# Top **URL:** https://discuss.elastic.co/top.md?page=1140&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1141 --- ## [Winlogbeat: Logstash as forensic investigator](https://discuss.elastic.co/t/winlogbeat-logstash-as-forensic-investigator/67612)
**Author:** [@xsallowed](https://discuss.elastic.co/u/xsallowed)\ **Replies:** 2\ **Last updated:** [December 3, 2016, 11:18am UTC](https://discuss.elastic.co/t/winlogbeat-logstash-as-forensic-investigator/67612 "2016-12-03T11:18:12Z")
Hi I am trying to parse log files collected as part of forensic investigation from windows machine and wondering how can i make winlogbeat to parse logs from files and ship it to logstash server? Do we have a winlogbea… --- ## [More high quality tile map?](https://discuss.elastic.co/t/more-high-quality-tile-map/63812)
**Author:** [@YuWatanabe](https://discuss.elastic.co/u/YuWatanabe)\ **Replies:** 2\ **Last updated:** [October 28, 2016, 11:11pm UTC](https://discuss.elastic.co/t/more-high-quality-tile-map/63812 "2016-10-28T23:11:43Z")
I am searching for a tile map that could zoom into street level on Kibana. Unfortunately, default tile map is not enough. Could someone share ones idea for good tile map service? My region is Japan. Perhaps, has any on… --- ## [Client node configuration](https://discuss.elastic.co/t/client-node-configuration/56082)
**Author:** [@YuWatanabe](https://discuss.elastic.co/u/YuWatanabe)\ **Replies:** 2\ **Last updated:** [July 22, 2016, 12:33am UTC](https://discuss.elastic.co/t/client-node-configuration/56082 "2016-07-22T00:33:57Z")
Hi! I am checking necessary setting for client node setup. I would like to ask question regarding to client node setup. \*\* Environment\*\* 1 cluster 3 regular nodes (Both eligible for master and data) 1 client node A… --- ## [Sparse\_vector query is not working](https://discuss.elastic.co/t/sparse-vector-query-is-not-working/365450)
**Author:** [@Pankaj\_Kumawat](https://discuss.elastic.co/u/Pankaj_Kumawat)\ **Replies:** 8\ **Last updated:** [August 28, 2024, 4:51am UTC](https://discuss.elastic.co/t/sparse-vector-query-is-not-working/365450 "2024-08-28T04:51:59Z")
following this doc i have created index with the mapping shown in the docs but when i am querying through the data, i am getting this error { "error": { "root\_cause": \[ { "type": "parsing\_exception… --- ## [Timeline Template not applied when Alert fires](https://discuss.elastic.co/t/timeline-template-not-applied-when-alert-fires/301950)
**Author:** [@PhilA](https://discuss.elastic.co/u/PhilA)\ **Replies:** 8\ **Last updated:** [April 12, 2022, 7:41am UTC](https://discuss.elastic.co/t/timeline-template-not-applied-when-alert-fires/301950 "2022-04-12T07:41:56Z")
Hi I am having issues with timeline templates. I have built a custom template showing some specific fields I would be interested in for blocked sessions thorugh a firewall. The timeline is configured and in the timeli… --- ## [Parsing apache logs - COMBINEDAPACHELOG & COMMONAPACHELOG not working](https://discuss.elastic.co/t/parsing-apache-logs-combinedapachelog-commonapachelog-not-working/82007)
**Author:** [@Maria\_Delarosa](https://discuss.elastic.co/u/Maria_Delarosa)\ **Replies:** 0\ **Last updated:** [April 11, 2017, 3:16pm UTC](https://discuss.elastic.co/t/parsing-apache-logs-combinedapachelog-commonapachelog-not-working/82007 "2017-04-11T15:16:38Z")
I am currently trying to parse Apache access and error logs. I have used both COMBINEDAPACHELOG and COMMONAPACHELOG but no luck. For the access logs I am trying to break it down to show timestamp, source, target, userage… --- ## [Logstash 7.17 keystore - get value by variable key](https://discuss.elastic.co/t/logstash-7-17-keystore-get-value-by-variable-key/342446)
