# Top **URL:** https://discuss.elastic.co/top.md?page=985&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 986 --- ## [Updating the dictionary file used in translate filter while logs are being processed](https://discuss.elastic.co/t/updating-the-dictionary-file-used-in-translate-filter-while-logs-are-being-processed/214494)
**Author:** [@dmalhan](https://discuss.elastic.co/u/dmalhan)\ **Replies:** 8\ **Last updated:** [February 4, 2020, 10:00pm UTC](https://discuss.elastic.co/t/updating-the-dictionary-file-used-in-translate-filter-while-logs-are-being-processed/214494 "2020-02-04T22:00:53Z")
Currently the Logstash instance that we're running basically runs 24 hours a day (processes millions of logs everyday). It's using a file as a mapping dictionary through a Translate filter with the default refresh interv… --- ## [ELK stack 6.2.2 not working after installation of X-pack on Windows 10](https://discuss.elastic.co/t/elk-stack-6-2-2-not-working-after-installation-of-x-pack-on-windows-10/126512)
**Author:** [@Ongun](https://discuss.elastic.co/u/Ongun)\ **Replies:** 8\ **Last updated:** [April 4, 2018, 1:42am UTC](https://discuss.elastic.co/t/elk-stack-6-2-2-not-working-after-installation-of-x-pack-on-windows-10/126512 "2018-04-04T01:42:18Z")
I installed X-pack 6.2.2 on Elasticsearch and Kibana respectively. Then I configured the built-in user accounts with the bin/x-pack/setup-passwords interactive command. Although now I can reach the Kibana interface it is… --- ## [Restoring a snapshot adds legacy routing parameters to the index](https://discuss.elastic.co/t/restoring-a-snapshot-adds-legacy-routing-parameters-to-the-index/55362)
**Author:** [@Jason\_Loveman](https://discuss.elastic.co/u/Jason_Loveman)\ **Replies:** 8\ **Last updated:** [July 21, 2016, 2:55pm UTC](https://discuss.elastic.co/t/restoring-a-snapshot-adds-legacy-routing-parameters-to-the-index/55362 "2016-07-21T14:55:06Z")
I have taken a snapshot (from one ES 2.3 system) to another and restored it and every time, it adds to my index settings "legacy: { routing: { use\_type: false, hash: { type: org.elasticsearch....DjbHashFunction}}}" Thi… --- ## [Filebeat include is not working when logs are in both json and non-json format](https://discuss.elastic.co/t/filebeat-include-is-not-working-when-logs-are-in-both-json-and-non-json-format/126372)
**Author:** [@Abhishek\_Jadhav](https://discuss.elastic.co/u/Abhishek_Jadhav)\ **Replies:** 3\ **Last updated:** [April 2, 2018, 2:44pm UTC](https://discuss.elastic.co/t/filebeat-include-is-not-working-when-logs-are-in-both-json-and-non-json-format/126372 "2018-04-02T14:44:08Z")
filebeat.yml configuration \< paths: #- /var/log/\*.log - /ap/logs/error\_log include\_lines: \['^{'\] json.keys\_under\_root: true json.add\_error\_key: true json.overwrite\_keys: true tail\_files: true /\> filebeat logs: … --- ## [Suggestion: libbeat to select between xxx.template,json and xxx.template-es2x.json](https://discuss.elastic.co/t/suggestion-libbeat-to-select-between-xxx-template-json-and-xxx-template-es2x-json/50887)
**Author:** [@cyrilleverrier](https://discuss.elastic.co/u/cyrilleverrier)\ **Replies:** 3\ **Last updated:** [May 26, 2016, 8:07am UTC](https://discuss.elastic.co/t/suggestion-libbeat-to-select-between-xxx-template-json-and-xxx-template-es2x-json/50887 "2016-05-26T08:07:38Z")
Hi Beat developers, May I suggest you to implement in libbeat a way to push the correct ES template file depending on the ES server. I believe it should not be difficult to query the ES version and select xxx.templat… --- ## [Readiness Probe Failing - clusterHealthCheckParams: "wait\_for\_status=yellow&timeout=1s"](https://discuss.elastic.co/t/readiness-probe-failing-clusterhealthcheckparams-wait-for-status-yellow-timeout-1s/295319)
