# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=176 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 177 --- ## [Different anonymous users on ELK](https://discuss.elastic.co/t/different-anonymous-users-on-elk/365892)
**Author:** [@PMF](https://discuss.elastic.co/u/PMF)\ **Replies:** 2\ **Last updated:** [September 3, 2024, 6:06am UTC](https://discuss.elastic.co/t/different-anonymous-users-on-elk/365892 "2024-09-03T06:06:28Z")
Hi. We are building several different dashboards with information that we want to share, but there are dashboards that we want to make public to everyone, dashboards that we want to make public at an enterprise level an… --- ## [Filebeat memory keeps increasing until OOM](https://discuss.elastic.co/t/filebeat-memory-keeps-increasing-until-oom/365880)
**Author:** [@syunka.tyo](https://discuss.elastic.co/u/syunka.tyo)\ **Replies:** 0\ **Last updated:** [September 2, 2024, 5:42am UTC](https://discuss.elastic.co/t/filebeat-memory-keeps-increasing-until-oom/365880 "2024-09-02T05:42:34Z")
Hello all We are facing persistent Out of Memory(OOM) issue with filebeat across our kubernetes environment. We initially encountered the issue with Filebeat version 8.5.1. Follwing the suggestions from a topic(Filebeat… --- ## [Elastic Agent Not Sending Logs FIN ACK after changing a cipher](https://discuss.elastic.co/t/elastic-agent-not-sending-logs-fin-ack-after-changing-a-cipher/365861)
**Author:** [@ahmed\_fetoh](https://discuss.elastic.co/u/ahmed_fetoh)\ **Replies:** 1\ **Last updated:** [September 2, 2024, 3:14pm UTC](https://discuss.elastic.co/t/elastic-agent-not-sending-logs-fin-ack-after-changing-a-cipher/365861 "2024-09-02T15:14:56Z")
Description: I have deployed a setup on the cloud with two VMs: One VM running Elasticsearch. Another VM running Kibana and Fleet Server. Issue: When I try to install an agent to collect logs from an endpoint, Elast… --- ## [Replicating documents from one index to another in real time](https://discuss.elastic.co/t/replicating-documents-from-one-index-to-another-in-real-time/365896)
**Author:** [@davidas](https://discuss.elastic.co/u/davidas)\ **Replies:** 1\ **Last updated:** [September 2, 2024, 1:44pm UTC](https://discuss.elastic.co/t/replicating-documents-from-one-index-to-another-in-real-time/365896 "2024-09-02T13:44:03Z")
I have an existing index with several documents that receives them from a service. I want to create a new index (data stream to be more specific) with a differente template. I want the second index to have the same docum… --- ## [Elasticsearch Internal File System Repository for Snapshot](https://discuss.elastic.co/t/elasticsearch-internal-file-system-repository-for-snapshot/365890)
**Author:** [@Julian\_Fazri](https://discuss.elastic.co/u/Julian_Fazri)\ **Replies:** 1\ **Last updated:** [September 2, 2024, 10:26am UTC](https://discuss.elastic.co/t/elasticsearch-internal-file-system-repository-for-snapshot/365890 "2024-09-02T10:26:44Z")
Hi All, Is there anyone who have face this scenario regarding the snapshot using file system as repository. Schenario: I have 3 nodes elasticsearch that all nodes have master and data role. I set up the repository wi… --- ## [Parse stringified json from syslog 3164 events](https://discuss.elastic.co/t/parse-stringified-json-from-syslog-3164-events/365877)
**Author:** [@Mark\_V](https://discuss.elastic.co/u/Mark_V)\ **Replies:** 3\ **Last updated:** [September 2, 2024, 8:38am UTC](https://discuss.elastic.co/t/parse-stringified-json-from-syslog-3164-events/365877 "2024-09-02T08:38:38Z")
Hi, I'm pretty new to the elastic stack so please excuse any newbie-level ignorance. Im shipping data from my splunk environment to logstash using the methods detailed in the Splunk Forward data to third-party systems.… --- ## [No file on .security indices shards](https://discuss.elastic.co/t/no-file-on-security-indices-shards/365665)
