# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1132 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1133 --- ## [Read containers log files using fleet](https://discuss.elastic.co/t/read-containers-log-files-using-fleet/288067)
**Author:** [@vovan13111](https://discuss.elastic.co/u/vovan13111)\ **Replies:** 3\ **Last updated:** [December 10, 2021, 4:50am UTC](https://discuss.elastic.co/t/read-containers-log-files-using-fleet/288067 "2021-12-10T04:50:46Z")
Good afternoon. When studying Fleet and apm agents, the question arose, is it possible to somehow collect logs from docker containers, as done in filebeat, or is there no such possibility yet? --- ## [Elastic search storage exception](https://discuss.elastic.co/t/elastic-search-storage-exception/290642)
**Author:** [@mehmood1](https://discuss.elastic.co/u/mehmood1)\ **Replies:** 8\ **Last updated:** [December 10, 2021, 4:03am UTC](https://discuss.elastic.co/t/elastic-search-storage-exception/290642 "2021-12-10T04:03:25Z")
Elasticsearch run in read only mode due to storage. i dont want to extend storage this time because it is only for testing purpose. below is Elasticsearch yml file # ======================== Elasticsearch Configuratio… --- ## [No audit log file in /usr/share/elasticsearch/logs directory when I opend the audit log configuration](https://discuss.elastic.co/t/no-audit-log-file-in-usr-share-elasticsearch-logs-directory-when-i-opend-the-audit-log-configuration/291387)
**Author:** [@Hello-Linux](https://discuss.elastic.co/u/Hello-Linux)\ **Replies:** 0\ **Last updated:** [December 10, 2021, 3:43am UTC](https://discuss.elastic.co/t/no-audit-log-file-in-usr-share-elasticsearch-logs-directory-when-i-opend-the-audit-log-configuration/291387 "2021-12-10T03:43:38Z")
I have set the config xpack.security.audit.enabled: true,and restart Elasticsearch,but in the logs file I can't find the json file what name is \_audit.json,why? look at No audit log file in /usr/share/elasticsearch/logs … --- ## [Panw module - Another incorrect timestamp issue](https://discuss.elastic.co/t/panw-module-another-incorrect-timestamp-issue/290099)
**Author:** [@ddaloia](https://discuss.elastic.co/u/ddaloia)\ **Replies:** 2\ **Last updated:** [December 10, 2021, 2:33am UTC](https://discuss.elastic.co/t/panw-module-another-incorrect-timestamp-issue/290099 "2021-12-10T02:33:00Z")
Hi friends. I am really struggling on this one. I can not figure out why all my ingested logs are showing up at the wrong time. It appears that all my firewall logs for each day are being grouped into a 3 hour window for… --- ## [Is any API to get request string of Kibana?](https://discuss.elastic.co/t/is-any-api-to-get-request-string-of-kibana/291281)
**Author:** [@Frank\_Kuo](https://discuss.elastic.co/u/Frank_Kuo)\ **Replies:** 2\ **Last updated:** [December 10, 2021, 12:44am UTC](https://discuss.elastic.co/t/is-any-api-to-get-request-string-of-kibana/291281 "2021-12-10T00:44:22Z")
Hello, I have many search objects at Kibana. Is any API to get request string? just set up server info/ object name, and output is request string. Is any API there? (to get discover-\>inspect-\>request string) --- ## [Make/deploy fail](https://discuss.elastic.co/t/make-deploy-fail/291372)
**Author:** [@Steph\_van\_Schalkwyk](https://discuss.elastic.co/u/Steph_van_Schalkwyk)\ **Replies:** 0\ **Last updated:** [December 9, 2021, 11:26pm UTC](https://discuss.elastic.co/t/make-deploy-fail/291372 "2021-12-09T23:26:31Z")
/dev-tools/deploy and $make clean fail with: make\[1\]: Leaving directory '/home/steph/go/src/github.com/elastic/beats/x-pack/packetbeat' make\[1\]: Entering directory '/home/steph/go/src/github.com/elastic/beats/x-pack/l… --- ## [Case insensitive term query (case\_insensitive) performance penalty?](https://discuss.elastic.co/t/case-insensitive-term-query-case-insensitive-performance-penalty/291371)