**Author:** [@aniesh.mathew](https://discuss.elastic.co/u/aniesh.mathew)\ **Replies:** 3\ **Last updated:** [January 25, 2022, 10:16am UTC](https://discuss.elastic.co/t/readiness-probe-failing-clusterhealthcheckparams-wait-for-status-yellow-timeout-1s/295319 "2022-01-25T10:16:02Z")
We have a deployed a elastic master with single replica in kubernetes and have added the parameter clusterHealthCheckParams: wait\_for\_status=yellow&timeout=1s as suggested in post. The elastic master was working fine e… --- ## [Grouping and counting with filters using transformations API](https://discuss.elastic.co/t/grouping-and-counting-with-filters-using-transformations-api/212751)
**Author:** [@Sergio\_Blanco](https://discuss.elastic.co/u/Sergio_Blanco)\ **Replies:** 5\ **Last updated:** [January 10, 2020, 3:30pm UTC](https://discuss.elastic.co/t/grouping-and-counting-with-filters-using-transformations-api/212751 "2020-01-10T15:30:44Z")
I have created these two transformations: query = { "source": { "index": "posts", "query": { "bool": { "filter": { "match" : {"PostTypeId": "1"} } } } },… --- ## [ELK stack with filebeat not mapping well GeoIP data](https://discuss.elastic.co/t/elk-stack-with-filebeat-not-mapping-well-geoip-data/213585)
**Author:** [@alesanchez](https://discuss.elastic.co/u/alesanchez)\ **Replies:** 5\ **Last updated:** [January 2, 2020, 3:54pm UTC](https://discuss.elastic.co/t/elk-stack-with-filebeat-not-mapping-well-geoip-data/213585 "2020-01-02T15:54:15Z")
Hello everyone, I want to view the data regarding nginx logs in Kibana so I've set up a flow that looks like: Filebeat \> Logstash \> Elasticsearch Filebeat is in the same machine as the nginx I want the logs from and L… --- ## [Logstash one single point failure](https://discuss.elastic.co/t/logstash-one-single-point-failure/111220)
**Author:** [@f26227279](https://discuss.elastic.co/u/f26227279)\ **Replies:** 5\ **Last updated:** [December 15, 2017, 10:16am UTC](https://discuss.elastic.co/t/logstash-one-single-point-failure/111220 "2017-12-15T10:16:54Z")
Hi,everyone: this is my ELK structure: \[image\] I am afraid that if the logstash host crash, and all the system can't run. so if there's a way to prevent the situation occur, such as joining a logstash to stand by. t… --- ## [Logstash JVM heap running out of space](https://discuss.elastic.co/t/logstash-jvm-heap-running-out-of-space/87565)
**Author:** [@Exocomp](https://discuss.elastic.co/u/Exocomp)\ **Replies:** 5\ **Last updated:** [June 5, 2017, 2:12pm UTC](https://discuss.elastic.co/t/logstash-jvm-heap-running-out-of-space/87565 "2017-06-05T14:12:48Z")
Need some advice on how to resolve this issue. I setup an ELK box (1 box) that is working great, except every 4 days or so logstash runs out of JVM heap and then doesn't do much processing and I have to do a restart to … --- ## [Where to place the CORS file](https://discuss.elastic.co/t/where-to-place-the-cors-file/27685)
**Author:** [@dcistaro](https://discuss.elastic.co/u/dcistaro)\ **Replies:** 5\ **Last updated:** [August 26, 2015, 2:01pm UTC](https://discuss.elastic.co/t/where-to-place-the-cors-file/27685 "2015-08-26T14:01:35Z")
I am following the elasticsearch-angular-example by Spence Spalger. The text says to place the CORS file near the config file. But I do not see a config file, just a config directory with 2 YAML files. So where does the … --- ## [Log threshold alerting rule to check the presence of logs on specific hosts](https://discuss.elastic.co/t/log-threshold-alerting-rule-to-check-the-presence-of-logs-on-specific-hosts/342799)
