# Top

**URL:** https://discuss.elastic.co/top.md?page=1181&period=all

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1182

---

## [Null\_pointer\_exception when trying to access any object type of field using ctx.\_source](https://discuss.elastic.co/t/null-pointer-exception-when-trying-to-access-any-object-type-of-field-using-ctx-source/342166)

<div class="topic-metadata">

**Author:** [@ankitpandoh](https://discuss.elastic.co/u/ankitpandoh)\
**Replies:** 3\
**Last updated:** [September 3, 2023, 3:59am UTC](https://discuss.elastic.co/t/null-pointer-exception-when-trying-to-access-any-object-type-of-field-using-ctx-source/342166 "2023-09-03T03:59:34Z")

</div>

I have a index mapping like below PUT /customer-index { "mappings":{ "properties":{ "customers.id": { "type": "long" }, "customers.name": { "type": "text", "norms": fals…

---

## [How to configure different indexes in logstash](https://discuss.elastic.co/t/how-to-configure-different-indexes-in-logstash/248752)

<div class="topic-metadata">

**Author:** [@pheathers](https://discuss.elastic.co/u/pheathers)\
**Replies:** 3\
**Last updated:** [September 16, 2020, 5:16pm UTC](https://discuss.elastic.co/t/how-to-configure-different-indexes-in-logstash/248752 "2020-09-16T17:16:59Z")

</div>

Hi, I'm trying to ingest multiple (two right now) different formatted logs via Filebeat into Logstash and have them sent to different indexes based on some criteria. The first thought was to use the source (path) to id…

---

## [Filebeat 6.7.1 high CPU usage](https://discuss.elastic.co/t/filebeat-6-7-1-high-cpu-usage/175493)

<div class="topic-metadata">

**Author:** [@mlaterman](https://discuss.elastic.co/u/mlaterman)\
**Replies:** 3\
**Last updated:** [April 5, 2019, 3:58pm UTC](https://discuss.elastic.co/t/filebeat-6-7-1-high-cpu-usage/175493 "2019-04-05T15:58:45Z")

</div>

I'm observing high CPU utilization with filebeat in trivial cases when running on Amazon Linux Given a fresh install of filebeat with the config: filebeat.inputs: - paths: \[/var/log/testlog\] type: log logging.level: …

---

## [Error with watcher](https://discuss.elastic.co/t/error-with-watcher/115282)

<div class="topic-metadata">

**Author:** [@sbampa](https://discuss.elastic.co/u/sbampa)\
**Replies:** 3\
**Last updated:** [January 15, 2018, 7:48am UTC](https://discuss.elastic.co/t/error-with-watcher/115282 "2018-01-15T07:48:14Z")

</div>

Hi all, after i set a watcher, in kibana logs i receiving the following error: Error: json argument must contain an actionJson.email.body property and in the UI of kibana if i click on watcher, i have the red line: W…

---

## [Logstash -t option returning false config ok message](https://discuss.elastic.co/t/logstash-t-option-returning-false-config-ok-message/58733)

<div class="topic-metadata">

**Author:** [@GardenMWM](https://discuss.elastic.co/u/GardenMWM)\
**Replies:** 3\
**Last updated:** [August 24, 2016, 6:15am UTC](https://discuss.elastic.co/t/logstash-t-option-returning-false-config-ok-message/58733 "2016-08-24T06:15:15Z")

</div>

I've run into an unexpected behaviour of the -t test option and if statements. If I use the following invalid config, input { stdin {} } filter { if somefield == "somevalue" { drop {}} } output { stdout {} } and …

---

## [Kibana: is it possible to display pie charts on a tile maps?](https://discuss.elastic.co/t/kibana-is-it-possible-to-display-pie-charts-on-a-tile-maps/51930)

<div class="topic-metadata">

**Author:** [@sen](https://discuss.elastic.co/u/sen)\
**Replies:** 3\
**Last updated:** [June 9, 2016, 8:09am UTC](https://discuss.elastic.co/t/kibana-is-it-possible-to-display-pie-charts-on-a-tile-maps/51930 "2016-06-09T08:09:39Z")

</div>

Hello everyone, Do you know how to display pies on a tile maps ? Like shown in the example below. Thank you for your attention and your help. S

---

## [Review of Book \[Kibana Essentials\]](https://discuss.elastic.co/t/review-of-book-kibana-essentials/44248)

<div class="topic-metadata">

**Author:** [@gupta.yuvraj](https://discuss.elastic.co/u/gupta.yuvraj)\
**Replies:** 3\
**Last updated:** [March 13, 2016, 2:15pm UTC](https://discuss.elastic.co/t/review-of-book-kibana-essentials/44248 "2016-03-13T14:15:49Z")

</div>

I had authored the book on Kibana named Kibana Essentials which is aimed at beginners. I would love to get your reviews on the book.

