# Top **URL:** https://discuss.elastic.co/top.md?page=154&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 155 --- ## [Using RabbitMq as broker between Beats and Logstash](https://discuss.elastic.co/t/using-rabbitmq-as-broker-between-beats-and-logstash/359302)
**Author:** [@NasrJBr](https://discuss.elastic.co/u/NasrJBr)\ **Replies:** 27\ **Last updated:** [May 19, 2024, 12:39pm UTC](https://discuss.elastic.co/t/using-rabbitmq-as-broker-between-beats-and-logstash/359302 "2024-05-19T12:39:03Z")
Hello, I’ve created an architecture for a SIEM using ELK. In this architecture, I’ve used a RabbitMQ broker between Beats and Logstash. Is it a good choice? My final target is to collect logs from at least 1000 Beats and… --- ## [Calculate a delta between two time slices](https://discuss.elastic.co/t/calculate-a-delta-between-two-time-slices/307411)
**Author:** [@Kohlman](https://discuss.elastic.co/u/Kohlman)\ **Replies:** 9\ **Last updated:** [June 24, 2022, 3:50pm UTC](https://discuss.elastic.co/t/calculate-a-delta-between-two-time-slices/307411 "2022-06-24T15:50:26Z")
Is there a visualization that can calculate a delta between to two most recent records or any two time slices for that matter. Specifically we have metricbeat data from SQL server. Many of the metrics we extract are cumu… --- ## [Watcher Beta key reporting as expired](https://discuss.elastic.co/t/watcher-beta-key-reporting-as-expired/1012)
**Author:** [@jdaviscooke](https://discuss.elastic.co/u/jdaviscooke)\ **Replies:** 9\ **Last updated:** [May 25, 2015, 5:32pm UTC](https://discuss.elastic.co/t/watcher-beta-key-reporting-as-expired/1012 "2015-05-25T17:32:03Z")
I received my Watcher beta key this afternoon after the webinar, but after I followed the installation instructions in the Get Started page provided and tried to hit the API, I am met with LicenseExpiredException\[license… --- ## [Logstash: Input from SQS does not get inserted to InfluxDB](https://discuss.elastic.co/t/logstash-input-from-sqs-does-not-get-inserted-to-influxdb/174996)
**Author:** [@smchae](https://discuss.elastic.co/u/smchae)\ **Replies:** 20\ **Last updated:** [April 4, 2019, 8:14am UTC](https://discuss.elastic.co/t/logstash-input-from-sqs-does-not-get-inserted-to-influxdb/174996 "2019-04-04T08:14:31Z")
I am trying to insert data to InfluxDB using Logstash with input method SQS: I send message to Sqs and Logstash reads the messages from Sqs and tries to put data to InfluxDB. I have set logstash like below, however, the… --- ## [Logstash Translate Dictionary not working](https://discuss.elastic.co/t/logstash-translate-dictionary-not-working/233420)
**Author:** [@AliMalik](https://discuss.elastic.co/u/AliMalik)\ **Replies:** 16\ **Last updated:** [May 21, 2020, 1:41am UTC](https://discuss.elastic.co/t/logstash-translate-dictionary-not-working/233420 "2020-05-21T01:41:29Z")
Hi All, I need some help. I am trying to use a translate filter in logstash to translate winlog.event\_data.AccessList value to some meaningful field but it's not working. below is my code in the filter file. Looks like … --- ## [Query for null?](https://discuss.elastic.co/t/query-for-null/3129)
**Author:** [@bailey](https://discuss.elastic.co/u/bailey)\ **Replies:** 11\ **Last updated:** [October 22, 2010, 4:57pm UTC](https://discuss.elastic.co/t/query-for-null/3129 "2010-10-22T16:57:23Z")
Hi All- What is the correct method to search for an attribute that is a null value? I'm attempting to search across 3 fields: query\_string : { query : "rootId:123 AND type:discussion AND p… --- ## [How can I see monitoring on kibana?](https://discuss.elastic.co/t/how-can-i-see-monitoring-on-kibana/281804)
