# Top **URL:** https://discuss.elastic.co/top.md?page=504&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 505 --- ## [Filebeat.yml配置文件里面如何设置和调用自定义变量](https://discuss.elastic.co/t/filebeat-yml/134713)
**Author:** [@wuwenjie\_cn](https://discuss.elastic.co/u/wuwenjie_cn)\ **Replies:** 1\ **Last updated:** [June 13, 2018, 1:43am UTC](https://discuss.elastic.co/t/filebeat-yml/134713 "2018-06-13T01:43:43Z")
filebeat.yml配置文件里面如何设置和调用自定义变量 --- ## [Load logs from gzip files using codec](https://discuss.elastic.co/t/load-logs-from-gzip-files-using-codec/151188)
**Author:** [@GitSpree23](https://discuss.elastic.co/u/GitSpree23)\ **Replies:** 2\ **Last updated:** [October 8, 2018, 4:43am UTC](https://discuss.elastic.co/t/load-logs-from-gzip-files-using-codec/151188 "2018-10-08T04:43:37Z")
There is a closed topic regarding the same from 2 years ago ... But the .rb code has been updated on GitHub. What is the latest solution to using the gzip-lines codec? I have installed the codec and am running the fo… --- ## [Elastic platinum license and number of nodes](https://discuss.elastic.co/t/elastic-platinum-license-and-number-of-nodes/144221)
**Author:** [@mruthyu](https://discuss.elastic.co/u/mruthyu)\ **Replies:** 2\ **Last updated:** [August 14, 2018, 8:25am UTC](https://discuss.elastic.co/t/elastic-platinum-license-and-number-of-nodes/144221 "2018-08-14T08:25:17Z")
Let me know if the platinum license includes which all nodes? (Elasticsearch - hot and warm data nodes, Coordinating only nodes, Master nodes, Kibana, Logstash, Beats , X-Pack) --- ## [Distinct value and search](https://discuss.elastic.co/t/distinct-value-and-search/86838)
**Author:** [@hairinwind](https://discuss.elastic.co/u/hairinwind)\ **Replies:** 2\ **Last updated:** [May 26, 2017, 5:57pm UTC](https://discuss.elastic.co/t/distinct-value-and-search/86838 "2017-05-26T17:57:09Z")
My documents are like this. { "sourceTitle": "Arrival", "otherFields": ... } { "sourceTitle": "Arrival", "otherFields": ... } { "sourceTitle": "Eye in the Sky", "otherFields": ... } I need tw… --- ## [How to reduce elasticsearch high load average/cpu usage?](https://discuss.elastic.co/t/how-to-reduce-elasticsearch-high-load-average-cpu-usage/19932)
**Author:** [@lam](https://discuss.elastic.co/u/lam)\ **Replies:** 2\ **Last updated:** [September 25, 2014, 4:00am UTC](https://discuss.elastic.co/t/how-to-reduce-elasticsearch-high-load-average-cpu-usage/19932 "2014-09-25T04:00:30Z")
I am a developer from CHINA, i was suffering from load average recently,which range is 2-5 .I have 5 clustered nodes and each nodes have 1 replica,the cluster total document size is 2G and 2,000,000 docs. Here are som… --- ## [Webhook to slack fails to post - Elastic search 1.7](https://discuss.elastic.co/t/webhook-to-slack-fails-to-post-elastic-search-1-7/29514)
**Author:** [@Jag](https://discuss.elastic.co/u/Jag)\ **Replies:** 4\ **Last updated:** [September 18, 2015, 3:36am UTC](https://discuss.elastic.co/t/webhook-to-slack-fails-to-post-elastic-search-1-7/29514 "2015-09-18T03:36:39Z")
Hi, I am evaluating watcher to see if it fits our needs, one of the scenarios is to post to our slack channel, I added the below watcher curl -XPUT 'http://localhost:9200/\_watcher/watch/log\_error\_watch1' -d '{ "tri… --- ## [Throughput "docs/s" vs "ops/s"?](https://discuss.elastic.co/t/throughput-docs-s-vs-ops-s/218242)
**Author:** [@Chris1234](https://discuss.elastic.co/u/Chris1234)\ **Replies:** 3\ **Last updated:** [February 10, 2020, 7:31am UTC](https://discuss.elastic.co/t/throughput-docs-s-vs-ops-s/218242 "2020-02-10T07:31:22Z")
I've been running Rally (which is great thank you!) on clusters to test different setups. I've been watching the Throughput results as a rough "This is faster/slower" indicator. It's reported in "docs/s" for all the ru… --- ## [The load balancing algorithm followed by filebeat](https://discuss.elastic.co/t/the-load-balancing-algorithm-followed-by-filebeat/110376)
