# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=152 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 153 --- ## [Integration field map error, how to fix temporarily](https://discuss.elastic.co/t/integration-field-map-error-how-to-fix-temporarily/368807)
**Author:** [@rugenl](https://discuss.elastic.co/u/rugenl)\ **Replies:** 3\ **Last updated:** [October 16, 2024, 3:53pm UTC](https://discuss.elastic.co/t/integration-field-map-error-how-to-fix-temporarily/368807 "2024-10-16T15:53:21Z")
In the Microsoft Exchange integration, message tracking, field relatedrecipeinetaddress is mapped as an IP, but it is really an email address. I've reported a bug, but until it's fixed, what is the best way to fix this? … --- ## [Updating elastic django documents conditionally based on older documents](https://discuss.elastic.co/t/updating-elastic-django-documents-conditionally-based-on-older-documents/368922)
**Author:** [@Anshu\_Garg](https://discuss.elastic.co/u/Anshu_Garg)\ **Replies:** 0\ **Last updated:** [October 16, 2024, 2:07pm UTC](https://discuss.elastic.co/t/updating-elastic-django-documents-conditionally-based-on-older-documents/368922 "2024-10-16T14:07:05Z")
Hi team, I am stuck on the below problem. Can somebody please help I am using django elasticsearch DSL and have below model structure and corresponding document class Token(AppModel): # fields f1, f2, f3 … --- ## [How to unblock .security-x index?](https://discuss.elastic.co/t/how-to-unblock-security-x-index/368918)
**Author:** [@Oleg\_G](https://discuss.elastic.co/u/Oleg_G)\ **Replies:** 0\ **Last updated:** [October 16, 2024, 1:41pm UTC](https://discuss.elastic.co/t/how-to-unblock-security-x-index/368918 "2024-10-16T13:41:41Z")
We run Elastic and Kibana in Docker. We hit the disk space limit and indices moved to read-only state. After cleaned up I tried to set them to read-write state by executing this command- $ curl -XPUT -H "Content-Type: … --- ## [Not able to create basic authentication with username and password on elasticsearch 8.15.0 and kibana 8.15.0](https://discuss.elastic.co/t/not-able-to-create-basic-authentication-with-username-and-password-on-elasticsearch-8-15-0-and-kibana-8-15-0/368820)
**Author:** [@vikascateina](https://discuss.elastic.co/u/vikascateina)\ **Replies:** 5\ **Last updated:** [October 16, 2024, 1:05pm UTC](https://discuss.elastic.co/t/not-able-to-create-basic-authentication-with-username-and-password-on-elasticsearch-8-15-0-and-kibana-8-15-0/368820 "2024-10-16T13:05:40Z")
Hi, I want that elasticsearch of 8.15.0 should connect with kibana 8.15.0 with basic authentication but kibana is giving error i.e not server yet.But it is running without basic authentication.My docker-compose file is b… --- ## [Where are logs for monitors (heartbeat?)](https://discuss.elastic.co/t/where-are-logs-for-monitors-heartbeat/368909)
**Author:** [@Dani\_Perez](https://discuss.elastic.co/u/Dani_Perez)\ **Replies:** 0\ **Last updated:** [October 16, 2024, 12:59pm UTC](https://discuss.elastic.co/t/where-are-logs-for-monitors-heartbeat/368909 "2024-10-16T12:59:04Z")
Hi, I'm using the latest version of Elastic Cloud and despite having about 50 monitors configured I'm not able to find the index or datastream where the requests are saved, I think it is not there, shouldn't it be recre… --- ## [Elastic agent goes offline & healthy every 5 minutes](https://discuss.elastic.co/t/elastic-agent-goes-offline-healthy-every-5-minutes/367215)
**Author:** [@harshpanchal](https://discuss.elastic.co/u/harshpanchal)\ **Replies:** 3\ **Last updated:** [October 16, 2024, 12:45pm UTC](https://discuss.elastic.co/t/elastic-agent-goes-offline-healthy-every-5-minutes/367215 "2024-10-16T12:45:24Z")
I have an Elastic Stack setup managed by the ECK operator on Kubernetes. I deployed a Fleet Server on Kubernetes and an Elastic Agent on a separate Alpine Linux VM for log shipping. The installation was successful, and t… --- ## [OpenShift deploy Logstash display Association backend for elasticsearch is not configured](https://discuss.elastic.co/t/openshift-deploy-logstash-display-association-backend-for-elasticsearch-is-not-configured/360380)