**Author:** [@lisiyu](https://discuss.elastic.co/u/lisiyu)\ **Replies:** 10\ **Last updated:** [August 26, 2021, 12:43pm UTC](https://discuss.elastic.co/t/how-can-i-see-monitoring-on-kibana/281804 "2021-08-26T12:43:31Z")
I can't see monitoring page on kibana.How to fix it ? kibana version : 7.13.1 kibana.yaml xpack.monitoring.enabled: true xpack.monitoring.kibana.collection.enabled: true kibana show err: I try to install monitoring … --- ## [Cannot get date math to work properly in Elasticsearch](https://discuss.elastic.co/t/cannot-get-date-math-to-work-properly-in-elasticsearch/193655)
**Author:** [@jgorlin](https://discuss.elastic.co/u/jgorlin)\ **Replies:** 10\ **Last updated:** [August 13, 2019, 3:53pm UTC](https://discuss.elastic.co/t/cannot-get-date-math-to-work-properly-in-elasticsearch/193655 "2019-08-13T15:53:43Z")
Hi Team, I've bene struggling for hours on what seems to me should be a very basic search. I'm trying to find all documents that have a date within the last 7 days: GET date\_test/\_search { "query": { "range": { … --- ## [Winlogbeat 7.15.1 with sysmon missing fields task and message on Windows Server 2022](https://discuss.elastic.co/t/winlogbeat-7-15-1-with-sysmon-missing-fields-task-and-message-on-windows-server-2022/289675)
**Author:** [@sytser](https://discuss.elastic.co/u/sytser)\ **Replies:** 9\ **Last updated:** [December 1, 2021, 6:55am UTC](https://discuss.elastic.co/t/winlogbeat-7-15-1-with-sysmon-missing-fields-task-and-message-on-windows-server-2022/289675 "2021-12-01T06:55:39Z")
The issue is that on a Windows Server 2022 version with Winlogbeat v7.15.1 and Sysmon v13.24. Some how on Windows Server 2022 Winlogbeat doesn't send the fields task and message to Logstash v7.15.2. If we use the same … --- ## [Unassigned shard with inconsistent primary state and doc count differences](https://discuss.elastic.co/t/unassigned-shard-with-inconsistent-primary-state-and-doc-count-differences/203847)
**Author:** [@johnfzc](https://discuss.elastic.co/u/johnfzc)\ **Replies:** 16\ **Last updated:** [October 17, 2019, 7:49pm UTC](https://discuss.elastic.co/t/unassigned-shard-with-inconsistent-primary-state-and-doc-count-differences/203847 "2019-10-17T19:49:16Z")
I have a three node ES cluster running 5.6.5. Last week I restarted the servers in the cluster to make changes to their disk configuration, I did not follow any process to do this but after 12 hours the cluster and index… --- ## [Set up minimal security elasticsearch failed](https://discuss.elastic.co/t/set-up-minimal-security-elasticsearch-failed/270356)
**Author:** [@alipujaistopo](https://discuss.elastic.co/u/alipujaistopo)\ **Replies:** 15\ **Last updated:** [April 23, 2021, 9:36pm UTC](https://discuss.elastic.co/t/set-up-minimal-security-elasticsearch-failed/270356 "2021-04-23T21:36:08Z")
i try setup minimal security in here Set up minimal security for Elasticsearch | Elasticsearch Guide \[7.12\] | Elastic but still failed, and this the complete log i had. i will separate in 7 parts. please help why? \[20… --- ## [Search query working in One environment and not in another](https://discuss.elastic.co/t/search-query-working-in-one-environment-and-not-in-another/139516)
**Author:** [@mohammedEssabri](https://discuss.elastic.co/u/mohammedEssabri)\ **Replies:** 15\ **Last updated:** [August 7, 2018, 1:37pm UTC](https://discuss.elastic.co/t/search-query-working-in-one-environment-and-not-in-another/139516 "2018-08-07T13:37:07Z")
Dear team, --- ## [Upgrading from 6.6.8 to 7.5.0 having all sorts of problems - Please help](https://discuss.elastic.co/t/upgrading-from-6-6-8-to-7-5-0-having-all-sorts-of-problems-please-help/211407)
