# Top **URL:** https://discuss.elastic.co/top.md?page=104&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 105 --- ## [How to reference value of field in translate?](https://discuss.elastic.co/t/how-to-reference-value-of-field-in-translate/207561)
**Author:** [@Andrew22](https://discuss.elastic.co/u/Andrew22)\ **Replies:** 16\ **Last updated:** [November 13, 2019, 1:28pm UTC](https://discuss.elastic.co/t/how-to-reference-value-of-field-in-translate/207561 "2019-11-13T13:28:57Z")
I would like to use the device name I have in the dictionary\_path in the translate filter but I am having issues with it. is it even possible? something like translate { field =\> "name" destination =\> "lookUp" dicti… --- ## [Where statement in Kibana search?](https://discuss.elastic.co/t/where-statement-in-kibana-search/77432)
**Author:** [@prophoto](https://discuss.elastic.co/u/prophoto)\ **Replies:** 10\ **Last updated:** [March 7, 2017, 4:53pm UTC](https://discuss.elastic.co/t/where-statement-in-kibana-search/77432 "2017-03-07T16:53:04Z")
This is a typical log line from Apache being stored in AWS Elasticsearch. I'd like to be able to add a viz to my dashboard showing top referrers. The problem is that many static files have referrers from its own domain w… --- ## [Multiline not picking up events immediately](https://discuss.elastic.co/t/multiline-not-picking-up-events-immediately/46823)
**Author:** [@Sameer\_Panicker](https://discuss.elastic.co/u/Sameer_Panicker)\ **Replies:** 16\ **Last updated:** [April 13, 2016, 12:44pm UTC](https://discuss.elastic.co/t/multiline-not-picking-up-events-immediately/46823 "2016-04-13T12:44:03Z")
This is my conf file - file{ path =\> "C:/Logs/\*" codec =\> multiline { pattern =\> "%{WORD:EventId} : %{NUMBER:EventID}, %{WORD:Level} : %{WORD:EventLevel}, %{WORD:Message} : %{WORD:Operation}, %{WORD:Payload} : \[%{WORD… --- ## [Indexing speed in ES v1.71 approx 18% slower than v1.4.5](https://discuss.elastic.co/t/indexing-speed-in-es-v1-71-approx-18-slower-than-v1-4-5/28323)
**Author:** [@tinle](https://discuss.elastic.co/u/tinle)\ **Replies:** 13\ **Last updated:** [September 2, 2015, 10:01pm UTC](https://discuss.elastic.co/t/indexing-speed-in-es-v1-71-approx-18-slower-than-v1-4-5/28323 "2015-09-02T22:01:44Z")
Exact same test system. 5 physical nodes (64G RAM, 2.2TB SSD iofusion card) Intel(R) Xeon(R) CPU E5-2640 0 @ 2.50GHz (two sockets x 6 cores = 12 cores w/HT on) Reindexing. Reading from another ES cluster, bulkloadin… --- ## [Logstash with multiple inputs and outputs](https://discuss.elastic.co/t/logstash-with-multiple-inputs-and-outputs/168248)
**Author:** [@Megha\_Shree](https://discuss.elastic.co/u/Megha_Shree)\ **Replies:** 10\ **Last updated:** [February 13, 2019, 5:15pm UTC](https://discuss.elastic.co/t/logstash-with-multiple-inputs-and-outputs/168248 "2019-02-13T17:15:52Z")
HI All, I am trying to send rsyslog and gelf msgs from logstash to Graylog server I am getting the below error :reason=\>"Expected one of #, { at line 18, column 12 (byte 207) after output {\\n if \[type\] == "rsyslog\\ … --- ## [ELK to slow](https://discuss.elastic.co/t/elk-to-slow/79312)
**Author:** [@permyakovsv](https://discuss.elastic.co/u/permyakovsv)\ **Replies:** 14\ **Last updated:** [March 24, 2017, 11:30am UTC](https://discuss.elastic.co/t/elk-to-slow/79312 "2017-03-24T11:30:39Z")
I have elk installation: logshash -\> rmq -\> logstash(2 instances) -\> Elasticsearch Elasticsearch cluster with 3 nodes. elasticsearch-5.2 (8 cores, 32 Gb, SSD) 12Gb HEAP "number\_of\_replicas": 0 cluster.name: logs no… --- ## [7.11.0 Detections need permissions](https://discuss.elastic.co/t/7-11-0-detections-need-permissions/266610)
