# Top **URL:** https://discuss.elastic.co/top.md?page=116&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 117 --- ## [Kibana debian package not starting (chroot error)](https://discuss.elastic.co/t/kibana-debian-package-not-starting-chroot-error/266437)
**Author:** [@ea1987](https://discuss.elastic.co/u/ea1987)\ **Replies:** 13\ **Last updated:** [June 2, 2021, 5:19pm UTC](https://discuss.elastic.co/t/kibana-debian-package-not-starting-chroot-error/266437 "2021-06-02T17:19:48Z")
Kibana version: 7.11 (current) Installation on: ubuntu (WSL2) Error on: start Kibana.log: chroot: cannot change root directory to '': No such file or directory NB: Elasticsearch is running fine. Can you please help … --- ## [4624 log stoms](https://discuss.elastic.co/t/4624-log-stoms/195684)
**Author:** [@james\_007](https://discuss.elastic.co/u/james_007)\ **Replies:** 10\ **Last updated:** [September 13, 2019, 8:00am UTC](https://discuss.elastic.co/t/4624-log-stoms/195684 "2019-09-13T08:00:16Z")
Hi All - was wondering if anyone can help on the following: event ID 4624 : this event logs everything that speaks to the domain, I just want to log user who below to the DD1 domain and forget and drop the rest of the e… --- ## [Performance Issue on Inserting Data](https://discuss.elastic.co/t/performance-issue-on-inserting-data/69163)
**Author:** [@parthiban\_p](https://discuss.elastic.co/u/parthiban_p)\ **Replies:** 9\ **Last updated:** [December 16, 2016, 7:04am UTC](https://discuss.elastic.co/t/performance-issue-on-inserting-data/69163 "2016-12-16T07:04:07Z")
We are using Elastic Search Nest client for our application , we did load testing testing on inserting documents into Elastic Search DB and we found that there is a performance issue. Index Size 2Kb , Shard Count 5, re… --- ## [Csv filter plugin not working](https://discuss.elastic.co/t/csv-filter-plugin-not-working/268777)
**Author:** [@its-ogawa](https://discuss.elastic.co/u/its-ogawa)\ **Replies:** 28\ **Last updated:** [April 13, 2021, 1:07am UTC](https://discuss.elastic.co/t/csv-filter-plugin-not-working/268777 "2021-04-13T01:07:06Z")
I would like to use logstash to format my logs. Specifically, I have a log with the following format format: timestamp \[thread-name\] log-level class-name - log-message example: 2021-03-30 09:38:20.201 \[ConnectionChe… --- ## [GSOC| Elasticsearch: mongoDB-ElasticSearch request translator. project discussion](https://discuss.elastic.co/t/gsoc-elasticsearch-mongodb-elasticsearch-request-translator-project-discussion/125488)
**Author:** [@elska](https://discuss.elastic.co/u/elska)\ **Replies:** 11\ **Last updated:** [March 26, 2021, 7:52am UTC](https://discuss.elastic.co/t/gsoc-elasticsearch-mongodb-elasticsearch-request-translator-project-discussion/125488 "2021-03-26T07:52:56Z")
Hi, ElasticSearch team! I'm Denis Gorev, a 1st year CS phD student at MIPT, Moscow, Russian Federation. I would like to participate in GSOC with my own project, and would like to clarify if my idea is interesting for el… --- ## [Solo me aparecen algunas metricas](https://discuss.elastic.co/t/solo-me-aparecen-algunas-metricas/133482)
**Author:** [@Unamunoqueva](https://discuss.elastic.co/u/Unamunoqueva)\ **Replies:** 14\ **Last updated:** [June 8, 2018, 4:31pm UTC](https://discuss.elastic.co/t/solo-me-aparecen-algunas-metricas/133482 "2018-06-08T16:31:03Z")
Buenas, estoy probando metricbeat, tengo los modulos de system y docker añadidos, pero a la hora de consultarlos en kibana, en los de system por ejemplo solo me muestra una parte de la informacion, adjunto foto: \[image\] … --- ## [How to grok field appearing multiple times in a log line](https://discuss.elastic.co/t/how-to-grok-field-appearing-multiple-times-in-a-log-line/146287)
