# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=166 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 167 --- ## [Logstash--Need to create fields from Multi line log message which not able to get](https://discuss.elastic.co/t/logstash-need-to-create-fields-from-multi-line-log-message-which-not-able-to-get/366862)
**Author:** [@Bhanu\_Praveen](https://discuss.elastic.co/u/Bhanu_Praveen)\ **Replies:** 3\ **Last updated:** [September 23, 2024, 3:42am UTC](https://discuss.elastic.co/t/logstash-need-to-create-fields-from-multi-line-log-message-which-not-able-to-get/366862 "2024-09-23T03:42:50Z")
Hello, Below is my incoming single log message: \[2024-02-14T03:29:07.962+0000\]\[118\]\[safepoint \] Safepoint "Cleanup", Time since last: 1000174402 ns, Reaching safepoint: 9291 ns, Cleanup: 83971 ns, At safepoint: 14116… --- ## [Need an example to search incoming value in a Multi valued attribute](https://discuss.elastic.co/t/need-an-example-to-search-incoming-value-in-a-multi-valued-attribute/366917)
**Author:** [@vkrishna](https://discuss.elastic.co/u/vkrishna)\ **Replies:** 1\ **Last updated:** [September 22, 2024, 4:20pm UTC](https://discuss.elastic.co/t/need-an-example-to-search-incoming-value-in-a-multi-valued-attribute/366917 "2024-09-22T16:20:28Z")
Hi Team, I need an example to search a value in a multi valued attribute. Example: Let's say I have below documents in an index. \[ { "id":1, "lenders"=\[32,76\], "lender\_yield"=1.0 }, { "id":2, "lenders"=\[1,9\], "le… --- ## [How to deserialize SearchResponse properly in Elasticsearch Java Client](https://discuss.elastic.co/t/how-to-deserialize-searchresponse-properly-in-elasticsearch-java-client/366904)
**Author:** [@PodarcisMuralis](https://discuss.elastic.co/u/PodarcisMuralis)\ **Replies:** 1\ **Last updated:** [September 22, 2024, 4:15pm UTC](https://discuss.elastic.co/t/how-to-deserialize-searchresponse-properly-in-elasticsearch-java-client/366904 "2024-09-22T16:15:14Z")
I have Elasticsearch version 8.5.3 and many documents in my index. A document looks like this: { "myArray": \[ { "myGrocery": { "myId": "aString", "apple": "aString", "banana": aNumbe… --- ## [Disappearing kafka prometheus metricbeat data](https://discuss.elastic.co/t/disappearing-kafka-prometheus-metricbeat-data/366921)
**Author:** [@Frynaruto](https://discuss.elastic.co/u/Frynaruto)\ **Replies:** 0\ **Last updated:** [September 22, 2024, 4:04pm UTC](https://discuss.elastic.co/t/disappearing-kafka-prometheus-metricbeat-data/366921 "2024-09-22T16:04:07Z")
Hi im setting up an ELK monitoring for my kafka cluster of 5 broker/controller and prometheus. I have this issue where the active controller will report as per usual with the other brokers however after some time, some … --- ## [Custom filebeat for only streaming the data](https://discuss.elastic.co/t/custom-filebeat-for-only-streaming-the-data/366900)
**Author:** [@securityTets](https://discuss.elastic.co/u/securityTets)\ **Replies:** 1\ **Last updated:** [September 22, 2024, 1:00am UTC](https://discuss.elastic.co/t/custom-filebeat-for-only-streaming-the-data/366900 "2024-09-22T01:00:29Z")
My end goal is to make a golang binary with data streaming (log file) and writing to a different process it and write it to a different db (clickhouse) --- ## [Kibana server is not ready yet](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet/366651)
**Author:** [@17HungLe02](https://discuss.elastic.co/u/17HungLe02)\ **Replies:** 3\ **Last updated:** [September 22, 2024, 12:55am UTC](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet/366651 "2024-09-22T00:55:02Z")
Kibana server is not ready yet I installed Wazuh and ELK on the same ubuntu 22.04 machine. After the installation, I could access Kibana, then I accessed Wazuh but I couldn't access it. I restarted Wazuh, and now I ge… --- ## [VA's in elastic search](https://discuss.elastic.co/t/vas-in-elastic-search/366902)
