# \#none **URL:** https://discuss.elastic.co/tag/none.md?page=1867 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1868 --- ## [Defenxor DSIEM for Event Correlation](https://discuss.elastic.co/t/defenxor-dsiem-for-event-correlation/201638)
**Author:** [@gargantua](https://discuss.elastic.co/u/gargantua)\ **Replies:** 0\ **Last updated:** [September 30, 2019, 12:33pm UTC](https://discuss.elastic.co/t/defenxor-dsiem-for-event-correlation/201638 "2019-09-30T12:33:34Z")
Hello, I want to correlate my events with defenxor/dsiem. Is there anyone who uses dsiem for event correlation? Is it enough for correlation? What are advantages and disadvantages of dsiem? --- ## [Failed to execute the Index](https://discuss.elastic.co/t/failed-to-execute-the-index/201459)
**Author:** [@Sudharsankotti](https://discuss.elastic.co/u/Sudharsankotti)\ **Replies:** 1\ **Last updated:** [September 30, 2019, 12:31pm UTC](https://discuss.elastic.co/t/failed-to-execute-the-index/201459 "2019-09-30T12:31:52Z")
We are getting this below error when every we try to reindex . application.log.2019-09-25:\[2019-09-25 05:51:09,317\]\[DEBUG\]\[action.index \] \[atlspres1\] failed to execute \[index {\[partner\_location\]\[com.tuo.cust… --- ## [APM AGENT INSTALL](https://discuss.elastic.co/t/apm-agent-install/201467)
**Author:** [@fefo69](https://discuss.elastic.co/u/fefo69)\ **Replies:** 2\ **Last updated:** [September 30, 2019, 12:28pm UTC](https://discuss.elastic.co/t/apm-agent-install/201467 "2019-09-30T12:28:52Z")
Dear all, Im trying to setup the standalone method mentioned in elastic site, but the file is not available. In elastic site: https://www.elastic.co/guide/en/apm/agent/java/current/setup-attach-cli.html Refers to down… --- ## [How to debug when the search result doesn't return any highlight objects?](https://discuss.elastic.co/t/how-to-debug-when-the-search-result-doesnt-return-any-highlight-objects/201472)
**Author:** [@apraditya](https://discuss.elastic.co/u/apraditya)\ **Replies:** 1\ **Last updated:** [September 30, 2019, 12:27pm UTC](https://discuss.elastic.co/t/how-to-debug-when-the-search-result-doesnt-return-any-highlight-objects/201472 "2019-09-30T12:27:52Z")
I have the following search structure payload GET es\_index1,es\_index2/\_search?pretty { "query": { "function\_score": { } }, "highlight": { "fields": { "summary.analyzed": {}, "detail.analyze… --- ## [Failed to find metadata for existing index after node restart](https://discuss.elastic.co/t/failed-to-find-metadata-for-existing-index-after-node-restart/191507)
**Author:** [@Vertigo](https://discuss.elastic.co/u/Vertigo)\ **Replies:** 5\ **Last updated:** [September 30, 2019, 12:25pm UTC](https://discuss.elastic.co/t/failed-to-find-metadata-for-existing-index-after-node-restart/191507 "2019-09-30T12:25:08Z")
Recently we upgraded from 6.7.1 to 7.2.0. After the upgrade, if a node leaves the cluster it sometimes runs into the below error. The only way we have found to fix this issue is delete the data directly and lose any data… --- ## [Elasticsearch status show faild](https://discuss.elastic.co/t/elasticsearch-status-show-faild/201590)
**Author:** [@ask664](https://discuss.elastic.co/u/ask664)\ **Replies:** 1\ **Last updated:** [September 30, 2019, 12:24pm UTC](https://discuss.elastic.co/t/elasticsearch-status-show-faild/201590 "2019-09-30T12:24:18Z")
● elasticsearch.service - Elasticsearch Loaded: loaded (/usr/lib/systemd/system/elasticsearch.service; enabled; vendor preset: enabled) Active: failed (Result: exit-code) since Mon 2019-09-30 13:32:10 IST; 14s ago Doc… --- ## [Fuzzy contains on wild card fields](https://discuss.elastic.co/t/fuzzy-contains-on-wild-card-fields/201633)
