# Top **URL:** https://discuss.elastic.co/top.md?page=604&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 605 --- ## [Running Rally w/ use\_ssl — how do I pass cert & key info?](https://discuss.elastic.co/t/running-rally-w-use-ssl-how-do-i-pass-cert-key-info/83946)
**Author:** [@khyron4eva](https://discuss.elastic.co/u/khyron4eva)\ **Replies:** 7\ **Last updated:** [May 3, 2017, 5:47am UTC](https://discuss.elastic.co/t/running-rally-w-use-ssl-how-do-i-pass-cert-key-info/83946 "2017-05-03T05:47:17Z")
Hello again. After having finally located the docs re: --client-options, I've been trying some invocations with "use\_ssl:true" but they all fail. Rally won't let me disable cert verification so now I'm stuck. I could u… --- ## [How to do summary indexing in Elasticsearch](https://discuss.elastic.co/t/how-to-do-summary-indexing-in-elasticsearch/245491)
**Author:** [@kelk](https://discuss.elastic.co/u/kelk)\ **Replies:** 6\ **Last updated:** [August 18, 2020, 9:45pm UTC](https://discuss.elastic.co/t/how-to-do-summary-indexing-in-elasticsearch/245491 "2020-08-18T21:45:08Z")
hi, we have a massive index, few reference indexes and we wanted to summarise from these multiple indexes into a single "summary index" . This way we are planning to join the queries So the questions Can output of a … --- ## [APM agent for Java docker application](https://discuss.elastic.co/t/apm-agent-for-java-docker-application/178035)
**Author:** [@mugil1988](https://discuss.elastic.co/u/mugil1988)\ **Replies:** 4\ **Last updated:** [April 24, 2019, 5:30am UTC](https://discuss.elastic.co/t/apm-agent-for-java-docker-application/178035 "2019-04-24T05:30:35Z")
Hi Team, I am trying to configure Elastic APM for dockerized Java application.. Kindly let me know the steps to configure Java APM agent for docker Java apps.. Thanks, Mugil --- ## [Public ElasticSearch cloud server for trial?](https://discuss.elastic.co/t/public-elasticsearch-cloud-server-for-trial/24473)
**Author:** [@linlma](https://discuss.elastic.co/u/linlma)\ **Replies:** 4\ **Last updated:** [June 28, 2015, 7:25am UTC](https://discuss.elastic.co/t/public-elasticsearch-cloud-server-for-trial/24473 "2015-06-28T07:25:54Z")
Hello ElasticSeach experts, Is there any public ElasticSearch cluster which we can excise create index, and query? Without the overhead of maintaining our own server. \[smile\] thanks in advance, Lin --- ## [Change color-label names](https://discuss.elastic.co/t/change-color-label-names/220181)
**Author:** [@johnkary](https://discuss.elastic.co/u/johnkary)\ **Replies:** 8\ **Last updated:** [February 21, 2020, 1:54pm UTC](https://discuss.elastic.co/t/change-color-label-names/220181 "2020-02-21T13:54:18Z")
Hi to all the great team! I have an index with 2 docs where i store active / inactive systems (one doc for 'active' and the other doc for 'inactive'). This index is refreshed every 10 minutes with new values of active /… --- ## [Is it possible to use the json codec along with a json filter to further parse things into other fields?](https://discuss.elastic.co/t/is-it-possible-to-use-the-json-codec-along-with-a-json-filter-to-further-parse-things-into-other-fields/121120)
**Author:** [@Tieis](https://discuss.elastic.co/u/Tieis)\ **Replies:** 8\ **Last updated:** [February 26, 2018, 9:03pm UTC](https://discuss.elastic.co/t/is-it-possible-to-use-the-json-codec-along-with-a-json-filter-to-further-parse-things-into-other-fields/121120 "2018-02-26T21:03:06Z")
I've been looking around and experimented a bit, but haven't gotten it to work or so to say. I have a tcp input with the json codec, along with an elasticsearch output with a template that adds some custom fields. I use… --- ## [Kibana indexes will not update or delete](https://discuss.elastic.co/t/kibana-indexes-will-not-update-or-delete/32785)
