# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=103 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 104 --- ## [Unable to parse data with grok](https://discuss.elastic.co/t/unable-to-parse-data-with-grok/374362)
**Author:** [@Eshwar\_K](https://discuss.elastic.co/u/Eshwar_K)\ **Replies:** 1\ **Last updated:** [February 11, 2025, 12:55pm UTC](https://discuss.elastic.co/t/unable-to-parse-data-with-grok/374362 "2025-02-11T12:55:29Z")
Hi Team, I have following logs and trying to parse with grok pattern but not able to get proper grok pattern for it. Kindly help me to to parse data into JSON format. I am trying to write the pattern as below. 2025-01… --- ## [Jsr305 in latest version of elasticsearch-java package](https://discuss.elastic.co/t/jsr305-in-latest-version-of-elasticsearch-java-package/374355)
**Author:** [@shadyiscrazy](https://discuss.elastic.co/u/shadyiscrazy)\ **Replies:** 1\ **Last updated:** [February 11, 2025, 12:54pm UTC](https://discuss.elastic.co/t/jsr305-in-latest-version-of-elasticsearch-java-package/374355 "2025-02-11T12:54:20Z")
latest version of elasticsearch-java still uses com.google.code.findbugs:jsr305 package, it has been relocated to com.github.spotbugs -\> spotbugs-annotations will the upcoming version use the relocated version of jsr? --- ## [Sonar issue : t-digest🫙3.2 version is too old](https://discuss.elastic.co/t/sonar-issue-t-digest3-2-version-is-too-old/374353)
**Author:** [@shadyiscrazy](https://discuss.elastic.co/u/shadyiscrazy)\ **Replies:** 1\ **Last updated:** [February 11, 2025, 10:27am UTC](https://discuss.elastic.co/t/sonar-issue-t-digest3-2-version-is-too-old/374353 "2025-02-11T10:27:10Z")
in one of our microservice project we are using org.elasticsearch.client:elasticsearch-rest-high-level-client:jar:7.17.23 which internally uses "com.tdunning:t-digest:jar:3.2" this is sonar vulnerability issues, is th… --- ## [Local MySQL DB](https://discuss.elastic.co/t/local-mysql-db/374217)
**Author:** [@joerg\_kraemer1](https://discuss.elastic.co/u/joerg_kraemer1)\ **Replies:** 2\ **Last updated:** [February 11, 2025, 8:30am UTC](https://discuss.elastic.co/t/local-mysql-db/374217 "2025-02-11T08:30:10Z")
How can I use the Elastic Agent in my case? We have a Local MySQL DB on all of our clients. In that DB is a errorlog. How can I get that into Elastic? Shoves in the right direction would be nice :slight\_smile: --- ## [Kibana metricbeat iis and postgres default dashboards](https://discuss.elastic.co/t/kibana-metricbeat-iis-and-postgres-default-dashboards/374180)
**Author:** [@San9](https://discuss.elastic.co/u/San9)\ **Replies:** 1\ **Last updated:** [February 11, 2025, 7:46am UTC](https://discuss.elastic.co/t/kibana-metricbeat-iis-and-postgres-default-dashboards/374180 "2025-02-11T07:46:12Z")
Hi Teams! Please tell me where you can download default metricbeat dashboards for iis and postgres. Since I can't download them manually because they are in json format and I need ndjson. I would like to get as a result… --- ## [Fleet output cloning](https://discuss.elastic.co/t/fleet-output-cloning/374349)
**Author:** [@tapiojaa](https://discuss.elastic.co/u/tapiojaa)\ **Replies:** 0\ **Last updated:** [February 11, 2025, 7:09am UTC](https://discuss.elastic.co/t/fleet-output-cloning/374349 "2025-02-11T07:09:11Z")
We are using Elastic Agent with Fleet and our output is Kafka. That's why we need to create separate output configuration for each client. There are quite many things to configure. Is it possible to clone existing output… --- ## [MongoDB input plug-in for logstash](https://discuss.elastic.co/t/mongodb-input-plug-in-for-logstash/374345)