**Author:** [@Julian\_Fazri](https://discuss.elastic.co/u/Julian_Fazri)\ **Replies:** 2\ **Last updated:** [September 2, 2024, 7:42am UTC](https://discuss.elastic.co/t/no-file-on-security-indices-shards/365665 "2024-09-02T07:42:56Z")
Dear All, Suddenly my .security-7 index unassigned after restart and I cannot do authenticate to elasticsearch using elastic or kibana\_system user. I try to create another user with super\_user role, but I cannot remove… --- ## [Please clarify maintenance status for Functionbeat/beats code libraries](https://discuss.elastic.co/t/please-clarify-maintenance-status-for-functionbeat-beats-code-libraries/365416)
**Author:** [@Seagulls](https://discuss.elastic.co/u/Seagulls)\ **Replies:** 1\ **Last updated:** [September 2, 2024, 3:30am UTC](https://discuss.elastic.co/t/please-clarify-maintenance-status-for-functionbeat-beats-code-libraries/365416 "2024-09-02T03:30:32Z")
I am looking at the beats code libraries here: When I use the link to the Functionbeat documentation, a banner states: Functionbeat reached End of Support on October 18, 2023. You must consider moving your deployment… --- ## [Syslog Dashboard](https://discuss.elastic.co/t/syslog-dashboard/365869)
**Author:** [@alrightbabyboy](https://discuss.elastic.co/u/alrightbabyboy)\ **Replies:** 0\ **Last updated:** [September 1, 2024, 7:39pm UTC](https://discuss.elastic.co/t/syslog-dashboard/365869 "2024-09-01T19:39:10Z")
hello, I imported syslogs from RSYSLOG server with filebeat. I can see logs on discover with the filter : filebeat-\* ; and on Observability \> logs Stream. I Can't use dashboard : Syslog events by hostname \[Filebeat S… --- ## [Authentication Error and SSL](https://discuss.elastic.co/t/authentication-error-and-ssl/364246)
**Author:** [@JiCheng\_1981](https://discuss.elastic.co/u/JiCheng_1981)\ **Replies:** 2\ **Last updated:** [September 1, 2024, 5:03pm UTC](https://discuss.elastic.co/t/authentication-error-and-ssl/364246 "2024-09-01T17:03:26Z")
Hi folks, I need some advice here. We have an ES Cluster running on version 7.16.3, spread in 28 nodes with role master-only, ingest-only and data-only. SSL is enabled for http and transport and running fine until we r… --- ## [Run heartbeat in Openshift](https://discuss.elastic.co/t/run-heartbeat-in-openshift/365821)
**Author:** [@fabry\_00](https://discuss.elastic.co/u/fabry_00)\ **Replies:** 1\ **Last updated:** [September 1, 2024, 8:42am UTC](https://discuss.elastic.co/t/run-heartbeat-in-openshift/365821 "2024-09-01T08:42:03Z")
I'd like to run heartbeat in Openshift. I am trying to deploy it using this yaml file https://raw.githubusercontent.com/elastic/beats/8.15/deploy/kubernetes/heartbeat-kubernetes.yaml the issue is that in OCP we do not … --- ## [ES PostgreSQL connector](https://discuss.elastic.co/t/es-postgresql-connector/365853)
**Author:** [@os17](https://discuss.elastic.co/u/os17)\ **Replies:** 1\ **Last updated:** [September 1, 2024, 5:56am UTC](https://discuss.elastic.co/t/es-postgresql-connector/365853 "2024-09-01T05:56:16Z")
Hello, I did everything according to As a result kibana and es works as expected wo any issues Next step is to set PostgreSQL connector, I followed and getting \[FMWK\]\[11:00:07\]\[ERROR\] Cannot connect to host host.d… --- ## [Grok The correct syntax to match against multiple patterns](https://discuss.elastic.co/t/grok-the-correct-syntax-to-match-against-multiple-patterns/365854)