**Author:** [@burnsie](https://discuss.elastic.co/u/burnsie)\ **Replies:** 3\ **Last updated:** [November 6, 2015, 4:59am UTC](https://discuss.elastic.co/t/kibana-indexes-will-not-update-or-delete/32785 "2015-11-06T04:59:20Z")
I am relatively new to the ELK and have been playing around with the index for the last couple of weeks. We are modelling a log file that is also currently under-deveopment, hence there are many changes. I regularly upda… --- ## [Finding distance between Geo Points](https://discuss.elastic.co/t/finding-distance-between-geo-points/70147)
**Author:** [@patlola](https://discuss.elastic.co/u/patlola)\ **Replies:** 2\ **Last updated:** [December 28, 2016, 2:48pm UTC](https://discuss.elastic.co/t/finding-distance-between-geo-points/70147 "2016-12-28T14:48:21Z")
Hello, I would like to find distance between two geo points(lat,lon) I have tried to find distance using script\_fields but getting this error Is there any good way to find out the distance between two points except… --- ## [Filebeat lock monitored files?](https://discuss.elastic.co/t/filebeat-lock-monitored-files/39660)
**Author:** [@djvidov](https://discuss.elastic.co/u/djvidov)\ **Replies:** 5\ **Last updated:** [October 26, 2016, 2:18pm UTC](https://discuss.elastic.co/t/filebeat-lock-monitored-files/39660 "2016-10-26T14:18:53Z")
Hello, Can filebeat lock some monitored files for some reasons (Windows Server 2008 R2)? Regards, Ovidiu --- ## [Reindex behavior with dynamic mapping false](https://discuss.elastic.co/t/reindex-behavior-with-dynamic-mapping-false/93192)
**Author:** [@TdL](https://discuss.elastic.co/u/TdL)\ **Replies:** 2\ **Last updated:** [July 22, 2017, 10:26am UTC](https://discuss.elastic.co/t/reindex-behavior-with-dynamic-mapping-false/93192 "2017-07-22T10:26:17Z")
Hey, I am trying to implement some kind of migration for mapping changes. So my problem is I want to use reindex if for some reason my new mapping doesn't work with my current data (e.g. types changed). If a field has be… --- ## [Split a json array and then split on each object](https://discuss.elastic.co/t/split-a-json-array-and-then-split-on-each-object/285846)
**Author:** [@devtough](https://discuss.elastic.co/u/devtough)\ **Replies:** 7\ **Last updated:** [October 4, 2021, 10:20pm UTC](https://discuss.elastic.co/t/split-a-json-array-and-then-split-on-each-object/285846 "2021-10-04T22:20:21Z")
I would like to configure Logstash so that given a JSON input of \[ { "record": "a", "actions": \[ { "id": 1 }, { "id": 2 } \] }, { "record": "b", "actions": \[ { "id": 3 }, { "id": 4 } \] } \] it outputs {record: "a"… --- ## ['Illegal access' error](https://discuss.elastic.co/t/illegal-access-error/158957)
**Author:** [@s0r1n](https://discuss.elastic.co/u/s0r1n)\ **Replies:** 6\ **Last updated:** [December 6, 2018, 10:01am UTC](https://discuss.elastic.co/t/illegal-access-error/158957 "2018-12-06T10:01:53Z")
A docker with Apache, Tomcat and Elasticsearch images starts and runs without issue. But after restart with docker-compose down/up , the following error occurs: 30-Nov-2018 14:49:58.857 INFO \[main\] org.apache.catalina.c… --- ## [ES create index fails when using more than one geoip](https://discuss.elastic.co/t/es-create-index-fails-when-using-more-than-one-geoip/28875)