**Author:** [@Anand\_Konagala](https://discuss.elastic.co/u/Anand_Konagala)\ **Replies:** 0\ **Last updated:** [February 11, 2025, 6:08am UTC](https://discuss.elastic.co/t/mongodb-input-plug-in-for-logstash/374345 "2025-02-11T06:08:05Z")
Hi Team, I am using Logstash (v8.17.1) to sync data from MongoDB to Elasticsearch. The document creation works fine, but I am facing issues with syncing only updated documents from MongoDB. I tried filtering documents … --- ## [Dev Tools \\ Console with NDJSON](https://discuss.elastic.co/t/dev-tools-console-with-ndjson/374328)
**Author:** [@es2025](https://discuss.elastic.co/u/es2025)\ **Replies:** 5\ **Last updated:** [February 11, 2025, 1:24am UTC](https://discuss.elastic.co/t/dev-tools-console-with-ndjson/374328 "2025-02-11T01:24:16Z")
Hello, I am new to ES, please help to shed a light, does it error mean the Dev Tools Console does not handle ndjson or something else I missed? Thank you. --- ## [Using inner\_hits in knn search with rrf](https://discuss.elastic.co/t/using-inner-hits-in-knn-search-with-rrf/374086)
**Author:** [@gregp](https://discuss.elastic.co/u/gregp)\ **Replies:** 3\ **Last updated:** [February 10, 2025, 7:34pm UTC](https://discuss.elastic.co/t/using-inner-hits-in-knn-search-with-rrf/374086 "2025-02-10T19:34:26Z")
I'm relatively new to elasticsearch and have a knn query that uses inner\_hits to retrieve nested passages within a document. I want to combine this knn query with a matching query as part of a hybrid search, but I'm gett… --- ## [Monitor Agent-Status](https://discuss.elastic.co/t/monitor-agent-status/374059)
**Author:** [@MGBSLC](https://discuss.elastic.co/u/MGBSLC)\ **Replies:** 1\ **Last updated:** [February 10, 2025, 7:34pm UTC](https://discuss.elastic.co/t/monitor-agent-status/374059 "2025-02-10T19:34:22Z")
Hi Community We would like to monitor the agent-status (status = unhealthy) of an elastic agent but only with a specific integration policy included. what would be the best way to create such a monitor in Kibana? --- ## [Run from source Elasticsearch and connect Kibana](https://discuss.elastic.co/t/run-from-source-elasticsearch-and-connect-kibana/374279)
**Author:** [@Egor\_Krylovich](https://discuss.elastic.co/u/Egor_Krylovich)\ **Replies:** 7\ **Last updated:** [February 10, 2025, 7:21pm UTC](https://discuss.elastic.co/t/run-from-source-elasticsearch-and-connect-kibana/374279 "2025-02-10T19:21:03Z")
Hello, I'm trying to setup environment for contribution into the project. I was able to run Elasticsearch from sources by running: ./gradlew run I verified that the server is up and running by: curl -u elastic:passwo… --- ## [Filebeat and metricbeat logs ending up in /var/log/messages](https://discuss.elastic.co/t/filebeat-and-metricbeat-logs-ending-up-in-var-log-messages/374134)
**Author:** [@umesh2020](https://discuss.elastic.co/u/umesh2020)\ **Replies:** 1\ **Last updated:** [February 10, 2025, 6:53pm UTC](https://discuss.elastic.co/t/filebeat-and-metricbeat-logs-ending-up-in-var-log-messages/374134 "2025-02-10T18:53:39Z")
I am seeing that metricbeat/filebeat running on Linux are logging their messages to /var/log/messages instead of file. Here is my configuration: logging.level: info logging.to\_syslog: false logging.to\_files: true loggi… --- ## [Elasticsearch Help](https://discuss.elastic.co/t/elasticsearch-help/374312)
