# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=182 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 183 --- ## [Elastic Agent - Fleet Server Configuration yml](https://discuss.elastic.co/t/elastic-agent-fleet-server-configuration-yml/365360)
**Author:** [@Leo3](https://discuss.elastic.co/u/Leo3)\ **Replies:** 0\ **Last updated:** [August 22, 2024, 9:44am UTC](https://discuss.elastic.co/t/elastic-agent-fleet-server-configuration-yml/365360 "2024-08-22T09:44:09Z")
Hello. I was able to spin up Elastic, Kibana and Fleet server in docker based on the official docker-compose.yml and this repo. My setup is not intended for production use. It is used purely for my personal experiments … --- ## [Data is not coming through in Elastic](https://discuss.elastic.co/t/data-is-not-coming-through-in-elastic/365296)
**Author:** [@alexvp](https://discuss.elastic.co/u/alexvp)\ **Replies:** 10\ **Last updated:** [August 22, 2024, 9:22am UTC](https://discuss.elastic.co/t/data-is-not-coming-through-in-elastic/365296 "2024-08-22T09:22:51Z")
Hello, I am running the Elastic stack in docker desktop. This if the flow my data goes through : Filebeats -\> Logstash -\> Elastic However, when logstash is sending data to elastic I dont see any indexes being created… --- ## [Cluster privileges manage\_security does give user right to alle CRUD operations on a role](https://discuss.elastic.co/t/cluster-privileges-manage-security-does-give-user-right-to-alle-crud-operations-on-a-role/365196)
**Author:** [@fgjensen](https://discuss.elastic.co/u/fgjensen)\ **Replies:** 4\ **Last updated:** [August 22, 2024, 9:07am UTC](https://discuss.elastic.co/t/cluster-privileges-manage-security-does-give-user-right-to-alle-crud-operations-on-a-role/365196 "2024-08-22T09:07:17Z")
This issue is happens on Elasticsearch and Kibana version 8.15.0 (upgraded many times). A role has been created by the Elastic user. According to Kibana 8.15.0 documentation the cluster security privileges manage\_securi… --- ## [Streamlining Configuration Management for a Large Elasticsearch Cluster](https://discuss.elastic.co/t/streamlining-configuration-management-for-a-large-elasticsearch-cluster/364573)
**Author:** [@bdn](https://discuss.elastic.co/u/bdn)\ **Replies:** 2\ **Last updated:** [August 16, 2024, 3:21am UTC](https://discuss.elastic.co/t/streamlining-configuration-management-for-a-large-elasticsearch-cluster/364573 "2024-08-16T03:21:43Z")
I have 25+ Elasticsearch cluster nodes where I have configured ingestion, data, and master nodes. Any changes to the Elasticsearch configuration need to be updated on each cluster node individually. For instance, if I ne… --- ## [Handling different flows in data streams](https://discuss.elastic.co/t/handling-different-flows-in-data-streams/365342)
**Author:** [@Zain\_Ul\_Abideen](https://discuss.elastic.co/u/Zain_Ul_Abideen)\ **Replies:** 1\ **Last updated:** [August 22, 2024, 7:36am UTC](https://discuss.elastic.co/t/handling-different-flows-in-data-streams/365342 "2024-08-22T07:36:13Z")
Hello, I have been using data streams for my business flow logs, each flow has the different log structure. I have couple of solutions in mind: Having same structure for each flow and keep stringified version of log o… --- ## [Unable to parse response body due to 429 Too Many Requests error during bulk save](https://discuss.elastic.co/t/unable-to-parse-response-body-due-to-429-too-many-requests-error-during-bulk-save/365337)
