# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1743 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1744 --- ## [Ingesting Crowdstrike events](https://discuss.elastic.co/t/ingesting-crowdstrike-events/252583)
**Author:** [@darkbeatz](https://discuss.elastic.co/u/darkbeatz)\ **Replies:** 0\ **Last updated:** [October 19, 2020, 4:48pm UTC](https://discuss.elastic.co/t/ingesting-crowdstrike-events/252583 "2020-10-19T16:48:43Z")
Hi All, If I want to bring in events from crowdstrike falcon to elastic siem, is there guidance you can give me to help me plan for storage requirements on elastic? Thanks --- ## [Text search in Kibana](https://discuss.elastic.co/t/text-search-in-kibana/249157)
**Author:** [@fredrick.bb](https://discuss.elastic.co/u/fredrick.bb)\ **Replies:** 1\ **Last updated:** [September 24, 2020, 5:02pm UTC](https://discuss.elastic.co/t/text-search-in-kibana/249157 "2020-09-24T17:02:33Z")
Hello, I have application log message with following details as message : " some message; partition=-1;offset=-1;lag=275545;RetryCount=0; some message ". All my message will have "lag=". "lag" is a key comes as a… --- ## [How to tag or star rows in kibana to find later](https://discuss.elastic.co/t/how-to-tag-or-star-rows-in-kibana-to-find-later/252426)
**Author:** [@dnides](https://discuss.elastic.co/u/dnides)\ **Replies:** 1\ **Last updated:** [October 19, 2020, 4:11pm UTC](https://discuss.elastic.co/t/how-to-tag-or-star-rows-in-kibana-to-find-later/252426 "2020-10-19T16:11:09Z")
Trying to determine a way during log review to “tag”, “star”, or add a user defined comment so I can later simply search for those rows. Any such way of accomplishing this? Sounds like possibly via a plugin but how do I … --- ## [Running Two or more Elasticsearch clusters on one machine](https://discuss.elastic.co/t/running-two-or-more-elasticsearch-clusters-on-one-machine/252257)
**Author:** [@bretonj](https://discuss.elastic.co/u/bretonj)\ **Replies:** 1\ **Last updated:** [October 19, 2020, 3:19pm UTC](https://discuss.elastic.co/t/running-two-or-more-elasticsearch-clusters-on-one-machine/252257 "2020-10-19T15:19:59Z")
I'm trying to get a second elasticsearch cluster running on a machine which already has a cluster. I have 7.9.2 installed on Ubuntu 18.04, and it's working properly. I created a new service file for the new cluster, new … --- ## [Elastic 7.10 field type "version"](https://discuss.elastic.co/t/elastic-7-10-field-type-version/252545)
**Author:** [@videns](https://discuss.elastic.co/u/videns)\ **Replies:** 4\ **Last updated:** [October 19, 2020, 3:00pm UTC](https://discuss.elastic.co/t/elastic-7-10-field-type-version/252545 "2020-10-19T15:00:11Z")
First, create new index with mappings, one field has type "version": curl -X PUT "localhost:9200/version\_test\_v2?pretty" -H 'Content-Type: application/json' -d' { "mappings": { "properties": { "version": { … --- ## [\[IPV6 Only\]: FileBeat Integration to Push Logs on KAFKA Topic](https://discuss.elastic.co/t/ipv6-only-filebeat-integration-to-push-logs-on-kafka-topic/252504)
**Author:** [@PatelRudra](https://discuss.elastic.co/u/PatelRudra)\ **Replies:** 1\ **Last updated:** [October 19, 2020, 2:29pm UTC](https://discuss.elastic.co/t/ipv6-only-filebeat-integration-to-push-logs-on-kafka-topic/252504 "2020-10-19T14:29:32Z")
Hello Community, Hope you are doing good in this pandemic. I want to integrate FileBeat with Kafka, only on IPV6 K8S Cluster. But I am getting the error " Failed to connect to broker http://\[240b:x:x:x:x:x:x:5001\]:323… --- ## [Linux Disk IOPS](https://discuss.elastic.co/t/linux-disk-iops/252529)
