# Top **URL:** https://discuss.elastic.co/top.md?page=1348&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1349 --- ## [Filebeat pipping Suricatas eve.json issues](https://discuss.elastic.co/t/filebeat-pipping-suricatas-eve-json-issues/225890)
**Author:** [@eriknox](https://discuss.elastic.co/u/eriknox)\ **Replies:** 1\ **Last updated:** [March 31, 2020, 5:55pm UTC](https://discuss.elastic.co/t/filebeat-pipping-suricatas-eve-json-issues/225890 "2020-03-31T17:55:37Z")
Hello all, I have Elastic 7.6.1 up and running without the use of Logstash. My issue that I have is that I cannot get Filebeat to ingest Suricata. I have the module imported. Suricata is alerting and dropping the jso… --- ## [Difference between two metrics](https://discuss.elastic.co/t/difference-between-two-metrics/157514)
**Author:** [@Aya-kh](https://discuss.elastic.co/u/Aya-kh)\ **Replies:** 1\ **Last updated:** [November 21, 2018, 2:17am UTC](https://discuss.elastic.co/t/difference-between-two-metrics/157514 "2018-11-21T02:17:50Z")
hi, i need your help How could I visualize the difference between two metrics ( numerical histogram) and the grouping by third field (string ) thanks in advance --- ## [Multitenancy in Kibana using x-pack](https://discuss.elastic.co/t/multitenancy-in-kibana-using-x-pack/134989)
**Author:** [@sumit\_matta](https://discuss.elastic.co/u/sumit_matta)\ **Replies:** 1\ **Last updated:** [June 7, 2018, 7:11pm UTC](https://discuss.elastic.co/t/multitenancy-in-kibana-using-x-pack/134989 "2018-06-07T19:11:46Z")
I want to implement multitenency in kibana at a more deep level. eg :- there are 2 company company1\[index\] - | type1\[type\] - | id \[field\] | name \[field\] | users\_access \[user1,user2\] \[field\] company2\[index\] - | t… --- ## [Kibana geoip mapping wrong | unable to change index](https://discuss.elastic.co/t/kibana-geoip-mapping-wrong-unable-to-change-index/103881)
**Author:** [@bobwilly](https://discuss.elastic.co/u/bobwilly)\ **Replies:** 1\ **Last updated:** [October 13, 2017, 4:37pm UTC](https://discuss.elastic.co/t/kibana-geoip-mapping-wrong-unable-to-change-index/103881 "2017-10-13T16:37:16Z")
I got kibana to index my geoip data. The problem is my data is indexed in kibana as: \`Preformatted text\`geoip.city\_name geoip.continent\_code geoip.country\_code2 geoip.country\_code3 geoip.country\_name… --- ## [Kibana times out \[5.5.x\]](https://discuss.elastic.co/t/kibana-times-out-5-5-x/96363)
**Author:** [@Drift](https://discuss.elastic.co/u/Drift)\ **Replies:** 1\ **Last updated:** [August 9, 2017, 10:20pm UTC](https://discuss.elastic.co/t/kibana-times-out-5-5-x/96363 "2017-08-09T22:20:49Z")
Kibana \[5.5.x\] times out most of the time with the following error: Error: Request Timeout after 30000ms at http://10.10.7.173:5601/bundles/kibana.bundle.js?v=15405:12:4431 at http://10.10.7.173:5601/bundles/kibana.bu… --- ## [How to use fliter's json to parsing nested json](https://discuss.elastic.co/t/how-to-use-fliters-json-to-parsing-nested-json/60072)
**Author:** [@WangXiangUSTC](https://discuss.elastic.co/u/WangXiangUSTC)\ **Replies:** 1\ **Last updated:** [September 8, 2016, 1:25pm UTC](https://discuss.elastic.co/t/how-to-use-fliters-json-to-parsing-nested-json/60072 "2016-09-08T13:25:18Z")
I use the fliter's json to parse nested json, the log is like below: { "time":"2016-09-08T20:25:48.657327288+08:00", "requested\_id":"34545665", "body":"{\\"data\\":\\"fheufrgjidjweidwjfndfefm",\\"code\\":\\"200\\"}" } this … --- ## [Is logstash running, not getting messages after default pipeline workers](https://discuss.elastic.co/t/is-logstash-running-not-getting-messages-after-default-pipeline-workers/59496)