**Author:** [@kyocoolcool](https://discuss.elastic.co/u/kyocoolcool)\ **Replies:** 1\ **Last updated:** [October 16, 2024, 11:44am UTC](https://discuss.elastic.co/t/openshift-deploy-logstash-display-association-backend-for-elasticsearch-is-not-configured/360380 "2024-10-16T11:44:05Z")
display Association backend for elasticsearch is not configured Elasticsearch and kibana have been deployed, I've been looking for a long time and I don't know which side of the configuration is wrong. Could you… --- ## [Problem to store syslog](https://discuss.elastic.co/t/problem-to-store-syslog/368678)
**Author:** [@mmurgas](https://discuss.elastic.co/u/mmurgas)\ **Replies:** 1\ **Last updated:** [October 16, 2024, 11:34am UTC](https://discuss.elastic.co/t/problem-to-store-syslog/368678 "2024-10-16T11:34:44Z")
Hi, I am facing problem with processing of rsyslog messages by logstash. The goal is to receive syslogs from various devices, perform some filtration on base of Ip address/tags and so on and then send to different outpu… --- ## [如何用Criteria实现实现 and (a or b or c) 这种效果？](https://discuss.elastic.co/t/criteria-and-a-or-b-or-c/368900)
**Author:** [@a1248145775](https://discuss.elastic.co/u/a1248145775)\ **Replies:** 1\ **Last updated:** [October 16, 2024, 10:11am UTC](https://discuss.elastic.co/t/criteria-and-a-or-b-or-c/368900 "2024-10-16T10:11:52Z")
各位好，请教个问题，为什么用es的Criteria多个or连接在一起，最终生成的dsl只有这个or里面的最后一个？debug到org.springframework.data.elasticsearch.client.elc.CriteriaQueryProcessor#createQuery，发现should不会拿链式调用下面的内容 --- ## [Collect the logs of a website (login and signup) created by php](https://discuss.elastic.co/t/collect-the-logs-of-a-website-login-and-signup-created-by-php/368768)
**Author:** [@zakaria2](https://discuss.elastic.co/u/zakaria2)\ **Replies:** 1\ **Last updated:** [October 16, 2024, 9:55am UTC](https://discuss.elastic.co/t/collect-the-logs-of-a-website-login-and-signup-created-by-php/368768 "2024-10-16T09:55:26Z")
Hello, I created a website with php on my windows machine. I want to collect the logs of this website with kibana and logstash which are installed on a linux server. I installed filebeat on my windows machine, but I do… --- ## [Filebeat is not auto refreshing the log files](https://discuss.elastic.co/t/filebeat-is-not-auto-refreshing-the-log-files/368762)
**Author:** [@JyotiPrakash](https://discuss.elastic.co/u/JyotiPrakash)\ **Replies:** 1\ **Last updated:** [October 16, 2024, 9:36am UTC](https://discuss.elastic.co/t/filebeat-is-not-auto-refreshing-the-log-files/368762 "2024-10-16T09:36:36Z")
My file beat is running on my app server where my application code is generating , the following is the YML file for beat. --- filebeat.inputs: - type: log id: node-api enabled: true paths: - C:\\\\nod… --- ## [Transform missing documents in continuous mode](https://discuss.elastic.co/t/transform-missing-documents-in-continuous-mode/368695)
**Author:** [@Luka\_Jagmaidze](https://discuss.elastic.co/u/Luka_Jagmaidze)\ **Replies:** 0\ **Last updated:** [October 11, 2024, 3:25pm UTC](https://discuss.elastic.co/t/transform-missing-documents-in-continuous-mode/368695 "2024-10-11T15:25:42Z")
I have an issue with the transform i have created. It is aggregating on the source index which has events of the messages in it. The transform is running in continuous mode with the following options: "sync": { "t… --- ## [Not able to get multiline pattern properly for my log message](https://discuss.elastic.co/t/not-able-to-get-multiline-pattern-properly-for-my-log-message/368887)