**Author:** [@fabiansc](https://discuss.elastic.co/u/fabiansc)\ **Replies:** 1\ **Last updated:** [October 19, 2020, 2:09pm UTC](https://discuss.elastic.co/t/linux-disk-iops/252529 "2020-10-19T14:09:51Z")
Hello! I am looking for gathering IOPS information for Azure VMs using Elastics Metricsbeats. We are currently running on metricbeat 7.7 per user (optional: per process). Is there any possibility to gather this kind of… --- ## [Filebeat processor help](https://discuss.elastic.co/t/filebeat-processor-help/252516)
**Author:** [@Kay\_Khan](https://discuss.elastic.co/u/Kay_Khan)\ **Replies:** 1\ **Last updated:** [October 19, 2020, 2:04pm UTC](https://discuss.elastic.co/t/filebeat-processor-help/252516 "2020-10-19T14:04:01Z")
Hey i need some help with filebeat processors. I want to decode\_json\_fields if the kubernetes.container.name is equal to 1 or more values. processors: - add\_cloud\_metadata: - add\_host\_metadata: - de… --- ## [New users do not receive mails and can not log in](https://discuss.elastic.co/t/new-users-do-not-receive-mails-and-can-not-log-in/252496)
**Author:** [@Matteo\_Fiore](https://discuss.elastic.co/u/Matteo_Fiore)\ **Replies:** 3\ **Last updated:** [October 19, 2020, 2:02pm UTC](https://discuss.elastic.co/t/new-users-do-not-receive-mails-and-can-not-log-in/252496 "2020-10-19T14:02:15Z")
Hello, I am having some problems creating new users and granting them access. What I am doing Stack Management \> Users \> Create User When trying to log in with the new user I receive "Invalid username or password. Pl… --- ## [Installing xpack plugin on 7.7.1 elastic](https://discuss.elastic.co/t/installing-xpack-plugin-on-7-7-1-elastic/252397)
**Author:** [@txmrlevine](https://discuss.elastic.co/u/txmrlevine)\ **Replies:** 4\ **Last updated:** [October 19, 2020, 1:54pm UTC](https://discuss.elastic.co/t/installing-xpack-plugin-on-7-7-1-elastic/252397 "2020-10-19T13:54:23Z")
I am trying to set up security on my stack. looks like from what I can see version 7.7.1 should have the plugin available to install but when I go to install it I only get this . ./elasticsearch-plugin install xpack -\>… --- ## [About TranslogWriter.assertNoSeqNumberConflict](https://discuss.elastic.co/t/about-translogwriter-assertnoseqnumberconflict/252521)
**Author:** [@kimnwuchong](https://discuss.elastic.co/u/kimnwuchong)\ **Replies:** 1\ **Last updated:** [October 19, 2020, 1:32pm UTC](https://discuss.elastic.co/t/about-translogwriter-assertnoseqnumberconflict/252521 "2020-10-19T13:32:10Z")
before process assertNoSeqNumberConflict, the tranlog has already added。i think the assert is not necessary。 --- ## [Enabling security in a cluster with two nodes in Elasticsearch](https://discuss.elastic.co/t/enabling-security-in-a-cluster-with-two-nodes-in-elasticsearch/252536)
**Author:** [@Techmod](https://discuss.elastic.co/u/Techmod)\ **Replies:** 3\ **Last updated:** [October 19, 2020, 1:09pm UTC](https://discuss.elastic.co/t/enabling-security-in-a-cluster-with-two-nodes-in-elasticsearch/252536 "2020-10-19T13:09:51Z")
Hi There, I'm trying to enable security feature in Elasticsearch nodes but whenever I turn on "xpack.security.enabled: true" , my Elasticsearch won't start at all. How can I resolve this? here's my configuration on bot… --- ## [Make apache.status.uptime.server\_uptime human readable](https://discuss.elastic.co/t/make-apache-status-uptime-server-uptime-human-readable/252405)
