# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1087 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1088 --- ## [Irrelevant field search results](https://discuss.elastic.co/t/irrelevant-field-search-results/293188)
**Author:** [@ethical20](https://discuss.elastic.co/u/ethical20)\ **Replies:** 10\ **Last updated:** [January 20, 2022, 9:12am UTC](https://discuss.elastic.co/t/irrelevant-field-search-results/293188 "2022-01-20T09:12:58Z")
Hi, I've made this Lucene query in Kibana to search if Nginx access logs contain a URL with the word "malware": source.as.organization.name: (/.\*\[Mm\]\[Aa\]\[Ll\]\[Ww\]\[Aa\]\[Rr\]\[Ee\].\*/) But in Kibana I'm getting the results … --- ## [No cipher suites in common for tcp input](https://discuss.elastic.co/t/no-cipher-suites-in-common-for-tcp-input/52764)
**Author:** [@Jason\_Woodrich](https://discuss.elastic.co/u/Jason_Woodrich)\ **Replies:** 1\ **Last updated:** [January 20, 2022, 9:12am UTC](https://discuss.elastic.co/t/no-cipher-suites-in-common-for-tcp-input/52764 "2022-01-20T09:12:17Z")
I'm trying to configure a tcp syslog input with SSL support and running into some problems. I've installed logstash 2.3.2 using the RPM from the Elastic site. Below is my configuration: input { tcp { port =\> 54… --- ## [ES 7.16.0 and 7.16.1 Upgrade single node health yellow](https://discuss.elastic.co/t/es-7-16-0-and-7-16-1-upgrade-single-node-health-yellow/291875)
**Author:** [@VamPikmin](https://discuss.elastic.co/u/VamPikmin)\ **Replies:** 1\ **Last updated:** [January 20, 2022, 8:26am UTC](https://discuss.elastic.co/t/es-7-16-0-and-7-16-1-upgrade-single-node-health-yellow/291875 "2022-01-20T08:26:01Z")
Hello boys and girls I have a single ES node which has one index turn yellow curl -XGET localhost:9200/\_cat/health 1639519203 22:00:03 ndelastic yellow 1 1 317 317 0 0 1 0 - 99.7% curl -XGET localhost:9200/\_cluster/a… --- ## [McAfee Enterprise Enterprise Security triggers on Auditbeat in /etc/passwd.xx](https://discuss.elastic.co/t/mcafee-enterprise-enterprise-security-triggers-on-auditbeat-in-etc-passwd-xx/294846)
**Author:** [@odehen](https://discuss.elastic.co/u/odehen)\ **Replies:** 2\ **Last updated:** [January 20, 2022, 7:46am UTC](https://discuss.elastic.co/t/mcafee-enterprise-enterprise-security-triggers-on-auditbeat-in-etc-passwd-xx/294846 "2022-01-20T07:46:54Z")
We are using Elasticsearch 7.16.2 on RHEL with McAfee Enterprise. Apparently an alarm has gone off, namely the PREVENT\_MODIFICATION\_PASSWORDFILES\_LINUX rule because of Auditbeat supposedly attempting to modify /etc/passw… --- ## [Elasticsearch CCR synchronization](https://discuss.elastic.co/t/elasticsearch-ccr-synchronization/294902)
**Author:** [@fabry](https://discuss.elastic.co/u/fabry)\ **Replies:** 0\ **Last updated:** [January 20, 2022, 7:43am UTC](https://discuss.elastic.co/t/elasticsearch-ccr-synchronization/294902 "2022-01-20T07:43:49Z")
I have a couple of questions about how the CCR works. Does it uses a polling strategy? or whenever there is a new log it will be pushed to the remote cluster? In case is a polling strategy how can reduce the polling de… --- ## [Installable plugin checkbox disabled in Elastic Cloud due to subscription level](https://discuss.elastic.co/t/installable-plugin-checkbox-disabled-in-elastic-cloud-due-to-subscription-level/294899)
