# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1125 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1126 --- ## [Mutate rename using field value](https://discuss.elastic.co/t/mutate-rename-using-field-value/292014)
**Author:** [@sirReeall](https://discuss.elastic.co/u/sirReeall)\ **Replies:** 2\ **Last updated:** [December 15, 2021, 6:27pm UTC](https://discuss.elastic.co/t/mutate-rename-using-field-value/292014 "2021-12-15T18:27:13Z")
Hello, I'm trying to rename a field using the value of another metadata field, here is what I have tried: filter { grok { match =\> { "path" =\> "%{GREEDYDATA}/%{GREEDYDATA:\[@metadata\]\[metric\_name\]}\\.csv" … --- ## [7.16.1 - All beats docs in Discover had unknown field and value as json](https://discuss.elastic.co/t/7-16-1-all-beats-docs-in-discover-had-unknown-field-and-value-as-json/292017)
**Author:** [@Zabulon](https://discuss.elastic.co/u/Zabulon)\ **Replies:** 6\ **Last updated:** [December 15, 2021, 6:26pm UTC](https://discuss.elastic.co/t/7-16-1-all-beats-docs-in-discover-had-unknown-field-and-value-as-json/292017 "2021-12-15T18:26:46Z")
Hi, Yeserday, I upgraded one of our cluster from 7.13.4 to 7.16.1. When I'm going to discover pane and choose a beat index, almost all field show as 'unknown field' and the values are showing as JSON. The other clus… --- ## [Auditbeat, filebeat and journalbeat in kubernetes](https://discuss.elastic.co/t/auditbeat-filebeat-and-journalbeat-in-kubernetes/291805)
**Author:** [@Dmitriy\_Esin](https://discuss.elastic.co/u/Dmitriy_Esin)\ **Replies:** 1\ **Last updated:** [December 15, 2021, 6:24pm UTC](https://discuss.elastic.co/t/auditbeat-filebeat-and-journalbeat-in-kubernetes/291805 "2021-12-15T18:24:51Z")
Hi all! I want to get an assistant with filebeat and auditbeat deployed in the k8s cluster. Here are my yamls: Auditbeat: Filebeat: It runs successfully and has logs: Auditbeat: Fiebeat: But I can't see any d… --- ## [Elasticsearch js client version update when upgrading 6.x to 7.x for ES](https://discuss.elastic.co/t/elasticsearch-js-client-version-update-when-upgrading-6-x-to-7-x-for-es/292032)
**Author:** [@northwest](https://discuss.elastic.co/u/northwest)\ **Replies:** 0\ **Last updated:** [December 15, 2021, 6:06pm UTC](https://discuss.elastic.co/t/elasticsearch-js-client-version-update-when-upgrading-6-x-to-7-x-for-es/292032 "2021-12-15T18:06:31Z")
Planning on upgrading our ES cluster from 6.x to 7.x. With rolling update the cluster has 0 down time but I am wondering how to coordinate the js client version update since we have to use the same major version between … --- ## [Is Elasticsearch affected by CVE-2021-45046 - a second vulnerability in log4j?](https://discuss.elastic.co/t/is-elasticsearch-affected-by-cve-2021-45046-a-second-vulnerability-in-log4j/291885)
**Author:** [@smlx](https://discuss.elastic.co/u/smlx)\ **Replies:** 1\ **Last updated:** [December 15, 2021, 4:56pm UTC](https://discuss.elastic.co/t/is-elasticsearch-affected-by-cve-2021-45046-a-second-vulnerability-in-log4j/291885 "2021-12-15T16:56:32Z")
As per the title there is a newer vulnerability in log4j: CVE-2021-45046 https://logging.apache.org/log4j/2.x/security.html As the current log4j announcement doesn't specifically mention this CVE except in the context … --- ## [Multiline.pattern for my log](https://discuss.elastic.co/t/multiline-pattern-for-my-log/291973)