**Author:** [@amjad](https://discuss.elastic.co/u/amjad)\ **Replies:** 0\ **Last updated:** [September 21, 2024, 6:18am UTC](https://discuss.elastic.co/t/vas-in-elastic-search/366902 "2024-09-21T06:18:41Z")
Hi All, Hope all are doing well. we are creating the users in elastic cluster with the rest api's of elastic, now We have received 3 VA's for the elasticsearch api's, Insecure HTTP methods enabled Missing Cache Contr… --- ## [Visualizing Overall Max 'Num of Events per Second' in Hour Buckets](https://discuss.elastic.co/t/visualizing-overall-max-num-of-events-per-second-in-hour-buckets/366893)
**Author:** [@Austin\_R](https://discuss.elastic.co/u/Austin_R)\ **Replies:** 1\ **Last updated:** [September 20, 2024, 11:30pm UTC](https://discuss.elastic.co/t/visualizing-overall-max-num-of-events-per-second-in-hour-buckets/366893 "2024-09-20T23:30:02Z")
I've got multiple events that come in every second to couple of seconds and I'm looking to... Count the number of events that come in for each second Group those 'events per second' in buckets of of an hour Get the ove… --- ## [Extract JSON fields from Message](https://discuss.elastic.co/t/extract-json-fields-from-message/366832)
**Author:** [@B\_H](https://discuss.elastic.co/u/B_H)\ **Replies:** 1\ **Last updated:** [September 20, 2024, 8:02pm UTC](https://discuss.elastic.co/t/extract-json-fields-from-message/366832 "2024-09-20T20:02:00Z")
I have all my desired fields coming into logstash under the message field, including the desired message. I want to pull them up one level. I am aware there are many similar topics and I have tried various techniques fro… --- ## [Provided sincedb file is ignored](https://discuss.elastic.co/t/provided-sincedb-file-is-ignored/366534)
**Author:** [@natbronislavska](https://discuss.elastic.co/u/natbronislavska)\ **Replies:** 2\ **Last updated:** [September 20, 2024, 5:43pm UTC](https://discuss.elastic.co/t/provided-sincedb-file-is-ignored/366534 "2024-09-20T17:43:23Z")
Hello, My logstash runs on EC2 and harvest data from s3. For some reasons, the logstash host machine is sometimes being terminated and replaced with new one (same AMI). In such cases lohstash's sincedb file is lost and … --- ## [Some hosts not successfully downloading Elastic Agent 8.15.1 on fleet upgrade](https://discuss.elastic.co/t/some-hosts-not-successfully-downloading-elastic-agent-8-15-1-on-fleet-upgrade/366698)
**Author:** [@DougR](https://discuss.elastic.co/u/DougR)\ **Replies:** 3\ **Last updated:** [September 20, 2024, 4:25pm UTC](https://discuss.elastic.co/t/some-hosts-not-successfully-downloading-elastic-agent-8-15-1-on-fleet-upgrade/366698 "2024-09-20T16:25:18Z")
I'm using Elastic Cloud 8.15.1. I'm attempting to update a number of on-prem hosts to Elastic Agent 8.15.1 via Fleet and am receiving the following errors: {"log.level":"info","@timestamp":"2024-09-17T19:12:04.387Z","l… --- ## [Sparse Vectors](https://discuss.elastic.co/t/sparse-vectors/366856)
**Author:** [@Harsh\_Sonaiya](https://discuss.elastic.co/u/Harsh_Sonaiya)\ **Replies:** 18\ **Last updated:** [September 20, 2024, 3:30pm UTC](https://discuss.elastic.co/t/sparse-vectors/366856 "2024-09-20T15:30:53Z")
Is there a way to create index with sparse vectors and insert sparse vectors --- ## [6.X License time running out](https://discuss.elastic.co/t/6-x-license-time-running-out/366869)