**Author:** [@mlove](https://discuss.elastic.co/u/mlove)\ **Replies:** 13\ **Last updated:** [March 26, 2021, 6:46pm UTC](https://discuss.elastic.co/t/7-11-0-detections-need-permissions/266610 "2021-03-26T18:46:59Z")
Hi All, I'm using docker-compose to deploy 5 elastic nodes and 1 kibana. I followed the guide here: Additionally, I have set the following fields: xpack.encryptedSavedObjects.encryptionKey: xpack.reporting.encrypt… --- ## [ILM Policy through logstash dynamic index name](https://discuss.elastic.co/t/ilm-policy-through-logstash-dynamic-index-name/268011)
**Author:** [@gbandasha](https://discuss.elastic.co/u/gbandasha)\ **Replies:** 9\ **Last updated:** [April 13, 2021, 7:05pm UTC](https://discuss.elastic.co/t/ilm-policy-through-logstash-dynamic-index-name/268011 "2021-04-13T19:05:07Z")
Hello Team, I am trying to implement the ILM Policy but I ran into an issue because my index name is dynamically created through logstash. Let me give you an explain of my setup and wat I am trying to do I create th… --- ## [Geoip.location mapped as double](https://discuss.elastic.co/t/geoip-location-mapped-as-double/23854)
**Author:** [@slee](https://discuss.elastic.co/u/slee)\ **Replies:** 9\ **Last updated:** [June 17, 2015, 6:34pm UTC](https://discuss.elastic.co/t/geoip-location-mapped-as-double/23854 "2015-06-17T18:34:16Z")
Hello, I've search for this problem and see it come up pretty often, but the solutions I've found don't seem to take effect for me. Basically, when I create a new index via a logstash config (daily) with a template, it … --- ## [Alerting in ELK stack?](https://discuss.elastic.co/t/alerting-in-elk-stack/18258)
**Author:** [@Siddharth\_Trikha](https://discuss.elastic.co/u/Siddharth_Trikha)\ **Replies:** 9\ **Last updated:** [October 31, 2014, 8:36pm UTC](https://discuss.elastic.co/t/alerting-in-elk-stack/18258 "2014-10-31T20:36:22Z")
We are using the \`ELK stack (logstash, elasticsearch, kibana)\` to analyze our logs. So far, so good. But now we want notification generation on some particular kind of logs. Eg When a login failed logs comes more … --- ## [Indexing with deprecated \_type field](https://discuss.elastic.co/t/indexing-with-deprecated-type-field/271478)
**Author:** [@ThreatInter](https://discuss.elastic.co/u/ThreatInter)\ **Replies:** 16\ **Last updated:** [April 29, 2021, 11:11am UTC](https://discuss.elastic.co/t/indexing-with-deprecated-type-field/271478 "2021-04-29T11:11:52Z")
Hello community. I have a question. What happens in elasticsearch 7.10 if a write attempt occurs with deprecated \_type field (we use apache metron, that tries to write to elastic), something like this "{"index":{"\_ind… --- ## [CloudWatch logs for functionbeat are currently being sent but Kibana doesn't show them on the "Logs" tab?!?!](https://discuss.elastic.co/t/cloudwatch-logs-for-functionbeat-are-currently-being-sent-but-kibana-doesnt-show-them-on-the-logs-tab/229140)
**Author:** [@syost](https://discuss.elastic.co/u/syost)\ **Replies:** 15\ **Last updated:** [April 29, 2020, 6:58am UTC](https://discuss.elastic.co/t/cloudwatch-logs-for-functionbeat-are-currently-being-sent-but-kibana-doesnt-show-them-on-the-logs-tab/229140 "2020-04-29T06:58:02Z")
It appears that my Elasticseach + Kibana + Functionbeat + CloudWatch is setup correctly as far as the connections are working. However, when I generate logs into CloudWatch I never see them in the "Logs" page of Kibana. … --- ## [Long running GC, cluster status RED, only few GB's data](https://discuss.elastic.co/t/long-running-gc-cluster-status-red-only-few-gbs-data/42673)
