# Top **URL:** https://discuss.elastic.co/top.md?page=158&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 159 --- ## [Need help with adding geoip to syslog and then how to visualize... -](https://discuss.elastic.co/t/need-help-with-adding-geoip-to-syslog-and-then-how-to-visualize/209113)
**Author:** [@Cdnvballer](https://discuss.elastic.co/u/Cdnvballer)\ **Replies:** 12\ **Last updated:** [November 27, 2019, 1:43am UTC](https://discuss.elastic.co/t/need-help-with-adding-geoip-to-syslog-and-then-how-to-visualize/209113 "2019-11-27T01:43:47Z")
Hi, i'm receiving network device syslog via filebeats - works fine, using default syslog filter grok { match =\> { "message" =\> \["%{SYSLOGTIMESTAMP:\[system\]\[syslog\]\[timestamp\]} %{SYSLOGHOST:\[system\]\[syslog\]\[hostname\]} … --- ## [Scripted field return value on same order than original](https://discuss.elastic.co/t/scripted-field-return-value-on-same-order-than-original/265950)
**Author:** [@Jose\_Manuel\_Tirado](https://discuss.elastic.co/u/Jose_Manuel_Tirado)\ **Replies:** 14\ **Last updated:** [March 8, 2021, 12:33pm UTC](https://discuss.elastic.co/t/scripted-field-return-value-on-same-order-than-original/265950 "2021-03-08T12:33:34Z")
I am trying to create a scripted field to be able to fetch me the first value of a certain field. I find the problem in that when it returns the values ​​of the field, and I save them in path, it sorts them alphabetical… --- ## [7 Node Cluster with 3 dedicated master and 4 data nodes](https://discuss.elastic.co/t/7-node-cluster-with-3-dedicated-master-and-4-data-nodes/103060)
**Author:** [@samdash](https://discuss.elastic.co/u/samdash)\ **Replies:** 11\ **Last updated:** [October 10, 2017, 10:42pm UTC](https://discuss.elastic.co/t/7-node-cluster-with-3-dedicated-master-and-4-data-nodes/103060 "2017-10-10T22:42:52Z")
Hi All, I am setting up 7 node cluster with 3 dedicated master only and 4 data only nodes, my hosts are not bare metal hosts but JVM's . What should be my memory setting for each host ( master and data nodes) . What s… --- ## [How to define mustache variable for Kibana TSVB time series label](https://discuss.elastic.co/t/how-to-define-mustache-variable-for-kibana-tsvb-time-series-label/246071)
**Author:** [@Roy\_Zhang](https://discuss.elastic.co/u/Roy_Zhang)\ **Replies:** 10\ **Last updated:** [August 31, 2020, 3:50pm UTC](https://discuss.elastic.co/t/how-to-define-mustache-variable-for-kibana-tsvb-time-series-label/246071 "2020-08-31T15:50:54Z")
Dear Kibana Experts, According to https://www.elastic.co/guide/en/kibana/master/TSVB.html, for "series that are grouped by a term, I need to specify a mustache variable of {{key}} to substitute the term" for labels. … --- ## [NEST 6.2 using wildcard in indices](https://discuss.elastic.co/t/nest-6-2-using-wildcard-in-indices/147042)
**Author:** [@\_kyllr](https://discuss.elastic.co/u/_kyllr)\ **Replies:** 10\ **Last updated:** [September 12, 2018, 4:09am UTC](https://discuss.elastic.co/t/nest-6-2-using-wildcard-in-indices/147042 "2018-09-12T04:09:36Z")
Hi, is there a way to use a wildcard query in indices using NEST? We have indices like: index-2018.08 index-2018.09 and we only want to use those indices in one query in c#. We used index-\* but it shows invalid resp… --- ## [Indexing Sharepoint files(mounted to network driver) using fsCrawler](https://discuss.elastic.co/t/indexing-sharepoint-files-mounted-to-network-driver-using-fscrawler/227434)
**Author:** [@Lisahtwy](https://discuss.elastic.co/u/Lisahtwy)\ **Replies:** 12\ **Last updated:** [April 10, 2020, 4:16pm UTC](https://discuss.elastic.co/t/indexing-sharepoint-files-mounted-to-network-driver-using-fscrawler/227434 "2020-04-10T16:16:26Z")
Hi, I have mapped share point site as a network driver to my windows server 2019. The path is W:\\fsSharepointFiles Now I installed Java, fsCrawler and started indexing these files. Below are the steps I followed. i… --- ## [Grok for code to get formatted output](https://discuss.elastic.co/t/grok-for-code-to-get-formatted-output/49132)
