# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1085 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1086 --- ## [User details using auditbeat](https://discuss.elastic.co/t/user-details-using-auditbeat/295018)
**Author:** [@Riya\_patel](https://discuss.elastic.co/u/Riya_patel)\ **Replies:** 0\ **Last updated:** [January 21, 2022, 6:43am UTC](https://discuss.elastic.co/t/user-details-using-auditbeat/295018 "2022-01-21T06:43:05Z")
How to fetch last login user details using Auditbeat? --- ## [Elasticsearch disk based shard allocation tuning](https://discuss.elastic.co/t/elasticsearch-disk-based-shard-allocation-tuning/293616)
**Author:** [@tarund](https://discuss.elastic.co/u/tarund)\ **Replies:** 4\ **Last updated:** [January 21, 2022, 5:38am UTC](https://discuss.elastic.co/t/elasticsearch-disk-based-shard-allocation-tuning/293616 "2022-01-21T05:38:50Z")
I am running 2 node Elasticsearch cluster v7.9.2 Ingesting data through APM-Server v7.15.0, creates ~50 new indices daily with pattern apm-7.15.0-\-transaction-YYYY.MM.DD Observing that all new primary sh… --- ## [Error: Port 5601 is already in use. Another instance of Kibana may be running!--Sometime it's working sometime not if it is not worked then i restart my pc then it's worked](https://discuss.elastic.co/t/error-port-5601-is-already-in-use-another-instance-of-kibana-may-be-running-sometime-its-working-sometime-not-if-it-is-not-worked-then-i-restart-my-pc-then-its-worked/294762)
**Author:** [@harsh19](https://discuss.elastic.co/u/harsh19)\ **Replies:** 2\ **Last updated:** [January 21, 2022, 5:26am UTC](https://discuss.elastic.co/t/error-port-5601-is-already-in-use-another-instance-of-kibana-may-be-running-sometime-its-working-sometime-not-if-it-is-not-worked-then-i-restart-my-pc-then-its-worked/294762 "2022-01-21T05:26:17Z")
I already kill port 5601 and also reinstall kibana but still not working log \[10:32:00.035\] \[info\]\[plugins-service\] Plugin "metricsEntities" is disabled. log \[10:32:00.161\] \[fatal\]\[root\] Error: Port 5601 is alread… --- ## [Index pattern \> field format \> color hex codes removed in 7.15.2?](https://discuss.elastic.co/t/index-pattern-field-format-color-hex-codes-removed-in-7-15-2/294442)
**Author:** [@Mark\_Duncan](https://discuss.elastic.co/u/Mark_Duncan)\ **Replies:** 1\ **Last updated:** [January 21, 2022, 4:39am UTC](https://discuss.elastic.co/t/index-pattern-field-format-color-hex-codes-removed-in-7-15-2/294442 "2022-01-21T04:39:28Z")
I used to be able to set a hex code for the particular color that I wanted for a field in an index pattern, but that looks to have been replaced with a color graph and no option to set the value exactly. so now I cannot… --- ## [Convert a field from string to IP type](https://discuss.elastic.co/t/convert-a-field-from-string-to-ip-type/293253)
**Author:** [@yago82](https://discuss.elastic.co/u/yago82)\ **Replies:** 1\ **Last updated:** [January 21, 2022, 4:14am UTC](https://discuss.elastic.co/t/convert-a-field-from-string-to-ip-type/293253 "2022-01-21T04:14:44Z")
Hi, i need to Convert a field (client\_ip) from string to IP type. I use ILM for the index. It would be possible to change the field type on the next rollover? It doesn't matter that the previous indices are compromise… --- ## [Allowing USER to generate and download PDFs and PNGs](https://discuss.elastic.co/t/allowing-user-to-generate-and-download-pdfs-and-pngs/294629)