**Author:** [@melkamar](https://discuss.elastic.co/u/melkamar)\ **Replies:** 6\ **Last updated:** [September 19, 2023, 9:40am UTC](https://discuss.elastic.co/t/log-threshold-alerting-rule-to-check-the-presence-of-logs-on-specific-hosts/342799 "2023-09-19T09:40:28Z")
Hi, I am trying to set up an alert rule that will alert me when a job that I expect to run at particular servers stops writing into the syslog. The idea is that I want to receive alerts when: Any host with a field ser… --- ## [Field reference failed in logstash-input-redis](https://discuss.elastic.co/t/field-reference-failed-in-logstash-input-redis/84797)
**Author:** [@xiaotie](https://discuss.elastic.co/u/xiaotie)\ **Replies:** 6\ **Last updated:** [May 10, 2017, 2:59am UTC](https://discuss.elastic.co/t/field-reference-failed-in-logstash-input-redis/84797 "2017-05-10T02:59:32Z")
My logstash version is logstash-5.3.2;I use the following config: input { redis { batch\_count =\> 1 data\_type =\> "list" key =\> "monitor\_info\_queue" host =\> "192.168.154.135" por… --- ## [Downgrade elasticsearch to previous version](https://discuss.elastic.co/t/downgrade-elasticsearch-to-previous-version/258083)
**Author:** [@rohitarorait82](https://discuss.elastic.co/u/rohitarorait82)\ **Replies:** 1\ **Last updated:** [December 9, 2020, 7:42am UTC](https://discuss.elastic.co/t/downgrade-elasticsearch-to-previous-version/258083 "2020-12-09T07:42:44Z")
Hi All, I am planning to upgrade my 6 node elk cluster from 7.7 to 7.10. I am just looking for a scenario when two nodes are upgraded and 3rd node fails. So is there a way to downgrade all the nodes back to v7.7 --- ## [Plugin fails to install](https://discuss.elastic.co/t/plugin-fails-to-install/250012)
**Author:** [@tyrone](https://discuss.elastic.co/u/tyrone)\ **Replies:** 1\ **Last updated:** [September 25, 2020, 6:37pm UTC](https://discuss.elastic.co/t/plugin-fails-to-install/250012 "2020-09-25T18:37:34Z")
I am unable to install the logstash-syslog-output plugin locally I am running rhel7.8, logstash 7.8.1 I have downloaded logstash-output-syslog-master.zip from git and am running \[root@us3lpvinfelk004 bin\]# ./logstas… --- ## [Elastic APM server is not available (Failed to connect to /0.0.0.0:8200)](https://discuss.elastic.co/t/elastic-apm-server-is-not-available-failed-to-connect-to-0-0-0-0-8200/151639)
**Author:** [@sri\_lakshmi](https://discuss.elastic.co/u/sri_lakshmi)\ **Replies:** 1\ **Last updated:** [October 11, 2018, 11:16am UTC](https://discuss.elastic.co/t/elastic-apm-server-is-not-available-failed-to-connect-to-0-0-0-0-8200/151639 "2018-10-11T11:16:33Z")
Hello Team, I implemented java agent with spring boot application in docker ELK-6.4.2 APM-Server-6.4.2 APM-Agent : 0.7.0 Java: 1.8.0\_161 elasticapm.properties file: service\_name=my-cool-service … --- ## [Replacing all instances of a string in nested JSON](https://discuss.elastic.co/t/replacing-all-instances-of-a-string-in-nested-json/299152)
**Author:** [@7armyant](https://discuss.elastic.co/u/7armyant)\ **Replies:** 4\ **Last updated:** [March 9, 2022, 4:39am UTC](https://discuss.elastic.co/t/replacing-all-instances-of-a-string-in-nested-json/299152 "2022-03-09T04:39:17Z")
Hi Gurus, I'm new to logstash and have had little success with the following. I have been trying to relace all instances of a sting in nested JSON. Below is the JSON in question: "{"totalCount": 2, "nextPageKey": n… --- ## [ES 7.4.0 and SQL CLI Script :: Environment Variable Issue?](https://discuss.elastic.co/t/es-7-4-0-and-sql-cli-script-environment-variable-issue/203678)
**Author:** [@redapplesonly](https://discuss.elastic.co/u/redapplesonly)\ **Replies:** 4\ **Last updated:** [October 17, 2019, 7:41pm UTC](https://discuss.elastic.co/t/es-7-4-0-and-sql-cli-script-environment-variable-issue/203678 "2019-10-17T19:41:15Z")
Hi ELK Sensei (s), I recently upgraded to Elasticsearch 7.4.0 because I want to take advantage of the SQL-like queries. But I’m hitting issues with the CLI interface script. First off: I’m on an Ubuntu box, 16.04.4. My… --- ## [Heartbeat Query - Problem with Websites Security Certificate](https://discuss.elastic.co/t/heartbeat-query-problem-with-websites-security-certificate/97191)