**Author:** [@antmar9041](https://discuss.elastic.co/u/antmar9041)\ **Replies:** 5\ **Last updated:** [February 10, 2025, 4:26pm UTC](https://discuss.elastic.co/t/elasticsearch-help/374312 "2025-02-10T16:26:57Z")
Hi I use Elasticsearch a lot in my job but I'm having a hard time trying to search for Windows paths in my data. For example, I want to search for: C:\\Users\\user\\downloads I tried every type of search but I can't seem… --- ## [FIM integration User data missing](https://discuss.elastic.co/t/fim-integration-user-data-missing/374170)
**Author:** [@amarasinghe.kaluarac](https://discuss.elastic.co/u/amarasinghe.kaluarac)\ **Replies:** 4\ **Last updated:** [February 10, 2025, 4:10pm UTC](https://discuss.elastic.co/t/fim-integration-user-data-missing/374170 "2025-02-10T16:10:31Z")
Hi all, I have configured the File Integrity Monitoring Integration for my Linux server but even though the logs being ingested to my Elasticsearch some fileds like Process.user.name is missing from logs , This process … --- ## [Chat AI playground](https://discuss.elastic.co/t/chat-ai-playground/374292)
**Author:** [@Nokki123123](https://discuss.elastic.co/u/Nokki123123)\ **Replies:** 2\ **Last updated:** [February 10, 2025, 4:00pm UTC](https://discuss.elastic.co/t/chat-ai-playground/374292 "2025-02-10T16:00:23Z")
Hi Team, I have a native connector that connects to Salesforce, and I want to test the AI playground. I've linked my OpenAI account and the indices, but I can only select one field from the Salesforce schema. Is it poss… --- ## [Indexing delays in elastic search after increase the java heap memory on logstash](https://discuss.elastic.co/t/indexing-delays-in-elastic-search-after-increase-the-java-heap-memory-on-logstash/374324)
**Author:** [@devops\_training](https://discuss.elastic.co/u/devops_training)\ **Replies:** 0\ **Last updated:** [February 10, 2025, 3:41pm UTC](https://discuss.elastic.co/t/indexing-delays-in-elastic-search-after-increase-the-java-heap-memory-on-logstash/374324 "2025-02-10T15:41:48Z")
Hi Team - I would like to tune refresh interval and control bulk size parameters on Logstash. Could you please explain more about this parameters. --- ## [How to Add a Filter Bar to a Data Table in Kibana?](https://discuss.elastic.co/t/how-to-add-a-filter-bar-to-a-data-table-in-kibana/374321)
**Author:** [@se101](https://discuss.elastic.co/u/se101)\ **Replies:** 0\ **Last updated:** [February 10, 2025, 3:26pm UTC](https://discuss.elastic.co/t/how-to-add-a-filter-bar-to-a-data-table-in-kibana/374321 "2025-02-10T15:26:57Z")
Hi, I'm using Kibana 8.15 and I want to add a filter bar specifically to a data table visualization within a dashboard. The goal is to allow users to input text and filter the data table rows without affecting other vis… --- ## [Limited to Initial 1000 Logs from API with Elastic Agent](https://discuss.elastic.co/t/limited-to-initial-1000-logs-from-api-with-elastic-agent/374224)
**Author:** [@ErGeek](https://discuss.elastic.co/u/ErGeek)\ **Replies:** 4\ **Last updated:** [February 10, 2025, 2:50pm UTC](https://discuss.elastic.co/t/limited-to-initial-1000-logs-from-api-with-elastic-agent/374224 "2025-02-10T14:50:42Z")
Hi All, We have configured our elastic-agent.yml to poll logs every 1 minute. However, the API returns a maximum of 1000 logs per poll, so we’re only receiving the first 1000 logs while the remaining logs are not being … --- ## [Source.ip not available in the logs received from windows](https://discuss.elastic.co/t/source-ip-not-available-in-the-logs-received-from-windows/374308)
**Author:** [@mancharagopan](https://discuss.elastic.co/u/mancharagopan)\ **Replies:** 0\ **Last updated:** [February 10, 2025, 12:38pm UTC](https://discuss.elastic.co/t/source-ip-not-available-in-the-logs-received-from-windows/374308 "2025-02-10T12:38:13Z")
I have integrated Windows computer and receiving logs using elastic agent. For several security rules source.ip field is required for detection. Instead of source.ip the logs are indexed with host.ip. how do i change it… --- ## [Metricbeat get 403 when retrieving data from Jolokia over network](https://discuss.elastic.co/t/metricbeat-get-403-when-retrieving-data-from-jolokia-over-network/374305)