**Author:** [@pchatterji](https://discuss.elastic.co/u/pchatterji)\ **Replies:** 1\ **Last updated:** [January 21, 2022, 4:06am UTC](https://discuss.elastic.co/t/allowing-user-to-generate-and-download-pdfs-and-pngs/294629 "2022-01-21T04:06:37Z")
Hi, We have created a USER and assigned it USER\_ROLE (which has 'read' and 'view\_index\_metadata' privileges for a given index). This user is assigned a USER\_SPACE where the dashboard(s) the USER is able to view has been… --- ## [After collecting ES, Kibana shows why the following error occurs, sometimes it does not occur and sometimes it does occur?](https://discuss.elastic.co/t/after-collecting-es-kibana-shows-why-the-following-error-occurs-sometimes-it-does-not-occur-and-sometimes-it-does-occur/295007)
**Author:** [@linuxxin](https://discuss.elastic.co/u/linuxxin)\ **Replies:** 0\ **Last updated:** [January 21, 2022, 2:26am UTC](https://discuss.elastic.co/t/after-collecting-es-kibana-shows-why-the-following-error-occurs-sometimes-it-does-not-occur-and-sometimes-it-does-occur/295007 "2022-01-21T02:26:49Z")
Bad Request search\_phase\_execution\_exception all shards failed ................ --- ## [Dynamic mapping issue](https://discuss.elastic.co/t/dynamic-mapping-issue/294981)
**Author:** [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\ **Replies:** 1\ **Last updated:** [January 21, 2022, 12:14am UTC](https://discuss.elastic.co/t/dynamic-mapping-issue/294981 "2022-01-21T00:14:32Z")
Hi I'm having indices being sent dynamically to my project. When indices are being pushed , fields are mapped dynamically. Due to this mappings are different everytime. For example for 1 index , created date field is … --- ## [Using .Net client or low level client to create an seach engine in Search App running on Docker](https://discuss.elastic.co/t/using-net-client-or-low-level-client-to-create-an-seach-engine-in-search-app-running-on-docker/295001)
**Author:** [@shahabj13](https://discuss.elastic.co/u/shahabj13)\ **Replies:** 0\ **Last updated:** [January 21, 2022, 12:11am UTC](https://discuss.elastic.co/t/using-net-client-or-low-level-client-to-create-an-seach-engine-in-search-app-running-on-docker/295001 "2022-01-21T00:11:50Z")
I have Elasticsearch running on Docker in three nodes (9200, 3002 and 5601). I can send http request to 3002 endpoint from .Net and Postman to create a new engine. But I want to use Nest client or low level client to d… --- ## [Global Search](https://discuss.elastic.co/t/global-search/294887)
**Author:** [@Prabakar](https://discuss.elastic.co/u/Prabakar)\ **Replies:** 6\ **Last updated:** [January 20, 2022, 4:59pm UTC](https://discuss.elastic.co/t/global-search/294887 "2022-01-20T16:59:25Z")
Hello Everyone, I would like to perform a global search by providing a keyword like below (2 different requests) in the request. It returns the result which matches the word "pizza" in any of the field. But if I give "p… --- ## [Distinguishing username from domain\\username using grok](https://discuss.elastic.co/t/distinguishing-username-from-domain-username-using-grok/294988)
**Author:** [@smithtod](https://discuss.elastic.co/u/smithtod)\ **Replies:** 1\ **Last updated:** [January 20, 2022, 10:06pm UTC](https://discuss.elastic.co/t/distinguishing-username-from-domain-username-using-grok/294988 "2022-01-20T22:06:19Z")
I am trying to create a grok statement that will pull the username out of a syslog file. When users enter their authentication information for our VPN login, they can put either domain\\username, or just username, and eit… --- ## [How to find the Elasticsearch URL from Kibana?](https://discuss.elastic.co/t/how-to-find-the-elasticsearch-url-from-kibana/294979)
**Author:** [@Ananya\_Chakraborty](https://discuss.elastic.co/u/Ananya_Chakraborty)\ **Replies:** 3\ **Last updated:** [January 20, 2022, 10:00pm UTC](https://discuss.elastic.co/t/how-to-find-the-elasticsearch-url-from-kibana/294979 "2022-01-20T22:00:53Z")
I have a Kibana login with admin privilege. I don't know the URL for my Elasticsearch. How can I find it from within Kibana? Is there a query that I can run in the console to find the Elasticsearch URL? --- ## [Remove over gsub regex](https://discuss.elastic.co/t/remove-over-gsub-regex/294875)