**Author:** [@Siva\_Dorai](https://discuss.elastic.co/u/Siva_Dorai)\ **Replies:** 8\ **Last updated:** [September 1, 2016, 8:34am UTC](https://discuss.elastic.co/t/is-logstash-running-not-getting-messages-after-default-pipeline-workers/59496 "2016-09-01T08:34:26Z")
When i try to run my conf file, dont get any action after the settings line. E:\\ArchWorld\\logstash-2.3.4\\bin\>logstash -f ../first.conf io/console not supported; tty will not be manipulated Settings: Default pipeline wo… --- ## [Metric Text Graph to show Graph contents](https://discuss.elastic.co/t/metric-text-graph-to-show-graph-contents/287698)
**Author:** [@RAM\_NATHAN](https://discuss.elastic.co/u/RAM_NATHAN)\ **Replies:** 6\ **Last updated:** [October 28, 2021, 4:50pm UTC](https://discuss.elastic.co/t/metric-text-graph-to-show-graph-contents/287698 "2021-10-28T16:50:31Z")
Hi I have a metric text graph to show unique user count. I wanted to know who are those unique users. Is it possible? Regards Ram --- ## [How to check document consistent with current mapping?](https://discuss.elastic.co/t/how-to-check-document-consistent-with-current-mapping/278387)
**Author:** [@peter5](https://discuss.elastic.co/u/peter5)\ **Replies:** 6\ **Last updated:** [July 12, 2021, 9:00am UTC](https://discuss.elastic.co/t/how-to-check-document-consistent-with-current-mapping/278387 "2021-07-12T09:00:28Z")
i need to know if document is matching current mapping or not (if not match i need to reindex) . eg, i change a field analyzer several times by update mapping . i need to know current document index status is identical … --- ## [Plot Line Chart with Kibana Visualize](https://discuss.elastic.co/t/plot-line-chart-with-kibana-visualize/129301)
**Author:** [@AlexisC](https://discuss.elastic.co/u/AlexisC)\ **Replies:** 6\ **Last updated:** [April 26, 2018, 3:57pm UTC](https://discuss.elastic.co/t/plot-line-chart-with-kibana-visualize/129301 "2018-04-26T15:57:04Z")
I want to plot a specific line chart with Kibana Visualize. My data looks like this Timestamp / Value / Serie 15000 / 5.0 / 1 15500 / 12.5 / 1 16000 / 23 / 1 16500 / 16.2 / 2 17000 / 14.9 / 2 18000 / 4.6 / 3 ... … --- ## [Filebeat - There are conflicts between additional prospectors and reload function](https://discuss.elastic.co/t/filebeat-there-are-conflicts-between-additional-prospectors-and-reload-function/85891)
**Author:** [@Kirax00](https://discuss.elastic.co/u/Kirax00)\ **Replies:** 6\ **Last updated:** [May 17, 2017, 9:06am UTC](https://discuss.elastic.co/t/filebeat-there-are-conflicts-between-additional-prospectors-and-reload-function/85891 "2017-05-17T09:06:19Z")
When I use the additional prospectors function and reload function, the reload function is not working. Filebeat read the additional prospector configurations in the config.FetchConfigs, which call the mergeConfigFiles… --- ## [Cannot export Date fields to MongoDB](https://discuss.elastic.co/t/cannot-export-date-fields-to-mongodb/192943)
**Author:** [@HFolly](https://discuss.elastic.co/u/HFolly)\ **Replies:** 5\ **Last updated:** [August 1, 2019, 9:35am UTC](https://discuss.elastic.co/t/cannot-export-date-fields-to-mongodb/192943 "2019-08-01T09:35:52Z")
Hello. I'm facing an issue when I try to write date fields to MongoDB, I've tried to convert it in many ways but with no success. In my input JSON I have a collection like this: "Colecs": \[ { "Value": { "Va… --- ## [Data table split by columns, need to remove the data which is in both columns .. exclude that data](https://discuss.elastic.co/t/data-table-split-by-columns-need-to-remove-the-data-which-is-in-both-columns-exclude-that-data/179317)