**Author:** [@r4z0rw1r3666](https://discuss.elastic.co/u/r4z0rw1r3666)\ **Replies:** 4\ **Last updated:** [August 21, 2017, 12:42am UTC](https://discuss.elastic.co/t/heartbeat-query-problem-with-websites-security-certificate/97191 "2017-08-21T00:42:52Z")
Hello, I’ve configured heartbeat to connect to a https wsdl endpoint, however there is a problem with the website security certificate, causing failures. As a test, I have put ssl.verification\_mode: none into the monit… --- ## [How to search on multiple words and need to start with the given letter](https://discuss.elastic.co/t/how-to-search-on-multiple-words-and-need-to-start-with-the-given-letter/24520)
**Author:** [@anusha6](https://discuss.elastic.co/u/anusha6)\ **Replies:** 4\ **Last updated:** [June 29, 2015, 1:30pm UTC](https://discuss.elastic.co/t/how-to-search-on-multiple-words-and-need-to-start-with-the-given-letter/24520 "2015-06-29T13:30:29Z")
Hi All, I declared my settings with analyzer as, "analyzer\_startswith": { "filter": \[ "lowercase" \], "tokenizer": "whitespa… --- ## [How can i write to logstash without filebeat/agent?](https://discuss.elastic.co/t/how-can-i-write-to-logstash-without-filebeat-agent/200088)
**Author:** [@rajkumar.m](https://discuss.elastic.co/u/rajkumar.m)\ **Replies:** 2\ **Last updated:** [September 19, 2019, 4:26am UTC](https://discuss.elastic.co/t/how-can-i-write-to-logstash-without-filebeat-agent/200088 "2019-09-19T04:26:46Z")
Hi, Please let me know how can i write the messages to logstash without agent/filebeat. I would like to know if there are methods available to write into logstash without agent. Please help, Thanks --- ## [ABORTED snapshot blocks doing snapshot](https://discuss.elastic.co/t/aborted-snapshot-blocks-doing-snapshot/17523)
**Author:** [@Jeffz](https://discuss.elastic.co/u/Jeffz)\ **Replies:** 2\ **Last updated:** [June 20, 2016, 6:49am UTC](https://discuss.elastic.co/t/aborted-snapshot-blocks-doing-snapshot/17523 "2016-06-20T06:49:01Z")
Our Elasticsearch cluster has an aborted snapshot. Here is what I got by calling 'curl \_cluster/state', see the content below. It has been in this state for days. "snapshots": { "snapshots": \[ … --- ## [Ruby client and bulk method issue](https://discuss.elastic.co/t/ruby-client-and-bulk-method-issue/45430)
**Author:** [@twnone](https://discuss.elastic.co/u/twnone)\ **Replies:** 2\ **Last updated:** [March 25, 2016, 1:08pm UTC](https://discuss.elastic.co/t/ruby-client-and-bulk-method-issue/45430 "2016-03-25T13:08:31Z")
Hi there, I've been working on a piece of script for a few days and I really can't solve the problem by myself, apparently. It's a ruby script that queries for metrics in my ES (version 2.2.0) index and asks for aggr… --- ## [Indices are not showing for Fluentd on kubernetes](https://discuss.elastic.co/t/indices-are-not-showing-for-fluentd-on-kubernetes/227558)
**Author:** [@odirionyeo](https://discuss.elastic.co/u/odirionyeo)\ **Replies:** 1\ **Last updated:** [April 13, 2020, 8:00am UTC](https://discuss.elastic.co/t/indices-are-not-showing-for-fluentd-on-kubernetes/227558 "2020-04-13T08:00:15Z")
I deployed the EFK Stack(Elasticsearch, Fluentd, Kibana) on kuberntes using helm charts from elastic. I am trying to load the indices from kibana yet I don't see anything. when i did curl localhost:9200/\_cat/indices, i … --- ## [How to install S3 input plugin](https://discuss.elastic.co/t/how-to-install-s3-input-plugin/221089)
**Author:** [@cdelpino](https://discuss.elastic.co/u/cdelpino)\ **Replies:** 1\ **Last updated:** [March 6, 2020, 4:50pm UTC](https://discuss.elastic.co/t/how-to-install-s3-input-plugin/221089 "2020-03-06T16:50:17Z")
Hello. I am trying to install the S3 input plugin in the elasticsearch Docker image. I am following these instructions: and this is the exact the plugin I am trying to install: https://www.elastic.co/guide/en/logstas… --- ## [Kibana 4 Dev environment setup](https://discuss.elastic.co/t/kibana-4-dev-environment-setup/41684)