**Author:** [@INS](https://discuss.elastic.co/u/INS)\ **Replies:** 2\ **Last updated:** [January 20, 2022, 9:49pm UTC](https://discuss.elastic.co/t/remove-over-gsub-regex/294875 "2022-01-20T21:49:36Z")
Hi How to fix below code for remove all item with word " term" from many of fields, one variant of fields in example line "psm\_info" =\> "7-5-term-term-term-term-term-" I have tried some like this one, but it doesn't … --- ## [Fleet Settings - Elasticsearch output configuration (YAML)](https://discuss.elastic.co/t/fleet-settings-elasticsearch-output-configuration-yaml/294564)
**Author:** [@VamPikmin](https://discuss.elastic.co/u/VamPikmin)\ **Replies:** 2\ **Last updated:** [January 20, 2022, 8:26pm UTC](https://discuss.elastic.co/t/fleet-settings-elasticsearch-output-configuration-yaml/294564 "2022-01-20T20:26:25Z")
Hello everyone, Do I need to create separate agent policies for Linux and Windows hosts? The reason is the ca certs are in different location depending on the OS ssl.certificate\_authorities: \["/etc/elasticsearch/certs… --- ## [Elasticsearch endpoint is giving me \`My connection to this website is not secured\` on elastic cloud!](https://discuss.elastic.co/t/elasticsearch-endpoint-is-giving-me-my-connection-to-this-website-is-not-secured-on-elastic-cloud/294777)
**Author:** [@Hassan\_Shaitou1](https://discuss.elastic.co/u/Hassan_Shaitou1)\ **Replies:** 2\ **Last updated:** [January 20, 2022, 8:03pm UTC](https://discuss.elastic.co/t/elasticsearch-endpoint-is-giving-me-my-connection-to-this-website-is-not-secured-on-elastic-cloud/294777 "2022-01-20T20:03:49Z")
So I am getting this error My connection to this website is not secured when routing to the Elasticsearch endpoint before logging in, after logging in I can see that my elastic endpoint is certified correctly and secured… --- ## [How to increase number of shards in parallel that are initializing or relocating](https://discuss.elastic.co/t/how-to-increase-number-of-shards-in-parallel-that-are-initializing-or-relocating/294946)
**Author:** [@lecko](https://discuss.elastic.co/u/lecko)\ **Replies:** 1\ **Last updated:** [January 20, 2022, 7:59pm UTC](https://discuss.elastic.co/t/how-to-increase-number-of-shards-in-parallel-that-are-initializing-or-relocating/294946 "2022-01-20T19:59:47Z")
Hello. I use Elasticsearch 6.8 in a cluster of 8 servers. Sometimes I need to do some hardware task on one of servers and need to move shards from that node to others or initilaize them on other nodes. Before start I ru… --- ## [Bind errors on startup](https://discuss.elastic.co/t/bind-errors-on-startup/294886)
**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Replies:** 2\ **Last updated:** [January 20, 2022, 7:39pm UTC](https://discuss.elastic.co/t/bind-errors-on-startup/294886 "2022-01-20T19:39:23Z")
I am adding a new node to the cluster for the first time and I get the following error: \[2022-01-20T12:56:40,832\]\[INFO \]\[o.e.x.d.l.DeprecationIndexingComponent\] \[secmonprd01\] deprecation component started \[2022-01-20T12… --- ## [Drilldown date range bug](https://discuss.elastic.co/t/drilldown-date-range-bug/294976)
**Author:** [@Michael\_Ubry](https://discuss.elastic.co/u/Michael_Ubry)\ **Replies:** 6\ **Last updated:** [January 20, 2022, 6:57pm UTC](https://discuss.elastic.co/t/drilldown-date-range-bug/294976 "2022-01-20T18:57:05Z")
Hi, when you have stacked bar chart which is split by timestamp (lets say before 2019 and 2019-2022) and you create drilldown, the 2019-2022 part of bar redirects you to dashboard with correct timestamp. HOWEVER, when y… --- ## [Filbeat decode\_csv\_fields processor silently drops fields greater than 1024 characters](https://discuss.elastic.co/t/filbeat-decode-csv-fields-processor-silently-drops-fields-greater-than-1024-characters/294983)
