ **Last updated:** [November 30, 2019, 3:37pm UTC](https://discuss.elastic.co/t/how-elastic-store-he-indexed-data/210030 "2019-11-30T15:37:38Z")
hi dears, i creatd indexed and gotten data using logstash from differents sources but i want to know how the data is actually stored, the directory containing these data, the structure of this data and how to query them … [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1748) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1750)