**Author:** [@prakashkumar](https://discuss.elastic.co/u/prakashkumar)\ **Replies:** 14\ **Last updated:** [May 5, 2016, 8:30am UTC](https://discuss.elastic.co/t/grok-for-code-to-get-formatted-output/49132 "2016-05-05T08:30:28Z")
My filebeat0.yml filebeat: prospectors: - paths: - c:/Users/akashsoni/Downloads/k/logstash-tutorial/tutorial/\*.log - c:/Users/akashsoni/Downloads/k/logstash-tutorial/tutorial/\*.err input\_type: log … --- ## [Ingest pipe line grok pattern with field name having spaces](https://discuss.elastic.co/t/ingest-pipe-line-grok-pattern-with-field-name-having-spaces/259840)
**Author:** [@Bo\_Koralage](https://discuss.elastic.co/u/Bo_Koralage)\ **Replies:** 10\ **Last updated:** [January 12, 2021, 9:00am UTC](https://discuss.elastic.co/t/ingest-pipe-line-grok-pattern-with-field-name-having-spaces/259840 "2021-01-12T09:00:09Z")
I am using a ingest pipeline to parse a tab separated log message coming from filebeat. One of the fields can have spaces. In the example below "Gui Process" should be parsed to the SourceName field. However, what happen… --- ## [Fork AWS](https://discuss.elastic.co/t/fork-aws/261989)
**Author:** [@rbeg](https://discuss.elastic.co/u/rbeg)\ **Replies:** 16\ **Last updated:** [February 27, 2021, 7:43pm UTC](https://discuss.elastic.co/t/fork-aws/261989 "2021-02-27T19:43:25Z")
Bonjour, Qui peut m’expliquer brievement le conflit entre elastic et aws ? C’est quoi cette histoire de license ? Lien : --- ## [Kibana +geoip from ipv4 addr in a varx field](https://discuss.elastic.co/t/kibana-geoip-from-ipv4-addr-in-a-varx-field/110944)
**Author:** [@bruno-d](https://discuss.elastic.co/u/bruno-d)\ **Replies:** 16\ **Last updated:** [December 24, 2017, 12:40pm UTC](https://discuss.elastic.co/t/kibana-geoip-from-ipv4-addr-in-a-varx-field/110944 "2017-12-24T12:40:46Z")
Hi, i parsed syslog\_message to extract ip address from my ADSL modem to check who's ringing and store it into a new text field Varx (of my logstash index). Varx is a IPV4 text value computed every hours by an update\_by… --- ## [Labels are getting added to only transaction event not to span event](https://discuss.elastic.co/t/labels-are-getting-added-to-only-transaction-event-not-to-span-event/201069)
**Author:** [@ramya13](https://discuss.elastic.co/u/ramya13)\ **Replies:** 9\ **Last updated:** [September 30, 2019, 2:58pm UTC](https://discuss.elastic.co/t/labels-are-getting-added-to-only-transaction-event-not-to-span-event/201069 "2019-09-30T14:58:01Z")
Kibana version: Not using Kibana Elasticsearch version: 6.8.3 APM Server version: 7.3.2 APM Agent language and version: 1.9.0 Browser version: Version 77.0.3865.90 Original install method (e.g. download page, yum, d… --- ## [Latency](https://discuss.elastic.co/t/latency/163800)
**Author:** [@Asha](https://discuss.elastic.co/u/Asha)\ **Replies:** 15\ **Last updated:** [January 14, 2019, 4:54pm UTC](https://discuss.elastic.co/t/latency/163800 "2019-01-14T16:54:35Z")
GET mule-\*/\_search { "query":{ "exists": { "field": "mule.api.analytics.repliedTs" } }, "script\_fields" : { "totalRequestTime" : { "script" : { "inline": "((new SimpleDateFormat("yyyy-MM-dd'T'HH:mm:ss.S"… --- ## [Unable to create package for new beat based on metribeat](https://discuss.elastic.co/t/unable-to-create-package-for-new-beat-based-on-metribeat/198688)