**Author:** [@likejazz](https://discuss.elastic.co/u/likejazz)\ **Replies:** 1\ **Last updated:** [January 20, 2022, 7:36am UTC](https://discuss.elastic.co/t/installable-plugin-checkbox-disabled-in-elastic-cloud-due-to-subscription-level/294899 "2022-01-20T07:36:02Z")
Same question here: I have ENTERPRISE subscription level in Elastic Cloud and cannot install custom plugin due to disabled option as shown above. https://cloud.elastic.co/deployment-features/extensions/create The m… --- ## [Upgrade of elastic, name of indices and data streams](https://discuss.elastic.co/t/upgrade-of-elastic-name-of-indices-and-data-streams/294850)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 6\ **Last updated:** [January 20, 2022, 7:27am UTC](https://discuss.elastic.co/t/upgrade-of-elastic-name-of-indices-and-data-streams/294850 "2022-01-20T07:27:05Z")
Hi, we have installed version 7.5 of the stack and we want to upgrade to the latest version, but our custom indexes are already called: metrics-\ example : metrics-interfaces . what problems could ari… --- ## [Metricbeat for ActiveMQ](https://discuss.elastic.co/t/metricbeat-for-activemq/294359)
**Author:** [@rodentskie](https://discuss.elastic.co/u/rodentskie)\ **Replies:** 10\ **Last updated:** [January 20, 2022, 7:18am UTC](https://discuss.elastic.co/t/metricbeat-for-activemq/294359 "2022-01-20T07:18:45Z")
Hi, I'm currently working on getting metrics from AWS activemq, but I can't get it on how to install jolokia module. Any idea? We are using a cloud Elasticsearch instance, and we apply our metricbeat using kubernetes ya… --- ## [How to get meassages and send them by email](https://discuss.elastic.co/t/how-to-get-meassages-and-send-them-by-email/294893)
**Author:** [@rrrr](https://discuss.elastic.co/u/rrrr)\ **Replies:** 3\ **Last updated:** [January 20, 2022, 7:09am UTC](https://discuss.elastic.co/t/how-to-get-meassages-and-send-them-by-email/294893 "2022-01-20T07:09:49Z")
In the watcher, how to get all messages and send them by email --- ## [Watcher index filed Type conversion](https://discuss.elastic.co/t/watcher-index-filed-type-conversion/294676)
**Author:** [@rrrr](https://discuss.elastic.co/u/rrrr)\ **Replies:** 2\ **Last updated:** [January 20, 2022, 6:11am UTC](https://discuss.elastic.co/t/watcher-index-filed-type-conversion/294676 "2022-01-20T06:11:31Z")
How to convert the type of a field to another type in the watcher? For example, if the type of age is text, you want to convert it to int --- ## [Max between two fields in last X days Kibana(lens)](https://discuss.elastic.co/t/max-between-two-fields-in-last-x-days-kibana-lens/294765)
**Author:** [@dash5000](https://discuss.elastic.co/u/dash5000)\ **Replies:** 16\ **Last updated:** [January 20, 2022, 4:05am UTC](https://discuss.elastic.co/t/max-between-two-fields-in-last-x-days-kibana-lens/294765 "2022-01-20T04:05:03Z")
Hello, I am stuck at a problem, where i have to get the maximum between two fields in a document in last X days. I am using the table format with lens. For example document has: name=test description=test description … --- ## [Execute yarn kbn bootstrap error](https://discuss.elastic.co/t/execute-yarn-kbn-bootstrap-error/294537)
**Author:** [@qixian](https://discuss.elastic.co/u/qixian)\ **Replies:** 2\ **Last updated:** [January 20, 2022, 1:44am UTC](https://discuss.elastic.co/t/execute-yarn-kbn-bootstrap-error/294537 "2022-01-20T01:44:40Z")
when i execut the command error,and I have configured the npm $PATH globally,who can ihelp me. --- ## [Need help to understand how standard tokenizer works](https://discuss.elastic.co/t/need-help-to-understand-how-standard-tokenizer-works/294860)