**Author:** [@feliperuiz](https://discuss.elastic.co/u/feliperuiz)\ **Replies:** 0\ **Last updated:** [January 20, 2022, 6:48pm UTC](https://discuss.elastic.co/t/filbeat-decode-csv-fields-processor-silently-drops-fields-greater-than-1024-characters/294983 "2022-01-20T18:48:11Z")
Hello. I am trying to process some csv files in filebeat with the decode\_csv\_fields processor, but it seems that it is silently dropping fields that are greater than 1024 characters. Here is my filebeat processor config… --- ## [Kibana.yml file missing](https://discuss.elastic.co/t/kibana-yml-file-missing/294487)
**Author:** [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\ **Replies:** 3\ **Last updated:** [January 20, 2022, 6:44pm UTC](https://discuss.elastic.co/t/kibana-yml-file-missing/294487 "2022-01-20T18:44:42Z")
Hi all, i'm trying to install kibana in opendistro in Ubuntu systems I'm using command: sudo apt install opendistroforelasticsearch-kibana But when i run the above command, it unpacks packages , but kibana.yml is not … --- ## [How to construct JSON using filter{} and input data?](https://discuss.elastic.co/t/how-to-construct-json-using-filter-and-input-data/294867)
**Author:** [@AshwinMS](https://discuss.elastic.co/u/AshwinMS)\ **Replies:** 3\ **Last updated:** [January 20, 2022, 5:43pm UTC](https://discuss.elastic.co/t/how-to-construct-json-using-filter-and-input-data/294867 "2022-01-20T17:43:53Z")
Hi , im new to logstash and found it to be super useful to loadup data from different sources to an es cluster ! But ive run into one problem which ive been stuck with for a while now and would really love some help. Im… --- ## [Elastic-agent fails "enroll\_cmd.go:776 Fleet Server - Error - EOF"](https://discuss.elastic.co/t/elastic-agent-fails-enroll-cmd-go-776-fleet-server-error-eof/293779)
**Author:** [@stevebanik](https://discuss.elastic.co/u/stevebanik)\ **Replies:** 1\ **Last updated:** [January 20, 2022, 5:09pm UTC](https://discuss.elastic.co/t/elastic-agent-fails-enroll-cmd-go-776-fleet-server-error-eof/293779 "2022-01-20T17:09:34Z")
\[root@es1 elastic-agent-7.16.2-linux-x86\_64\]# uname -a Linux es1 3.10.0-1160.49.1.el7.x86\_64 #1 SMP Tue Nov 30 15:51:32 UTC 2021 x86\_64 x86\_64 x86\_64 GNU/Linux \[root@es1 elastic-agent-7.16.2-linux-x86\_64\]# ./elastic-ag… --- ## [Elastic Stack Architecture](https://discuss.elastic.co/t/elastic-stack-architecture/294849)
**Author:** [@baddack](https://discuss.elastic.co/u/baddack)\ **Replies:** 4\ **Last updated:** [January 20, 2022, 5:04pm UTC](https://discuss.elastic.co/t/elastic-stack-architecture/294849 "2022-01-20T17:04:56Z")
Hello everyone, /!\\ NB: First I would say that I am really really sorry for the ASCII Art but I can't upload images since this morning and I don't know why. :sweat\_smile: I read a lot about how an Elastic cluster shoul… --- ## [Upgrade elastic agent trough Fleet server fails](https://discuss.elastic.co/t/upgrade-elastic-agent-trough-fleet-server-fails/294717)
**Author:** [@Mr.Winter](https://discuss.elastic.co/u/Mr.Winter)\ **Replies:** 1\ **Last updated:** [January 20, 2022, 5:02pm UTC](https://discuss.elastic.co/t/upgrade-elastic-agent-trough-fleet-server-fails/294717 "2022-01-20T17:02:45Z")
Hi Folks, we are running a ELK Stack in version 7.16 with several elastic-agents managed by the fleet server. After we upgraded to 7.16 the elastic-agents needs to be upgraded also. Some upgrades for several elastic… --- ## [Setting a custom variable in TSVB bucket script](https://discuss.elastic.co/t/setting-a-custom-variable-in-tsvb-bucket-script/294960)