**Author:** [@happycampo](https://discuss.elastic.co/u/happycampo)\ **Replies:** 14\ **Last updated:** [December 12, 2019, 12:52pm UTC](https://discuss.elastic.co/t/upgrading-from-6-6-8-to-7-5-0-having-all-sorts-of-problems-please-help/211407 "2019-12-12T12:52:08Z")
Right now my PRODUCTION instance of this is down... Any help would be greatly appreciated. I'm running with docker containers on separate vms. I inherited it and I have upgraded it in the past from 5x to 6.6.1. I just… --- ## [FieldStats support](https://discuss.elastic.co/t/fieldstats-support/107144)
**Author:** [@gphadke](https://discuss.elastic.co/u/gphadke)\ **Replies:** 10\ **Last updated:** [December 6, 2017, 8:51am UTC](https://discuss.elastic.co/t/fieldstats-support/107144 "2017-12-06T08:51:46Z")
Hello FieldStats is removed in ES 6.0. Wanted to know if the functionality is provided by any other API or combination of APIs. We have been using it to filter numbers of indices to search which store time series data.… --- ## [Beats behaviour](https://discuss.elastic.co/t/beats-behaviour/51875)
**Author:** [@Igor\_Dementyeff](https://discuss.elastic.co/u/Igor_Dementyeff)\ **Replies:** 10\ **Last updated:** [June 10, 2016, 10:18am UTC](https://discuss.elastic.co/t/beats-behaviour/51875 "2016-06-10T10:18:58Z")
Hello all. I got a very strange problem with the Kibana and I honestly don't know where to search... So the overview is this: Kibana server with topbeat, packetbeat and filebeat running Once in a day, or 2 days, filebeat… --- ## [Getting Error While creating Watcher execution!](https://discuss.elastic.co/t/getting-error-while-creating-watcher-execution/124214)
**Author:** [@naveen\_K.N](https://discuss.elastic.co/u/naveen_K.N)\ **Replies:** 12\ **Last updated:** [March 22, 2018, 3:34am UTC](https://discuss.elastic.co/t/getting-error-while-creating-watcher-execution/124214 "2018-03-22T03:34:04Z")
Hi Elastic search Team, someone please explain why im getting "No handler found for uri \[/\_xpack/watcher/watch/prod-SL3b\_jvm\_memkpi/\_execute;\] and method \[POST\]" while trying to execute watcher created ?? Thanks in adv… --- ## [Logstash vs rsyslog java stack multiline issue](https://discuss.elastic.co/t/logstash-vs-rsyslog-java-stack-multiline-issue/97557)
**Author:** [@Marcello\_A](https://discuss.elastic.co/u/Marcello_A)\ **Replies:** 12\ **Last updated:** [August 21, 2017, 9:20am UTC](https://discuss.elastic.co/t/logstash-vs-rsyslog-java-stack-multiline-issue/97557 "2017-08-21T09:20:18Z")
Hi All, Does someone configure a multiline event starting from rsyslog messages? We tried to implement a catch all logstash instance for all the messages forwarded by docker daemons via syslog but we can’t parse the mul… --- ## [ES crashing multiple times, over 1Billion docs a day, indexing rate falling from 25k/s to 2k/s](https://discuss.elastic.co/t/es-crashing-multiple-times-over-1billion-docs-a-day-indexing-rate-falling-from-25k-s-to-2k-s/184628)
**Author:** [@yvreddy](https://discuss.elastic.co/u/yvreddy)\ **Replies:** 9\ **Last updated:** [June 12, 2019, 12:20pm UTC](https://discuss.elastic.co/t/es-crashing-multiple-times-over-1billion-docs-a-day-indexing-rate-falling-from-25k-s-to-2k-s/184628 "2019-06-12T12:20:44Z")
GET / output: { "name": "es-ingest-3", "cluster\_name": "ct", "cluster\_uuid": "IED4OO5CR6ur7ZCRNmfWEg", "version": { "number": "6.1.2", "build\_hash": "5b1fea5", "build\_date": "2018-01-10T02:35:59.208… --- ## [Filebeat cannot setup](https://discuss.elastic.co/t/filebeat-cannot-setup/272305)