**Author:** [@bonyolult](https://discuss.elastic.co/u/bonyolult)\ **Replies:** 4\ **Last updated:** [September 8, 2023, 8:24pm UTC](https://discuss.elastic.co/t/logstash-7-17-keystore-get-value-by-variable-key/342446 "2023-09-08T20:24:59Z")
Hello, long story short: i must process logs that are encryped with EC keys. The customer requires the keys' passwords to be stored in Logstash keystore where the key is the p12's serial and the value is the password. T… --- ## [Unable to Parse Meraki Flow Syslog Message with GROK and KV Filters in Logstash](https://discuss.elastic.co/t/unable-to-parse-meraki-flow-syslog-message-with-grok-and-kv-filters-in-logstash/271446)
**Author:** [@Khughes0516](https://discuss.elastic.co/u/Khughes0516)\ **Replies:** 4\ **Last updated:** [April 28, 2021, 9:03pm UTC](https://discuss.elastic.co/t/unable-to-parse-meraki-flow-syslog-message-with-grok-and-kv-filters-in-logstash/271446 "2021-04-28T21:03:53Z")
Hello, I am having a lot of trouble with trying to parse a Cisco Meraki flow syslog message in Logstash. A sample message looks like this: Apr 25 13:12:41 gateway 1619356361.230223408 ip\_flow\_end src=10.1.130.45 dst=3… --- ## [No cipher suits](https://discuss.elastic.co/t/no-cipher-suits/209209)
**Author:** [@laijianbin](https://discuss.elastic.co/u/laijianbin)\ **Replies:** 4\ **Last updated:** [November 25, 2019, 9:21am UTC](https://discuss.elastic.co/t/no-cipher-suits/209209 "2019-11-25T09:21:27Z")
when zipkin connect to elasticsearch which Connections are secured using Transport Layer Security. \[2019-11-25T10:01:04,749\]\[WARN \]\[o.e.h.n.Netty4HttpServerTransport\] \[lFAgPu1\] caught exception while handling client ht… --- ## [How to make Elasticsearch can search from another field when have some specific keyword](https://discuss.elastic.co/t/how-to-make-elasticsearch-can-search-from-another-field-when-have-some-specific-keyword/177143)
**Author:** [@LinJIngYun](https://discuss.elastic.co/u/LinJIngYun)\ **Replies:** 1\ **Last updated:** [April 17, 2019, 1:58am UTC](https://discuss.elastic.co/t/how-to-make-elasticsearch-can-search-from-another-field-when-have-some-specific-keyword/177143 "2019-04-17T01:58:44Z")
Hello, This is my example data about event or meeting organization. I want to perform searching like "Songkarn holiday in Bangkok" and Elasticsearch will know automatically that "in \[Bangkok\]" is it mean my location f… --- ## [Single Metric Viewer - Visual Bug](https://discuss.elastic.co/t/single-metric-viewer-visual-bug/142696)
**Author:** [@manuelk](https://discuss.elastic.co/u/manuelk)\ **Replies:** 1\ **Last updated:** [August 2, 2018, 8:09am UTC](https://discuss.elastic.co/t/single-metric-viewer-visual-bug/142696 "2018-08-02T08:09:51Z")
Hello, we´re running a 6.3 Cluster and I think (since the upgrade) there seems to be a visual bug in the Single Metric Viewer. If you change time span the graphic sometimes shows the anomalies and sometimes not, e.G.: … --- ## [Logstash creating day based indexes](https://discuss.elastic.co/t/logstash-creating-day-based-indexes/49633)
**Author:** [@rajkumar3v](https://discuss.elastic.co/u/rajkumar3v)\ **Replies:** 4\ **Last updated:** [May 10, 2016, 2:58pm UTC](https://discuss.elastic.co/t/logstash-creating-day-based-indexes/49633 "2016-05-10T14:58:16Z")
Hello guys, I am new to Logstash, i have configured logstash to process syslog messages and it is creating indexes every day but i need single index for syslog messages. (I have understand logstash will cre… --- ## [Why would the docs.deleted count in some indices exceed 10 times the docs.count?](https://discuss.elastic.co/t/why-would-the-docs-deleted-count-in-some-indices-exceed-10-times-the-docs-count/358223)
