# Top **URL:** https://discuss.elastic.co/top.md?page=947&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 948 --- ## [How to count tuples of 3 variables, sorted](https://discuss.elastic.co/t/how-to-count-tuples-of-3-variables-sorted/20309)
**Author:** [@Artur\_Martins](https://discuss.elastic.co/u/Artur_Martins)\ **Replies:** 0\ **Last updated:** [October 17, 2014, 6:43pm UTC](https://discuss.elastic.co/t/how-to-count-tuples-of-3-variables-sorted/20309 "2014-10-17T18:43:07Z")
Greetings community, I'm new to elasticsearch, so first of all sorry for my questions being so basic. I developed a flow collector which dumps flows to my elasticsearch server. Right now i use Kibana to perform the T… --- ## [Logstash Netflow module](https://discuss.elastic.co/t/logstash-netflow-module/114118)
**Author:** [@DarkVodka34](https://discuss.elastic.co/u/DarkVodka34)\ **Replies:** 6\ **Last updated:** [January 10, 2018, 3:28pm UTC](https://discuss.elastic.co/t/logstash-netflow-module/114118 "2018-01-10T15:28:35Z")
Howdy im very new to linux and have been following a tut on getting this all working. Im having big trouble getting the module to install I get this error root@OMV-MediaServer:/usr/share/logstash# bin/logstash --module… --- ## [Issue with Filebeat and Multiple Logstash Conf files](https://discuss.elastic.co/t/issue-with-filebeat-and-multiple-logstash-conf-files/87301)
**Author:** [@Sameer\_Panicker](https://discuss.elastic.co/u/Sameer_Panicker)\ **Replies:** 6\ **Last updated:** [May 31, 2017, 2:21pm UTC](https://discuss.elastic.co/t/issue-with-filebeat-and-multiple-logstash-conf-files/87301 "2017-05-31T14:21:21Z")
I have 2 Logstash.conf files under Configurations folder. Logstash is configured to run using logstash -f \\Configurations command. 2 conf files are nothing but IIS.conf and Services.conf Everything worked smoothly usin… --- ## [Issues with if statement, grok, and mutate](https://discuss.elastic.co/t/issues-with-if-statement-grok-and-mutate/24754)
**Author:** [@naisanza](https://discuss.elastic.co/u/naisanza)\ **Replies:** 0\ **Last updated:** [July 1, 2015, 7:33pm UTC](https://discuss.elastic.co/t/issues-with-if-statement-grok-and-mutate/24754 "2015-07-01T19:33:09Z")
I'm having issues with a conditional statement. I have a grok filter used to parse through a dataset, of which a field named domain will be created. Then, I want a regex conditional to check if that field matches %{HOST} … --- ## [Unable to uninstall elastic-agent](https://discuss.elastic.co/t/unable-to-uninstall-elastic-agent/305347)
**Author:** [@liwenbo97](https://discuss.elastic.co/u/liwenbo97)\ **Replies:** 1\ **Last updated:** [May 30, 2022, 4:43pm UTC](https://discuss.elastic.co/t/unable-to-uninstall-elastic-agent/305347 "2022-05-30T16:43:43Z")
n227-012-170 ➜ ~ sudo elastic-agent uninstall Error: can only be uninstall by executing the installed Elastic Agent at: /usr/bin/elastic-agent For help, please see our troubleshooting guide at Troubleshoot common probl… --- ## [Logstash json parse error](https://discuss.elastic.co/t/logstash-json-parse-error/291557)
**Author:** [@dominbdg](https://discuss.elastic.co/u/dominbdg)\ **Replies:** 1\ **Last updated:** [December 15, 2021, 11:01pm UTC](https://discuss.elastic.co/t/logstash-json-parse-error/291557 "2021-12-15T23:01:31Z")
hello, Last time I'm receiving a log of logstash json parse errors, from the error logs I cannot read anything about to what files it is about to, \[ WARN \] 2021-12-12 13:28:20.845 \[\[main\]\>worker6\] json - Error parsing… --- ## [Elasticsearch docker-compose and CLI settings](https://discuss.elastic.co/t/elasticsearch-docker-compose-and-cli-settings/64022)