**Author:** [@Chenko](https://discuss.elastic.co/u/Chenko)\ **Replies:** 1\ **Last updated:** [September 20, 2024, 3:02pm UTC](https://discuss.elastic.co/t/6-x-license-time-running-out/366869 "2024-09-20T15:02:56Z")
Hello, I recently made this post this post basically asks what happens when Elastic 5.6's license time runs out. Now I was wondering what would happen in V6.X if the license were to run out. Any insights are appreciat… --- ## [Uptime Monitor Alert - no email received](https://discuss.elastic.co/t/uptime-monitor-alert-no-email-received/366885)
**Author:** [@Jasonespo](https://discuss.elastic.co/u/Jasonespo)\ **Replies:** 0\ **Last updated:** [September 20, 2024, 2:44pm UTC](https://discuss.elastic.co/t/uptime-monitor-alert-no-email-received/366885 "2024-09-20T14:44:56Z")
Hi, as the title suggests.... I have many heartbeat monitors setup with a target email address (to) and two (cc'ed) email addresses. I am receiving the email on the (to) email address and one of the two cc'ed email add… --- ## [Logstash to push Filebeat logs to Datadog](https://discuss.elastic.co/t/logstash-to-push-filebeat-logs-to-datadog/366849)
**Author:** [@Kalaivani\_C](https://discuss.elastic.co/u/Kalaivani_C)\ **Replies:** 0\ **Last updated:** [September 20, 2024, 6:19am UTC](https://discuss.elastic.co/t/logstash-to-push-filebeat-logs-to-datadog/366849 "2024-09-20T06:19:58Z")
I am currently working on configuring Logstash to push Filebeat logs to Datadog. I need some clarification regarding the necessity of deploying the Datadog Agent in our cluster for this purpose. Specifically, I would li… --- ## [Export CSV or table contins \*\*Split metrics by \*\* in table does not exports correctly](https://discuss.elastic.co/t/export-csv-or-table-contins-split-metrics-by-in-table-does-not-exports-correctly/361860)
**Author:** [@kishorkumar](https://discuss.elastic.co/u/kishorkumar)\ **Replies:** 1\ **Last updated:** [September 20, 2024, 12:19pm UTC](https://discuss.elastic.co/t/export-csv-or-table-contins-split-metrics-by-in-table-does-not-exports-correctly/361860 "2024-09-20T12:19:46Z")
This report table is created using lens and have used the Split metrics by to show it per day in columns my report on looks like this in lens. but when i download as csv then its messed up you can all the per da… --- ## [How to restore source-only indices and rebuild index](https://discuss.elastic.co/t/how-to-restore-source-only-indices-and-rebuild-index/366871)
**Author:** [@ACoder](https://discuss.elastic.co/u/ACoder)\ **Replies:** 0\ **Last updated:** [September 20, 2024, 10:13am UTC](https://discuss.elastic.co/t/how-to-restore-source-only-indices-and-rebuild-index/366871 "2024-09-20T10:13:16Z")
When I created the snapshot repo, I chose source-only to save space. When I restored it, I found it didn't rebuild the index. Instead of restoring it to a temporary index, then call the reindex API. Is there a simpler m… --- ## [Dynamic template create error in 8.14+ java, works in 8.12](https://discuss.elastic.co/t/dynamic-template-create-error-in-8-14-java-works-in-8-12/366639)
**Author:** [@MChambers](https://discuss.elastic.co/u/MChambers)\ **Replies:** 3\ **Last updated:** [September 20, 2024, 10:03am UTC](https://discuss.elastic.co/t/dynamic-template-create-error-in-8-14-java-works-in-8-12/366639 "2024-09-20T10:03:03Z")
When I try to create an index using a mapping that has a dynamic template that matches a type, I get this error: \[es/indices.create\] failed: \[mapper\_parsing\_exception\] Failed to parse mapping: No field type matched on \[… --- ## [5.6 License time testing/running out](https://discuss.elastic.co/t/5-6-license-time-testing-running-out/366677)