**Author:** [@Prakash\_Sharma](https://discuss.elastic.co/u/Prakash_Sharma)\ **Replies:** 15\ **Last updated:** [September 5, 2018, 8:54am UTC](https://discuss.elastic.co/t/how-to-grok-field-appearing-multiple-times-in-a-log-line/146287 "2018-09-05T08:54:15Z")
Hi , I have a syslog coming from cisco ISE which has multiple entry of "Step" in one line . Like ++++++++++++++++++++++ Step=11001, Step=11017, Step=15049, Step=15008, Step=15048, Step=15048, Step=15048, Step=15048,… --- ## [Remembering Field Values](https://discuss.elastic.co/t/remembering-field-values/73870)
**Author:** [@Kryten](https://discuss.elastic.co/u/Kryten)\ **Replies:** 12\ **Last updated:** [February 5, 2017, 6:18pm UTC](https://discuss.elastic.co/t/remembering-field-values/73870 "2017-02-05T18:18:24Z")
Hi, Does anyone have any solutions for how to store and re-use field values between events? For example if we have a log file that contains something like:- Counter 1 stuff.... stuff.... Counter 2 stuff... stuff... … --- ## [What are the use cases for the file plugin v.s. logstash?](https://discuss.elastic.co/t/what-are-the-use-cases-for-the-file-plugin-v-s-logstash/52250)
**Author:** [@matanster](https://discuss.elastic.co/u/matanster)\ **Replies:** 12\ **Last updated:** [June 10, 2016, 7:14pm UTC](https://discuss.elastic.co/t/what-are-the-use-cases-for-the-file-plugin-v-s-logstash/52250 "2016-06-10T19:14:45Z")
Hi, I have looked at the file plugin. and am not quite sure what use cases is it meant for. Other than when sharing some sort of shared network storage, it seems as if this plugin can only ingest files from the local h… --- ## [Logstash not reading remote log files](https://discuss.elastic.co/t/logstash-not-reading-remote-log-files/54919)
**Author:** [@Suren92](https://discuss.elastic.co/u/Suren92)\ **Replies:** 12\ **Last updated:** [March 24, 2017, 6:00am UTC](https://discuss.elastic.co/t/logstash-not-reading-remote-log-files/54919 "2017-03-24T06:00:36Z")
Hi, I have some log files in a remote system, I need to send those to elasticsearch. But logstash is not reading the remote log files. I have specified the following configuration for logstash. input { file{ path =\> … --- ## [DocId bit flip after routing \[Document retrievable by \_search, but doesn't return in get api\]](https://discuss.elastic.co/t/docid-bit-flip-after-routing-document-retrievable-by-search-but-doesnt-return-in-get-api/192424)
**Author:** [@muralikpbhat](https://discuss.elastic.co/u/muralikpbhat)\ **Replies:** 33\ **Last updated:** [July 31, 2019, 8:03am UTC](https://discuss.elastic.co/t/docid-bit-flip-after-routing-document-retrievable-by-search-but-doesnt-return-in-get-api/192424 "2019-07-31T08:03:30Z")
Hi, I have a document indexed a month back in Elasticsearch version 6.3.1. If I try searching by id or any other term in that doc, it returns that doc. However get api responds with found:false indicating that the doc i… --- ## [Watcher nested aggregations with "direction"](https://discuss.elastic.co/t/watcher-nested-aggregations-with-direction/140215)
**Author:** [@vgersh99](https://discuss.elastic.co/u/vgersh99)\ **Replies:** 17\ **Last updated:** [August 6, 2018, 4:10pm UTC](https://discuss.elastic.co/t/watcher-nested-aggregations-with-direction/140215 "2018-08-06T16:10:23Z")
Hi, need a bit of help here with the watcher aggregation. So far I've dealt with somewhat simplified aggs of the form: time-\>host-\>latency. Now I need to work on a bit of a different struct: time-\>host-\>direction(in/ou… --- ## [Elastic agent offline after upgrade from Fleet](https://discuss.elastic.co/t/elastic-agent-offline-after-upgrade-from-fleet/344973)