**Author:** [@Bhanu\_Praveen](https://discuss.elastic.co/u/Bhanu_Praveen)\ **Replies:** 2\ **Last updated:** [October 16, 2024, 8:42am UTC](https://discuss.elastic.co/t/not-able-to-get-multiline-pattern-properly-for-my-log-message/368887 "2024-10-16T08:42:25Z")
Hello, Below is my log msg where i need to split multiline with "\[gc \]" text. Tried some options which doesn't work. Pls let me know the issue \[2024-10-16T00:52:58.870+0000\]\[0.013s\]\[gc \] Using G1 \[2024-10-16T… --- ## [Filebeat 8.7.1 : Logging Configurations logging.files.rotateeverybytes not working](https://discuss.elastic.co/t/filebeat-8-7-1-logging-configurations-logging-files-rotateeverybytes-not-working/368890)
**Author:** [@Nandhini\_Viswanathan](https://discuss.elastic.co/u/Nandhini_Viswanathan)\ **Replies:** 0\ **Last updated:** [October 16, 2024, 7:35am UTC](https://discuss.elastic.co/t/filebeat-8-7-1-logging-configurations-logging-files-rotateeverybytes-not-working/368890 "2024-10-16T07:35:14Z")
Hello All, I am trying to rotate the logs generated by filebeat process by setting maximum file size of 1MB by configuring logging.files.rotateeverybytes: 1048576 but logs files are getting generated more than 10 MB and… --- ## [How to make now to be dynamic in the date \> now-1M](https://discuss.elastic.co/t/how-to-make-now-to-be-dynamic-in-the-date-now-1m/368847)
**Author:** [@kishorkumar](https://discuss.elastic.co/u/kishorkumar)\ **Replies:** 1\ **Last updated:** [October 16, 2024, 7:29am UTC](https://discuss.elastic.co/t/how-to-make-now-to-be-dynamic-in-the-date-now-1m/368847 "2024-10-16T07:29:53Z")
i am trying to create last month sales lens where i have added the filter of the date \>= now-1M/M AND date \< now/M so lets i am in oct then i want to see sep sales. and if i change the end from above globla time filte… --- ## [Signals export failing frequently as more than 20 services are exporting signals to elk at the same time](https://discuss.elastic.co/t/signals-export-failing-frequently-as-more-than-20-services-are-exporting-signals-to-elk-at-the-same-time/365610)
**Author:** [@Harshul](https://discuss.elastic.co/u/Harshul)\ **Replies:** 1\ **Last updated:** [October 16, 2024, 7:19am UTC](https://discuss.elastic.co/t/signals-export-failing-frequently-as-more-than-20-services-are-exporting-signals-to-elk-at-the-same-time/365610 "2024-10-16T07:19:36Z")
I'm currently working on a test project that involves multiple services implemented in Python, Java, React, and Node.js. These services utilize OpenTelemetry for observability. The architecture is designed such that: A… --- ## [How to reduce the high score when a term appears repeatedly in a record in Elasticsearch, for example, the term 'fruit' should have a lower score in the record 'fruit' compared to 'record2 fruit xx fruit'?](https://discuss.elastic.co/t/how-to-reduce-the-high-score-when-a-term-appears-repeatedly-in-a-record-in-elasticsearch-for-example-the-term-fruit-should-have-a-lower-score-in-the-record-fruit-compared-to-record2-fruit-xx-fruit/368879)
**Author:** [@lmr520](https://discuss.elastic.co/u/lmr520)\ **Replies:** 1\ **Last updated:** [October 16, 2024, 6:06am UTC](https://discuss.elastic.co/t/how-to-reduce-the-high-score-when-a-term-appears-repeatedly-in-a-record-in-elasticsearch-for-example-the-term-fruit-should-have-a-lower-score-in-the-record-fruit-compared-to-record2-fruit-xx-fruit/368879 "2024-10-16T06:06:10Z")
How to reduce the high score when a term appears repeatedly in a record in Elasticsearch, for example, the term 'fruit' should have a lower score in the record 'fruit' compared to 'record2 fruit xx fruit'? --- ## [Using custom ingest pipeline for Filebeat Netflow](https://discuss.elastic.co/t/using-custom-ingest-pipeline-for-filebeat-netflow/368829)
**Author:** [@hjazz6](https://discuss.elastic.co/u/hjazz6)\ **Replies:** 1\ **Last updated:** [October 16, 2024, 2:33am UTC](https://discuss.elastic.co/t/using-custom-ingest-pipeline-for-filebeat-netflow/368829 "2024-10-16T02:33:58Z")
Hi, I'm using Filebeat v8.8.0, and am trying to ingest Netflow data through a custom ingest pipeline to perform IP geo-location using a database that is not Maxmind. Currently, my Netflow data is enriched using the Maxm… --- ## [Cluster does not start after updating certificates](https://discuss.elastic.co/t/cluster-does-not-start-after-updating-certificates/368795)