**Author:** [@roytmana](https://discuss.elastic.co/u/roytmana)\ **Replies:** 0\ **Last updated:** [December 9, 2021, 11:20pm UTC](https://discuss.elastic.co/t/case-insensitive-term-query-case-insensitive-performance-penalty/291371 "2021-12-09T23:20:28Z")
Hello, Is there any significant performance penalty for using case\_insensitive: true in term queries? If I use keyword mapping with lowercase normalizer, highlighter would emit lowercased results which I would like to … --- ## [Logstash not creating new index](https://discuss.elastic.co/t/logstash-not-creating-new-index/291265)
**Author:** [@will.nickisch](https://discuss.elastic.co/u/will.nickisch)\ **Replies:** 7\ **Last updated:** [December 9, 2021, 10:28pm UTC](https://discuss.elastic.co/t/logstash-not-creating-new-index/291265 "2021-12-09T22:28:02Z")
I am having an issue with multiple tcp inputs and logstash not pulling in messages from the second tcp input. The data received on port 6050 is going into the default index logstash-%{+YYYY.MM.dd} but the data sent from… --- ## [High system CPU usage with Elasticsearch on Kubernetes (using ECK) using ES v7.10.0+ (but not in v7.6.1)](https://discuss.elastic.co/t/high-system-cpu-usage-with-elasticsearch-on-kubernetes-using-eck-using-es-v7-10-0-but-not-in-v7-6-1/290904)
**Author:** [@YannV](https://discuss.elastic.co/u/YannV)\ **Replies:** 5\ **Last updated:** [December 9, 2021, 10:20pm UTC](https://discuss.elastic.co/t/high-system-cpu-usage-with-elasticsearch-on-kubernetes-using-eck-using-es-v7-10-0-but-not-in-v7-6-1/290904 "2021-12-09T22:20:19Z")
Elasticsearch version: 7.10.0 & 7.14.2 (but not reproduced in ES v7.6.1) Plugins installed: None JVM version: Bundled in official Elasticsearch docker image OS version: Reproduced on CentOS 7.9 with kernel 3.10.0 and … --- ## [Replace string in elastic](https://discuss.elastic.co/t/replace-string-in-elastic/291320)
**Author:** [@idoweiss1](https://discuss.elastic.co/u/idoweiss1)\ **Replies:** 1\ **Last updated:** [December 9, 2021, 9:52pm UTC](https://discuss.elastic.co/t/replace-string-in-elastic/291320 "2021-12-09T21:52:07Z")
Hi , I have a string from the kibana and need to change the output : from "mdc.correlationId" to "correlation-id" --- ## [Can´t start Fleet server](https://discuss.elastic.co/t/can-t-start-fleet-server/291352)
**Author:** [@almedor](https://discuss.elastic.co/u/almedor)\ **Replies:** 0\ **Last updated:** [December 9, 2021, 4:51pm UTC](https://discuss.elastic.co/t/can-t-start-fleet-server/291352 "2021-12-09T16:51:50Z")
Hi, I´ve just deployed an ELK develop environment (windows msi) but i can´t (i don´t know) how to deploy the fleet server. I´ve followed these steps: but i always received the same error: What am i missing or doing wr… --- ## [Logstash arbitrarily hangs with SIGINT. Happens roughly every few days](https://discuss.elastic.co/t/logstash-arbitrarily-hangs-with-sigint-happens-roughly-every-few-days/291258)
**Author:** [@jtocher](https://discuss.elastic.co/u/jtocher)\ **Replies:** 1\ **Last updated:** [December 9, 2021, 8:51pm UTC](https://discuss.elastic.co/t/logstash-arbitrarily-hangs-with-sigint-happens-roughly-every-few-days/291258 "2021-12-09T20:51:43Z")
We have a Logstash server as part of our Elastic Stack on Windows. About once a week, logs stop ingesting and the culprit is always Logstash. Restarting the service on that VM fixes the issue, but I'd like to find the pr… --- ## [ES not found documents](https://discuss.elastic.co/t/es-not-found-documents/291227)