---

## [Get rid of duplicated items](https://discuss.elastic.co/t/get-rid-of-duplicated-items/40630)

<div class="topic-metadata">

**Author:** [@nkoleff](https://discuss.elastic.co/u/nkoleff)\
**Replies:** 3\
**Last updated:** [February 3, 2016, 10:10pm UTC](https://discuss.elastic.co/t/get-rid-of-duplicated-items/40630 "2016-02-03T22:10:36Z")

</div>

Hello, I've got some duplicated items in logstash which I want to get rid of in the future with implementing the fingerprint filter. I've seen an example here - https://discuss.elastic.co/t/logstash-duplicate-messag…

---

## [【ダッシュボード】URLのリンクについて](https://discuss.elastic.co/t/url/247690)

<div class="topic-metadata">

**Author:** [@harue](https://discuss.elastic.co/u/harue)\
**Replies:** 2\
**Last updated:** [September 10, 2020, 8:20am UTC](https://discuss.elastic.co/t/url/247690 "2020-09-10T08:20:42Z")

</div>

お世話になります。 ダッシュボードの機能に関して、ご質問します。 ダッシュボードにて、Discoverで作成したindex項目一覧の掲載を検討しています。 index一覧に「WebサイトのURL」がある場合、URLを押下してWebサイトに遷移する方法はありますでしょうか？ （項目のtypeがStringだと実現出来ないと思いますが、何かしらのtypeを指定すれば実現出来ますでしょうか） 例)下記「WebURL」を押下するとgo…

---

## [Procedure to change role of a node](https://discuss.elastic.co/t/procedure-to-change-role-of-a-node/231345)

<div class="topic-metadata">

**Author:** [@DENMODSupport](https://discuss.elastic.co/u/DENMODSupport)\
**Replies:** 2\
**Last updated:** [May 6, 2020, 2:14pm UTC](https://discuss.elastic.co/t/procedure-to-change-role-of-a-node/231345 "2020-05-06T14:14:01Z")

</div>

I have 2 master and 1 data node in my cluster. I want to make all the three nodes as master\\data nodes. What is the procedure to change the role? What are all the things to keep in mind while changing the role?

---

## [Kibanaでindexpatternを自動で登録する方法](https://discuss.elastic.co/t/kibana-indexpattern/208252)

<div class="topic-metadata">

**Author:** [@keikei12](https://discuss.elastic.co/u/keikei12)\
**Replies:** 2\
**Last updated:** [November 18, 2019, 8:37am UTC](https://discuss.elastic.co/t/kibana-indexpattern/208252 "2019-11-18T08:37:22Z")

</div>

Kibana7.4.2を使用しています。 ElasticSearchのインデックスをKibanaで参照するために、 KibanaのManagementからIndexPatternを登録する必要があると思いますが、自動で登録するような方法はないのでしょうか？ ElasticSearchで日付ごとのインデックスを作成しており、毎日新しいindexができるため、自動化できないか考えております。

---

## [Kibana url with index attribute](https://discuss.elastic.co/t/kibana-url-with-index-attribute/190736)

<div class="topic-metadata">

**Author:** [@mrashid](https://discuss.elastic.co/u/mrashid)\
**Replies:** 2\
**Last updated:** [July 19, 2019, 4:12pm UTC](https://discuss.elastic.co/t/kibana-url-with-index-attribute/190736 "2019-07-19T16:12:53Z")

</div>

In my Kibana URL i can see an attribute by name index : XXXXXXXXXXXX . In the below url the attribute I am talking about is : index:b9047cd0-a3e8-11e9-9bde-f13129c64e7c http://XXXXXXXXXXXXXX:5601/app/kibana#/discover/6f…

---

## [Unable to reinstall Elasticsearch](https://discuss.elastic.co/t/unable-to-reinstall-elasticsearch/106358)

<div class="topic-metadata">

**Author:** [@rpazhyannur](https://discuss.elastic.co/u/rpazhyannur)\
**Replies:** 2\
**Last updated:** [November 4, 2017, 11:37pm UTC](https://discuss.elastic.co/t/unable-to-reinstall-elasticsearch/106358 "2017-11-04T23:37:47Z")