**Author:** [@DaddyYusk](https://discuss.elastic.co/u/DaddyYusk)\ **Replies:** 15\ **Last updated:** [October 19, 2023, 6:22pm UTC](https://discuss.elastic.co/t/elastic-agent-offline-after-upgrade-from-fleet/344973 "2023-10-19T18:22:20Z")
Hi, Because of the last vulnerabilities from this week affecting Elastic Suite, I've made an upgrade from 8.8.0 to 8.10.3 of all my Elastic Agent from Fleet. Now all the agents are Offline (and displaying the version a… --- ## [Documents being deleted after BulkRequest indexing](https://discuss.elastic.co/t/documents-being-deleted-after-bulkrequest-indexing/333674)
**Author:** [@vivss](https://discuss.elastic.co/u/vivss)\ **Replies:** 12\ **Last updated:** [May 25, 2023, 3:06pm UTC](https://discuss.elastic.co/t/documents-being-deleted-after-bulkrequest-indexing/333674 "2023-05-25T15:06:35Z")
Hi all, We are using Elasticsearch 7.17.7 and indexing documents via BulkRequest in Java API Client, and we noticed that many documents are being deleted after indexing. We retrieve the records from a Postgresql databas… --- ## [Sum values before applying calculation](https://discuss.elastic.co/t/sum-values-before-applying-calculation/103829)
**Author:** [@mathias](https://discuss.elastic.co/u/mathias)\ **Replies:** 12\ **Last updated:** [November 6, 2017, 2:32pm UTC](https://discuss.elastic.co/t/sum-values-before-applying-calculation/103829 "2017-11-06T14:32:33Z")
Hi, I try to display a throughput graph over a time period of 7 days. To do this I need to set Interval in DateHistorogram to 600s. (Otherwise there are to many events. Kibana will complain) This will make the result… --- ## [Parsing log with logstash](https://discuss.elastic.co/t/parsing-log-with-logstash/212280)
**Author:** [@volcano](https://discuss.elastic.co/u/volcano)\ **Replies:** 34\ **Last updated:** [December 27, 2019, 11:59am UTC](https://discuss.elastic.co/t/parsing-log-with-logstash/212280 "2019-12-27T11:59:25Z")
How would you parse this key value data ? ( // this log data is in a single line) myapp.myproject.notice.student.request-time = 2019-12-13 12:37:01.4 # myapp.myproject.notice.student.response-time = 2019-12-13 12:37:19… --- ## [Avoid duplicates via node ingest pipelines](https://discuss.elastic.co/t/avoid-duplicates-via-node-ingest-pipelines/288408)
**Author:** [@omartinez](https://discuss.elastic.co/u/omartinez)\ **Replies:** 9\ **Last updated:** [November 5, 2021, 2:30pm UTC](https://discuss.elastic.co/t/avoid-duplicates-via-node-ingest-pipelines/288408 "2021-11-05T14:30:06Z")
Hi all, I need a solution on the elastic side to handle duplicate logs. I need to develop an elastic ingest node pipeline that can manage duplicates by replacing \_id with uuid, any other suggestions are welcome, but I d… --- ## [How to stop and remove filebeat from kubernetes? (eks)](https://discuss.elastic.co/t/how-to-stop-and-remove-filebeat-from-kubernetes-eks/259957)
**Author:** [@umen](https://discuss.elastic.co/u/umen)\ **Replies:** 13\ **Last updated:** [January 6, 2021, 3:03pm UTC](https://discuss.elastic.co/t/how-to-stop-and-remove-filebeat-from-kubernetes-eks/259957 "2021-01-06T15:03:16Z")
Hello i installed filebeat from this link : and its working. now i like to remove it from the eks cluster. how can i stop it and remove it ? no info in documents Thanks --- ## [Parsing Text Data from a txt file without Key Value Pair using Grok](https://discuss.elastic.co/t/parsing-text-data-from-a-txt-file-without-key-value-pair-using-grok/126005)
