# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1885 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1886 --- ## [Illegal character in authority at index 8:](https://discuss.elastic.co/t/illegal-character-in-authority-at-index-8/243795)
**Author:** [@elaair](https://discuss.elastic.co/u/elaair)\ **Replies:** 12\ **Last updated:** [August 5, 2020, 6:37pm UTC](https://discuss.elastic.co/t/illegal-character-in-authority-at-index-8/243795 "2020-08-05T18:37:09Z")
I am using logstash 7.8 and am seeing this error while using the elasticsearch filter: :error=\>"Illegal character in authority at index 8: https://{:host=\>\\"fqdn.here.com\\", :scheme=\>\\"https\\", :protocol=\>\\"https\\", :po… --- ## [How to configure a cluster with enable X-Pac(security)?](https://discuss.elastic.co/t/how-to-configure-a-cluster-with-enable-x-pac-security/243801)
**Author:** [@HenriqueNogueira](https://discuss.elastic.co/u/HenriqueNogueira)\ **Replies:** 9\ **Last updated:** [August 5, 2020, 6:17pm UTC](https://discuss.elastic.co/t/how-to-configure-a-cluster-with-enable-x-pac-security/243801 "2020-08-05T18:17:16Z")
I'm using version 7.8.1 with x-pac enabled and I can't get my second node to connect to my cluster, what should I do? --- ## [Unable to point metricbeat to monitor elasticsearch instance running on custom port](https://discuss.elastic.co/t/unable-to-point-metricbeat-to-monitor-elasticsearch-instance-running-on-custom-port/243908)
**Author:** [@Vijay\_Gharge](https://discuss.elastic.co/u/Vijay_Gharge)\ **Replies:** 1\ **Last updated:** [August 5, 2020, 6:08pm UTC](https://discuss.elastic.co/t/unable-to-point-metricbeat-to-monitor-elasticsearch-instance-running-on-custom-port/243908 "2020-08-05T18:08:54Z")
Hi, I am trying to configure metricbeat-oss to monitor ES-OSS instance hosted on custom port i.e. 7077 (which is further forwarded to 9200 in docker instance configured on localhost). However I am unable to monitor as e… --- ## [Where are index templates and lifecycle policies stored?](https://discuss.elastic.co/t/where-are-index-templates-and-lifecycle-policies-stored/243910)
**Author:** [@steven1](https://discuss.elastic.co/u/steven1)\ **Replies:** 0\ **Last updated:** [August 5, 2020, 5:54pm UTC](https://discuss.elastic.co/t/where-are-index-templates-and-lifecycle-policies-stored/243910 "2020-08-05T17:54:05Z")
Our cluster was shutdown and we had to recover the data nodes. It is now missing all of our index templates and index lifecycles. Index data and other settings seem ok. I'm look for where this data is stored and the p… --- ## [Filebeat doesn't accept logs with container name](https://discuss.elastic.co/t/filebeat-doesnt-accept-logs-with-container-name/243723)
**Author:** [@mohanr](https://discuss.elastic.co/u/mohanr)\ **Replies:** 3\ **Last updated:** [August 5, 2020, 5:44pm UTC](https://discuss.elastic.co/t/filebeat-doesnt-accept-logs-with-container-name/243723 "2020-08-05T17:44:07Z")
Hi, We are using Docker to deploy microservice. Every time when we run a new container. Its id will be changed. Default logs path looks like /var/lib/docker/containers/\/\-json.log. We are usin… --- ## [Search query retrieving data from Kibana Dev Console But no hits from Postman](https://discuss.elastic.co/t/search-query-retrieving-data-from-kibana-dev-console-but-no-hits-from-postman/243222)