**Author:** [@carrot](https://discuss.elastic.co/u/carrot)\ **Replies:** 1\ **Last updated:** [October 26, 2016, 11:52pm UTC](https://discuss.elastic.co/t/elasticsearch-docker-compose-and-cli-settings/64022 "2016-10-26T23:52:35Z")
I'm trying to use docker-compose to start a small cluster for testing, although I'm having problem passing more than 1 Setting on the command line. How do we specify multiple "Configure a setting" ? es\_master | starts … --- ## [Watcher is not sending email in ES 5.2](https://discuss.elastic.co/t/watcher-is-not-sending-email-in-es-5-2/89482)
**Author:** [@ankush\_singh](https://discuss.elastic.co/u/ankush_singh)\ **Replies:** 4\ **Last updated:** [June 16, 2017, 6:13am UTC](https://discuss.elastic.co/t/watcher-is-not-sending-email-in-es-5-2/89482 "2017-06-16T06:13:48Z")
Hi, i am using ES 5.2 i am trying to implement watcher for some keywords ("filename" : getSSLConnectionSocketFactory.java") I used below curl but its not working out. Can someone tell me what wrong I am doing or plea… --- ## [Difference between index/type/\_search and index/\_search results](https://discuss.elastic.co/t/difference-between-index-type--search-and-index--search-results/81314)
**Author:** [@Ramdev\_Wudali](https://discuss.elastic.co/u/Ramdev_Wudali)\ **Replies:** 4\ **Last updated:** [April 5, 2017, 5:09pm UTC](https://discuss.elastic.co/t/difference-between-index-type--search-and-index--search-results/81314 "2017-04-05T17:09:27Z")
Hi: I had asked this as a followup question, But I think it perhaps needs to be its own question : If I have an Index - index and a single Type - type what is the difference between searching against endpoint i… --- ## [Cannot create Index Patterns of remote clusters - Kibana 7.10.0](https://discuss.elastic.co/t/cannot-create-index-patterns-of-remote-clusters-kibana-7-10-0/262206)
**Author:** [@Phandora](https://discuss.elastic.co/u/Phandora)\ **Replies:** 5\ **Last updated:** [February 19, 2021, 6:48am UTC](https://discuss.elastic.co/t/cannot-create-index-patterns-of-remote-clusters-kibana-7-10-0/262206 "2021-02-19T06:48:35Z")
Hi, we are facing some problems creating index patterns in the 7.10.0 version. When trying to create the index pattern of a remote cluster we got the error No matching indices found. However, the indexes do exist (the i… --- ## [Can we use "sub-partitioning" in ML?](https://discuss.elastic.co/t/can-we-use-sub-partitioning-in-ml/99002)
**Author:** [@Vitaly\_il](https://discuss.elastic.co/u/Vitaly_il)\ **Replies:** 5\ **Last updated:** [September 7, 2017, 6:20pm UTC](https://discuss.elastic.co/t/can-we-use-sub-partitioning-in-ml/99002 "2017-09-07T18:20:12Z")
Our goal is similar to discussed in this thread Machine learning - host stopped sending logs or events - we're trying to send alerts when certain hosts or components stopped to send data or we have anomaly in data volu… --- ## [Canvas : Need to parse the values of 2 filters to the essql](https://discuss.elastic.co/t/canvas-need-to-parse-the-values-of-2-filters-to-the-essql/181166)
**Author:** [@TEJASWI\_CHUNDURI](https://discuss.elastic.co/u/TEJASWI_CHUNDURI)\ **Replies:** 3\ **Last updated:** [May 29, 2019, 6:05pm UTC](https://discuss.elastic.co/t/canvas-need-to-parse-the-values-of-2-filters-to-the-essql/181166 "2019-05-29T18:05:55Z")
The filter values needs to be parsed to the sql Example: SELECT url , version, COUNT(\*) AS K FROM "table\_\*" WHERE version='9.0.3.9' or version='9.0.3.10' GROUP BY url, version HAVING K \<2 ORDER BY url DESC… --- ## [How to resolve the UNASSIGNED index](https://discuss.elastic.co/t/how-to-resolve-the-unassigned-index/76113)