**Author:** [@jsjs2](https://discuss.elastic.co/u/jsjs2)\ **Replies:** 1\ **Last updated:** [January 20, 2022, 1:12am UTC](https://discuss.elastic.co/t/need-help-to-understand-how-standard-tokenizer-works/294860 "2022-01-20T01:12:42Z")
In the following two examples, I had hard time to understand why the outputs are different: POST \_analyze { "tokenizer": "standard", "text": "mark.cuban" } terms produced: \["mark.cuban"\] POST \_analyze { "tokeniz… --- ## [GROK | Problem ingest Pipeline | replace](https://discuss.elastic.co/t/grok-problem-ingest-pipeline-replace/294881)
**Author:** [@Walli](https://discuss.elastic.co/u/Walli)\ **Replies:** 1\ **Last updated:** [January 20, 2022, 12:59am UTC](https://discuss.elastic.co/t/grok-problem-ingest-pipeline-replace/294881 "2022-01-20T00:59:19Z")
Hello, I am new in the Commutiy and new in the topic GROK. I have a message where I want to replace a certain string. The problem the string contains the GROK meta character ^. The whole thing is supposed to happen in… --- ## [QueryCacheMemorySize increased to 9.2EB then dropped to 0. How to debug QueryCache issues?](https://discuss.elastic.co/t/querycachememorysize-increased-to-9-2eb-then-dropped-to-0-how-to-debug-querycache-issues/294885)
**Author:** [@ztesky](https://discuss.elastic.co/u/ztesky)\ **Replies:** 0\ **Last updated:** [January 19, 2022, 11:41pm UTC](https://discuss.elastic.co/t/querycachememorysize-increased-to-9-2eb-then-dropped-to-0-how-to-debug-querycache-issues/294885 "2022-01-19T23:41:57Z")
I'm using Elasticsearch version 6.3 in production. We have a shard with size \> 200GB in a data node. Recently, we did a "cluster reroute" wherein we moved this shard from node A (which had QueryCacheMemorySize = 3GB) to … --- ## [Configuring SSL over http](https://discuss.elastic.co/t/configuring-ssl-over-http/294883)
**Author:** [@jayjayp2](https://discuss.elastic.co/u/jayjayp2)\ **Replies:** 0\ **Last updated:** [January 19, 2022, 11:09pm UTC](https://discuss.elastic.co/t/configuring-ssl-over-http/294883 "2022-01-19T23:09:50Z")
Hi, I'm new to Elasticsearch. I couldn't find an existing post. I'm trying to setup ssl over http. I have a .p12 file that is trusted over our network. I set: xpack.security.http.ssl.enabled: true xpack.security.http.s… --- ## [Heartbeat (7.16.3) - missing required field accessing 'schedule'](https://discuss.elastic.co/t/heartbeat-7-16-3-missing-required-field-accessing-schedule/294782)
**Author:** [@jurgenhaas](https://discuss.elastic.co/u/jurgenhaas)\ **Replies:** 9\ **Last updated:** [January 19, 2022, 10:33pm UTC](https://discuss.elastic.co/t/heartbeat-7-16-3-missing-required-field-accessing-schedule/294782 "2022-01-19T22:33:27Z")
My heartbeat monitoring is working just fine, but syslog is flooded with error messages like this: Jan 19 08:51:38 bslog1 heartbeat\[32480\]: 2022-01-19T08:51:38.532+0100 ERROR \[reload\] cfgfile/list.go:99 Error creating r… --- ## [KQL from @timestamp until 7days offset](https://discuss.elastic.co/t/kql-from-timestamp-until-7days-offset/294819)