**Author:** [@TEJASWI\_CHUNDURI](https://discuss.elastic.co/u/TEJASWI_CHUNDURI)\ **Replies:** 5\ **Last updated:** [May 30, 2019, 12:45pm UTC](https://discuss.elastic.co/t/data-table-split-by-columns-need-to-remove-the-data-which-is-in-both-columns-exclude-that-data/179317 "2019-05-30T12:45:10Z")
Hi , I had a Datatable, where split by columns , for example a ( build versions) .. I need to remove the data which is common in both columns. Actual : V1 V2 V3 … --- ## [How to create a client with the protect of SearchGuard By Class RestHighLevelClient](https://discuss.elastic.co/t/how-to-create-a-client-with-the-protect-of-searchguard-by-class-resthighlevelclient/165185)
**Author:** [@AveiShriety](https://discuss.elastic.co/u/AveiShriety)\ **Replies:** 5\ **Last updated:** [January 23, 2019, 11:41pm UTC](https://discuss.elastic.co/t/how-to-create-a-client-with-the-protect-of-searchguard-by-class-resthighlevelclient/165185 "2019-01-23T23:41:57Z")
Now, I use SearchGuard to secure my elasticsearch cluster. And in the search-guard official website, I found the Transport Clients to create A client. But, due to the Elasticsearch official website's declare: We plan… --- ## [Elastic search performance](https://discuss.elastic.co/t/elastic-search-performance/67559)
**Author:** [@madhan](https://discuss.elastic.co/u/madhan)\ **Replies:** 5\ **Last updated:** [December 1, 2016, 2:14pm UTC](https://discuss.elastic.co/t/elastic-search-performance/67559 "2016-12-01T14:14:52Z")
i need to retrieve 5000 records as single shot in elastic search querystring. so i mention .size(5000) but it takes too long time and throws exception as "The operation timed out". How to resolve this issue and boost… --- ## [Inspect =\> Download CSV =\> Formatted CSV, download file using Python](https://discuss.elastic.co/t/inspect-download-csv-formatted-csv-download-file-using-python/248508)
**Author:** [@balajipothula](https://discuss.elastic.co/u/balajipothula)\ **Replies:** 3\ **Last updated:** [September 14, 2020, 2:41pm UTC](https://discuss.elastic.co/t/inspect-download-csv-formatted-csv-download-file-using-python/248508 "2020-09-14T14:41:50Z")
HI Team, I had Kibana version 7.4 Inspect =\> Download CSV =\> Formatted CSV Can I download table visualization Formatted data by using Python code or CURL Thanks and regards, BALAJI --- ## [Kibana to run more than one process using PM2](https://discuss.elastic.co/t/kibana-to-run-more-than-one-process-using-pm2/164349)
**Author:** [@colinPDX](https://discuss.elastic.co/u/colinPDX)\ **Replies:** 3\ **Last updated:** [January 16, 2019, 3:47pm UTC](https://discuss.elastic.co/t/kibana-to-run-more-than-one-process-using-pm2/164349 "2019-01-16T15:47:42Z")
Hi. Has anyone successfully run Kibana using PM2 or have recommendations to do so for a system w/, say, k hardware threads available? I have a 96vCPU VM available. Thanks. - Colin --- ## [Elasticsearch-py not compatible with cross cluster search](https://discuss.elastic.co/t/elasticsearch-py-not-compatible-with-cross-cluster-search/140713)
**Author:** [@bbailey](https://discuss.elastic.co/u/bbailey)\ **Replies:** 3\ **Last updated:** [August 21, 2018, 10:30am UTC](https://discuss.elastic.co/t/elasticsearch-py-not-compatible-with-cross-cluster-search/140713 "2018-08-21T10:30:36Z")
We have been using the elasticsearch-py module for a couple of years to automate data analysis across a multiple clusters using tribe nodes. We have now replaced the tribe nodes with cross cluster search nodes but seem u… --- ## [Geo Search with Elasticsearch.Net/Nest](https://discuss.elastic.co/t/geo-search-with-elasticsearch-net-nest/111025)