</div>

Hello for various reasons I have to reinstall Elasticsearch. I have deleted the directories but there is something that is preventing a reinstall. I am getting message 'Package elasticsearch-5.6.3-1.noarch already insta…

---

## [Does "retry\_on\_conflict" will handle updating the latest version number before retrying again?](https://discuss.elastic.co/t/does-retry-on-conflict-will-handle-updating-the-latest-version-number-before-retrying-again/281738)

<div class="topic-metadata">

**Author:** [@Vikram\_Golapelliwar](https://discuss.elastic.co/u/Vikram_Golapelliwar)\
**Replies:** 1\
**Last updated:** [August 20, 2021, 9:41am UTC](https://discuss.elastic.co/t/does-retry-on-conflict-will-handle-updating-the-latest-version-number-before-retrying-again/281738 "2021-08-20T09:41:22Z")

</div>

Team, I have been trying to understand how setting retry\_on\_conflict will behave. It is little confusing in the documentation. As per my understanding, below lines suggest that the latest version update will be handle…

---

## [Readiness probe failed: Get https://5601/login: net/http: request canceled while waiting for connection (Client.Timeout exceeded while awaiting headers)](https://discuss.elastic.co/t/readiness-probe-failed-get-https-5601-login-net-http-request-canceled-while-waiting-for-connection-client-timeout-exceeded-while-awaiting-headers/216771)

<div class="topic-metadata">

**Author:** [@kumar\_kung](https://discuss.elastic.co/u/kumar_kung)\
**Replies:** 1\
**Last updated:** [January 28, 2020, 1:30pm UTC](https://discuss.elastic.co/t/readiness-probe-failed-get-https-5601-login-net-http-request-canceled-while-waiting-for-connection-client-timeout-exceeded-while-awaiting-headers/216771 "2020-01-28T13:30:37Z")

</div>

ECK operator 1.0.0 GA Kibana readiness probe fails I am using the same config provided by eck docs \< apiVersion: kibana.k8s.elastic.co/v1 kind: Kibana metadata: name: quickstart spec: version: 7.5.2 count: 1 e…

---

## [Why snapshot API requires shared file system?](https://discuss.elastic.co/t/why-snapshot-api-requires-shared-file-system/192612)

<div class="topic-metadata">

**Author:** [@mmk1995](https://discuss.elastic.co/u/mmk1995)\
**Replies:** 7\
**Last updated:** [July 29, 2019, 9:16am UTC](https://discuss.elastic.co/t/why-snapshot-api-requires-shared-file-system/192612 "2019-07-29T09:16:51Z")

</div>

My case wanted to backup only one node of a cluster, I know it is good practice to backup the whole cluster, but my ELK infrastructure do not have a shared file system, if there is no other choice, of course I will creat…

---

## [Logstash US-ASCII](https://discuss.elastic.co/t/logstash-us-ascii/188317)

<div class="topic-metadata">

**Author:** [@selimseker](https://discuss.elastic.co/u/selimseker)\
**Replies:** 1\
**Last updated:** [July 4, 2019, 3:00pm UTC](https://discuss.elastic.co/t/logstash-us-ascii/188317 "2019-07-04T15:00:12Z")

</div>

Hi everyone I'm a newbie on ELK. I just download the logstash and when I run it it gives this error: \[main\] Logstash - java.lang.IllegalStateException: Logstash stopped processing because of an error: (ArgumentError) in…

---

## [Filebeat ssl client failed to connect sometimes](https://discuss.elastic.co/t/filebeat-ssl-client-failed-to-connect-sometimes/56212)

<div class="topic-metadata">

**Author:** [@dfaropennetwork](https://discuss.elastic.co/u/dfaropennetwork)\
**Replies:** 1\
**Last updated:** [July 25, 2016, 7:32am UTC](https://discuss.elastic.co/t/filebeat-ssl-client-failed-to-connect-sometimes/56212 "2016-07-25T07:32:05Z")

</div>

Hi all, I 've the filebeat 1.2.3 version and topbeat/packetbeat. I see on the syslog the folowing error: Jul 23 04:45:14 hostname /usr/bin/filebeat\[858\]: transport.go:125: SSL client failed to connect with: read tc…

---

## [Optimum index.translog.flush\_threshold\_ops setting](https://discuss.elastic.co/t/optimum-index-translog-flush-threshold-ops-setting/11805)