**Author:** [@Juliana\_Sabino](https://discuss.elastic.co/u/Juliana_Sabino)\ **Replies:** 4\ **Last updated:** [January 19, 2022, 9:55pm UTC](https://discuss.elastic.co/t/kql-from-timestamp-until-7days-offset/294819 "2022-01-19T21:55:35Z")
Hi team, I need a query that takes the @timestamp from the timepicker and then add an offset of 7 days. I don't know how to do it. I tried: (@timestamp \<= "now-1d/d+7d") but it's not working as I wanted. Could someone … --- ## [Control Visualization, metricbeat field , values not showing. v7.13](https://discuss.elastic.co/t/control-visualization-metricbeat-field-values-not-showing-v7-13/294876)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 0\ **Last updated:** [January 19, 2022, 9:53pm UTC](https://discuss.elastic.co/t/control-visualization-metricbeat-field-values-not-showing-v7-13/294876 "2022-01-19T21:53:57Z")
Hi, Im having problems to display values in the control visualization, the field that I need to use is created by metricbeat. in discovery I can see the values, and the field exist In index patterns there is a field… --- ## [Backend programming for kibana plugin development](https://discuss.elastic.co/t/backend-programming-for-kibana-plugin-development/294745)
**Author:** [@Ernesto\_Rodolfo\_Cast](https://discuss.elastic.co/u/Ernesto_Rodolfo_Cast)\ **Replies:** 2\ **Last updated:** [January 19, 2022, 9:49pm UTC](https://discuss.elastic.co/t/backend-programming-for-kibana-plugin-development/294745 "2022-01-19T21:49:57Z")
hello, is it possible to develop a plugin for kibana from the backend, how would this process work, what programming language can I use? --- ## [Match data from two arrays](https://discuss.elastic.co/t/match-data-from-two-arrays/294488)
**Author:** [@INS](https://discuss.elastic.co/u/INS)\ **Replies:** 11\ **Last updated:** [January 19, 2022, 9:33pm UTC](https://discuss.elastic.co/t/match-data-from-two-arrays/294488 "2022-01-19T21:33:45Z")
Hi Can You help me for make a method for merge data between two arrays and match this into one document. pattern- \> name of fields \[a-b-c-d-e\] //we have a 3 events separated by the | value\_field = 5-7-10-12-9|5-7-9… --- ## [Mget too slow for large amount of documents](https://discuss.elastic.co/t/mget-too-slow-for-large-amount-of-documents/294586)
**Author:** [@Benjamin\_Elkrieff](https://discuss.elastic.co/u/Benjamin_Elkrieff)\ **Replies:** 8\ **Last updated:** [January 19, 2022, 9:26pm UTC](https://discuss.elastic.co/t/mget-too-slow-for-large-amount-of-documents/294586 "2022-01-19T21:26:16Z")
Hello There. I use opensearch on AWS to store embeddings generated by a ML model. We need to use it for similarity search. I use 5 nodes of 4 CPU, 8 GB Ram, 1 shard per index, 5 replicas. The data we currently have in … --- ## [Move elasticsearch data from frozen tier back to cold or warm tier](https://discuss.elastic.co/t/move-elasticsearch-data-from-frozen-tier-back-to-cold-or-warm-tier/294874)
**Author:** [@dimitris\_sb](https://discuss.elastic.co/u/dimitris_sb)\ **Replies:** 0\ **Last updated:** [January 19, 2022, 8:38pm UTC](https://discuss.elastic.co/t/move-elasticsearch-data-from-frozen-tier-back-to-cold-or-warm-tier/294874 "2022-01-19T20:38:06Z")
Hi All, How do you handle cases that you have already applied ILM policy to a set of indices (by its legacy index template) and you revise your strategy and you want to move data which are in the frozen tier back to co… --- ## [Kibana dashboard Visualisation into Angular 10 Webapp](https://discuss.elastic.co/t/kibana-dashboard-visualisation-into-angular-10-webapp/294784)
**Author:** [@Abhishek\_Gautam](https://discuss.elastic.co/u/Abhishek_Gautam)\ **Replies:** 1\ **Last updated:** [January 19, 2022, 8:13pm UTC](https://discuss.elastic.co/t/kibana-dashboard-visualisation-into-angular-10-webapp/294784 "2022-01-19T20:13:39Z")
Hi Team, Can someone suggest any way to embed kibana dashboard visulizations with our Angular 10 web App, so that from the application itself he can change the type of graph he wishes to have. --- ## [Error index management Filebeat to Logstash](https://discuss.elastic.co/t/error-index-management-filebeat-to-logstash/294872)