**Author:** [@spraveenjd](https://discuss.elastic.co/u/spraveenjd)\ **Replies:** 3\ **Last updated:** [February 22, 2017, 11:56pm UTC](https://discuss.elastic.co/t/how-to-resolve-the-unassigned-index/76113 "2017-02-22T23:56:30Z")
I have 3 node cluster. had a configuration in elastic search yml as below index.number\_of\_replicas: 2 (1 is primary, 2 replica so totally 3 node cluster) index.number\_of\_shards: 3 (3 node cluster) But Still my cluster … --- ## [Trouble making Bar Graph showing the most common value of a field over a given time](https://discuss.elastic.co/t/trouble-making-bar-graph-showing-the-most-common-value-of-a-field-over-a-given-time/62864)
**Author:** [@cb2015](https://discuss.elastic.co/u/cb2015)\ **Replies:** 3\ **Last updated:** [October 13, 2016, 9:05pm UTC](https://discuss.elastic.co/t/trouble-making-bar-graph-showing-the-most-common-value-of-a-field-over-a-given-time/62864 "2016-10-13T21:05:56Z")
Hi Everyone, I am trying to make a bar graph that will show the value of a field(storeinfo) with the highest count, every hour, for the past 24 hours. Basically, I want to to show the most frequent storeinfo in my logs,… --- ## [My Elasticsearch Got Killed Frequently due to OOM killer with Out of memory message](https://discuss.elastic.co/t/my-elasticsearch-got-killed-frequently-due-to-oom-killer-with-out-of-memory-message/360421)
**Author:** [@bbkunbi](https://discuss.elastic.co/u/bbkunbi)\ **Replies:** 7\ **Last updated:** [May 29, 2024, 11:10am UTC](https://discuss.elastic.co/t/my-elasticsearch-got-killed-frequently-due-to-oom-killer-with-out-of-memory-message/360421 "2024-05-29T11:10:10Z")
My Syslog message is: Out of memory: Killed process 1421927 (java) total-vm:17109192kB, anon-rss:6968532kB, file-rss:0kB, shmem-rss:0kB, UID:128 pgtables:18984kB oom\_score\_adj In which file i need to define memory: -r… --- ## [Empty response when search through too many indices](https://discuss.elastic.co/t/empty-response-when-search-through-too-many-indices/181519)
**Author:** [@Dmitriy\_Bashkalin](https://discuss.elastic.co/u/Dmitriy_Bashkalin)\ **Replies:** 7\ **Last updated:** [May 23, 2019, 6:31am UTC](https://discuss.elastic.co/t/empty-response-when-search-through-too-many-indices/181519 "2019-05-23T06:31:33Z")
Hello! My situation is: Elasticsearch 1.7.3 (didn't migrate to new version cause of complexity of app modifications but it's already planned) Much indices on different nodes (through tribe node) Each index name has st… --- ## [Hide a field](https://discuss.elastic.co/t/hide-a-field/49901)
**Author:** [@Christian16](https://discuss.elastic.co/u/Christian16)\ **Replies:** 1\ **Last updated:** [May 12, 2016, 9:07pm UTC](https://discuss.elastic.co/t/hide-a-field/49901 "2016-05-12T21:07:07Z")
Hello, I have 2 users with different rules, and I would like that 1 user can see "msisdn" field and not the other . I created a search as following and I would like to hide the "msisdn" field (red square) depending the u… --- ## [Slop value](https://discuss.elastic.co/t/slop-value/71656)
**Author:** [@DBS](https://discuss.elastic.co/u/DBS)\ **Replies:** 0\ **Last updated:** [January 15, 2017, 6:38pm UTC](https://discuss.elastic.co/t/slop-value/71656 "2017-01-15T18:38:34Z")
Hi, I am wondering how "slop" option in "match phrase " affects the final query score. Also can I customize its score? Say for any slop value between 1 and 3, their score is the same, or calculated based on some kind … --- ## [Elastic Agent environment variables file](https://discuss.elastic.co/t/elastic-agent-environment-variables-file/289713)
**Author:** [@Craig\_Lawson](https://discuss.elastic.co/u/Craig_Lawson)\ **Replies:** 3\ **Last updated:** [November 22, 2021, 11:58pm UTC](https://discuss.elastic.co/t/elastic-agent-environment-variables-file/289713 "2021-11-22T23:58:49Z")
Hi all, I'm not 100% sure where to submit a request to change so figured I would start here... While installing elastic agent using the generic linux package I have battled for some time to get it to work with a web pr… --- ## [Difficulty installing ECK in a single namespace](https://discuss.elastic.co/t/difficulty-installing-eck-in-a-single-namespace/225891)