<div class="topic-metadata">

**Author:** [@subin](https://discuss.elastic.co/u/subin)\
**Replies:** 1\
**Last updated:** [May 4, 2013, 8:10am UTC](https://discuss.elastic.co/t/optimum-index-translog-flush-threshold-ops-setting/11805 "2013-05-04T08:10:23Z")

</div>

I'm not sure how to deduce the optimum "index.translog.flush\_threshold\_ops" for my Logstash setup. Logstash indexes are created on daily basis. I'd like some advises. I hope these helps: i. ES version- 0.90.0 s…

---

## [No Matches for the grok filter](https://discuss.elastic.co/t/no-matches-for-the-grok-filter/122820)

<div class="topic-metadata">

**Author:** [@kavinda](https://discuss.elastic.co/u/kavinda)\
**Replies:** 5\
**Last updated:** [March 8, 2018, 7:22am UTC](https://discuss.elastic.co/t/no-matches-for-the-grok-filter/122820 "2018-03-08T07:22:43Z")

</div>

HI all Im new to the ELK stack and i have face fallowing problem when i try to create a pattern for a custom log file This is the custom log line INFO \[01/Jul/2017:03:38:38 +0530\] REQUEST CarrierName Balance Check …

---

## [Rollover syntaxe](https://discuss.elastic.co/t/rollover-syntaxe/59796)

<div class="topic-metadata">

**Author:** [@mkm](https://discuss.elastic.co/u/mkm)\
**Replies:** 5\
**Last updated:** [September 5, 2016, 3:22pm UTC](https://discuss.elastic.co/t/rollover-syntaxe/59796 "2016-09-05T15:22:00Z")

</div>

Bonjour, pour la mise en place d'une solution de suavegarde se basant sur rollover et la notion j'ai voulu testé le cas expliqué dans le lien suivant: https://www.elastic.co/blog/managing-time-based-indices-efficiently …

---

## [How to execute dynamic queries with visualisations](https://discuss.elastic.co/t/how-to-execute-dynamic-queries-with-visualisations/281640)

<div class="topic-metadata">

**Author:** [@akashk](https://discuss.elastic.co/u/akashk)\
**Replies:** 8\
**Last updated:** [August 23, 2021, 1:13pm UTC](https://discuss.elastic.co/t/how-to-execute-dynamic-queries-with-visualisations/281640 "2021-08-23T13:13:58Z")

</div>

Hi, I am new to ELK and I am facing one issue in creating visualisations. So we have two different sources(log files) from where we are reading the logs and storing triggeredTime and pickedTime of application event in …

---

## [No logs found for filebeat](https://discuss.elastic.co/t/no-logs-found-for-filebeat/257519)

<div class="topic-metadata">

**Author:** [@Abdelhalim](https://discuss.elastic.co/u/Abdelhalim)\
**Replies:** 8\
**Last updated:** [December 3, 2020, 4:55pm UTC](https://discuss.elastic.co/t/no-logs-found-for-filebeat/257519 "2020-12-03T16:55:08Z")

</div>

Hello, I am using filebeat 7.10 on Debian machine and I configured it to send data to /var/log/filebeat : logging.level: info logging.to\_file: true logging.files: path: /var/log/filebeat name: filebeat keepfiles…

---

## [With FSCrawler 2.7 I am not able to index pdf and other types of documents which worked fine with 2.6](https://discuss.elastic.co/t/with-fscrawler-2-7-i-am-not-able-to-index-pdf-and-other-types-of-documents-which-worked-fine-with-2-6/206246)

<div class="topic-metadata">

**Author:** [@rkmohapatra](https://discuss.elastic.co/u/rkmohapatra)\
**Replies:** 8\
**Last updated:** [November 5, 2019, 12:35pm UTC](https://discuss.elastic.co/t/with-fscrawler-2-7-i-am-not-able-to-index-pdf-and-other-types-of-documents-which-worked-fine-with-2-6/206246 "2019-11-05T12:35:44Z")

</div>

FSCrawler log says this. \[Elasticsearch exception \[type=mapper\_parsing\_exception, reason=failed to parse\]\]; nested: ElasticsearchException\[Elasticsearch exception \[type=illegal\_argument\_exception, reason=Malformed conte…

---

## [Degrading Performance due to Nested Fields](https://discuss.elastic.co/t/degrading-performance-due-to-nested-fields/164774)

<div class="topic-metadata">

**Author:** [@vyazici](https://discuss.elastic.co/u/vyazici)\
**Replies:** 0\
**Last updated:** [January 18, 2019, 10:48am UTC](https://discuss.elastic.co/t/degrading-performance-due-to-nested-fields/164774 "2019-01-18T10:48:11Z")

