# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=156 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 157 --- ## [Create snapshot](https://discuss.elastic.co/t/create-snapshot/363915)
**Author:** [@dsagent](https://discuss.elastic.co/u/dsagent)\ **Replies:** 15\ **Last updated:** [July 28, 2024, 5:49pm UTC](https://discuss.elastic.co/t/create-snapshot/363915 "2024-07-28T17:49:03Z")
I have a node1, node2, node3 contract in several places and I want to make a snapshot of a specific indicator that is available for example in node2 I made the path.repo in the configuration file for each node and when… --- ## [Unclear minhash filter behavior in near-duplicate detection for short texts](https://discuss.elastic.co/t/unclear-minhash-filter-behavior-in-near-duplicate-detection-for-short-texts/368561)
**Author:** [@m-sean](https://discuss.elastic.co/u/m-sean)\ **Replies:** 1\ **Last updated:** [October 9, 2024, 8:29pm UTC](https://discuss.elastic.co/t/unclear-minhash-filter-behavior-in-near-duplicate-detection-for-short-texts/368561 "2024-10-09T20:29:51Z")
I am working on a solution for near-duplicate detection of short texts (social media, review, snippetized articles, etc). I have been attempting to configure the MinHash filter per the documentation. I have set the para… --- ## [Create a search for IOCs](https://discuss.elastic.co/t/create-a-search-for-iocs/368532)
**Author:** [@JA\_cintegration](https://discuss.elastic.co/u/JA_cintegration)\ **Replies:** 0\ **Last updated:** [October 9, 2024, 1:17pm UTC](https://discuss.elastic.co/t/create-a-search-for-iocs/368532 "2024-10-09T13:17:54Z")
Trying to create a query search for IPs found in the last 24 hours. I have been testing with: GET /index/\_search { "query": { "match": { "event.category": "network" } } } Or: POST /\*index\_name\*/\_as… --- ## [Need Help in understanding how to convert Datastreams to Regular Index](https://discuss.elastic.co/t/need-help-in-understanding-how-to-convert-datastreams-to-regular-index/368113)
**Author:** [@kushalOtter](https://discuss.elastic.co/u/kushalOtter)\ **Replies:** 4\ **Last updated:** [October 9, 2024, 7:46pm UTC](https://discuss.elastic.co/t/need-help-in-understanding-how-to-convert-datastreams-to-regular-index/368113 "2024-10-09T19:46:45Z")
Hi all, So we are using EFK stack for logging purposes. We have ES at 7.17.23 and filebeat at 7 version. Unfortunately on some of the machines, the filebeat got upgraded to 8 , it forcefully modified the Index template … --- ## [How I can do rollover log with serilog app?](https://discuss.elastic.co/t/how-i-can-do-rollover-log-with-serilog-app/368559)
**Author:** [@felipej](https://discuss.elastic.co/u/felipej)\ **Replies:** 0\ **Last updated:** [October 9, 2024, 7:29pm UTC](https://discuss.elastic.co/t/how-i-can-do-rollover-log-with-serilog-app/368559 "2024-10-09T19:29:48Z")
Hello guys. I have some apps .net running in my environment. My apps are using serilog to send logs to Elasticsearch. We aren't use any plugin or middle to do this, like logstash, filebeat, etc. When I leave the app to… --- ## [Logstash not getting complete msg from filebeats, might be due to length](https://discuss.elastic.co/t/logstash-not-getting-complete-msg-from-filebeats-might-be-due-to-length/368552)