**Author:** [@allAbout\_Gaming](https://discuss.elastic.co/u/allAbout_Gaming)\ **Replies:** 4\ **Last updated:** [August 5, 2020, 5:36pm UTC](https://discuss.elastic.co/t/search-query-retrieving-data-from-kibana-dev-console-but-no-hits-from-postman/243222 "2020-08-05T17:36:39Z")
Hi All, The below search query is retrieving data when we run in Dev console in Kibana But when we run from postman it returns 0 hits. Please help. { "query":{ "match": { "name": "ABC" } } } --- ## [Are hashes/objects saved in order?](https://discuss.elastic.co/t/are-hashes-objects-saved-in-order/243881)
**Author:** [@spdoes](https://discuss.elastic.co/u/spdoes)\ **Replies:** 10\ **Last updated:** [August 5, 2020, 5:33pm UTC](https://discuss.elastic.co/t/are-hashes-objects-saved-in-order/243881 "2020-08-05T17:33:15Z")
if I insert this field in this order: "name\_of\_field": {"first":1,"second":2,"third":3} will it always save in the same order as I inserted ? Based on my test, inserting multiple objects like that can make it save it … --- ## [Is there a cross reference available to map file names to modules you should use to process them](https://discuss.elastic.co/t/is-there-a-cross-reference-available-to-map-file-names-to-modules-you-should-use-to-process-them/243907)
**Author:** [@srpine](https://discuss.elastic.co/u/srpine)\ **Replies:** 0\ **Last updated:** [August 5, 2020, 4:55pm UTC](https://discuss.elastic.co/t/is-there-a-cross-reference-available-to-map-file-names-to-modules-you-should-use-to-process-them/243907 "2020-08-05T16:55:47Z")
I keep struggling trying to work out what modules I need to use for some of the more common log files found in linux. Example: I have yum.log what module should I use to map this to (in short set var.paths for that modu… --- ## [Create a new index to store alerts](https://discuss.elastic.co/t/create-a-new-index-to-store-alerts/241003)
**Author:** [@robertitox](https://discuss.elastic.co/u/robertitox)\ **Replies:** 8\ **Last updated:** [August 5, 2020, 4:24pm UTC](https://discuss.elastic.co/t/create-a-new-index-to-store-alerts/241003 "2020-08-05T16:24:39Z")
Dear all, I have an ELK 7.8.0 server running OK. I want to create some alerts for different events, and because I have the ELK open source version, I just can create two type of connectors: Index and Server Log. I'd lik… --- ## [Drop filter is not dropping the logs](https://discuss.elastic.co/t/drop-filter-is-not-dropping-the-logs/243781)
**Author:** [@srbhklkrn](https://discuss.elastic.co/u/srbhklkrn)\ **Replies:** 4\ **Last updated:** [August 5, 2020, 4:19pm UTC](https://discuss.elastic.co/t/drop-filter-is-not-dropping-the-logs/243781 "2020-08-05T16:19:54Z")
I need to drop logs when syslog5424\_host is e.g dev.dev.sample-app-109, the number at the end will change but I have regex to accommodate that. This is my current configuration but it's not dropping the logs. The field… --- ## [Aggregating relevance \_score with nested text fields](https://discuss.elastic.co/t/aggregating-relevance-score-with-nested-text-fields/243892)
**Author:** [@zp230](https://discuss.elastic.co/u/zp230)\ **Replies:** 0\ **Last updated:** [August 5, 2020, 3:31pm UTC](https://discuss.elastic.co/t/aggregating-relevance-score-with-nested-text-fields/243892 "2020-08-05T15:31:58Z")
I am having difficulties finding documentation or discussions about how to aggregate the \_score field for nested text fields. The structure of my index includes one nested field. The structure of a single document is a l… --- ## [Version conflict on update\_by\_query](https://discuss.elastic.co/t/version-conflict-on-update-by-query/243762)