**Author:** [@kenrowland](https://discuss.elastic.co/u/kenrowland)\ **Replies:** 11\ **Last updated:** [September 11, 2019, 8:51pm UTC](https://discuss.elastic.co/t/unable-to-create-package-for-new-beat-based-on-metribeat/198688 "2019-09-11T20:51:26Z")
Hello, I am trying to create a new beat based on metricbeat. I have followed the instructions and am able to build and debug my new beat. All works as expected. However, when I try to create a package using "make pack… --- ## [Logstash Jdbc oracle issue](https://discuss.elastic.co/t/logstash-jdbc-oracle-issue/179223)
**Author:** [@hannkeat](https://discuss.elastic.co/u/hannkeat)\ **Replies:** 10\ **Last updated:** [May 3, 2019, 4:07pm UTC](https://discuss.elastic.co/t/logstash-jdbc-oracle-issue/179223 "2019-05-03T16:07:23Z")
Here is my input file logstash 6.7 ojdbc8 input { jdbc { jdbc\_driver\_library =\> "/usr/lib/oracle/18.3/client64/lib/ojdbc8.jar" jdbc\_driver\_class =\> "Java::oracle.jdbc.driver.OracleDriver" jdbc\_connection\_string =\> … --- ## [Visual Builder](https://discuss.elastic.co/t/visual-builder/91745)
**Author:** [@aaheaton](https://discuss.elastic.co/u/aaheaton)\ **Replies:** 9\ **Last updated:** [July 5, 2017, 4:15pm UTC](https://discuss.elastic.co/t/visual-builder/91745 "2017-07-05T16:15:19Z")
Visual builder chart working fine under admin role but when user logs in the chart returns the error "The request for this panel failed.", all other charts are working fine. Is there a role I need to add to each user? --- ## [Update to 8.3.1 from 8.3.0 has broken Fleet - please help!](https://discuss.elastic.co/t/update-to-8-3-1-from-8-3-0-has-broken-fleet-please-help/308654)
**Author:** [@finbarr996](https://discuss.elastic.co/u/finbarr996)\ **Replies:** 10\ **Last updated:** [July 20, 2022, 8:32am UTC](https://discuss.elastic.co/t/update-to-8-3-1-from-8-3-0-has-broken-fleet-please-help/308654 "2022-07-20T08:32:37Z")
Upgraded to 8.3 a few days ago - everything working fine. Updated to 8.3.1 this morning and now the elastic-agent service won't start on my single on-prem node - this is also the Fleet Server. Error in the logs is: Er… --- ## [Filebeat 7.5.1 logging.files.path is not working](https://discuss.elastic.co/t/filebeat-7-5-1-logging-files-path-is-not-working/224750)
**Author:** [@kyle\_che](https://discuss.elastic.co/u/kyle_che)\ **Replies:** 10\ **Last updated:** [March 25, 2020, 5:46pm UTC](https://discuss.elastic.co/t/filebeat-7-5-1-logging-files-path-is-not-working/224750 "2020-03-25T17:46:24Z")
I have put the following in my filebeats for 7.5.1 but everything is being logged to syslog still. any idea on why? logging.level: info logging.to\_syslog: false logging.to\_files: true logging.files: path: /var/log/… --- ## [File input, from NetApp CIFS share, not reading single file](https://discuss.elastic.co/t/file-input-from-netapp-cifs-share-not-reading-single-file/195391)
**Author:** [@eclipsed450](https://discuss.elastic.co/u/eclipsed450)\ **Replies:** 10\ **Last updated:** [August 19, 2019, 9:25pm UTC](https://discuss.elastic.co/t/file-input-from-netapp-cifs-share-not-reading-single-file/195391 "2019-08-19T21:25:30Z")
Hi, I've made quite a few other posts, and have successfully ingested more than 1 billion messages in the last couple weeks, but we've come to the conclusion that Logstash just isn't keeping up with the backlog of messa… --- ## [Два хоста filebeat +ELK](https://discuss.elastic.co/t/filebeat-elk/239596)
**Author:** [@Ivan\_Bykov](https://discuss.elastic.co/u/Ivan_Bykov)\ **Replies:** 9\ **Last updated:** [July 7, 2020, 6:27am UTC](https://discuss.elastic.co/t/filebeat-elk/239596 "2020-07-07T06:27:54Z")
Добрый день. У меня настроен ELK 7.8.0 и filebeat 7.8.0 который читает лог1 и отдает с индексом лог1 в logstash. Собственно возникла потребность подключить еще один хост filbeat с лог2 и индексом лог2 для logstash. На… --- ## [ELK APM Transaction not showing end to end flow if we have two diffent services](https://discuss.elastic.co/t/elk-apm-transaction-not-showing-end-to-end-flow-if-we-have-two-diffent-services/233242)
