# Top **URL:** https://discuss.elastic.co/top.md?page=1654&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1655 --- ## [How to add a field with description for a specific Windows Event ID?](https://discuss.elastic.co/t/how-to-add-a-field-with-description-for-a-specific-windows-event-id/268617)
**Author:** [@nael\_uchiha](https://discuss.elastic.co/u/nael_uchiha)\ **Replies:** 5\ **Last updated:** [March 31, 2021, 12:22am UTC](https://discuss.elastic.co/t/how-to-add-a-field-with-description-for-a-specific-windows-event-id/268617 "2021-03-31T00:22:43Z")
Hello, I need to add some fields and descriptions for a Windows Event ID. For example, for winlog.event\_id = 1111 create a field named rule.description: Our descroption Thank you for your help! --- ## [Does Elasticsearch automatically compress indexes?](https://discuss.elastic.co/t/does-elasticsearch-automatically-compress-indexes/243354)
**Author:** [@d.silwon](https://discuss.elastic.co/u/d.silwon)\ **Replies:** 5\ **Last updated:** [August 4, 2020, 5:27am UTC](https://discuss.elastic.co/t/does-elasticsearch-automatically-compress-indexes/243354 "2020-08-04T05:27:23Z")
Dears, We have ELK in version 7.7.1. Everyday we send to ELK logs is size about 30GB. I'm worried about FS space. My question is does Elasticsearch automatically compress indexes? or Should it be forced with the corr… --- ## [Actually i am going metricbeat through logstash not getting kibana dashboard with all metrics](https://discuss.elastic.co/t/actually-i-am-going-metricbeat-through-logstash-not-getting-kibana-dashboard-with-all-metrics/195214)
**Author:** [@vishnuvardhan](https://discuss.elastic.co/u/vishnuvardhan)\ **Replies:** 5\ **Last updated:** [August 19, 2019, 8:50pm UTC](https://discuss.elastic.co/t/actually-i-am-going-metricbeat-through-logstash-not-getting-kibana-dashboard-with-all-metrics/195214 "2019-08-19T20:50:56Z")
actually i am going metricbeat through logstash not getting kibana dashboard with all metrics But i will go elasticsearch get the all the metrics . why it is not happen ?? any settings we need to change go through the l… --- ## [Needing Help Determining Suspicious User Activity using freq\_rare detector](https://discuss.elastic.co/t/needing-help-determining-suspicious-user-activity-using-freq-rare-detector/194090)
**Author:** [@alta\_01](https://discuss.elastic.co/u/alta_01)\ **Replies:** 5\ **Last updated:** [August 6, 2019, 8:17pm UTC](https://discuss.elastic.co/t/needing-help-determining-suspicious-user-activity-using-freq-rare-detector/194090 "2019-08-06T20:17:55Z")
Currently trying to develop a machine learning job to detect when a user identity is performing suspicious actions. I'm having a hard time wrapping my head around ML, so I may need a bit of help determining the best way … --- ## [Concave geo shapes in 1.7.x](https://discuss.elastic.co/t/concave-geo-shapes-in-1-7-x/185948)
**Author:** [@nickoneill](https://discuss.elastic.co/u/nickoneill)\ **Replies:** 5\ **Last updated:** [June 21, 2019, 6:34am UTC](https://discuss.elastic.co/t/concave-geo-shapes-in-1-7-x/185948 "2019-06-21T06:34:34Z")
I'm maintaining an application running 1.7.x that heavily uses geoshapes and querying by points within those shapes. As far as I can tell 1.7.x is not handling concave shapes well and queries for shapes are returning po… --- ## [No Logstash errors, but no data](https://discuss.elastic.co/t/no-logstash-errors-but-no-data/170971)