**Author:** [@Dhiwakar\_Ravikumar](https://discuss.elastic.co/u/Dhiwakar_Ravikumar)\ **Replies:** 1\ **Last updated:** [August 31, 2024, 2:57pm UTC](https://discuss.elastic.co/t/grok-the-correct-syntax-to-match-against-multiple-patterns/365854 "2024-08-31T14:57:13Z")
I have an event whose message field I want to match against multiple patterns, if the message matches any of the patterns, then simply stop searching the remaining patterns in the list/array and write to output. For ref… --- ## [Filebeat:Not able to scrap logs of Spark on Kubernetes](https://discuss.elastic.co/t/filebeat-not-able-to-scrap-logs-of-spark-on-kubernetes/365851)
**Author:** [@cpawali](https://discuss.elastic.co/u/cpawali)\ **Replies:** 0\ **Last updated:** [August 31, 2024, 10:46am UTC](https://discuss.elastic.co/t/filebeat-not-able-to-scrap-logs-of-spark-on-kubernetes/365851 "2024-08-31T10:46:37Z")
I am running spark on Kubernetes . Need to send spark driver logs to elastic through filebeat. And I need Driver pod details also in my logs.Below are my configuration filebeat\_configmap.yaml apiVersion: v1 kind: Conf… --- ## [Dedupe Identification and delete the Old entries of unique key like Task Id](https://discuss.elastic.co/t/dedupe-identification-and-delete-the-old-entries-of-unique-key-like-task-id/365841)
**Author:** [@Aditya\_Macherla](https://discuss.elastic.co/u/Aditya_Macherla)\ **Replies:** 0\ **Last updated:** [August 30, 2024, 7:45pm UTC](https://discuss.elastic.co/t/dedupe-identification-and-delete-the-old-entries-of-unique-key-like-task-id/365841 "2024-08-30T19:45:06Z")
Hello, We have recently moved all the Tasks from Java Application to ELK Stack but we understood duplicates got created in the ELK. We are getting incorrect reports because of it. We have a volume of 40 million records. … --- ## [Unable to ship metrics when using metricbeat provided index template, 400 error "routing\_missing\_exception"](https://discuss.elastic.co/t/unable-to-ship-metrics-when-using-metricbeat-provided-index-template-400-error-routing-missing-exception/365638)
**Author:** [@dfinn](https://discuss.elastic.co/u/dfinn)\ **Replies:** 34\ **Last updated:** [August 30, 2024, 6:20pm UTC](https://discuss.elastic.co/t/unable-to-ship-metrics-when-using-metricbeat-provided-index-template-400-error-routing-missing-exception/365638 "2024-08-30T18:20:36Z")
Hello, We are using metricbeat (8.14) on k8s to ship metrics to an elasticsearch (8.13) cluster. This has been working well however last week we discovered a mapping issue where sometimes some of our metrics are getti… --- ## [Don’t work kibana web](https://discuss.elastic.co/t/don-t-work-kibana-web/365834)
**Author:** [@khusan241](https://discuss.elastic.co/u/khusan241)\ **Replies:** 0\ **Last updated:** [August 30, 2024, 6:02pm UTC](https://discuss.elastic.co/t/don-t-work-kibana-web/365834 "2024-08-30T18:02:34Z")
Hi, I really need help. I picked up elasticsearch and kibana, but I can't get into web kibana from another virtual machine. There are no errors in the logs, elastic sees kibana The ports are all open. Elastic is avai… --- ## [Dashboard creation on Kibana](https://discuss.elastic.co/t/dashboard-creation-on-kibana/365692)
**Author:** [@karankamat\_21](https://discuss.elastic.co/u/karankamat_21)\ **Replies:** 3\ **Last updated:** [August 30, 2024, 3:56pm UTC](https://discuss.elastic.co/t/dashboard-creation-on-kibana/365692 "2024-08-30T15:56:28Z")
Hello, I am relatively new to the Elastic Stack. For my current project, I will be importing data into Elasticsearch using Logstash. I aim to create a dashboard for this imported data, with filtration based on criteria … --- ## [Jira content source in Workplace Search doesn't import ticket status history](https://discuss.elastic.co/t/jira-content-source-in-workplace-search-doesnt-import-ticket-status-history/361664)