**Author:** [@Bhanu\_Praveen](https://discuss.elastic.co/u/Bhanu_Praveen)\ **Replies:** 0\ **Last updated:** [October 9, 2024, 5:55pm UTC](https://discuss.elastic.co/t/logstash-not-getting-complete-msg-from-filebeats-might-be-due-to-length/368552 "2024-10-09T17:55:43Z")
Hello, Below is the multiline log msg coming into logstash\[Not able to post the whole log here also due to max char issue\], but some lines are missing in Msg field, pls let me know the issue for fix \[2024-10-09T07:04:4… --- ## [Logstash config advise](https://discuss.elastic.co/t/logstash-config-advise/368415)
**Author:** [@Athen](https://discuss.elastic.co/u/Athen)\ **Replies:** 22\ **Last updated:** [October 9, 2024, 5:48pm UTC](https://discuss.elastic.co/t/logstash-config-advise/368415 "2024-10-09T17:48:10Z")
Hi Team, I'm new to ELK and have deployed the ELK stack (Elasticsearch, Logstash, and Kibana) in Kubernetes and exposed Logstash via a Traefik ingress route to allow external servers to send logs. However, I am encounte… --- ## [Splitting a field that looks like an array](https://discuss.elastic.co/t/splitting-a-field-that-looks-like-an-array/368540)
**Author:** [@cdy5159](https://discuss.elastic.co/u/cdy5159)\ **Replies:** 7\ **Last updated:** [October 9, 2024, 4:45pm UTC](https://discuss.elastic.co/t/splitting-a-field-that-looks-like-an-array/368540 "2024-10-09T16:45:30Z")
I'm getting audit data from my linux hosts that will sometimes repeat a field name, so I get what looks like an array of data in that field. I've tried various forms of 'split' to see if I can separate the data into two… --- ## [Need help with search\_after and PIT for deep pagination](https://discuss.elastic.co/t/need-help-with-search-after-and-pit-for-deep-pagination/368484)
**Author:** [@jax020](https://discuss.elastic.co/u/jax020)\ **Replies:** 11\ **Last updated:** [October 9, 2024, 4:26pm UTC](https://discuss.elastic.co/t/need-help-with-search-after-and-pit-for-deep-pagination/368484 "2024-10-09T16:26:33Z")
okay so i need help. i am currently working on a project where millions of documents have to be displayed. Currently, there are 50 documents on each page, and there are 200 pages, totaling 10,000 documents. however, i wa… --- ## [Dynamically create fields from another field with json input file](https://discuss.elastic.co/t/dynamically-create-fields-from-another-field-with-json-input-file/368508)
**Author:** [@remich](https://discuss.elastic.co/u/remich)\ **Replies:** 8\ **Last updated:** [October 9, 2024, 4:11pm UTC](https://discuss.elastic.co/t/dynamically-create-fields-from-another-field-with-json-input-file/368508 "2024-10-09T16:11:58Z")
Hi, I have json input that contains appname with their version and other field with standard string like : { "app1": "1.2.3", "app2": "3.2.1", "arch": "virtual" } I would like to be able to use filter versions i… --- ## [Does Kibana have a video player widget?](https://discuss.elastic.co/t/does-kibana-have-a-video-player-widget/368545)
**Author:** [@sami-obvio](https://discuss.elastic.co/u/sami-obvio)\ **Replies:** 1\ **Last updated:** [October 9, 2024, 4:07pm UTC](https://discuss.elastic.co/t/does-kibana-have-a-video-player-widget/368545 "2024-10-09T16:07:19Z")
I want to read a DB which has a video URL field - I want to render and play that video in a Kibana dashboard Is there a Kibana widget to play videos via loading them with a URL? I couldn't find one Thanks --- ## [CCR KSPM Data](https://discuss.elastic.co/t/ccr-kspm-data/368541)
**Author:** [@karnamonkster](https://discuss.elastic.co/u/karnamonkster)\ **Replies:** 0\ **Last updated:** [October 9, 2024, 2:53pm UTC](https://discuss.elastic.co/t/ccr-kspm-data/368541 "2024-10-09T14:53:11Z")
As suggested in the past, for using the KSPM on the SIEM Module, we need to use the Elastic Agent integration for our k8s clusters. Now if in case this data is read over CCR, what changes needs to be done other than map… --- ## [Widows file server crawling and indexing](https://discuss.elastic.co/t/widows-file-server-crawling-and-indexing/368531)