**Author:** [@johnfowles](https://discuss.elastic.co/u/johnfowles)\ **Replies:** 5\ **Last updated:** [March 5, 2019, 10:25pm UTC](https://discuss.elastic.co/t/no-logstash-errors-but-no-data/170971 "2019-03-05T22:25:46Z")
Working indexing and adding fields to OpenVPN logs in pfsense, the original config (stolen from git) works fine and parses out all the pfsense syslog inputs correctly. When I add in the following I get no errors in the … --- ## [Distributed tracing with custom transactions (Node.js agent)](https://discuss.elastic.co/t/distributed-tracing-with-custom-transactions-node-js-agent/164671)
**Author:** [@treble.snake](https://discuss.elastic.co/u/treble.snake)\ **Replies:** 5\ **Last updated:** [January 23, 2019, 9:16am UTC](https://discuss.elastic.co/t/distributed-tracing-with-custom-transactions-node-js-agent/164671 "2019-01-23T09:16:00Z")
Hi, I wonder if it's possible to do distributed tracing with custom transactions? I see there is an automated distributed tracing for services communicating via HTTP. But what about other means of IPC, like message br… --- ## [Cant understand watcher keywords](https://discuss.elastic.co/t/cant-understand-watcher-keywords/141040)
**Author:** [@rijinmp](https://discuss.elastic.co/u/rijinmp)\ **Replies:** 5\ **Last updated:** [July 23, 2018, 11:45am UTC](https://discuss.elastic.co/t/cant-understand-watcher-keywords/141040 "2018-07-23T11:45:38Z")
When I am started to study watcher , i see lots of keywords in watcher examples . Samples are showing below 1)ctx.payload.hits.total 2)ctx.payload.first.path 3)ctx.metadata.color 4)ctx.payload.aggregations.bucket\_r… --- ## [Https Client Authentication Verify Hostname](https://discuss.elastic.co/t/https-client-authentication-verify-hostname/136697)
**Author:** [@Dietmar](https://discuss.elastic.co/u/Dietmar)\ **Replies:** 5\ **Last updated:** [June 21, 2018, 6:42am UTC](https://discuss.elastic.co/t/https-client-authentication-verify-hostname/136697 "2018-06-21T06:42:17Z")
Hallo , I have an https client to ES and using Self Signed Certificates with client authentication on. I am using PKI realm and have mapped the DN to a role. Things work fine for me. But, authentication the hostname of… --- ## [Elasticsearch shards not able to set 1](https://discuss.elastic.co/t/elasticsearch-shards-not-able-to-set-1/106979)
**Author:** [@Shekhar\_Pandey](https://discuss.elastic.co/u/Shekhar_Pandey)\ **Replies:** 5\ **Last updated:** [November 10, 2017, 9:27am UTC](https://discuss.elastic.co/t/elasticsearch-shards-not-able-to-set-1/106979 "2017-11-10T09:27:31Z")
I try to change the shards by default from 5 to 1 using settings options like this.. { "index":{ "number\_of\_shards": 1, "number\_of\_replicas": 0 }, "settings": { "analysis": { "filter": { "nG..... its' showing … --- ## [How to parse logs on startup and merge files per folder?](https://discuss.elastic.co/t/how-to-parse-logs-on-startup-and-merge-files-per-folder/101291)
**Author:** [@vrider](https://discuss.elastic.co/u/vrider)\ **Replies:** 5\ **Last updated:** [September 28, 2017, 4:25am UTC](https://discuss.elastic.co/t/how-to-parse-logs-on-startup-and-merge-files-per-folder/101291 "2017-09-28T04:25:42Z")
Dear Community, I had troubles with parsing of logs with logstash during startup Once I add an exta line to log file -\> parsed; It seems that parsing only is triggerred once change is observer Is there a setting fo… --- ## [Query speed advice](https://discuss.elastic.co/t/query-speed-advice/33471)
**Author:** [@voipoclay](https://discuss.elastic.co/u/voipoclay)\ **Replies:** 5\ **Last updated:** [November 1, 2015, 8:50pm UTC](https://discuss.elastic.co/t/query-speed-advice/33471 "2015-11-01T20:50:54Z")
Hello, I have two queries that produce results basically in the same amount of time and I think there was more discrepancy in the 1.7 version versus the 2.0. I know filters and queries have been reworked so I was hopin… --- ## [Access is denied in case of elastic agent in Windows installation](https://discuss.elastic.co/t/access-is-denied-in-case-of-elastic-agent-in-windows-installation/322333)