**Author:** [@xunterix](https://discuss.elastic.co/u/xunterix)\ **Replies:** 6\ **Last updated:** [December 9, 2021, 7:39pm UTC](https://discuss.elastic.co/t/es-not-found-documents/291227 "2021-12-09T19:39:47Z")
Hi, after resetting the index and re-indexing, the search stopped finding any documents. In the logs I see all shards failed. What could be the problem? { "cluster\_name" : "elasticsearch", "status" : "yellow", "ti… --- ## [Get status snapshot does not work for snapshots that are not currently running](https://discuss.elastic.co/t/get-status-snapshot-does-not-work-for-snapshots-that-are-not-currently-running/291271)
**Author:** [@Hannah\_Chung](https://discuss.elastic.co/u/Hannah_Chung)\ **Replies:** 0\ **Last updated:** [December 8, 2021, 11:57pm UTC](https://discuss.elastic.co/t/get-status-snapshot-does-not-work-for-snapshots-that-are-not-currently-running/291271 "2021-12-08T23:57:01Z")
Based on the documentation for Get snapshot status here, I expect to see the state of my snapshot even if it is not currently running. I confirmed I am making the call GET /\_snapshot/\/\/\_sta… --- ## [Multi-line Filebeat templates don't work with filebeat.inputs - type: filestream](https://discuss.elastic.co/t/multi-line-filebeat-templates-dont-work-with-filebeat-inputs-type-filestream/274510)
**Author:** [@cva](https://discuss.elastic.co/u/cva)\ **Replies:** 1\ **Last updated:** [December 9, 2021, 6:06pm UTC](https://discuss.elastic.co/t/multi-line-filebeat-templates-dont-work-with-filebeat-inputs-type-filestream/274510 "2021-12-09T18:06:07Z")
I ran into a multiline processing problem in Filebeat when the filebeat.inputs: parameters specify type: filestream - the logs of the file stream are not analyzed according to the requirements of multiline. pattern: '^\[\[… --- ## [High CPU utilization on master node](https://discuss.elastic.co/t/high-cpu-utilization-on-master-node/290096)
**Author:** [@guptaparv-rlr](https://discuss.elastic.co/u/guptaparv-rlr)\ **Replies:** 26\ **Last updated:** [December 9, 2021, 5:01pm UTC](https://discuss.elastic.co/t/high-cpu-utilization-on-master-node/290096 "2021-12-09T17:01:58Z")
I'm operating a Elasticsearch cluster using ECK Operator. Recently, we have observed high CPU utilization on master nodes. Here is the topology of the cluster: 3 master nodes 3 data nodes On running the nodes hot thr… --- ## [Pie chart labels canvas](https://discuss.elastic.co/t/pie-chart-labels-canvas/291351)
**Author:** [@MTV](https://discuss.elastic.co/u/MTV)\ **Replies:** 0\ **Last updated:** [December 9, 2021, 4:48pm UTC](https://discuss.elastic.co/t/pie-chart-labels-canvas/291351 "2021-12-09T16:48:39Z")
Hi, I have a pie chart in canvas that I would like to only show the percentage in the pie, and next to it the legend. I tried to clink in inspect to try some CSS but with no avail, because I just don't know what I'm doi… --- ## [Unable to perform a Regex Search for Asterisk](https://discuss.elastic.co/t/unable-to-perform-a-regex-search-for-asterisk/291036)
**Author:** [@GreenBlueSkys](https://discuss.elastic.co/u/GreenBlueSkys)\ **Replies:** 1\ **Last updated:** [December 9, 2021, 4:44pm UTC](https://discuss.elastic.co/t/unable-to-perform-a-regex-search-for-asterisk/291036 "2021-12-09T16:44:18Z")
\[Edit: Elastic parsed out the Asterisk, the proper log is now visible\] I am trying to perform a search against an AWS CloudTrail log identifying different instances of the asterisk (or escaped wildcard). To do this I a… --- ## [Logstash Can't read the elasticsearch username and password from Keystore!](https://discuss.elastic.co/t/logstash-cant-read-the-elasticsearch-username-and-password-from-keystore/291350)