**Author:** [@Astro-es](https://discuss.elastic.co/u/Astro-es)\ **Replies:** 11\ **Last updated:** [March 27, 2016, 6:35am UTC](https://discuss.elastic.co/t/long-running-gc-cluster-status-red-only-few-gbs-data/42673 "2016-03-27T06:35:02Z")
It has been long since we're facing ES cluster down issues regularly generally when Garbage collection initiates, although data size is relatively small and enough memory is available. ES Setup: ES version: 2.0.0 Clust… --- ## [How to parse below SQL query to ES?](https://discuss.elastic.co/t/how-to-parse-below-sql-query-to-es/102734)
**Author:** [@kedarsdixit](https://discuss.elastic.co/u/kedarsdixit)\ **Replies:** 9\ **Last updated:** [October 6, 2017, 1:25pm UTC](https://discuss.elastic.co/t/how-to-parse-below-sql-query-to-es/102734 "2017-10-06T13:25:23Z")
I have documents such as: { {id:1, timestamp:123456897} , {id:1, timestamp:123456893}, {id:1, timestamp:123356897} } Suppose I need to get highest time stamp for each id ? (assuming there can be multiple ids and ea… --- ## [How to run metricbeat in background?](https://discuss.elastic.co/t/how-to-run-metricbeat-in-background/263595)
**Author:** [@shaiksubhan](https://discuss.elastic.co/u/shaiksubhan)\ **Replies:** 11\ **Last updated:** [February 9, 2021, 3:17pm UTC](https://discuss.elastic.co/t/how-to-run-metricbeat-in-background/263595 "2021-02-09T15:17:17Z")
Hi Team, I am trying to install Metricbeat 7.10.1 Linux version on my Linux machine but I am unable to run the metricbeat in the Background. Can any one help me on this so that i can run this beat in background itself … --- ## [Kibana doesn't show the numerical tags values](https://discuss.elastic.co/t/kibana-doesnt-show-the-numerical-tags-values/27053)
**Author:** [@billy6](https://discuss.elastic.co/u/billy6)\ **Replies:** 13\ **Last updated:** [August 10, 2015, 8:31am UTC](https://discuss.elastic.co/t/kibana-doesnt-show-the-numerical-tags-values/27053 "2015-08-10T08:31:59Z")
Hi, I'm sending messages with whis configuration\> 2015/01/06 07:15:43.073;1.849365 And I'm using this grok filter in logstash\> grok{ match =\> { "message" =\> "%{YEAR:year}/%{MONTHNUM:monthnum}/%{MONTHDAY:monthday} %{TI… --- ## [Filebeat as service on Windows Server 2008 R2 not work properly](https://discuss.elastic.co/t/filebeat-as-service-on-windows-server-2008-r2-not-work-properly/38997)
**Author:** [@djvidov](https://discuss.elastic.co/u/djvidov)\ **Replies:** 12\ **Last updated:** [January 14, 2016, 7:53am UTC](https://discuss.elastic.co/t/filebeat-as-service-on-windows-server-2008-r2-not-work-properly/38997 "2016-01-14T07:53:45Z")
Hello, I have finished the the implementation of ELK + filebeat, and on my laptop works well. ELK are installed into linux server. And filebeat should monitor files from an windows server 2008. When I run FileBeat 1.0… --- ## [Merge policy tuning hint](https://discuss.elastic.co/t/merge-policy-tuning-hint/10070)
**Author:** [@arta](https://discuss.elastic.co/u/arta)\ **Replies:** 15\ **Last updated:** [December 20, 2012, 10:30pm UTC](https://discuss.elastic.co/t/merge-policy-tuning-hint/10070 "2012-12-20T22:30:41Z")
Hi, I think I am seeing node performance degrades when the merge count ("merges":{"current": x, ...}} in node stats) increases to somewhere 6 to 10, and that results the node drop from the cluster. I enabled index… --- ## [Experience Unavailable Cluster Issue](https://discuss.elastic.co/t/experience-unavailable-cluster-issue/164506)