**Author:** [@eirena](https://discuss.elastic.co/u/eirena)\ **Replies:** 4\ **Last updated:** [August 22, 2024, 7:05am UTC](https://discuss.elastic.co/t/unable-to-parse-response-body-due-to-429-too-many-requests-error-during-bulk-save/365337 "2024-08-22T07:05:54Z")
Hi :slight\_smile: We are experiencing 429 error during bulk save in our prod environment. The problem is intermittent and occurs only once a week, making it hard to reproduce in our test environment. We have the follo… --- ## [Field based limit using simple query string query](https://discuss.elastic.co/t/field-based-limit-using-simple-query-string-query/365336)
**Author:** [@jahedi](https://discuss.elastic.co/u/jahedi)\ **Replies:** 1\ **Last updated:** [August 22, 2024, 6:33am UTC](https://discuss.elastic.co/t/field-based-limit-using-simple-query-string-query/365336 "2024-08-22T06:33:28Z")
Hi, Consider a elastic document has a filed named site. We can use query string query to limit the search results to the related site just like this: GET my\_index/\_search { "query": { "query\_string": { "defau… --- ## [Modifying Elasticsearch Mapping and Reindexing Real-Time Data](https://discuss.elastic.co/t/modifying-elasticsearch-mapping-and-reindexing-real-time-data/365275)
**Author:** [@Monica\_Andhare](https://discuss.elastic.co/u/Monica_Andhare)\ **Replies:** 2\ **Last updated:** [August 22, 2024, 5:54am UTC](https://discuss.elastic.co/t/modifying-elasticsearch-mapping-and-reindexing-real-time-data/365275 "2024-08-22T05:54:37Z")
Hi, Is there any way to modify the mapping of an Elasticsearch index without needing to reindex the data? If not, what is the most optimal approach to reindex an index that is receiving real-time data? --- ## [Cannot use ignore\_unavailable in DeleteRequest in Elasticsearch Java API Client](https://discuss.elastic.co/t/cannot-use-ignore-unavailable-in-deleterequest-in-elasticsearch-java-api-client/365323)
**Author:** [@elvin](https://discuss.elastic.co/u/elvin)\ **Replies:** 5\ **Last updated:** [August 22, 2024, 5:40am UTC](https://discuss.elastic.co/t/cannot-use-ignore-unavailable-in-deleterequest-in-elasticsearch-java-api-client/365323 "2024-08-22T05:40:13Z")
I am using the official Java API Client for Elasticsearch. : Introduction | Elasticsearch Java API Client \[7.17\] | Elastic When deleting I cannot use ignore\_unavailable elasticsearchClient .delete(idx -\> idx.in… --- ## [Issue with regular expression](https://discuss.elastic.co/t/issue-with-regular-expression/365313)
**Author:** [@UMUT\_CAN\_ARGUN](https://discuss.elastic.co/u/UMUT_CAN_ARGUN)\ **Replies:** 2\ **Last updated:** [August 22, 2024, 5:37am UTC](https://discuss.elastic.co/t/issue-with-regular-expression/365313 "2024-08-22T05:37:30Z")
My regex for the sample log line looks line this: As you see, the endpoint section doesn’t match for “usr/admin/developer” although what I write in my regex. What is my mistake? --- ## [Using Grafana's Increase Function In Kibana](https://discuss.elastic.co/t/using-grafanas-increase-function-in-kibana/365330)
**Author:** [@harris\_p](https://discuss.elastic.co/u/harris_p)\ **Replies:** 0\ **Last updated:** [August 22, 2024, 2:30am UTC](https://discuss.elastic.co/t/using-grafanas-increase-function-in-kibana/365330 "2024-08-22T02:30:48Z")
Hello, I need to replicate Grafana visualization using Kibana. The visualization in Grafana is using this query: SUM(increase(requests\_total{operation\_type="query",instance=~"$instance",job=~"$job",response\_status!="su… --- ## [Setup Elasticsearch + Grafana](https://discuss.elastic.co/t/setup-elasticsearch-grafana/365308)
**Author:** [@vished](https://discuss.elastic.co/u/vished)\ **Replies:** 0\ **Last updated:** [August 21, 2024, 8:02pm UTC](https://discuss.elastic.co/t/setup-elasticsearch-grafana/365308 "2024-08-21T20:02:30Z")
Hello, I´m currently struggeling to setup: Docker Elasticssearch Filebeat with Grafana Currently I´m getting always this issue: "No date field named @timestamp found" I cannot post any links, therefore it´s ver… --- ## [Same query returning different result each time](https://discuss.elastic.co/t/same-query-returning-different-result-each-time/365230)