**Author:** [@gdanielson](https://discuss.elastic.co/u/gdanielson)\ **Replies:** 6\ **Last updated:** [January 20, 2016, 2:23am UTC](https://discuss.elastic.co/t/es-create-index-fails-when-using-more-than-one-geoip/28875 "2016-01-20T02:23:16Z")
Starting out with ELK stack, initially to work with Cisco ASA firewall logs. It's been a bit of a learning curve regarding the mapping template config, I finally managed to get the IP addresses mapped to type:ip (after f… --- ## [Proper way to escape escape characters](https://discuss.elastic.co/t/proper-way-to-escape-escape-characters/324143)
**Author:** [@hexoffender](https://discuss.elastic.co/u/hexoffender)\ **Replies:** 3\ **Last updated:** [January 30, 2023, 5:31pm UTC](https://discuss.elastic.co/t/proper-way-to-escape-escape-characters/324143 "2023-01-30T17:31:18Z")
Hello, I have a weird problem. I'm trying to replace \\x5c with \\ in a mutate. However, the logstash config fails to parse when I do this: input { beats { # The port to listen on for filebeat connections. … --- ## [Custom Docker Image Install Plugin from Local file](https://discuss.elastic.co/t/custom-docker-image-install-plugin-from-local-file/146727)
**Author:** [@kkr78](https://discuss.elastic.co/u/kkr78)\ **Replies:** 2\ **Last updated:** [August 30, 2018, 3:05pm UTC](https://discuss.elastic.co/t/custom-docker-image-install-plugin-from-local-file/146727 "2018-08-30T15:05:36Z")
Not able to install the plugin from local zip file. I followed the instructions in Official Doc but it didn't work. Do I have do it differently for docker image? $ bin/kibana-plugin install file:///some/local/path/my-pl… --- ## [Docker - app\_search - how to find default password](https://discuss.elastic.co/t/docker-app-search-how-to-find-default-password/213235)
**Author:** [@byteandbit](https://discuss.elastic.co/u/byteandbit)\ **Replies:** 8\ **Last updated:** [January 8, 2020, 10:42pm UTC](https://discuss.elastic.co/t/docker-app-search-how-to-find-default-password/213235 "2020-01-08T22:42:49Z")
How to find out or set password for user: app\_search in App Search Docker? Can not login via: http://localhost:3002/login and keep getting: "Authentication has failed Invalid credentials" From logs I can see that AppS… --- ## [Deleting documents from couchdb doesn't delete it from ES index](https://discuss.elastic.co/t/deleting-documents-from-couchdb-doesnt-delete-it-from-es-index/29807)
**Author:** [@imad](https://discuss.elastic.co/u/imad)\ **Replies:** 8\ **Last updated:** [September 25, 2015, 7:45pm UTC](https://discuss.elastic.co/t/deleting-documents-from-couchdb-doesnt-delete-it-from-es-index/29807 "2015-09-25T19:45:07Z")
I wondering if there is anything extra that I need do to delete a document from ES index when its deleted from my couchdb. Here is how my config file looks like: input { couchdb\_changes { db =\> "users" ho… --- ## [Can't listen to syslog with Logstash](https://discuss.elastic.co/t/cant-listen-to-syslog-with-logstash/119206)
**Author:** [@Adren](https://discuss.elastic.co/u/Adren)\ **Replies:** 7\ **Last updated:** [February 9, 2018, 1:38pm UTC](https://discuss.elastic.co/t/cant-listen-to-syslog-with-logstash/119206 "2018-02-09T13:38:39Z")
Hello, I've some problems to configure Logstash for listening to syslog that a server sends me. I configured the pipleline like this: input { syslog{ port =\> "514" } } filter { geoip { source =\> "clientip" } } … --- ## [Grok Pattern to extract brackets content](https://discuss.elastic.co/t/grok-pattern-to-extract-brackets-content/149802)
**Author:** [@gsiap5](https://discuss.elastic.co/u/gsiap5)\ **Replies:** 4\ **Last updated:** [October 10, 2018, 7:19am UTC](https://discuss.elastic.co/t/grok-pattern-to-extract-brackets-content/149802 "2018-10-10T07:19:56Z")
Hi , I am attempting to create a grok pattern to parse the following log file. 14:10:49:158017|5860-00088:JMIX: ChainSubscription {INFO} Action {Update} Chain {MOVE.AA\_MOVE\_TOP.ABC\_SWITCH\_COMP\_GO.SHOP\_ABC} Snapshot {fa… --- ## [How to get part of the path name and add it to the index](https://discuss.elastic.co/t/how-to-get-part-of-the-path-name-and-add-it-to-the-index/47547)