**Author:** [@tiptobi](https://discuss.elastic.co/u/tiptobi)\ **Replies:** 0\ **Last updated:** [September 30, 2019, 12:18pm UTC](https://discuss.elastic.co/t/fuzzy-contains-on-wild-card-fields/201633 "2019-09-30T12:18:36Z")
Hi guys, I'm struggling to do a "fuzzy contains" search on fields with wildcards. The index looks like: "property": { "title": { "\_en": "sample movie", "\_fr": "exemple" } My first try was sth. like "fuzzy": { "… --- ## [Elastic Search Query DSL Getting full search result](https://discuss.elastic.co/t/elastic-search-query-dsl-getting-full-search-result/201625)
**Author:** [@vivek\_t](https://discuss.elastic.co/u/vivek_t)\ **Replies:** 0\ **Last updated:** [September 30, 2019, 11:44am UTC](https://discuss.elastic.co/t/elastic-search-query-dsl-getting-full-search-result/201625 "2019-09-30T11:44:29Z")
Hi Team, I am trying to search using queryDSL for the below condition { "size" : 1000, "min\_score": 1, "query": { "bool": { "must": { "bool" : { "should": \[ { "match": { "field1": "X" }}, { "match": { "field1":… --- ## [SIEM Infrastructure design](https://discuss.elastic.co/t/siem-infrastructure-design/201529)
**Author:** [@lokmanopt](https://discuss.elastic.co/u/lokmanopt)\ **Replies:** 1\ **Last updated:** [September 30, 2019, 10:35am UTC](https://discuss.elastic.co/t/siem-infrastructure-design/201529 "2019-09-30T10:35:24Z")
Dear Concern, I want to implement SIEM solution for production. I need to ELK expert's help Please share Design for production environment. I have more then 300 system and 300 router as well as 6 Cisco firewall. So p… --- ## [\[Logstash\] Peut-on supprimer un backslash?](https://discuss.elastic.co/t/logstash-peut-on-supprimer-un-backslash/201416)
**Author:** [@Travis](https://discuss.elastic.co/u/Travis)\ **Replies:** 3\ **Last updated:** [September 30, 2019, 10:24am UTC](https://discuss.elastic.co/t/logstash-peut-on-supprimer-un-backslash/201416 "2019-09-30T10:24:59Z")
Bonjour, J'arrive bien à supprimer plusieurs caractères spéciaux : filter { mutate { gsub =\> \["message", "\\\[", ""\] gsub =\> \["message", "\\\]", ""\] gsub =\> \["message", "\\(", ""\] gsub =\> \["message", "\\)",… --- ## [Elastic Search Auto completion return only the first match prefix in completion suggest field input](https://discuss.elastic.co/t/elastic-search-auto-completion-return-only-the-first-match-prefix-in-completion-suggest-field-input/201611)
**Author:** [@Muhamad\_Eissa](https://discuss.elastic.co/u/Muhamad_Eissa)\ **Replies:** 0\ **Last updated:** [September 30, 2019, 10:10am UTC](https://discuss.elastic.co/t/elastic-search-auto-completion-return-only-the-first-match-prefix-in-completion-suggest-field-input/201611 "2019-09-30T10:10:18Z")
I tried to use the completion suggester feature of elastic but when i fill the suggest input field with words with the same prefix it return only one of them. for example a sample of my document suggest field "msSugges… --- ## [Filtering x-axis by using custom intervals in kibana visualizations](https://discuss.elastic.co/t/filtering-x-axis-by-using-custom-intervals-in-kibana-visualizations/201585)