**Author:** [@wangxr1985](https://discuss.elastic.co/u/wangxr1985)\ **Replies:** 7\ **Last updated:** [April 26, 2024, 8:09am UTC](https://discuss.elastic.co/t/why-would-the-docs-deleted-count-in-some-indices-exceed-10-times-the-docs-count/358223 "2024-04-26T08:09:19Z")
OS: CentOS 7.8 ES version: 7.5.2 with bundled JDK(openjdk version "13.0.1" 2019-10-15) The default segment merge parameter index.merge.policy.deletes\_pct\_allowed is set to 33, so theoretically the docs.deleted count … --- ## [Calculating a formula on nested fields in classic, aggregation-based visualizations](https://discuss.elastic.co/t/calculating-a-formula-on-nested-fields-in-classic-aggregation-based-visualizations/311988)
**Author:** [@slhck](https://discuss.elastic.co/u/slhck)\ **Replies:** 7\ **Last updated:** [August 15, 2022, 6:17pm UTC](https://discuss.elastic.co/t/calculating-a-formula-on-nested-fields-in-classic-aggregation-based-visualizations/311988 "2022-08-15T18:17:15Z")
I have a document field that gives me a result in kBit/s, but I would like to convert it to MBit/s (by dividing by 1,000). This should only be done during visualization; there is no need to create a runtime field or scri… --- ## [Metricbeat elasticsearch module and SSL configuration](https://discuss.elastic.co/t/metricbeat-elasticsearch-module-and-ssl-configuration/274532)
**Author:** [@DPattee](https://discuss.elastic.co/u/DPattee)\ **Replies:** 1\ **Last updated:** [June 23, 2021, 10:12am UTC](https://discuss.elastic.co/t/metricbeat-elasticsearch-module-and-ssl-configuration/274532 "2021-06-23T10:12:27Z")
tl;dr: I'm having trouble getting metricbeat elasticsearch module to work properly after enabling ssl. Background I followed the tutorials to get ssl/tls set up on my test cluster. There is one node that is the elastic… --- ## [Jdbc for sqlserver](https://discuss.elastic.co/t/jdbc-for-sqlserver/198058)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 1\ **Last updated:** [September 10, 2019, 8:24pm UTC](https://discuss.elastic.co/t/jdbc-for-sqlserver/198058 "2019-09-10T20:24:17Z")
I am trying to connect to microsoft sqlserver but no luck I can connect to this db using microsoft sqlserver management studio. What am I missing here? input { jdbc { jdbc\_validate\_connection =\> … --- ## [Why does the NEST library make a HEAD call every time?](https://discuss.elastic.co/t/why-does-the-nest-library-make-a-head-call-every-time/184864)
**Author:** [@rgelb](https://discuss.elastic.co/u/rgelb)\ **Replies:** 7\ **Last updated:** [June 10, 2019, 11:44pm UTC](https://discuss.elastic.co/t/why-does-the-nest-library-make-a-head-call-every-time/184864 "2019-06-10T23:44:05Z")
I am using NEST library 6.5 from a .NET Core project. I've noticed that the library sends out an HTTP HEAD message prior to every call to get actual data. HEAD http://10.50.136.80:9200/ GET http://10.50.136.80:9200/pr… --- ## [Mixing ssd and hdd in path.data is not working](https://discuss.elastic.co/t/mixing-ssd-and-hdd-in-path-data-is-not-working/99180)
**Author:** [@elasticuser1](https://discuss.elastic.co/u/elasticuser1)\ **Replies:** 7\ **Last updated:** [September 2, 2017, 4:47am UTC](https://discuss.elastic.co/t/mixing-ssd-and-hdd-in-path-data-is-not-working/99180 "2017-09-02T04:47:23Z")
Hi, For one of ES instances, we pointed path.data to both hdd and ssd. path.data: /dir/d05/elasticsearch/data,/ssd/elasticsearch/data This setup is not working. I found there is NO data being written to ssd except \_st… --- ## [Logstash install?](https://discuss.elastic.co/t/logstash-install/93660)
**Author:** [@Maha](https://discuss.elastic.co/u/Maha)\ **Replies:** 7\ **Last updated:** [July 20, 2017, 8:00am UTC](https://discuss.elastic.co/t/logstash-install/93660 "2017-07-20T08:00:29Z")
install logstash --- ## [Lack of Beats resources](https://discuss.elastic.co/t/lack-of-beats-resources/89267)