**Author:** [@lovelike123](https://discuss.elastic.co/u/lovelike123)\ **Replies:** 2\ **Last updated:** [January 4, 2023, 1:17am UTC](https://discuss.elastic.co/t/access-is-denied-in-case-of-elastic-agent-in-windows-installation/322333 "2023-01-04T01:17:34Z")
Access is denied in case of elastic agent in Windows installation Version of windows server：windows server 2008r2 --- ## [Reindex API - Need to improve performance](https://discuss.elastic.co/t/reindex-api-need-to-improve-performance/285453)
**Author:** [@Seba](https://discuss.elastic.co/u/Seba)\ **Replies:** 2\ **Last updated:** [October 4, 2021, 9:40am UTC](https://discuss.elastic.co/t/reindex-api-need-to-improve-performance/285453 "2021-10-04T09:40:07Z")
Hello, The goal is to accelerate the reindex of indexes from an ELK cluster (version 7.6.2) composed of 3 nodes each with all the roles to a datastream in an ELK cluster (version 7.11) installed in a container system w… --- ## [Action \[indices:admin/auto\_create\] is unauthorized for API key id \[-#########\] of user \[elastic/fleet-server\] on indices \[metricbeat-#######\]](https://discuss.elastic.co/t/action-indices-admin-auto-create-is-unauthorized-for-api-key-id-of-user-elastic-fleet-server-on-indices-metricbeat/278825)
**Author:** [@tcaudill](https://discuss.elastic.co/u/tcaudill)\ **Replies:** 2\ **Last updated:** [July 15, 2021, 8:08pm UTC](https://discuss.elastic.co/t/action-indices-admin-auto-create-is-unauthorized-for-api-key-id-of-user-elastic-fleet-server-on-indices-metricbeat/278825 "2021-07-15T20:08:01Z")
I'm seeing errors like this one in the logs of some of my fleet managed elastic-agents. After doing some testing, it looks like I'm not getting all of the log data that I should be getting. For example, on my Windows D… --- ## [\[BUG?\] date\_histogram hard\_bounds returns unknown\_field](https://discuss.elastic.co/t/bug-date-histogram-hard-bounds-returns-unknown-field/260825)
**Author:** [@demasie](https://discuss.elastic.co/u/demasie)\ **Replies:** 2\ **Last updated:** [January 12, 2021, 4:45pm UTC](https://discuss.elastic.co/t/bug-date-histogram-hard-bounds-returns-unknown-field/260825 "2021-01-12T16:45:09Z")
The following snippet returns error reason \[date\_histogram\] unknown field \[hard\_bounds\] did you mean \[extended\_bounds\]? { date\_histogram: { field: 'date', calendar\_interval: 'day', hard\_bounds: { min: '2020-11… --- ## [Can't compile beats since 7.6.2](https://discuss.elastic.co/t/cant-compile-beats-since-7-6-2/232695)
**Author:** [@Aaron\_Abbett](https://discuss.elastic.co/u/Aaron_Abbett)\ **Replies:** 2\ **Last updated:** [May 19, 2020, 8:24pm UTC](https://discuss.elastic.co/t/cant-compile-beats-since-7-6-2/232695 "2020-05-19T20:24:25Z")
Using the same methods I've been using to compile Beats for Pi since v6, I can no longer compile beats. GOARCH=arm GOOS=linux GO v1.13.10 I clone the repo, checkout the commit for the release (5e69e25), cd to the bea… --- ## [Metricbeat 6.8.3 service on CentOS 7 failing to start automatically on reboot](https://discuss.elastic.co/t/metricbeat-6-8-3-service-on-centos-7-failing-to-start-automatically-on-reboot/205232)
