python (12.9k questions)

javascript (9.2k questions)

reactjs (4.7k questions)

java (4.2k questions)

java (4.2k questions)

c# (3.5k questions)

c# (3.5k questions)

html (3.3k questions)

Questions - elastic-stack

Filebeat multiline filter doesn't work with txt file

I use the filebeat to collect data from .txt file.I'm trying to use Filebeat multiline capabilities to combine log lines into one entry using the following Filebeat configuration: filebeat.inputs: - ...
test-img

ZSH

elasticsearch

logstash

kibana

elastic-stack

filebeat

Votes: 0

Answers: 2

Latest Answer

I've found out what was the problem. I used filestream as a filebeat input. multiline doesn't work with filestream. I've changed the type to log then everything works fine. filebeat.inputs: multiline...
test-img

ZSH

How to determine the correct size for terms aggregation, which will produce accurate aggregation results?

As I read through document for Terms Aggregation, I came across the fact that the results from Term Aggregation are not always accurate, but we can increase the size to get the accurate results. I kno...
test-img

Nishikant Tayade

elasticsearch

elastic-stack

resthighlevelclient

Votes: 0

Answers: 1

Latest Answer

You will get an accurate result as long as aggregation size (bucket count) is not lower than the field cardinality. If cardinality is very high you may try to use a very high shard_size or bump search...
test-img

ilvar

Why is watcher giving errors?

I want to send slack notifications to a channel as soon as any log with loglevel ERROR appears in my index. I have configured watcher in the following way but it is giving me errors. The slack message...
test-img

Sambhav Jain

kibana

elastic-stack

filebeat

elasticsearch-watcher

Votes: 0

Answers: 0

How to change “message” value in index

In logstash pipeline or indexpattern how to change the following part of CDN log in "message" field to seperate or extract some data then aggrigate them. <40> 2022-01-17T08:31:22Z logs...
test-img

MHZR

logstash

kibana

elastic-stack

cdn

elk

Votes: 0

Answers: 2

Latest Answer

Thank you, This is very useful, I got an idea from your suggestion for this specific scenario: The following edited logstash.conf solves this problem : input { tcp { port => 5000 ...
test-img

MHZR

Posts

Questions

Blogs

Jobs