**Author:** [@Chenko](https://discuss.elastic.co/u/Chenko)\ **Replies:** 10\ **Last updated:** [September 20, 2024, 9:49am UTC](https://discuss.elastic.co/t/5-6-license-time-testing-running-out/366677 "2024-09-20T09:49:43Z")
Hello, I want to test what happens when my license runs out on 5.6. We currently have a prospect whose license will run out soon so I thought a good way to simulate this was to locally set up an Elastic 5.6 environment… --- ## [Do I need to apply index/component templates retroactively to free up shards?](https://discuss.elastic.co/t/do-i-need-to-apply-index-component-templates-retroactively-to-free-up-shards/366863)
**Author:** [@Jac\_Pettersson](https://discuss.elastic.co/u/Jac_Pettersson)\ **Replies:** 0\ **Last updated:** [September 20, 2024, 8:37am UTC](https://discuss.elastic.co/t/do-i-need-to-apply-index-component-templates-retroactively-to-free-up-shards/366863 "2024-09-20T08:37:11Z")
Hello! I have an issue that we are running out of shards in our elastic cloud cluster. (lots of errors saying: "this action would add \[2\] shards, but this cluster currently has \[2000\]/\[2000\] maximum normal shards open… --- ## [Change default view in "Discover"](https://discuss.elastic.co/t/change-default-view-in-discover/366858)
**Author:** [@KaWa](https://discuss.elastic.co/u/KaWa)\ **Replies:** 4\ **Last updated:** [September 20, 2024, 8:29am UTC](https://discuss.elastic.co/t/change-default-view-in-discover/366858 "2024-09-20T08:29:09Z")
Hi, I'd like to change the default view in "Analytics --\> Discover" from "alerts-security.alerts-default,....,-elastic-cloud-logs-" to "logs-\*". How can one do this? Thanks in advance Kai -- Version: 8.15.1 --- ## [What does 'fields' refer to in Kibana-\>Discover-\>JSON view?](https://discuss.elastic.co/t/what-does-fields-refer-to-in-kibana-discover-json-view/366776)
**Author:** [@ACoder](https://discuss.elastic.co/u/ACoder)\ **Replies:** 3\ **Last updated:** [September 20, 2024, 7:49am UTC](https://discuss.elastic.co/t/what-does-fields-refer-to-in-kibana-discover-json-view/366776 "2024-09-20T07:49:50Z")
When I analyze my indices in Discover Tab and click on a doc, and view it in JSON view: I can see a property called fields. It lists all fields in the doc. Does it have any relationship to index as in: But I only … --- ## [Find source of request using invalid API Key](https://discuss.elastic.co/t/find-source-of-request-using-invalid-api-key/366757)
**Author:** [@Steve\_Foster](https://discuss.elastic.co/u/Steve_Foster)\ **Replies:** 1\ **Last updated:** [September 20, 2024, 6:58am UTC](https://discuss.elastic.co/t/find-source-of-request-using-invalid-api-key/366757 "2024-09-20T06:58:44Z")
Hi, I've seen these in the logs for a while now but I've been able to find a way to show where the request is coming from. Authentication using apikey failed - unable to find apikey with id \ Any suggestions? --- ## [How to Disable Default Index Creation in ELK and Kibana to Save Storage Space](https://discuss.elastic.co/t/how-to-disable-default-index-creation-in-elk-and-kibana-to-save-storage-space/366785)
**Author:** [@Krishnamohan\_M](https://discuss.elastic.co/u/Krishnamohan_M)\ **Replies:** 3\ **Last updated:** [September 20, 2024, 6:14am UTC](https://discuss.elastic.co/t/how-to-disable-default-index-creation-in-elk-and-kibana-to-save-storage-space/366785 "2024-09-20T06:14:19Z")
Hi ELK Community, I'm currently facing a significant storage issue due to the default indices created by ELK and Kibana. My environment has over 40 indices, These indices are consuming a considerable amount of storage … --- ## [How to create read-only user in elastic](https://discuss.elastic.co/t/how-to-create-read-only-user-in-elastic/366749)
