# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1052 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1053 --- ## [Same action for every SIEM detection rule](https://discuss.elastic.co/t/same-action-for-every-siem-detection-rule/297056)
**Author:** [@maof97](https://discuss.elastic.co/u/maof97)\ **Replies:** 2\ **Last updated:** [February 15, 2022, 7:08pm UTC](https://discuss.elastic.co/t/same-action-for-every-siem-detection-rule/297056 "2022-02-15T19:08:44Z")
Hello, I am testing the Gold license and I thought it would be a good idea to send an E-Mail for every alert detected by the SIEM ("Alert" tab). I generally found out how to do that. I created a connector i.e. Mail conn… --- ## [Inconsistent API Response "error: no handler found for uri"](https://discuss.elastic.co/t/inconsistent-api-response-error-no-handler-found-for-uri/297086)
**Author:** [@maof97](https://discuss.elastic.co/u/maof97)\ **Replies:** 4\ **Last updated:** [February 15, 2022, 7:07pm UTC](https://discuss.elastic.co/t/inconsistent-api-response-error-no-handler-found-for-uri/297086 "2022-02-15T19:07:50Z")
Hey, doing API POST Requests via Python (on MacOS) I did: elastic\_client.update(index='.internal.alerts-security.alerts-default-000001',id='a9136c19ccfd95123cb2cf5697affbbdeb5a35c785ced06071f2777881aa33f7', body={"doc":… --- ## [Match only?](https://discuss.elastic.co/t/match-only/296888)
**Author:** [@ntak](https://discuss.elastic.co/u/ntak)\ **Replies:** 2\ **Last updated:** [February 15, 2022, 6:40pm UTC](https://discuss.elastic.co/t/match-only/296888 "2022-02-15T18:40:58Z")
Hello! I'm new to ES and I'm trying to figure out how to make a query which asserts the following: All given tokens are present in the field - regardless of the order No other token are present. Ideally, I'd also be … --- ## [Logstatsh Time Zone issue](https://discuss.elastic.co/t/logstatsh-time-zone-issue/297280)
**Author:** [@hanumant](https://discuss.elastic.co/u/hanumant)\ **Replies:** 1\ **Last updated:** [February 15, 2022, 5:55pm UTC](https://discuss.elastic.co/t/logstatsh-time-zone-issue/297280 "2022-02-15T17:55:39Z")
Hi Team, environment logstatsh and elastic server are running in IST System DataBase is in UTC time zone I'm using JDBC logstatsh to push the information I'm seeing the date related all columns values are getting alter… --- ## [Error Querying Windows System using Osquery Manager on Kibana](https://discuss.elastic.co/t/error-querying-windows-system-using-osquery-manager-on-kibana/296354)
**Author:** [@mibeyki](https://discuss.elastic.co/u/mibeyki)\ **Replies:** 13\ **Last updated:** [February 15, 2022, 5:01pm UTC](https://discuss.elastic.co/t/error-querying-windows-system-using-osquery-manager-on-kibana/296354 "2022-02-15T17:01:17Z")
Hello there, I have successfully setup and ELK stack v7.17.0 fully integrated with Fleet and Osquery manager. When I try to query the remote windows agent using osquery live queries, i get the error below; TypeError: … --- ## [Self-managed App Search with SSL enabled](https://discuss.elastic.co/t/self-managed-app-search-with-ssl-enabled/297245)
**Author:** [@Amine27](https://discuss.elastic.co/u/Amine27)\ **Replies:** 0\ **Last updated:** [February 15, 2022, 1:06pm UTC](https://discuss.elastic.co/t/self-managed-app-search-with-ssl-enabled/297245 "2022-02-15T13:06:28Z")
Hello, I am trying to connect Logstash to App Search output with SSL enabled. I am getting this error: Pipeline error {:pipeline\_id=\>"main", :exception=\>#\ **Author:** [@Wonder\_Garance](https://discuss.elastic.co/u/Wonder_Garance)\ **Replies:** 4\ **Last updated:** [February 15, 2022, 5:13pm UTC](https://discuss.elastic.co/t/how-to-add-optional-json-field-in-logstash/296650 "2022-02-15T17:13:47Z") Hi, I wrote a Logstash pipeline to modify some fields of json input files. The keys introduction.text, introduction.html and body in json are optional, I don't want to create empty fields in json output files. How to add… --- ## [Display a Value from a JSON Field](https://discuss.elastic.co/t/display-a-value-from-a-json-field/297178)
**Author:** [@jamiejackson](https://discuss.elastic.co/u/jamiejackson)\ **Replies:** 1\ **Last updated:** [February 15, 2022, 5:10pm UTC](https://discuss.elastic.co/t/display-a-value-from-a-json-field/297178 "2022-02-15T17:10:19Z")
I see several related forums posts for this but as far as I can tell, nobody had any success. In Elasticsearch/Kibana 6.7 (AWS-managed, for now). Say I have a field, httpRequest.headers, which has the following contents… --- ## [Ingest pipeline: run uri\_parts on all fields ending in "url"](https://discuss.elastic.co/t/ingest-pipeline-run-uri-parts-on-all-fields-ending-in-url/297231)