**Author:** [@Amir\_P](https://discuss.elastic.co/u/Amir_P)\ **Replies:** 3\ **Last updated:** [December 12, 2017, 8:16am UTC](https://discuss.elastic.co/t/geo-search-with-elasticsearch-net-nest/111025 "2017-12-12T08:16:37Z")
Hello everyone, I’m trying to make a simple geo bounding box search using Elasticsearch.Net/Nest but couldn’t find the right way. I would be happy if someone could help me, thanks ahead. --- ## [Is there a way to send the path as a parameter to the the filebeat.yml configuration file?](https://discuss.elastic.co/t/is-there-a-way-to-send-the-path-as-a-parameter-to-the-the-filebeat-yml-configuration-file/86389)
**Author:** [@Nisal\_Thiwanka](https://discuss.elastic.co/u/Nisal_Thiwanka)\ **Replies:** 3\ **Last updated:** [May 22, 2017, 10:51am UTC](https://discuss.elastic.co/t/is-there-a-way-to-send-the-path-as-a-parameter-to-the-the-filebeat-yml-configuration-file/86389 "2017-05-22T10:51:09Z")
I have configured filebeat to read different log files from several paths and I need to configure filebeat in a way that I can send path as a parameter to the configuration file. Is it possible? --- ## [Nginx & proxies](https://discuss.elastic.co/t/nginx-proxies/85757)
**Author:** [@sepal](https://discuss.elastic.co/u/sepal)\ **Replies:** 3\ **Last updated:** [May 16, 2017, 12:28pm UTC](https://discuss.elastic.co/t/nginx-proxies/85757 "2017-05-16T12:28:35Z")
I've just setup filebeat for an existing elastic stack primarily to analyze the the access logs from nginx. I used the setup command and it all went ok without any problems. I've encoutered one issue in the index data t… --- ## [Jvm.dll crashes when stopping elastic search service](https://discuss.elastic.co/t/jvm-dll-crashes-when-stopping-elastic-search-service/83316)
**Author:** [@prabhurajreddy](https://discuss.elastic.co/u/prabhurajreddy)\ **Replies:** 0\ **Last updated:** [April 23, 2017, 9:38am UTC](https://discuss.elastic.co/t/jvm-dll-crashes-when-stopping-elastic-search-service/83316 "2017-04-23T09:38:04Z")
Whenever i stop elastic search service using the service.bat script in elastic search 2.4.0, jvm.dll crashes. Below Windows application error log is observed. Faulting application name: elasticsearch-service-x64.exe, … --- ## [Cardinality and value\_count aggr values are 200-500% off](https://discuss.elastic.co/t/cardinality-and-value-count-aggr-values-are-200-500-off/75803)
**Author:** [@kievbs](https://discuss.elastic.co/u/kievbs)\ **Replies:** 3\ **Last updated:** [February 21, 2017, 4:57pm UTC](https://discuss.elastic.co/t/cardinality-and-value-count-aggr-values-are-200-500-off/75803 "2017-02-21T16:57:13Z")
I have the really weird issue with ES 2.4. Really appreciate if someone would explain me how to fix it. I have an index with one unique field 'some\_id' inside - and the value of that field is used as object ID. Tota… --- ## [Logstash Key Value Filter unable to parse specific text](https://discuss.elastic.co/t/logstash-key-value-filter-unable-to-parse-specific-text/60145)
**Author:** [@mrunalgosar](https://discuss.elastic.co/u/mrunalgosar)\ **Replies:** 3\ **Last updated:** [September 9, 2016, 10:48am UTC](https://discuss.elastic.co/t/logstash-key-value-filter-unable-to-parse-specific-text/60145 "2016-09-09T10:48:26Z")
I am trying to use Logstash's Key Value (kv) filter to parse logs. It specifically fails for a pair where key is "valid". see below example: Log message: "versionInfo=VersionInfo{valid=test}" Logstash filter config s… --- ## [Possible to change index rollover time?](https://discuss.elastic.co/t/possible-to-change-index-rollover-time/52247)