**Author:** [@redec](https://discuss.elastic.co/u/redec)\ **Replies:** 1\ **Last updated:** [August 5, 2020, 4:00pm UTC](https://discuss.elastic.co/t/version-conflict-on-update-by-query/243762 "2020-08-05T16:00:49Z")
I'm seeing some behavior that I can't explain...and all the googling I've done indicates it should not be possible. I have a single client application, issuing an update\_by\_query which updates a few thousand documents..… --- ## [Retrieve synonyms list from database](https://discuss.elastic.co/t/retrieve-synonyms-list-from-database/243897)
**Author:** [@gitterhh](https://discuss.elastic.co/u/gitterhh)\ **Replies:** 1\ **Last updated:** [August 5, 2020, 3:55pm UTC](https://discuss.elastic.co/t/retrieve-synonyms-list-from-database/243897 "2020-08-05T15:55:26Z")
Is it possible to configure Elasticsearch to retrieve synonyms list from database instead of file? --- ## [GROK pattern and Debugger](https://discuss.elastic.co/t/grok-pattern-and-debugger/242905)
**Author:** [@dmalchikov](https://discuss.elastic.co/u/dmalchikov)\ **Replies:** 2\ **Last updated:** [August 5, 2020, 3:34pm UTC](https://discuss.elastic.co/t/grok-pattern-and-debugger/242905 "2020-08-05T15:34:22Z")
Hi there! Could not find a problem and supported index I have pattern which pass test in Grok Debugger but shows "The input is not valid." in Processor field while Create pipeline Grok pattern: ^%{TIMESTAMP\_ISO8601:t… --- ## [Pipeline remove processor not removing all fields](https://discuss.elastic.co/t/pipeline-remove-processor-not-removing-all-fields/243879)
**Author:** [@chapmantrain](https://discuss.elastic.co/u/chapmantrain)\ **Replies:** 3\ **Last updated:** [August 5, 2020, 3:16pm UTC](https://discuss.elastic.co/t/pipeline-remove-processor-not-removing-all-fields/243879 "2020-08-05T15:16:35Z")
I have an ingest pipeline to remove some fields for a reindex. However, the pipeline is not removing the last field. I have changed the order and it always leaves the last field in line. I am Version: 6.4.2 { "reindex… --- ## [Index mapping shows key as "object", Kibana Management as "string"](https://discuss.elastic.co/t/index-mapping-shows-key-as-object-kibana-management-as-string/243595)
**Author:** [@A\_B](https://discuss.elastic.co/u/A_B)\ **Replies:** 4\ **Last updated:** [August 5, 2020, 3:05pm UTC](https://discuss.elastic.co/t/index-mapping-shows-key-as-object-kibana-management-as-string/243595 "2020-08-05T15:05:49Z")
Hello all, I'm trying to understand why Kibana \> Management \> Index Patterns shows me one thing and using Dev Tools to query API shows me another. Some of our logs have the key json.user\_agent. In Kibana \> Management \>… --- ## [Logstash docker container growing](https://discuss.elastic.co/t/logstash-docker-container-growing/243886)
**Author:** [@MartiM](https://discuss.elastic.co/u/MartiM)\ **Replies:** 0\ **Last updated:** [August 5, 2020, 3:02pm UTC](https://discuss.elastic.co/t/logstash-docker-container-growing/243886 "2020-08-05T15:02:04Z")
We are having an issue with Logstash docker container . The container grows up to 1 TB in 2 or 5 days and when we explore the inside the container in the filesystem there are not folders containing near this space usage … --- ## [Illegal\_argument\_exception when metricbeat begins new index](https://discuss.elastic.co/t/illegal-argument-exception-when-metricbeat-begins-new-index/243269)
**Author:** [@HeroCC](https://discuss.elastic.co/u/HeroCC)\ **Replies:** 2\ **Last updated:** [August 5, 2020, 2:57pm UTC](https://discuss.elastic.co/t/illegal-argument-exception-when-metricbeat-begins-new-index/243269 "2020-08-05T14:57:28Z")
Hello! I had a metricbeat instance running 7.8.0, and when I first wired it up to logstash, then to elasticsearch, it generated an index, but whenever I tried to use it things like the Dashboards would not work, citing a… --- ## [Application of grok pattern to the actual YAML](https://discuss.elastic.co/t/application-of-grok-pattern-to-the-actual-yaml/243877)