**Author:** [@George\_Cherian](https://discuss.elastic.co/u/George_Cherian)\ **Replies:** 3\ **Last updated:** [December 6, 2017, 2:01pm UTC](https://discuss.elastic.co/t/the-load-balancing-algorithm-followed-by-filebeat/110376 "2017-12-06T14:01:28Z")
Hi The question I have is that , I have two Logstash Instances, running on same configuration VMs, with filebeat forwarding data to both the logstash instances. But I could find that one of the VM is indexing 22 MB dat… --- ## [Prefix inside a multi\_match query](https://discuss.elastic.co/t/prefix-inside-a-multi-match-query/74860)
**Author:** [@Sunil\_Khullar](https://discuss.elastic.co/u/Sunil_Khullar)\ **Replies:** 1\ **Last updated:** [February 13, 2017, 10:41am UTC](https://discuss.elastic.co/t/prefix-inside-a-multi-match-query/74860 "2017-02-13T10:41:59Z")
Hi I am new to ES. And this is my first week. I have a requirement to search with prefix inside this multi\_match query. I am stuck Any any help will be appreciated. { "query": { "multi\_match": { … --- ## [Possible to add to @metadata?](https://discuss.elastic.co/t/possible-to-add-to-metadata/42592)
**Author:** [@whitej](https://discuss.elastic.co/u/whitej)\ **Replies:** 4\ **Last updated:** [February 24, 2016, 1:49pm UTC](https://discuss.elastic.co/t/possible-to-add-to-metadata/42592 "2016-02-24T13:49:24Z")
Is it possible to add information to the @metadata field? Or perhaps there's a better way to accomplish what I'm trying to do. I have multiple prospectors set up on each machine. Each prospector is consuming logs fro… --- ## [Failed to query elasticsearch for previous event {:query=\>"\_index:s1index AND type:a AND A:1 ",....:error=\>#\, :level=\>:warn}](https://discuss.elastic.co/t/failed-to-query-elasticsearch-for-previous-event-query--index-s1index-and-type-a-and-a-1-error-nomethoderror-undefined-method-start-with-for-nil-nilclass-level-warn/47254)
**Author:** [@rupal](https://discuss.elastic.co/u/rupal)\ **Replies:** 8\ **Last updated:** [July 18, 2016, 6:21am UTC](https://discuss.elastic.co/t/failed-to-query-elasticsearch-for-previous-event-query--index-s1index-and-type-a-and-a-1-error-nomethoderror-undefined-method-start-with-for-nil-nilclass-level-warn/47254 "2016-07-18T06:21:47Z")
Hi I have two csv files , s1.csv with following data, 1,2,3 1,2,3 2,3,4 And s2.csv with following data, 1,4 2,5 Consider column name as specified in configuration files like for s1 - A,B,C and… --- ## [Retrieve all ids that starts with a string](https://discuss.elastic.co/t/retrieve-all-ids-that-starts-with-a-string/73332)
**Author:** [@oranciog](https://discuss.elastic.co/u/oranciog)\ **Replies:** 3\ **Last updated:** [January 31, 2017, 10:26am UTC](https://discuss.elastic.co/t/retrieve-all-ids-that-starts-with-a-string/73332 "2017-01-31T10:26:41Z")
Hello! We want to retrieve all documents that have a common part in their ids. For example we want to retrieve all ids that starts with B\*. I saw the ids query, but it is not we want and also using a regexp on id or… --- ## [HTTP REST ElasticSearch client without lucene dependencies](https://discuss.elastic.co/t/http-rest-elasticsearch-client-without-lucene-dependencies/32224)