**Author:** [@alipujaistopo](https://discuss.elastic.co/u/alipujaistopo)\ **Replies:** 13\ **Last updated:** [May 10, 2021, 3:11am UTC](https://discuss.elastic.co/t/filebeat-cannot-setup/272305 "2021-05-10T03:11:50Z")
i wanna setup my filebeat but i have a report like this \[root@bdi-uat-splunkes filebeat\]# filebeat setup Exiting: couldn't connect to any of the configured Elasticsearch hosts. Errors: \[error connecting to Elasticsearch… --- ## [Scaling up for petabyte sizes?](https://discuss.elastic.co/t/scaling-up-for-petabyte-sizes/130047)
**Author:** [@lvic](https://discuss.elastic.co/u/lvic)\ **Replies:** 13\ **Last updated:** [May 4, 2018, 8:03pm UTC](https://discuss.elastic.co/t/scaling-up-for-petabyte-sizes/130047 "2018-05-04T20:03:03Z")
Had a performance problem: ES queries become really slow when dataset size grew to several petabytes... What approach can I use to scale up for larger datasets while preserving original data? For example: is it possible … --- ## [Best pratices for Ops guys](https://discuss.elastic.co/t/best-pratices-for-ops-guys/11997)
**Author:** [@Alexis\_Okuwa](https://discuss.elastic.co/u/Alexis_Okuwa)\ **Replies:** 10\ **Last updated:** [May 20, 2013, 3:09am UTC](https://discuss.elastic.co/t/best-pratices-for-ops-guys/11997 "2013-05-20T03:09:43Z")
I really been looking for one place that gives some great config settings changes suggestions for us ops guys and how to setup an elasticsearch cluster cpu to shard ratios how many replicas to have. IOPS to disk size… --- ## [Two copy of one log](https://discuss.elastic.co/t/two-copy-of-one-log/91139)
**Author:** [@erion](https://discuss.elastic.co/u/erion)\ **Replies:** 12\ **Last updated:** [June 30, 2017, 1:57pm UTC](https://discuss.elastic.co/t/two-copy-of-one-log/91139 "2017-06-30T13:57:13Z")
Hi, when i upload a string of apache log in kibana i see one with real timestamp and the same string with timestamp of uploaded . I use the mapping founded on github here https://github.com/elastic/examples/tree/master/… --- ## [Service doesn't process log but command line works](https://discuss.elastic.co/t/service-doesnt-process-log-but-command-line-works/130903)
**Author:** [@Michael3](https://discuss.elastic.co/u/Michael3)\ **Replies:** 9\ **Last updated:** [May 9, 2018, 4:33pm UTC](https://discuss.elastic.co/t/service-doesnt-process-log-but-command-line-works/130903 "2018-05-09T16:33:34Z")
I am hoping someone would have some suggestions on this because so far I've got nothing. I have a pattern that works in logstash 5.6 on centos 7, but not on centos 6 when run as a service. Run from the command line as … --- ## [Test Rest API through python](https://discuss.elastic.co/t/test-rest-api-through-python/357531)
**Author:** [@navya\_k](https://discuss.elastic.co/u/navya_k)\ **Replies:** 23\ **Last updated:** [May 3, 2024, 2:57pm UTC](https://discuss.elastic.co/t/test-rest-api-through-python/357531 "2024-05-03T14:57:47Z")
We have Elastic search cluster with thousands of applications. We would like to read logs through python script from elastic cluster. Use Cases : Get logs of last 1 hour or 1 day If it has error 500 or 404 We would l… --- ## [Cluster block](https://discuss.elastic.co/t/cluster-block/190231)
**Author:** [@amitavmohanty01](https://discuss.elastic.co/u/amitavmohanty01)\ **Replies:** 13\ **Last updated:** [July 16, 2019, 12:46pm UTC](https://discuss.elastic.co/t/cluster-block/190231 "2019-07-16T12:46:01Z")
We are getting cluster block exception way before our watermark is reached. \[2019-07-12T00:31:30,354\]\[WARN \]\[o.e.x.m.e.l.LocalExporter\] \[elkcoord02.ytz0\] unexpected error while indexing monitoring document org.elasticse… --- ## [Can't enroll MacOS agent](https://discuss.elastic.co/t/cant-enroll-macos-agent/283601)
