# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1209 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1210 --- ## [Fleet agent failed to connect to fleet server after assigning new agent policy](https://discuss.elastic.co/t/fleet-agent-failed-to-connect-to-fleet-server-after-assigning-new-agent-policy/286263)
**Author:** [@pingz](https://discuss.elastic.co/u/pingz)\ **Replies:** 0\ **Last updated:** [October 8, 2021, 4:04pm UTC](https://discuss.elastic.co/t/fleet-agent-failed-to-connect-to-fleet-server-after-assigning-new-agent-policy/286263 "2021-10-08T16:04:54Z")
Hi there: I have fleet agent and fleet server (7.15.0) both running as pods in Kubernetes. After applying new agent policy, fleet agent became offline. I can see the error in fleet agent log |2021-10-08T15:56:56.120Z… --- ## [Append nested variable's value to a string](https://discuss.elastic.co/t/append-nested-variables-value-to-a-string/285470)
**Author:** [@Voolkan](https://discuss.elastic.co/u/Voolkan)\ **Replies:** 6\ **Last updated:** [October 8, 2021, 3:10pm UTC](https://discuss.elastic.co/t/append-nested-variables-value-to-a-string/285470 "2021-10-08T15:10:49Z")
Hello, I'm trying to setup a bit of a dynamic solution to the logstash config, and especially the json filter part. When setting the json part, I need to provide a source and a target fields. With source it's easy, howe… --- ## [Fleet service account permissions for filebeat threat intel](https://discuss.elastic.co/t/fleet-service-account-permissions-for-filebeat-threat-intel/286258)
**Author:** [@albbapm](https://discuss.elastic.co/u/albbapm)\ **Replies:** 0\ **Last updated:** [October 8, 2021, 2:53pm UTC](https://discuss.elastic.co/t/fleet-service-account-permissions-for-filebeat-threat-intel/286258 "2021-10-08T14:53:14Z")
I am trying to use the elastic agent via fleet and filebeat to gather threat intel. I realize this is currently not working out of the box. That being said, I think I can massage it and get it working but I have some q… --- ## [Developing plugins for kibana](https://discuss.elastic.co/t/developing-plugins-for-kibana/285942)
**Author:** [@Slava\_Gavrilov](https://discuss.elastic.co/u/Slava_Gavrilov)\ **Replies:** 1\ **Last updated:** [October 8, 2021, 2:49pm UTC](https://discuss.elastic.co/t/developing-plugins-for-kibana/285942 "2021-10-08T14:49:34Z")
Hi. In my dicovery page of kibana i'm using url format field (kibana format) I want to that ref in field opend in modal window or something, not in new tab or current tab. I met kibana plugin develobment. The command n… --- ## [Subtracting 2 fields different document on Scripted Field / json input](https://discuss.elastic.co/t/subtracting-2-fields-different-document-on-scripted-field-json-input/286203)
**Author:** [@rikizita3](https://discuss.elastic.co/u/rikizita3)\ **Replies:** 1\ **Last updated:** [October 8, 2021, 2:44pm UTC](https://discuss.elastic.co/t/subtracting-2-fields-different-document-on-scripted-field-json-input/286203 "2021-10-08T14:44:12Z")
I have a set of data below. I want to add the red marker then subtract it to the blue marker. I tried using Scripted Field. But when I go back to discovery I have this error. If I will put it on the line gra… --- ## [Dissect Logs](https://discuss.elastic.co/t/dissect-logs/286048)
**Author:** [@maltewhiite](https://discuss.elastic.co/u/maltewhiite)\ **Replies:** 7\ **Last updated:** [October 8, 2021, 2:41pm UTC](https://discuss.elastic.co/t/dissect-logs/286048 "2021-10-08T14:41:53Z")
I simply want to turn key:value data from a message string into fields in Elastic, so I can analyze the logs with Kibana. I'd like to use Dissect to do the following: Dissecting this log: conn=10 op=221996 RESULT err=… --- ## [How do I not send metadata from filebeat to Graylog?](https://discuss.elastic.co/t/how-do-i-not-send-metadata-from-filebeat-to-graylog/286253)