**Author:** [@bourak\_justbourak](https://discuss.elastic.co/u/bourak_justbourak)\ **Replies:** 0\ **Last updated:** [December 15, 2021, 12:53pm UTC](https://discuss.elastic.co/t/multiline-pattern-for-my-log/291973 "2021-12-15T12:53:45Z")
Hi please help me what multiline.pattern is good for my log? My log contains blank line in the middle. Thanks a lot. 2021-12-08 01:00:00.020 DEBUG --- \[TaskScheduler-1\] \[c.i.f.g.c.s.d.InputService :\] : … --- ## [How to filter log in kibana](https://discuss.elastic.co/t/how-to-filter-log-in-kibana/291981)
**Author:** [@Roccof97](https://discuss.elastic.co/u/Roccof97)\ **Replies:** 1\ **Last updated:** [December 15, 2021, 4:21pm UTC](https://discuss.elastic.co/t/how-to-filter-log-in-kibana/291981 "2021-12-15T16:21:32Z")
Hi everyone, my goal is to filter this string "sudo egrep -i -r '${jndi:(ldap\[s\]?|rmi|dns):/\[^\\n\]+' /var/log" in the message of my logs This is related to the log4j issue. Thanks in advance to those who help me. --- ## [Date math index name throwing error in Watcher input](https://discuss.elastic.co/t/date-math-index-name-throwing-error-in-watcher-input/290638)
**Author:** [@Munavir\_Chavody](https://discuss.elastic.co/u/Munavir_Chavody)\ **Replies:** 1\ **Last updated:** [December 15, 2021, 4:05pm UTC](https://discuss.elastic.co/t/date-math-index-name-throwing-error-in-watcher-input/290638 "2021-12-15T16:05:41Z")
I've the date math name in one of the watcher search input as below. "indices": \["\<.watcher-history-13-{now/d}\>"\] But the execution fails with below error. "result": { "execution\_time": "2021-12-01T07:57:46.049Z",… --- ## [Watcher, multiple web posts](https://discuss.elastic.co/t/watcher-multiple-web-posts/290643)
**Author:** [@runtman](https://discuss.elastic.co/u/runtman)\ **Replies:** 3\ **Last updated:** [December 15, 2021, 4:03pm UTC](https://discuss.elastic.co/t/watcher-multiple-web-posts/290643 "2021-12-15T16:03:49Z")
I've looked through the docs and can't really find an answer if this is possible. I want a watcher job to fire every 5 minutes to hit an API. First of all it must hit the API to gain an authorization token, then once i… --- ## [WebHook works with Alerting but doesnt with watcher](https://discuss.elastic.co/t/webhook-works-with-alerting-but-doesnt-with-watcher/291335)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 2\ **Last updated:** [December 15, 2021, 4:01pm UTC](https://discuss.elastic.co/t/webhook-works-with-alerting-but-doesnt-with-watcher/291335 "2021-12-15T16:01:27Z")
Hi, Im trying to send webhooks to logstash with watcher, and Im getting this error "type" : "client\_protocol\_exception", "reason" : null, "caused\_by" : { "type" : "proto… --- ## [Python Elasticsearch aggregated query](https://discuss.elastic.co/t/python-elasticsearch-aggregated-query/291998)
**Author:** [@Sederfo](https://discuss.elastic.co/u/Sederfo)\ **Replies:** 5\ **Last updated:** [December 15, 2021, 3:59pm UTC](https://discuss.elastic.co/t/python-elasticsearch-aggregated-query/291998 "2021-12-15T15:59:16Z")
I am struggling to get an aggregated response based on a query... for example, in Kibana visualization, after creating a table with the aggregations and query I need, I can view the request by going inside the visualizat… --- ## [Create new records from old one](https://discuss.elastic.co/t/create-new-records-from-old-one/291989)
**Author:** [@ddoroshenko](https://discuss.elastic.co/u/ddoroshenko)\ **Replies:** 7\ **Last updated:** [December 15, 2021, 3:42pm UTC](https://discuss.elastic.co/t/create-new-records-from-old-one/291989 "2021-12-15T15:42:25Z")
Hello! I have JSON at input { "data:{ "id":"123" }, "message":\[ "event1", "event2", "event3" \], "source":"abc" } Is it possible to make three different events based on "event1", "event2" and "… --- ## [Metricbeat, http: server gave HTTP response to HTTPS client](https://discuss.elastic.co/t/metricbeat-http-server-gave-http-response-to-https-client/291835)
