# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1152 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1153 --- ## [Send user input to elasticsearch](https://discuss.elastic.co/t/send-user-input-to-elasticsearch/290065)
**Author:** [@AlexM566](https://discuss.elastic.co/u/AlexM566)\ **Replies:** 1\ **Last updated:** [November 24, 2021, 5:30pm UTC](https://discuss.elastic.co/t/send-user-input-to-elasticsearch/290065 "2021-11-24T17:30:30Z")
Hello everyone, I have a web form and I want user input to be stored in Elasticsearch into an index. I do no know how to do that, I have a method written in php but is not working :frowning: . The elk stack version is … --- ## [Curator is failing during authentication for elastic search on AWS](https://discuss.elastic.co/t/curator-is-failing-during-authentication-for-elastic-search-on-aws/289978)
**Author:** [@hudar01](https://discuss.elastic.co/u/hudar01)\ **Replies:** 2\ **Last updated:** [November 24, 2021, 5:27pm UTC](https://discuss.elastic.co/t/curator-is-failing-during-authentication-for-elastic-search-on-aws/289978 "2021-11-24T17:27:58Z")
I've setup an Elasticsearch backup and restore on S3, and I was trying to delete the backups using Curator (but it's always failing - i tried both ways using url\_prefix and without it). Could you please help how I can ma… --- ## [Ingest pipeline GeoIP processor lacking parent fields on ingestion?](https://discuss.elastic.co/t/ingest-pipeline-geoip-processor-lacking-parent-fields-on-ingestion/289950)
**Author:** [@chippey5](https://discuss.elastic.co/u/chippey5)\ **Replies:** 3\ **Last updated:** [November 24, 2021, 3:37pm UTC](https://discuss.elastic.co/t/ingest-pipeline-geoip-processor-lacking-parent-fields-on-ingestion/289950 "2021-11-24T15:37:49Z")
In our environment we have custom logs coming in of which a remote IP is ingested to a field called remoteAddr. In our ingest pipeline we're using a GeoIP processor which we use the source field remoteAddr to the target … --- ## [Plotting the result of nested aggregations in kibana](https://discuss.elastic.co/t/plotting-the-result-of-nested-aggregations-in-kibana/290074)
**Author:** [@M.KRISHNAKANT\_ACHARY](https://discuss.elastic.co/u/M.KRISHNAKANT_ACHARY)\ **Replies:** 1\ **Last updated:** [November 24, 2021, 3:11pm UTC](https://discuss.elastic.co/t/plotting-the-result-of-nested-aggregations-in-kibana/290074 "2021-11-24T15:11:15Z")
I have an index which has nested data types. when I am running this query { "size":0, "aggs": { "tenant": { "nested": { "path": "custom\_details.tenantname" }, "aggs": { "count1… --- ## [Facing issue while reindexing document using elasticsearch-7.9.0.jar to Elasticsearch](https://discuss.elastic.co/t/facing-issue-while-reindexing-document-using-elasticsearch-7-9-0-jar-to-elasticsearch/290085)
**Author:** [@bikas](https://discuss.elastic.co/u/bikas)\ **Replies:** 0\ **Last updated:** [November 24, 2021, 2:50pm UTC](https://discuss.elastic.co/t/facing-issue-while-reindexing-document-using-elasticsearch-7-9-0-jar-to-elasticsearch/290085 "2021-11-24T14:50:09Z")
Hi Team, We are using Elasticsearch 7.9.0 having single node cluster. We have developed a plugin which is sitting inside plugins folder of Elasticsearch. We are using Elasticsearch SDK (org.Elasticsearch:Elasticsearch:… --- ## [Metricbeat setup to return localhost metrics](https://discuss.elastic.co/t/metricbeat-setup-to-return-localhost-metrics/289880)
**Author:** [@maheshe](https://discuss.elastic.co/u/maheshe)\ **Replies:** 6\ **Last updated:** [November 24, 2021, 2:45pm UTC](https://discuss.elastic.co/t/metricbeat-setup-to-return-localhost-metrics/289880 "2021-11-24T14:45:50Z")
Running 7.11 Elastic on self managed eks 1.19 with Metricbeats 7.9 running on EC2 instance This is the below configuration of the metricbeat.yaml metricbeat.modules: - module: system metricsets: # - cpu … --- ## [Not receiving logs from Elastic Agent](https://discuss.elastic.co/t/not-receiving-logs-from-elastic-agent/289743)