**Author:** [@jeffkirk1](https://discuss.elastic.co/u/jeffkirk1)\ **Replies:** 3\ **Last updated:** [June 13, 2016, 7:50pm UTC](https://discuss.elastic.co/t/possible-to-change-index-rollover-time/52247 "2016-06-13T19:50:15Z")
Hi folks, We've seen a big increase in our log volume and need to be able to reduce the maximum shard size to a manageable level. I'm wondering if there's any way to automatically spawn a new logstash index when it … --- ## [Multi Type Search Using java API more specifically Spring Data Elasticsearch](https://discuss.elastic.co/t/multi-type-search-using-java-api-more-specifically-spring-data-elasticsearch/47300)
**Author:** [@rahul\_agarwal](https://discuss.elastic.co/u/rahul_agarwal)\ **Replies:** 0\ **Last updated:** [April 13, 2016, 6:32pm UTC](https://discuss.elastic.co/t/multi-type-search-using-java-api-more-specifically-spring-data-elasticsearch/47300 "2016-04-13T18:32:40Z")
I want to Search My Index in all Types and all fields for the query. I know how to do it using REST way. I want to know how to do it using JAVA API and more specifically in Spring Data Elasticsearch. This is some code … --- ## [What is request cache](https://discuss.elastic.co/t/what-is-request-cache/46619)
**Author:** [@vineeth\_mohan\_2](https://discuss.elastic.co/u/vineeth_mohan_2)\ **Replies:** 3\ **Last updated:** [April 12, 2016, 8:23am UTC](https://discuss.elastic.co/t/what-is-request-cache/46619 "2016-04-12T08:23:38Z")
On the Elasticsearch 5 alpha release , I noticed that something called request cache is highlighted as key release component. Enable the indices request cache by default #17162 (issues: #16870, #17134) I went though… --- ## [Issue of Configuring in Logstash](https://discuss.elastic.co/t/issue-of-configuring-in-logstash/294387)
**Author:** [@leyleynewt](https://discuss.elastic.co/u/leyleynewt)\ **Replies:** 7\ **Last updated:** [January 18, 2022, 2:16am UTC](https://discuss.elastic.co/t/issue-of-configuring-in-logstash/294387 "2022-01-18T02:16:07Z")
This is the configuration in logstash-sample.conf: input{ stdin{} } output{ elasticsearch{ hosts =\> \["localhost:9200"\] index =\> "my-index-name" user =\> "elastic" passwo… --- ## [Another Kibana instance appears to be migrating the index - Docker environment](https://discuss.elastic.co/t/another-kibana-instance-appears-to-be-migrating-the-index-docker-environment/248487)
**Author:** [@Stimmot](https://discuss.elastic.co/u/Stimmot)\ **Replies:** 1\ **Last updated:** [September 14, 2020, 8:59am UTC](https://discuss.elastic.co/t/another-kibana-instance-appears-to-be-migrating-the-index-docker-environment/248487 "2020-09-14T08:59:08Z")
I have three Elasticsearch nodes running with docker-compose. When I start the additional kibana service, it gets stuck on: Another Kibana instance appears to be migrating the index. Waiting for that migration to comple… --- ## [Dateparse failure When trying to get date from xml file](https://discuss.elastic.co/t/dateparse-failure-when-trying-to-get-date-from-xml-file/228342)
**Author:** [@kagashe](https://discuss.elastic.co/u/kagashe)\ **Replies:** 7\ **Last updated:** [April 16, 2020, 8:27pm UTC](https://discuss.elastic.co/t/dateparse-failure-when-trying-to-get-date-from-xml-file/228342 "2020-04-16T20:27:38Z")
Hi all, I'm trying to update the @timestamp field to be the timestamp pulled from my source xml file. The xml fields are mapped with xpath and all seem to be parsing fine however when I run the date filter below it does… --- ## [Spark save to elasticsearch failed due to Connection error](https://discuss.elastic.co/t/spark-save-to-elasticsearch-failed-due-to-connection-error/135153)
**Author:** [@aouakki](https://discuss.elastic.co/u/aouakki)\ **Replies:** 1\ **Last updated:** [June 21, 2018, 3:26pm UTC](https://discuss.elastic.co/t/spark-save-to-elasticsearch-failed-due-to-connection-error/135153 "2018-06-21T15:26:51Z")
I'm trying to index data in elasticsearch about 77M documents with 150 fields . We dont have much computing/memory resource so our cluster is 3 nodes ( 48GB RAM /24 CPU and 6TB of storage ) I'm sending data from anothe… --- ## [Can't connect coordinator\_host](https://discuss.elastic.co/t/cant-connect-coordinator-host/109312)