</div>

Hello, We operate an Elasticsearch 6.3.0 cluster where we have (unless explicitly required) no control over the incoming data and executed queries against it. We combine JSON documents from multiple queues and let busin…

---

## [Bash Scripting ElasticSearch and Kibana Passwords](https://discuss.elastic.co/t/bash-scripting-elasticsearch-and-kibana-passwords/317285)

<div class="topic-metadata">

**Author:** [@Ihms](https://discuss.elastic.co/u/Ihms)\
**Replies:** 6\
**Last updated:** [October 25, 2022, 6:09pm UTC](https://discuss.elastic.co/t/bash-scripting-elasticsearch-and-kibana-passwords/317285 "2022-10-25T18:09:36Z")

</div>

I have a bash script that automates the installation and configuration of Elastic, Kibana, Logstash, and filebeat. I am currently trying to secure my Kibana. I have enabled xpack in my elastic.yml: xpack.security.enable…

---

## [Cloud isn't restoring from snapshot](https://discuss.elastic.co/t/cloud-isnt-restoring-from-snapshot/192491)

<div class="topic-metadata">

**Author:** [@seanziee](https://discuss.elastic.co/u/seanziee)\
**Replies:** 6\
**Last updated:** [July 29, 2019, 7:23pm UTC](https://discuss.elastic.co/t/cloud-isnt-restoring-from-snapshot/192491 "2019-07-29T19:23:06Z")

</div>

This is a pretty basic use case, don't know how this isn't caught yet in testing, but I can't bring a snapshot I have over because of the .kibana index (and .apm-\*) which come default on the new instance. I have 100's of…

---

## [Wrong timestamp from metricbeat 6.3.0](https://discuss.elastic.co/t/wrong-timestamp-from-metricbeat-6-3-0/138693)

<div class="topic-metadata">

**Author:** [@MrFrost](https://discuss.elastic.co/u/MrFrost)\
**Replies:** 6\
**Last updated:** [July 12, 2018, 10:57am UTC](https://discuss.elastic.co/t/wrong-timestamp-from-metricbeat-6-3-0/138693 "2018-07-12T10:57:29Z")

</div>

Hello, I have no idea what can be wrong, but timestamp for data sent by metricbeat is incorrect. i did double check elasticsearch and server date and time that is set. On server PC my time is lets say 12:30 pm CEST I…

---

## [How to integrate logstash in nodejs application?](https://discuss.elastic.co/t/how-to-integrate-logstash-in-nodejs-application/207238)

<div class="topic-metadata">

**Author:** [@Shubham\_Akodiya](https://discuss.elastic.co/u/Shubham_Akodiya)\
**Replies:** 1\
**Last updated:** [November 11, 2019, 5:38am UTC](https://discuss.elastic.co/t/how-to-integrate-logstash-in-nodejs-application/207238 "2019-11-11T05:38:47Z")

</div>

I'm working on node application and my main goal is to maintain the logs (error, info) of the backend part in logstash so that I could do some analysis of which api is breaking and why. I'm new to logstash and I read som…

---

## [Filebeat Module Custom Index](https://discuss.elastic.co/t/filebeat-module-custom-index/181350)

<div class="topic-metadata">

**Author:** [@jbws](https://discuss.elastic.co/u/jbws)\
**Replies:** 1\
**Last updated:** [May 17, 2019, 10:26pm UTC](https://discuss.elastic.co/t/filebeat-module-custom-index/181350 "2019-05-17T22:26:14Z")

</div>

I currently have application logs going in to an index through Filebeat, but would like to use the NGINX module to send access and error logs to a seperate instance through the same Filebeat. I can see how to set the lo…

---

## [Elasticsearch can't handle multiple requests without dramatically decrease its performance](https://discuss.elastic.co/t/elasticsearch-cant-handle-multiple-requests-without-dramatically-decrease-its-performance/115938)

<div class="topic-metadata">

**Author:** [@montenegrodr](https://discuss.elastic.co/u/montenegrodr)\
**Replies:** 1\
**Last updated:** [January 19, 2018, 1:13pm UTC](https://discuss.elastic.co/t/elasticsearch-cant-handle-multiple-requests-without-dramatically-decrease-its-performance/115938 "2018-01-19T13:13:32Z")

</div>

I have a two node cluster hosted in ElasticCloud. Host Elastic Cloud Platform Google Cloud Region US Central 1 (Iowa) Memory 8 GB Storage 192 GB SSD Yes HA Yes Each node has: Allocated Processors …