**Author:** [@eleong](https://discuss.elastic.co/u/eleong)\ **Replies:** 2\ **Last updated:** [November 24, 2021, 2:13pm UTC](https://discuss.elastic.co/t/not-receiving-logs-from-elastic-agent/289743 "2021-11-24T14:13:56Z")
Hi, I cant seem to receive any logs from elastic agent installed on either Windows or Ubuntu machine. I've searched through the documentations to the best of my abilities but I'm afraid that I'm still too new to Elastic… --- ## [Auditbeat configuration to use the "Modification of OpenSSH binaries" detection rule](https://discuss.elastic.co/t/auditbeat-configuration-to-use-the-modification-of-openssh-binaries-detection-rule/289971)
**Author:** [@aryon](https://discuss.elastic.co/u/aryon)\ **Replies:** 1\ **Last updated:** [November 24, 2021, 1:46pm UTC](https://discuss.elastic.co/t/auditbeat-configuration-to-use-the-modification-of-openssh-binaries-detection-rule/289971 "2021-11-24T13:46:13Z")
Hello, I am trying to use this detection rule that relies on AuditBeat events: Modification of OpenSSH Binaries | Elastic Security Solution \[7.15\] | Elastic I set up AuditBeat 7.14.2 with the following configuration: a… --- ## [Elastic-agent not respecting the config file parameters](https://discuss.elastic.co/t/elastic-agent-not-respecting-the-config-file-parameters/289898)
**Author:** [@Munavir\_Chavody](https://discuss.elastic.co/u/Munavir_Chavody)\ **Replies:** 3\ **Last updated:** [November 24, 2021, 1:45pm UTC](https://discuss.elastic.co/t/elastic-agent-not-respecting-the-config-file-parameters/289898 "2021-11-24T13:45:15Z")
Elastic agent doesn't seem to respect the parameters specified in the config file. As per below config, gRPC should bind to 6790. Rather it binds on 6789 (default). agent.grpc: address: localhost port: 6790 Here's … --- ## [Can filebeat autodiscover collect logs from k8s emptydir volume?](https://discuss.elastic.co/t/can-filebeat-autodiscover-collect-logs-from-k8s-emptydir-volume/290071)
**Author:** [@ydy](https://discuss.elastic.co/u/ydy)\ **Replies:** 0\ **Last updated:** [November 24, 2021, 1:17pm UTC](https://discuss.elastic.co/t/can-filebeat-autodiscover-collect-logs-from-k8s-emptydir-volume/290071 "2021-11-24T13:17:27Z")
Here is my filebeat config yaml, downloaded from Run Filebeat on Kubernetes | Filebeat Reference \[7.15\] | Elastic I can't get log when the templates.config.type is log (yaml below), But when I set this to container I ca… --- ## [Extend cluster, new data nodes, identical disk space?](https://discuss.elastic.co/t/extend-cluster-new-data-nodes-identical-disk-space/289931)
**Author:** [@benoitp](https://discuss.elastic.co/u/benoitp)\ **Replies:** 7\ **Last updated:** [November 24, 2021, 1:07pm UTC](https://discuss.elastic.co/t/extend-cluster-new-data-nodes-identical-disk-space/289931 "2021-11-24T13:07:14Z")
Hello, I have a cluster with 4 data nodes, each with a storage of 4 To dedicated to the ES datas. Can i add 2 more data nodes, but only with 2 To of disk dedicated to the ES datas ? I don’t know if ES will handle this… --- ## [Negative axis does not work in TVSB](https://discuss.elastic.co/t/negative-axis-does-not-work-in-tvsb/290010)
**Author:** [@sidharth\_vijayakumar](https://discuss.elastic.co/u/sidharth_vijayakumar)\ **Replies:** 2\ **Last updated:** [November 24, 2021, 9:23am UTC](https://discuss.elastic.co/t/negative-axis-does-not-work-in-tvsb/290010 "2021-11-24T09:23:03Z")
I am trying to plot a graph on kibana using TSVB where inbound traffic is on top and outbound traffic is on the bottom. I am not able to get it in negative y axis I tried to follow this demo but does not work in my kiban… --- ## [Curator - shard has exceeded the maximum number of retries \[1\]](https://discuss.elastic.co/t/curator-shard-has-exceeded-the-maximum-number-of-retries-1/290059)