**Author:** [@Vissu\_Reddy](https://discuss.elastic.co/u/Vissu_Reddy)\ **Replies:** 12\ **Last updated:** [May 26, 2020, 7:36pm UTC](https://discuss.elastic.co/t/elk-apm-transaction-not-showing-end-to-end-flow-if-we-have-two-diffent-services/233242 "2020-05-26T19:36:39Z")
We have two services called ServiceA and ServiceB . ServiceA has been implemented using Java language and ServiceB has been implemented using .Net language. Both these services has been integrated with respective ELK APM… --- ## [Logstash unable to collect logs from filebeat due to protocol mismatch](https://discuss.elastic.co/t/logstash-unable-to-collect-logs-from-filebeat-due-to-protocol-mismatch/335269)
**Author:** [@Chel\_Db](https://discuss.elastic.co/u/Chel_Db)\ **Replies:** 16\ **Last updated:** [June 6, 2023, 4:31pm UTC](https://discuss.elastic.co/t/logstash-unable-to-collect-logs-from-filebeat-due-to-protocol-mismatch/335269 "2023-06-06T16:31:33Z")
I've installed filebeat in our k8s following official elastic document (kubernetes/filebeat-kubernetes.yaml ) to collect logs of our microservices and push it to the Logstash which is installed in a different VM as a co… --- ## [Filebeat is not sending data to Elasticsearch](https://discuss.elastic.co/t/filebeat-is-not-sending-data-to-elasticsearch/291000)
**Author:** [@Akanksha\_Pandey](https://discuss.elastic.co/u/Akanksha_Pandey)\ **Replies:** 9\ **Last updated:** [December 9, 2021, 4:06am UTC](https://discuss.elastic.co/t/filebeat-is-not-sending-data-to-elasticsearch/291000 "2021-12-09T04:06:05Z")
I'm using running Filebeat version 7.10.0 as container version to ship docker container logs as well as system logs directly to Elasticsearch. Docker logs are shipped fine but system logs are not getting shipped. When I … --- ## [Cannot install Search-Guard plugin and enable xPacks. Version 6.4.2](https://discuss.elastic.co/t/cannot-install-search-guard-plugin-and-enable-xpacks-version-6-4-2/167751)
**Author:** [@JDev](https://discuss.elastic.co/u/JDev)\ **Replies:** 9\ **Last updated:** [February 11, 2019, 9:25am UTC](https://discuss.elastic.co/t/cannot-install-search-guard-plugin-and-enable-xpacks-version-6-4-2/167751 "2019-02-11T09:25:17Z")
Hello, I installed the elastic stack on the Kubernetes cluster. I wanted to enable Search-guard plugin. Before that, the installation did not work at all, added two variables to the environment. Elastiksearch/Kibana … --- ## [Running Lucene query using Elastic search API](https://discuss.elastic.co/t/running-lucene-query-using-elastic-search-api/10835)
**Author:** [@Vivek\_Mishra](https://discuss.elastic.co/u/Vivek_Mishra)\ **Replies:** 12\ **Last updated:** [February 21, 2013, 12:31pm UTC](https://discuss.elastic.co/t/running-lucene-query-using-elastic-search-api/10835 "2013-02-21T12:31:21Z")
Hi, I am newbie to ES java API. I have a very small query, I have a lucene query object parsed as: QueryParser qp = new QueryParser(Version.LUCENE\_34, DEFAULT\_SEARCHABLE\_FIELD, new StandardAnalyzer( … --- ## [Can't join elastic to microsoft active directory ldap](https://discuss.elastic.co/t/cant-join-elastic-to-microsoft-active-directory-ldap/326514)
**Author:** [@Indeed2000](https://discuss.elastic.co/u/Indeed2000)\ **Replies:** 16\ **Last updated:** [March 23, 2023, 2:05pm UTC](https://discuss.elastic.co/t/cant-join-elastic-to-microsoft-active-directory-ldap/326514 "2023-03-23T14:05:36Z")
Hi ldap users can't login on kibana: here is the log when user attempt to login: Feb 26 11:55:21 logdev kibana\[1784685\]: \[2023-02-26T11:55:21.243+03:30\]\[INFO \]\[plugins.security.routes\] Logging in with provider "bas… --- ## [Usign ruby to update local Linux environment variable](https://discuss.elastic.co/t/usign-ruby-to-update-local-linux-environment-variable/113948)