**Author:** [@aleksandr.komarov](https://discuss.elastic.co/u/aleksandr.komarov)\ **Replies:** 3\ **Last updated:** [October 15, 2024, 11:14pm UTC](https://discuss.elastic.co/t/cluster-does-not-start-after-updating-certificates/368795 "2024-10-15T23:14:03Z")
Our cluster's CA and node certificates have expired. We updated them by following these steps: Expired ca.crt/nodes certificates - how to renew such certificates? - Elastic Stack / Elasticsearch - Discuss the Elastic Sta… --- ## [Tagging - Correlating Between Datasets](https://discuss.elastic.co/t/tagging-correlating-between-datasets/368873)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 3\ **Last updated:** [October 15, 2024, 9:14pm UTC](https://discuss.elastic.co/t/tagging-correlating-between-datasets/368873 "2024-10-15T21:14:15Z")
Hello, I want to do something like add tags but to datasets. I know I can use an ingest pipeline and then apply it all ingest pipelines but this isn't practical as updates to tags can't be retroactive. Is it possible … --- ## [Logstash(8.15 version, running in local) not able to connect to elastic search(running in local-8.15version)](https://discuss.elastic.co/t/logstash-8-15-version-running-in-local-not-able-to-connect-to-elastic-search-running-in-local-8-15version/368736)
**Author:** [@pranchalm](https://discuss.elastic.co/u/pranchalm)\ **Replies:** 17\ **Last updated:** [October 15, 2024, 8:20pm UTC](https://discuss.elastic.co/t/logstash-8-15-version-running-in-local-not-able-to-connect-to-elastic-search-running-in-local-8-15version/368736 "2024-10-15T20:20:46Z")
I am running logstash in local and Elasticsearch too, trying to run an alreay configured pipeline on Elasticsearch, but when i m running my logstash.bat file it starts to read the pipelines.yml but the expectancy is that… --- ## [Does sort need to be applied to query for applying index-sort optimizations? What about transforms?](https://discuss.elastic.co/t/does-sort-need-to-be-applied-to-query-for-applying-index-sort-optimizations-what-about-transforms/368872)
**Author:** [@Max5](https://discuss.elastic.co/u/Max5)\ **Replies:** 0\ **Last updated:** [October 15, 2024, 8:00pm UTC](https://discuss.elastic.co/t/does-sort-need-to-be-applied-to-query-for-applying-index-sort-optimizations-what-about-transforms/368872 "2024-10-15T20:00:46Z")
I'm trying to fully understand the best way to optimize for transforms and then searching running aggregations on resulting indices. The situation: Stuck on 7.17.21 currently Non-managed cluster Conversion to data str… --- ## [Searching against runtime mapped fields](https://discuss.elastic.co/t/searching-against-runtime-mapped-fields/361597)
**Author:** [@John\_Schoonover](https://discuss.elastic.co/u/John_Schoonover)\ **Replies:** 2\ **Last updated:** [October 15, 2024, 6:11pm UTC](https://discuss.elastic.co/t/searching-against-runtime-mapped-fields/361597 "2024-10-15T18:11:13Z")
Hey all! Long-time user, first-time poster! I've been trying to figure out a problem we're seeing with some unique search behavior on runtime fields when using CCS. REF: Runtime fields in a search request When done o… --- ## [Pipeline not created during setup of packetbeat 8.15.1 on windows](https://discuss.elastic.co/t/pipeline-not-created-during-setup-of-packetbeat-8-15-1-on-windows/366656)
**Author:** [@drops](https://discuss.elastic.co/u/drops)\ **Replies:** 4\ **Last updated:** [October 15, 2024, 5:50pm UTC](https://discuss.elastic.co/t/pipeline-not-created-during-setup-of-packetbeat-8-15-1-on-windows/366656 "2024-10-15T17:50:32Z")
{"log.level":"warn","@timestamp":"2024-09-17T09:27:50.421+0200","log.logger":"elasticsearch","log.origin":{"function":"github.com/elastic/beats/v7/libbeat/outputs/elasticsearch.(Client).applyItemStatus","file.name":"elas… --- ## [Old old Windows Server 2008 vs filebeat v.x](https://discuss.elastic.co/t/old-old-windows-server-2008-vs-filebeat-v-x/362343)