**Author:** [@rockybean](https://discuss.elastic.co/u/rockybean)\ **Replies:** 14\ **Last updated:** [January 18, 2019, 12:43am UTC](https://discuss.elastic.co/t/experience-unavailable-cluster-issue/164506 "2019-01-18T00:43:53Z")
Hi, I'm testing ece 2.0.1 on aws. My deployment is a small one with three ece node with full roles. One ece node was terminated. Ece should have high availability even one node is down. But the reality is I cannot ge… --- ## [Running 1.x & 5.x SxS](https://discuss.elastic.co/t/running-1-x-5-x-sxs/76289)
**Author:** [@aateeque](https://discuss.elastic.co/u/aateeque)\ **Replies:** 18\ **Last updated:** [February 27, 2017, 9:46am UTC](https://discuss.elastic.co/t/running-1-x-5-x-sxs/76289 "2017-02-27T09:46:29Z")
I am trying to install es 5.2.1 on win2008 r2 server; it already runs 1.x ES. I am getting: Installing service : "elasticsearch-service-x64" Using JAVA\_HOME (64-bit): "D:\\Java\\jdk1.8.0\_40x64\\jre" Failed install… --- ## [New filebeat/ELK stack user: trouble with Raspberry](https://discuss.elastic.co/t/new-filebeat-elk-stack-user-trouble-with-raspberry/70435)
**Author:** [@jarif](https://discuss.elastic.co/u/jarif)\ **Replies:** 17\ **Last updated:** [January 3, 2017, 5:01pm UTC](https://discuss.elastic.co/t/new-filebeat-elk-stack-user-trouble-with-raspberry/70435 "2017-01-03T17:01:35Z")
Hello all. I have an ELK stack running on a CentOS server. I also have logging satellites running CentOS, and those are sending logs using filebeat. Fine, and works nice. I'm also trying to set up my Raspberrys for f… --- ## [Failed to publish events: unsupported float value: NaN](https://discuss.elastic.co/t/failed-to-publish-events-unsupported-float-value-nan/169771)
**Author:** [@sgerlach](https://discuss.elastic.co/u/sgerlach)\ **Replies:** 15\ **Last updated:** [March 18, 2019, 10:22am UTC](https://discuss.elastic.co/t/failed-to-publish-events-unsupported-float-value-nan/169771 "2019-03-18T10:22:45Z")
Hello, We have some issues with metricbeat to logstash transport. After some time (can be days after startup), metricbeat starts logging "Failed to publish events: unsupported float value: NaN" every report cycle and re… --- ## [Phrase suggester for not\_analyzed?](https://discuss.elastic.co/t/phrase-suggester-for-not-analyzed/37667)
**Author:** [@111106](https://discuss.elastic.co/u/111106)\ **Replies:** 9\ **Last updated:** [December 22, 2015, 2:31pm UTC](https://discuss.elastic.co/t/phrase-suggester-for-not-analyzed/37667 "2015-12-22T14:31:55Z")
Is it possible to use a phrase suggester on fields that are indexed as not\_analyzed? For some reason, I keep getting empty results. Query looks something like: POST http://localhost:9200/companies/\_suggest { "text… --- ## [The new version of es "\_count" doesn't support post\_filter](https://discuss.elastic.co/t/the-new-version-of-es--count-doesnt-support-post-filter/91825)
**Author:** [@yanyumiao](https://discuss.elastic.co/u/yanyumiao)\ **Replies:** 9\ **Last updated:** [July 6, 2017, 4:36pm UTC](https://discuss.elastic.co/t/the-new-version-of-es--count-doesnt-support-post-filter/91825 "2017-07-06T16:36:34Z")
hi: I found that es v2.3.3 \[\_count\] and \[\_search\] both support \[post\_filter\] but es v5.0.2 \[\_count\] does not support \[post\_filter\]. I also found es v5.4.2 has the same problem. Is that a BUG? --- ## [Custom template for not \_analyzed field is not working](https://discuss.elastic.co/t/custom-template-for-not--analyzed-field-is-not-working/66080)