**Author:** [@data\_smith](https://discuss.elastic.co/u/data_smith)\ **Replies:** 4\ **Last updated:** [April 3, 2020, 2:14pm UTC](https://discuss.elastic.co/t/difficulty-installing-eck-in-a-single-namespace/225891 "2020-04-03T14:14:03Z")
I ran the script: OPERATOR\_NAME=myelastic-op OPERATOR\_IMAGE=docker.elastic.co/eck/eck-operator:1.0.1 NAMESPACE=myns MANAGED\_NAMESPACE=myns make generate-namespace | kubectl apply -f - And it works up until I g… --- ## [Kibana 5.1.2 Babel 5 option ERROR when starting Kibana](https://discuss.elastic.co/t/kibana-5-1-2-babel-5-option-error-when-starting-kibana/70979)
**Author:** [@John\_McAfee1](https://discuss.elastic.co/u/John_McAfee1)\ **Replies:** 4\ **Last updated:** [January 10, 2017, 2:24pm UTC](https://discuss.elastic.co/t/kibana-5-1-2-babel-5-option-error-when-starting-kibana/70979 "2017-01-10T14:24:01Z")
Hello, I have a local VM that is using nodejs v6.9.4 and npm 3.10.10 on a Centos 6.5 platform. I cloned the Kibana 5.1.2 software from the github repository. When I attempt to start the Kibana application, I get the f… --- ## [Unable to install Curator CLI on macOS Sierra](https://discuss.elastic.co/t/unable-to-install-curator-cli-on-macos-sierra/69224)
**Author:** [@gsccheng](https://discuss.elastic.co/u/gsccheng)\ **Replies:** 4\ **Last updated:** [December 16, 2016, 5:25am UTC](https://discuss.elastic.co/t/unable-to-install-curator-cli-on-macos-sierra/69224 "2016-12-16T05:25:40Z")
Hi, I've followed the instructions here but calling with pip3 instead of pip to get the latest version of Curator. However executing curator --help from my command line gives -bash: curator: command not found I see c… --- ## [Too many properties: should we increase the property limit or use a nested approach and increase that limit?](https://discuss.elastic.co/t/too-many-properties-should-we-increase-the-property-limit-or-use-a-nested-approach-and-increase-that-limit/328179)
**Author:** [@obi-wan](https://discuss.elastic.co/u/obi-wan)\ **Replies:** 3\ **Last updated:** [March 22, 2023, 11:19am UTC](https://discuss.elastic.co/t/too-many-properties-should-we-increase-the-property-limit-or-use-a-nested-approach-and-increase-that-limit/328179 "2023-03-22T11:19:59Z")
Hi there, We have a situation with limits in the mapping, and I am not sure what is the way to go as there are multiple solutions. I will start by describing the use case: there are multiple tenants, which each have … --- ## [Is it possible to add threshold line on Lens in Kibana 7.6?](https://discuss.elastic.co/t/is-it-possible-to-add-threshold-line-on-lens-in-kibana-7-6/238213)
**Author:** [@mmk1995](https://discuss.elastic.co/u/mmk1995)\ **Replies:** 3\ **Last updated:** [June 30, 2020, 7:56am UTC](https://discuss.elastic.co/t/is-it-possible-to-add-threshold-line-on-lens-in-kibana-7-6/238213 "2020-06-30T07:56:56Z")
There is no metrics and axes option in Lens visualization. Is it possible to add threshold line on Lens in Kibana 7.6? Thank you. --- ## [TSVB Markdown](https://discuss.elastic.co/t/tsvb-markdown/239514)
**Author:** [@ahadi](https://discuss.elastic.co/u/ahadi)\ **Replies:** 5\ **Last updated:** [July 14, 2020, 12:32pm UTC](https://discuss.elastic.co/t/tsvb-markdown/239514 "2020-07-14T12:32:34Z")
Hi, Do you know how to create a scroll to top button with tsvb markdown in kibana using CSS ? --- ## [Need help with watcher to send the correct fields of result in the email](https://discuss.elastic.co/t/need-help-with-watcher-to-send-the-correct-fields-of-result-in-the-email/231158)