**Author:** [@StivOstenberg](https://discuss.elastic.co/u/StivOstenberg)\ **Replies:** 7\ **Last updated:** [June 16, 2017, 6:04pm UTC](https://discuss.elastic.co/t/lack-of-beats-resources/89267 "2017-06-16T18:04:06Z")
Hi All; I am new to ELK, and have been tasked with implementing the Beats side of the deployment. Sadly, I find that I cannot find any reference materials online that address working with Beats. Yes, I have seen the d… --- ## [Kibana as a tool for performance tests analysis](https://discuss.elastic.co/t/kibana-as-a-tool-for-performance-tests-analysis/18013)
**Author:** [@Piotr\_Bzdyl](https://discuss.elastic.co/u/Piotr_Bzdyl)\ **Replies:** 1\ **Last updated:** [June 10, 2014, 10:56am UTC](https://discuss.elastic.co/t/kibana-as-a-tool-for-performance-tests-analysis/18013 "2014-06-10T10:56:36Z")
Hello, This is my first post to this groups, so welcome everybody. I am evaluating Logstash+Elasticsearch+Kibana combo as a tool set for collecting data from performance tests which I could later analyse visually… --- ## [Is not support reindex from es6 to es7](https://discuss.elastic.co/t/is-not-support-reindex-from-es6-to-es7/236295)
**Author:** [@innze](https://discuss.elastic.co/u/innze)\ **Replies:** 3\ **Last updated:** [June 9, 2020, 11:23pm UTC](https://discuss.elastic.co/t/is-not-support-reindex-from-es6-to-es7/236295 "2020-06-09T23:23:56Z")
The following error is occurring when reindexing from remote es to es. Request POST \_reindex { "source": { "remote": { "host": "http://remote\_es\_url:9200" }, "index": "source… --- ## [Unable to use the app generated timestamp in logstash](https://discuss.elastic.co/t/unable-to-use-the-app-generated-timestamp-in-logstash/197531)
**Author:** [@chimbu3306](https://discuss.elastic.co/u/chimbu3306)\ **Replies:** 3\ **Last updated:** [August 30, 2019, 3:11pm UTC](https://discuss.elastic.co/t/unable-to-use-the-app-generated-timestamp-in-logstash/197531 "2019-08-30T15:11:55Z")
I have the below log file created by the application and the timestamp value is recorded in "@timestamp" but logstash is unable to use that timestamp and failing to push this value to elasticsearch { "@timestamp": "2019… --- ## [Matchquery is unable to sort based on query](https://discuss.elastic.co/t/matchquery-is-unable-to-sort-based-on-query/134034)
**Author:** [@kish](https://discuss.elastic.co/u/kish)\ **Replies:** 3\ **Last updated:** [June 1, 2018, 7:32am UTC](https://discuss.elastic.co/t/matchquery-is-unable-to-sort-based-on-query/134034 "2018-06-01T07:32:03Z")
Hello - I am trying to execute a query which has match query (nodeid)+ sort(with date) + size(1). I am trying to get the out N curries the latest requried nodeid details. And this cscfcounter index will be getting upda… --- ## [Kibana Install fails - No Presto metadata available for elasticsearch-6.x](https://discuss.elastic.co/t/kibana-install-fails-no-presto-metadata-available-for-elasticsearch-6-x/118697)
**Author:** [@jamest23](https://discuss.elastic.co/u/jamest23)\ **Replies:** 3\ **Last updated:** [February 6, 2018, 7:47pm UTC](https://discuss.elastic.co/t/kibana-install-fails-no-presto-metadata-available-for-elasticsearch-6-x/118697 "2018-02-06T19:47:49Z")
I am trying to install kibana but it keeps failing. I had no problem with logstash and elasticsearch. They upgraded from 6.1 to 6.2 no problem, but kibana keeps bombing out of the yum install. I use the kibana.repo ( s… --- ## [High level rest client for java](https://discuss.elastic.co/t/high-level-rest-client-for-java/81836)