**Author:** [@Santanu112](https://discuss.elastic.co/u/Santanu112)\ **Replies:** 6\ **Last updated:** [August 21, 2024, 6:29pm UTC](https://discuss.elastic.co/t/same-query-returning-different-result-each-time/365230 "2024-08-21T18:29:22Z")
I have more than 50 documents with same score cause they have same name . I am searching top 10 document using "size" and "sort" parameter . Is it ok that every time i am getting different top 10 document ? "size": "10"… --- ## [Elastic and Linux agent Connection issue](https://discuss.elastic.co/t/elastic-and-linux-agent-connection-issue/365110)
**Author:** [@khaled7](https://discuss.elastic.co/u/khaled7)\ **Replies:** 1\ **Last updated:** [August 21, 2024, 5:24pm UTC](https://discuss.elastic.co/t/elastic-and-linux-agent-connection-issue/365110 "2024-08-21T17:24:18Z")
Hello Elastic Team, i faced an issue in connection between Elasticsearch cloud and Elastic Agent for linux (rhel 7.7) and the issue logs are like that i can't understad what to do and i'm empty handed for now Thank… --- ## [Is there any permanent ID in Filebeat logs?](https://discuss.elastic.co/t/is-there-any-permanent-id-in-filebeat-logs/365118)
**Author:** [@hjazz6](https://discuss.elastic.co/u/hjazz6)\ **Replies:** 1\ **Last updated:** [August 21, 2024, 5:22pm UTC](https://discuss.elastic.co/t/is-there-any-permanent-id-in-filebeat-logs/365118 "2024-08-21T17:22:53Z")
Hi, I'm ingesting filebeat logs (/var/log/filebeat/filebeat-\.ndjson) to Elasticsearch so that I can build a dashboard showing the filebeat metrics (e.g. packets received, dropped, etc). Both Filebeat and ES are ru… --- ## [Looking for alternative ways to visualize status](https://discuss.elastic.co/t/looking-for-alternative-ways-to-visualize-status/365217)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 2\ **Last updated:** [August 21, 2024, 5:08pm UTC](https://discuss.elastic.co/t/looking-for-alternative-ways-to-visualize-status/365217 "2024-08-21T17:08:06Z")
Hello, I am looking for any advice on how to find different ways to visualize this: The data showcases the last status of a task per host. Is there methods people use to showcase "status" events? --- ## [ERROR: no\_shard\_available\_action\_exception after restoring the snapshot](https://discuss.elastic.co/t/error-no-shard-available-action-exception-after-restoring-the-snapshot/365021)
**Author:** [@cassper](https://discuss.elastic.co/u/cassper)\ **Replies:** 3\ **Last updated:** [August 21, 2024, 4:40pm UTC](https://discuss.elastic.co/t/error-no-shard-available-action-exception-after-restoring-the-snapshot/365021 "2024-08-21T16:40:31Z")
Hello, I am using ES 8.13 docker and try to restore the snapshot. I am using \_restore ES API. \_snapshot/my\_repository/snapshot\_1/\_restore?wait\_for\_completion=true { "indices": "test-000001" } Result - { "snaps… --- ## [REGEX filtering on fields with embedded 'special chars'](https://discuss.elastic.co/t/regex-filtering-on-fields-with-embedded-special-chars/364800)
**Author:** [@andrew.laraia](https://discuss.elastic.co/u/andrew.laraia)\ **Replies:** 2\ **Last updated:** [August 21, 2024, 4:30pm UTC](https://discuss.elastic.co/t/regex-filtering-on-fields-with-embedded-special-chars/364800 "2024-08-21T16:30:50Z")
I know I can modify the current ingestion process to include more fields to make this example easier. But that's not the real goal. I'm trying to demonstrate using REGEX to isolates some specific data within a general da… --- ## [Convert string to array for new and old data in an index](https://discuss.elastic.co/t/convert-string-to-array-for-new-and-old-data-in-an-index/365242)