**Author:** [@prophoto](https://discuss.elastic.co/u/prophoto)\ **Replies:** 3\ **Last updated:** [October 19, 2020, 12:44pm UTC](https://discuss.elastic.co/t/make-apache-status-uptime-server-uptime-human-readable/252405 "2020-10-19T12:44:58Z")
How do I convert apache.status.uptime.server\_uptime to human readable format and display it in a Visualization? I've tried multiple times in a scripted field but can't seem to get that to work either. Thanks. --- ## [Index Lifecycle Allocation Routed Step failing with NullPtrException](https://discuss.elastic.co/t/index-lifecycle-allocation-routed-step-failing-with-nullptrexception/252331)
**Author:** [@Benjamin\_saiz](https://discuss.elastic.co/u/Benjamin_saiz)\ **Replies:** 4\ **Last updated:** [October 19, 2020, 12:39pm UTC](https://discuss.elastic.co/t/index-lifecycle-allocation-routed-step-failing-with-nullptrexception/252331 "2020-10-19T12:39:40Z")
We are running an ElasticSearch 6.8.8 cluster. We just implemented ILM for our indexes. Here is our ILM Policy : { "policy": { "phases": { /\* Hot phase - Resync Priority 100 \*/ … --- ## [Filebeat scan frequency](https://discuss.elastic.co/t/filebeat-scan-frequency/251138)
**Author:** [@gizem](https://discuss.elastic.co/u/gizem)\ **Replies:** 3\ **Last updated:** [October 19, 2020, 12:11pm UTC](https://discuss.elastic.co/t/filebeat-scan-frequency/251138 "2020-10-19T12:11:09Z")
Hi, In filebeat configuration file, there is scan\_frequency option. But I am confused about is scan frequency define the scanning new files in the path or scanning updates(new lines) in a file. If the scan frequency ch… --- ## [Ingest Node Pipeline doesn't allow for "\\\[" pattern](https://discuss.elastic.co/t/ingest-node-pipeline-doesnt-allow-for-pattern/250227)
**Author:** [@madduck](https://discuss.elastic.co/u/madduck)\ **Replies:** 2\ **Last updated:** [October 19, 2020, 12:08pm UTC](https://discuss.elastic.co/t/ingest-node-pipeline-doesnt-allow-for-pattern/250227 "2020-10-19T12:08:33Z")
Hi gang, I'm trying to parse some logs into my index but I always get the GROK error: "Provided Grok expressions do not match field value" Error Message Provided Grok expressions do not match field value: \[Sep 28 17:1… --- ## [Value of index.blocks.write is auto changed to false](https://discuss.elastic.co/t/value-of-index-blocks-write-is-auto-changed-to-false/252207)
**Author:** [@kamils468](https://discuss.elastic.co/u/kamils468)\ **Replies:** 2\ **Last updated:** [October 19, 2020, 11:48am UTC](https://discuss.elastic.co/t/value-of-index-blocks-write-is-auto-changed-to-false/252207 "2020-10-19T11:48:53Z")
ES ver. 7.4 I want to block all write actions (create/update/delete) to my index. I need it to copy docs to another index using reindex action and keep 100% consistency between indicies. So what I do is: curl -X PUT \\… --- ## [DeleteByQuery using "from"](https://discuss.elastic.co/t/deletebyquery-using-from/251135)
**Author:** [@Alder](https://discuss.elastic.co/u/Alder)\ **Replies:** 3\ **Last updated:** [October 19, 2020, 11:35am UTC](https://discuss.elastic.co/t/deletebyquery-using-from/251135 "2020-10-19T11:35:32Z")
Hello everyone from elastic I try to exclude some docs by specifying the starting document offset. Based on the documentation below I write this C # code public async Task EraseData(string indexName, int from, int… --- ## [Term text cannot contain HOLE character U+001E; or unit separator character U+001F; this character is reserved](https://discuss.elastic.co/t/term-text-cannot-contain-hole-character-u-001e-or-unit-separator-character-u-001f-this-character-is-reserved/252484)
