1,079 questions
- Bountied 0
- Unanswered
- Frequent
- Score
- Trending
- Week
- Month
- Unanswered (my tags)
0
votes
0
answers
47
views
kibana snapshot SLM from 5 days and indexes from one year
I defined SLM for 5 days as below:
PUT _slm/policy/new-snapshot-1
{
"schedule": "0 40 21 * * ?",
"name": "<index-{now/d}>",
"...
0
votes
1
answer
111
views
Why my field reference with datastream output in logstash is not working?
I'm trying to create logstash.conf to send mylog app to elk stack. I'm using field reference in ouput tag config to create a dynamic stream data, and it return me an error then crash the logstash:
...
0
votes
0
answers
38
views
Elastic agent for apm, tracing
I want to my spring Boot application and elastic agent in a single container on ECS farget. I want to setup ELK to monitor application.cn anyone tell me Whether elastic agent only can be used for ...
0
votes
0
answers
61
views
How to disable auto sorting elkjs ladder layout Ractjs Reactflow
I am building a ladder layout diagram application using ReactJS, React Flow, and ELK for layout. However, I’m encountering an issue with the layout generation. When I add a new node using ELK, the ...
2
votes
0
answers
131
views
Integration of Wazuh, Logstash, and MISP in a Preventive Security Analysis Module (Docker-based)
I’m currently working on a preventive security analysis module that involves integrating three major components:
Wazuh – for log collection, SIEM, and real-time threat detection
Logstash – for parsing ...
0
votes
1
answer
104
views
Elasticsearch @timestamp field returned as current date time instead of from log message
This is my logstash.conf file:
filter {
grok {
match => {
"message" => '%{IPV4:client_ip} - - \[%{HTTPDATE:log_timestamp}\] "%{WORD:method} %{URIPATHPARAM:uri} HTTP/%{...
0
votes
1
answer
147
views
"Contains" search in ElasticSearch
I am new to ElasicSearch and was thrown into a project using it and I have a question about searching. We'd like to implement a "Contains()" type of search on a particular field like C# ...
0
votes
0
answers
85
views
Need to parse the json data in elasticsearch, using fluentd json parse but the combination I tried is not working
I am trying to parse this JSON data in fluentd, could you please suggest the parser and the configuration which can be used to parse this data
[
{
"Priority": 65000,
...
1
vote
1
answer
118
views
Java Elastic query not returning results
I have an application which uses java HLRC client fetching results from Elasticsearch cluster. I am facing a peculiar problem in which I am not able to get certain results from Java client side. But ...
0
votes
0
answers
58
views
table dashboard in Kibana is not showing every events
Some how we are able to create a basic TABLE dashboard to visualize the list of alerts events in table format. But what its missing is, Its not showing every alert events, for example at 13:35 there ...
0
votes
0
answers
99
views
Integrating ELK Data with TheHive and Cortex
I have deployed TheHive and Cortex on one VM and ELK on another. The ElasticSearch IP is configured in Cortex's application.conf, and everything is set up via Docker. However, I am unsure how to ...
0
votes
1
answer
111
views
How to test threat intel filebeat module rule in ELK
I have an ELK server and a Windows client that send Threat Intel logs to ELK using Filebeat.
The Enrichment log is doing by MISP (Integration between ELK and MISP by THIS LINK).
And the logs are OK.
I ...
0
votes
1
answer
93
views
Some pre built rules in Kibana are failed
I activate all rules in Kibana. But some of rules are in failed status. When I open the rule this error shown:
An error occurred during rule execution: message: "...
1
vote
4
answers
873
views
Elastic Search query upgrade for RangeQuery builder
I am upgrading the elasticsearch version from 8.14.3 to 8.15.3 and there are some issues with this query-
return new RangeQuery.Builder() .field(fieldName) .gte(JsonData.of(dateToday)) .build() ....
0
votes
1
answer
127
views
Writing a grok pattern for key value pairs
"processors" : [
{
"grok": {
"field": "log",
"patterns": ["%{TIME_STAMP:ts} %{GREEDYDATA:logtail}"],
...