**Author:** [@subbu.nv](https://discuss.elastic.co/u/subbu.nv)\ **Replies:** 6\ **Last updated:** [April 20, 2016, 6:34pm UTC](https://discuss.elastic.co/t/how-to-get-part-of-the-path-name-and-add-it-to-the-index/47547 "2016-04-20T18:34:11Z")
0 down vote favorite I currently have a file name like this. \[SERIALNUMBER\]\[2014\_12\_04\]\[00\_45\_22\]\[141204T014214\]AB\_DEF.log i basically want to extract the year from the file (2014) and add it to the index name in logst… --- ## [Moving from single redis instances to clustered caching pool](https://discuss.elastic.co/t/moving-from-single-redis-instances-to-clustered-caching-pool/27713)
**Author:** [@allenmchan](https://discuss.elastic.co/u/allenmchan)\ **Replies:** 5\ **Last updated:** [August 21, 2015, 7:36am UTC](https://discuss.elastic.co/t/moving-from-single-redis-instances-to-clustered-caching-pool/27713 "2015-08-21T07:36:24Z")
We currently run single instance of redis to cache logs before sending to Elasticsearch. We want to move to a cluster to avoid single point of failure. At this point it feels like we need to move away from Redis due to t… --- ## [Unable to access Kibana in T-Pot](https://discuss.elastic.co/t/unable-to-access-kibana-in-t-pot/286409)
**Author:** [@paulap2](https://discuss.elastic.co/u/paulap2)\ **Replies:** 3\ **Last updated:** [October 14, 2021, 11:46am UTC](https://discuss.elastic.co/t/unable-to-access-kibana-in-t-pot/286409 "2021-10-14T11:46:25Z")
Hi, I am setting up T-POT for a uni project. I followed this tutorial step by step: Setup a T-POT Honeypot on Azure in less than 30 minutes - YouTube It worked for me over the weekend but today my kibana was giving me … --- ## [Frozen tiers : How to size local cache?](https://discuss.elastic.co/t/frozen-tiers-how-to-size-local-cache/287704)
**Author:** [@Travis](https://discuss.elastic.co/u/Travis)\ **Replies:** 4\ **Last updated:** [October 27, 2021, 9:39am UTC](https://discuss.elastic.co/t/frozen-tiers-how-to-size-local-cache/287704 "2021-10-27T09:39:58Z")
Hello ! Is there any RAM/Disk ratio to size the local cache for frozen tiers ? I found ratios for Hot/Warm/Cold tiers but nothing for frozen tiers Thanks --- ## [Compare Dates in Logstash Pipeline](https://discuss.elastic.co/t/compare-dates-in-logstash-pipeline/247415)
**Author:** [@d-ring](https://discuss.elastic.co/u/d-ring)\ **Replies:** 4\ **Last updated:** [September 23, 2020, 9:51pm UTC](https://discuss.elastic.co/t/compare-dates-in-logstash-pipeline/247415 "2020-09-23T21:51:17Z")
I have created a data field during the pipeline and I am trying to find a way to compare that field to see if it is 30 days old or newer. I am not sure how to do about it however. This is the code I have for creating th… --- ## [Elasticsearch not indexing all files](https://discuss.elastic.co/t/elasticsearch-not-indexing-all-files/13551)
**Author:** [@KS1](https://discuss.elastic.co/u/KS1)\ **Replies:** 4\ **Last updated:** [September 12, 2013, 2:31pm UTC](https://discuss.elastic.co/t/elasticsearch-not-indexing-all-files/13551 "2013-09-12T14:31:58Z")
Hi, I am trying to index all my files stored in MongoDB using Elasticsearch. But only 180842 files are indexed whereas I have 1637870 files in my DB. I tried to delete an create an index and everytime it stops aft… --- ## [How to get a field value greater than 50 characters](https://discuss.elastic.co/t/how-to-get-a-field-value-greater-than-50-characters/138982)
