elk | Eclipse Layout Kernel - Automatic layout | Code Editor library

I need to remediate from a little error (60k+ over a full set of 2M items) when stack the dataset in a quite big file: somehow 2 consecutive records were merged together. I show you just few examples:

I am two days new to grok and ELK. I am struggling with breaking up the log messages based on space and make them appear as different fields in the logstash.

My input pattern is: 2022-02-11 11:57:49 - app - INFO - function_name=add elapsed_time=0.0296 input_params=6_3

I would like to see different fields in the logstash/kibana for function_name, elapsed_time and input_params.

At the moment, I have a following .conf

I'm trying to setup some processors in a filebeat.yml to process some logs before sending to ELK.

An important part of the processing is determining the "level" of the event, which is not always included in the line in the log file.

This is the idea I have for it right now:

We are using Hashicorp Nomad to run microservices on Windows. We experienced that allocations come and go, but we would like to have centralized logging solution (ideally ELK) for all logs from all jobs and tasks from multiple environments. It is quite simple to do it with dockerized environments, but how can I do it if I run raw_exec tasks?

I have a json log like this being streamed into ELK

In https://github.com/grafana/loki/issues/4249 I found interesting screenshot.

On this screenshot I see that log level and message are displayed bold with white text and other metadata (collected from log message) displayed on separate line with grey color.

I have searched docs and haven't found how it's possible to achieve that. To be honest I'm searching for something like "short message" in ELK to make developers see metadata only when they are actually needs it. Could you please point me to the doc how to achieve that please?

I'm writing a SQL query that needs to only show the results where the 'titel' is the same as 'Baklava', but it doesn't return any rows. When I try to use the query without the WHERE, is shows all the results, but I need the WHERE clause to work.

Here is the query I'm trying to use:

Which query can I use that uses INNER JOIN that gets the output of:

post_id, tag_id from table posts_tags

titel from table tags

titel from table posts

post_id from table posts_tags has a foreign key to id in posts table, and tag_id from table posts_tags has a foreign key to id in the tags table

import.sql:

Elasticsearch 7.15 with xpack auth enabled (if matters, only elasticsearch, no kibana or other elk applications installed)

I'm trying to add a user for monitoring purposes (retrieve information from elasticsearch i.e. cluster status, cluster health, indices health, size, docs count, other read only parameters about elasticsearch performance). I was looking into elasticsearch builtin roles and add role of "monitoring_user", but I can only get the "about page" (aka /), no _cluster/health, no _cat/indices or other links.

So what is the minimum least privileges role to be applied to the monitoring user in order to obtain status data from elasticsearch ?

Thank you!