**Author:** [@hilt86](https://discuss.elastic.co/u/hilt86)\ **Replies:** 11\ **Last updated:** [October 13, 2021, 9:05pm UTC](https://discuss.elastic.co/t/cant-enroll-macos-agent/283601 "2021-10-13T21:05:38Z")
Me again..I'm trying to enroll a macOS agent and when I run the enroll command I get the following : Error: fail to enroll: fail to execute request to fleet-server: fail to decode enrollment response: context canceled E… --- ## [Config not working for logstash 2](https://discuss.elastic.co/t/config-not-working-for-logstash-2/33520)
**Author:** [@imad](https://discuss.elastic.co/u/imad)\ **Replies:** 11\ **Last updated:** [November 2, 2015, 6:05pm UTC](https://discuss.elastic.co/t/config-not-working-for-logstash-2/33520 "2015-11-02T18:05:07Z")
Hi, Can someone show me whats wrong with the config here. I am trying to convert my logstast 1.5.4 config to logstash 2. When I run it with --configtest flag, I get message 'Configuration is Ok'. and when I run the log… --- ## [Execute a custom SQL query using mysql metricbeat module](https://discuss.elastic.co/t/execute-a-custom-sql-query-using-mysql-metricbeat-module/125960)
**Author:** [@firstpostcommenter](https://discuss.elastic.co/u/firstpostcommenter)\ **Replies:** 9\ **Last updated:** [April 10, 2018, 6:21pm UTC](https://discuss.elastic.co/t/execute-a-custom-sql-query-using-mysql-metricbeat-module/125960 "2018-04-10T18:21:03Z")
Hi, I want to run a custom SQL query (to get the count of records in a table) using mysql metricbeat module. Is this possible? If this is not possible, then I want to create a custom metricset in mysql metricbeat modul… --- ## [Auto Update logs without running logstash](https://discuss.elastic.co/t/auto-update-logs-without-running-logstash/104855)
**Author:** [@Samreen\_Zeeshan](https://discuss.elastic.co/u/Samreen_Zeeshan)\ **Replies:** 9\ **Last updated:** [October 30, 2017, 11:31am UTC](https://discuss.elastic.co/t/auto-update-logs-without-running-logstash/104855 "2017-10-30T11:31:09Z")
I have logs stored in a MS SQL table and i have migrated all logs by running logstash once. Now what i want is if i update a particular record in SQL table that should be reflected in Kibana visualizations without resta… --- ## [\] \[data\_node\_1\] not enough master nodes discovered during pinging (found \[\[\]\], but needed \[1\]), pinging again](https://discuss.elastic.co/t/data-node-1-not-enough-master-nodes-discovered-during-pinging-found-but-needed-1-pinging-again/215291)
**Author:** [@nidhi1](https://discuss.elastic.co/u/nidhi1)\ **Replies:** 18\ **Last updated:** [January 21, 2020, 10:09am UTC](https://discuss.elastic.co/t/data-node-1-not-enough-master-nodes-discovered-during-pinging-found-but-needed-1-pinging-again/215291 "2020-01-21T10:09:53Z")
Hi I have two two node cluster on red hat Enterprise Linux server . Both nodes are running on different different server. when i run elastic search for the server having data node ,getting such error --- ## [Embedded ElasticSearch On Java](https://discuss.elastic.co/t/embedded-elasticsearch-on-java/6032)
**Author:** [@samCougars](https://discuss.elastic.co/u/samCougars)\ **Replies:** 18\ **Last updated:** [August 13, 2014, 10:07am UTC](https://discuss.elastic.co/t/embedded-elasticsearch-on-java/6032 "2014-08-13T10:07:24Z")
All I have a webapp (JAVA) with a list of items on the page. All these items are generated on html with session variables. I want to use ElasticSearch on the back end to do a search for items with different search … --- ## [Lots of Garbage collection logs in elasticsearch 5.6](https://discuss.elastic.co/t/lots-of-garbage-collection-logs-in-elasticsearch-5-6/225391)