**Author:** [@Andre\_Pierre](https://discuss.elastic.co/u/Andre_Pierre)\ **Replies:** 2\ **Last updated:** [August 30, 2024, 3:13pm UTC](https://discuss.elastic.co/t/jira-content-source-in-workplace-search-doesnt-import-ticket-status-history/361664 "2024-08-30T15:13:23Z")
Hi, My team is working to develop some reports and visualizations in (self-managed) Elasticsearch/Kibana about tickets in Jira Cloud. We can successfully see the content of our tickets in Workplace Search and in ES indic… --- ## [Unable to install new wildcard certificat on stack](https://discuss.elastic.co/t/unable-to-install-new-wildcard-certificat-on-stack/365830)
**Author:** [@vincent.morel](https://discuss.elastic.co/u/vincent.morel)\ **Replies:** 0\ **Last updated:** [August 30, 2024, 2:42pm UTC](https://discuss.elastic.co/t/unable-to-install-new-wildcard-certificat-on-stack/365830 "2024-08-30T14:42:16Z")
Hello. I tried and search a lot of stuff but I can't find any working solution... Here is the facts: We have an elk stack (elk1.domain .com,elk2.domain .com, elk3.domain .com + logstah elk04 and kibana elk05), working… --- ## [How to convert hex to ascii in logstash?](https://discuss.elastic.co/t/how-to-convert-hex-to-ascii-in-logstash/365803)
**Author:** [@lilyyy](https://discuss.elastic.co/u/lilyyy)\ **Replies:** 1\ **Last updated:** [August 30, 2024, 12:17pm UTC](https://discuss.elastic.co/t/how-to-convert-hex-to-ascii-in-logstash/365803 "2024-08-30T12:17:21Z")
Hello. I want to convert hex data to ascii so I tried several ways on the logstash.config file. My reference document is here. But it doesn't work for me. There's a error likes 'undefined method pack' . My source data… --- ## [Filestream monitorization issue](https://discuss.elastic.co/t/filestream-monitorization-issue/365819)
**Author:** [@Samuel\_Ruiz\_Garcia](https://discuss.elastic.co/u/Samuel_Ruiz_Garcia)\ **Replies:** 0\ **Last updated:** [August 30, 2024, 12:51pm UTC](https://discuss.elastic.co/t/filestream-monitorization-issue/365819 "2024-08-30T12:51:35Z")
We have a monitoring on some logs of an application. This monitoring was already done since version 7.17.9 with filestream (because of the log deprecation issue). A few weeks ago we upgraded the whole cluster to version … --- ## [Duplicate fleet instances after Docker compose restart](https://discuss.elastic.co/t/duplicate-fleet-instances-after-docker-compose-restart/342039)
**Author:** [@MBender](https://discuss.elastic.co/u/MBender)\ **Replies:** 7\ **Last updated:** [August 30, 2024, 9:04am UTC](https://discuss.elastic.co/t/duplicate-fleet-instances-after-docker-compose-restart/342039 "2024-08-30T09:04:22Z")
We're using a single compose file for our on-prem Elastic Stack, which includes a fleet server as well as a default agent (currently running APM). In general, this works and starts up nicely, BUT on every restart of the… --- ## [Reporting error while trying to generate CSV from Kibana (filebeats)](https://discuss.elastic.co/t/reporting-error-while-trying-to-generate-csv-from-kibana-filebeats/365796)
**Author:** [@fae](https://discuss.elastic.co/u/fae)\ **Replies:** 3\ **Last updated:** [August 30, 2024, 8:54am UTC](https://discuss.elastic.co/t/reporting-error-while-trying-to-generate-csv-from-kibana-filebeats/365796 "2024-08-30T08:54:32Z")
As above image, I am trying to generate CSV for my filebeat but there's a Reporting error which I can't solve, anyone able to advise? --- ## [Unable to connect to elasticsearch: resource 'filebeat-7.14.0' exists, but it is not an alias](https://discuss.elastic.co/t/unable-to-connect-to-elasticsearch-resource-filebeat-7-14-0-exists-but-it-is-not-an-alias/365802)