**Author:** [@isharamadhawa](https://discuss.elastic.co/u/isharamadhawa)\ **Replies:** 2\ **Last updated:** [September 30, 2019, 10:05am UTC](https://discuss.elastic.co/t/filtering-x-axis-by-using-custom-intervals-in-kibana-visualizations/201585 "2019-09-30T10:05:51Z")
I have a requirement as the following. When a Kibana visualization contains a x-axis, can we add an interval options list to filter the x-axis like the drop-down list in Kibana Discover. Curently I'm using Elasticsearc… --- ## [Count distinct by date](https://discuss.elastic.co/t/count-distinct-by-date/200845)
**Author:** [@Quang\_D\_Tr\_n](https://discuss.elastic.co/u/Quang_D_Tr_n)\ **Replies:** 2\ **Last updated:** [September 30, 2019, 9:16am UTC](https://discuss.elastic.co/t/count-distinct-by-date/200845 "2019-09-30T09:16:35Z")
I am trying to count distinct date in a field so I followed the cardinality aggregation to do it but it failed to return the expected result, any suggestion on what I am doing wrong please? { "query": { "bool": { "fi… --- ## [Logstash stopped processing because of an error: system Exit](https://discuss.elastic.co/t/logstash-stopped-processing-because-of-an-error-system-exit/201602)
**Author:** [@satyam2593](https://discuss.elastic.co/u/satyam2593)\ **Replies:** 0\ **Last updated:** [September 30, 2019, 8:52am UTC](https://discuss.elastic.co/t/logstash-stopped-processing-because-of-an-error-system-exit/201602 "2019-09-30T08:52:33Z")
I am getting the Logstash error as below. Error: java.lang.IllegalStateException: Logstash stopped processing because of an error: (SystemExit) exit An unexpected error occurred! {:error=\>#\ **Author:** [@namali](https://discuss.elastic.co/u/namali)\ **Replies:** 5\ **Last updated:** [September 30, 2019, 8:29am UTC](https://discuss.elastic.co/t/not-giving-correct-column-from-translate-pluging/201386 "2019-09-30T08:29:57Z") two csv files are hotel.csv hotelcode,hotelname,citycode CountryCityLive.csv citycode,CityName,CountryRegionCode,CountryCode taking all columns from hotel.csv and from CountryCityLive.csv only take CountryRegionCode… --- ## [Show count excluding 2nd index values from 1st index](https://discuss.elastic.co/t/show-count-excluding-2nd-index-values-from-1st-index/200913)
**Author:** [@tag\_v](https://discuss.elastic.co/u/tag_v)\ **Replies:** 2\ **Last updated:** [September 25, 2019, 3:35pm UTC](https://discuss.elastic.co/t/show-count-excluding-2nd-index-values-from-1st-index/200913 "2019-09-25T15:35:10Z")
I have 2 Indices in Elasticsearch with below data. Need a query to visualize metric count as 2 which is documents count after excluding index2 eids from index1 eids. index1: { "\_id":1, "eid":"E1" } { "\_id":2, "eid":"E2… --- ## [How to use size API in composite aggregation for unique terms](https://discuss.elastic.co/t/how-to-use-size-api-in-composite-aggregation-for-unique-terms/201587)
**Author:** [@Sakthivanan](https://discuss.elastic.co/u/Sakthivanan)\ **Replies:** 0\ **Last updated:** [September 30, 2019, 7:58am UTC](https://discuss.elastic.co/t/how-to-use-size-api-in-composite-aggregation-for-unique-terms/201587 "2019-09-30T07:58:29Z")
GET teacher\_dashboard\_student\_kpi\_master\_index/\_search { "size": 0, "query": { "bool": { "filter": \[ \], "must": \[ \] } }, "aggs": { "my\_buckets": { "composite": { "size": 2, "sources": \[ { "school\_year": … --- ## [Dynamic field fetching](https://discuss.elastic.co/t/dynamic-field-fetching/201584)