**Author:** [@GiridharKonda](https://discuss.elastic.co/u/GiridharKonda)\ **Replies:** 5\ **Last updated:** [May 26, 2020, 9:33am UTC](https://discuss.elastic.co/t/need-help-with-watcher-to-send-the-correct-fields-of-result-in-the-email/231158 "2020-05-26T09:33:32Z")
Hello Team, I am trying to setup a watcher for uptime using heartbeat to trigger a mail with proper message. I've got the watcher setup and is working but the issue is that one triggered mail has more than 10 alerts so … --- ## [Very slow processing of CDN logs](https://discuss.elastic.co/t/very-slow-processing-of-cdn-logs/90496)
**Author:** [@UnitedMarsupials](https://discuss.elastic.co/u/UnitedMarsupials)\ **Replies:** 5\ **Last updated:** [June 27, 2017, 12:52pm UTC](https://discuss.elastic.co/t/very-slow-processing-of-cdn-logs/90496 "2017-06-27T12:52:35Z")
I've configured logstash to parse CDN-uploaded logs and feed them into Graphite. Things work, but very slowly -- a log-file with 278K lines takes 6.5 minutes to process. The development instance of logstash copies prod… --- ## [Mcafee DAM syslog parsing Logstash](https://discuss.elastic.co/t/mcafee-dam-syslog-parsing-logstash/73136)
**Author:** [@HawkUser](https://discuss.elastic.co/u/HawkUser)\ **Replies:** 5\ **Last updated:** [February 1, 2017, 8:59am UTC](https://discuss.elastic.co/t/mcafee-dam-syslog-parsing-logstash/73136 "2017-02-01T08:59:15Z")
Hi Community, i'm looking for logstash idea how to parse the next content: \<15\>#externalId=0#rt=1XXXX1#cs1=SaXXM XX-XXXXXX#cs1Label=XXX#dst=XX.XX.xx.xx#src=xx.xx.xx.xxx#duser=xxx\_xxxx#suser=#shost=XXX-XXXXXXX#dproc=xx… --- ## [Counting unique values in y axis of a line/bar visualization](https://discuss.elastic.co/t/counting-unique-values-in-y-axis-of-a-line-bar-visualization/215272)
**Author:** [@Omer\_Botenski](https://discuss.elastic.co/u/Omer_Botenski)\ **Replies:** 1\ **Last updated:** [February 6, 2020, 1:49pm UTC](https://discuss.elastic.co/t/counting-unique-values-in-y-axis-of-a-line-bar-visualization/215272 "2020-02-06T13:49:15Z")
Hi there! I'm trying to create a line/bar visualization based upon a query which returns all tests I run on my system. The main goal is to show a count of unique test titles on the Y axis (since some tests run several t… --- ## [Extracting fields from GREEDY data in GROK](https://discuss.elastic.co/t/extracting-fields-from-greedy-data-in-grok/95586)
**Author:** [@shroh](https://discuss.elastic.co/u/shroh)\ **Replies:** 1\ **Last updated:** [August 2, 2017, 9:01pm UTC](https://discuss.elastic.co/t/extracting-fields-from-greedy-data-in-grok/95586 "2017-08-02T21:01:27Z")
I have a web access log from which i need to create the fields, below is the log line: 10.202.103.252 - ECG358 \[02/Aug/2017:16:48:53 +0000\] “GET /app-web/tutor/applications/14/notes?category=All&offset=0&limit=30&count=… --- ## [Constant\_score vs. filtered; and a follow up about custom\_filters\_score](https://discuss.elastic.co/t/constant-score-vs-filtered-and-a-follow-up-about-custom-filters-score/15182)
**Author:** [@weitzenfeld1](https://discuss.elastic.co/u/weitzenfeld1)\ **Replies:** 1\ **Last updated:** [January 9, 2014, 8:42pm UTC](https://discuss.elastic.co/t/constant-score-vs-filtered-and-a-follow-up-about-custom-filters-score/15182 "2014-01-09T20:42:18Z")
\*Question 1\* Is there a preferred way to write a query that consists solely of filters - that is, return documents iff they pass a set of filters? From thisthread, I've gathered that there are two options: \* Co… --- ## [How to create kibana dashboard using bash script with Linux?](https://discuss.elastic.co/t/how-to-create-kibana-dashboard-using-bash-script-with-linux/148093)