**Author:** [@Andrew22](https://discuss.elastic.co/u/Andrew22)\ **Replies:** 1\ **Last updated:** [January 20, 2022, 4:57pm UTC](https://discuss.elastic.co/t/setting-a-custom-variable-in-tsvb-bucket-script/294960 "2022-01-20T16:57:25Z")
Hello, Is it possible to set a variable inside a bucket script in tsvb? i would like to compare two values and set the new variable to be the value that exists. right now I have: my code if (params.inmin != null)… --- ## [Directories of indices in Backup Storage](https://discuss.elastic.co/t/directories-of-indices-in-backup-storage/294958)
**Author:** [@ttttien](https://discuss.elastic.co/u/ttttien)\ **Replies:** 1\ **Last updated:** [January 20, 2022, 4:48pm UTC](https://discuss.elastic.co/t/directories-of-indices-in-backup-storage/294958 "2022-01-20T16:48:59Z")
Hello everyone, I would like to know that if there are a method to verify what folder in the Backup Storage that correspondent with each index in Elasticsearch: For example: consider 3 index "audit\_trail", "index\_log"… --- ## [Use Logstash for execute enrich policy with HTTP output](https://discuss.elastic.co/t/use-logstash-for-execute-enrich-policy-with-http-output/294975)
**Author:** [@GinkoLucas](https://discuss.elastic.co/u/GinkoLucas)\ **Replies:** 0\ **Last updated:** [January 20, 2022, 4:34pm UTC](https://discuss.elastic.co/t/use-logstash-for-execute-enrich-policy-with-http-output/294975 "2022-01-20T16:34:28Z")
Hello, I need to schedule the execution of an enrich policy. I think i can use Logstash for that, with an HTTP output. Actualy, i have a Logstash who send data to Elasticsearch from Mysql Database. These data are going… --- ## [Unable to do \`filebeat setup ...\` for custom \`filebeat\` index name](https://discuss.elastic.co/t/unable-to-do-filebeat-setup-for-custom-filebeat-index-name/294968)
**Author:** [@DougR](https://discuss.elastic.co/u/DougR)\ **Replies:** 1\ **Last updated:** [January 20, 2022, 4:07pm UTC](https://discuss.elastic.co/t/unable-to-do-filebeat-setup-for-custom-filebeat-index-name/294968 "2022-01-20T16:07:32Z")
I'm attempting to do a filebeat setup ... with Filebeat 7.16.0/Elasticsearch 7.16.2 for a custom index (foo-filebeat-7.16.0-\*). However, it always loads the template, etc. for filebeat-7.16.0-\*. I'm pretty sure this is a… --- ## [Error while doing suggest query for java-client](https://discuss.elastic.co/t/error-while-doing-suggest-query-for-java-client/294828)
**Author:** [@2393747135](https://discuss.elastic.co/u/2393747135)\ **Replies:** 3\ **Last updated:** [January 20, 2022, 4:07pm UTC](https://discuss.elastic.co/t/error-while-doing-suggest-query-for-java-client/294828 "2022-01-20T16:07:03Z")
Regarding the java-client of suguest, the prompts need to be as follows when using: Missing required property 'TermSuggestOption.score Below is my code SearchResponse\ se… --- ## [Elastic users api: beginner questions](https://discuss.elastic.co/t/elastic-users-api-beginner-questions/294901)
**Author:** [@Emile\_Plas](https://discuss.elastic.co/u/Emile_Plas)\ **Replies:** 0\ **Last updated:** [January 20, 2022, 7:24am UTC](https://discuss.elastic.co/t/elastic-users-api-beginner-questions/294901 "2022-01-20T07:24:38Z")
Hey everyone! I am quite new to Elasticsearch and I have some beginners questions, please forgive me. I hope you can shortly take the time to validate my questions regarding the elastic users API. I am currently buildi… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1084) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1086)