**Author:** [@thinkdffrnt](https://discuss.elastic.co/u/thinkdffrnt)\ **Replies:** 1\ **Last updated:** [July 9, 2018, 12:38pm UTC](https://discuss.elastic.co/t/how-to-get-a-field-value-greater-than-50-characters/138982 "2018-07-09T12:38:35Z")
ES version 6.1.1 Mapping "fieldName": { "type": "keyword" } --- ## [UTF-16 Broken since logstash 6](https://discuss.elastic.co/t/utf-16-broken-since-logstash-6/135558)
**Author:** [@maigel](https://discuss.elastic.co/u/maigel)\ **Replies:** 0\ **Last updated:** [June 12, 2018, 2:24pm UTC](https://discuss.elastic.co/t/utf-16-broken-since-logstash-6/135558 "2018-06-12T14:24:09Z")
Hello, I recently migrated our cluster from ELK2 to ELK6. One of our logstash configs is used to parse some powershell CSV output, which is in UTF-16LE (Little-endian UTF-16 Unicode text, with very long lines, with CR… --- ## [Elastic Stack 6.0 beta-1 is here!](https://discuss.elastic.co/t/elastic-stack-6-0-beta-1-is-here/96333)
**Author:** [@michelle](https://discuss.elastic.co/u/michelle)\ **Replies:** 0\ **Last updated:** [August 8, 2017, 7:40pm UTC](https://discuss.elastic.co/t/elastic-stack-6-0-beta-1-is-here/96333 "2017-08-08T19:40:39Z")
Elastic Stack 6.0 beta-1 is here! The 6.0.0-beta1 Elasticsearch, Logstash, Beats, Kibana, and X-Pack are now available to download and test! Learn about what’s coming in 6.0: Elastic Stack Elasticsearch Logstash Kiban… --- ## [A memory intensive query crashes an elasticsearch node](https://discuss.elastic.co/t/a-memory-intensive-query-crashes-an-elasticsearch-node/52710)
**Author:** [@nma](https://discuss.elastic.co/u/nma)\ **Replies:** 0\ **Last updated:** [June 14, 2016, 9:41am UTC](https://discuss.elastic.co/t/a-memory-intensive-query-crashes-an-elasticsearch-node/52710 "2016-06-14T09:41:20Z")
Hi. There is 1 server 1 node 1 shard 1 index elasticsearch (v 2.3.2) configuration with very restricted hardware resources (ES HEAP - 1.5 GB). The index stores about 100 million of docs. elaticsearch.yml contains the … --- ## ["no results found" in Kibana Dashboard with filebeat & elastic search](https://discuss.elastic.co/t/no-results-found-in-kibana-dashboard-with-filebeat-elastic-search/192714)
**Author:** [@anarchipur](https://discuss.elastic.co/u/anarchipur)\ **Replies:** 6\ **Last updated:** [August 12, 2019, 1:57pm UTC](https://discuss.elastic.co/t/no-results-found-in-kibana-dashboard-with-filebeat-elastic-search/192714 "2019-08-12T13:57:13Z")
Hi I am absolutely new to elastic stack. I just installed and configured filebeat, elastic search and Kibana for Apache logging. I went through the steps as described in "Getting Started with Filebeat" and reached "Step… --- ## [Unable to get auditd module configured for Auditbeat](https://discuss.elastic.co/t/unable-to-get-auditd-module-configured-for-auditbeat/121477)
**Author:** [@nlh](https://discuss.elastic.co/u/nlh)\ **Replies:** 6\ **Last updated:** [February 28, 2018, 2:08pm UTC](https://discuss.elastic.co/t/unable-to-get-auditd-module-configured-for-auditbeat/121477 "2018-02-28T14:08:00Z")
Hi, just loving yaml at the moment (Grr) after a lot of experimentation, I managed to get the audit module working with the following: ################################################## auditbeat.modules: # The kernel … --- ## [Apt-get update Elastic ERROR!](https://discuss.elastic.co/t/apt-get-update-elastic-error/81447)
**Author:** [@safasalwan](https://discuss.elastic.co/u/safasalwan)\ **Replies:** 6\ **Last updated:** [April 11, 2017, 12:06am UTC](https://discuss.elastic.co/t/apt-get-update-elastic-error/81447 "2017-04-11T00:06:33Z")
Hey guys, I noticed this error every time I run 'sudo apt-get update' : W: Duplicate sources.list entry https://artifacts.elastic.co/packages/5.x/apt/ stable/main amd64 Packages (/var/lib/apt/lists/artifacts.elasti… --- ## [How to use rolllover index in filebeat configuration](https://discuss.elastic.co/t/how-to-use-rolllover-index-in-filebeat-configuration/121557)