**Author:** [@amanpradhan](https://discuss.elastic.co/u/amanpradhan)\ **Replies:** 1\ **Last updated:** [September 30, 2019, 7:19am UTC](https://discuss.elastic.co/t/dynamic-field-fetching/201584 "2019-09-30T07:19:09Z")
I have a field "msg\_string" in my logs which has multiple fields saparated by tilda "~" e.g. msg\_string =firstname~lasname~city~hobby~marks ... position of fields firstname,lastname are at index 0 and 1 the position o… --- ## [How to run Metricbeat as a service on SUSE enterprise 11](https://discuss.elastic.co/t/how-to-run-metricbeat-as-a-service-on-suse-enterprise-11/201144)
**Author:** [@arun1](https://discuss.elastic.co/u/arun1)\ **Replies:** 7\ **Last updated:** [September 30, 2019, 7:13am UTC](https://discuss.elastic.co/t/how-to-run-metricbeat-as-a-service-on-suse-enterprise-11/201144 "2019-09-30T07:13:30Z")
Hi, I have installed Meticbeat on SUSE Linux Enterprise 11 using the .rpm package. I am also able to start metricbeat from the command line using the command 'sudo ./metricbeat -e'. However when I try to start it as a … --- ## [How to export index based on hour range?](https://discuss.elastic.co/t/how-to-export-index-based-on-hour-range/201583)
**Author:** [@Bob94](https://discuss.elastic.co/u/Bob94)\ **Replies:** 0\ **Last updated:** [September 30, 2019, 7:11am UTC](https://discuss.elastic.co/t/how-to-export-index-based-on-hour-range/201583 "2019-09-30T07:11:52Z")
Hi, im try to do index export based on hour using elasticdump..is this available ? Thanks and any help is highly appreciated --- ## [Java APM agent configuration via external configuration management](https://discuss.elastic.co/t/java-apm-agent-configuration-via-external-configuration-management/201517)
**Author:** [@surenraju](https://discuss.elastic.co/u/surenraju)\ **Replies:** 1\ **Last updated:** [September 30, 2019, 7:09am UTC](https://discuss.elastic.co/t/java-apm-agent-configuration-via-external-configuration-management/201517 "2019-09-30T07:09:56Z")
Elastic Search Version: 7.3.1 APM Server Version: 7.3.1 APM Client Version: APM Java Agent: 1.x (current) APM Agent language and version: Java 1.8 We are evaluating elastic APM for our micro service stack. As part of… --- ## [Aggregation, group by and histogram in a single query for nested fields](https://discuss.elastic.co/t/aggregation-group-by-and-histogram-in-a-single-query-for-nested-fields/201578)
**Author:** [@Yamuna\_Mallikarjun](https://discuss.elastic.co/u/Yamuna_Mallikarjun)\ **Replies:** 0\ **Last updated:** [September 30, 2019, 6:36am UTC](https://discuss.elastic.co/t/aggregation-group-by-and-histogram-in-a-single-query-for-nested-fields/201578 "2019-09-30T06:36:13Z")
Query: { "size": 0, "query": { "bool": { "must": \[ { "range": { "timestamp": { "from": 1568110120010, "to": 1569824176000, "include\_lower": true, "include\_up… --- ## [Filebeatのタグの設定について](https://discuss.elastic.co/t/filebeat/201567)
**Author:** [@Negi700](https://discuss.elastic.co/u/Negi700)\ **Replies:** 2\ **Last updated:** [September 30, 2019, 6:35am UTC](https://discuss.elastic.co/t/filebeat/201567 "2019-09-30T06:35:47Z")
「x」というタグをつける設定をすると、 「beats\_input\_codec\_plain\_applied」というタグもつきます。 ①「beats\_input\_codec\_plain\_applied」のタグをつけないことは可能でしょうか？ ②また、可能でしたら「beats\_input\_codec\_plain\_applied」をつけない設定を 教えていただけないでしょうか？ 現行のタグ付け x, beats\_input\_code… --- ## [Using keystore in curator](https://discuss.elastic.co/t/using-keystore-in-curator/200610)
**Author:** [@cowensel](https://discuss.elastic.co/u/cowensel)\ **Replies:** 4\ **Last updated:** [September 30, 2019, 6:21am UTC](https://discuss.elastic.co/t/using-keystore-in-curator/200610 "2019-09-30T06:21:10Z")
Hi There, Does anyone use Curator where the username and password are stored in a keystore rather than being plain text in the config file. I need to try and avoid passwords in plain text in configuration files. Any su… --- ## [Dissect Processorのエラーについて](https://discuss.elastic.co/t/dissect-processor/201175)