**Author:** [@nso](https://discuss.elastic.co/u/nso)\ **Replies:** 0\ **Last updated:** [February 10, 2025, 11:08am UTC](https://discuss.elastic.co/t/metricbeat-get-403-when-retrieving-data-from-jolokia-over-network/374305 "2025-02-10T11:08:42Z")
Hello ! I'm currently trying to retrieve JVM metrics through Jolokia and Metricbeat but i'm facing an issue. When Metricbeat (on server 1) calls Jolokia agents (on server 2) over the network i get 403 HTTP response. But… --- ## [Missing token enrollment](https://discuss.elastic.co/t/missing-token-enrollment/374282)
**Author:** [@seblac](https://discuss.elastic.co/u/seblac)\ **Replies:** 2\ **Last updated:** [February 10, 2025, 10:49am UTC](https://discuss.elastic.co/t/missing-token-enrollment/374282 "2025-02-10T10:49:58Z")
Dear All, I have installed the ELK stack in version 8.16.3 with docker running on a windows system and WSL 2. I am using the tool compose from docker to script the installation of a first elastic node. I used the script… --- ## [Azure Integration - incomplete logs in standard dashboards](https://discuss.elastic.co/t/azure-integration-incomplete-logs-in-standard-dashboards/374303)
**Author:** [@Simon7](https://discuss.elastic.co/u/Simon7)\ **Replies:** 0\ **Last updated:** [February 10, 2025, 10:39am UTC](https://discuss.elastic.co/t/azure-integration-incomplete-logs-in-standard-dashboards/374303 "2025-02-10T10:39:07Z")
Hi, i´m in trouble with the azure integrations in elastic. I use an elastic-agent of an own linux server to collect logs out of an azure eventhub. In discover i see any logs with the following data\_stream.dataset: azure… --- ## [Resolving 'Freezing deprecated' migration assistant warnings](https://discuss.elastic.co/t/resolving-freezing-deprecated-migration-assistant-warnings/374285)
**Author:** [@DPattee](https://discuss.elastic.co/u/DPattee)\ **Replies:** 0\ **Last updated:** [February 10, 2025, 1:21am UTC](https://discuss.elastic.co/t/resolving-freezing-deprecated-migration-assistant-warnings/374285 "2025-02-10T01:21:56Z")
I've resolved all the critical Upgrade Assistant issues in prep for a 7.17 -\> 8 upgrade, including removing 'freeze' steps from my ILM policies. But there are nearly 150 "Freezing indices is deprecated" warnings left. M… --- ## [Hide Anonymous login from login page](https://discuss.elastic.co/t/hide-anonymous-login-from-login-page/374275)
**Author:** [@hamedov](https://discuss.elastic.co/u/hamedov)\ **Replies:** 1\ **Last updated:** [February 9, 2025, 3:22pm UTC](https://discuss.elastic.co/t/hide-anonymous-login-from-login-page/374275 "2025-02-09T15:22:58Z")
We have a scenario where we embed Kibana dashboards in our admin portal using saved object URL iframe embed. We use anonymous login provider in the url query to skip the login page. Is there a way to accomplish this wit… --- ## [Filebeat ILM Policy Not Working](https://discuss.elastic.co/t/filebeat-ilm-policy-not-working/374273)
**Author:** [@Mysticrunner](https://discuss.elastic.co/u/Mysticrunner)\ **Replies:** 0\ **Last updated:** [February 9, 2025, 1:45pm UTC](https://discuss.elastic.co/t/filebeat-ilm-policy-not-working/374273 "2025-02-09T13:45:24Z")
Hi, I am using Filebeat to harvest logs from servers. I want to set up a cleanup policy, and I have created one, but it is not taking effect. Can anyone help me figure out if I am missing something? I am using the same … --- ## [Elasticsearch run with single noe but not running with docker-compose for multi-node](https://discuss.elastic.co/t/elasticsearch-run-with-single-noe-but-not-running-with-docker-compose-for-multi-node/374253)