**Author:** [@moriol](https://discuss.elastic.co/u/moriol)\ **Replies:** 15\ **Last updated:** [January 8, 2018, 2:57pm UTC](https://discuss.elastic.co/t/usign-ruby-to-update-local-linux-environment-variable/113948 "2018-01-08T14:57:44Z")
I am ingesting some data with Logstash, with Kafka as an input. Is it possible with ruby, to configure a filter, which will update a Linux environment variable with what I am getting from Kafka? Lets say I will get som… --- ## [Elasticsearch Java API client 8.7.1, No Option available to generate the correct format for source ordering for composition aggregation](https://discuss.elastic.co/t/elasticsearch-java-api-client-8-7-1-no-option-available-to-generate-the-correct-format-for-source-ordering-for-composition-aggregation/337477)
**Author:** [@ramyogi](https://discuss.elastic.co/u/ramyogi)\ **Replies:** 12\ **Last updated:** [August 8, 2023, 8:39pm UTC](https://discuss.elastic.co/t/elasticsearch-java-api-client-8-7-1-no-option-available-to-generate-the-correct-format-for-source-ordering-for-composition-aggregation/337477 "2023-08-08T20:39:45Z")
Elasticsearch Java API client 8.7.1 does not have option to supply order for the composite term aggregation but it was available server lib. Query runs fine in KIBANA but cannot build same in Java client library {"from… --- ## [Logstash consuming too much bandwidth](https://discuss.elastic.co/t/logstash-consuming-too-much-bandwidth/190593)
**Author:** [@Jitendra\_Kumhar](https://discuss.elastic.co/u/Jitendra_Kumhar)\ **Replies:** 11\ **Last updated:** [July 29, 2019, 5:17pm UTC](https://discuss.elastic.co/t/logstash-consuming-too-much-bandwidth/190593 "2019-07-29T17:17:08Z")
Hello, I am sending logs from filebeat to Logstash and then from logstash to ElasticSearch. The problem is Logstash is consuming too much bandwidth.I have attached network usage graph of logstash server. (green is inc… --- ## [Java Agent is sending empty? Transations/Span](https://discuss.elastic.co/t/java-agent-is-sending-empty-transations-span/178923)
**Author:** [@Shaoranlaos](https://discuss.elastic.co/u/Shaoranlaos)\ **Replies:** 11\ **Last updated:** [April 30, 2019, 6:48am UTC](https://discuss.elastic.co/t/java-agent-is-sending-empty-transations-span/178923 "2019-04-30T06:48:08Z")
Kibana version: 6.6.2 Elasticsearch version: 6.6.2 APM Server version: 6.6.2 APM Agent language and version: Java 1.8 with Java Agent 1.6.1 Browser version: Chrome 73 Original install method (e.g. download page, yum… --- ## [Monitor cluster with elastic agent](https://discuss.elastic.co/t/monitor-cluster-with-elastic-agent/342413)
**Author:** [@lduvnjak](https://discuss.elastic.co/u/lduvnjak)\ **Replies:** 16\ **Last updated:** [September 13, 2023, 6:39pm UTC](https://discuss.elastic.co/t/monitor-cluster-with-elastic-agent/342413 "2023-09-13T18:39:17Z")
Hey Everyone, We're trying to move from the legacy exporters over to Elastic Agent. Our data pipeline is Elastic Agent \> Logstash \> Kafka \> Elastic. I have a couple of questions and would appreciate any and all knowledg… --- ## [Сжатие старых логов](https://discuss.elastic.co/t/topic/297130)
**Author:** [@holpa](https://discuss.elastic.co/u/holpa)\ **Replies:** 10\ **Last updated:** [March 9, 2022, 6:55am UTC](https://discuss.elastic.co/t/topic/297130 "2022-03-09T06:55:08Z")
Здравствуйте. эластик с кибаной собираются логи с домена (сбор логов осуществляется через ForwardedEvents .evtx) В Logstash настроен фильтр которые собирает нужные event id filter { if "slog" in \[tags\] { if \[winlo… --- ## [Translog Corruption- AccessDeniedException -in ElasticSearch](https://discuss.elastic.co/t/translog-corruption-accessdeniedexception-in-elasticsearch/101608)