**Author:** [@vmashok85](https://discuss.elastic.co/u/vmashok85)\ **Replies:** 12\ **Last updated:** [April 13, 2018, 10:22am UTC](https://discuss.elastic.co/t/parsing-text-data-from-a-txt-file-without-key-value-pair-using-grok/126005 "2018-04-13T10:22:58Z")
Hi All, I need help to parse data separated by ' ; ' from a txt file without key value pair using grok. Kindly advice. --- ## [Logstash aggregate nested field](https://discuss.elastic.co/t/logstash-aggregate-nested-field/120802)
**Author:** [@sabdoul](https://discuss.elastic.co/u/sabdoul)\ **Replies:** 12\ **Last updated:** [February 26, 2018, 4:22pm UTC](https://discuss.elastic.co/t/logstash-aggregate-nested-field/120802 "2018-02-26T16:22:29Z")
Bonjour, Je veux regrouper les logiciels par un id (nom pc). Pour cela j'utilise le filtre aggregate. Mais le regroupement ne s'effectue pas. Peut être je rate quelque chose (ci-dessous mon code): input { elasticsear… --- ## [Filebeat (6.4.2) autodiscover on Kubernetes. Missing field accessing 'containers.ids.0'](https://discuss.elastic.co/t/filebeat-6-4-2-autodiscover-on-kubernetes-missing-field-accessing-containers-ids-0/154459)
**Author:** [@havlan](https://discuss.elastic.co/u/havlan)\ **Replies:** 11\ **Last updated:** [December 11, 2018, 10:44am UTC](https://discuss.elastic.co/t/filebeat-6-4-2-autodiscover-on-kubernetes-missing-field-accessing-containers-ids-0/154459 "2018-12-11T10:44:04Z")
I got this strange (I've not seen it before) error from Filebeat running as a daemonset on Kubernetes (minikube) today. It might be a misconfiguration, that's why I'm posting here first. Filebeat yaml: filebeat.yml: |-… --- ## [Indexing in Elasticsearch stops after particular number](https://discuss.elastic.co/t/indexing-in-elasticsearch-stops-after-particular-number/106059)
**Author:** [@malhotras](https://discuss.elastic.co/u/malhotras)\ **Replies:** 10\ **Last updated:** [November 8, 2017, 1:29pm UTC](https://discuss.elastic.co/t/indexing-in-elasticsearch-stops-after-particular-number/106059 "2017-11-08T13:29:12Z")
I am trying to index SQL data from the database using logstash. I am able to index the data properly. But, after certain number of documents (6191) , Elasticsearch does not have any documets indexed. Logstash keeps on r… --- ## [What If my ES Client Node goes down](https://discuss.elastic.co/t/what-if-my-es-client-node-goes-down/74058)
**Author:** [@Ritesh\_Sharma](https://discuss.elastic.co/u/Ritesh_Sharma)\ **Replies:** 10\ **Last updated:** [February 7, 2017, 5:58am UTC](https://discuss.elastic.co/t/what-if-my-es-client-node-goes-down/74058 "2017-02-07T05:58:32Z")
Hi Team , I am trying to setup Kibana over two node cluster of Elasticsearch as a part of ELK Stack and came across to the information that i simply can't do that (cause Kibana don't have such feature till yet ) ; Got… --- ## [Failed to verify server certificate - APM Go Agent with ECK](https://discuss.elastic.co/t/failed-to-verify-server-certificate-apm-go-agent-with-eck/280738)
**Author:** [@Hongbo-Miao](https://discuss.elastic.co/u/Hongbo-Miao)\ **Replies:** 12\ **Last updated:** [August 9, 2021, 1:05am UTC](https://discuss.elastic.co/t/failed-to-verify-server-certificate-apm-go-agent-with-eck/280738 "2021-08-09T01:05:52Z")
Kibana version: 7.14 Elasticsearch version: 7.14 APM Server version: 7.14 APM Agent language and version: Go (Gin) go.elastic.co/apm/module/apmgin v1.13.1 Browser version: None Original install method (e.g. do… --- ## [Logstash-filter-zeromq does not install (version conflict) on logstash 5.1](https://discuss.elastic.co/t/logstash-filter-zeromq-does-not-install-version-conflict-on-logstash-5-1/69146)