**Author:** [@Rohit\_Vyavahare](https://discuss.elastic.co/u/Rohit_Vyavahare)\ **Replies:** 5\ **Last updated:** [March 6, 2018, 8:37pm UTC](https://discuss.elastic.co/t/how-to-use-rolllover-index-in-filebeat-configuration/121557 "2018-03-06T20:37:08Z")
I am using filebeat to put all logs from kubernetes into elasticsearch. Here is snippet of my filebeat config file : output.elasticsearch: hosts: \['${ELASTICSEARCH\_HOST:elasticsearch}:${ELASTICSEARCH\_PORT:920… --- ## [Guidance for simple elasticsearch project](https://discuss.elastic.co/t/guidance-for-simple-elasticsearch-project/70106)
**Author:** [@Mark\_Dendrix\_Garcia](https://discuss.elastic.co/u/Mark_Dendrix_Garcia)\ **Replies:** 5\ **Last updated:** [December 28, 2016, 10:27am UTC](https://discuss.elastic.co/t/guidance-for-simple-elasticsearch-project/70106 "2016-12-28T10:27:00Z")
Hi ! Im making a simple demo project for a certein bank. The project goes like this, they're gonna use it to search using a account number and return results even using a wild card. My problem is on how to make the Front… --- ## [Enable Xpack on Docker single node, getting "You do not have permission to access the requested page"](https://discuss.elastic.co/t/enable-xpack-on-docker-single-node-getting-you-do-not-have-permission-to-access-the-requested-page/255911)
**Author:** [@cwobuzz](https://discuss.elastic.co/u/cwobuzz)\ **Replies:** 4\ **Last updated:** [November 20, 2020, 3:08pm UTC](https://discuss.elastic.co/t/enable-xpack-on-docker-single-node-getting-you-do-not-have-permission-to-access-the-requested-page/255911 "2020-11-20T15:08:10Z")
I followed the example laid out here. https://github.com/elastic/stack-docs/blob/master/docs/en/getting-started/get-started-docker.asciidoc Had to make a couple of modifications due to only wanting a single node. I will… --- ## [How to include log field value in the alert body message](https://discuss.elastic.co/t/how-to-include-log-field-value-in-the-alert-body-message/245876)
**Author:** [@akhettar](https://discuss.elastic.co/u/akhettar)\ **Replies:** 1\ **Last updated:** [August 24, 2020, 5:10pm UTC](https://discuss.elastic.co/t/how-to-include-log-field-value-in-the-alert-body-message/245876 "2020-08-24T17:10:22Z")
Hello there, I would like to include a log's field value in the alert body message. The alert is pushed to slack channel. From the log entry below, I wanted to include the payload.message and payload.customData.orders T… --- ## [Can not run Logstash on my server](https://discuss.elastic.co/t/can-not-run-logstash-on-my-server/181715)
**Author:** [@zenimagine](https://discuss.elastic.co/u/zenimagine)\ **Replies:** 8\ **Last updated:** [May 19, 2019, 11:46pm UTC](https://discuss.elastic.co/t/can-not-run-logstash-on-my-server/181715 "2019-05-19T23:46:30Z")
I have 2 servers (Ubuntu 18.04) : monitoring.example.com with ELK (ELK server) www.example.com with my Drupal site and Filebeat (Client server) I generated an SSL certificate on ELK and sent it to the client server. … --- ## [Trying to add ruby filter to remove leading zero](https://discuss.elastic.co/t/trying-to-add-ruby-filter-to-remove-leading-zero/168901)