**Author:** [@Zoltan\_Kovacs](https://discuss.elastic.co/u/Zoltan_Kovacs)\ **Replies:** 1\ **Last updated:** [October 19, 2020, 11:29am UTC](https://discuss.elastic.co/t/term-text-cannot-contain-hole-character-u-001e-or-unit-separator-character-u-001f-this-character-is-reserved/252484 "2020-10-19T11:29:42Z")
I run today an interesting error message: Term text cannot contain HOLE character U+001E; this character is reserved Term text cannot contain unit separator character U+001F; this character is reserved in search s… --- ## [Update by query date field (painless) and add hours](https://discuss.elastic.co/t/update-by-query-date-field-painless-and-add-hours/252291)
**Author:** [@AClerk](https://discuss.elastic.co/u/AClerk)\ **Replies:** 3\ **Last updated:** [October 19, 2020, 11:15am UTC](https://discuss.elastic.co/t/update-by-query-date-field-painless-and-add-hours/252291 "2020-10-19T11:15:31Z")
Hi, Some basics in painless (the painful syntax) Trying to update a filed to have the timestamp value + X hours. I was trying the following POST index\*/\_update\_by\_query { "script": { "source": "ctx.\_source.time… --- ## [\[watcher\] how to list out all indices in email action in kibana?](https://discuss.elastic.co/t/watcher-how-to-list-out-all-indices-in-email-action-in-kibana/252431)
**Author:** [@Smit108](https://discuss.elastic.co/u/Smit108)\ **Replies:** 1\ **Last updated:** [October 19, 2020, 11:13am UTC](https://discuss.elastic.co/t/watcher-how-to-list-out-all-indices-in-email-action-in-kibana/252431 "2020-10-19T11:13:58Z")
how to list out all indices health , status index name etc in email action ? "path" : "/\_cat/indices" i'm following below Ref. Ref: https://www.elastic.co/guide/en/elasticsearch/reference/current/watch-cluster-status… --- ## [Authentication fails on a new node in a secure cluster](https://discuss.elastic.co/t/authentication-fails-on-a-new-node-in-a-secure-cluster/252517)
**Author:** [@aryon](https://discuss.elastic.co/u/aryon)\ **Replies:** 1\ **Last updated:** [October 19, 2020, 10:47am UTC](https://discuss.elastic.co/t/authentication-fails-on-a-new-node-in-a-secure-cluster/252517 "2020-10-19T10:47:47Z")
Hello, I have an Elasticsearch cluster with 2 nodes, on which I enabled xpack security a while ago (TLS on both transport and HTTP + local authentication). I want to add a new node to the cluster, I configured the node… --- ## [Dynamic\_templates vs Template API](https://discuss.elastic.co/t/dynamic-templates-vs-template-api/252478)
**Author:** [@vorapoap](https://discuss.elastic.co/u/vorapoap)\ **Replies:** 2\ **Last updated:** [October 19, 2020, 10:32am UTC](https://discuss.elastic.co/t/dynamic-templates-vs-template-api/252478 "2020-10-19T10:32:37Z")
In term of indexing performance. Which one is faster? between using dynamic\_templates vs Template API --- ## [Yellow Shard](https://discuss.elastic.co/t/yellow-shard/252514)
**Author:** [@laurent2](https://discuss.elastic.co/u/laurent2)\ **Replies:** 1\ **Last updated:** [October 19, 2020, 10:23am UTC](https://discuss.elastic.co/t/yellow-shard/252514 "2020-10-19T10:23:19Z")
Hello, I'm having some issue with an elasticsearch install, I don't have extensive knowledge on ES but your help would be appreciated. 2 issues: ES is regulary stuck and i have to restart it manually ES is in yellow … --- ## [Logstash Filebeat input](https://discuss.elastic.co/t/logstash-filebeat-input/251992)