**Author:** [@bhavani1](https://discuss.elastic.co/u/bhavani1)\ **Replies:** 9\ **Last updated:** [November 16, 2016, 6:59pm UTC](https://discuss.elastic.co/t/custom-template-for-not--analyzed-field-is-not-working/66080 "2016-11-16T18:59:02Z")
Hi all, I have created a new template and posted into localhost using POSTMAN.The new INDEX is not replicating the changes. I couldn't find where I made mistake. Help me in this my new template is: { "template": "\*", … --- ## [Data nodes randomly leaving cluster](https://discuss.elastic.co/t/data-nodes-randomly-leaving-cluster/294838)
**Author:** [@jcasals](https://discuss.elastic.co/u/jcasals)\ **Replies:** 11\ **Last updated:** [January 25, 2022, 8:55am UTC](https://discuss.elastic.co/t/data-nodes-randomly-leaving-cluster/294838 "2022-01-25T08:55:30Z")
Hello, I have a problem that I can't seem to be able to fix nor understand. I have an Elasticsearch cluster with three master nodes and 6 (12) data nodes. Master nodes: virtual, with 2CPU and 4GB of memory. Data node… --- ## [Not able to trigger email from connector](https://discuss.elastic.co/t/not-able-to-trigger-email-from-connector/309672)
**Author:** [@desai.aditya12](https://discuss.elastic.co/u/desai.aditya12)\ **Replies:** 17\ **Last updated:** [July 28, 2022, 10:13am UTC](https://discuss.elastic.co/t/not-able-to-trigger-email-from-connector/309672 "2022-07-28T10:13:47Z")
I am configuring a connector to send emails when server is down. for that i have done gmail configuration in elasticsearch.yml xpack.notification.email.account: gmail\_account: profile: gmail smtp: auth: true startt… --- ## [Rally Track Report Analysis (follow up)](https://discuss.elastic.co/t/rally-track-report-analysis-follow-up/127266)
**Author:** [@ize0j10](https://discuss.elastic.co/u/ize0j10)\ **Replies:** 17\ **Last updated:** [May 16, 2018, 3:23pm UTC](https://discuss.elastic.co/t/rally-track-report-analysis-follow-up/127266 "2018-05-16T15:23:12Z")
Continuing the discussion from Rally Track Report Analysis: Hi, we are running esrally Version 0.9.4 (with options --pipeline=benchmark-only --client-ptions="use\_ssl:true,verify\_certs:false,basic\_auth\_user:'${ESRALLY\_… --- ## [ES5 RestClient retry behavior with multiple nodes: Fix suggestion](https://discuss.elastic.co/t/es5-restclient-retry-behavior-with-multiple-nodes-fix-suggestion/64929)
**Author:** [@trisport88](https://discuss.elastic.co/u/trisport88)\ **Replies:** 9\ **Last updated:** [November 16, 2016, 3:56am UTC](https://discuss.elastic.co/t/es5-restclient-retry-behavior-with-multiple-nodes-fix-suggestion/64929 "2016-11-16T03:56:33Z")
Hi, I have been testing the behavior of the RestClient (ES 5) when a node that is part of a two node cluster is not running. I have configured the RestClient with two nodes: localhost:9200 localhost:9321 When I con… --- ## [Master role does not switch automaticaly](https://discuss.elastic.co/t/master-role-does-not-switch-automaticaly/214213)
**Author:** [@The-oo](https://discuss.elastic.co/u/The-oo)\ **Replies:** 16\ **Last updated:** [January 20, 2020, 10:09am UTC](https://discuss.elastic.co/t/master-role-does-not-switch-automaticaly/214213 "2020-01-20T10:09:32Z")
Hello everyone, I've recently having issue moving the master role from node to node. I got 3 node in my cluster and there are all 3 master-eligible nodes : I first disable shard allocation on my second node and i le… --- ## [Unable to start Elasticsearch 7.6.2 due to java.lang.NoSuchFieldError: LUCENE\_6\_0\_0](https://discuss.elastic.co/t/unable-to-start-elasticsearch-7-6-2-due-to-java-lang-nosuchfielderror-lucene-6-0-0/232006)