**Author:** [@Vicente\_de\_Rivera\_II](https://discuss.elastic.co/u/Vicente_de_Rivera_II)\ **Replies:** 6\ **Last updated:** [October 19, 2015, 3:29pm UTC](https://discuss.elastic.co/t/http-rest-elasticsearch-client-without-lucene-dependencies/32224 "2015-10-19T15:29:48Z")
Hi, I'm using ElasticSearch with JEST. But when I add the maven dependency for elasticsearch: \ \org.elasticsearch\ \elasticsearch\ \… --- ## [How to build an embedded node in 5.x](https://discuss.elastic.co/t/how-to-build-an-embedded-node-in-5-x/63925)
**Author:** [@dminkovsky](https://discuss.elastic.co/u/dminkovsky)\ **Replies:** 4\ **Last updated:** [June 19, 2017, 7:34pm UTC](https://discuss.elastic.co/t/how-to-build-an-embedded-node-in-5-x/63925 "2017-06-19T19:34:14Z")
I've used embedded Nodes for integration testing. Prior to 5.x, I could build a Node using the NodeBuilder. Now that builder is gone. How do I build an embedded node for testing? Looking at Boostrap.java, I am seeing: … --- ## [java.lang.ClassNotFoundException: org.elasticsearch.common.transport.TransportAddress](https://discuss.elastic.co/t/java-lang-classnotfoundexception-org-elasticsearch-common-transport-transportaddress/51915)
**Author:** [@mattcrawfoord](https://discuss.elastic.co/u/mattcrawfoord)\ **Replies:** 1\ **Last updated:** [June 7, 2016, 8:18am UTC](https://discuss.elastic.co/t/java-lang-classnotfoundexception-org-elasticsearch-common-transport-transportaddress/51915 "2016-06-07T08:18:30Z")
I am trying to query on Elasticsearch , But unable to run its jar. java -jar connect.jar i have put dependencies in my target jar Below is the error: Error: A JNI error has occurred, please check your installatio… --- ## [Kibana unable to configure fleet access](https://discuss.elastic.co/t/kibana-unable-to-configure-fleet-access/255977)
**Author:** [@Mikel\_U](https://discuss.elastic.co/u/Mikel_U)\ **Replies:** 6\ **Last updated:** [November 23, 2020, 9:52am UTC](https://discuss.elastic.co/t/kibana-unable-to-configure-fleet-access/255977 "2020-11-23T09:52:49Z")
Hi there, I'm trying to configure Fleet on Kibana container. Mi elastic-docker.yml is this (have 3 instances of elastic search and 1 of kibana): version: '2.2' services: es01: image: docker.elastic.co/elasticsear… --- ## [I want to match two grok patterns in one config file?](https://discuss.elastic.co/t/i-want-to-match-two-grok-patterns-in-one-config-file/87878)
**Author:** [@Yaswanth](https://discuss.elastic.co/u/Yaswanth)\ **Replies:** 5\ **Last updated:** [June 4, 2017, 9:07am UTC](https://discuss.elastic.co/t/i-want-to-match-two-grok-patterns-in-one-config-file/87878 "2017-06-04T09:07:59Z")
Hi, I have two types of error messages in the below format: \[2017-05-25 01:00:00,647\]\[ERROR\]\[marvel.agent.exporter.local\] local exporter \[default\_local\] - failed to delete indices RemoteTransportException\[\[data-0\]\[10… --- ## [Filebeat - issue after enable elasticsearch module](https://discuss.elastic.co/t/filebeat-issue-after-enable-elasticsearch-module/297553)
**Author:** [@dominbdg](https://discuss.elastic.co/u/dominbdg)\ **Replies:** 4\ **Last updated:** [February 20, 2022, 8:03pm UTC](https://discuss.elastic.co/t/filebeat-issue-after-enable-elasticsearch-module/297553 "2022-02-20T20:03:16Z")
Hello, I would like to filebeat process my Elasticsearch audit logs. When I enable Elasticsearch module (filebeat modules enable Elasticsearch) module is enabled and under modules.d file Elasticsearch.yml.disabled chan… --- ## [Entrada File en Logstash](https://discuss.elastic.co/t/entrada-file-en-logstash/109469)
**Author:** [@Diego\_Gomez](https://discuss.elastic.co/u/Diego_Gomez)\ **Replies:** 7\ **Last updated:** [November 29, 2017, 5:01pm UTC](https://discuss.elastic.co/t/entrada-file-en-logstash/109469 "2017-11-29T17:01:59Z")
Buenas este es mi codigo en el archivo de logstash y debajo pongo la salida, no logro entender los errores que estoy teniendo. Si alguien puede ayudarme. este es el archivo que quiero desmenuzar. MODSEN:000#I:216F6F057… --- ## [Replace my \\r\\n with a new line using mutate gsub](https://discuss.elastic.co/t/replace-my-r-n-with-a-new-line-using-mutate-gsub/288240)