**Author:** [@dimalini](https://discuss.elastic.co/u/dimalini)\ **Replies:** 10\ **Last updated:** [October 11, 2017, 3:05am UTC](https://discuss.elastic.co/t/translog-corruption-accessdeniedexception-in-elasticsearch/101608 "2017-10-11T03:05:44Z")
Hi, I came across few instances where the shards went into "Unassigned" state and failed to recover. The logs indicated a possible translog corruption with the following exception- IndexShardRecoveryException\[failed … --- ## [Elasticsearch 2.3.4 connection refused](https://discuss.elastic.co/t/elasticsearch-2-3-4-connection-refused/56073)
**Author:** [@sunilmchaudhari](https://discuss.elastic.co/u/sunilmchaudhari)\ **Replies:** 16\ **Last updated:** [July 21, 2016, 11:47am UTC](https://discuss.elastic.co/t/elasticsearch-2-3-4-connection-refused/56073 "2016-07-21T11:47:46Z")
Hi, I have upgraded ES 1.5 to 2.3.4 After that I am getting connection issues from client machine (Indexer in my case). I haven't changed any Elasticsearch.yml configuration. I checked with IT team, there is no FW or… --- ## [Why is fast bulk than single indexing in elasticsearch](https://discuss.elastic.co/t/why-is-fast-bulk-than-single-indexing-in-elasticsearch/341339)
**Author:** [@slowup](https://discuss.elastic.co/u/slowup)\ **Replies:** 11\ **Last updated:** [August 23, 2023, 9:42am UTC](https://discuss.elastic.co/t/why-is-fast-bulk-than-single-indexing-in-elasticsearch/341339 "2023-08-23T09:42:00Z")
I wonder why bulk indexing is faster than single indexing. I'm curious from the point of view of elasticsearch, other than being connected and closed and network communication problems. Based on the default refresh tim… --- ## [Add\_docker\_metadata not working with match\_source: false](https://discuss.elastic.co/t/add-docker-metadata-not-working-with-match-source-false/136874)
**Author:** [@pa.cloud](https://discuss.elastic.co/u/pa.cloud)\ **Replies:** 9\ **Last updated:** [June 27, 2018, 4:13pm UTC](https://discuss.elastic.co/t/add-docker-metadata-not-working-with-match-source-false/136874 "2018-06-27T16:13:11Z")
Hi, Though I could successfully use add\_docker\_metadata with "~" as well as if I set match\_source: true But i am unable to get it to work if i set match\_source: false. Please see my config below. Not sure if it's beca… --- ## [ECE - bash install error - docker.io/library/de - not found](https://discuss.elastic.co/t/ece-bash-install-error-docker-io-library-de-not-found/134553)
**Author:** [@dsigiscar](https://discuss.elastic.co/u/dsigiscar)\ **Replies:** 16\ **Last updated:** [June 5, 2018, 8:51am UTC](https://discuss.elastic.co/t/ece-bash-install-error-docker-io-library-de-not-found/134553 "2018-06-05T08:51:31Z")
Hi, Im trying to install ECE on my virtual machin by following the prerequise for CentOS7 and own registry installation mode. I make the installation on the VM from scratch, I didn't encountered error during the prere… --- ## [Kibana OAuth 2 flow](https://discuss.elastic.co/t/kibana-oauth-2-flow/265697)
**Author:** [@horatiu](https://discuss.elastic.co/u/horatiu)\ **Replies:** 10\ **Last updated:** [March 2, 2021, 4:16am UTC](https://discuss.elastic.co/t/kibana-oauth-2-flow/265697 "2021-03-02T04:16:23Z")
Hello, I'm trying to figure out if my understanding of the implementation of OAuth2 in Kibana is correct. I've got an ES domain deployed on AWS with Cognito authentication via "Authorization code grant" flow. My unders… --- ## [Metricbeat dashboards doesnot show all data](https://discuss.elastic.co/t/metricbeat-dashboards-doesnot-show-all-data/135712)