**Author:** [@harue](https://discuss.elastic.co/u/harue)\ **Replies:** 2\ **Last updated:** [September 30, 2019, 4:29am UTC](https://discuss.elastic.co/t/dissect-processor/201175 "2019-09-30T04:29:04Z")
FileBeatからIngest node Dissect Processorへの連携を行っております。 Input log 1286536308.779 180 192.168.0.224 TCP\_MISS/200 411 GET http://liveupdate.symantecliveupdate.com/minitri.flg - DIRECT/125.23.216.203 text/plain Dissect Proc… --- ## [Not seeing any exported fields for MySQL logs](https://discuss.elastic.co/t/not-seeing-any-exported-fields-for-mysql-logs/201561)
**Author:** [@ashadp](https://discuss.elastic.co/u/ashadp)\ **Replies:** 0\ **Last updated:** [September 30, 2019, 3:56am UTC](https://discuss.elastic.co/t/not-seeing-any-exported-fields-for-mysql-logs/201561 "2019-09-30T03:56:45Z")
I am using following setup to ingest MySQL logs . Filebeat -\> Logstash -\> Elasticsearch -\> Kibana For filebeat, I have enabled mysql module and specified Error and Slowlog path locations. After creating index in Kiban… --- ## [Filebeatでの、収集ログのタグ付けについて](https://discuss.elastic.co/t/filebeat/201375)
**Author:** [@Negi700](https://discuss.elastic.co/u/Negi700)\ **Replies:** 2\ **Last updated:** [September 30, 2019, 3:23am UTC](https://discuss.elastic.co/t/filebeat/201375 "2019-09-30T03:23:42Z")
filebeatで、複数のログファイルを収集しています。 各ログファイルに、固有のタグをつけたいです。 しかし、現在、kibanaで確認すると どのログにも、「messages, beats\_input\_codec\_plain\_applied」という同じタグが 付き詰まっています。 対処方法を教えていただけないでしょうか？ ■filebeatの設定 paths: - /var/log/filebeat/\*\_filebea… --- ## [Hot phase以外のindexの場合、heap sizeあたりshard数](https://discuss.elastic.co/t/hot-phase-index-heap-size-shard/201555)
**Author:** [@ichirou](https://discuss.elastic.co/u/ichirou)\ **Replies:** 0\ **Last updated:** [September 30, 2019, 2:30am UTC](https://discuss.elastic.co/t/hot-phase-index-heap-size-shard/201555 "2019-09-30T02:30:03Z")
heap sizeあたりのshard数について、ご教授いただけませんでしょうか？ Data Node１つに対して、shardを幾つ保持させようか検討しております。 下記の公式ドキュメントには、heap size1Gbあたり20shard以下とするべきとの記述がありました。 Scalability and resilience: clusters, nodes, and shards 検討中のシステムのElasticsearchで… --- ## [Ingest node GrokにてArraylistの値を受け取りエラー](https://discuss.elastic.co/t/ingest-node-grok-arraylist/201124)
**Author:** [@harue](https://discuss.elastic.co/u/harue)\ **Replies:** 4\ **Last updated:** [September 30, 2019, 1:42am UTC](https://discuss.elastic.co/t/ingest-node-grok-arraylist/201124 "2019-09-30T01:42:39Z")
LogstashからElasticsearch(Ingest node)の連携について、ご質問させて頂きます。 実現したいこと ・Logstashでtanslateを実施（前段階としてmutateのsplit,add\_fieldを使い特定の値をfieldにセット） ・Elasticsearch Ingest nodeにて全体値をGrok Logstash config input { beats { port =\> … --- ## [Elasticsearch Percolate with 6.x](https://discuss.elastic.co/t/elasticsearch-percolate-with-6-x/201552)
**Author:** [@Indu\_Nallithodi](https://discuss.elastic.co/u/Indu_Nallithodi)\ **Replies:** 0\ **Last updated:** [September 30, 2019, 12:33am UTC](https://discuss.elastic.co/t/elasticsearch-percolate-with-6-x/201552 "2019-09-30T00:33:00Z")
The 6.x doco says document\_type is deprecated for Percolate (https://www.elastic.co/guide/en/elasticsearch/reference/6.0/breaking\_60\_search\_changes.html) The percolate query’s document\_type has been deprecated. Fro… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1866) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1868)