**Author:** [@burnard11](https://discuss.elastic.co/u/burnard11)\ **Replies:** 13\ **Last updated:** [January 4, 2017, 6:31am UTC](https://discuss.elastic.co/t/logstash-filter-zeromq-does-not-install-version-conflict-on-logstash-5-1/69146 "2017-01-04T06:31:09Z")
Hi all, I have trouble installing the logstah-filter-zeromq plugin on a clean logstash 5.1 install (tested with docker hub docker image logstash:5.1). Installation reports a version conflict. Full console output follow… --- ## [FILEBEAT module Fortinet : Provided Grok expressions do not match field value](https://discuss.elastic.co/t/filebeat-module-fortinet-provided-grok-expressions-do-not-match-field-value/269986)
**Author:** [@Alex\_Lum](https://discuss.elastic.co/u/Alex_Lum)\ **Replies:** 9\ **Last updated:** [April 15, 2021, 8:12am UTC](https://discuss.elastic.co/t/filebeat-module-fortinet-provided-grok-expressions-do-not-match-field-value/269986 "2021-04-15T08:12:37Z")
Hello, I send fortigate logs via rsylog on /var/log/fortigate\* files. I 've configured filebeat with fortinet module. On kibana, i get this : Provided Grok expressions do not match field value It was working with udp… --- ## [Logstash stops elasticsearch](https://discuss.elastic.co/t/logstash-stops-elasticsearch/323017)
**Author:** [@bas\_kos](https://discuss.elastic.co/u/bas_kos)\ **Replies:** 27\ **Last updated:** [January 19, 2023, 7:17am UTC](https://discuss.elastic.co/t/logstash-stops-elasticsearch/323017 "2023-01-19T07:17:45Z")
After starting logstash, elasticsearch stops. If logstash is not running, then elasticsearch and kibana work and I go to the kibana web interface. I tried to cleanly remove logstash and install with default settings, I… --- ## [Syslog filter issue with timestamp](https://discuss.elastic.co/t/syslog-filter-issue-with-timestamp/290468)
**Author:** [@mylvestre](https://discuss.elastic.co/u/mylvestre)\ **Replies:** 12\ **Last updated:** [December 6, 2021, 6:54pm UTC](https://discuss.elastic.co/t/syslog-filter-issue-with-timestamp/290468 "2021-12-06T18:54:22Z")
Greetings, I'm having an issue where my syslog is parsing the wrong date format. I get the following in Elastic: yyyy-11-Mo 11:37:17, while I get the following error in logstash: \[2021-11-29T11:34:43,644\]\[WARN \]\[logsta… --- ## [FreeBSD 10.1 install elasticsearch plugin fails](https://discuss.elastic.co/t/freebsd-10-1-install-elasticsearch-plugin-fails/23371)
**Author:** [@Pccom\_Frank](https://discuss.elastic.co/u/Pccom_Frank)\ **Replies:** 12\ **Last updated:** [April 24, 2015, 12:47pm UTC](https://discuss.elastic.co/t/freebsd-10-1-install-elasticsearch-plugin-fails/23371 "2015-04-24T12:47:34Z")
Hi, Please help to install plugins for elasticsearch on FreeBSD. I tried different ways, I always fail. The following is one of them: root@mail:/usr/local/lib/elasticsearch/plugins # elasticsearch-plugin --url h… --- ## [Kibana Dashboard default configuration change](https://discuss.elastic.co/t/kibana-dashboard-default-configuration-change/62472)
**Author:** [@srikar](https://discuss.elastic.co/u/srikar)\ **Replies:** 11\ **Last updated:** [October 20, 2016, 2:53pm UTC](https://discuss.elastic.co/t/kibana-dashboard-default-configuration-change/62472 "2016-10-20T14:53:51Z")
I want dashboard to directly load as below rathan than Can some one please tell me.. how do I do this ? --- ## [Want to configure email in kibana](https://discuss.elastic.co/t/want-to-configure-email-in-kibana/246675)
**Author:** [@AKumar123](https://discuss.elastic.co/u/AKumar123)\ **Replies:** 12\ **Last updated:** [August 31, 2020, 10:23am UTC](https://discuss.elastic.co/t/want-to-configure-email-in-kibana/246675 "2020-08-31T10:23:49Z")
want to configure email in kibana so i can take the screen shot of Particular panel and able to send it to someone from kibana page. --- ## [Problems with GrayLog2 + ES setup \[long\]](https://discuss.elastic.co/t/problems-with-graylog2-es-setup-long/7134)