**Author:** [@Aftab\_Ali](https://discuss.elastic.co/u/Aftab_Ali)\ **Replies:** 2\ **Last updated:** [September 11, 2018, 9:50am UTC](https://discuss.elastic.co/t/how-to-create-kibana-dashboard-using-bash-script-with-linux/148093 "2018-09-11T09:50:27Z")
Dear ELK Team, I am big fan of your company and your product like ELK with beats. I have installed elk 6.4 with Ubuntu Linux OS with our local environment its working fine, but i have Cloud and i have configured with a… --- ## [Spring Elasticsearch vs Spring Data Elasticsearch:](https://discuss.elastic.co/t/spring-elasticsearch-vs-spring-data-elasticsearch/19577)
**Author:** [@Jinyuan\_Zhou](https://discuss.elastic.co/u/Jinyuan_Zhou)\ **Replies:** 2\ **Last updated:** [September 2, 2014, 8:02pm UTC](https://discuss.elastic.co/t/spring-elasticsearch-vs-spring-data-elasticsearch/19577 "2014-09-02T20:02:02Z")
Hi, I'm planning to use java native client to mainly to bulk index a lot of data. I see there are two project listed on the elasticsearch guide's integration page. one is a sub project of spring data at https://g… --- ## [Fleet permissons](https://discuss.elastic.co/t/fleet-permissons/353465)
**Author:** [@Dilma\_David](https://discuss.elastic.co/u/Dilma_David)\ **Replies:** 1\ **Last updated:** [March 12, 2024, 4:44pm UTC](https://discuss.elastic.co/t/fleet-permissons/353465 "2024-03-12T16:44:08Z")
Hello, I am trying to use the Elastic search for the first time, I installed Elasticsearch and Kibana in an Ubunto Virtual Machine in VirtualBox. Now Im trying to configure the fleet and Elastic Agent, but I am havi… --- ## [APM Filter incoming data](https://discuss.elastic.co/t/apm-filter-incoming-data/275971)
**Author:** [@binschlag](https://discuss.elastic.co/u/binschlag)\ **Replies:** 7\ **Last updated:** [June 16, 2021, 10:50am UTC](https://discuss.elastic.co/t/apm-filter-incoming-data/275971 "2021-06-16T10:50:41Z")
Is there any possibility to filter out APM data (errors, specific urls, ...), so that apm-server does not index them to elasticsearch? Or is the only way to set the apm-server output to logstash and drop unwanted data i… --- ## [Issues while deploying Elastic Search from Azure Portal](https://discuss.elastic.co/t/issues-while-deploying-elastic-search-from-azure-portal/230700)
**Author:** [@Sushma](https://discuss.elastic.co/u/Sushma)\ **Replies:** 7\ **Last updated:** [May 8, 2020, 10:03am UTC](https://discuss.elastic.co/t/issues-while-deploying-elastic-search-from-azure-portal/230700 "2020-05-08T10:03:01Z")
Hi Team, I am trying to deploy Elastic Search(Self- Managed) from Azure portal. However the issue I am facing is not able to select the virtual network as seen below: The virtual network(SUB\_VNET\_29\_0) initially had… --- ## [Using Kibana generated POST URL to generate CSV fails -](https://discuss.elastic.co/t/using-kibana-generated-post-url-to-generate-csv-fails/213353)
**Author:** [@Mike\_Donohue](https://discuss.elastic.co/u/Mike_Donohue)\ **Replies:** 1\ **Last updated:** [December 30, 2019, 1:46pm UTC](https://discuss.elastic.co/t/using-kibana-generated-post-url-to-generate-csv-fails/213353 "2019-12-30T13:46:53Z")
Hi We are using Kibana 7.3.0 Trying to download CSV from a Discover query. After running and Saving the query, I go to Share -\> CSV Reports -\> Copy POST URL and get the following URL: https://\/api… --- ## [Documentation for what goes in fields.yml?](https://discuss.elastic.co/t/documentation-for-what-goes-in-fields-yml/78611)
**Author:** [@rzrelyea](https://discuss.elastic.co/u/rzrelyea)\ **Replies:** 1\ **Last updated:** [March 27, 2017, 4:51pm UTC](https://discuss.elastic.co/t/documentation-for-what-goes-in-fields-yml/78611 "2017-03-27T16:51:23Z")
I've read the blog on how to build lsbeat and I've gone through the tutorial on creating a custom beat, but I can't seem to find documentation on what needs to go into \_meta\\fields.yml. I'm not sure if the documentatio… --- ## [Extract and add field](https://discuss.elastic.co/t/extract-and-add-field/49617)