**Author:** [@Francesco\_Zuliani](https://discuss.elastic.co/u/Francesco_Zuliani)\ **Replies:** 3\ **Last updated:** [April 14, 2017, 8:55am UTC](https://discuss.elastic.co/t/high-level-rest-client-for-java/81836 "2017-04-14T08:55:46Z")
Hello, I have read here that an official High Level Java Rest client for elasticsearch is scheduled. I have found an unofficial rest client, but I would like to know when the official one will be available for produc… --- ## [Logstash Filter Issue with Apache2](https://discuss.elastic.co/t/logstash-filter-issue-with-apache2/52280)
**Author:** [@harshanarayana](https://discuss.elastic.co/u/harshanarayana)\ **Replies:** 3\ **Last updated:** [June 9, 2016, 8:52am UTC](https://discuss.elastic.co/t/logstash-filter-issue-with-apache2/52280 "2016-06-09T08:52:20Z")
Hi All, I've recently started using the Log handler Trio of Logstash + ELK + Kibana to work analyze through my apache logs during my daily work activities. However, I'm facing some issues with Grok when it comes to fi… --- ## [Tuning for high volume logging?](https://discuss.elastic.co/t/tuning-for-high-volume-logging/8881)
**Author:** [@Seth\_Hall](https://discuss.elastic.co/u/Seth_Hall)\ **Replies:** 3\ **Last updated:** [September 10, 2012, 3:37am UTC](https://discuss.elastic.co/t/tuning-for-high-volume-logging/8881 "2012-09-10T03:37:10Z")
Hi all, We have been integrating an ElasticSearch log writer into Bro network monitor (http://www.bro-ids.org) and we have a few users that are monitoring extremely high volume networks and want to insert their lo… --- ## [Elasticsearch and inodes](https://discuss.elastic.co/t/elasticsearch-and-inodes/200160)
**Author:** [@granier](https://discuss.elastic.co/u/granier)\ **Replies:** 2\ **Last updated:** [September 19, 2019, 12:55pm UTC](https://discuss.elastic.co/t/elasticsearch-and-inodes/200160 "2019-09-19T12:55:40Z")
Hi, In configuration system https://www.elastic.co/guide/en/elasticsearch/reference/master/file-descriptors.html there is a point about the number of files that can be opened by Elasticsearch. But there is no item abou… --- ## [Implement full-text fuzzy prefix search in Elastic search](https://discuss.elastic.co/t/implement-full-text-fuzzy-prefix-search-in-elastic-search/158990)
**Author:** [@ndakotabai](https://discuss.elastic.co/u/ndakotabai)\ **Replies:** 2\ **Last updated:** [December 4, 2018, 9:38pm UTC](https://discuss.elastic.co/t/implement-full-text-fuzzy-prefix-search-in-elastic-search/158990 "2018-12-04T21:38:22Z")
I understand that Elasticsearch tries to avoid using Fuzzy search with prefix matching, and this is also why it doesn't natively support such feature due to its complexity. However, we have a directory search system that… --- ## [Indexes being created as %{\[@metadata\]\[beat\]}-2017.05.26 instead of "filebeat-2017.05.26"](https://discuss.elastic.co/t/indexes-being-created-as-metadata-beat-2017-05-26-instead-of-filebeat-2017-05-26/87290)
**Author:** [@Landon\_Edwards](https://discuss.elastic.co/u/Landon_Edwards)\ **Replies:** 2\ **Last updated:** [May 26, 2017, 8:28pm UTC](https://discuss.elastic.co/t/indexes-being-created-as-metadata-beat-2017-05-26-instead-of-filebeat-2017-05-26/87290 "2017-05-26T20:28:46Z")
I am having a similar issue to this thread, but the solution does not appear to be the same for me, and I have not been able to figure out how to fix it. I am actually thinking the issue may be with filebeat, and not log… --- ## [Multiple patterns for Multiline Configuration?](https://discuss.elastic.co/t/multiple-patterns-for-multiline-configuration/32258)