**Author:** [@markt277](https://discuss.elastic.co/u/markt277)\ **Replies:** 10\ **Last updated:** [May 12, 2020, 4:03pm UTC](https://discuss.elastic.co/t/unable-to-start-elasticsearch-7-6-2-due-to-java-lang-nosuchfielderror-lucene-6-0-0/232006 "2020-05-12T16:03:49Z")
Hi there I'm upgrading Elasticsearch, Kibana and Filebeat to their respective latest versions, starting with Elasticsearch. I took a backup of all the indices before starting. This is a single node in a dev environment.… --- ## [Curl in logstash conf](https://discuss.elastic.co/t/curl-in-logstash-conf/110457)
**Author:** [@Shekhar\_Pandey](https://discuss.elastic.co/u/Shekhar_Pandey)\ **Replies:** 10\ **Last updated:** [December 7, 2017, 6:10am UTC](https://discuss.elastic.co/t/curl-in-logstash-conf/110457 "2017-12-07T06:10:28Z")
Can we use curl option in logstash conf...is this possible or not.... Thank you. --- ## [Graph Plugin Missing on Kibana 5](https://discuss.elastic.co/t/graph-plugin-missing-on-kibana-5/54215)
**Author:** [@mitchswaldman](https://discuss.elastic.co/u/mitchswaldman)\ **Replies:** 9\ **Last updated:** [June 29, 2016, 6:38pm UTC](https://discuss.elastic.co/t/graph-plugin-missing-on-kibana-5/54215 "2016-06-29T18:38:55Z")
Hello! I installed Kibana 5.0 and ES 5.0, and I'm able to bring up the Kibana UI, but I noticed that the graph app isn't listed on the side panel with all the other apps. I installed x-pack into Kibana and ES. Do I ha… --- ## [Elastic application is down because of unknown node.remote\_cluster\_client](https://discuss.elastic.co/t/elastic-application-is-down-because-of-unknown-node-remote-cluster-client/272484)
**Author:** [@Dawood](https://discuss.elastic.co/u/Dawood)\ **Replies:** 11\ **Last updated:** [May 17, 2021, 11:04am UTC](https://discuss.elastic.co/t/elastic-application-is-down-because-of-unknown-node-remote-cluster-client/272484 "2021-05-17T11:04:48Z")
--- ## [File input randomly skipping files](https://discuss.elastic.co/t/file-input-randomly-skipping-files/170228)
**Author:** [@Bob\_Nicksic](https://discuss.elastic.co/u/Bob_Nicksic)\ **Replies:** 9\ **Last updated:** [February 28, 2019, 10:02pm UTC](https://discuss.elastic.co/t/file-input-randomly-skipping-files/170228 "2019-02-28T22:02:50Z")
I'm using the file input to ingest cloudflare logs into elasticsearch. I have a cronjob that runs every 10 minutes and dumps a gzip file ranging from a few hundred KB to a couple MB in size into the read path. Logstash r… --- ## [Export has limited columns](https://discuss.elastic.co/t/export-has-limited-columns/285584)
**Author:** [@parthmaniar](https://discuss.elastic.co/u/parthmaniar)\ **Replies:** 11\ **Last updated:** [October 6, 2021, 4:08pm UTC](https://discuss.elastic.co/t/export-has-limited-columns/285584 "2021-10-06T16:08:21Z")
Hello, I hope this message finds the community members safe and healthy. I'm having incomplete data when exporting via Kibana & the output is erratic. I am carrying out the searches on the same index Total documents… --- ## [Filebeat Multiline Weblogic//Java Stacktrace](https://discuss.elastic.co/t/filebeat-multiline-weblogic-java-stacktrace/58348)
**Author:** [@JensK](https://discuss.elastic.co/u/JensK)\ **Replies:** 10\ **Last updated:** [August 22, 2016, 10:13am UTC](https://discuss.elastic.co/t/filebeat-multiline-weblogic-java-stacktrace/58348 "2016-08-22T10:13:25Z")
Hello guys :slight\_smile: im testing ELK with Weblogic Application Server and want to parse the server.out file with filebeat. This ist my Example file.... \<18.08.2016 14:00 Uhr MESZ\> \ \ \ \<… --- ## [Upgrade to 2.0 breaks Kibana and Logstash](https://discuss.elastic.co/t/upgrade-to-2-0-breaks-kibana-and-logstash/31953)