**Author:** [@jafri6](https://discuss.elastic.co/u/jafri6)\ **Replies:** 3\ **Last updated:** [October 19, 2020, 9:36am UTC](https://discuss.elastic.co/t/logstash-filebeat-input/251992 "2020-10-19T09:36:39Z")
My goal is to setup filebeat on at least 5 systems, and get the data to elasticsearch via logstash. I imported data via the file plugin earlier for one of my trials, and the data was imported successfully. I tried the … --- ## [Illegal\_argument\_exception at index filebeat-7.4.0](https://discuss.elastic.co/t/illegal-argument-exception-at-index-filebeat-7-4-0/252513)
**Author:** [@deniss.stepanov](https://discuss.elastic.co/u/deniss.stepanov)\ **Replies:** 1\ **Last updated:** [October 19, 2020, 9:10am UTC](https://discuss.elastic.co/t/illegal-argument-exception-at-index-filebeat-7-4-0/252513 "2020-10-19T09:10:42Z")
Hello everyone, After the last update to version 7.9.1 my ELK cluster and beats version in Kibana under Visuals tab, I start to receive such notifications. Easy google is nothing gave to me, so I am here. And this is a… --- ## [Elasticsearch 6.8.12 & Magento 2.3.4](https://discuss.elastic.co/t/elasticsearch-6-8-12-magento-2-3-4/251241)
**Author:** [@mbob](https://discuss.elastic.co/u/mbob)\ **Replies:** 8\ **Last updated:** [October 19, 2020, 9:02am UTC](https://discuss.elastic.co/t/elasticsearch-6-8-12-magento-2-3-4/251241 "2020-10-19T09:02:33Z")
Hi, I was told to by your User Success Manager to ask for help in this forum regarding issues with using Elasticsearch and Magento 2. The problem: The test of the connection fails in Magento 2 (test fails in backend) w… --- ## [Search query - StartsWIth, Contains and Endswith](https://discuss.elastic.co/t/search-query-startswith-contains-and-endswith/252501)
**Author:** [@mruthyu](https://discuss.elastic.co/u/mruthyu)\ **Replies:** 1\ **Last updated:** [October 19, 2020, 8:41am UTC](https://discuss.elastic.co/t/search-query-startswith-contains-and-endswith/252501 "2020-10-19T08:41:24Z")
How to query elasticsearch with Startswith, contains and Endswith. \\Looks like it is not recommended to use wildcard \* at the beginning of the search term considering the performance impact. --- ## [Logstash truncating original message while applying json filter](https://discuss.elastic.co/t/logstash-truncating-original-message-while-applying-json-filter/252500)
**Author:** [@pks01](https://discuss.elastic.co/u/pks01)\ **Replies:** 0\ **Last updated:** [October 19, 2020, 8:14am UTC](https://discuss.elastic.co/t/logstash-truncating-original-message-while-applying-json-filter/252500 "2020-10-19T08:14:27Z")
I have logstash running on kubernetes which gets the logs from azure-eventhub using eventhub plugin. In eventhub, the messages are logged in JSON format. While reading events from the topic in logstash and applying JSON … --- ## [Elastic-agent and winlogbeat](https://discuss.elastic.co/t/elastic-agent-and-winlogbeat/252446)
**Author:** [@fdaa](https://discuss.elastic.co/u/fdaa)\ **Replies:** 1\ **Last updated:** [October 19, 2020, 8:34am UTC](https://discuss.elastic.co/t/elastic-agent-and-winlogbeat/252446 "2020-10-19T08:34:30Z")
Will elastic-agent include winlogbeat when it's released for production? [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1742) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1744)