**Author:** [@eyts](https://discuss.elastic.co/u/eyts)\ **Replies:** 3\ **Last updated:** [August 5, 2020, 2:52pm UTC](https://discuss.elastic.co/t/application-of-grok-pattern-to-the-actual-yaml/243877 "2020-08-05T14:52:25Z")
This is related to topic https://discuss.elastic.co/t/capturing-all-messages-in-a-log/243261. I was able to parse the messages inside the log with (\[%{QS:user\_msg1},)(?:|%{QS:user\_msg2},)(?:|%{QS:user\_msg3},).....(?:|%{… --- ## [How to run metricbeat as background process](https://discuss.elastic.co/t/how-to-run-metricbeat-as-background-process/243865)
**Author:** [@Mahebub\_Sayyed](https://discuss.elastic.co/u/Mahebub_Sayyed)\ **Replies:** 7\ **Last updated:** [August 5, 2020, 2:26pm UTC](https://discuss.elastic.co/t/how-to-run-metricbeat-as-background-process/243865 "2020-08-05T14:26:44Z")
I want to install metricbeat to monitor server metrics. I dont have internet connection on server so I have manually downloaded "metricbeat-oss-7.3.2-linux-x86\_64.tar.gz" and running it through "./metricbeat -e" when I a… --- ## [Logstash path.data](https://discuss.elastic.co/t/logstash-path-data/243844)
**Author:** [@a11an](https://discuss.elastic.co/u/a11an)\ **Replies:** 2\ **Last updated:** [August 5, 2020, 10:48am UTC](https://discuss.elastic.co/t/logstash-path-data/243844 "2020-08-05T10:48:37Z")
Hi, I am wondering what the path.data compared to path.settings. I was deploying a couple of .conf files under /etc/logstash/conf.d/ directory via cmd line and it complained that it cannot find the --path.settings and s… --- ## [ES Cluster Perf is lower than single node ES](https://discuss.elastic.co/t/es-cluster-perf-is-lower-than-single-node-es/243424)
**Author:** [@Yogesh\_BG](https://discuss.elastic.co/u/Yogesh_BG)\ **Replies:** 8\ **Last updated:** [August 5, 2020, 1:59pm UTC](https://discuss.elastic.co/t/es-cluster-perf-is-lower-than-single-node-es/243424 "2020-08-05T13:59:56Z")
Hi I am using ES veriosn 6.6.0 I use es for heavy load index, almost 20MBPS, ~80K rps HW deatails, each node is 88CPUc(44 core), 32GB(ES)+32GB(lucen) RAM, 5 SSDs RAID 10. each index is of size 60GB primary, total 120… --- ## [Deploying ELK three nodes cluster with Ansible](https://discuss.elastic.co/t/deploying-elk-three-nodes-cluster-with-ansible/243878)
**Author:** [@BlessingEzeama](https://discuss.elastic.co/u/BlessingEzeama)\ **Replies:** 0\ **Last updated:** [August 5, 2020, 1:54pm UTC](https://discuss.elastic.co/t/deploying-elk-three-nodes-cluster-with-ansible/243878 "2020-08-05T13:54:46Z")
I am trying to deploy ELK three node cluster with Ansible but i cannot find my way around it. I followed a guide but it was not helpful. How do i go about it please? --- ## [I need help! Auditbeat \`file.path\` field does not contain the absolute path](https://discuss.elastic.co/t/i-need-help-auditbeat-file-path-field-does-not-contain-the-absolute-path/243045)
**Author:** [@Simon\_Moller](https://discuss.elastic.co/u/Simon_Moller)\ **Replies:** 8\ **Last updated:** [August 5, 2020, 1:34pm UTC](https://discuss.elastic.co/t/i-need-help-auditbeat-file-path-field-does-not-contain-the-absolute-path/243045 "2020-08-05T13:34:44Z")
Hi, I am having problems with how auditbeat pushes documents to elasticsearch. I want auditbeat to monitor openat system calls on a directory (or, alternatively on the files within that directory). To that end I have the… --- ## [Filebeat custom patterns](https://discuss.elastic.co/t/filebeat-custom-patterns/243662)