**Author:** [@Samantha\_V](https://discuss.elastic.co/u/Samantha_V)\ **Replies:** 4\ **Last updated:** [September 20, 2024, 4:57am UTC](https://discuss.elastic.co/t/how-to-create-read-only-user-in-elastic/366749 "2024-09-20T04:57:57Z")
Hi Team, there is a requirment to create read-only user for elastic. I tried my best but could not achieve it. I want to start from scratch. Please give me some suggestion how to achieve this. --- ## [7.17.7 logstash nokogiri-1.12.5 CVE-2022-23437](https://discuss.elastic.co/t/7-17-7-logstash-nokogiri-1-12-5-cve-2022-23437/366843)
**Author:** [@Jerry-zjl](https://discuss.elastic.co/u/Jerry-zjl)\ **Replies:** 0\ **Last updated:** [September 20, 2024, 2:47am UTC](https://discuss.elastic.co/t/7-17-7-logstash-nokogiri-1-12-5-cve-2022-23437/366843 "2024-09-20T02:47:56Z")
ask for help , do anyone know how to fix this question,I want to update nokogiri-1.12.5 to nokogiri-1.16.7,and i changed the version int the Gemfile,then i build a logstash docker image,however it doesn\`t work --- ## [Can custom logs integration in fleet ingest container logs?](https://discuss.elastic.co/t/can-custom-logs-integration-in-fleet-ingest-container-logs/365940)
**Author:** [@Abhi\_Abhishek](https://discuss.elastic.co/u/Abhi_Abhishek)\ **Replies:** 2\ **Last updated:** [September 19, 2024, 10:10pm UTC](https://discuss.elastic.co/t/can-custom-logs-integration-in-fleet-ingest-container-logs/365940 "2024-09-19T22:10:20Z")
Hi all, @warkolm @Baguette I am trying to fetch kubernetes container logs from elastic-agents, i don't want to use Kubernetes integration to get container logs, is their a way to fetch container logs from custom logs i… --- ## [Rollover action during a reindex](https://discuss.elastic.co/t/rollover-action-during-a-reindex/366821)
**Author:** [@brandon.n](https://discuss.elastic.co/u/brandon.n)\ **Replies:** 4\ **Last updated:** [September 19, 2024, 8:39pm UTC](https://discuss.elastic.co/t/rollover-action-during-a-reindex/366821 "2024-09-19T20:39:54Z")
Hello, Currently working on reindexing an old index with a massive 170ishGB single primary shard into a new datastream index, with an ILM policy of 30GB/30D. We configured for 8 primary, 1 replica, but currently the ro… --- ## [Filebeat Docker Autodiscovery stopped working when I upgraded to 8.15.1](https://discuss.elastic.co/t/filebeat-docker-autodiscovery-stopped-working-when-i-upgraded-to-8-15-1/366822)
**Author:** [@yquirion](https://discuss.elastic.co/u/yquirion)\ **Replies:** 0\ **Last updated:** [September 19, 2024, 8:24pm UTC](https://discuss.elastic.co/t/filebeat-docker-autodiscovery-stopped-working-when-i-upgraded-to-8-15-1/366822 "2024-09-19T20:24:05Z")
Hello, Today I've updated from filebeat 8.11.1 to 8.15.1, but unfortunatly I had to roll back because there was an issue with the autodiscovery option. From the forums, I've found this post: Filebeat Docker Autodiscove… --- ## [API Interface for Elastic Search Index](https://discuss.elastic.co/t/api-interface-for-elastic-search-index/366817)
**Author:** [@raylowe](https://discuss.elastic.co/u/raylowe)\ **Replies:** 3\ **Last updated:** [September 19, 2024, 6:42pm UTC](https://discuss.elastic.co/t/api-interface-for-elastic-search-index/366817 "2024-09-19T18:42:07Z")
Hi, I am having some trouble with the API interface for the Elasticsearch web crawler. Background: I have a created an Elastic search index with a web crawler. I have also created an engine using the "Elasticsearch i… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=165) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=167)