**Author:** [@sahere37](https://discuss.elastic.co/u/sahere37)\ **Replies:** 2\ **Last updated:** [December 15, 2021, 3:33pm UTC](https://discuss.elastic.co/t/metricbeat-http-server-gave-http-response-to-https-client/291835 "2021-12-15T15:33:25Z")
Hi all, I am trying to activate basic security http in my ELK stack. My Elasticsearch version is 7.16.1. I create Elasticsearch-ssl-http.zip and add related files to config folder of Elasticsearch and kibana. Also I add… --- ## [Parse XML nessus config to logstash](https://discuss.elastic.co/t/parse-xml-nessus-config-to-logstash/290887)
**Author:** [@k1mson13](https://discuss.elastic.co/u/k1mson13)\ **Replies:** 12\ **Last updated:** [December 15, 2021, 3:21pm UTC](https://discuss.elastic.co/t/parse-xml-nessus-config-to-logstash/290887 "2021-12-15T15:21:20Z")
I have a nessus file that looks like this : \\ \192.168.2.65\ \Wed Nov 10 12:48:53 2021\ \ **Author:** [@sahere37](https://discuss.elastic.co/u/sahere37)\ **Replies:** 0\ **Last updated:** [December 15, 2021, 3:18pm UTC](https://discuss.elastic.co/t/filebeat-failed-to-publish-events/292001 "2021-12-15T15:18:14Z") Hi all, I am using ELK version 7.12.1 to harvest data using filebeat and then send them logstash. I have two nodes of logstash (10.0.0.1:5044 and 10.0.0.2:5044) My filebeat output config is as following: output.logst… --- ## [Kibana issue with relative and absolute range combination](https://discuss.elastic.co/t/kibana-issue-with-relative-and-absolute-range-combination/291972)
**Author:** [@Angelos](https://discuss.elastic.co/u/Angelos)\ **Replies:** 3\ **Last updated:** [December 15, 2021, 3:14pm UTC](https://discuss.elastic.co/t/kibana-issue-with-relative-and-absolute-range-combination/291972 "2021-12-15T15:14:12Z")
Elasticsearch Platinum: 7.16.1 Hi! We recently found out that when we use relative as start date and absolute as end date it doesn't work as intended. For example when I select relative start date "14 days ago" and ab… --- ## [Create Index Lifecycle Policies to existing index](https://discuss.elastic.co/t/create-index-lifecycle-policies-to-existing-index/290983)
**Author:** [@Aviel\_Bashari](https://discuss.elastic.co/u/Aviel_Bashari)\ **Replies:** 17\ **Last updated:** [December 15, 2021, 3:08pm UTC](https://discuss.elastic.co/t/create-index-lifecycle-policies-to-existing-index/290983 "2021-12-15T15:08:17Z")
Hi, im trying to add 'Index Lifecycle Policies' to my existing index. my steps: Index management --\> choose my index --\> add lifecycle policy --\> slect logs but i got 'Policy logs is configured for rollover, but ind… --- ## [Change navLinks with kibana 7.14](https://discuss.elastic.co/t/change-navlinks-with-kibana-7-14/291951)
**Author:** [@Osysh](https://discuss.elastic.co/u/Osysh)\ **Replies:** 3\ **Last updated:** [December 15, 2021, 2:40pm UTC](https://discuss.elastic.co/t/change-navlinks-with-kibana-7-14/291951 "2021-12-15T14:40:37Z")
Hi ! Is it possible to change the home navLink througth a custom plugin in Kibana 7.14 ? The final aim is to replace it with a plugin url. It seems that the chrome.navLinks.update() method is not available for this vers… --- ## [Drop some field when we restore](https://discuss.elastic.co/t/drop-some-field-when-we-restore/291915)