**Author:** [@KaZuKi\_Yashiro](https://discuss.elastic.co/u/KaZuKi_Yashiro)\ **Replies:** 0\ **Last updated:** [November 24, 2021, 12:16pm UTC](https://discuss.elastic.co/t/curator-shard-has-exceeded-the-maximum-number-of-retries-1/290059 "2021-11-24T12:16:48Z")
Good afternoon. Current cnfiguration: ES version 6.8.8 in docker "docker.elastic.co/elasticsearch/elasticsearch:6.8.8" heap\_size: 31g "number\_of\_nodes" : 3, "number\_of\_data\_nodes" : 3, "active\_primary\_shards" : 125… --- ## [Elastic Agent ElasticSearch integration doesn't work with custom CA](https://discuss.elastic.co/t/elastic-agent-elasticsearch-integration-doesnt-work-with-custom-ca/290041)
**Author:** [@CarolinDohmen](https://discuss.elastic.co/u/CarolinDohmen)\ **Replies:** 0\ **Last updated:** [November 24, 2021, 10:38am UTC](https://discuss.elastic.co/t/elastic-agent-elasticsearch-integration-doesnt-work-with-custom-ca/290041 "2021-11-24T10:38:21Z")
Hi, I would like to use the Elasticsearch integration with Elastic Agents managed by Fleet. We have a self-managed Elasticsearch cluster running in Kubernetes and we are using self-signed certificates for the ES. I have… --- ## [Problem re-adding the same fields to start with a lowercase letter when updating](https://discuss.elastic.co/t/problem-re-adding-the-same-fields-to-start-with-a-lowercase-letter-when-updating/290015)
**Author:** [@Busra\_Duygu](https://discuss.elastic.co/u/Busra_Duygu)\ **Replies:** 2\ **Last updated:** [November 24, 2021, 10:01am UTC](https://discuss.elastic.co/t/problem-re-adding-the-same-fields-to-start-with-a-lowercase-letter-when-updating/290015 "2021-11-24T10:01:44Z")
Hello dear friends. I am encountering a problem while updating. The problem I'm having is, for example, I want to update the Title field, but I see that a new field has been created for the Title field in the document. (… --- ## [Is there a way to stop visualizations from refreshing when editing a Lens?](https://discuss.elastic.co/t/is-there-a-way-to-stop-visualizations-from-refreshing-when-editing-a-lens/290020)
**Author:** [@aqiank](https://discuss.elastic.co/u/aqiank)\ **Replies:** 2\ **Last updated:** [November 24, 2021, 9:41am UTC](https://discuss.elastic.co/t/is-there-a-way-to-stop-visualizations-from-refreshing-when-editing-a-lens/290020 "2021-11-24T09:41:34Z")
Hi, I'm using Kibana 7.15. is it possible to tell Kibana to stop refresh visualizations when editing a Lens? It's really slow and seems to affect the UI as I can't edit anything while visualization is refreshing. There s… --- ## [Elasticsearch index stopped](https://discuss.elastic.co/t/elasticsearch-index-stopped/290021)
**Author:** [@bahman\_shahrzad\_asr](https://discuss.elastic.co/u/bahman_shahrzad_asr)\ **Replies:** 1\ **Last updated:** [November 24, 2021, 8:16am UTC](https://discuss.elastic.co/t/elasticsearch-index-stopped/290021 "2021-11-24T08:16:38Z")
have graylog 4.x on ubuntu 20.04. standard installation. I can log in to my gralog but all data is one week old. services says running but : graylog-server.service: Failed with result ‘timeout’. in graylog log i have … --- ## [Elastic Cluster Performance Issue](https://discuss.elastic.co/t/elastic-cluster-performance-issue/289701)
**Author:** [@Clyton](https://discuss.elastic.co/u/Clyton)\ **Replies:** 2\ **Last updated:** [November 24, 2021, 8:02am UTC](https://discuss.elastic.co/t/elastic-cluster-performance-issue/289701 "2021-11-24T08:02:01Z")
Hi All, We have a set-up of Pipeline: Beats Agents--\>AWS MSK--\>LogStash--\>Elasticsearch. In which application team sends their application logs through this pipeline. We have 8 AWS ec2 instances which is running on Auto… --- ## [How to send Azure Linux VM auth logs to Elastic cloud using Event Hubs](https://discuss.elastic.co/t/how-to-send-azure-linux-vm-auth-logs-to-elastic-cloud-using-event-hubs/290022)