**Author:** [@scaarup](https://discuss.elastic.co/u/scaarup)\ **Replies:** 9\ **Last updated:** [November 9, 2015, 1:39am UTC](https://discuss.elastic.co/t/upgrade-to-2-0-breaks-kibana-and-logstash/31953 "2015-11-09T01:39:34Z")
Hi all. I just tried to upgrade my elasticsearch from 1.7 to 2.0 on a non-prod system. I have not upgraded logstash or Kibana. Kibana (1.4.2) just stopped working with an error " Error Discover: An error occurred with … --- ## [Sysmon events not getting to SOC kibana or hunt - connection issues](https://discuss.elastic.co/t/sysmon-events-not-getting-to-soc-kibana-or-hunt-connection-issues/327966)
**Author:** [@iqworks](https://discuss.elastic.co/u/iqworks)\ **Replies:** 23\ **Last updated:** [April 17, 2023, 11:47pm UTC](https://discuss.elastic.co/t/sysmon-events-not-getting-to-soc-kibana-or-hunt-connection-issues/327966 "2023-04-17T23:47:57Z")
Hi, i am using elasticsearch 8.6.2, Winlogbeat 8.6.2 and sysmon 74 I am trying the ELK system. The data gets into sysmon ok. There are probably many reasons. I was pointing to output.logstash because as I understand … --- ## [SIEM Hosts/All Hosts Tables Empty](https://discuss.elastic.co/t/siem-hosts-all-hosts-tables-empty/189832)
**Author:** [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Replies:** 11\ **Last updated:** [August 5, 2019, 1:03pm UTC](https://discuss.elastic.co/t/siem-hosts-all-hosts-tables-empty/189832 "2019-08-05T13:03:12Z")
Started playing with SIEM after upgrading our Stack and some agents to 7.2. I currently have winlogbeat and auditbeat sending data to our stack. Auditbeat has the host and process modules enabled, winlogbeat is sending… --- ## [Elasticsearch errors while running](https://discuss.elastic.co/t/elasticsearch-errors-while-running/191321)
**Author:** [@pharshil9697](https://discuss.elastic.co/u/pharshil9697)\ **Replies:** 17\ **Last updated:** [July 19, 2019, 2:57pm UTC](https://discuss.elastic.co/t/elasticsearch-errors-while-running/191321 "2019-07-19T14:57:23Z")
After downloading and extracting the zip file, I tried to run the bat file. Now it is showing this error. I am kind of not able to figure this out. I checked the logs this is what it displays. Elasticsearch version : 7.… --- ## [Unable to login to Kibana](https://discuss.elastic.co/t/unable-to-login-to-kibana/354147)
**Author:** [@Mike\_Kirby](https://discuss.elastic.co/u/Mike_Kirby)\ **Replies:** 14\ **Last updated:** [March 1, 2024, 1:59pm UTC](https://discuss.elastic.co/t/unable-to-login-to-kibana/354147 "2024-03-01T13:59:06Z")
Good Afternoon. I have been working with OpenShift and ElasticSIEM for 6 months now. For the first 5 I was learning the installation process and getting up to speed. I am able to install ElasticSIEM without containers… --- ## [How to get data](https://discuss.elastic.co/t/how-to-get-data/70260)
**Author:** [@dineshangari](https://discuss.elastic.co/u/dineshangari)\ **Replies:** 20\ **Last updated:** [January 13, 2017, 11:03am UTC](https://discuss.elastic.co/t/how-to-get-data/70260 "2017-01-13T11:03:30Z")
" input { http\_poller { urls =\> { http\_poller { url =\> " " --- ## [Bulk indexing creates a lot of disk read OPS](https://discuss.elastic.co/t/bulk-indexing-creates-a-lot-of-disk-read-ops/23386)
**Author:** [@Eran\_Eidinger](https://discuss.elastic.co/u/Eran_Eidinger)\ **Replies:** 11\ **Last updated:** [April 24, 2015, 11:54am UTC](https://discuss.elastic.co/t/bulk-indexing-creates-a-lot-of-disk-read-ops/23386 "2015-04-24T11:54:11Z")
Hello, I've created an index I use for logging. This means there are mostly writes, and some searches once in a while. In the phase of the first loading, I'm using several clients to concurrently index documents… --- ## [Functionbeat missing package io/fs](https://discuss.elastic.co/t/functionbeat-missing-package-io-fs/284975)