**Author:** [@Tuncay\_Gunduz](https://discuss.elastic.co/u/Tuncay_Gunduz)\ **Replies:** 1\ **Last updated:** [October 9, 2024, 2:22pm UTC](https://discuss.elastic.co/t/widows-file-server-crawling-and-indexing/368531 "2024-10-09T14:22:56Z")
Hi I m new to Elastic search. I looking into this if feasible as on premises Install Elastic on a linux server (on premises) Index our files located on windows server (on premises - same LAN) search from a basic page… --- ## [Possible to access sibling aggregation value within sibling child aggregation?](https://discuss.elastic.co/t/possible-to-access-sibling-aggregation-value-within-sibling-child-aggregation/368537)
**Author:** [@jlrivera81](https://discuss.elastic.co/u/jlrivera81)\ **Replies:** 0\ **Last updated:** [October 9, 2024, 1:54pm UTC](https://discuss.elastic.co/t/possible-to-access-sibling-aggregation-value-within-sibling-child-aggregation/368537 "2024-10-09T13:54:51Z")
Hello, I have a test pipeline that is triggered for every code commit. The code commit has a unique "revision" and you can determine commit-order based on the revision's associated "revision\_order". Additionally, each… --- ## [Does Elastic internally perform 'query' and 'suggest' requests in parallel?](https://discuss.elastic.co/t/does-elastic-internally-perform-query-and-suggest-requests-in-parallel/368536)
**Author:** [@alliswell](https://discuss.elastic.co/u/alliswell)\ **Replies:** 0\ **Last updated:** [October 9, 2024, 1:40pm UTC](https://discuss.elastic.co/t/does-elastic-internally-perform-query-and-suggest-requests-in-parallel/368536 "2024-10-09T13:40:42Z")
Elastics search provides feature to get search results and suggestions in a single request, reducing network overhead. POST my-index-000001/\_search { "query" : { "match": { "message": "tring out Elasticsearc… --- ## [Gatling test on ES EKS cluster](https://discuss.elastic.co/t/gatling-test-on-es-eks-cluster/368295)
**Author:** [@INS](https://discuss.elastic.co/u/INS)\ **Replies:** 6\ **Last updated:** [October 9, 2024, 11:13am UTC](https://discuss.elastic.co/t/gatling-test-on-es-eks-cluster/368295 "2024-10-09T11:13:38Z")
Maybe someone has some expierence in performing gatling test on Elasticsearch? Indeed I'm interesting on query responses time, I have a cluster build on 10 data nodes(14 CPU handling ES) with 52GB RAMnodes a 3(6CPU) mast… --- ## [Extraxt data from a strin in a shown in a data table](https://discuss.elastic.co/t/extraxt-data-from-a-strin-in-a-shown-in-a-data-table/368439)
**Author:** [@vaibhav\_dahmival](https://discuss.elastic.co/u/vaibhav_dahmival)\ **Replies:** 1\ **Last updated:** [October 9, 2024, 7:46am UTC](https://discuss.elastic.co/t/extraxt-data-from-a-strin-in-a-shown-in-a-data-table/368439 "2024-10-09T07:46:58Z")
I was creating a dashboard, when i tried creating a data table selected the field i want to add. But i only wanted the first 3 digits from that string. Could you guys help me with it on how to do it. there were some solu… --- ## [Umbrella S3 logs weird format when using CSV filter](https://discuss.elastic.co/t/umbrella-s3-logs-weird-format-when-using-csv-filter/368502)