**Author:** [@Salil\_Hardeniya](https://discuss.elastic.co/u/Salil_Hardeniya)\ **Replies:** 12\ **Last updated:** [February 9, 2025, 1:09pm UTC](https://discuss.elastic.co/t/elasticsearch-run-with-single-noe-but-not-running-with-docker-compose-for-multi-node/374253 "2025-02-09T13:09:53Z")
Hi, I'm having issue running multi-node cluster using docker-compose on Apple M4 chip. I was getting similar issue when I tried to run single node using docker but it was fixed by using ES\_JAVA\_OPTS='-XX:UseSVE=0' CL… --- ## [Using Observability Alerts for Slack: Why am I unable to post both the context.value and the aggregation A value that's used to calculate context.value?](https://discuss.elastic.co/t/using-observability-alerts-for-slack-why-am-i-unable-to-post-both-the-context-value-and-the-aggregation-a-value-thats-used-to-calculate-context-value/374194)
**Author:** [@walk](https://discuss.elastic.co/u/walk)\ **Replies:** 2\ **Last updated:** [February 9, 2025, 2:10am UTC](https://discuss.elastic.co/t/using-observability-alerts-for-slack-why-am-i-unable-to-post-both-the-context-value-and-the-aggregation-a-value-thats-used-to-calculate-context-value/374194 "2025-02-09T02:10:19Z")
Hello, I've set up observability alerts with Elastic/Kibana, but have run into such a simple issue: When an alert triggers, it only shows the value that triggered the alert (e.g. the error rate above a certain threshold… --- ## [Multipe group with multiple aggregation in dotnet](https://discuss.elastic.co/t/multipe-group-with-multiple-aggregation-in-dotnet/374249)
**Author:** [@vicentegarciadiez](https://discuss.elastic.co/u/vicentegarciadiez)\ **Replies:** 0\ **Last updated:** [February 8, 2025, 8:18am UTC](https://discuss.elastic.co/t/multipe-group-with-multiple-aggregation-in-dotnet/374249 "2025-02-08T08:18:08Z")
Hi to everybody, I like to create a query with the latest dotnet Elasticsearch client version 8.17.1 What I want is: groupBy: sessionId AND destinationPort,sourcePort AND protocol AND destinationPhysicalAddress AND … --- ## [Logstash CEF Field Mapping Inconsistency Between 7.16.2 and 8.16.3](https://discuss.elastic.co/t/logstash-cef-field-mapping-inconsistency-between-7-16-2-and-8-16-3/374212)
**Author:** [@Kfiro](https://discuss.elastic.co/u/Kfiro)\ **Replies:** 3\ **Last updated:** [February 8, 2025, 7:57am UTC](https://discuss.elastic.co/t/logstash-cef-field-mapping-inconsistency-between-7-16-2-and-8-16-3/374212 "2025-02-08T07:57:55Z")
I am running Logstash containers to process CEF messages, and I have observed an inconsistency in field mappings between Logstash 7.16.2 and 8.16.3. When using Logstash 7.16.2, fields are mapped as expected, but in 8.16… --- ## [Fluid layout for Kibana panel?](https://discuss.elastic.co/t/fluid-layout-for-kibana-panel/374241)
**Author:** [@hardcodet](https://discuss.elastic.co/u/hardcodet)\ **Replies:** 1\ **Last updated:** [February 7, 2025, 8:42pm UTC](https://discuss.elastic.co/t/fluid-layout-for-kibana-panel/374241 "2025-02-07T20:42:01Z")
Hi all Beginner's question here :slight\_smile: I created a dashboard that's very similar to the discovery view: a chart on top, and then the results of the search below. When I set up the dashboard, I moved the panel … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=102) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=104)