**Author:** [@lantern77](https://discuss.elastic.co/u/lantern77)\ **Replies:** 1\ **Last updated:** [February 15, 2016, 4:59pm UTC](https://discuss.elastic.co/t/kibana-4-dev-environment-setup/41684 "2016-02-15T16:59:03Z")
Hello, I am currently trying to install Kibana 4.2.1 as a dev environment on a windows machine and unfortunateky I get error when I try to do npm install. I am following these instructions: https://github.com/elastic/k… --- ## [Using filebeat , logstash grok does't work](https://discuss.elastic.co/t/using-filebeat-logstash-grok-doest-work/33598)
**Author:** [@beta\_beta](https://discuss.elastic.co/u/beta_beta)\ **Replies:** 1\ **Last updated:** [November 3, 2015, 9:25am UTC](https://discuss.elastic.co/t/using-filebeat-logstash-grok-doest-work/33598 "2015-11-03T09:25:12Z")
This is my config file , I can't match and remove\_field input { beats { port =\> 5047 add\_field =\> { "type" =\> "ad\_engine"} } } filter { grok { patt… --- ## [GUI tool for elasticsearch cluster for windows](https://discuss.elastic.co/t/gui-tool-for-elasticsearch-cluster-for-windows/10244)
**Author:** [@Janusz\_Dalecki](https://discuss.elastic.co/u/Janusz_Dalecki)\ **Replies:** 1\ **Last updated:** [January 7, 2013, 6:14am UTC](https://discuss.elastic.co/t/gui-tool-for-elasticsearch-cluster-for-windows/10244 "2013-01-07T06:14:02Z")
Hi, Is there any GUI tool for elasticsearch cluster for windows, that could show me what nodes are in the cluster and how shards are distributed? Regards, Janusz -- --- ## [How can I resolve "could not use PowerShell to find Visual Studio 2017 or newer" while installing kibana](https://discuss.elastic.co/t/how-can-i-resolve-could-not-use-powershell-to-find-visual-studio-2017-or-newer-while-installing-kibana/309932)
**Author:** [@najmiehsa](https://discuss.elastic.co/u/najmiehsa)\ **Replies:** 8\ **Last updated:** [August 15, 2022, 4:12pm UTC](https://discuss.elastic.co/t/how-can-i-resolve-could-not-use-powershell-to-find-visual-studio-2017-or-newer-while-installing-kibana/309932 "2022-08-15T16:12:36Z")
Hi, I have visual studio 2022 community and visual studio 2022 build tools installed and config them with npm. But when I try to install kibana I encounter this error: could not use PowerShell to find Visual Studio 20… --- ## [Client write error, trying connect {:e=\>#\ **Author:** [@PraveenKT](https://discuss.elastic.co/u/PraveenKT)\ **Replies:** 3\ **Last updated:** [January 11, 2021, 9:08pm UTC](https://discuss.elastic.co/t/client-write-error-trying-connect-e-ioerror-connection-reset-by-peer/260571 "2021-01-11T21:08:47Z") After restarting logstash, after few hours, beats data is not sending to elasticsearch. Beats ---\> Logstash ----\> logstash ---\> Elasticsearch. I have 2 logstash servers in the site, I am getting below error on one logst… --- ## [How to limit logging to only 3 months](https://discuss.elastic.co/t/how-to-limit-logging-to-only-3-months/253025)
**Author:** [@Craig2188](https://discuss.elastic.co/u/Craig2188)\ **Replies:** 3\ **Last updated:** [November 3, 2020, 4:17pm UTC](https://discuss.elastic.co/t/how-to-limit-logging-to-only-3-months/253025 "2020-11-03T16:17:16Z")
Hi, I am trying to figure out how to limit the number of logs on Elastic/Kibana/Logstash to only hold 3 months worth of data. It is all installed on windows servers. --- ## [Unix socket input with stdout](https://discuss.elastic.co/t/unix-socket-input-with-stdout/143525)