**Author:** [@Mohit\_Kunjir](https://discuss.elastic.co/u/Mohit_Kunjir)\ **Replies:** 2\ **Last updated:** [October 25, 2019, 5:15pm UTC](https://discuss.elastic.co/t/metricbeat-6-8-3-service-on-centos-7-failing-to-start-automatically-on-reboot/205232 "2019-10-25T17:15:12Z")
This is my metricbeat.yml file name: Metricbeat-Monitor #================================= Paths ============================ path.home: /usr/share/metricbeat path.config: /etc/metricbeat path.data: /var/lib/metric… --- ## [Elasticsearch doesn't start after overwhelming](https://discuss.elastic.co/t/elasticsearch-doesnt-start-after-overwhelming/190391)
**Author:** [@Vladpov](https://discuss.elastic.co/u/Vladpov)\ **Replies:** 2\ **Last updated:** [July 14, 2019, 7:37pm UTC](https://discuss.elastic.co/t/elasticsearch-doesnt-start-after-overwhelming/190391 "2019-07-14T19:37:12Z")
Hi there, I was trying a performance of elasticsearch by running script for generating logs. In particular around 600 000 logs per approximately 1 minute were generating on one VM where Filebeat was sending it to logsta… --- ## [Curator - suppress urllib3 SSL warning](https://discuss.elastic.co/t/curator-suppress-urllib3-ssl-warning/169239)
**Author:** [@Jasper\_Nygaard](https://discuss.elastic.co/u/Jasper_Nygaard)\ **Replies:** 2\ **Last updated:** [February 21, 2019, 8:02am UTC](https://discuss.elastic.co/t/curator-suppress-urllib3-ssl-warning/169239 "2019-02-21T08:02:08Z")
Hi Got an ES cluster with self signed certificates and using Curator to do maintenance. Can anyone either: tell me where I can suppress Unverified HTTPS request warning from urllib3 - I'm running Curator on Windows an… --- ## [No cached mapping for this field for apm server](https://discuss.elastic.co/t/no-cached-mapping-for-this-field-for-apm-server/168164)
**Author:** [@arun5635](https://discuss.elastic.co/u/arun5635)\ **Replies:** 2\ **Last updated:** [February 14, 2019, 7:08pm UTC](https://discuss.elastic.co/t/no-cached-mapping-for-this-field-for-apm-server/168164 "2019-02-14T19:08:15Z")
Hi I am using apm server and sending the data to aws ES and kibana . I am getting warning for some fields (No cached mapping for this field). I tried to refresh the index pattern in management. And I am not able to find … --- ## [Grok processor in pipeline throws json\_parse\_exception](https://discuss.elastic.co/t/grok-processor-in-pipeline-throws-json-parse-exception/125251)
**Author:** [@Sonia\_Gupta](https://discuss.elastic.co/u/Sonia_Gupta)\ **Replies:** 2\ **Last updated:** [March 27, 2018, 6:30pm UTC](https://discuss.elastic.co/t/grok-processor-in-pipeline-throws-json-parse-exception/125251 "2018-03-27T18:30:03Z")
Unable to use regex for grok pattern: when I give the following: POST \_ingest/pipeline/\_simulate { "pipeline": { "description" : "parse multiple patterns", "processors": \[ { "grok": { "field": "message", "patte… --- ## [Controlling b and k1 values on the BM25 of the unified highlighter](https://discuss.elastic.co/t/controlling-b-and-k1-values-on-the-bm25-of-the-unified-highlighter/110935)
**Author:** [@Sheker](https://discuss.elastic.co/u/Sheker)\ **Replies:** 2\ **Last updated:** [December 9, 2017, 8:04pm UTC](https://discuss.elastic.co/t/controlling-b-and-k1-values-on-the-bm25-of-the-unified-highlighter/110935 "2017-12-09T20:04:35Z")
Hi, The reference states: "The unified highlighter uses the Lucene Unified Highlighter. This highlighter breaks the text into sentences and uses the BM25 algorithm to score individual sentences as if they were document… --- ## [Processors setting when running multiple elaticsearch instances on same server](https://discuss.elastic.co/t/processors-setting-when-running-multiple-elaticsearch-instances-on-same-server/84196)