**Author:** [@kayshu](https://discuss.elastic.co/u/kayshu)\ **Replies:** 11\ **Last updated:** [April 15, 2020, 6:22am UTC](https://discuss.elastic.co/t/lots-of-garbage-collection-logs-in-elasticsearch-5-6/225391 "2020-04-15T06:22:34Z")
Hi, I am seeing a lot of gc overhead spent messages in the logs of a single node ES, there's also a log with total \[858ms\]/\[21.7m\]. How do I read these GCMonitor logs? What does this total \[858ms\]/\[21.7m\] means ?, What … --- ## [Sending files to logstash with Ruby](https://discuss.elastic.co/t/sending-files-to-logstash-with-ruby/71882)
**Author:** [@sjc07](https://discuss.elastic.co/u/sjc07)\ **Replies:** 11\ **Last updated:** [January 18, 2017, 9:50am UTC](https://discuss.elastic.co/t/sending-files-to-logstash-with-ruby/71882 "2017-01-18T09:50:46Z")
I am working on some code to send a number of files from a series of folders to logstash to be filtered and then added to elasticsearch. I have some Ruby code that identifies the log file type and I then want to send it … --- ## [Creating two node cluster in elasticsearch](https://discuss.elastic.co/t/creating-two-node-cluster-in-elasticsearch/196087)
**Author:** [@Ayush\_Verma](https://discuss.elastic.co/u/Ayush_Verma)\ **Replies:** 13\ **Last updated:** [August 29, 2019, 7:41am UTC](https://discuss.elastic.co/t/creating-two-node-cluster-in-elasticsearch/196087 "2019-08-29T07:41:35Z")
I have two instances of gcp and both have elasticsearch 7.3 installed on it master node also have kibana 7.3 installed on the same machine, i have set same cluster name for both the nodes declare one as master and one as… --- ## [Cross-cluster search questions](https://discuss.elastic.co/t/cross-cluster-search-questions/222379)
**Author:** [@alexpanas](https://discuss.elastic.co/u/alexpanas)\ **Replies:** 9\ **Last updated:** [March 10, 2020, 12:05am UTC](https://discuss.elastic.co/t/cross-cluster-search-questions/222379 "2020-03-10T00:05:24Z")
Hello, We are trying to replace our tribe nodes setup with cross-cluster search setup and we have multiple questions regarding the general configuration and monitoring of cross-cluster-search cluster. Unfortunately the… --- ## [Kibana dashboard to limited anonymous user](https://discuss.elastic.co/t/kibana-dashboard-to-limited-anonymous-user/338086)
**Author:** [@sunny2502](https://discuss.elastic.co/u/sunny2502)\ **Replies:** 11\ **Last updated:** [August 2, 2023, 9:16am UTC](https://discuss.elastic.co/t/kibana-dashboard-to-limited-anonymous-user/338086 "2023-08-02T09:16:24Z")
Hi I want my dashboard to be viewable to limited no of users, but I dont want them to get into login page. Can it be done? I know kibana support anonymous authentication but that will open my dashboard for public which… --- ## [No JVMs were found APM](https://discuss.elastic.co/t/no-jvms-were-found-apm/318177)
**Author:** [@User28](https://discuss.elastic.co/u/User28)\ **Replies:** 9\ **Last updated:** [November 9, 2022, 9:02pm UTC](https://discuss.elastic.co/t/no-jvms-were-found-apm/318177 "2022-11-09T21:02:24Z")
Hi, Elasticsearch - v7.17.4 Kibana - v7.17.4 APM Server - v7.17.4 Opentelemetry agent - v1.11.0 In Kibana APM JVM UI, it says No JVMs were found service.node.name is also set We have sending observability da… --- ## [Canvas conditional statement](https://discuss.elastic.co/t/canvas-conditional-statement/270495)