**Author:** [@MichaelGlad](https://discuss.elastic.co/u/MichaelGlad)\ **Replies:** 14\ **Last updated:** [April 1, 2012, 9:12pm UTC](https://discuss.elastic.co/t/problems-with-graylog2-es-setup-long/7134 "2012-04-01T21:12:27Z")
I'm having troubles with a my GrayLog2 + ES 0.19.0 installation. It seems I've hit a wall. Java is CPU bound and there's next to no disk activity. As I believe that the cure could be tuning ES or adding hardware res… --- ## [GROK filter cannot be applied on aggregated events](https://discuss.elastic.co/t/grok-filter-cannot-be-applied-on-aggregated-events/56113)
**Author:** [@jpry](https://discuss.elastic.co/u/jpry)\ **Replies:** 11\ **Last updated:** [September 6, 2016, 9:02am UTC](https://discuss.elastic.co/t/grok-filter-cannot-be-applied-on-aggregated-events/56113 "2016-09-06T09:02:51Z")
Hi, All is in the title; here is my Aggregate plugin configuration: aggregate { task\_id =\> "%{id}" code =\> "map\['message'\] ||= '' ; map\['message'\] += event\['message'\] + '\\n'" a… --- ## [ES 6.x - Timeout by REST API operations](https://discuss.elastic.co/t/es-6-x-timeout-by-rest-api-operations/180773)
**Author:** [@EldrosKandar](https://discuss.elastic.co/u/EldrosKandar)\ **Replies:** 13\ **Last updated:** [June 27, 2019, 12:24pm UTC](https://discuss.elastic.co/t/es-6-x-timeout-by-rest-api-operations/180773 "2019-06-27T12:24:18Z")
This issue appears on ES 6.7 I've been trying to create an ILM policy to delete old indices. I used first the Kibana Console and got a 500 Internal Server Error back. So I tried the following curl call on the server: c… --- ## [Filter vector search results to get only relevant documents?](https://discuss.elastic.co/t/filter-vector-search-results-to-get-only-relevant-documents/339543)
**Author:** [@john\_nicolas](https://discuss.elastic.co/u/john_nicolas)\ **Replies:** 10\ **Last updated:** [August 2, 2023, 12:15pm UTC](https://discuss.elastic.co/t/filter-vector-search-results-to-get-only-relevant-documents/339543 "2023-08-02T12:15:55Z")
I am not an expert in elastic queries, I have not found a solution to filter my results. My index contains 450,000 documents. The issue is that when I perform a search, it always returns all 450,000 documents, sorted by … --- ## [Multiple logstash forwarder instances](https://discuss.elastic.co/t/multiple-logstash-forwarder-instances/29850)
**Author:** [@paulkeogh](https://discuss.elastic.co/u/paulkeogh)\ **Replies:** 11\ **Last updated:** [November 5, 2015, 7:42am UTC](https://discuss.elastic.co/t/multiple-logstash-forwarder-instances/29850 "2015-11-05T07:42:53Z")
Hi, I am running multiple LF instances on a single host - unfortunately I started them both from the same working directory so they are sharing a .logstash-forwarder file. I presume this is incorrect and I will recti… --- ## [SIEM Command Line Auditing 4688 - 4689](https://discuss.elastic.co/t/siem-command-line-auditing-4688-4689/202656)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 10\ **Last updated:** [October 14, 2019, 1:01pm UTC](https://discuss.elastic.co/t/siem-command-line-auditing-4688-4689/202656 "2019-10-14T13:01:09Z")
Hello, 2 of the most interesting event id's in siem are 4688 and 4689, which can be enabled with a gpo and enable us to monitor every command used in your network. Interesting fields are: winlog.event\_data.NewProcessN… --- ## [Logstash Timestamp date field filter not parsing properly](https://discuss.elastic.co/t/logstash-timestamp-date-field-filter-not-parsing-properly/91154)