**Author:** [@macymin](https://discuss.elastic.co/u/macymin)\ **Replies:** 2\ **Last updated:** [May 29, 2017, 4:00am UTC](https://discuss.elastic.co/t/processors-setting-when-running-multiple-elaticsearch-instances-on-same-server/84196 "2017-05-29T04:00:55Z")
hi my data node server has 256G memory and 32 cores, currently we are running 3 elasticsearch instances (processors set to 8 for each instance) in the servers. but it often hit high CPU issue. our initial thinking … --- ## [Extending Existing Kibana Visualization Plugin](https://discuss.elastic.co/t/extending-existing-kibana-visualization-plugin/77323)
**Author:** [@vincentforiter](https://discuss.elastic.co/u/vincentforiter)\ **Replies:** 2\ **Last updated:** [March 7, 2017, 8:26am UTC](https://discuss.elastic.co/t/extending-existing-kibana-visualization-plugin/77323 "2017-03-07T08:26:11Z")
I'm looking for advice on how to make a plugin that would be very similar to the core plugin Data Table, except that it would show red or green dots instead of "true" or "false" for boolean values. My first thought was… --- ## [\_xpack vs \_watcher](https://discuss.elastic.co/t/-xpack-vs--watcher/69188)
**Author:** [@chromechris](https://discuss.elastic.co/u/chromechris)\ **Replies:** 2\ **Last updated:** [December 15, 2016, 4:49pm UTC](https://discuss.elastic.co/t/-xpack-vs--watcher/69188 "2016-12-15T16:49:39Z")
Hello, My team curretnly upgraded to ES 5.1. I tried using watcher with both URI's: GET xpack/watcher/watch/mywatch GET watcher/watcher/watch/mywatch Which both work. Is this for backwards comatibility. Is one UR… --- ## [Concerned about high query times](https://discuss.elastic.co/t/concerned-about-high-query-times/54526)
**Author:** [@Emrah](https://discuss.elastic.co/u/Emrah)\ **Replies:** 2\ **Last updated:** [August 24, 2016, 2:47pm UTC](https://discuss.elastic.co/t/concerned-about-high-query-times/54526 "2016-08-24T14:47:01Z")
Hi there, We recently decided use Elasticsearch for our website. Rewrote the website, including mobile apps in a short time. So the time we publish the website and apps , something went wrong in our elastic nodes. We h… --- ## [\[ Get the average number of an unique count \]](https://discuss.elastic.co/t/get-the-average-number-of-an-unique-count/52847)
**Author:** [@jerome83136](https://discuss.elastic.co/u/jerome83136)\ **Replies:** 2\ **Last updated:** [June 16, 2016, 7:56am UTC](https://discuss.elastic.co/t/get-the-average-number-of-an-unique-count/52847 "2016-06-16T07:56:10Z")
Hello, I need some help for a query. My documents are Apache access logs and they have a "jsessionid" field (string) and a JVM field (string). I would like to get the average number of unique count of jsessionid pe… --- ## [Phrase suggester and ngrams](https://discuss.elastic.co/t/phrase-suggester-and-ngrams/51780)
**Author:** [@Imran\_Azad](https://discuss.elastic.co/u/Imran_Azad)\ **Replies:** 2\ **Last updated:** [June 3, 2016, 2:45pm UTC](https://discuss.elastic.co/t/phrase-suggester-and-ngrams/51780 "2016-06-03T14:45:04Z")
The phrase suggester documentation makes a few references to ngrams: https://www.elastic.co/guide/en/elasticsearch/reference/current/search-suggesters-phrase.html Since it's possible to get the phrase suggester to work… --- ## [2 scales asbcisse on 1 graph](https://discuss.elastic.co/t/2-scales-asbcisse-on-1-graph/49386)
**Author:** [@pittoch](https://discuss.elastic.co/u/pittoch)\ **Replies:** 2\ **Last updated:** [May 7, 2016, 7:00am UTC](https://discuss.elastic.co/t/2-scales-asbcisse-on-1-graph/49386 "2016-05-07T07:00:10Z")
Hi, Is it possible to have two graph on one graph ? and have 2 abscisse like this graph on the left (IO/rate) and on the right "Response Time" in Ms \[image\] Thanks! --- ## [During develping kibana plugin](https://discuss.elastic.co/t/during-develping-kibana-plugin/48367)