**Author:** [@accateo](https://discuss.elastic.co/u/accateo)\ **Replies:** 9\ **Last updated:** [April 19, 2021, 6:24pm UTC](https://discuss.elastic.co/t/canvas-conditional-statement/270495 "2021-04-19T18:24:15Z")
Hi, Is it possible to add, on the canvas, an element that, based on the value of a field of an index, shows an image instead of another? Thank you --- ## [Aggregate filter plugin](https://discuss.elastic.co/t/aggregate-filter-plugin/119632)
**Author:** [@scch](https://discuss.elastic.co/u/scch)\ **Replies:** 10\ **Last updated:** [February 20, 2018, 3:49pm UTC](https://discuss.elastic.co/t/aggregate-filter-plugin/119632 "2018-02-20T15:49:10Z")
occurred\_on Bytes\_Out user\_id 2017-12-31T10:25:49.000-0600 1718 ts2341 2017-12-31T10:25:08.000-0600 1070 ts2341 2017-12-31T10:25:08.000-0600 355 ts2341 2017-12-29T16:55:01.000-0600 255 gs2121 2017-12-29T1… --- ## [Dissector mapping field not found in event](https://discuss.elastic.co/t/dissector-mapping-field-not-found-in-event/279179)
**Author:** [@gongon](https://discuss.elastic.co/u/gongon)\ **Replies:** 13\ **Last updated:** [July 21, 2021, 6:59am UTC](https://discuss.elastic.co/t/dissector-mapping-field-not-found-in-event/279179 "2021-07-21T06:59:16Z")
Hi, I used the dissect filter and it worked .Now it does not. The only change is the upgrate of mac Os Catalina to mac OS Big Sur v 11.4 A message is displayed : Dissector mapping field not found in event Could you … --- ## [Snapshot and restore source only feature](https://discuss.elastic.co/t/snapshot-and-restore-source-only-feature/240881)
**Author:** [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Replies:** 15\ **Last updated:** [July 13, 2020, 4:38am UTC](https://discuss.elastic.co/t/snapshot-and-restore-source-only-feature/240881 "2020-07-13T04:38:55Z")
Hi all i recently trying the snapshot feature in elastic and i noticed the feature source only button there, according to what i have read the source only will only save the metadata and the field of the index and nothi… --- ## [Logstash monitoring BB-Server Logs](https://discuss.elastic.co/t/logstash-monitoring-bb-server-logs/31457)
**Author:** [@lukas\_meier](https://discuss.elastic.co/u/lukas_meier)\ **Replies:** 15\ **Last updated:** [October 1, 2015, 1:53pm UTC](https://discuss.elastic.co/t/logstash-monitoring-bb-server-logs/31457 "2015-10-01T13:53:36Z")
hi my mission it is to monitor a Blackberry (BES) Server with logstash i got 3 types of Logfiles on BES-Server to parse, core, mdat and disp logfile-types, but they save wrong into ES, with 2 types it was more easier, bu… --- ## [Scheduled Watcher Tasks Failing](https://discuss.elastic.co/t/scheduled-watcher-tasks-failing/177336)
**Author:** [@ccampbell](https://discuss.elastic.co/u/ccampbell)\ **Replies:** 13\ **Last updated:** [May 14, 2019, 2:26pm UTC](https://discuss.elastic.co/t/scheduled-watcher-tasks-failing/177336 "2019-05-14T14:26:23Z")
I've just completed an upgrade to 6.7.0 (for Elasticsearch, Logstash, and Kibana), but my scheduled watches are not running correctly. These watches worked under 6.4.0 (although I had to start and stop the watcher servic… --- ## [Custom normalisation and filtering?](https://discuss.elastic.co/t/custom-normalisation-and-filtering/3882)
**Author:** [@Barsk](https://discuss.elastic.co/u/Barsk)\ **Replies:** 9\ **Last updated:** [February 8, 2011, 11:41am UTC](https://discuss.elastic.co/t/custom-normalisation-and-filtering/3882 "2011-02-08T11:41:59Z")
I have spent the last day or so trying to get my head around how normalization is done in ElasticSearch and how to customize it for my needs. I am responsible for a webbappliction that i… --- ## [Elastic search dynamic number of replicas from Java API](https://discuss.elastic.co/t/elastic-search-dynamic-number-of-replicas-from-java-api/18563)