**Author:** [@paano](https://discuss.elastic.co/u/paano)\ **Replies:** 5\ **Last updated:** [February 19, 2019, 5:36pm UTC](https://discuss.elastic.co/t/trying-to-add-ruby-filter-to-remove-leading-zero/168901 "2019-02-19T17:36:01Z")
I have the following the json message. { "eventData" : { "commandContext" : { "eventUserId" : "system", "eventOrigin" : "java", "eventQueueMgr" : "TEST1", "eventAccountingToken" : 000000000000000000000000000000… --- ## [Filebeat Logstash Default Dashboards not loading](https://discuss.elastic.co/t/filebeat-logstash-default-dashboards-not-loading/160793)
**Author:** [@swright-eti](https://discuss.elastic.co/u/swright-eti)\ **Replies:** 5\ **Last updated:** [December 17, 2018, 6:32pm UTC](https://discuss.elastic.co/t/filebeat-logstash-default-dashboards-not-loading/160793 "2018-12-17T18:32:43Z")
I am having some trouble understanding getting the default dashboards for Filebeat's Logstash module working. I see Filebeat shipping data. I see that ElasticSearch has indexes for filebeat. I can search it using the De… --- ## [Kibana 3 Dashboard vs. Kibana 4 Dashboard](https://discuss.elastic.co/t/kibana-3-dashboard-vs-kibana-4-dashboard/37950)
**Author:** [@DigiAngel](https://discuss.elastic.co/u/DigiAngel)\ **Replies:** 5\ **Last updated:** [January 17, 2016, 1:12pm UTC](https://discuss.elastic.co/t/kibana-3-dashboard-vs-kibana-4-dashboard/37950 "2016-01-17T13:12:15Z")
Well I took the plunge at home and did the ELK stack upgrade. Here's my graph comparison: Kibana 3 Kibana 4.3.1: Both these graphs contain the same queries(kb3) or filters(kb4). I know there are github tickets o… --- ## [Shodan Integration](https://discuss.elastic.co/t/shodan-integration/223425)
**Author:** [@hilt86](https://discuss.elastic.co/u/hilt86)\ **Replies:** 4\ **Last updated:** [April 1, 2020, 12:41pm UTC](https://discuss.elastic.co/t/shodan-integration/223425 "2020-04-01T12:41:18Z")
Has anyone managed to get Shodan.io alerts into Elastic SIEM? I'm trying to use kubi-ecs-logger logging library and the shodan python api to send ECS alerts and wondered if anyone is interested in collaborating? H --- ## [Filebeat,ERROR pipeline/output.go:74 Failed to connect: diali/o timeout](https://discuss.elastic.co/t/filebeat-error-pipeline-output-go-74-failed-to-connect-diali-o-timeout/130192)
**Author:** [@Rmond](https://discuss.elastic.co/u/Rmond)\ **Replies:** 2\ **Last updated:** [May 9, 2018, 6:51am UTC](https://discuss.elastic.co/t/filebeat-error-pipeline-output-go-74-failed-to-connect-diali-o-timeout/130192 "2018-05-09T06:51:34Z")
when I use hosts: \["192.168.26.130:5046","172.16.26.170:5046","172.16.26.171:5046"\] on logstash output. neither loadbalance: true or false,the filebeat always connect the first ip,and others raise 2018-05-02T14:34:… --- ## [How ELK stores data](https://discuss.elastic.co/t/how-elk-stores-data/22585)
**Author:** [@vikas\_gopal](https://discuss.elastic.co/u/vikas_gopal)\ **Replies:** 2\ **Last updated:** [March 12, 2015, 2:44pm UTC](https://discuss.elastic.co/t/how-elk-stores-data/22585 "2015-03-12T14:44:42Z")
Hi Experts, I am totally new to this tool, so I have couple of basic queries 1) How ELK stores indexed data. Like traditional analytic tools stores data in flat files or in their own database . 2) How we can p… --- ## [Transform not synching](https://discuss.elastic.co/t/transform-not-synching/292699)
**Author:** [@iamtheschmitzer](https://discuss.elastic.co/u/iamtheschmitzer)\ **Replies:** 8\ **Last updated:** [December 22, 2021, 10:20pm UTC](https://discuss.elastic.co/t/transform-not-synching/292699 "2021-12-22T22:20:50Z")
Hi trying to build my first transform - a latest transform. Maybe I misunderstand, but I expect to create and start the transform and it runs continuously - so new documents in the source index are processed and reflec… --- ## [Elastic Agent - error getting cgroup stats: error fetching stats for controller io](https://discuss.elastic.co/t/elastic-agent-error-getting-cgroup-stats-error-fetching-stats-for-controller-io/296906)