**Author:** [@kannan\_raj](https://discuss.elastic.co/u/kannan_raj)\ **Replies:** 1\ **Last updated:** [December 15, 2021, 2:37pm UTC](https://discuss.elastic.co/t/drop-some-field-when-we-restore/291915 "2021-12-15T14:37:38Z")
Hi Team, Is it possible to remove some fields while restoring indices from snapshots? Ex: let's assume the doc in the index and take the snapshot { "foo": "bar", "bar": "foo" } Here would like to remove the f… --- ## [Beats are not vulnerable to Log4j2 RCE](https://discuss.elastic.co/t/beats-are-not-vulnerable-to-log4j2-rce/291992)
**Author:** [@dave101](https://discuss.elastic.co/u/dave101)\ **Replies:** 2\ **Last updated:** [December 15, 2021, 2:27pm UTC](https://discuss.elastic.co/t/beats-are-not-vulnerable-to-log4j2-rce/291992 "2021-12-15T14:27:46Z")
Hi there, maybe some can confirm the follow for us. A few days ago we read this article concerning the log4j vulnerability. Apache Log4j2 Remote Code Execution (RCE) Vulnerability - CVE-2021-44228 - ESA-2021-31 Here it … --- ## [Elastic Machine Learning NLP (Elastic 8.0)](https://discuss.elastic.co/t/elastic-machine-learning-nlp-elastic-8-0/291993)
**Author:** [@zangero98](https://discuss.elastic.co/u/zangero98)\ **Replies:** 0\ **Last updated:** [December 15, 2021, 2:23pm UTC](https://discuss.elastic.co/t/elastic-machine-learning-nlp-elastic-8-0/291993 "2021-12-15T14:23:00Z")
Hello, im currently writing a thesis about elastic machine learning. I would like to specify the NLP topic with use cases that can be realized with elastic NLP. Until now i only analyzed the prebuild languageid model a… --- ## [ElasticSearch 7.9.2 getting issue with Query latency and Flush latency](https://discuss.elastic.co/t/elasticsearch-7-9-2-getting-issue-with-query-latency-and-flush-latency/291245)
**Author:** [@balac](https://discuss.elastic.co/u/balac)\ **Replies:** 2\ **Last updated:** [December 15, 2021, 1:55pm UTC](https://discuss.elastic.co/t/elasticsearch-7-9-2-getting-issue-with-query-latency-and-flush-latency/291245 "2021-12-15T13:55:32Z")
Hi , In Elasticsearch:7.9.2 we are getting Query latency and Flush Latency alert. We setup this new cluster and moved it from standalone ES cluster to 3 node cluster in kubernetes. We are monitoring ES cluster with Zabb… --- ## [Mongodb jdbc using in logstash](https://discuss.elastic.co/t/mongodb-jdbc-using-in-logstash/291311)
**Author:** [@peledev](https://discuss.elastic.co/u/peledev)\ **Replies:** 4\ **Last updated:** [December 15, 2021, 8:03am UTC](https://discuss.elastic.co/t/mongodb-jdbc-using-in-logstash/291311 "2021-12-15T08:03:58Z")
trying to write log from mongodb using jdbc see configuration file: input { jdbc { jdbc\_driver\_library =\> "/usr/share/logstash/logstash-core/lib/jars/mongodb-driver-core-3.4.2.jar" jdbc\_driver\_class =\>… --- ## [Kibana is not getting connected to elastic search](https://discuss.elastic.co/t/kibana-is-not-getting-connected-to-elastic-search/291630)
**Author:** [@aravi](https://discuss.elastic.co/u/aravi)\ **Replies:** 1\ **Last updated:** [December 15, 2021, 1:16pm UTC](https://discuss.elastic.co/t/kibana-is-not-getting-connected-to-elastic-search/291630 "2021-12-15T13:16:08Z")
We are not bale to open up the kibana portal due to the probable socket timed out error while reaching the Elasticsearch. Recently we have made a change to disable the xpack-security in the Elasticsearch. Please be infor… --- ## [Monitor Fstab entry using metricbeat](https://discuss.elastic.co/t/monitor-fstab-entry-using-metricbeat/291980)
**Author:** [@abhi.logs](https://discuss.elastic.co/u/abhi.logs)\ **Replies:** 0\ **Last updated:** [December 15, 2021, 1:15pm UTC](https://discuss.elastic.co/t/monitor-fstab-entry-using-metricbeat/291980 "2021-12-15T13:15:16Z")
Hello, Can we monitor Fstab entry in metricbeat? --- ## [Could not index event to Elasticsearch](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch/291777)