**Author:** [@Moni\_Hazarika](https://discuss.elastic.co/u/Moni_Hazarika)\ **Replies:** 1\ **Last updated:** [August 21, 2024, 4:05pm UTC](https://discuss.elastic.co/t/convert-string-to-array-for-new-and-old-data-in-an-index/365242 "2024-08-21T16:05:17Z")
Our current Audit log entries contain a field called Ipaddress, which is a string IP address. Some services send this value as a single IP address while some services are sending it as an array with multiple comma sepa… --- ## [Logstash Kafka output fails on TLS post-handshake messags](https://discuss.elastic.co/t/logstash-kafka-output-fails-on-tls-post-handshake-messags/365297)
**Author:** [@natharran](https://discuss.elastic.co/u/natharran)\ **Replies:** 0\ **Last updated:** [August 21, 2024, 4:04pm UTC](https://discuss.elastic.co/t/logstash-kafka-output-fails-on-tls-post-handshake-messags/365297 "2024-08-21T16:04:30Z")
Hello, I have Logstash and Kafka deployed in OpenShift cluster via operators (ECK for Logstash and AMQ streams for Kafka) Logstash sends messages to Kafka without issue when unencrypted. To enable mTLS, I have custom k… --- ## [S3 snapshot repository setup](https://discuss.elastic.co/t/s3-snapshot-repository-setup/365231)
**Author:** [@mealbert23](https://discuss.elastic.co/u/mealbert23)\ **Replies:** 0\ **Last updated:** [August 20, 2024, 9:19pm UTC](https://discuss.elastic.co/t/s3-snapshot-repository-setup/365231 "2024-08-20T21:19:22Z")
Hi, I have a elasticsearch and kibana 8.14.2 running on an aws eks infrastructure. I am trying to now configure the s3 repository for snapshots and restores. After much searching around and filtering through old stori… --- ## [API KeyFailed - unable to find apikey with id xPIMCZABHLQpy59UBMie](https://discuss.elastic.co/t/api-keyfailed-unable-to-find-apikey-with-id-xpimczabhlqpy59ubmie/365156)
**Author:** [@ETFJeff](https://discuss.elastic.co/u/ETFJeff)\ **Replies:** 1\ **Last updated:** [August 21, 2024, 1:43pm UTC](https://discuss.elastic.co/t/api-keyfailed-unable-to-find-apikey-with-id-xpimczabhlqpy59ubmie/365156 "2024-08-21T13:43:27Z")
Hello, We are new to Elastic Cloud and we have odd errors in our cluster logs. Authentication using apikey failed - unable to find apikey with id xPIMCZABHLQpy59UBMie instance-0000000021 We have not setup this API ke… --- ## [Kibana query on data from Filebeat not returning anything](https://discuss.elastic.co/t/kibana-query-on-data-from-filebeat-not-returning-anything/365286)
**Author:** [@kernelpanic](https://discuss.elastic.co/u/kernelpanic)\ **Replies:** 0\ **Last updated:** [August 21, 2024, 1:11pm UTC](https://discuss.elastic.co/t/kibana-query-on-data-from-filebeat-not-returning-anything/365286 "2024-08-21T13:11:15Z")
Elasticsearch version: 7.17.22 Kibana version: 7.17.22 Filebeat version: 7.17.7 Hello all, we're using Filebeat to ingest the Microsoft System Center Endpoint protection logs so we can monitor and alert on malware / … --- ## [Kibana stuck in a crash loop](https://discuss.elastic.co/t/kibana-stuck-in-a-crash-loop/364834)
**Author:** [@Glorified\_SysAdmin](https://discuss.elastic.co/u/Glorified_SysAdmin)\ **Replies:** 19\ **Last updated:** [August 21, 2024, 1:28pm UTC](https://discuss.elastic.co/t/kibana-stuck-in-a-crash-loop/364834 "2024-08-21T13:28:40Z")
Hello, I have a EFK stack deployed in EKS via helm. I have 6 nodes assigned to my ES cluster - 3 master, 2 ingest and 1 primary. All of my ES nodes are up and running. However, my Kibana pod is stuck on restart loop, ke… --- ## [Error when starting kibana.service](https://discuss.elastic.co/t/error-when-starting-kibana-service/365284)