**Author:** [@s79](https://discuss.elastic.co/u/s79)\ **Replies:** 0\ **Last updated:** [October 8, 2021, 2:36pm UTC](https://discuss.elastic.co/t/how-do-i-not-send-metadata-from-filebeat-to-graylog/286253 "2021-10-08T14:36:27Z")
I am using filebeats directly to send json data to graylog. The fields @metadata\_\_id, @metadata\_beat, @metadata\_type, @metadata\_version are constants, and @timestamp is not needed since the time is in the message. All th… --- ## [Metricbeat not creating Index correctly](https://discuss.elastic.co/t/metricbeat-not-creating-index-correctly/285863)
**Author:** [@mhare](https://discuss.elastic.co/u/mhare)\ **Replies:** 4\ **Last updated:** [October 8, 2021, 2:36pm UTC](https://discuss.elastic.co/t/metricbeat-not-creating-index-correctly/285863 "2021-10-08T14:36:25Z")
I am running Stack version 7.13.4 with Metricbeat Everything seemed to be working fine, then we wanted to remove all the metricbeat data and start over. So we stopped metricbeat, and deleted all of the Metricbeat indexe… --- ## [Pipeline error {:pipeline\_id=\>"main", :exception=\>#\ **Author:** [@Busra\_Duygu](https://discuss.elastic.co/u/Busra_Duygu)\ **Replies:** 1\ **Last updated:** [October 8, 2021, 2:35pm UTC](https://discuss.elastic.co/t/pipeline-error-pipeline-id-main-exception-logstash-unexpected-character-code-58-expected-a-valid-value-number-string-array-object-true-false-or-null/286252 "2021-10-08T14:35:30Z") Hello friends, I want to add some data to a new index according to a query from an existing index in elasticsearch. But I am facing a problem while doing this, I would be very happy if you could help me. my conf file: i… --- ## [Mutate gsub - re-using regex](https://discuss.elastic.co/t/mutate-gsub-re-using-regex/286243)
**Author:** [@JimJ](https://discuss.elastic.co/u/JimJ)\ **Replies:** 2\ **Last updated:** [October 8, 2021, 2:13pm UTC](https://discuss.elastic.co/t/mutate-gsub-re-using-regex/286243 "2021-10-08T14:13:06Z")
Hi everybody, I would like to parttially remove the end of a string like that: mutate { gsub =\> \[ "fieldname", "(:\[0-5\]\[0-9\].\\d{3})\\d\*$", "what\_is\_between\_brackets" \] } Context: I parse… --- ## [handleSQSMessage failed: json unmarshal sqs message body failed at offset 1 with syntax error: invalid character 'T' looking for beginning of value](https://discuss.elastic.co/t/handlesqsmessage-failed-json-unmarshal-sqs-message-body-failed-at-offset-1-with-syntax-error-invalid-character-t-looking-for-beginning-of-value/286249)
**Author:** [@EvanGertis](https://discuss.elastic.co/u/EvanGertis)\ **Replies:** 0\ **Last updated:** [October 8, 2021, 2:11pm UTC](https://discuss.elastic.co/t/handlesqsmessage-failed-json-unmarshal-sqs-message-body-failed-at-offset-1-with-syntax-error-invalid-character-t-looking-for-beginning-of-value/286249 "2021-10-08T14:11:11Z")
I am trying to trouble shoot an issue. I have a set of logs from ecs that are to be sent to an sqs queue. The container logs show that the logs are being sent. However, when I poll the sqs queue none of the messages are … --- ## [Elasticsearch installation](https://discuss.elastic.co/t/elasticsearch-installation/285415)
**Author:** [@eugestel](https://discuss.elastic.co/u/eugestel)\ **Replies:** 45\ **Last updated:** [October 8, 2021, 2:08pm UTC](https://discuss.elastic.co/t/elasticsearch-installation/285415 "2021-10-08T14:08:19Z")
Requesting for help with Elasticsearch. I installed Elasticsearch in my ubuntu server 20.04 but unable to get it to work. The command : systemctl status Elasticsearch.service yielded the following: $ systemctl status… --- ## [Paginating through results in a query that doesnt use sort](https://discuss.elastic.co/t/paginating-through-results-in-a-query-that-doesnt-use-sort/286160)