**Author:** [@Jonghun\_Park](https://discuss.elastic.co/u/Jonghun_Park)\ **Replies:** 2\ **Last updated:** [April 27, 2016, 3:21am UTC](https://discuss.elastic.co/t/during-develping-kibana-plugin/48367 "2016-04-27T03:21:08Z")
Hello. I'm not sure why discover don't appear table contents when kibana run dev mode. I ran the elasticsearch using 'npm run elasticsearch' describing in kibana plugin dev manual. all of my actions such as setting up … --- ## [ESHadoop Port](https://discuss.elastic.co/t/eshadoop-port/40711)
**Author:** [@abhijitdeka11](https://discuss.elastic.co/u/abhijitdeka11)\ **Replies:** 2\ **Last updated:** [February 22, 2016, 5:45am UTC](https://discuss.elastic.co/t/eshadoop-port/40711 "2016-02-22T05:45:19Z")
Hi, I am working on a monitored environment where I need to explicitly open ports that are needed to be opened. I was trying the ESHadoop plugin to store data in ElasticSearch via Pig script.I am storing this as STO… --- ## [Architecture Elasticsearch](https://discuss.elastic.co/t/architecture-elasticsearch/40135)
**Author:** [@mkm](https://discuss.elastic.co/u/mkm)\ **Replies:** 2\ **Last updated:** [January 27, 2016, 8:12am UTC](https://discuss.elastic.co/t/architecture-elasticsearch/40135 "2016-01-27T08:12:54Z")
Bonjour, serait-il possible de m'expliquer si ES assure en plus de la distribution de l'indexation est ce que l'activité de recherche est -elle aussi réparti sur plusieurs noeud à l'image de ce que fait hadoop. En d'autr… --- ## [Cluster node discovery failed](https://discuss.elastic.co/t/cluster-node-discovery-failed/155653)
**Author:** [@wujiaxin159](https://discuss.elastic.co/u/wujiaxin159)\ **Replies:** 4\ **Last updated:** [November 9, 2018, 2:05am UTC](https://discuss.elastic.co/t/cluster-node-discovery-failed/155653 "2018-11-09T02:05:27Z")
elk version: 6.3.0 Using docker container Server IP: 9.77.10.27 --\> Docker IP: 172.17.0.2 Server IP: 9.77.10.28 --\> Docker IP: 172.17.0.3 9.77.10.27 config cluster.name: elk node.name: node-1 network.host: 0… --- ## [X-Pack Watch jobs for CPU usage](https://discuss.elastic.co/t/x-pack-watch-jobs-for-cpu-usage/129540)
**Author:** [@mww1](https://discuss.elastic.co/u/mww1)\ **Replies:** 4\ **Last updated:** [April 27, 2018, 2:43pm UTC](https://discuss.elastic.co/t/x-pack-watch-jobs-for-cpu-usage/129540 "2018-04-27T14:43:01Z")
Hi, I want to make a watch job for CPU usage\>20%. Please help me code with http input. thanks --- ## [Commit failure using remote cluster](https://discuss.elastic.co/t/commit-failure-using-remote-cluster/12965)
**Author:** [@Gordon\_Collins](https://discuss.elastic.co/u/Gordon_Collins)\ **Replies:** 4\ **Last updated:** [July 30, 2013, 7:09am UTC](https://discuss.elastic.co/t/commit-failure-using-remote-cluster/12965 "2013-07-30T07:09:39Z")
Hello, I'm trying to use remote ElasticSearch from TitanDB, but get the following error on commit in Gremlin: Could not commit transaction due to exception during persistence Display stack trace? \[yN\] y com.thi… --- ## [Elk cluster其中一个node启动提示failed to send join request to master](https://discuss.elastic.co/t/elk-cluster-node-failed-to-send-join-request-to-master/170268)
**Author:** [@jayshi1985](https://discuss.elastic.co/u/jayshi1985)\ **Replies:** 0\ **Last updated:** [February 28, 2019, 3:35am UTC](https://discuss.elastic.co/t/elk-cluster-node-failed-to-send-join-request-to-master/170268 "2019-02-28T03:35:35Z")
如题，elasticsearch cluster中，其中一个node无法正常启动elasticsearch，提示: \[2019-02-28T10:55:58,243\]\[INFO \]\[o.e.d.z.ZenDiscovery \] \[es-node-1\] failed to send join request to master \[{es-node-2}{THbImmRcQ7WdREIQcG4ndg}{cFtkVn3IRr-P\_g… --- ## [Failed to perform request](https://discuss.elastic.co/t/failed-to-perform-request/324071)