---

## [ElasticSearch Transport client is throwing exception:](https://discuss.elastic.co/t/elasticsearch-transport-client-is-throwing-exception/95289)

<div class="topic-metadata">

**Author:** [@kedarsdixit](https://discuss.elastic.co/u/kedarsdixit)\
**Replies:** 1\
**Last updated:** [August 2, 2017, 10:43am UTC](https://discuss.elastic.co/t/elasticsearch-transport-client-is-throwing-exception/95289 "2017-08-02T10:43:26Z")

</div>

Hi, I am using ES transport client for pulling data using scroll, I am using ES 5.5. When I run the code I am getting below mentioned exception: Exception in thread "main" org.elasticsearch.action.ActionRequestValidat…

---

## [Indices vs cluster vs x-pack user privileges](https://discuss.elastic.co/t/indices-vs-cluster-vs-x-pack-user-privileges/85693)

<div class="topic-metadata">

**Author:** [@vijayramachandran](https://discuss.elastic.co/u/vijayramachandran)\
**Replies:** 1\
**Last updated:** [May 16, 2017, 3:01am UTC](https://discuss.elastic.co/t/indices-vs-cluster-vs-x-pack-user-privileges/85693 "2017-05-16T03:01:32Z")

</div>

Hello there! Can anyone explain me the privileges of x-pack users, indices privileges, and cluster privileges. x-pack users has got some privileges when they have created like superuser, monitoring\_user and goes on. …

---

## [Need help to create regex in logstash](https://discuss.elastic.co/t/need-help-to-create-regex-in-logstash/28510)

<div class="topic-metadata">

**Author:** [@vikas\_gopal](https://discuss.elastic.co/u/vikas_gopal)\
**Replies:** 1\
**Last updated:** [September 2, 2015, 1:02pm UTC](https://discuss.elastic.co/t/need-help-to-create-regex-in-logstash/28510 "2015-09-02T13:02:21Z")

</div>

Hi Experts , I have data in key value format . But some data is as follows act=ACCESS GRANTED rt=1439389790799 Now when I use KV filter in logstash it gives me an output like act=ACCESS rt=1439389790799 Here I…

---

## [\[feature request\] Use CC and BCC but not TO my email address](https://discuss.elastic.co/t/feature-request-use-cc-and-bcc-but-not-to-my-email-address/1587)

<div class="topic-metadata">

**Author:** [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Replies:** 1\
**Last updated:** [June 14, 2015, 11:57pm UTC](https://discuss.elastic.co/t/feature-request-use-cc-and-bcc-but-not-to-my-email-address/1587 "2015-06-14T23:57:30Z")

</div>

hey there, I'd love to have a clear distinction when getting email from discuss platform between threads I have answered and others. Github does this for example. If you have never participated to a thread, then the …

---

## [\[LOGSTASH\] How to pars logs with SSH](https://discuss.elastic.co/t/logstash-how-to-pars-logs-with-ssh/270513)

<div class="topic-metadata">

**Author:** [@Adhara](https://discuss.elastic.co/u/Adhara)\
**Replies:** 2\
**Last updated:** [April 29, 2021, 8:40pm UTC](https://discuss.elastic.co/t/logstash-how-to-pars-logs-with-ssh/270513 "2021-04-29T20:40:48Z")

</div>

Hello, I'm new in ELK and i don't understand one thing. I installed ELK with basic options. I did some small tests locally with the "File" input and it worked fine. Now, I wanted to parse the logs for a remote machine…

---

## [Parsing syslog RFC 5424 format](https://discuss.elastic.co/t/parsing-syslog-rfc-5424-format/261021)

<div class="topic-metadata">

**Author:** [@S3l3ct3d](https://discuss.elastic.co/u/S3l3ct3d)\
**Replies:** 2\
**Last updated:** [January 13, 2021, 9:07pm UTC](https://discuss.elastic.co/t/parsing-syslog-rfc-5424-format/261021 "2021-01-13T21:07:56Z")

</div>

Good morning, I have a log source that sends syslog messages in RFC 5424 format. I have searched everywhere to figure out how to parse these syslog messages. Since logstash's syslog input is for RFC 3164 format, nothing…

---

## [Kibana with basePath login redirect loop on GCP](https://discuss.elastic.co/t/kibana-with-basepath-login-redirect-loop-on-gcp/260115)