**Author:** [@John\_Mackey](https://discuss.elastic.co/u/John_Mackey)\ **Replies:** 3\ **Last updated:** [October 8, 2021, 1:46pm UTC](https://discuss.elastic.co/t/paginating-through-results-in-a-query-that-doesnt-use-sort/286160 "2021-10-08T13:46:51Z")
We have the below query that returns 15K results. How do we paginate through all the results From the examples for search\_after , it can be used only if we are sorting by a unique field in the query . We do not intend … --- ## [Get Laste Value of each host with Query DSL in Discover](https://discuss.elastic.co/t/get-laste-value-of-each-host-with-query-dsl-in-discover/286002)
**Author:** [@GinkoLucas](https://discuss.elastic.co/u/GinkoLucas)\ **Replies:** 3\ **Last updated:** [October 8, 2021, 12:55pm UTC](https://discuss.elastic.co/t/get-laste-value-of-each-host-with-query-dsl-in-discover/286002 "2021-10-08T12:55:46Z")
Hi, Actually i store logs in Elastic. I would like to get all the last log collected from each host in Discover. If there is 20 differents hosts, the Discover have to show me 20 logs. I think i can use Elasticsearch Qu… --- ## [When does minimum\_should\_match change default value?](https://discuss.elastic.co/t/when-does-minimum-should-match-change-default-value/286234)
**Author:** [@dinamic](https://discuss.elastic.co/u/dinamic)\ **Replies:** 0\ **Last updated:** [October 8, 2021, 12:10pm UTC](https://discuss.elastic.co/t/when-does-minimum-should-match-change-default-value/286234 "2021-10-08T12:10:50Z")
Hey guys :wave: We've upgraded from 6.8 to 7.10 recently and are still finding out issues. It seems like minimum\_should\_match behaviour has been silently updated. Consider the following repeatable example: PUT /test-b… --- ## [Create user with multiple roles(of different spaces) and having access to only single space](https://discuss.elastic.co/t/create-user-with-multiple-roles-of-different-spaces-and-having-access-to-only-single-space/284591)
**Author:** [@srinielk](https://discuss.elastic.co/u/srinielk)\ **Replies:** 10\ **Last updated:** [October 8, 2021, 12:20pm UTC](https://discuss.elastic.co/t/create-user-with-multiple-roles-of-different-spaces-and-having-access-to-only-single-space/284591 "2021-10-08T12:20:56Z")
please advise how to create user with multiple roles(of different spaces) and having access to only single space --- ## [Snapshot in s3 bucket not seen by other cluster](https://discuss.elastic.co/t/snapshot-in-s3-bucket-not-seen-by-other-cluster/286006)
**Author:** [@raphaelSeguin](https://discuss.elastic.co/u/raphaelSeguin)\ **Replies:** 3\ **Last updated:** [October 8, 2021, 11:22am UTC](https://discuss.elastic.co/t/snapshot-in-s3-bucket-not-seen-by-other-cluster/286006 "2021-10-08T11:22:02Z")
Hi, I'm using an s3 repository to snapshot a cluster. I was hoping to restore the snapshot on a remote cluster by registering a repository pointing to the same bucket. But the snapshot I took from he first cluster remai… --- ## [Alerting in Kibana](https://discuss.elastic.co/t/alerting-in-kibana/286212)
**Author:** [@josh12](https://discuss.elastic.co/u/josh12)\ **Replies:** 2\ **Last updated:** [October 8, 2021, 10:57am UTC](https://discuss.elastic.co/t/alerting-in-kibana/286212 "2021-10-08T10:57:10Z")
Hi all, i saw alerting is paid version like sending mail or slack. I saw there is alterntive which iselastalert2. However, there is elastalert as well .what the difference. I plan to use docker --- ## [Parsed JSON object/hash requires a target configuration option](https://discuss.elastic.co/t/parsed-json-object-hash-requires-a-target-configuration-option/286217)