**Author:** [@test\_qweqwe](https://discuss.elastic.co/u/test_qweqwe)\ **Replies:** 1\ **Last updated:** [January 26, 2023, 10:15pm UTC](https://discuss.elastic.co/t/failed-to-perform-request/324071 "2023-01-26T22:15:18Z")
\[2023-01-26T19:51:43,271\]\[INFO \]\[logstash.outputs.elasticsearch\]\[main\] Failed to perform request {:message=\>"192.168.0.108:9200 failed to respond", :exception=\>Manticore::ClientProtocolException, :cause=\>#\ **Author:** [@auzin](https://discuss.elastic.co/u/auzin)\ **Replies:** 7\ **Last updated:** [September 5, 2019, 12:19am UTC](https://discuss.elastic.co/t/logstash-se-apaga-despues-de-estar-ejecutandose-unos-segundos/197529 "2019-09-05T00:19:38Z") Hi, Every time I try to run logstash with my config file, it shuts down a few seconds after de service is started. This is my config file: input{ file { path =\> "E:\\DATA\\test\\\*log" start\_position =\> "beginning"… --- ## [Sound alert in Kibana](https://discuss.elastic.co/t/sound-alert-in-kibana/133233)
**Author:** [@sunilmchaudhari](https://discuss.elastic.co/u/sunilmchaudhari)\ **Replies:** 1\ **Last updated:** [May 25, 2018, 2:08am UTC](https://discuss.elastic.co/t/sound-alert-in-kibana/133233 "2018-05-25T02:08:22Z")
Hello, is there any plugin in Kibana which makes sound on some specific alert condition is met? br, Sunil. --- ## [How to escape field values for elasticsearch filter query?](https://discuss.elastic.co/t/how-to-escape-field-values-for-elasticsearch-filter-query/125386)
**Author:** [@jdmcalee](https://discuss.elastic.co/u/jdmcalee)\ **Replies:** 1\ **Last updated:** [March 26, 2018, 1:22pm UTC](https://discuss.elastic.co/t/how-to-escape-field-values-for-elasticsearch-filter-query/125386 "2018-03-26T13:22:09Z")
I'm using the elasticsearch filter to enrich an event coming from a database. I'm using a fairly simple query: query =\> "usernames.keyword:%{\[userid\]}@%{\[domain\]}" It works fine, usually. However, I have instances wher… --- ## [Problems with parsing JSON file with \\n \\t and \\s](https://discuss.elastic.co/t/problems-with-parsing-json-file-with-n-t-and-s/113802)
**Author:** [@yishain11](https://discuss.elastic.co/u/yishain11)\ **Replies:** 1\ **Last updated:** [January 2, 2018, 4:43pm UTC](https://discuss.elastic.co/t/problems-with-parsing-json-file-with-n-t-and-s/113802 "2018-01-02T16:43:59Z")
Hi everyone! I have the following file I need to process in logstash: { "DataChangeInfo" : "Archive Log Set archiveLogSet.25933761.25933688 Info: Thread# Sequence# FirstScn LastScn", "documentsList" : \[ { "commandScn… --- ## [Certificate revocation via CLR or OCSP](https://discuss.elastic.co/t/certificate-revocation-via-clr-or-ocsp/106382)
**Author:** [@9nativ](https://discuss.elastic.co/u/9nativ)\ **Replies:** 1\ **Last updated:** [November 6, 2017, 10:45am UTC](https://discuss.elastic.co/t/certificate-revocation-via-clr-or-ocsp/106382 "2017-11-06T10:45:29Z")
Hi, We are using Filebeat (version 5.4.2) to ship our customer's logs to logstash servers and we are testing the process of server certificate revocation. As Filebeat using golang TLS stack, we noticed that Filebeat im… --- ## [Timelion - clause.split is not a function](https://discuss.elastic.co/t/timelion-clause-split-is-not-a-function/83321)