**Author:** [@syed](https://discuss.elastic.co/u/syed)\ **Replies:** 1\ **Last updated:** [November 28, 2017, 8:59am UTC](https://discuss.elastic.co/t/cant-connect-coordinator-host/109312 "2017-11-28T08:59:54Z")
Please find the below error while adding the 2nd node to the elastic cloud enterprise: Elastic Cloud Enterprise Installer Install Elastic Cloud Enterprise on this host to add its resources to an existing installation. … --- ## [Elasticsearch throwing execption while starting](https://discuss.elastic.co/t/elasticsearch-throwing-execption-while-starting/100465)
**Author:** [@Kishore](https://discuss.elastic.co/u/Kishore)\ **Replies:** 7\ **Last updated:** [September 14, 2017, 11:52am UTC](https://discuss.elastic.co/t/elasticsearch-throwing-execption-while-starting/100465 "2017-09-14T11:52:47Z")
I am getting below error while starting elasticsearch version 5.0 indent preformatted text by 4 spacesException in thread "main" java.lang.NoSuchMethodError: org.apache.logging.log4j.core.config.properties.PropertiesCon… --- ## [Is it possible apply grok in oldest logs?](https://discuss.elastic.co/t/is-it-possible-apply-grok-in-oldest-logs/91104)
**Author:** [@joao](https://discuss.elastic.co/u/joao)\ **Replies:** 7\ **Last updated:** [June 28, 2017, 7:59pm UTC](https://discuss.elastic.co/t/is-it-possible-apply-grok-in-oldest-logs/91104 "2017-06-28T19:59:15Z")
Hello, I need to apply the grok filter in oldest logs, is it possible? Because I need to creat new fields. Thank you very much. --- ## [Flag traffic from Tor exit nodes](https://discuss.elastic.co/t/flag-traffic-from-tor-exit-nodes/44938)
**Author:** [@tomr](https://discuss.elastic.co/u/tomr)\ **Replies:** 1\ **Last updated:** [March 21, 2016, 2:44am UTC](https://discuss.elastic.co/t/flag-traffic-from-tor-exit-nodes/44938 "2016-03-21T02:44:02Z")
I'm looking to flag any traffic hitting our edge that appears to come from a tor exit node. I've pulled a list of all exit nodes, which I'll later cron updates to, with: curl -s https://check.torproject.org/exit-addr… --- ## [Trigger a red cluster state?](https://discuss.elastic.co/t/trigger-a-red-cluster-state/9786)
**Author:** [@emj11](https://discuss.elastic.co/u/emj11)\ **Replies:** 1\ **Last updated:** [November 22, 2012, 3:51am UTC](https://discuss.elastic.co/t/trigger-a-red-cluster-state/9786 "2012-11-22T03:51:42Z")
Is there an easy way to trigger the cluster state to go from a green state to a red state? I'd like to know if the transport client tries to connect to a cluster while it is in a red state, will it be able to conn… --- ## [Kibana alerts creates ticket in Topdesk?](https://discuss.elastic.co/t/kibana-alerts-creates-ticket-in-topdesk/212790)
**Author:** [@Robin020](https://discuss.elastic.co/u/Robin020)\ **Replies:** 2\ **Last updated:** [December 27, 2019, 9:48am UTC](https://discuss.elastic.co/t/kibana-alerts-creates-ticket-in-topdesk/212790 "2019-12-27T09:48:40Z")
Hello, With Kibana you can set alerts. I have read it could create automatic tickets in a ticket system from Kibana alerts. Is this possible with Topdesk? Where can I find information about this? Robin --- ## [Manage\_security Cluster privilege without role settings](https://discuss.elastic.co/t/manage-security-cluster-privilege-without-role-settings/200303)