**Author:** [@ktpktr0](https://discuss.elastic.co/u/ktpktr0)\ **Replies:** 0\ **Last updated:** [October 8, 2021, 9:47am UTC](https://discuss.elastic.co/t/parsed-json-object-hash-requires-a-target-configuration-option/286217 "2021-10-08T09:47:06Z")
My cluster architecture is elk + Kafka + filebeat. Use the following configuration to parse JSON logs: input { kafka { bootstrap\_servers =\> "192.168.1.176:9092,192.168.1.178:9092,192.168.1.177:9092" cl… --- ## [Elastic Agent built-in Filebeat](https://discuss.elastic.co/t/elastic-agent-built-in-filebeat/286214)
**Author:** [@bil\_15](https://discuss.elastic.co/u/bil_15)\ **Replies:** 0\ **Last updated:** [October 8, 2021, 9:31am UTC](https://discuss.elastic.co/t/elastic-agent-built-in-filebeat/286214 "2021-10-08T09:31:24Z")
Hello! I've installed Elastic Agent on Ubuntu and enabled AuditD integration for it (it's attached to an agent) I left all the configurations by default. Now, when I'm trying to elastic\_agent.filebeat data stream I'm … --- ## [Read Last 3 moth Historic Log from Windows Events Log](https://discuss.elastic.co/t/read-last-3-moth-historic-log-from-windows-events-log/286182)
**Author:** [@rijinmp](https://discuss.elastic.co/u/rijinmp)\ **Replies:** 1\ **Last updated:** [October 8, 2021, 9:31am UTC](https://discuss.elastic.co/t/read-last-3-moth-historic-log-from-windows-events-log/286182 "2021-10-08T09:31:07Z")
I am planning to install winlog beat in one of my Windows host. How can we read last 3 month historic logs( logs generated before the winlogbeat installation) from windows event log. My requirement is to read the… --- ## [Nested query builder inside must\_not clause does not build inner hits](https://discuss.elastic.co/t/nested-query-builder-inside-must-not-clause-does-not-build-inner-hits/286210)
**Author:** [@cip999](https://discuss.elastic.co/u/cip999)\ **Replies:** 0\ **Last updated:** [October 8, 2021, 9:07am UTC](https://discuss.elastic.co/t/nested-query-builder-inside-must-not-clause-does-not-build-inner-hits/286210 "2021-10-08T09:07:25Z")
I encountered an unexpected behavior of ES when combining must\_not and nested. Let's say I have an index my\_index with the following schema: { "mappings": { "properties": { "normal\_field": { "type":… --- ## [Maximum number of shards reached on a single node cluster](https://discuss.elastic.co/t/maximum-number-of-shards-reached-on-a-single-node-cluster/286204)
**Author:** [@NoemieB](https://discuss.elastic.co/u/NoemieB)\ **Replies:** 2\ **Last updated:** [October 8, 2021, 8:40am UTC](https://discuss.elastic.co/t/maximum-number-of-shards-reached-on-a-single-node-cluster/286204 "2021-10-08T08:40:52Z")
Hello, When creating an Index, I get the following error : "this action would add \[2\] total shards, but this cluster currently has \[1000\]/\[1000\] maximum shards open;" I found out a few posts about this issue and checke… --- ## [New master is not getting selected](https://discuss.elastic.co/t/new-master-is-not-getting-selected/286194)
**Author:** [@NutaN\_Shrivastava](https://discuss.elastic.co/u/NutaN_Shrivastava)\ **Replies:** 3\ **Last updated:** [October 8, 2021, 8:40am UTC](https://discuss.elastic.co/t/new-master-is-not-getting-selected/286194 "2021-10-08T08:40:25Z")
I have created a cluster of 3 nodes, out of which 2 are data and master and 1 is only data node. Recently due to some technical glitch one of the master nodes was down, but through out we kept getting a log msg elastic… --- ## [Datastream index template not working](https://discuss.elastic.co/t/datastream-index-template-not-working/286201)