<div class="topic-metadata">

**Author:** [@uncl3mar1k](https://discuss.elastic.co/u/uncl3mar1k)\
**Replies:** 2\
**Last updated:** [January 11, 2021, 5:30pm UTC](https://discuss.elastic.co/t/kibana-with-basepath-login-redirect-loop-on-gcp/260115 "2021-01-11T17:30:41Z")

</div>

On a regular GKE private cluster I Installed ECK (kubectl apply -f https://download.elastic.co/downloads/eck/1.3.1/all-in-one.yaml) Installed Elasticsearch and Kibana: apiVersion: v1 kind: Namespace meta…

---

## [Remove old index automatically](https://discuss.elastic.co/t/remove-old-index-automatically/239321)

<div class="topic-metadata">

**Author:** [@jgonzalez](https://discuss.elastic.co/u/jgonzalez)\
**Replies:** 2\
**Last updated:** [June 30, 2020, 2:23pm UTC](https://discuss.elastic.co/t/remove-old-index-automatically/239321 "2020-06-30T14:23:49Z")

</div>

Hello All, I need to remove all the indexes older than 6 days automatically, I tried to create a lifecycle in Kibana but it didn't work fine, so i saw an option called Curator but for some reason, the curator can't fin…

---

## [Setting advanced settings - env? kibana.yml? curl?](https://discuss.elastic.co/t/setting-advanced-settings-env-kibana-yml-curl/223023)

<div class="topic-metadata">

**Author:** [@Supermathie](https://discuss.elastic.co/u/Supermathie)\
**Replies:** 2\
**Last updated:** [March 11, 2020, 8:54am UTC](https://discuss.elastic.co/t/setting-advanced-settings-env-kibana-yml-curl/223023 "2020-03-11T08:54:34Z")

</div>

Is there a way to specify these settings (especially dateFormat:tz) in either the env or in kibana.yml? Alternatively, is there a way to query for and update these settings via curl? Can you provide an example of the c…

---

## [Custom Context vs Tags](https://discuss.elastic.co/t/custom-context-vs-tags/151126)

<div class="topic-metadata">

**Author:** [@doug\_shareablee](https://discuss.elastic.co/u/doug_shareablee)\
**Replies:** 2\
**Last updated:** [October 5, 2018, 3:11pm UTC](https://discuss.elastic.co/t/custom-context-vs-tags/151126 "2018-10-05T15:11:30Z")

</div>

I'm instrumenting my code, and trying to add some context to the traces. I see there are two methods: https://www.elastic.co/guide/en/apm/agent/python/current/api.html#api-set-custom-context and https://www.elastic.co…

---

## [PII data in ingested into the ELK environment](https://discuss.elastic.co/t/pii-data-in-ingested-into-the-elk-environment/101051)

<div class="topic-metadata">

**Author:** [@kal](https://discuss.elastic.co/u/kal)\
**Replies:** 2\
**Last updated:** [September 20, 2017, 4:47pm UTC](https://discuss.elastic.co/t/pii-data-in-ingested-into-the-elk-environment/101051 "2017-09-20T16:47:50Z")

</div>

Hello, we are needing to figure out if there's any personally identifiable information stored in our ELK stack, I did see a bunch of articles on finding CC numbers within the environment, but unless I am mistaken, it see…

---

## [How to measure performance of Logstash](https://discuss.elastic.co/t/how-to-measure-performance-of-logstash/81327)

<div class="topic-metadata">

**Author:** [@parrot](https://discuss.elastic.co/u/parrot)\
**Replies:** 2\
**Last updated:** [April 10, 2017, 7:03am UTC](https://discuss.elastic.co/t/how-to-measure-performance-of-logstash/81327 "2017-04-10T07:03:09Z")

</div>

Hi, i need a tool to measure the performance of Logstash - i want to try different configurations and choose the one with the best performance (minimum time until i get the output). What is the best way to check it?