**Author:** [@louic](https://discuss.elastic.co/u/louic)\ **Replies:** 0\ **Last updated:** [February 15, 2022, 10:52am UTC](https://discuss.elastic.co/t/ingest-pipeline-run-uri-parts-on-all-fields-ending-in-url/297231 "2022-02-15T10:52:11Z")
How to define an ingest pipeline that runs the uri\_parts processor on all fields that match "\*.url" and output to "\*.parsed\_url" ? (without using logstash or beats) The URI parts documentation does not list any support … --- ## [Logstash remove field](https://discuss.elastic.co/t/logstash-remove-field/297209)
**Author:** [@chandima\_jayamina](https://discuss.elastic.co/u/chandima_jayamina)\ **Replies:** 3\ **Last updated:** [February 15, 2022, 4:54pm UTC](https://discuss.elastic.co/t/logstash-remove-field/297209 "2022-02-15T16:54:10Z")
Hi I am new to ELK. I am thinking what is the best way to remove field. Just use mutate filter and remove field First set field to nil and then use mutate filter and remove What is the best way to remove the field. An… --- ## [Upgrading elasticsearch through Helm](https://discuss.elastic.co/t/upgrading-elasticsearch-through-helm/297274)
**Author:** [@tom4](https://discuss.elastic.co/u/tom4)\ **Replies:** 0\ **Last updated:** [February 15, 2022, 4:53pm UTC](https://discuss.elastic.co/t/upgrading-elasticsearch-through-helm/297274 "2022-02-15T16:53:19Z")
Hi Guys, Is there a way to upgrade Elasticsearch via rolling upgrade if deployed in k8s using helm? --- ## [Kibana Visualizing Array fields in Dashboards](https://discuss.elastic.co/t/kibana-visualizing-array-fields-in-dashboards/297141)
**Author:** [@chandima\_jayamina](https://discuss.elastic.co/u/chandima_jayamina)\ **Replies:** 1\ **Last updated:** [February 15, 2022, 3:56pm UTC](https://discuss.elastic.co/t/kibana-visualizing-array-fields-in-dashboards/297141 "2022-02-15T15:56:21Z")
Hi I have created an array for family details. filter { mutate { add\_field =\> {"employee.family"=\>"%{familyMember}"} } } So in here employee.family =\["mom", "son", "daughter"\] I created Visualisation on how many e… --- ## [Query\_string query operator precedence](https://discuss.elastic.co/t/query-string-query-operator-precedence/297183)
**Author:** [@MrFantastic2022](https://discuss.elastic.co/u/MrFantastic2022)\ **Replies:** 2\ **Last updated:** [February 15, 2022, 2:56pm UTC](https://discuss.elastic.co/t/query-string-query-operator-precedence/297183 "2022-02-15T14:56:49Z")
Hello. When constructing a query\_string query, what is the precedence of the operators? For instance, the example given is this AND that OR thus. So does it AND this/that, then OR with thus? Or does it OR then AND? … --- ## [URI parts processor does not process "domain" part containing special letters (öüõä, cyrillic)](https://discuss.elastic.co/t/uri-parts-processor-does-not-process-domain-part-containing-special-letters-ouoa-cyrillic/297261)
**Author:** [@heikis](https://discuss.elastic.co/u/heikis)\ **Replies:** 0\ **Last updated:** [February 15, 2022, 2:56pm UTC](https://discuss.elastic.co/t/uri-parts-processor-does-not-process-domain-part-containing-special-letters-ouoa-cyrillic/297261 "2022-02-15T14:56:36Z")
Hello. What would be the solution to my problem that the ingest pipeline "uri\_parts" does not process the "domain" part of the URL if the domain contains some special letters like öäüõ or letters in cyrillic. What could… --- ## [Possible bug in logstash 7.16.2 with degug](https://discuss.elastic.co/t/possible-bug-in-logstash-7-16-2-with-degug/297260)
**Author:** [@mtudisco](https://discuss.elastic.co/u/mtudisco)\ **Replies:** 0\ **Last updated:** [February 15, 2022, 2:51pm UTC](https://discuss.elastic.co/t/possible-bug-in-logstash-7-16-2-with-degug/297260 "2022-02-15T14:51:36Z")
Hi, We recently upgraded our stack to elastic 7.16.2, and after that I introduced some changes in my configuracion. That configuration worked in test, but when i put it in production it does not get any error, however i… --- ## [Snapshot creation to external fs runs into open file limit](https://discuss.elastic.co/t/snapshot-creation-to-external-fs-runs-into-open-file-limit/297132)