**Author:** [@Sjaak01](https://discuss.elastic.co/u/Sjaak01)\ **Replies:** 1\ **Last updated:** [April 24, 2017, 10:32pm UTC](https://discuss.elastic.co/t/timelion-clause-split-is-not-a-function/83321 "2017-04-24T22:32:34Z")
Hi, I'm trying to build a query that sums up netflow traffic based on a location field that I've added to my data so I can graph data based on the location. .es(metric='sum:netflow.in\_bytes').scale\_interval(1s).divi… --- ## [When loading from hive to elastic search](https://discuss.elastic.co/t/when-loading-from-hive-to-elastic-search/63388)
**Author:** [@Siva\_Sai](https://discuss.elastic.co/u/Siva_Sai)\ **Replies:** 1\ **Last updated:** [March 30, 2017, 11:48pm UTC](https://discuss.elastic.co/t/when-loading-from-hive-to-elastic-search/63388 "2017-03-30T23:48:55Z")
Status: Failed Vertex failed, vertexName=Map 1, vertexId=vertex\_1476839126138\_0014\_8\_00, diagnostics=\[Vertex vertex\_1476839126138\_0014\_8\_00 \[Map 1\] killed/failed due to:INIT\_FAILURE, Fail to create InputInitializerManage… --- ## [How to set a default start up option?](https://discuss.elastic.co/t/how-to-set-a-default-start-up-option/77557)
**Author:** [@Rich\_Johnson](https://discuss.elastic.co/u/Rich_Johnson)\ **Replies:** 1\ **Last updated:** [March 6, 2017, 7:34pm UTC](https://discuss.elastic.co/t/how-to-set-a-default-start-up-option/77557 "2017-03-06T19:34:27Z")
I am new to Elasticstack, and am currently plowing my way through Logstash configuration according to this guide: https://www.elastic.co/guide/en/logstash/5.2/advanced-pipeline.html On this page, it shows how you can… --- ## [ELK 5.0 with SSO](https://discuss.elastic.co/t/elk-5-0-with-sso/69432)
**Author:** [@Lakshmi1](https://discuss.elastic.co/u/Lakshmi1)\ **Replies:** 1\ **Last updated:** [December 19, 2016, 11:56am UTC](https://discuss.elastic.co/t/elk-5-0-with-sso/69432 "2016-12-19T11:56:16Z")
Hello Team, I need to integrate SSO(Single Sign on) with ELK 5.0. Can you please let me know what is the configuration and pre-requisites for the same. Thanks a lot. Lakshmi. --- ## [Unexpected behavior with Elasticsearch GeoShape query](https://discuss.elastic.co/t/unexpected-behavior-with-elasticsearch-geoshape-query/51612)
**Author:** [@JnBrymn](https://discuss.elastic.co/u/JnBrymn)\ **Replies:** 1\ **Last updated:** [June 1, 2016, 10:14pm UTC](https://discuss.elastic.co/t/unexpected-behavior-with-elasticsearch-geoshape-query/51612 "2016-06-01T22:14:15Z")
(copied from this stackoverflow question) Using Elasticsearch 2.3.1 and the python client I'm getting unexpected results with geo search. In the code below I create a simple index. I then index two shapes - a big squar… --- ## [How to pass command line arguments to logsatsh](https://discuss.elastic.co/t/how-to-pass-command-line-arguments-to-logsatsh/46924)
**Author:** [@sdaruna](https://discuss.elastic.co/u/sdaruna)\ **Replies:** 1\ **Last updated:** [April 11, 2016, 5:47am UTC](https://discuss.elastic.co/t/how-to-pass-command-line-arguments-to-logsatsh/46924 "2016-04-11T05:47:31Z")
Can we pass command line arguments to logstash.? I am sending the output from logstash to redis server. I would like to use command line arguments to pass the redis host. How can we pass command line arguments to log… --- ## [Filebeat: Payload Format](https://discuss.elastic.co/t/filebeat-payload-format/41262)
**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 1\ **Last updated:** [February 9, 2016, 10:05am UTC](https://discuss.elastic.co/t/filebeat-payload-format/41262 "2016-02-09T10:05:33Z")
Hi, I'm testing out filebeat on our elastic search logs. However, when the logs hit elasticsearch an "\_jsonparsefailure" tag gets added by the beats input in logstash. Can I ask, what format does beats use for sending… [Previous page](https://discuss.elastic.co/top.md?page=1653&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=1655&per_page=50&period=all)