**Author:** [@Gauti](https://discuss.elastic.co/u/Gauti)\ **Replies:** 11\ **Last updated:** [July 9, 2018, 8:39am UTC](https://discuss.elastic.co/t/metricbeat-dashboards-doesnot-show-all-data/135712 "2018-07-09T08:39:23Z")
Hey Guys, I have installed metricbeat in some virtual machines and started sending data to elasticsearch. I have imported default dashboards also for the same. The problem is, the dashboard is not visualizing all data,… --- ## [Can fscrawler index files from different servers?](https://discuss.elastic.co/t/can-fscrawler-index-files-from-different-servers/214912)
**Author:** [@SwatiVavilapalli](https://discuss.elastic.co/u/SwatiVavilapalli)\ **Replies:** 9\ **Last updated:** [January 15, 2020, 2:08pm UTC](https://discuss.elastic.co/t/can-fscrawler-index-files-from-different-servers/214912 "2020-01-15T14:08:18Z")
Hi, I am new to Elasticsearch and fscrawler, could you please let me know what are the settings I need to mention in the \_settings.yaml (in fscrawler index) file so that I can index files from multiple servers. I tried… --- ## [Fleet Policy different IP from the server](https://discuss.elastic.co/t/fleet-policy-different-ip-from-the-server/362595)
**Author:** [@otortosa](https://discuss.elastic.co/u/otortosa)\ **Replies:** 13\ **Last updated:** [July 31, 2024, 7:29pm UTC](https://discuss.elastic.co/t/fleet-policy-different-ip-from-the-server/362595 "2024-07-31T19:29:47Z")
Hello guys! My Fleet server have a private IP, but i need to recolect logs from a VM with only public IP, working with a PFSense, created a Port Forwarder to the Fleet Server private IP. The issue is that the Fleet Age… --- ## [Can't execute winlogbeat.exe](https://discuss.elastic.co/t/cant-execute-winlogbeat-exe/148594)
**Author:** [@Pinno\_Lin](https://discuss.elastic.co/u/Pinno_Lin)\ **Replies:** 10\ **Last updated:** [September 25, 2018, 2:43am UTC](https://discuss.elastic.co/t/cant-execute-winlogbeat-exe/148594 "2018-09-25T02:43:46Z")
Hi, I want to install winlogbeat in Windows 2016 Standard x64 with Winlogbeat 6.4.0 x64 When I execute the winlogbeat.exe to confirm the configuration file or anything, The console also response error in below. what's… --- ## [Elasticsearch cluster have millions of pending tasks](https://discuss.elastic.co/t/elasticsearch-cluster-have-millions-of-pending-tasks/272349)
**Author:** [@fengxiaobai](https://discuss.elastic.co/u/fengxiaobai)\ **Replies:** 14\ **Last updated:** [May 11, 2021, 5:33am UTC](https://discuss.elastic.co/t/elasticsearch-cluster-have-millions-of-pending-tasks/272349 "2021-05-11T05:33:57Z")
i have a es cluster , 7.4 version . There are a lot of pending tasks around 8 a.m. every day。 pending task list info： 639479 "source": "ilm-execute-cluster-state-steps", 82666 "source": "ilm-move-to-step"… --- ## [Advise needed](https://discuss.elastic.co/t/advise-needed/171198)
**Author:** [@Dinesh\_Chandrasekara](https://discuss.elastic.co/u/Dinesh_Chandrasekara)\ **Replies:** 13\ **Last updated:** [March 10, 2019, 10:33am UTC](https://discuss.elastic.co/t/advise-needed/171198 "2019-03-10T10:33:30Z")
How to search combining 3 fields in the same document in elastic search. Like if Sachin Tendulkar is in 3 fields sachin tendu lkar. Combine 3 fields and search in it Note :I don't want to use copy to that's used in ind… --- ## [Ingest pipeline drops the field as @timestamp while loading Elasticsearch's server and slowlog using filebeat](https://discuss.elastic.co/t/ingest-pipeline-drops-the-field-as-timestamp-while-loading-elasticsearchs-server-and-slowlog-using-filebeat/247031)