**Author:** [@Adrpan83](https://discuss.elastic.co/u/Adrpan83)\ **Replies:** 0\ **Last updated:** [January 19, 2022, 7:32pm UTC](https://discuss.elastic.co/t/error-index-management-filebeat-to-logstash/294872 "2022-01-19T19:32:16Z")
Hi, I have the following configuration: Filebeat 7.10.1 and Logstash 7.10.1. ERROR instance/beat.go:956 Exiting: Index management requested but the Elasticsearch output is not configured/enabled Exiting: Index man… --- ## [Obtain Jenkins pipelines and parameters from Kibana](https://discuss.elastic.co/t/obtain-jenkins-pipelines-and-parameters-from-kibana/294871)
**Author:** [@Brian\_Fernandez](https://discuss.elastic.co/u/Brian_Fernandez)\ **Replies:** 0\ **Last updated:** [January 19, 2022, 7:20pm UTC](https://discuss.elastic.co/t/obtain-jenkins-pipelines-and-parameters-from-kibana/294871 "2022-01-19T19:20:40Z")
Good afternoon. How can I show in Kibana, the total list of Jenkins pipelines and the parameters that each one has configured? Thanks! --- ## [Make the Time Range on a map dynamic](https://discuss.elastic.co/t/make-the-time-range-on-a-map-dynamic/294810)
**Author:** [@Angad\_Panesar1](https://discuss.elastic.co/u/Angad_Panesar1)\ **Replies:** 1\ **Last updated:** [January 19, 2022, 6:43pm UTC](https://discuss.elastic.co/t/make-the-time-range-on-a-map-dynamic/294810 "2022-01-19T18:43:13Z")
Hi, How would you make a time range dynamic on a map in a canvas? (i.e. it automatically changes over time like 11:59am today to 12:15pm). --- ## [Getting timestamp field from XML attribute](https://discuss.elastic.co/t/getting-timestamp-field-from-xml-attribute/294625)
**Author:** [@Tim\_Mobley](https://discuss.elastic.co/u/Tim_Mobley)\ **Replies:** 10\ **Last updated:** [January 19, 2022, 6:41pm UTC](https://discuss.elastic.co/t/getting-timestamp-field-from-xml-attribute/294625 "2022-01-19T18:41:09Z")
I'm using the xml filter plugin in Logstash to parse a XML document, and am having success with the exception of the @timestamp value, which is found as an attribute value. Here is a snippet of the XML file: \ **Author:** [@dmarshall](https://discuss.elastic.co/u/dmarshall)\ **Replies:** 2\ **Last updated:** [January 19, 2022, 6:28pm UTC](https://discuss.elastic.co/t/using-logstash-to-denomalize-data/294858 "2022-01-19T18:28:43Z") I have data coming in with field names like this: "field\_1" =\> "10" "field\_2" =\> "20" and I'm trying to figure out how to convert it to something more like this: "field" =\> \[ {"num" =\> "1", "val" =\> "10"}, {"num" =\> … --- ## [Dashboard POST URL too long unless re-saving](https://discuss.elastic.co/t/dashboard-post-url-too-long-unless-re-saving/294859)
**Author:** [@bm11100](https://discuss.elastic.co/u/bm11100)\ **Replies:** 0\ **Last updated:** [January 19, 2022, 6:02pm UTC](https://discuss.elastic.co/t/dashboard-post-url-too-long-unless-re-saving/294859 "2022-01-19T18:02:46Z")
7.16.2 stack I'm running into an issue where it's saying my Dashboard POST URL is too long The odd thing is, if I edit the dashboard and re-save it, the POST URL is fine. I'm stuck on what is causing the dashboard… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1086) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1088)