---

## [Import Jedis lib in native script](https://discuss.elastic.co/t/import-jedis-lib-in-native-script/40928)

<div class="topic-metadata">

**Author:** [@hahander](https://discuss.elastic.co/u/hahander)\
**Replies:** 2\
**Last updated:** [February 4, 2016, 7:09am UTC](https://discuss.elastic.co/t/import-jedis-lib-in-native-script/40928 "2016-02-04T07:09:51Z")

</div>

Hi there. Sorry if i'm type in wrong topic. Is there any way to include any external libs to elasticsearch? I have this lib(jar file) and simple native script. I wonna get access to this external classes from my native s…

---

## [Error running logstash-input-couchdb\_changes plugin](https://discuss.elastic.co/t/error-running-logstash-input-couchdb-changes-plugin/27794)

<div class="topic-metadata">

**Author:** [@imad](https://discuss.elastic.co/u/imad)\
**Replies:** 2\
**Last updated:** [August 21, 2015, 7:06pm UTC](https://discuss.elastic.co/t/error-running-logstash-input-couchdb-changes-plugin/27794 "2015-08-21T19:06:01Z")

</div>

Hi, I am having problem running this plugin. I downloaded logstash and logstash-input-couchdb\_changes plugin, unzipped those and then followed 1st two steps in the sections below. I am running windows 7. I didn't insta…

---

## [Map IP Address to geolocation and use of the anomaly detector](https://discuss.elastic.co/t/map-ip-address-to-geolocation-and-use-of-the-anomaly-detector/270027)

<div class="topic-metadata">

**Author:** [@Vannessa\_Kemeni](https://discuss.elastic.co/u/Vannessa_Kemeni)\
**Replies:** 4\
**Last updated:** [April 16, 2021, 5:55pm UTC](https://discuss.elastic.co/t/map-ip-address-to-geolocation-and-use-of-the-anomaly-detector/270027 "2021-04-16T17:55:24Z")

</div>

Hello everyone, i am using the wazuh software combined with ELK. I get some ip adress from Wazuh and i want to find the corresponding geolocation. How i can do that. Furthermore, i want to use the anomaly detector in or…

---

## [Kibana \> Lens Vis. \> Share](https://discuss.elastic.co/t/kibana-lens-vis-share/249456)

<div class="topic-metadata">

**Author:** [@Er.Sid](https://discuss.elastic.co/u/Er.Sid)\
**Replies:** 4\
**Last updated:** [September 22, 2020, 9:22am UTC](https://discuss.elastic.co/t/kibana-lens-vis-share/249456 "2020-09-22T09:22:55Z")

</div>

Hello All, I have created a Data Table in Kibana - Visualization - lens - Data Table I wish to export or Share this table to PDF or any other format. Normally ,,SHARE" button is available on every Visualisation, Ho…

---

## [Logstash Crashes... Minimal Config, Default Pipeline!](https://discuss.elastic.co/t/logstash-crashes-minimal-config-default-pipeline/236766)

<div class="topic-metadata">

**Author:** [@redapplesonly](https://discuss.elastic.co/u/redapplesonly)\
**Replies:** 4\
**Last updated:** [June 11, 2020, 10:41pm UTC](https://discuss.elastic.co/t/logstash-crashes-minimal-config-default-pipeline/236766 "2020-06-11T22:41:45Z")

</div>

Hi Logstash gurus, I have been running the Docker container instance of Logstash (ver 7.4.0, yes, I need to upgrade) for a while now. I had to tear down and rebuild the container, and I decided to take the opportunity …

---

## [Multiline Java Stack Trace parsing doesn't work](https://discuss.elastic.co/t/multiline-java-stack-trace-parsing-doesnt-work/227783)

<div class="topic-metadata">

**Author:** [@ramokarahasan](https://discuss.elastic.co/u/ramokarahasan)\
**Replies:** 4\
**Last updated:** [April 15, 2020, 6:08am UTC](https://discuss.elastic.co/t/multiline-java-stack-trace-parsing-doesnt-work/227783 "2020-04-15T06:08:18Z")

</div>

I'm reviewing and trying: https://www.elastic.co/guide/en/beats/filebeat/current/multiline-examples.html and also followed: https://discuss.elastic.co/t/filebeat-multiline-java-stack-trace/150003 I've deployed the late…

---

## [DataTable customized metric?](https://discuss.elastic.co/t/datatable-customized-metric/151520)

<div class="topic-metadata">

**Author:** [@Matt\_McGovern](https://discuss.elastic.co/u/Matt_McGovern)\
**Replies:** 4\
**Last updated:** [October 11, 2018, 1:28pm UTC](https://discuss.elastic.co/t/datatable-customized-metric/151520 "2018-10-11T13:28:56Z")

</div>

I'm trying to have a data table with 3 columns, where the 3rd column is a Status (Success or Failure)...I don't want the 3rd column to repeat as a different row each time---I'd rather I just had a calculation of percenta…

[Previous page](https://discuss.elastic.co/top.md?page=1180&per_page=50&period=all)

[Next page](https://discuss.elastic.co/top.md?page=1182&per_page=50&period=all)