**Author:** [@raulk89](https://discuss.elastic.co/u/raulk89)\ **Replies:** 11\ **Last updated:** [February 15, 2022, 2:51pm UTC](https://discuss.elastic.co/t/snapshot-creation-to-external-fs-runs-into-open-file-limit/297132 "2022-02-15T14:51:20Z")
Hi Elastic 7.16 How can I limit open file descriptors while creating snapshots..? My issue is, the external file share (hpe storeonce nfs share), we are using where to put our snapshots, it has open file handle limit.… --- ## [How to do log parsing](https://discuss.elastic.co/t/how-to-do-log-parsing/297112)
**Author:** [@himmana](https://discuss.elastic.co/u/himmana)\ **Replies:** 1\ **Last updated:** [February 15, 2022, 2:40pm UTC](https://discuss.elastic.co/t/how-to-do-log-parsing/297112 "2022-02-15T14:40:24Z")
This is my log. i used "elastic" and "filebeat" and "kibana" I'm a beginner who just started studying. I want to parse and use the contents of "message". Where should I start and what should we do? --- ## [ElasticSearch 7.16.3 throwing error on shape that is valid geojson](https://discuss.elastic.co/t/elasticsearch-7-16-3-throwing-error-on-shape-that-is-valid-geojson/297161)
**Author:** [@jstone\_b3insight](https://discuss.elastic.co/u/jstone_b3insight)\ **Replies:** 2\ **Last updated:** [February 15, 2022, 2:22pm UTC](https://discuss.elastic.co/t/elasticsearch-7-16-3-throwing-error-on-shape-that-is-valid-geojson/297161 "2022-02-15T14:22:25Z")
Hello, We recently upgraded from ES version 6 to 7.16.3. One of the shapes we have in our index worked fine in version 6 and is currently working fine in version 7 in the index we migrated over from 6, but when trying … --- ## [Schedule not working sometimes | gaps in records](https://discuss.elastic.co/t/schedule-not-working-sometimes-gaps-in-records/296442)
**Author:** [@Nasser](https://discuss.elastic.co/u/Nasser)\ **Replies:** 1\ **Last updated:** [February 15, 2022, 1:53pm UTC](https://discuss.elastic.co/t/schedule-not-working-sometimes-gaps-in-records/296442 "2022-02-15T13:53:44Z")
Hi i have 10 jdbc.conf files when i start the logstash all queries executed successfully but after the first shot some of the queries not execute. i tried to find the reason in logstash.log but nothing show PFB screen… --- ## [Fleet Server Settings Elasticsearch CA Fingerprint Rejected](https://discuss.elastic.co/t/fleet-server-settings-elasticsearch-ca-fingerprint-rejected/297218)
**Author:** [@ddth\_2022](https://discuss.elastic.co/u/ddth_2022)\ **Replies:** 3\ **Last updated:** [February 15, 2022, 1:46pm UTC](https://discuss.elastic.co/t/fleet-server-settings-elasticsearch-ca-fingerprint-rejected/297218 "2022-02-15T13:46:10Z")
I tried entering the base64 encoded Fingerprint of the CA certificate in the Output section of Fleet settings, but I get the error below - The string is most definitely base64 encoded. What can I do to get past this i… --- ## [How to calculate gauss value](https://discuss.elastic.co/t/how-to-calculate-gauss-value/297106)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 2\ **Last updated:** [February 15, 2022, 11:13am UTC](https://discuss.elastic.co/t/how-to-calculate-gauss-value/297106 "2022-02-15T11:13:13Z")
I want to know how this gauss value is calculated. POST sneaker/\_search { "query": { "function\_score": { "functions": \[ { "gauss": { "price": { "origin": "300", … --- ## [Ratio of different event count](https://discuss.elastic.co/t/ratio-of-different-event-count/296976)
**Author:** [@Dror\_Tirosh](https://discuss.elastic.co/u/Dror_Tirosh)\ **Replies:** 2\ **Last updated:** [February 15, 2022, 10:31am UTC](https://discuss.elastic.co/t/ratio-of-different-event-count/296976 "2022-02-15T10:31:44Z")
I have a log of various event I need to find the ratio of "good events" from "bad events". I want to graph it over time. For the "vertical axis formula", I need something like count(eventName=="bad) / count(eventName=… --- ## [Configuring Elasticsearch on K8s](https://discuss.elastic.co/t/configuring-elasticsearch-on-k8s/297229)
**Author:** [@Kapila](https://discuss.elastic.co/u/Kapila)\ **Replies:** 0\ **Last updated:** [February 15, 2022, 10:25am UTC](https://discuss.elastic.co/t/configuring-elasticsearch-on-k8s/297229 "2022-02-15T10:25:54Z")
I'm trying to create 3-node Elasticsearch cluster in K8s. Tried create with helm but it created 3-replicas with same Elasticsearch roles instead 3 pods in K8s. I want to create 1-master and 2-data nodes with 1-replica ea… --- ## [Api python for update with ?pipeline=opennlp-pipeline parameter](https://discuss.elastic.co/t/api-python-for-update-with-pipeline-opennlp-pipeline-parameter/297228)