**Author:** [@rkhapre](https://discuss.elastic.co/u/rkhapre)\ **Replies:** 6\ **Last updated:** [November 2, 2021, 9:35pm UTC](https://discuss.elastic.co/t/replace-my-r-n-with-a-new-line-using-mutate-gsub/288240 "2021-11-02T21:35:49Z")
Hi All I have a csv data in this format { "message" : "value1,value2,value3\\r\\nvalue4,value5,value6" } My expected result is { "message" : "value1,value2,value3 value4,value5,value6" } I have tried mutate g… --- ## [How to run Logstash as a service on Windows](https://discuss.elastic.co/t/how-to-run-logstash-as-a-service-on-windows/189801)
**Author:** [@akhilsharma.in](https://discuss.elastic.co/u/akhilsharma.in)\ **Replies:** 3\ **Last updated:** [July 11, 2019, 10:39am UTC](https://discuss.elastic.co/t/how-to-run-logstash-as-a-service-on-windows/189801 "2019-07-11T10:39:10Z")
Hello, I'm configuring Logstash on windows server. And I need logstash to run as a service and not from command line. And I assume service is configured with an .exe file as binary and not other files like .bat or .ps1.… --- ## [Region Map can't join fields](https://discuss.elastic.co/t/region-map-cant-join-fields/106308)
**Author:** [@kumpelblase](https://discuss.elastic.co/u/kumpelblase)\ **Replies:** 2\ **Last updated:** [November 3, 2017, 3:17pm UTC](https://discuss.elastic.co/t/region-map-cant-join-fields/106308 "2017-11-03T15:17:37Z")
Hi there I created my own region map for the countys of switzerland. Everything's good the areas are shown on the map, but my data fields won't show on the map. Also if I click on one of the countys I get this response … --- ## [How to take word order into account in match\_phrase query](https://discuss.elastic.co/t/how-to-take-word-order-into-account-in-match-phrase-query/237448)
**Author:** [@mehdi89](https://discuss.elastic.co/u/mehdi89)\ **Replies:** 0\ **Last updated:** [June 17, 2020, 10:08am UTC](https://discuss.elastic.co/t/how-to-take-word-order-into-account-in-match-phrase-query/237448 "2020-06-17T10:08:52Z")
Suppose that my index have two documents: "get my money" "my money get here" When I do a regular match query for "get my money", both documents match correctly but they get equal scores. However, I want the order of w… --- ## [Filebeat and kubernetes with custom index](https://discuss.elastic.co/t/filebeat-and-kubernetes-with-custom-index/156336)
**Author:** [@CSaavedra](https://discuss.elastic.co/u/CSaavedra)\ **Replies:** 3\ **Last updated:** [November 14, 2018, 3:08pm UTC](https://discuss.elastic.co/t/filebeat-and-kubernetes-with-custom-index/156336 "2018-11-14T15:08:32Z")
Hi guys, Im try to create a custom indexes for my different apps in a kubernetes cluster, but this not working :frowning: anyone know any way to create this ? Here is a part of my code output.elasticsearch: hosts: … --- ## [Elasticsearch-5.0.2 -\> SERVICE\_UNAVAILABLE/1/state not recovered / initialized](https://discuss.elastic.co/t/elasticsearch-5-0-2-service-unavailable-1-state-not-recovered-initialized/123665)
**Author:** [@lupolo](https://discuss.elastic.co/u/lupolo)\ **Replies:** 1\ **Last updated:** [March 14, 2018, 1:33pm UTC](https://discuss.elastic.co/t/elasticsearch-5-0-2-service-unavailable-1-state-not-recovered-initialized/123665 "2018-03-14T13:33:21Z")
Hi, What can I do to bring this cluster of 5 nodes up and running again? Issue: Since I upgraded jvm.options settings from -Xms2g -Xmx2g to -Xms4g -Xmx4g the cluster stays in red state. See details: Version: elastic… --- ## [Exclude\_pattern in logstash s3 input](https://discuss.elastic.co/t/exclude-pattern-in-logstash-s3-input/97993)