**Author:** [@Maryam2021](https://discuss.elastic.co/u/Maryam2021)\ **Replies:** 0\ **Last updated:** [December 9, 2021, 4:39pm UTC](https://discuss.elastic.co/t/logstash-cant-read-the-elasticsearch-username-and-password-from-keystore/291350 "2021-12-09T16:39:32Z")
Hello All, I'm trying to build ELK stack on EC2 instances. I have built the ES cluster, Kibana and Logstash. The cluster and Kibana are happy and talking to each other fine but can't figure out the keystore issue with L… --- ## [Filebeat keystore for basic security](https://discuss.elastic.co/t/filebeat-keystore-for-basic-security/291257)
**Author:** [@bbangerter](https://discuss.elastic.co/u/bbangerter)\ **Replies:** 2\ **Last updated:** [December 9, 2021, 4:13pm UTC](https://discuss.elastic.co/t/filebeat-keystore-for-basic-security/291257 "2021-12-09T16:13:44Z")
I am running Elasticsearch 7.15.2 on CentOS 8 and have it successfully taking in logs from filebeat with a clear password in the yml file. I'm trying to get it running with a keystore, but am running into issues. My ou… --- ## [Parse Substring to JSON](https://discuss.elastic.co/t/parse-substring-to-json/291333)
**Author:** [@hami2608](https://discuss.elastic.co/u/hami2608)\ **Replies:** 1\ **Last updated:** [December 9, 2021, 4:09pm UTC](https://discuss.elastic.co/t/parse-substring-to-json/291333 "2021-12-09T16:09:05Z")
Hi, i have a Droptailer Pod in my Kubernetes Cluster with the following log example: 2021-12-09 13:46:32 +0000 UTC {"DPT":"161","DST":"XXX.XXX.XXX.XXX","ID":"54321","IN":"vrf104009","LEN":"48","MAC":"XX:XX:XX:XX:XX:XX… --- ## [Conditional indexing in metricbeat using Ingest node pipeline creates a datastream](https://discuss.elastic.co/t/conditional-indexing-in-metricbeat-using-ingest-node-pipeline-creates-a-datastream/291344)
**Author:** [@sidharth\_vijayakumar](https://discuss.elastic.co/u/sidharth_vijayakumar)\ **Replies:** 0\ **Last updated:** [December 9, 2021, 4:08pm UTC](https://discuss.elastic.co/t/conditional-indexing-in-metricbeat-using-ingest-node-pipeline-creates-a-datastream/291344 "2021-12-09T16:08:21Z")
I am trying to achieve conditional indexing for namespaces in elastic using ingest node pipelines. I used the below pipeline but the index getting created when I add the pipeline in metricbeat.yml is in form of datastrea… --- ## [Painless in Script Ingest Pipeline : Get fields name](https://discuss.elastic.co/t/painless-in-script-ingest-pipeline-get-fields-name/291341)
**Author:** [@GinkoLucas](https://discuss.elastic.co/u/GinkoLucas)\ **Replies:** 0\ **Last updated:** [December 9, 2021, 3:44pm UTC](https://discuss.elastic.co/t/painless-in-script-ingest-pipeline-get-fields-name/291341 "2021-12-09T15:44:29Z")
Hi, I need to know the names of the fields entering the pipeline. Because I would like to place in a different index the documents with an extra field, or an unknown field. Is there a solution with script processor ? --- ## [ML job behavior changed](https://discuss.elastic.co/t/ml-job-behavior-changed/291230)
**Author:** [@dao](https://discuss.elastic.co/u/dao)\ **Replies:** 6\ **Last updated:** [December 9, 2021, 3:30pm UTC](https://discuss.elastic.co/t/ml-job-behavior-changed/291230 "2021-12-09T15:30:46Z")
Hello, I have a ML jon that is started for a long time, but since a few monthes, there is a change (is it a bug?) Explanations: Here is what I have As you can see, It seems that the ML runs OK and detects some ano… --- ## [I want to set up the initial password without any environment variables after "xpack.security.enabled: true"](https://discuss.elastic.co/t/i-want-to-set-up-the-initial-password-without-any-environment-variables-after-xpack-security-enabled-true/291209)