**Author:** [@ViJaY\_S](https://discuss.elastic.co/u/ViJaY_S)\ **Replies:** 10\ **Last updated:** [June 28, 2017, 7:22pm UTC](https://discuss.elastic.co/t/logstash-timestamp-date-field-filter-not-parsing-properly/91154 "2017-06-28T19:22:04Z")
Hello, I'm unable to parse the Timestamp field from logstash configuration, I didn't see any errors while running configuration but the date field is not matching my index field same as in IIS logs. All my logs are ap… --- ## [Filebeats causing \\t not to be caught in multiline](https://discuss.elastic.co/t/filebeats-causing-t-not-to-be-caught-in-multiline/123692)
**Author:** [@ksnapes](https://discuss.elastic.co/u/ksnapes)\ **Replies:** 9\ **Last updated:** [May 1, 2018, 10:04am UTC](https://discuss.elastic.co/t/filebeats-causing-t-not-to-be-caught-in-multiline/123692 "2018-05-01T10:04:06Z")
Hi, I'm having an issue when sending logs from filebeats to logstash I am trying to capture java stack trace events in tomcat log files. I am using multiline to capture the events that span multiple lines and it is wor… --- ## [Y-Axis Kibana problem function SUM](https://discuss.elastic.co/t/y-axis-kibana-problem-function-sum/74193)
**Author:** [@Beuhlet\_Reseau](https://discuss.elastic.co/u/Beuhlet_Reseau)\ **Replies:** 11\ **Last updated:** [February 9, 2017, 2:29pm UTC](https://discuss.elastic.co/t/y-axis-kibana-problem-function-sum/74193 "2017-02-09T14:29:14Z")
Hello, I analyze a test log file, example of file : (syntax is : Date ; Name script ; Name application ; data volume) 20170127174559;AC\_hour-C-FWK-BMA-EDR-2-Zone-C;Eroe;10000 20170127164559;AC\_hour-C-FWK-BMA-EDR-2-Zon… --- ## [Sent logs to Logstash using Filebeat](https://discuss.elastic.co/t/sent-logs-to-logstash-using-filebeat/168420)
**Author:** [@erdo](https://discuss.elastic.co/u/erdo)\ **Replies:** 16\ **Last updated:** [February 15, 2019, 7:43pm UTC](https://discuss.elastic.co/t/sent-logs-to-logstash-using-filebeat/168420 "2019-02-15T19:43:45Z")
I am trying to send log files using Filebeat to logstash. Filebeat and logstash are on different servers so Filebeat ip is like this 100.100.100.100 and logstash is like 200.200.200.200 My filebeat conf: output.logstas… --- ## [Elastic search couldnt start after deleting the nodes-HELP! URGENT](https://discuss.elastic.co/t/elastic-search-couldnt-start-after-deleting-the-nodes-help-urgent/203741)
**Author:** [@anusree\_arun](https://discuss.elastic.co/u/anusree_arun)\ **Replies:** 25\ **Last updated:** [October 16, 2019, 4:37pm UTC](https://discuss.elastic.co/t/elastic-search-couldnt-start-after-deleting-the-nodes-help-urgent/203741 "2019-10-16T16:37:23Z")
systemctl status elasticsearch â elasticsearch.service - Elasticsearch Loaded: loaded (/usr/lib/systemd/system/elasticsearch.service; enabled; vendor preset: disabled) Active: failed (Result: exit-code) since Wed 2019… --- ## [Lab Enviro Not Working](https://discuss.elastic.co/t/lab-enviro-not-working/243621)
**Author:** [@alexiirf](https://discuss.elastic.co/u/alexiirf)\ **Replies:** 21\ **Last updated:** [October 13, 2020, 8:45am UTC](https://discuss.elastic.co/t/lab-enviro-not-working/243621 "2020-10-13T08:45:41Z")
I recently signed up for the free Kibana for Splunk SPL Users training and tried to setup my lab through Strigo. However, when I log in to strigo, it never brings up a command line. It just shows a blank screen (see sc… --- ## [Elastic Stack 5.4.0 is breaking for Spark 2.1.1](https://discuss.elastic.co/t/elastic-stack-5-4-0-is-breaking-for-spark-2-1-1/87627)