**Author:** [@pechora](https://discuss.elastic.co/u/pechora)\ **Replies:** 2\ **Last updated:** [September 25, 2019, 9:21am UTC](https://discuss.elastic.co/t/manage-security-cluster-privilege-without-role-settings/200303 "2019-09-25T09:21:29Z")
Greetings Everyone, I am trying to set up Elasticsearch and Kibana for a minor logging project. I need to create a role in which the user has the access to create and delete users but cannot alter the definition of role… --- ## [Inserting Logs into SIEM](https://discuss.elastic.co/t/inserting-logs-into-siem/188510)
**Author:** [@inteli](https://discuss.elastic.co/u/inteli)\ **Replies:** 2\ **Last updated:** [July 3, 2019, 11:17am UTC](https://discuss.elastic.co/t/inserting-logs-into-siem/188510 "2019-07-03T11:17:14Z")
Hi Guys, the new elastic SIEM timeline feature looks amazing and I would like to use it for log analysis. Unfortunately I don't have that much experience regarding ELK setup. If i understand correctly it is only possi… --- ## [XPack ClassNotFoundException: com.unboundid.util.Debug in java](https://discuss.elastic.co/t/xpack-classnotfoundexception-com-unboundid-util-debug-in-java/160852)
**Author:** [@lip](https://discuss.elastic.co/u/lip)\ **Replies:** 2\ **Last updated:** [December 14, 2018, 8:00am UTC](https://discuss.elastic.co/t/xpack-classnotfoundexception-com-unboundid-util-debug-in-java/160852 "2018-12-14T08:00:49Z")
I m using Elasticsearch 6.3.1 and xpack 6.3.1,here is the Exception in my project Caused by: java.lang.RuntimeException: java.lang.ClassNotFoundException: com.unboundid.util.Debug at org.elasticsearch.xpack.core.XPack… --- ## [Filebeat -\> kafka - \> logstash no output](https://discuss.elastic.co/t/filebeat-kafka-logstash-no-output/90552)
**Author:** [@pashmina](https://discuss.elastic.co/u/pashmina)\ **Replies:** 2\ **Last updated:** [June 27, 2017, 6:01pm UTC](https://discuss.elastic.co/t/filebeat-kafka-logstash-no-output/90552 "2017-06-27T18:01:28Z")
Hi, I am trying to read apache-access log file via filebeat and send it to kafka topic. The kafka topic is used as input to logstash as follows. input { kafka { bootstrap\_servers =\> "localhost… --- ## [Problem with S3 as Input](https://discuss.elastic.co/t/problem-with-s3-as-input/38280)
**Author:** [@Nitz](https://discuss.elastic.co/u/Nitz)\ **Replies:** 2\ **Last updated:** [February 7, 2017, 1:41pm UTC](https://discuss.elastic.co/t/problem-with-s3-as-input/38280 "2017-02-07T13:41:10Z")
Hi all, I'm having the following configuration: input { s3 { type =\> "cloudtrail" bucket =\> $BUCKET\_NAME prefix =\> $PREFIX access\_key\_id =\> $ACCESS\_KEY\_ID secret\_access\_key =\> $SECRET region… --- ## [Best design for product attributes](https://discuss.elastic.co/t/best-design-for-product-attributes/46854)
**Author:** [@zuninet](https://discuss.elastic.co/u/zuninet)\ **Replies:** 2\ **Last updated:** [April 9, 2016, 1:30pm UTC](https://discuss.elastic.co/t/best-design-for-product-attributes/46854 "2016-04-09T13:30:27Z")
I'm indexing products who have myriad of attributes with different types, my first iteration was to store the attributes as a nested type and put the attribute name in a field called key and the value in a field called v… --- ## [SearchParseException JS client](https://discuss.elastic.co/t/searchparseexception-js-client/26532)
**Author:** [@jbbush](https://discuss.elastic.co/u/jbbush)\ **Replies:** 2\ **Last updated:** [October 30, 2015, 8:54am UTC](https://discuss.elastic.co/t/searchparseexception-js-client/26532 "2015-10-30T08:54:03Z")
I'm working on a JS client and having issues querying my index. I can use CURL to query it but my JS client fails to parse the query and I get the exception below. What am I doing wrong? Version1: client.search( {… --- ## [Failed to send release search context - SourceLookup fetching cost (?)](https://discuss.elastic.co/t/failed-to-send-release-search-context-sourcelookup-fetching-cost/17753)