**Author:** [@lgr](https://discuss.elastic.co/u/lgr)\ **Replies:** 0\ **Last updated:** [November 24, 2021, 7:55am UTC](https://discuss.elastic.co/t/how-to-send-azure-linux-vm-auth-logs-to-elastic-cloud-using-event-hubs/290022 "2021-11-24T07:55:59Z")
Hi, i have small environment using couple of Azure technologies compatible with LAW (Log Analytics Workspace \[Sentinel\]). Is there a way to send Azure linux VM (auth) logs from LAW to Elastic cloud using Event Hubs? The… --- ## [Kibana Enhanced Table 2 Total Values on Different Condition](https://discuss.elastic.co/t/kibana-enhanced-table-2-total-values-on-different-condition/289913)
**Author:** [@Avnish\_Singh](https://discuss.elastic.co/u/Avnish_Singh)\ **Replies:** 6\ **Last updated:** [November 24, 2021, 7:33am UTC](https://discuss.elastic.co/t/kibana-enhanced-table-2-total-values-on-different-condition/289913 "2021-11-24T07:33:23Z")
Hi, I have created an enhanced table now there is an option to do a sum on a computed column but it does the sum of the entire column whereas I want 2 sums based on condition. Is it possible if yes then how? --- ## [How do I get the \_id which is the document id using NEST?](https://discuss.elastic.co/t/how-do-i-get-the-id-which-is-the-document-id-using-nest/288841)
**Author:** [@Busra\_Duygu](https://discuss.elastic.co/u/Busra_Duygu)\ **Replies:** 2\ **Last updated:** [November 24, 2021, 6:17am UTC](https://discuss.elastic.co/t/how-do-i-get-the-id-which-is-the-document-id-using-nest/288841 "2021-11-24T06:17:34Z")
Hello dear friends, I have a question. I want to retrieve the \_id of a document, how can I do that with using Nest? The field I want to reach is the following "\_id" field : "\_id" : "4912ba5cfb86ea63541c7007b1791ab3a6f0… --- ## [Logstash using KV filter creating a field with an array rather than individual fields and individual values](https://discuss.elastic.co/t/logstash-using-kv-filter-creating-a-field-with-an-array-rather-than-individual-fields-and-individual-values/290007)
**Author:** [@neil6323](https://discuss.elastic.co/u/neil6323)\ **Replies:** 2\ **Last updated:** [November 24, 2021, 5:32am UTC](https://discuss.elastic.co/t/logstash-using-kv-filter-creating-a-field-with-an-array-rather-than-individual-fields-and-individual-values/290007 "2021-11-24T05:32:19Z")
Hi all, I'm working through a Logstash configuration which is parsing Cisco ISE log entries. I'm using multiline to collate entries into records and a grok filter coupled with a 'kv' filter which is mostly having the de… --- ## [There are wrong values with memory usage in kubernetes metricbeat module](https://discuss.elastic.co/t/there-are-wrong-values-with-memory-usage-in-kubernetes-metricbeat-module/288261)
**Author:** [@Sergio\_Ferreyra](https://discuss.elastic.co/u/Sergio_Ferreyra)\ **Replies:** 4\ **Last updated:** [November 24, 2021, 3:53am UTC](https://discuss.elastic.co/t/there-are-wrong-values-with-memory-usage-in-kubernetes-metricbeat-module/288261 "2021-11-24T03:53:17Z")
Hi team, Having an issue with the values of this metric. kubernetes.node.memory.usage.bytes Looks like is not taking the proper values, for example: I am using that metric to get the memory usage but is not the cor… --- ## [Elastic Agent, single custom log to multiple indices via ingest pipeline](https://discuss.elastic.co/t/elastic-agent-single-custom-log-to-multiple-indices-via-ingest-pipeline/290002)
**Author:** [@rappersdelight](https://discuss.elastic.co/u/rappersdelight)\ **Replies:** 6\ **Last updated:** [November 24, 2021, 3:06am UTC](https://discuss.elastic.co/t/elastic-agent-single-custom-log-to-multiple-indices-via-ingest-pipeline/290002 "2021-11-24T03:06:13Z")
I am using elastic agent to capture the custom log from a pihole server, but I would like to split out the dns logs and the dhcp logs that are both found in pihole.log into different indexes. Things are working well, pr… --- ## [Modify sourcecode to achieve dashboard only mode](https://discuss.elastic.co/t/modify-sourcecode-to-achieve-dashboard-only-mode/289936)