**Author:** [@TimTim](https://discuss.elastic.co/u/TimTim)\ **Replies:** 2\ **Last updated:** [October 16, 2015, 7:06am UTC](https://discuss.elastic.co/t/multiple-patterns-for-multiline-configuration/32258 "2015-10-16T07:06:49Z")
I am wondering if it is possible to have mulitple patterns in the multiline configuration or Logstash (running 1.4.5 at the moment)? The reason is that we have several log files coming in that we want to go to the same… --- ## [Logstash template creation problem: parsing](https://discuss.elastic.co/t/logstash-template-creation-problem-parsing/14176)
**Author:** [@tom\_rkba](https://discuss.elastic.co/u/tom_rkba)\ **Replies:** 2\ **Last updated:** [October 31, 2013, 1:56pm UTC](https://discuss.elastic.co/t/logstash-template-creation-problem-parsing/14176 "2013-10-31T13:56:37Z")
curl -XPUT http://localhost:9200/\_template/logstash\_per\_index -d '{ "template": "logstash\*", "settings": { "index.query.default\_field": "@message", "index.cache.field.type": "soft", "index.store.compress.stored": t… --- ## [ANN Search: Performance / Setup](https://discuss.elastic.co/t/ann-search-performance-setup/307129)
**Author:** [@SbstnErhrdt](https://discuss.elastic.co/u/SbstnErhrdt)\ **Replies:** 5\ **Last updated:** [June 28, 2022, 10:31am UTC](https://discuss.elastic.co/t/ann-search-performance-setup/307129 "2022-06-28T10:31:44Z")
I recently wrote this post to report some issues with the ANN Search / Set-Up. ANN Search Timeouts - #8 by Julie\_Tibshirani The main take-away for me was to use the: "index.refresh\_interval": "-1" setting and run a fir… --- ## [Windows metricbeat service stops at random](https://discuss.elastic.co/t/windows-metricbeat-service-stops-at-random/208452)
**Author:** [@pdeelman](https://discuss.elastic.co/u/pdeelman)\ **Replies:** 5\ **Last updated:** [November 25, 2019, 10:41am UTC](https://discuss.elastic.co/t/windows-metricbeat-service-stops-at-random/208452 "2019-11-25T10:41:26Z")
Hi, I'm currently deploying my beats for my new cluster and I have the following setup: Metricbeat \> logstash (port 5044) \> elastic. I'm using logstash because I want to introduce a Kafka pipeline, but that isn't impor… --- ## [Unable to drop events](https://discuss.elastic.co/t/unable-to-drop-events/133993)
**Author:** [@limp15000](https://discuss.elastic.co/u/limp15000)\ **Replies:** 5\ **Last updated:** [May 31, 2018, 1:02pm UTC](https://discuss.elastic.co/t/unable-to-drop-events/133993 "2018-05-31T13:02:06Z")
Hi, I am very to ELK. I've setup a GPO which forwards sysmon and sercurity logs to a server. Then I have winlogbeat which sends the log to logstash. Everything works like a charm except now I am trying to filter the eve… --- ## [Any way to restore the sample dashboards?](https://discuss.elastic.co/t/any-way-to-restore-the-sample-dashboards/109850)
**Author:** [@learner](https://discuss.elastic.co/u/learner)\ **Replies:** 5\ **Last updated:** [December 1, 2017, 12:19am UTC](https://discuss.elastic.co/t/any-way-to-restore-the-sample-dashboards/109850 "2017-12-01T00:19:20Z")
I had manually deleted each of them to not mix with my custom dashboards. Now I want to refer to some of their settings and want to restore them. Is it possible? I tried re-installing ES, Kibana, Packetbeat, etc. but … --- ## [Elastisticsearch\_dsl python to create pivot tables](https://discuss.elastic.co/t/elastisticsearch-dsl-python-to-create-pivot-tables/22991)
**Author:** [@Mike\_5](https://discuss.elastic.co/u/Mike_5)\ **Replies:** 5\ **Last updated:** [March 31, 2015, 7:18pm UTC](https://discuss.elastic.co/t/elastisticsearch-dsl-python-to-create-pivot-tables/22991 "2015-03-31T19:18:34Z")
the python elasticsearch , elasticsearch dsl packages are life-saver and got me converted to ES. Now I am trying to use elasticsearch dsl package to create pivot tables in ES but am having hard time figuring out… --- ## [Specs for non-data, master-eligible nodes?](https://discuss.elastic.co/t/specs-for-non-data-master-eligible-nodes/15095)