**Author:** [@zx8086](https://discuss.elastic.co/u/zx8086)\ **Replies:** 0\ **Last updated:** [February 10, 2022, 9:55pm UTC](https://discuss.elastic.co/t/elastic-agent-error-getting-cgroup-stats-error-fetching-stats-for-controller-io/296906 "2022-02-10T21:55:58Z")
Hi, Elastic-Agent 7.17 and getting this error for the agents on Raspberry Pi Model 4 - Debian Bullseye elastic-agent filebeat metrcbeat osquerybeat error getting cgroup stats: error fetching stats for controller io… --- ## [Nested queries and cross referencing](https://discuss.elastic.co/t/nested-queries-and-cross-referencing/17929)
**Author:** [@David\_Fox](https://discuss.elastic.co/u/David_Fox)\ **Replies:** 0\ **Last updated:** [June 5, 2014, 4:19pm UTC](https://discuss.elastic.co/t/nested-queries-and-cross-referencing/17929 "2014-06-05T16:19:44Z")
After reading this excellent document on managing relations in Elasticsearch, I have decided that 'nested queries' are the best solution for our particular query needs.Of the list of negatives for nested queries… --- ## [Painless scripting error illegal\_argument\_exception "unexpected token \['('\] was expecting one of \[{\, ';'}\]"](https://discuss.elastic.co/t/painless-scripting-error-illegal-argument-exception-unexpected-token-was-expecting-one-of-eof/135547)
**Author:** [@ajp](https://discuss.elastic.co/u/ajp)\ **Replies:** 1\ **Last updated:** [July 2, 2018, 4:53pm UTC](https://discuss.elastic.co/t/painless-scripting-error-illegal-argument-exception-unexpected-token-was-expecting-one-of-eof/135547 "2018-07-02T16:53:43Z")
Running the following painless script against 6.2.4 returns an illegal\_argument\_exception "unexpected token \['('\] was expecting one of \[{, ';'}\]". def someVariable = ""; void someFunction(def arg) { def someVariabl… --- ## [Custom field (filebeat) in condition in logstash filter](https://discuss.elastic.co/t/custom-field-filebeat-in-condition-in-logstash-filter/257761)
**Author:** [@arp220](https://discuss.elastic.co/u/arp220)\ **Replies:** 3\ **Last updated:** [December 6, 2020, 3:48pm UTC](https://discuss.elastic.co/t/custom-field-filebeat-in-condition-in-logstash-filter/257761 "2020-12-06T15:48:57Z")
I have this config in filebeat.yml: filebeat.inputs: - type: log enabled: true paths: - /var/log/nginx/access.log fields\_under\_root: true fields: service\_name: "nginx" ##### OutPut ####### output.logstas… --- ## [Command to find elasticsearch python client version](https://discuss.elastic.co/t/command-to-find-elasticsearch-python-client-version/229101)
**Author:** [@chari](https://discuss.elastic.co/u/chari)\ **Replies:** 2\ **Last updated:** [April 21, 2020, 5:27pm UTC](https://discuss.elastic.co/t/command-to-find-elasticsearch-python-client-version/229101 "2020-04-21T17:27:28Z")
how do i find what version of elasticsearch python client i am running ? --- ## [How to send Cisco devices logs to Logstash?](https://discuss.elastic.co/t/how-to-send-cisco-devices-logs-to-logstash/207132)
**Author:** [@PraveenKT](https://discuss.elastic.co/u/PraveenKT)\ **Replies:** 2\ **Last updated:** [November 13, 2019, 11:56am UTC](https://discuss.elastic.co/t/how-to-send-cisco-devices-logs-to-logstash/207132 "2019-11-13T11:56:32Z")
Hi, I want to send the Cisco switch logs to ELK stack? Is below procedure correct ? step-1 Sentd logs from Cisco switch to Rsyslog server Step-2 Install filebeat on Rsyslog server Step-3: enable Filbeat Cisco mo… [Previous page](https://discuss.elastic.co/top.md?page=603&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=605&per_page=50&period=all)