**Author:** [@shiva9](https://discuss.elastic.co/u/shiva9)\ **Replies:** 0\ **Last updated:** [August 30, 2024, 7:29am UTC](https://discuss.elastic.co/t/unable-to-connect-to-elasticsearch-resource-filebeat-7-14-0-exists-but-it-is-not-an-alias/365802 "2024-08-30T07:29:20Z")
I am getting an error like this Unable to connect to elasticsearch: resource 'filebeat-7.14.0' exists, but it is not an alias. I had given the elasticsearch credentials correctly in the configuration file. I can't see th… --- ## [How to aggregate the change of a field value split by multiple keyword fields?](https://discuss.elastic.co/t/how-to-aggregate-the-change-of-a-field-value-split-by-multiple-keyword-fields/365810)
**Author:** [@Jim\_Panzee](https://discuss.elastic.co/u/Jim_Panzee)\ **Replies:** 0\ **Last updated:** [August 30, 2024, 8:26am UTC](https://discuss.elastic.co/t/how-to-aggregate-the-change-of-a-field-value-split-by-multiple-keyword-fields/365810 "2024-08-30T08:26:27Z")
Give this sample data structure: "data": { "values": \[ { "A": "Room1", "B": "Team1", "C": "Chef", "X": 30}, { "A": "Room2", "B": "Team2", "C": "Waitress", "X": 24}, ...\] } Documents are coming in e… --- ## [Elastic agent send \_nil id to Logstash](https://discuss.elastic.co/t/elastic-agent-send-nil-id-to-logstash/365809)
**Author:** [@Alessio\_Creo](https://discuss.elastic.co/u/Alessio_Creo)\ **Replies:** 0\ **Last updated:** [August 30, 2024, 8:23am UTC](https://discuss.elastic.co/t/elastic-agent-send-nil-id-to-logstash/365809 "2024-08-30T08:23:31Z")
Hi there! we'reusing the logstash output to send data from the elastic agent but we're are facing a strange behaviour. Our logstash pipeline input { elastic\_agent { port =\> 5044 ssl =\> true ssl\_certifica… --- ## [Deploying a Fleet server pod in an already set up ECK env](https://discuss.elastic.co/t/deploying-a-fleet-server-pod-in-an-already-set-up-eck-env/365460)
**Author:** [@Dave\_Houser](https://discuss.elastic.co/u/Dave_Houser)\ **Replies:** 1\ **Last updated:** [August 30, 2024, 8:06am UTC](https://discuss.elastic.co/t/deploying-a-fleet-server-pod-in-an-already-set-up-eck-env/365460 "2024-08-30T08:06:23Z")
We already have a fully deployed ECK env with services, elastic pods and Kibana pods. Our data comes from on prem forwarder hosts that run Logstash, Filebeat, and Metricbeat. The goal is to replace Metricbeat with Elast… --- ## [Unable to delete elastic search deployments](https://discuss.elastic.co/t/unable-to-delete-elastic-search-deployments/365769)
**Author:** [@Balasundaram\_Narayan](https://discuss.elastic.co/u/Balasundaram_Narayan)\ **Replies:** 1\ **Last updated:** [August 30, 2024, 3:30am UTC](https://discuss.elastic.co/t/unable-to-delete-elastic-search-deployments/365769 "2024-08-30T03:30:59Z")
unable to delete the Elasticsearch deployments from API.as the resource is deleted in azure but the resource is still being billed. I need a way to delete deployments through API kindly guide me...I am chasing Elasticsea… --- ## [Parser fails when it encounters a newline / Parser falla cuando encuentra un salto de linea](https://discuss.elastic.co/t/parser-fails-when-it-encounters-a-newline-parser-falla-cuando-encuentra-un-salto-de-linea/365718)
**Author:** [@Roberto\_Soto](https://discuss.elastic.co/u/Roberto_Soto)\ **Replies:** 2\ **Last updated:** [August 30, 2024, 3:05am UTC](https://discuss.elastic.co/t/parser-fails-when-it-encounters-a-newline-parser-falla-cuando-encuentra-un-salto-de-linea/365718 "2024-08-30T03:05:44Z")
hi, i have a problem when a ln or \\n exist in message text. my filter grok is match=\>{"message" =\> "\<%{DATA:timestamp}\> \<%{WORD:Severity}\> \<%{WORD:Subsystem}\> \<%{HOSTNAME:ServerName}\> \<%{HOSTNAME:Instancia}\> \<%{DATA:Thr… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=175) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=177)