**Author:** [@niraj\_kumar](https://discuss.elastic.co/u/niraj_kumar)\ **Replies:** 4\ **Last updated:** [August 24, 2017, 8:28pm UTC](https://discuss.elastic.co/t/exclude-pattern-in-logstash-s3-input/97993 "2017-08-24T20:28:15Z")
This is my s3 input config. I am trying to exclude a key that has name called CloudTrail-Digest. input { s3 { type =\> "cloudtrail" bucket =\> "aws" prefix =\> "Accounts/" add\_field =\> { source =\> gzfiles… --- ## [Change Color of Kibana Top Banner](https://discuss.elastic.co/t/change-color-of-kibana-top-banner/46395)
**Author:** [@michelle.foy](https://discuss.elastic.co/u/michelle.foy)\ **Replies:** 5\ **Last updated:** [April 18, 2016, 6:07pm UTC](https://discuss.elastic.co/t/change-color-of-kibana-top-banner/46395 "2016-04-18T18:07:24Z")
Hi, I have been able to change the Kibana logo in the Kibana 4.X top banner, but what about changing the background color of the navigation banner? Is there a simple way of changing the color code from black/dark grey … --- ## [Using Scripted field to display a sub-string](https://discuss.elastic.co/t/using-scripted-field-to-display-a-sub-string/310798)
**Author:** [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\ **Replies:** 6\ **Last updated:** [July 29, 2022, 8:18pm UTC](https://discuss.elastic.co/t/using-scripted-field-to-display-a-sub-string/310798 "2022-07-29T20:18:55Z")
Hello. We are using ELK 7.6.2 stack. I have a field named host.name which displays a value such as ad-c2ff-v2bg.taz.root.net I need to extract the second substring (taz) using Scripted field. When I try to define a n… --- ## [Logstash not logging to /var/log](https://discuss.elastic.co/t/logstash-not-logging-to-var-log/125013)
**Author:** [@hgpit](https://discuss.elastic.co/u/hgpit)\ **Replies:** 1\ **Last updated:** [March 21, 2018, 3:47pm UTC](https://discuss.elastic.co/t/logstash-not-logging-to-var-log/125013 "2018-03-21T15:47:15Z")
Hello, I am brand new to logstash 6.2.3 and struggling with some basics. I have installed it onto CentOS7. If I run 'systemctl start logstash', I get nothing output to /var/log/logstash/ (but 'systemctl status logstash'… --- ## [Kibana issue with PEM format](https://discuss.elastic.co/t/kibana-issue-with-pem-format/246356)
**Author:** [@ManuelF](https://discuss.elastic.co/u/ManuelF)\ **Replies:** 3\ **Last updated:** [August 26, 2020, 12:34pm UTC](https://discuss.elastic.co/t/kibana-issue-with-pem-format/246356 "2020-08-26T12:34:30Z")
\*Running ELK 7.9 Apparently Kibana is not being able to read/parse certificate/key files in PEM format. These file where generated via /usr/share/elasticsearch/bin/elasticsearch-certutil csr , so it should work like a c… --- ## [Keyword field not aggregatable and not searchable](https://discuss.elastic.co/t/keyword-field-not-aggregatable-and-not-searchable/84631)
**Author:** [@ajnfde](https://discuss.elastic.co/u/ajnfde)\ **Replies:** 4\ **Last updated:** [May 8, 2017, 9:14pm UTC](https://discuss.elastic.co/t/keyword-field-not-aggregatable-and-not-searchable/84631 "2017-05-08T21:14:41Z")
Hi, I can't make visualisation table using a field I add from logstash. In logstash conf file used, I read a log file containing XML data. XML data example : \ ... \ \ \ \ **Author:** [@m\_ebags](https://discuss.elastic.co/u/m_ebags)\ **Replies:** 5\ **Last updated:** [February 1, 2018, 5:23am UTC](https://discuss.elastic.co/t/kibana-ssl-pem-error-on-windows/117851 "2018-02-01T05:23:57Z") Note: I will regenerate all passwords, certs and ect in my final install since I have provided all that information here. Environment Windows 10 Enterprises Elasticsearch Version : 6.1.1 (elasticsearch-6.1.1.zip) Kib… --- ## [Filebeat Elastic working, but filebeat logstash not working](https://discuss.elastic.co/t/filebeat-elastic-working-but-filebeat-logstash-not-working/83121)