**Author:** [@Santhosh\_CT](https://discuss.elastic.co/u/Santhosh_CT)\ **Replies:** 0\ **Last updated:** [October 8, 2021, 8:12am UTC](https://discuss.elastic.co/t/datastream-index-template-not-working/286201 "2021-10-08T08:12:34Z")
I am trying to onboard datastream into my es cluster. I have created the ilm with necessary phases, created the index template and then creating the datastream. But I am stuck at one point and not able to go forward. I … --- ## [Options list control is not case sensitive](https://discuss.elastic.co/t/options-list-control-is-not-case-sensitive/285448)
**Author:** [@Rom1](https://discuss.elastic.co/u/Rom1)\ **Replies:** 2\ **Last updated:** [October 8, 2021, 8:01am UTC](https://discuss.elastic.co/t/options-list-control-is-not-case-sensitive/285448 "2021-10-08T08:01:43Z")
Hi all, I'm using the version 7.13.4 The answers I found for this topic don't resolve my problem. It seems that the 'options list' control is not case sensitive. My mapping is: ... "template" : { "settin… --- ## [How to parse different log in logstash configuration](https://discuss.elastic.co/t/how-to-parse-different-log-in-logstash-configuration/286142)
**Author:** [@Roccof97](https://discuss.elastic.co/u/Roccof97)\ **Replies:** 2\ **Last updated:** [October 8, 2021, 7:47am UTC](https://discuss.elastic.co/t/how-to-parse-different-log-in-logstash-configuration/286142 "2021-10-08T07:47:16Z")
Hello to all, i have a problem with activemq logos i have created different types of grok, but the problem is that sometimes the message is different with additional fields and consequently it is parsed incorrectly, i… --- ## [Extract concrete words with logstash](https://discuss.elastic.co/t/extract-concrete-words-with-logstash/286139)
**Author:** [@rodri.gz](https://discuss.elastic.co/u/rodri.gz)\ **Replies:** 2\ **Last updated:** [October 8, 2021, 7:38am UTC](https://discuss.elastic.co/t/extract-concrete-words-with-logstash/286139 "2021-10-08T07:38:38Z")
Hi! I was interested in knowing if with logstash I could find words that match a pattern and extract them from the message, without parsing the whole message. For example: there has been an error on the \*\*s123s\*\* mach… --- ## [How can we update value of a field in a document in a bulk not a single document](https://discuss.elastic.co/t/how-can-we-update-value-of-a-field-in-a-document-in-a-bulk-not-a-single-document/286192)
**Author:** [@1a2k3m](https://discuss.elastic.co/u/1a2k3m)\ **Replies:** 0\ **Last updated:** [October 8, 2021, 7:12am UTC](https://discuss.elastic.co/t/how-can-we-update-value-of-a-field-in-a-document-in-a-bulk-not-a-single-document/286192 "2021-10-08T07:12:15Z")
Hi team, i am a new joiner to this discussion, i want to update field of a document in Elasticsearch on Devtools. and i want update all the document in one go, i mean to say i want to update more that 10 document in one… --- ## [When disable close\_removed, why also need disable clean\_removed](https://discuss.elastic.co/t/when-disable-close-removed-why-also-need-disable-clean-removed/286188)
**Author:** [@honghong516](https://discuss.elastic.co/u/honghong516)\ **Replies:** 0\ **Last updated:** [October 8, 2021, 7:02am UTC](https://discuss.elastic.co/t/when-disable-close-removed-why-also-need-disable-clean-removed/286188 "2021-10-08T07:02:43Z")
close\_removed edit When this option is enabled, Filebeat closes the harvester when a file is removed. Normally a file should only be removed after it’s inactive for the duration specified by close\_inactive . However, if … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1208) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1210)