**Author:** [@zabitelasticsearch](https://discuss.elastic.co/u/zabitelasticsearch)\ **Replies:** 0\ **Last updated:** [February 15, 2022, 10:25am UTC](https://discuss.elastic.co/t/api-python-for-update-with-pipeline-opennlp-pipeline-parameter/297228 "2022-02-15T10:25:29Z")
Hi, I use python library to query Elasticsearch. from elasticsearch import Elasticsearch clearedText = "Kobe Bryant was one of the best basketball players of all times. Not even Michael Jordan has ever scored 81 poin… --- ## [Not able to write into log file on running logstash](https://discuss.elastic.co/t/not-able-to-write-into-log-file-on-running-logstash/296574)
**Author:** [@RaviK](https://discuss.elastic.co/u/RaviK)\ **Replies:** 2\ **Last updated:** [February 15, 2022, 10:06am UTC](https://discuss.elastic.co/t/not-able-to-write-into-log-file-on-running-logstash/296574 "2022-02-15T10:06:07Z")
Hi Can anyone please help. My logstash service is running fine and able to parse the log lines from input files. But i can see due to running logstash service, my logfile is not getting updated. But when i'm stopping… --- ## [How to pass params into script as HashSet](https://discuss.elastic.co/t/how-to-pass-params-into-script-as-hashset/297224)
**Author:** [@megatron90000](https://discuss.elastic.co/u/megatron90000)\ **Replies:** 0\ **Last updated:** [February 15, 2022, 10:00am UTC](https://discuss.elastic.co/t/how-to-pass-params-into-script-as-hashset/297224 "2022-02-15T10:00:39Z")
I want to pass params in my script function as HashSet for fast contains check with complexity O(1). As I know, standart params list is ArrayList. How can I do this? Can I use ScriptEngine java? --- ## [Elastic fork/commit in github, how to apply?](https://discuss.elastic.co/t/elastic-fork-commit-in-github-how-to-apply/297217)
**Author:** [@b.kaliuzhnyi](https://discuss.elastic.co/u/b.kaliuzhnyi)\ **Replies:** 0\ **Last updated:** [February 15, 2022, 9:26am UTC](https://discuss.elastic.co/t/elastic-fork-commit-in-github-how-to-apply/297217 "2022-02-15T09:26:07Z")
Hello! I need a function to add a rollup to ILM. Found something on github: https://github.com/elastic/elasticsearch/issues/48003 . I've never worked with git, I don't know where to start. Is there an instruction to … --- ## [Auto\_flush\_interval in exec module](https://discuss.elastic.co/t/auto-flush-interval-in-exec-module/295863)
**Author:** [@jeleb](https://discuss.elastic.co/u/jeleb)\ **Replies:** 1\ **Last updated:** [February 15, 2022, 9:03am UTC](https://discuss.elastic.co/t/auto-flush-interval-in-exec-module/295863 "2022-02-15T09:03:39Z")
Hi, I have a problem with auto\_flush\_interval I want to check the command result logstash.conf: input { … --- ## [Closed indices do not release shards](https://discuss.elastic.co/t/closed-indices-do-not-release-shards/297142)
**Author:** [@gjulianm](https://discuss.elastic.co/u/gjulianm)\ **Replies:** 4\ **Last updated:** [February 15, 2022, 8:58am UTC](https://discuss.elastic.co/t/closed-indices-do-not-release-shards/297142 "2022-02-15T08:58:06Z")
I am having a problem where closed indices are not releasing shards. I am not sure if this is a configuration problem or a change with respect to previous versions (I am using 7.17.0 right now), because I have been able … --- ## ['You do not have permission to access the requested page' after ELK Docker Compose tutorial](https://discuss.elastic.co/t/you-do-not-have-permission-to-access-the-requested-page-after-elk-docker-compose-tutorial/297171)
**Author:** [@JaspervLeeuwen](https://discuss.elastic.co/u/JaspervLeeuwen)\ **Replies:** 2\ **Last updated:** [February 15, 2022, 8:51am UTC](https://discuss.elastic.co/t/you-do-not-have-permission-to-access-the-requested-page-after-elk-docker-compose-tutorial/297171 "2022-02-15T08:51:27Z")
I have followed the guide on installing the Elastic Stack using Docker Compose (Running the Elastic Stack ("ELK") on Docker | Getting Started \[8.0\] | Elastic). When I try to sign in Kibana using kibana\_system as username… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1051) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1053)