**Author:** [@sLuvpreet33](https://discuss.elastic.co/u/sLuvpreet33)\ **Replies:** 5\ **Last updated:** [April 21, 2017, 6:14am UTC](https://discuss.elastic.co/t/filebeat-elastic-working-but-filebeat-logstash-not-working/83121 "2017-04-21T06:14:44Z")
Hi, I am searching for a solution to this for past 2 days, but have not found it. Filebeat can send data to elasticsearch, but it is not working if I am sending it by logstash. Here is the filebeat.yml file, filebe… --- ## [Kibana Lens Table Date Format](https://discuss.elastic.co/t/kibana-lens-table-date-format/284746)
**Author:** [@fefontana](https://discuss.elastic.co/u/fefontana)\ **Replies:** 6\ **Last updated:** [September 23, 2021, 8:52pm UTC](https://discuss.elastic.co/t/kibana-lens-table-date-format/284746 "2021-09-23T20:52:26Z")
Hi, using a table in Kibana Lens I can't get a formatted date at the "Log Date" column. The date format changes according to the time period. Below is the JSON I've been using and the screenshots with the issue { "too… --- ## [Elastic Agent filling up disk space with logs, disaster](https://discuss.elastic.co/t/elastic-agent-filling-up-disk-space-with-logs-disaster/276668)
**Author:** [@Achilleas](https://discuss.elastic.co/u/Achilleas)\ **Replies:** 6\ **Last updated:** [June 28, 2021, 5:03pm UTC](https://discuss.elastic.co/t/elastic-agent-filling-up-disk-space-with-logs-disaster/276668 "2021-06-28T17:03:52Z")
We had a meltdown on one of our servers, where the elastic agent filled up the disk space with logs (36GB of text logfiles, in 2 months), from a trial we had on the Elastic Cloud. I know I am to blame for installing an … --- ## [How to find the difference between aggregate min from aggregate max(max - min) in ES?](https://discuss.elastic.co/t/how-to-find-the-difference-between-aggregate-min-from-aggregate-max-max-min-in-es/17390)
**Author:** [@Alex\_Mathew](https://discuss.elastic.co/u/Alex_Mathew)\ **Replies:** 6\ **Last updated:** [March 6, 2015, 8:31am UTC](https://discuss.elastic.co/t/how-to-find-the-difference-between-aggregate-min-from-aggregate-max-max-min-in-es/17390 "2015-03-06T08:31:53Z")
How to write an ES query to find the difference between max and min value of a field? I am a newbee in elastic search, In my case I feed lot of events along with session\_id and time in to elastic search. My eve… --- ## [Pivot table or substitute](https://discuss.elastic.co/t/pivot-table-or-substitute/158125)
**Author:** [@hermann102](https://discuss.elastic.co/u/hermann102)\ **Replies:** 2\ **Last updated:** [November 28, 2018, 2:17pm UTC](https://discuss.elastic.co/t/pivot-table-or-substitute/158125 "2018-11-28T14:17:31Z")
Hello all, We use the pivot table plugin in kibana 6.2.4 without any problem. But it can not be used with version 6.4. Is there any other plugin that can be used as a pivot table? I have heard of pandas, my research o… --- ## [Unique node id for elasticsearch node](https://discuss.elastic.co/t/unique-node-id-for-elasticsearch-node/23682)
**Author:** [@Debayan\_Banerjee](https://discuss.elastic.co/u/Debayan_Banerjee)\ **Replies:** 2\ **Last updated:** [May 26, 2015, 5:40am UTC](https://discuss.elastic.co/t/unique-node-id-for-elasticsearch-node/23682 "2015-05-26T05:40:03Z")
Hi, I want to know the node unique ID for an elasticsearch node via an API. There is https://www.elastic.co/guide/en/elasticsearch/reference/1.3/cat-nodes.html but it only shows a four letter abbreviated ID. I need… --- ## [Filebeat error. Returns unicode character code instead of symbol](https://discuss.elastic.co/t/filebeat-error-returns-unicode-character-code-instead-of-symbol/64827)