**Author:** [@Lubomir\_Bielik](https://discuss.elastic.co/u/Lubomir_Bielik)\ **Replies:** 3\ **Last updated:** [August 9, 2018, 1:42pm UTC](https://discuss.elastic.co/t/unix-socket-input-with-stdout/143525 "2018-08-09T13:42:44Z")
Hello, I am new to Logstash, but I would like to use its capability of unix socket input, which comes very handy. I have a program sending data to unix socket, i have that socket tested and i am 100% sure, that data ar… --- ## [How to find the average query response time](https://discuss.elastic.co/t/how-to-find-the-average-query-response-time/39758)
**Author:** [@SKumarMN](https://discuss.elastic.co/u/SKumarMN)\ **Replies:** 0\ **Last updated:** [January 21, 2016, 10:52am UTC](https://discuss.elastic.co/t/how-to-find-the-average-query-response-time/39758 "2016-01-21T10:52:44Z")
Hi, I want to find out the average query response time. Say I ran a thousand queries, does ES provide any stats API to find the average response time of all the queries. Using node/stats API, I see I can get stats… --- ## [Kibana not starting up properly. pid":6349,"message":"not sending \[kibana\_settings\] monitoring document because \[undefined\] is null or invalid."}](https://discuss.elastic.co/t/kibana-not-starting-up-properly-pid-6349-message-not-sending-kibana-settings-monitoring-document-because-undefined-is-null-or-invalid/196096)
**Author:** [@darrynza](https://discuss.elastic.co/u/darrynza)\ **Replies:** 2\ **Last updated:** [August 22, 2019, 8:37am UTC](https://discuss.elastic.co/t/kibana-not-starting-up-properly-pid-6349-message-not-sending-kibana-settings-monitoring-document-because-undefined-is-null-or-invalid/196096 "2019-08-22T08:37:41Z")
{"type":"log","@timestamp":"2019-08-21T11:37:04Z","tags":\["debug","stats-collection"\],"pid":6349,"message":"not sending \[kibana\_settings\] monitoring document because \[undefined\] is null or invalid."} {"type":"log","@tim… --- ## [Logstash Inplut plugin metrics and filters?](https://discuss.elastic.co/t/logstash-inplut-plugin-metrics-and-filters/182708)
**Author:** [@EZprogramming](https://discuss.elastic.co/u/EZprogramming)\ **Replies:** 0\ **Last updated:** [May 24, 2019, 6:09pm UTC](https://discuss.elastic.co/t/logstash-inplut-plugin-metrics-and-filters/182708 "2019-05-24T18:09:17Z")
From the image above, we can see the metrics and filters for variety of namesspaces including EC2 and EBS, but how about logs? I don't know what to enter for metrics and filters if I want to import AWS Cloudwatch logs … --- ## [Cannot upgrade .kibana](https://discuss.elastic.co/t/cannot-upgrade-kibana/169856)
**Author:** [@Filippo\_Pisapia](https://discuss.elastic.co/u/Filippo_Pisapia)\ **Replies:** 0\ **Last updated:** [February 25, 2019, 3:04pm UTC](https://discuss.elastic.co/t/cannot-upgrade-kibana/169856 "2019-02-25T15:04:03Z")
Hi, i'm following the migration procedure to upgrade elasticstack from 5.4 to 6.6.1. But at this point https://www.elastic.co/guide/en/elastic-stack/6.6/upgrading-elastic-stack.html#upgrade-internal-indices i got two… --- ## [How to integrate ELK with ArcSight](https://discuss.elastic.co/t/how-to-integrate-elk-with-arcsight/236762)
**Author:** [@cezar996](https://discuss.elastic.co/u/cezar996)\ **Replies:** 4\ **Last updated:** [June 24, 2020, 3:36pm UTC](https://discuss.elastic.co/t/how-to-integrate-elk-with-arcsight/236762 "2020-06-24T15:36:32Z")
Hello everybody! I have installed ELK 7.6.2 and I want to get logs from ArcSight SIEM. In order to do this I configured a forward connector which sends all events in Syslog CEF format on port 5000 TCP, as described here… --- ## [AWS EC2에 ES와 kibana 연동 문제](https://discuss.elastic.co/t/aws-ec2-es-kibana/229166)