**Author:** [@yuswanul](https://discuss.elastic.co/u/yuswanul)\ **Replies:** 4\ **Last updated:** [December 15, 2021, 12:59pm UTC](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch/291777 "2021-12-15T12:59:54Z")
Hello everyone. i have a trouble with elastic. the logs stop come in since 16:40 and here is the log of logstash \` \> \[2021-12-14T16:57:20,948\]\[WARN \]\[logstash.outputs.elasticsearch\]\[pipeline\_ocp4\] Could not index event… --- ## [Unable to initialize Fleet as i get internal server error in kibana logs and on GUI "Default policy could not be added. system is not installed, add system to \`xpack.fleet.packages\` or remove it from system-1" i'm using 3 nodes cluster for elasticsearch](https://discuss.elastic.co/t/unable-to-initialize-fleet-as-i-get-internal-server-error-in-kibana-logs-and-on-gui-default-policy-could-not-be-added-system-is-not-installed-add-system-to-xpack-fleet-packages-or-remove-it-from-system-1-im-using-3-nodes-cluster-for-elasticsearch/291555)
**Author:** [@amr\_hamdy](https://discuss.elastic.co/u/amr_hamdy)\ **Replies:** 1\ **Last updated:** [December 15, 2021, 12:47pm UTC](https://discuss.elastic.co/t/unable-to-initialize-fleet-as-i-get-internal-server-error-in-kibana-logs-and-on-gui-default-policy-could-not-be-added-system-is-not-installed-add-system-to-xpack-fleet-packages-or-remove-it-from-system-1-im-using-3-nodes-cluster-for-elasticsearch/291555 "2021-12-15T12:47:39Z")
--- ## [Is there a way to update the Elastic index field data through Kibana console - preferably through Discover feature](https://discuss.elastic.co/t/is-there-a-way-to-update-the-elastic-index-field-data-through-kibana-console-preferably-through-discover-feature/291700)
**Author:** [@Pradeep\_Nukatoti](https://discuss.elastic.co/u/Pradeep_Nukatoti)\ **Replies:** 1\ **Last updated:** [December 15, 2021, 12:44pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-update-the-elastic-index-field-data-through-kibana-console-preferably-through-discover-feature/291700 "2021-12-15T12:44:46Z")
Hello Folks, I'm looking for a way to update the Elastic index field data through Kibana console through discover, I was able to pull the data and display it as a table but I don't see a way to update it and ES index.… --- ## [Building oss tar from source code Elasticsearch 7.10](https://discuss.elastic.co/t/building-oss-tar-from-source-code-elasticsearch-7-10/291966)
**Author:** [@dhina](https://discuss.elastic.co/u/dhina)\ **Replies:** 0\ **Last updated:** [December 15, 2021, 12:10pm UTC](https://discuss.elastic.co/t/building-oss-tar-from-source-code-elasticsearch-7-10/291966 "2021-12-15T12:10:43Z")
Hi, References Is there a way we could build the oss version of the Elasticsearch from source code. We have a requirement like, we have to build the Elasticsearch OSS from source code and use it instead of downloadi… --- ## [Appending a result from a search to the result of another search](https://discuss.elastic.co/t/appending-a-result-from-a-search-to-the-result-of-another-search/291956)
**Author:** [@perbejder](https://discuss.elastic.co/u/perbejder)\ **Replies:** 2\ **Last updated:** [December 15, 2021, 12:10pm UTC](https://discuss.elastic.co/t/appending-a-result-from-a-search-to-the-result-of-another-search/291956 "2021-12-15T12:10:56Z")
Hi I have two indexes. One with data from our Windows servers and another with information from our CMDB. I want to make a count of servers that have send data to Elastic within the last 24 hours from the Windows inde… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1124) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1126)