**Author:** [@Ivan\_Sotirov](https://discuss.elastic.co/u/Ivan_Sotirov)\ **Replies:** 0\ **Last updated:** [August 21, 2024, 12:56pm UTC](https://discuss.elastic.co/t/error-when-starting-kibana-service/365284 "2024-08-21T12:56:27Z")
When staring the kibana service, it starts for a couple of seconds and then stops. Here are the errors i am getting: Failed to start Kibana kibana.service: Failed with result 'exit-code' kibana.service: Start request… --- ## [Fluentd is not able to send json logs to logstash](https://discuss.elastic.co/t/fluentd-is-not-able-to-send-json-logs-to-logstash/365264)
**Author:** [@upreddy](https://discuss.elastic.co/u/upreddy)\ **Replies:** 1\ **Last updated:** [August 21, 2024, 12:55pm UTC](https://discuss.elastic.co/t/fluentd-is-not-able-to-send-json-logs-to-logstash/365264 "2024-08-21T12:55:23Z")
Hi, I am trying to send json logs from application pods to logstash through fluentd agent. But i am getting one error and unable to send json logs to logstash. We mentioned the file extension in fluentd config is .json … --- ## [Logstash keystore key alias selection](https://discuss.elastic.co/t/logstash-keystore-key-alias-selection/365279)
**Author:** [@natharran](https://discuss.elastic.co/u/natharran)\ **Replies:** 0\ **Last updated:** [August 21, 2024, 12:29pm UTC](https://discuss.elastic.co/t/logstash-keystore-key-alias-selection/365279 "2024-08-21T12:29:36Z")
Hello, I'm trying to configure Kafka output module for Logstash. I have my PKCS12 keystore and truststore prepared with proper key and certs added, but I wonder - if there are more keys in the keystore, how does Logstas… --- ## [Continuous data read using Elasticsearch input plugin in logstash](https://discuss.elastic.co/t/continuous-data-read-using-elasticsearch-input-plugin-in-logstash/365198)
**Author:** [@venkatkumar229](https://discuss.elastic.co/u/venkatkumar229)\ **Replies:** 2\ **Last updated:** [August 21, 2024, 11:15am UTC](https://discuss.elastic.co/t/continuous-data-read-using-elasticsearch-input-plugin-in-logstash/365198 "2024-08-21T11:15:45Z")
Hi Team, I have a requirement where i need to read the data from an elasticsearch index(datastream) and perform "split" operation to split the array records into individual documents and store into a destination index(d… --- ## [Inserting text file containing key-value pairs into Elastic Search using Logstash](https://discuss.elastic.co/t/inserting-text-file-containing-key-value-pairs-into-elastic-search-using-logstash/365240)
**Author:** [@karankamat\_21](https://discuss.elastic.co/u/karankamat_21)\ **Replies:** 3\ **Last updated:** [August 21, 2024, 10:58am UTC](https://discuss.elastic.co/t/inserting-text-file-containing-key-value-pairs-into-elastic-search-using-logstash/365240 "2024-08-21T10:58:44Z")
Hello All, I'm relatively new to Elastic Stack. I wanted to understand how I can insert each record(line) as an individual document into Elastic Search from my text file using Logstash. Below is a sample content of my … --- ## [Ssl setup for filebeat and logstash in docker getting desperate now](https://discuss.elastic.co/t/ssl-setup-for-filebeat-and-logstash-in-docker-getting-desperate-now/365078)
**Author:** [@daverodgers](https://discuss.elastic.co/u/daverodgers)\ **Replies:** 12\ **Last updated:** [August 21, 2024, 10:30am UTC](https://discuss.elastic.co/t/ssl-setup-for-filebeat-and-logstash-in-docker-getting-desperate-now/365078 "2024-08-21T10:30:08Z")
Morning everyone. im getting desperate now so i really need your help please. I cannot find a guide anywhere that is for a production setup , where you have nodes and beats running on different servers, it all seems to … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=181) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=183)