**Author:** [@AidenSong](https://discuss.elastic.co/u/AidenSong)\ **Replies:** 4\ **Last updated:** [April 27, 2020, 9:52am UTC](https://discuss.elastic.co/t/aws-ec2-es-kibana/229166 "2020-04-27T09:52:41Z")
안녕하세요 AWS EC2에 2개에 ES와 kibana를 RPM으로 각각 설치 하였습니다. 하지만 kibana에서 ES에 연결를 할수 없다고만 표시되고 있어 질문 드립니다. \[환경\] 서버 : AWS EC2 OS : centos 7 ES/kibana version : 7.1.1 \[elasticsearch.yml\] node.name: node-1 network.host: 0.0.0… --- ## [Problem with multiline filebeat docker prospector (,\\n)](https://discuss.elastic.co/t/problem-with-multiline-filebeat-docker-prospector-n/122261)
**Author:** [@meril](https://discuss.elastic.co/u/meril)\ **Replies:** 4\ **Last updated:** [March 12, 2018, 6:42am UTC](https://discuss.elastic.co/t/problem-with-multiline-filebeat-docker-prospector-n/122261 "2018-03-12T06:42:01Z")
Hi I configured filebeat 6.2.1 like this: filebeat.prospectors: - type: docker document\_type: eoclog4j paths: - '/var/lib/docker/containers/\*/\*.log' containers.ids: - '\*' multiline: pattern: '(\[0-9\]{4}-… --- ## [Do we have data loss when logstash is unable to send logs to haproxy as haproxy server is unavailable](https://discuss.elastic.co/t/do-we-have-data-loss-when-logstash-is-unable-to-send-logs-to-haproxy-as-haproxy-server-is-unavailable/269216)
**Author:** [@muralikrishna](https://discuss.elastic.co/u/muralikrishna)\ **Replies:** 6\ **Last updated:** [April 29, 2021, 4:03pm UTC](https://discuss.elastic.co/t/do-we-have-data-loss-when-logstash-is-unable-to-send-logs-to-haproxy-as-haproxy-server-is-unavailable/269216 "2021-04-29T16:03:09Z")
Hi All, I am looking for some information on data/log loss incase of my below situation. I have centralized management cluster to which my logstash will be connected with and i have logs coming from beat agents and sys… --- ## [Rally for aggregations on existing ES cluster](https://discuss.elastic.co/t/rally-for-aggregations-on-existing-es-cluster/195019)
**Author:** [@rajgurinder](https://discuss.elastic.co/u/rajgurinder)\ **Replies:** 6\ **Last updated:** [August 22, 2019, 1:26pm UTC](https://discuss.elastic.co/t/rally-for-aggregations-on-existing-es-cluster/195019 "2019-08-22T13:26:50Z")
Hi I have an existing ElasticSearch Cluster with 36 Data Nodes and 5 Masters. Our Main Use case is search + aggregations(alot) It frequency goes to RED state with some concurrent requests. After reading many blogs, I… --- ## [Redis input plugin back pressure issue](https://discuss.elastic.co/t/redis-input-plugin-back-pressure-issue/150826)
**Author:** [@Leo\_Kwok](https://discuss.elastic.co/u/Leo_Kwok)\ **Replies:** 6\ **Last updated:** [October 3, 2018, 9:31am UTC](https://discuss.elastic.co/t/redis-input-plugin-back-pressure-issue/150826 "2018-10-03T09:31:56Z")
Hi, we are using ELK 6.3 with the data flow Filebeat -\> Redis -\> Logstash -\> Elasticsearch. During the last few days we are doing several round of failure tests to study the impact of components down. We noticed when Red… --- ## [How to get multiline JSON parsing configured?](https://discuss.elastic.co/t/how-to-get-multiline-json-parsing-configured/255409)
**Author:** [@houmie](https://discuss.elastic.co/u/houmie)\ **Replies:** 1\ **Last updated:** [November 14, 2020, 5:39pm UTC](https://discuss.elastic.co/t/how-to-get-multiline-json-parsing-configured/255409 "2020-11-14T17:39:45Z")
Hello, When I try to activate multiline JSON parsing directly I get this error message:: Exiting: Failed to start crawler: starting input failed: Error while initializing input: When using the JSON decoder and multili… --- ## [Security index goes yellow when 1 of 3 masters go down](https://discuss.elastic.co/t/security-index-goes-yellow-when-1-of-3-masters-go-down/243036)
**Author:** [@sudeera](https://discuss.elastic.co/u/sudeera)\ **Replies:** 7\ **Last updated:** [July 31, 2020, 5:07am UTC](https://discuss.elastic.co/t/security-index-goes-yellow-when-1-of-3-masters-go-down/243036 "2020-07-31T05:07:21Z")
Hi Support, We have 6 node elasticsearch cluster. Node 1 is master and Node 2 and 6 are master eligible. Node 3, 4, 5, 6 are data nodes. Node 1,2,3,4,5 have same rack\_id and Node6 has a different rack\_id. When we have… --- ## [Painless new behaviour for nulls in version 7.x](https://discuss.elastic.co/t/painless-new-behaviour-for-nulls-in-version-7-x/212096)