**Author:** [@HugoBang](https://discuss.elastic.co/u/HugoBang)\ **Replies:** 7\ **Last updated:** [May 12, 2016, 5:50am UTC](https://discuss.elastic.co/t/extract-and-add-field/49617 "2016-05-12T05:50:14Z")
Hello, How can I extract a value from message field and add field with the extracted value? For example, message field is as below. "message": "This is a test.\\n\\nSubject:\\n\\tSecurity ID:\\t\\tT-E-S-T\\n\\tAccount Name… --- ## [Add Winlogbeat option to truncate Security 'message' field to just first line](https://discuss.elastic.co/t/add-winlogbeat-option-to-truncate-security-message-field-to-just-first-line/49409)
**Author:** [@cknz](https://discuss.elastic.co/u/cknz)\ **Replies:** 1\ **Last updated:** [May 6, 2016, 2:30pm UTC](https://discuss.elastic.co/t/add-winlogbeat-option-to-truncate-security-message-field-to-just-first-line/49409 "2016-05-06T14:30:04Z")
I'm currently sending the Active Directory audit logs for our large network to my ELK stack (currently 4 VMs, but I have new hardware to deploy and an opportunity to do things better), which works fairly nicely, but boy,… --- ## [Build Query based on Json using Java client](https://discuss.elastic.co/t/build-query-based-on-json-using-java-client/2597)
**Author:** [@javadevmtl](https://discuss.elastic.co/u/javadevmtl)\ **Replies:** 1\ **Last updated:** [June 14, 2015, 12:43am UTC](https://discuss.elastic.co/t/build-query-based-on-json-using-java-client/2597 "2015-06-14T00:43:08Z")
I have some written Json queries and I would like to execute them using the Java client. The below requires me to break the json in individual parts and pass it in as arguments. client.prepareSearch(index).setTypes(t… --- ## [Can we set up multiple output in metricbeat?](https://discuss.elastic.co/t/can-we-set-up-multiple-output-in-metricbeat/284168)
**Author:** [@abhi.logs](https://discuss.elastic.co/u/abhi.logs)\ **Replies:** 3\ **Last updated:** [September 16, 2021, 4:29am UTC](https://discuss.elastic.co/t/can-we-set-up-multiple-output-in-metricbeat/284168 "2021-09-16T04:29:18Z")
Hello, I want to set up multiple outputs in metricbeat.yml, Is it possible we can set up? output.elasticsearch: hosts: \["abc.com"\] username: "xxxxx" Password: "xxxx" output.elasticsearch: hosts: \["xyz.com"\] usern… --- ## [Kibana intergration with all types of AWS Logs like (VPC flow Logs, Instances Logs, Cloudwatch logs, Cloud trail logs , systemlogs )](https://discuss.elastic.co/t/kibana-intergration-with-all-types-of-aws-logs-like-vpc-flow-logs-instances-logs-cloudwatch-logs-cloud-trail-logs-systemlogs/171615)
**Author:** [@Shashank029](https://discuss.elastic.co/u/Shashank029)\ **Replies:** 3\ **Last updated:** [March 19, 2019, 7:24pm UTC](https://discuss.elastic.co/t/kibana-intergration-with-all-types-of-aws-logs-like-vpc-flow-logs-instances-logs-cloudwatch-logs-cloud-trail-logs-systemlogs/171615 "2019-03-19T19:24:45Z")
how to do Kibana intergration with all types of AWS Logs like (VPC flow Logs, Instances Logs, Cloudwatch logs, Cloud trail logs , systemlogs ). Thanks Shashank --- ## [HOW to Create Pie visualized Browser name w/ version, Device and OS used](https://discuss.elastic.co/t/how-to-create-pie-visualized-browser-name-w-version-device-and-os-used/148253)
**Author:** [@mark.quilates](https://discuss.elastic.co/u/mark.quilates)\ **Replies:** 8\ **Last updated:** [September 12, 2018, 6:17am UTC](https://discuss.elastic.co/t/how-to-create-pie-visualized-browser-name-w-version-device-and-os-used/148253 "2018-09-12T06:17:56Z")
Hi Guys, Is there a way to create pie visualization that display, Browser name w/ version, Device and OS used? Can help me how please. Thanks! --- ## [PKI between Logstash and Winlogbeat](https://discuss.elastic.co/t/pki-between-logstash-and-winlogbeat/94851)