**Author:** [@Prashant\_Agrawal](https://discuss.elastic.co/u/Prashant_Agrawal)\ **Replies:** 9\ **Last updated:** [September 6, 2020, 11:08pm UTC](https://discuss.elastic.co/t/ingest-pipeline-drops-the-field-as-timestamp-while-loading-elasticsearchs-server-and-slowlog-using-filebeat/247031 "2020-09-06T23:08:34Z")
Ingest pipeline drops the field as @timestamp while loading Elasticsearch's server and slowlog using filebeat. "filebeat-7.9.0-elasticsearch-server-pipeline" : { "description" : "Pipeline for parsing elasticsearch ser… --- ## [Extract parameters from a message](https://discuss.elastic.co/t/extract-parameters-from-a-message/187797)
**Author:** [@WarriorHarb](https://discuss.elastic.co/u/WarriorHarb)\ **Replies:** 11\ **Last updated:** [June 28, 2019, 9:13am UTC](https://discuss.elastic.co/t/extract-parameters-from-a-message/187797 "2019-06-28T09:13:49Z")
Hello, So i have a message in my log that contains parameters that i need to extract. This is an log line exemple : AgentID=50119&Tenant=2003&GroupID=15043&CountryCode=00&AreaCode=&DialedNumber=000000000 I need to … --- ## [Filebeat on director role node spams](https://discuss.elastic.co/t/filebeat-on-director-role-node-spams/84181)
**Author:** [@iremmats](https://discuss.elastic.co/u/iremmats)\ **Replies:** 10\ **Last updated:** [May 2, 2017, 9:14pm UTC](https://discuss.elastic.co/t/filebeat-on-director-role-node-spams/84181 "2017-05-02T21:14:02Z")
Noticed that Filebeat on one of our servers in ECE goes bananas. Where as other vms with same config, same settings and same roles sends about 1000 logs per 15 minutes this server sends roughly 500k in same time period.… --- ## [Not able to visualize percentage on pie using vega](https://discuss.elastic.co/t/not-able-to-visualize-percentage-on-pie-using-vega/270234)
**Author:** [@saumya1](https://discuss.elastic.co/u/saumya1)\ **Replies:** 9\ **Last updated:** [May 4, 2021, 1:48pm UTC](https://discuss.elastic.co/t/not-able-to-visualize-percentage-on-pie-using-vega/270234 "2021-05-04T13:48:34Z")
while doing aggregation on count of string I am getting error as nan%. { "$schema": "https://vega.github.io/schema/vega-lite/v5.json", "description": "A simple pie chart with labels.", "height": 500, "width"… --- ## [Add new visualizations to Kibana](https://discuss.elastic.co/t/add-new-visualizations-to-kibana/22495)
**Author:** [@Jean\_Marc\_Saffroy](https://discuss.elastic.co/u/Jean_Marc_Saffroy)\ **Replies:** 9\ **Last updated:** [October 9, 2016, 6:35am UTC](https://discuss.elastic.co/t/add-new-visualizations-to-kibana/22495 "2016-10-09T06:35:40Z")
Hi all, In the context of the development of an internal tool for my company (Scality), I am trying to figure out how hard it is (ie. estimate development cost) to extend Kibana 4 to add some visualization schemes… --- ## [Logstash-hipchat messages are not displaying in hipchat](https://discuss.elastic.co/t/logstash-hipchat-messages-are-not-displaying-in-hipchat/52611)
**Author:** [@babeesh](https://discuss.elastic.co/u/babeesh)\ **Replies:** 11\ **Last updated:** [June 17, 2016, 10:55am UTC](https://discuss.elastic.co/t/logstash-hipchat-messages-are-not-displaying-in-hipchat/52611 "2016-06-17T10:55:44Z")
Hi, I have redirected logs recieving in logstash to hipchat. output { if \[type\]== 'eventlog' { hipchat { room\_id =\> '\*\*\*\*' token =\> '\*\*\*\*' } elasticsearch { hosts =\> \['172.30… --- ## [Watcher email and slack failing](https://discuss.elastic.co/t/watcher-email-and-slack-failing/268854)
**Author:** [@twilight](https://discuss.elastic.co/u/twilight)\ **Replies:** 14\ **Last updated:** [April 1, 2021, 3:33pm UTC](https://discuss.elastic.co/t/watcher-email-and-slack-failing/268854 "2021-04-01T15:33:19Z")
Hello, I am trying to configure slack and email action in watcher on my ES and Kibana 7.12 installed on Amazon Linux AMI. below are my slack settings (plus webhook url in keystore): xpack.notification.slack: default… [Previous page](https://discuss.elastic.co/top.md?page=157&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=159&per_page=50&period=all)