**Author:** [@Paulo\_Henrique\_PH](https://discuss.elastic.co/u/Paulo_Henrique_PH)\ **Replies:** 1\ **Last updated:** [December 19, 2019, 1:56am UTC](https://discuss.elastic.co/t/painless-new-behaviour-for-nulls-in-version-7-x/212096 "2019-12-19T01:56:23Z")
Hi all, After the upgrade from version 6 to 7, we are experiencing a new behavior when processing aggregation. Now, whenever the Elastic comes across with a null value in a field while running a Painless script it break… --- ## [How to get nested type array length?](https://discuss.elastic.co/t/how-to-get-nested-type-array-length/176319)
**Author:** [@Vu\_Nguyen\_Van](https://discuss.elastic.co/u/Vu_Nguyen_Van)\ **Replies:** 1\ **Last updated:** [April 11, 2019, 2:29pm UTC](https://discuss.elastic.co/t/how-to-get-nested-type-array-length/176319 "2019-04-11T14:29:05Z")
Hi, i have a document as follow :slight\_smile:{ "took": 0, "timed\_out": false, "\_shards": { "total": 5, "successful": 5, "skipped": 0, "failed": 0 }, "hits": { "total": 4, "max\_score": 1, "hits": \[ { "\_ind… --- ## [Log alert using elastic search](https://discuss.elastic.co/t/log-alert-using-elastic-search/132160)
**Author:** [@abhijithmadhav](https://discuss.elastic.co/u/abhijithmadhav)\ **Replies:** 1\ **Last updated:** [May 16, 2018, 2:57pm UTC](https://discuss.elastic.co/t/log-alert-using-elastic-search/132160 "2018-05-16T14:57:30Z")
We have a typical ELK stack deployment in our organization. Logstash pumps our application logs into Elastic Search with each log message being mapped to a document. We use Kibana or the REST interface to Elastic Search … --- ## [Migrating Elasticsearch node](https://discuss.elastic.co/t/migrating-elasticsearch-node/62091)
**Author:** [@sarveshdamle](https://discuss.elastic.co/u/sarveshdamle)\ **Replies:** 7\ **Last updated:** [October 4, 2016, 5:39pm UTC](https://discuss.elastic.co/t/migrating-elasticsearch-node/62091 "2016-10-04T17:39:54Z")
Are there any special consideration for migrating elasticsearch nodes? OS: CentOS Old ES Version: 2.1.0 Old ES Cluster: 3 servers (5 shards each with 1 replica) Old topology: Server1 Node: master=true, data=true (only … --- ## [Enable xpack.security but not password authentication](https://discuss.elastic.co/t/enable-xpack-security-but-not-password-authentication/338917)
**Author:** [@darshanypatel](https://discuss.elastic.co/u/darshanypatel)\ **Replies:** 2\ **Last updated:** [July 25, 2023, 8:00pm UTC](https://discuss.elastic.co/t/enable-xpack-security-but-not-password-authentication/338917 "2023-07-25T20:00:11Z")
I have an ES 7.16.2 cluster running with TLS set up. I haven't set the xpack.security.enabled setting in my elasticsearch.yml file. I'm using the BASIC license. So it should have used the default value of false for that … --- ## [Logstash condition to check if a field value starts with another field's value](https://discuss.elastic.co/t/logstash-condition-to-check-if-a-field-value-starts-with-another-fields-value/264168)
**Author:** [@mattinVS](https://discuss.elastic.co/u/mattinVS)\ **Replies:** 2\ **Last updated:** [February 12, 2021, 10:49pm UTC](https://discuss.elastic.co/t/logstash-condition-to-check-if-a-field-value-starts-with-another-fields-value/264168 "2021-02-12T22:49:28Z")
Hi, I'd like to know how I can check in an if-condition in Logstash, is a field's value (in the example below the field is named "complete") starts with the value of another field (in the example below the field is name… [Previous page](https://discuss.elastic.co/top.md?page=984&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=986&per_page=50&period=all)