**Author:** [@socdev](https://discuss.elastic.co/u/socdev)\ **Replies:** 3\ **Last updated:** [August 1, 2017, 11:59am UTC](https://discuss.elastic.co/t/pki-between-logstash-and-winlogbeat/94851 "2017-08-01T11:59:06Z")
I am having a frustrating problem with setting up PKI between Logstash and Winlogbeat. I have tried two (X-Pack, EASY-RSA) methods both successfully creating a CA, Private and Public Key, however both result in the same … --- ## [Not able to parse fields with logstash](https://discuss.elastic.co/t/not-able-to-parse-fields-with-logstash/63468)
**Author:** [@VijayKarthikeyan](https://discuss.elastic.co/u/VijayKarthikeyan)\ **Replies:** 3\ **Last updated:** [October 20, 2016, 11:25am UTC](https://discuss.elastic.co/t/not-able-to-parse-fields-with-logstash/63468 "2016-10-20T11:25:33Z")
Hello everyone, Am using Logstash and am a new user. I have a log file which I need to parse and get some meaningful fields like Timestamp, User, Domain, message, response code, error code etc., I use Grok pattern to p… --- ## [How to disable add\_cloud\_metadata processor?](https://discuss.elastic.co/t/how-to-disable-add-cloud-metadata-processor/329463)
**Author:** [@Vanav](https://discuss.elastic.co/u/Vanav)\ **Replies:** 0\ **Last updated:** [April 5, 2023, 8:01pm UTC](https://discuss.elastic.co/t/how-to-disable-add-cloud-metadata-processor/329463 "2023-04-05T20:01:05Z")
I have a standalone Elastic Agent with filestream input. I want to cleanup sent data. How to disable default processors add\_cloud\_metadata and others? I can drop fields, but I prefer to disable processor. In filebeat I … --- ## [Ingest Node - Stored pipelines](https://discuss.elastic.co/t/ingest-node-stored-pipelines/150991)
**Author:** [@gourmax-geo](https://discuss.elastic.co/u/gourmax-geo)\ **Replies:** 1\ **Last updated:** [October 4, 2018, 7:03pm UTC](https://discuss.elastic.co/t/ingest-node-stored-pipelines/150991 "2018-10-04T19:03:46Z")
Hi, I'm trying to make some test with ingest node and coordinator node. The settings between both is pretty easy, but I was wondering if there is any way to be sure that my pipeline is really "stored" in the ingest nod… --- ## [Filebeat not sending logs to multiple hosts specified in \[output.elasticsearch:\] section](https://discuss.elastic.co/t/filebeat-not-sending-logs-to-multiple-hosts-specified-in-output-elasticsearch-section/126097)
**Author:** [@AVM](https://discuss.elastic.co/u/AVM)\ **Replies:** 4\ **Last updated:** [March 30, 2018, 5:27am UTC](https://discuss.elastic.co/t/filebeat-not-sending-logs-to-multiple-hosts-specified-in-output-elasticsearch-section/126097 "2018-03-30T05:27:13Z")
Hi Team, I have a cluster with 3 nodes. All nodes are master and data eligible nodes. One of them is configured for kibana in kibana.yml (in \[elasticsearch.url\] section). I am using filebeat to send logs directly to ela… --- ## [Cannot restart logstash](https://discuss.elastic.co/t/cannot-restart-logstash/104508)
**Author:** [@neal1991](https://discuss.elastic.co/u/neal1991)\ **Replies:** 4\ **Last updated:** [October 20, 2017, 11:55am UTC](https://discuss.elastic.co/t/cannot-restart-logstash/104508 "2017-10-20T11:55:51Z")
I am config a logstash to obtains logs from a client. But now there is a problem with logstah. There is error information in /var/log/logstash: logstash.agent cannot create pipeline{reson:"Expected one of #, input, filt… [Previous page](https://discuss.elastic.co/top.md?page=946&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=948&per_page=50&period=all)