**Author:** [@Anupam\_Jaiswal1](https://discuss.elastic.co/u/Anupam_Jaiswal1)\ **Replies:** 11\ **Last updated:** [July 2, 2017, 5:20am UTC](https://discuss.elastic.co/t/elastic-stack-5-4-0-is-breaking-for-spark-2-1-1/87627 "2017-07-02T05:20:26Z")
Does the current library support spark 2.1.1 . The code is breaking for me . Printschema works fine , but show and collect breaks. --- ## [How can I sort strings with numbers alphabetically?](https://discuss.elastic.co/t/how-can-i-sort-strings-with-numbers-alphabetically/319088)
**Author:** [@Michal\_Stefaniuk](https://discuss.elastic.co/u/Michal_Stefaniuk)\ **Replies:** 9\ **Last updated:** [November 17, 2022, 5:11pm UTC](https://discuss.elastic.co/t/how-can-i-sort-strings-with-numbers-alphabetically/319088 "2022-11-17T17:11:04Z")
Hey guys, one quick question. I have a set of example records: Test 123 sesi 501 Alva rout and I want those to be sorted in asc/desc order in case insensitive and alphabeticall order, just like this: 501 Alva rout 12… --- ## [Kibana ECK OIDC with DEX](https://discuss.elastic.co/t/kibana-eck-oidc-with-dex/241689)
**Author:** [@suckowbiz](https://discuss.elastic.co/u/suckowbiz)\ **Replies:** 9\ **Last updated:** [July 23, 2020, 4:31am UTC](https://discuss.elastic.co/t/kibana-eck-oidc-with-dex/241689 "2020-07-23T04:31:53Z")
Hi, we configured Elastic Cloud on Kubernetes (version 1.1.2) on our own Bare Metal Kubernetes Stack. We set up Elasticsearch (version 7.8.0) with an OpenID Connect "oidc" realm with DEX as provider. We called the real… --- ## [Squid module does not parse logs](https://discuss.elastic.co/t/squid-module-does-not-parse-logs/313088)
**Author:** [@it\_dev](https://discuss.elastic.co/u/it_dev)\ **Replies:** 22\ **Last updated:** [August 31, 2022, 6:05am UTC](https://discuss.elastic.co/t/squid-module-does-not-parse-logs/313088 "2022-08-31T06:05:03Z")
I have Linux syslog server. My squid server (separate from Linux syslog) sends all its access.log files to Linux syslog server into /var/log/squid/\*.log There, on my Linux syslog server I have installed filebeat 8.4. I … --- ## [Elasticsearch index](https://discuss.elastic.co/t/elasticsearch-index/298257)
**Author:** [@umangpatel](https://discuss.elastic.co/u/umangpatel)\ **Replies:** 29\ **Last updated:** [March 8, 2022, 5:42am UTC](https://discuss.elastic.co/t/elasticsearch-index/298257 "2022-03-08T05:42:10Z")
I have to remove old data of apiman-indices in Elasticsearch which contain .pos, .cf or any other extension. So how can we remove the old indices? --- ## [“distinct” query in elasticsearch java api](https://discuss.elastic.co/t/distinct-query-in-elasticsearch-java-api/319349)
**Author:** [@hmkhitaryan](https://discuss.elastic.co/u/hmkhitaryan)\ **Replies:** 18\ **Last updated:** [November 29, 2022, 11:19pm UTC](https://discuss.elastic.co/t/distinct-query-in-elasticsearch-java-api/319349 "2022-11-29T23:19:05Z")
How to create “distinct” query in elasticsearch java api, like we do in sql. here is my query, which kibana generated, so I should do the same with java, and I'm trying many ways, but again getting with duplicates. "agg… --- ## [Cannot start filebeat with configuration file](https://discuss.elastic.co/t/cannot-start-filebeat-with-configuration-file/333338)
**Author:** [@Yasser\_Alsawy](https://discuss.elastic.co/u/Yasser_Alsawy)\ **Replies:** 19\ **Last updated:** [May 15, 2023, 2:23pm UTC](https://discuss.elastic.co/t/cannot-start-filebeat-with-configuration-file/333338 "2023-05-15T14:23:31Z")
I'm not able to start filebeat with below config file: filebeat.inputs: - type: filestream id: input1-id paths: - /home/yasser/data/sample1.log output.elasticsearch: hosts: \["https://localhost:9200"\] … [Previous page](https://discuss.elastic.co/top.md?page=115&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=117&per_page=50&period=all)