**Author:** [@danielpaiva](https://discuss.elastic.co/u/danielpaiva)\ **Replies:** 0\ **Last updated:** [October 9, 2024, 7:39am UTC](https://discuss.elastic.co/t/umbrella-s3-logs-weird-format-when-using-csv-filter/368502 "2024-10-09T07:39:07Z")
Hello ! I'm currently working on pulling Cisco Umbrella logs from S3 buckets with Logstash and s3 input and I'm dealing with a weird behavior. When using only the s3 input and sending the logs to Elastic, it works like… --- ## [Multilingual-e5 sparse vector support](https://discuss.elastic.co/t/multilingual-e5-sparse-vector-support/368497)
**Author:** [@czek0](https://discuss.elastic.co/u/czek0)\ **Replies:** 0\ **Last updated:** [October 9, 2024, 7:10am UTC](https://discuss.elastic.co/t/multilingual-e5-sparse-vector-support/368497 "2024-10-09T07:10:21Z")
Hello Upon investigatoing into your examples for the miltilingual-e5-base, I see you are using the dense vector type as the passage\_embedding. Is it possible to use sparse vector types as the passage\_embedding? And how … --- ## [Logstash not parsing eventhub logs](https://discuss.elastic.co/t/logstash-not-parsing-eventhub-logs/366816)
**Author:** [@vaibhavu](https://discuss.elastic.co/u/vaibhavu)\ **Replies:** 10\ **Last updated:** [October 9, 2024, 6:16am UTC](https://discuss.elastic.co/t/logstash-not-parsing-eventhub-logs/366816 "2024-10-09T06:16:59Z")
Hi Everyone , I am working on parsing the logs from Azure eventhub to Elasticsearch and trying to use logstash filter for this but getting \_jsonparsing error for the logs. the logs structure is someting like below: {"… --- ## [Reallocate shards from DR to PR](https://discuss.elastic.co/t/reallocate-shards-from-dr-to-pr/368492)
**Author:** [@Sandeepa\_Kariyawasam](https://discuss.elastic.co/u/Sandeepa_Kariyawasam)\ **Replies:** 0\ **Last updated:** [October 9, 2024, 6:15am UTC](https://discuss.elastic.co/t/reallocate-shards-from-dr-to-pr/368492 "2024-10-09T06:15:54Z")
Hello, I have an elastic cluster with seven PR nodes and three DR nodes. All nodes are either master, hot or warm configured. My primary and replica shards are distributed randomly in between the PR and DR nodes in the… --- ## [Elastic Fleet API Permissions](https://discuss.elastic.co/t/elastic-fleet-api-permissions/368474)
**Author:** [@elasticfantastik](https://discuss.elastic.co/u/elasticfantastik)\ **Replies:** 2\ **Last updated:** [October 8, 2024, 8:16pm UTC](https://discuss.elastic.co/t/elastic-fleet-api-permissions/368474 "2024-10-08T20:16:44Z")
We have an elastic stack setup, along with fleet to manage our elastic agents. However, due to a number of technical reasons: We have to manually deploy updates to certain agents. We are limited to accessing Kibana onl… --- ## [Not able to log on](https://discuss.elastic.co/t/not-able-to-log-on/368377)
**Author:** [@jleroux1](https://discuss.elastic.co/u/jleroux1)\ **Replies:** 4\ **Last updated:** [October 8, 2024, 4:09pm UTC](https://discuss.elastic.co/t/not-able-to-log-on/368377 "2024-10-08T16:09:26Z")
Hi, I'm new to elastic cloud. I created a superuser in kibana. Not able to logon...bad user name or password. I've checked the documentation. What do I mist ? Thank in advance :slight\_smile: --- ## [Can not start elasticsearch client using fscrawler](https://discuss.elastic.co/t/can-not-start-elasticsearch-client-using-fscrawler/367229)
**Author:** [@Vaci](https://discuss.elastic.co/u/Vaci)\ **Replies:** 3\ **Last updated:** [October 8, 2024, 12:58pm UTC](https://discuss.elastic.co/t/can-not-start-elasticsearch-client-using-fscrawler/367229 "2024-10-08T12:58:26Z")
I am using elasticsearch 8.15.1 and fscrawler 2.10 to do index some files. I am running the files using ./bin/elasticsearch and ./bin/fscrawler to run the files and not using docker. I have disabled all the authenticati… --- ## [Facing Rate limiting issue in my elastic search cluster](https://discuss.elastic.co/t/facing-rate-limiting-issue-in-my-elastic-search-cluster/368435)