**Author:** [@stefws](https://discuss.elastic.co/u/stefws)\ **Replies:** 5\ **Last updated:** [October 15, 2024, 3:05pm UTC](https://discuss.elastic.co/t/old-old-windows-server-2008-vs-filebeat-v-x/362343 "2024-10-15T15:05:19Z")
I know it's very old, but for various legacy purposes we still have a few old Windows Server 2008 in the back of our data center, running on their last breath, meanwhile we want to monitoring a legacy App's log files, on… --- ## [Import as nested type](https://discuss.elastic.co/t/import-as-nested-type/368733)
**Author:** [@os17](https://discuss.elastic.co/u/os17)\ **Replies:** 1\ **Last updated:** [October 15, 2024, 3:04pm UTC](https://discuss.elastic.co/t/import-as-nested-type/368733 "2024-10-15T15:04:35Z")
Hello, I'm trying to import parent-child data. Here is my config file: input{ jdbc{ jdbc\_driver\_library =\> "/usr/library/postgresql-42.7.4.jar" jdbc\_connection\_string =\> "jdbc:postgresql://185.\*\*.\*… --- ## [Using values from an array as field names to contain values from another array](https://discuss.elastic.co/t/using-values-from-an-array-as-field-names-to-contain-values-from-another-array/368478)
**Author:** [@ccweirsw](https://discuss.elastic.co/u/ccweirsw)\ **Replies:** 5\ **Last updated:** [October 15, 2024, 2:58pm UTC](https://discuss.elastic.co/t/using-values-from-an-array-as-field-names-to-contain-values-from-another-array/368478 "2024-10-15T14:58:44Z")
I am ingesting event logs from Office 365. Some of these documents contain objects that look like this: "DeviceProperties": \[ { "Value": "Windows10", "Name": "OS" }, … --- ## [Retention errors in Transforms](https://discuss.elastic.co/t/retention-errors-in-transforms/368747)
**Author:** [@venkatkumar229](https://discuss.elastic.co/u/venkatkumar229)\ **Replies:** 1\ **Last updated:** [October 15, 2024, 2:45pm UTC](https://discuss.elastic.co/t/retention-errors-in-transforms/368747 "2024-10-15T14:45:19Z")
Hi Team, We are using transforms in our cluster and we have applied retention in the transforms for 90 days. But now a days we are frequently seeing below warnings in transforms. Could you please help me to understand t… --- ## [BUG: Wrong visualizations rendered when using buttons/links](https://discuss.elastic.co/t/bug-wrong-visualizations-rendered-when-using-buttons-links/368850)
**Author:** [@sacalata](https://discuss.elastic.co/u/sacalata)\ **Replies:** 1\ **Last updated:** [October 15, 2024, 1:44pm UTC](https://discuss.elastic.co/t/bug-wrong-visualizations-rendered-when-using-buttons-links/368850 "2024-10-15T13:44:02Z")
When using markdown buttons to other dashboards, like this: '\[Button Text\] (/s/project/app/dashboards#/view/dashboardId)' The wrong visualizations get loaded when you click the button, if it's dashboard X with a button… --- ## [I am trying to setup elk on docker, but it is not pulling data from my log file which already has data](https://discuss.elastic.co/t/i-am-trying-to-setup-elk-on-docker-but-it-is-not-pulling-data-from-my-log-file-which-already-has-data/368833)
**Author:** [@Manak\_Wadhwa](https://discuss.elastic.co/u/Manak_Wadhwa)\ **Replies:** 2\ **Last updated:** [October 15, 2024, 12:51pm UTC](https://discuss.elastic.co/t/i-am-trying-to-setup-elk-on-docker-but-it-is-not-pulling-data-from-my-log-file-which-already-has-data/368833 "2024-10-15T12:51:04Z")
This is my logstash config: input { file { path =\> \["/Users/newlap/Desktop/newap/Logs/service-logs.log"\] } } filter {} output { elasticsearch { index =\> "logs-%{+YYYY.MM.dd}" hosts =\> \["https://e… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=151) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=153)