**Author:** [@goncalo\_luiz](https://discuss.elastic.co/u/goncalo_luiz)\ **Replies:** 20\ **Last updated:** [August 25, 2014, 9:49am UTC](https://discuss.elastic.co/t/elastic-search-dynamic-number-of-replicas-from-java-api/18563 "2014-08-25T09:49:02Z")
Hi all, I'm considering using elasticsearch as a repository for a PoC I'm currently developing. This PoC models an application that needs durability but not isolability, so I'm fine with the eventual consisten… --- ## [Sharing my rule update experience on Elastic Security Serverless](https://discuss.elastic.co/t/sharing-my-rule-update-experience-on-elastic-security-serverless/389853)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 15\ **Last updated:** [October 10, 2026, 10:13am UTC](https://discuss.elastic.co/t/sharing-my-rule-update-experience-on-elastic-security-serverless/389853 "2026-10-10T10:13:12Z")
Hello, Just sharing my experience updating Elastic prebuilt Security rules after being away for about 1.5 months. When I logged back in, I had roughly 1,200 rule updates waiting. That is fine in itself - I clicked Upda… --- ## [Refreshing the access token when communicating with an API](https://discuss.elastic.co/t/refreshing-the-access-token-when-communicating-with-an-api/25384)
**Author:** [@rmarji](https://discuss.elastic.co/u/rmarji)\ **Replies:** 10\ **Last updated:** [December 3, 2021, 9:05am UTC](https://discuss.elastic.co/t/refreshing-the-access-token-when-communicating-with-an-api/25384 "2021-12-03T09:05:26Z")
I'm trying to use Http\_poller input plugin, to get results from an API, it works fine while the access token is valid, however its only valid for one hour, I want to be able to refresh the access token with the refresh t… --- ## [Elastic Agent Fortinet Module 7 Hours Delay Log](https://discuss.elastic.co/t/elastic-agent-fortinet-module-7-hours-delay-log/311034)
**Author:** [@godhand](https://discuss.elastic.co/u/godhand)\ **Replies:** 14\ **Last updated:** [August 2, 2022, 1:47am UTC](https://discuss.elastic.co/t/elastic-agent-fortinet-module-7-hours-delay-log/311034 "2022-08-02T01:47:33Z")
Hello, I've installed the Fleet Server, Elastic Agent, and Fortinet module integration. But the log from FortiGate to elastic has a delay of 7 hours. I looked at the logs via Observability -\> Logs -\> Stream, and Analytic… --- ## [Aggregate multiple nested (recursive) logstash](https://discuss.elastic.co/t/aggregate-multiple-nested-recursive-logstash/275621)
**Author:** [@maxi99](https://discuss.elastic.co/u/maxi99)\ **Replies:** 10\ **Last updated:** [June 14, 2021, 1:03pm UTC](https://discuss.elastic.co/t/aggregate-multiple-nested-recursive-logstash/275621 "2021-06-14T13:03:05Z")
I am using logstash with input jdbc, and would like to embed one object inside another with aggregate. How can I use add recursive? Ie add an object inside another object? My jdbc input would return output similar (as … --- ## [Broke login to kibana](https://discuss.elastic.co/t/broke-login-to-kibana/321334)
**Author:** [@ant2ne](https://discuss.elastic.co/u/ant2ne)\ **Replies:** 11\ **Last updated:** [December 19, 2022, 8:12pm UTC](https://discuss.elastic.co/t/broke-login-to-kibana/321334 "2022-12-19T20:12:20Z")
after doing the minimal security configuration (Built-in users | Elasticsearch Guide \[8.5\] | Elastic) I can no longer log into the kibana webui. the login of the webpage loads, but doesn't accept kibanaadmin and its pass… [Previous page](https://discuss.elastic.co/top.md?page=153&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=155&per_page=50&period=all)