**Author:** [@revdev\_2](https://discuss.elastic.co/u/revdev_2)\ **Replies:** 5\ **Last updated:** [January 3, 2014, 9:52pm UTC](https://discuss.elastic.co/t/specs-for-non-data-master-eligible-nodes/15095 "2014-01-03T21:52:48Z")
we have fairly large ES cluster and are noticing that as the cluster has gotten larger, split brain issues have become more frequent. as per a suggestion by kimchy, we'd like to try adding 3 non-data, master-eligible… --- ## [Importing .evtx files to ELK using WinLogBeat](https://discuss.elastic.co/t/importing-evtx-files-to-elk-using-winlogbeat/287141)
**Author:** [@ThePurple5merf](https://discuss.elastic.co/u/ThePurple5merf)\ **Replies:** 1\ **Last updated:** [October 20, 2021, 12:15am UTC](https://discuss.elastic.co/t/importing-evtx-files-to-elk-using-winlogbeat/287141 "2021-10-20T00:15:02Z")
I'm trying to upload a set of .evtx files to my ELK Stack environment using WinLogBeat. I haven't been able to find any online resources that really help me out in doing this. I was hoping someone here could help point m… --- ## [Filter documents using AND OR on array field](https://discuss.elastic.co/t/filter-documents-using-and-or-on-array-field/166330)
**Author:** [@Wassim\_Ben\_Amor](https://discuss.elastic.co/u/Wassim_Ben_Amor)\ **Replies:** 1\ **Last updated:** [January 30, 2019, 3:14pm UTC](https://discuss.elastic.co/t/filter-documents-using-and-or-on-array-field/166330 "2019-01-30T15:14:20Z")
Hello, I have documents having a field called "filters" which is an array containing strings. Example : \['A','B','C'\] I want to make queries to filter documents, example of a query : ((('A' and 'C') or 'B') and ('A' o… --- ## [FileBeat multiline parser fails with '^#\[0-9\]'](https://discuss.elastic.co/t/filebeat-multiline-parser-fails-with-0-9/97012)
**Author:** [@ianseyer](https://discuss.elastic.co/u/ianseyer)\ **Replies:** 1\ **Last updated:** [August 14, 2017, 6:35pm UTC](https://discuss.elastic.co/t/filebeat-multiline-parser-fails-with-0-9/97012 "2017-08-14T18:35:22Z")
Hi. I am attempting to use the multiline parser for Filebeat to chunk my Laravel log into useful segments. Laravel logs spew a multi-line stacktrace by prepending each line with #1, #2, …, #n. Therefore, I am attempting… --- ## [X-pack plugin installation was unsuccessful due to error client request error self signed certificate in certificate chain](https://discuss.elastic.co/t/x-pack-plugin-installation-was-unsuccessful-due-to-error-client-request-error-self-signed-certificate-in-certificate-chain/82040)
**Author:** [@SuperheroSmith](https://discuss.elastic.co/u/SuperheroSmith)\ **Replies:** 1\ **Last updated:** [April 11, 2017, 9:03pm UTC](https://discuss.elastic.co/t/x-pack-plugin-installation-was-unsuccessful-due-to-error-client-request-error-self-signed-certificate-in-certificate-chain/82040 "2017-04-11T21:03:52Z")
I have Elasticsearch and Kibana v5.3 installed. I had them both working, with Winlogbeat sending logs successfully through the chain to Kibana. Where the solution was working, we wanted to add X-Pack to secure it. Th… --- ## [Elasticsearch output plugin: "workers" setting](https://discuss.elastic.co/t/elasticsearch-output-plugin-workers-setting/43644)
**Author:** [@mguiwin](https://discuss.elastic.co/u/mguiwin)\ **Replies:** 1\ **Last updated:** [May 26, 2016, 8:49am UTC](https://discuss.elastic.co/t/elasticsearch-output-plugin-workers-setting/43644 "2016-05-26T08:49:41Z")
Hello, If I understand well what is described in the Logstash Processing Pipeline article , it might be that the number of ES output plugin workers (as defined by the 'workers' setting of the ES output plugin) equals … --- ## [Gelf to multiline filter messes up newlines](https://discuss.elastic.co/t/gelf-to-multiline-filter-messes-up-newlines/39393)