**Author:** [@elasticheart](https://discuss.elastic.co/u/elasticheart)\ **Replies:** 4\ **Last updated:** [November 8, 2016, 8:12am UTC](https://discuss.elastic.co/t/filebeat-error-returns-unicode-character-code-instead-of-symbol/64827 "2016-11-08T08:12:02Z")
I have a multiline log file, in which entries are nested using xml like markup, inside \< and \> tags. I have defined multiline pattern and it works fine. It was working fine with filebeat 5.0.0 alpha. But in new 5.0 GA ve… --- ## [Access Denied reading from Security log on Windows 2012](https://discuss.elastic.co/t/access-denied-reading-from-security-log-on-windows-2012/48445)
**Author:** [@xiaozhuqq48](https://discuss.elastic.co/u/xiaozhuqq48)\ **Replies:** 4\ **Last updated:** [April 27, 2016, 12:45am UTC](https://discuss.elastic.co/t/access-denied-reading-from-security-log-on-windows-2012/48445 "2016-04-27T00:45:55Z")
winlogbeat 1.2.1 windows 2012 configuration : most are the defaults. just the output for logstash. \[ winlogbeat: registry\_file: C:/ProgramData/winlogbeat/.winlogbeat.yml event\_logs: - name: Application igno… --- ## [Performance concerns on using UUIDv4 generated ID](https://discuss.elastic.co/t/performance-concerns-on-using-uuidv4-generated-id/139775)
**Author:** [@Ali\_Nazemian](https://discuss.elastic.co/u/Ali_Nazemian)\ **Replies:** 5\ **Last updated:** [July 17, 2018, 6:56am UTC](https://discuss.elastic.co/t/performance-concerns-on-using-uuidv4-generated-id/139775 "2018-07-17T06:56:50Z")
I was wondering if there are any performance concerns on using UUIDv4 generated ID at the client side? I've got an application that sends documents with a randomly generated id. I've noticed the ID is generated by using … --- ## [Filebeat Fortinet module doesn't parse message field](https://discuss.elastic.co/t/filebeat-fortinet-module-doesnt-parse-message-field/246013)
**Author:** [@anon56147639](https://discuss.elastic.co/u/anon56147639)\ **Replies:** 6\ **Last updated:** [August 26, 2020, 3:35pm UTC](https://discuss.elastic.co/t/filebeat-fortinet-module-doesnt-parse-message-field/246013 "2020-08-26T15:35:27Z")
Hi everyone, I'm facing issues with the Fortinet module in Filebeat. It stores the whole log in the message field instead of seperate fields. This is an example of my log (I removed some info such as IPs): https://paste… --- ## [Unexpected pool error](https://discuss.elastic.co/t/unexpected-pool-error/74340)
**Author:** [@111126](https://discuss.elastic.co/u/111126)\ **Replies:** 3\ **Last updated:** [February 22, 2017, 5:53am UTC](https://discuss.elastic.co/t/unexpected-pool-error/74340 "2017-02-22T05:53:09Z")
hello! I have logstash, elastic verison 5.2 My elastic - there is cluster with two nodes (ip adress x.x.x.x and y.y.y.y). My output logstash config: \> elasticsearch { \> hosts =\> … --- ## [Filebeat not sending logs to logstash](https://discuss.elastic.co/t/filebeat-not-sending-logs-to-logstash/127372)
**Author:** [@sandeepnarla22322](https://discuss.elastic.co/u/sandeepnarla22322)\ **Replies:** 7\ **Last updated:** [April 25, 2018, 3:55pm UTC](https://discuss.elastic.co/t/filebeat-not-sending-logs-to-logstash/127372 "2018-04-25T15:55:51Z")
elk.home: /tmp/ELK filebeat.prospectors: input\_type: log paths: ${elk.home}/LogStashOutputFormatted/SES\_VG1/\*.csv fields: log\_type: sesvg1 input\_type: log paths: ${elk.home}/LogStashOutputFormatted/SES\_VG2… --- ## [Can the Ingest Attachment Processor Plugin extract array data?](https://discuss.elastic.co/t/can-the-ingest-attachment-processor-plugin-extract-array-data/67199)