**Author:** [@Yero\_Me](https://discuss.elastic.co/u/Yero_Me)\ **Replies:** 11\ **Last updated:** [December 30, 2021, 11:34am UTC](https://discuss.elastic.co/t/functionbeat-missing-package-io-fs/284975 "2021-12-30T11:34:18Z")
Hello, Since 7.15, deployment for functionbeat on GCP cloud function leads to an error : Function: functionbeat-XXXXX, could not update, error: error while creating function (code: 3): \[89\](/-/jobs/1615821324#L89)Buil… --- ## [Loading a file having multiple XML elements, but document is not having ROOT element](https://discuss.elastic.co/t/loading-a-file-having-multiple-xml-elements-but-document-is-not-having-root-element/89423)
**Author:** [@bhattji007](https://discuss.elastic.co/u/bhattji007)\ **Replies:** 11\ **Last updated:** [July 11, 2017, 7:35pm UTC](https://discuss.elastic.co/t/loading-a-file-having-multiple-xml-elements-but-document-is-not-having-root-element/89423 "2017-07-11T19:35:07Z")
I am not able to find any post/documents/blogs/search to load details from XML file without root element. Here is my structure: rt-logs.gz file is having file containing daily real time messages, and each message have p… --- ## [ERROR Unable to locate plugin type for IfFileName](https://discuss.elastic.co/t/error-unable-to-locate-plugin-type-for-iffilename/115398)
**Author:** [@ilkiny](https://discuss.elastic.co/u/ilkiny)\ **Replies:** 9\ **Last updated:** [January 13, 2018, 3:01pm UTC](https://discuss.elastic.co/t/error-unable-to-locate-plugin-type-for-iffilename/115398 "2018-01-13T15:01:23Z")
Hello there, I am faced with such an error, what is the cause? Log Stay with love. --- ## [Detecting entries causing mapping conflict](https://discuss.elastic.co/t/detecting-entries-causing-mapping-conflict/359275)
**Author:** [@AmyMCollins](https://discuss.elastic.co/u/AmyMCollins)\ **Replies:** 12\ **Last updated:** [May 13, 2024, 4:03pm UTC](https://discuss.elastic.co/t/detecting-entries-causing-mapping-conflict/359275 "2024-05-13T16:03:06Z")
Hi, In my index pattern, I am getting a warning on one of my fields that it is defined as multiple types (text, float, long) and so it causing a mapping conflict. I do know how to solve it by re-indexing. I am wonderi… --- ## [I really need help with standard rsyslog parsing](https://discuss.elastic.co/t/i-really-need-help-with-standard-rsyslog-parsing/33622)
**Author:** [@tomas](https://discuss.elastic.co/u/tomas)\ **Replies:** 11\ **Last updated:** [November 3, 2015, 1:49pm UTC](https://discuss.elastic.co/t/i-really-need-help-with-standard-rsyslog-parsing/33622 "2015-11-03T13:49:09Z")
Hi, env: rsyslog (clients) =\> syslog-ng (server) =\> logstash 1.5 =\> elasticsearch =\> kibana I'm trying to parse (match) the standard linux rsyslog message format but I always get \_grokparsefailure and are unable to c… --- ## [Kibana keeps restarting with no error](https://discuss.elastic.co/t/kibana-keeps-restarting-with-no-error/301868)
**Author:** [@radw](https://discuss.elastic.co/u/radw)\ **Replies:** 10\ **Last updated:** [April 14, 2022, 1:35pm UTC](https://discuss.elastic.co/t/kibana-keeps-restarting-with-no-error/301868 "2022-04-14T13:35:01Z")
Hi all. I've deployed an EK stack on GKE, with operator 1.9.1, but my kibana pod keeps restarting. The only pertinent log which I've been able to extract from kibana's pods is this: rpc error: code = NotFound desc = a… [Previous page](https://discuss.elastic.co/top.md?page=103&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=105&per_page=50&period=all)