**Author:** [@Rajat\_Jainwal](https://discuss.elastic.co/u/Rajat_Jainwal)\ **Replies:** 5\ **Last updated:** [October 8, 2024, 12:53pm UTC](https://discuss.elastic.co/t/facing-rate-limiting-issue-in-my-elastic-search-cluster/368435 "2024-10-08T12:53:47Z")
I have a k8s cluster which as 3 ES nodes deployed & this es cluster is used by another pod In the logs of my pod I see logs like Node \ has failed for 1 times in a row… --- ## [Filebeat filestream reads the files from last line after service restart](https://discuss.elastic.co/t/filebeat-filestream-reads-the-files-from-last-line-after-service-restart/368425)
**Author:** [@jack\_a](https://discuss.elastic.co/u/jack_a)\ **Replies:** 4\ **Last updated:** [October 8, 2024, 11:58am UTC](https://discuss.elastic.co/t/filebeat-filestream-reads-the-files-from-last-line-after-service-restart/368425 "2024-10-08T11:58:02Z")
how can i setup filebeat so after each filebeat service restart it start reading the files from last line and stop it from reading the file from beginning. i have a config like the following: filebeat.inputs: - type: f… --- ## [Watcher feature not available after upgrading Elasticsearch to version 8.15.2](https://discuss.elastic.co/t/watcher-feature-not-available-after-upgrading-elasticsearch-to-version-8-15-2/368437)
**Author:** [@ErGeek](https://discuss.elastic.co/u/ErGeek)\ **Replies:** 0\ **Last updated:** [October 8, 2024, 11:17am UTC](https://discuss.elastic.co/t/watcher-feature-not-available-after-upgrading-elasticsearch-to-version-8-15-2/368437 "2024-10-08T11:17:41Z")
Hi All, We recently upgraded Elasticsearch from version 7.17.9 to version 8.15.2. Earlier , we had set up watchers in the Management tab inside alerts. But after the upgrade we are unable to see the Watcher option . Is … --- ## [Unable to login to Elastic Cloud using Microsoft login](https://discuss.elastic.co/t/unable-to-login-to-elastic-cloud-using-microsoft-login/368393)
**Author:** [@cpua](https://discuss.elastic.co/u/cpua)\ **Replies:** 7\ **Last updated:** [October 8, 2024, 10:10am UTC](https://discuss.elastic.co/t/unable-to-login-to-elastic-cloud-using-microsoft-login/368393 "2024-10-08T10:10:51Z")
For the past weeks I am able to login to Elastic cloud to configure the server and indices. But today I am unable to login to my Elastic cloud. I have provision it using Azure Elasticsearch. Is there any changes or maint… --- ## [Disable Kibana Help button](https://discuss.elastic.co/t/disable-kibana-help-button/368429)
**Author:** [@arT1](https://discuss.elastic.co/u/arT1)\ **Replies:** 0\ **Last updated:** [October 8, 2024, 10:06am UTC](https://discuss.elastic.co/t/disable-kibana-help-button/368429 "2024-10-08T10:06:01Z")
is there any way to remove or hide the help button? --- ## [Unable to check permissions in Fleet](https://discuss.elastic.co/t/unable-to-check-permissions-in-fleet/368324)
**Author:** [@Muni](https://discuss.elastic.co/u/Muni)\ **Replies:** 2\ **Last updated:** [October 8, 2024, 10:03am UTC](https://discuss.elastic.co/t/unable-to-check-permissions-in-fleet/368324 "2024-10-08T10:03:16Z")
Hi , We are unable to access the fleet and we are getting the error unable to check permission. [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=155) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=157)