**Author:** [@Mateusz\_Kaczynski](https://discuss.elastic.co/u/Mateusz_Kaczynski)\ **Replies:** 2\ **Last updated:** [May 29, 2014, 9:57am UTC](https://discuss.elastic.co/t/failed-to-send-release-search-context-sourcelookup-fetching-cost/17753 "2014-05-29T09:57:00Z")
We have recently changed some of our code to include additional call to SourceLookup.extractValue(path) in fetch stage. Soon after, we have started experiencing some issues with search stability (with some of our sea… --- ## [Logstash 8.x ecs.compatibility mode adds event.original](https://discuss.elastic.co/t/logstash-8-x-ecs-compatibility-mode-adds-event-original/307654)
**Author:** [@bernhard.fluehmann](https://discuss.elastic.co/u/bernhard.fluehmann)\ **Replies:** 0\ **Last updated:** [June 20, 2022, 1:05pm UTC](https://discuss.elastic.co/t/logstash-8-x-ecs-compatibility-mode-adds-event-original/307654 "2022-06-20T13:05:42Z")
As already discussed in a previous thread, logstash in ecs.compatibility mode adds the event.original field to all events. The proposed solution was to turn off ecs.compatibility. The problem is that disabling ecs.compa… --- ## [Failed to start Logstash - S3 output plugin is not working](https://discuss.elastic.co/t/failed-to-start-logstash-s3-output-plugin-is-not-working/330096)
**Author:** [@WonhyeongCho](https://discuss.elastic.co/u/WonhyeongCho)\ **Replies:** 4\ **Last updated:** [April 27, 2023, 1:46pm UTC](https://discuss.elastic.co/t/failed-to-start-logstash-s3-output-plugin-is-not-working/330096 "2023-04-27T13:46:17Z")
Hi. I'm using Logstash. I recently upgraded Logstash to version 8.7.0, but it's not working. I'm getting an error message. Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:OSQUERY, :excep… --- ## [User with manage\_own\_api\_key - Best Practices (Security)](https://discuss.elastic.co/t/user-with-manage-own-api-key-best-practices-security/288559)
**Author:** [@inf](https://discuss.elastic.co/u/inf)\ **Replies:** 4\ **Last updated:** [November 8, 2021, 9:05am UTC](https://discuss.elastic.co/t/user-with-manage-own-api-key-best-practices-security/288559 "2021-11-08T09:05:09Z")
Hi, I have been using the default elastic user to create API keys. However, I do not think that this is a good security practice (please correct me if I'm wrong). Hence, I'm not sure how do others normally create API … --- ## [Import mapping via index template](https://discuss.elastic.co/t/import-mapping-via-index-template/267393)
**Author:** [@Voula\_Mikr](https://discuss.elastic.co/u/Voula_Mikr)\ **Replies:** 4\ **Last updated:** [March 24, 2021, 6:52pm UTC](https://discuss.elastic.co/t/import-mapping-via-index-template/267393 "2021-03-24T18:52:06Z")
I want to import an index template with a mapping for the fields of the index pmdata\* in order to set as type of the field counter\_value float. After the import of the template with counter\_value type float, I imported … --- ## [Log Messages despite recording=false and instrument=false](https://discuss.elastic.co/t/log-messages-despite-recording-false-and-instrument-false/238475)
**Author:** [@sopgreg](https://discuss.elastic.co/u/sopgreg)\ **Replies:** 4\ **Last updated:** [July 3, 2020, 6:24am UTC](https://discuss.elastic.co/t/log-messages-despite-recording-false-and-instrument-false/238475 "2020-07-03T06:24:07Z")
APM Agent language and version: Java, 1.17 Description of the problem including expected versus actual behavior. Please include screenshots (if relevant): Starting JBoss with -javaagent with recording = false and instr… [Previous page](https://discuss.elastic.co/top.md?page=1347&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=1349&per_page=50&period=all)