**Author:** [@laigood](https://discuss.elastic.co/u/laigood)\ **Replies:** 5\ **Last updated:** [November 24, 2021, 1:52am UTC](https://discuss.elastic.co/t/modify-sourcecode-to-achieve-dashboard-only-mode/289936 "2021-11-24T01:52:14Z")
I have an unsecurity es cluster，and i deploy a normal kibana for daily mangement and analysis data.then i want to deploy another kibana to achieve dashboard only mode,i want to modify source code to cut out other functio… --- ## [Index rollover and hot to warm node move](https://discuss.elastic.co/t/index-rollover-and-hot-to-warm-node-move/289982)
**Author:** [@keiransteele](https://discuss.elastic.co/u/keiransteele)\ **Replies:** 1\ **Last updated:** [November 24, 2021, 1:44am UTC](https://discuss.elastic.co/t/index-rollover-and-hot-to-warm-node-move/289982 "2021-11-24T01:44:05Z")
I'm trying to understand how ILM works with the default 50GB/30days policy if I also want to move indicies longer than 7 days to warm nodes and it takes longer than 7 days to fill an index. Should I actually be making th… --- ## [Is possible to listen index changes?](https://discuss.elastic.co/t/is-possible-to-listen-index-changes/289988)
**Author:** [@thewasta](https://discuss.elastic.co/u/thewasta)\ **Replies:** 2\ **Last updated:** [November 24, 2021, 1:25am UTC](https://discuss.elastic.co/t/is-possible-to-listen-index-changes/289988 "2021-11-24T01:25:31Z")
I need to 'listen' for changes on my index, at first I started by writing a script in nodejs which is executed every 5min. For now I think it works... But can I do it in realtime? When a new document is insert or update. … --- ## [Port number ECS field data type](https://discuss.elastic.co/t/port-number-ecs-field-data-type/289992)
**Author:** [@groth](https://discuss.elastic.co/u/groth)\ **Replies:** 2\ **Last updated:** [November 23, 2021, 11:42pm UTC](https://discuss.elastic.co/t/port-number-ecs-field-data-type/289992 "2021-11-23T23:42:38Z")
Can someone please explain to me why port number ECS fields like source.port, destination.port, etc. are defined as numerical type long? When would port numbers from logs ever need to be used in any kind of mathematical … --- ## [Fleet Server and Elastic Agents not working when adding nodeSelectors](https://discuss.elastic.co/t/fleet-server-and-elastic-agents-not-working-when-adding-nodeselectors/289996)
**Author:** [@GerardoManzo](https://discuss.elastic.co/u/GerardoManzo)\ **Replies:** 0\ **Last updated:** [November 23, 2021, 11:18pm UTC](https://discuss.elastic.co/t/fleet-server-and-elastic-agents-not-working-when-adding-nodeselectors/289996 "2021-11-23T23:18:34Z")
Hi, I'm trying to setup a cluster using the ECK operator 1.8.0 and a GKE cluster with dedicated node pools: 1 node pool for Elasticsearch masters in europe-west1-b 1 node pool in europe-west1-b and in europe-west1-d fo… --- ## [Full text search on both Parent and Child](https://discuss.elastic.co/t/full-text-search-on-both-parent-and-child/289990)
**Author:** [@annasunny](https://discuss.elastic.co/u/annasunny)\ **Replies:** 0\ **Last updated:** [November 23, 2021, 10:20pm UTC](https://discuss.elastic.co/t/full-text-search-on-both-parent-and-child/289990 "2021-11-23T22:20:14Z")
Hi, I'm looking for a query ( or multiple queries) to do a full text search on both Parent and Child. Thank you in advance! I'm using the parent-child type. For example, my Parent documents will be a Choice, and its s… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1151) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1153)