**Author:** [@M4urice](https://discuss.elastic.co/u/M4urice)\ **Replies:** 7\ **Last updated:** [December 21, 2016, 7:40am UTC](https://discuss.elastic.co/t/can-the-ingest-attachment-processor-plugin-extract-array-data/67199 "2016-12-21T07:40:17Z")
Hello! :slight\_smile: So I am diving into v5 at the moment and want to use the Ingest Attachment Processor Plugin (https://www.elastic.co/guide/en/elasticsearch/plugins/current/ingest-attachment.html) in combination w… --- ## [Get a length/size of message field value](https://discuss.elastic.co/t/get-a-length-size-of-message-field-value/254368)
**Author:** [@EugeneZ](https://discuss.elastic.co/u/EugeneZ)\ **Replies:** 4\ **Last updated:** [November 5, 2020, 10:02am UTC](https://discuss.elastic.co/t/get-a-length-size-of-message-field-value/254368 "2020-11-05T10:02:14Z")
Hi, I try to make a scripted fields with size of message field value. I tried doc\['message'\].value.getSize() doc\['message'\].value.size() I tried also with \['message.keyword'\] but nothing. I have in preview. Where am… --- ## [Elasticsearch crashes when updated data path](https://discuss.elastic.co/t/elasticsearch-crashes-when-updated-data-path/35024)
**Author:** [@Sanjay\_Bhosale](https://discuss.elastic.co/u/Sanjay_Bhosale)\ **Replies:** 5\ **Last updated:** [November 19, 2015, 3:03pm UTC](https://discuss.elastic.co/t/elasticsearch-crashes-when-updated-data-path/35024 "2015-11-19T15:03:57Z")
Hi, Elasticsearch setup works fine with default configurations. But when updated its path.data setting from elasticsearch.yml file it crashes with below error \[2015-11-19 12:39:56,194\]\[ERROR\]\[bootstrap … --- ## [SOAR for elk](https://discuss.elastic.co/t/soar-for-elk/228133)
**Author:** [@oumy](https://discuss.elastic.co/u/oumy)\ **Replies:** 2\ **Last updated:** [April 16, 2020, 11:03am UTC](https://discuss.elastic.co/t/soar-for-elk/228133 "2020-04-16T11:03:02Z")
Hello there, i was wondering if there is an open source SOAR that can be integrated with elk stack, and if so how to do so? and does any of you know how too integrate PatrOwl with elk stack? Thank you --- ## [Kibana {"statusCode":404,"error":"Not Found","message":"Not Found"}](https://discuss.elastic.co/t/kibana-statuscode-404-error-not-found-message-not-found/217124)
**Author:** [@Whovian](https://discuss.elastic.co/u/Whovian)\ **Replies:** 2\ **Last updated:** [February 11, 2020, 11:40am UTC](https://discuss.elastic.co/t/kibana-statuscode-404-error-not-found-message-not-found/217124 "2020-02-11T11:40:53Z")
Hello there elasticsearch and logstash work but not my ihm kibana Here's my problem On ihm -\> {"statusCode":404,"error":"Not Found","message":"Not Found"} When i launch bin\]$ kibana log \[07:38:38.505\] \[info\]\[plug… --- ## [Elasticsearch parallel queries performance](https://discuss.elastic.co/t/elasticsearch-parallel-queries-performance/50307)
**Author:** [@Avi\_Kesselr](https://discuss.elastic.co/u/Avi_Kesselr)\ **Replies:** 3\ **Last updated:** [May 19, 2016, 5:24am UTC](https://discuss.elastic.co/t/elasticsearch-parallel-queries-performance/50307 "2016-05-19T05:24:51Z")
Hello, We have been using elastic for a while ( running on version 1.7). We noted that when a specific user is running a "heavy query" using the kebana all other users are experiencing a a huge performance delay it's l… [Previous page](https://discuss.elastic.co/top.md?page=503&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=505&per_page=50&period=all)