**Author:** [@tadashi.oya](https://discuss.elastic.co/u/tadashi.oya)\ **Replies:** 1\ **Last updated:** [December 9, 2021, 3:02pm UTC](https://discuss.elastic.co/t/i-want-to-set-up-the-initial-password-without-any-environment-variables-after-xpack-security-enabled-true/291209 "2021-12-09T15:02:00Z")
Hi there. I'm trying to use T-Pot with "xpack.security.enabled: true". I want to set up passwords for Elasticsearch's built-in users (elastic, kibana\_system, and so on) as following conditions. Use as few interactive… --- ## [Metric data from csv](https://discuss.elastic.co/t/metric-data-from-csv/291314)
**Author:** [@sirReeall](https://discuss.elastic.co/u/sirReeall)\ **Replies:** 1\ **Last updated:** [December 9, 2021, 2:52pm UTC](https://discuss.elastic.co/t/metric-data-from-csv/291314 "2021-12-09T14:52:11Z")
Hello, I'm trying to import metrics data from a CSV file. Currently I'm using a csv filter like: filter { csv { autodetect\_column\_names =\> true } date { match =\> \["\[t\]","UNIX"\] } mutat… --- ## [Kibana not successfully filtering in Discover](https://discuss.elastic.co/t/kibana-not-successfully-filtering-in-discover/290918)
**Author:** [@agentw](https://discuss.elastic.co/u/agentw)\ **Replies:** 1\ **Last updated:** [December 9, 2021, 2:51pm UTC](https://discuss.elastic.co/t/kibana-not-successfully-filtering-in-discover/290918 "2021-12-09T14:51:44Z")
I recently updated our Elastic instances to 7.15.2. I am seeing mixed results when applying filters in Discover. For example, when filtering out a host on the agent.hostname field (i.e. 'NOT agent.hostname: example\_host)… --- ## [SSO and Subscription](https://discuss.elastic.co/t/sso-and-subscription/291275)
**Author:** [@suren\_es](https://discuss.elastic.co/u/suren_es)\ **Replies:** 7\ **Last updated:** [December 9, 2021, 2:13pm UTC](https://discuss.elastic.co/t/sso-and-subscription/291275 "2021-12-09T14:13:36Z")
I did download ELK stack tarballs, installed, configured. All is working fine. But when I started enabling SSO (via parameter xpack.security.authc.realms.oidc.oidc1 in config file), it says that this is not possible wit… --- ## [Kibana Logs Stream as Dashboard Visualization are not streaming live](https://discuss.elastic.co/t/kibana-logs-stream-as-dashboard-visualization-are-not-streaming-live/290758)
**Author:** [@kshepitzki1](https://discuss.elastic.co/u/kshepitzki1)\ **Replies:** 5\ **Last updated:** [December 9, 2021, 2:36pm UTC](https://discuss.elastic.co/t/kibana-logs-stream-as-dashboard-visualization-are-not-streaming-live/290758 "2021-12-09T14:36:39Z")
When I save a Kibana Live Log Stream as a visualization in the Visualization Library and then import it into a Dashboard, the Live Streaming feature is gone and I have to manually refresh it. I need it in a dashboard so… --- ## [Is there a reason you cannot use \[runtime\_mappings\] in a \_count request?](https://discuss.elastic.co/t/is-there-a-reason-you-cannot-use-runtime-mappings-in-a-count-request/291334)
**Author:** [@sz\_bb](https://discuss.elastic.co/u/sz_bb)\ **Replies:** 0\ **Last updated:** [December 9, 2021, 1:54pm UTC](https://discuss.elastic.co/t/is-there-a-reason-you-cannot-use-runtime-mappings-in-a-count-request/291334 "2021-12-09T13:54:55Z")
I'd like to take advantage of \[runtime\_mappings\] in a search request, specifically leveraging that runtime\_field as a filter. In that scenario, while I may only have a size of 50 to return the top 50 docs, I also request… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1131) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1133)