**Author:** [@tino](https://discuss.elastic.co/u/tino)\ **Replies:** 1\ **Last updated:** [May 24, 2016, 8:09pm UTC](https://discuss.elastic.co/t/gelf-to-multiline-filter-messes-up-newlines/39393 "2016-05-24T20:09:39Z")
I'm trying to get the output of python stacktraces to show up nicely in Kibana. I am using the docker gelf log driver, and I am able to get the messages through logstash into ES. With the following config, tracebacks are… --- ## [Problems getting filebeats to work with API keys](https://discuss.elastic.co/t/problems-getting-filebeats-to-work-with-api-keys/314982)
**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Replies:** 0\ **Last updated:** [September 23, 2022, 12:43am UTC](https://discuss.elastic.co/t/problems-getting-filebeats-to-work-with-api-keys/314982 "2022-09-23T00:43:02Z")
I have just got filebeats (7.17.1) working on a bunch of ubuntu systems. I initially tried to use API keys for authentication but got errors from filebeat "API key: invalid ApiKey value" when it connects to the ES serv… --- ## [Unable to restrict duplicate documents using http\_poller](https://discuss.elastic.co/t/unable-to-restrict-duplicate-documents-using-http-poller/260511)
**Author:** [@Gauti](https://discuss.elastic.co/u/Gauti)\ **Replies:** 0\ **Last updated:** [January 8, 2021, 8:06am UTC](https://discuss.elastic.co/t/unable-to-restrict-duplicate-documents-using-http-poller/260511 "2021-01-08T08:06:55Z")
Hi All, I have been trying to ingest some, time series data into elasticsearch using logstash http poller plugin. my data is from a monitoring tool which capture the parameters like hostname, memory usage, cpu load, s… --- ## [Failed to start shard](https://discuss.elastic.co/t/failed-to-start-shard/22577)
**Author:** [@Sephen\_Xu](https://discuss.elastic.co/u/Sephen_Xu)\ **Replies:** 0\ **Last updated:** [March 9, 2015, 6:15am UTC](https://discuss.elastic.co/t/failed-to-start-shard/22577 "2015-03-09T06:15:44Z")
\[2015-03-09 13:46:33,720\]\[WARN \]\[indices.cluster \] \[es\_node\_4\_2\] \[ossdatabse-2015-02-10\]\[6\] failed to start shard org.elasticsearch.index.gateway.IndexShardGatewayRecoveryException: \[ossdatabse-2015-02-10\]\[… --- ## [Logstash Installation on AWS Ubuntu Instance](https://discuss.elastic.co/t/logstash-installation-on-aws-ubuntu-instance/213761)
**Author:** [@droidus](https://discuss.elastic.co/u/droidus)\ **Replies:** 4\ **Last updated:** [January 19, 2020, 12:29am UTC](https://discuss.elastic.co/t/logstash-installation-on-aws-ubuntu-instance/213761 "2020-01-19T00:29:50Z")
I am trying to get ElasticSearch setup on my Ubuntu server 18 on AWS. logstash seems to be installed: "logstash/stable,now 1:7.5.1-1 all \[installed\]" But when I check the config of logstash, it seems like logstash is n… --- ## [Kibana 5 broken after adding data to elasticsearch with winlogbeat - only timelion pane loads correctly](https://discuss.elastic.co/t/kibana-5-broken-after-adding-data-to-elasticsearch-with-winlogbeat-only-timelion-pane-loads-correctly/64276)
**Author:** [@ssi](https://discuss.elastic.co/u/ssi)\ **Replies:** 4\ **Last updated:** [October 29, 2016, 12:51pm UTC](https://discuss.elastic.co/t/kibana-5-broken-after-adding-data-to-elasticsearch-with-winlogbeat-only-timelion-pane-loads-correctly/64276 "2016-10-29T12:51:59Z")
windows platform with all latest versions initially I the kibana webpage it worked fine, after successfully loading index. I could verify that data was in ES as i could use the developer pane to check. - looked ok in t… [Previous page](https://discuss.elastic.co/top.md?page=1139&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=1141&per_page=50&period=all)