**Author:** [@vladtepes](https://discuss.elastic.co/u/vladtepes)\ **Replies:** 1\ **Last updated:** [August 5, 2020, 1:28pm UTC](https://discuss.elastic.co/t/filebeat-custom-patterns/243662 "2020-08-05T13:28:53Z")
Greetings friends, I am trying to make this approach work in ingest pipelines, but have stumbled upon a syntax error. The grok pattern is valid from what I have tested: When I try to use it in the ingest pipeline ho… --- ## [Cannot see my created saved\_object when creating it thru POST API](https://discuss.elastic.co/t/cannot-see-my-created-saved-object-when-creating-it-thru-post-api/243011)
**Author:** [@dao](https://discuss.elastic.co/u/dao)\ **Replies:** 16\ **Last updated:** [August 5, 2020, 1:07pm UTC](https://discuss.elastic.co/t/cannot-see-my-created-saved-object-when-creating-it-thru-post-api/243011 "2020-08-05T13:07:39Z")
I have created a space test and I want to fill it with the saved\_object API. I create a visualization (ID:nff) with the POST endpoint ( POST https://mykibana.flightwatching.com/bigdata/s/test/api/saved\_objects/visualiza… --- ## [Filebeat ingest pipeline Grok pattern](https://discuss.elastic.co/t/filebeat-ingest-pipeline-grok-pattern/243866)
**Author:** [@vladtepes](https://discuss.elastic.co/u/vladtepes)\ **Replies:** 3\ **Last updated:** [August 5, 2020, 12:51pm UTC](https://discuss.elastic.co/t/filebeat-ingest-pipeline-grok-pattern/243866 "2020-08-05T12:51:28Z")
Must be something really simple, but am struggling to make it work. :confused: The sample log line: 2020-07-29 12:17:16.948 +02:00 \[80000025-0002-ff00-b63f-84710c7967bb\] \[Some.Text.Goes.Here.Controllers.UserController\]… --- ## [Best solution for de-duplication of alerts whilst using additional lookback time](https://discuss.elastic.co/t/best-solution-for-de-duplication-of-alerts-whilst-using-additional-lookback-time/243027)
**Author:** [@Jasonespo](https://discuss.elastic.co/u/Jasonespo)\ **Replies:** 2\ **Last updated:** [August 5, 2020, 12:41pm UTC](https://discuss.elastic.co/t/best-solution-for-de-duplication-of-alerts-whilst-using-additional-lookback-time/243027 "2020-08-05T12:41:20Z")
Hi, An issue we are facing with real-time timestamps is the log processing time. Even if log processing time is less than a second to go through the pipeline, there is still a chance this log is missed due to the nature… --- ## [Copying field values](https://discuss.elastic.co/t/copying-field-values/242520)
**Author:** [@macg](https://discuss.elastic.co/u/macg)\ **Replies:** 8\ **Last updated:** [August 5, 2020, 12:29pm UTC](https://discuss.elastic.co/t/copying-field-values/242520 "2020-08-05T12:29:53Z")
I want to copy the value of the host.hostname field to host.name or otherwise ensure that host.name takes this value. I'm collecting syslog and auth data from a number of hosts on a single machine and shipping to Elasti… --- ## [Unable to view Security option under Management option in Kibana](https://discuss.elastic.co/t/unable-to-view-security-option-under-management-option-in-kibana/243017)
**Author:** [@chinmoy\_padhi](https://discuss.elastic.co/u/chinmoy_padhi)\ **Replies:** 3\ **Last updated:** [August 5, 2020, 11:48am UTC](https://discuss.elastic.co/t/unable-to-view-security-option-under-management-option-in-kibana/243017 "2020-08-05T11:48:02Z")
Hi, I want to restrict user using Role Based Access Control(RBAC) I have a Kibana Basic license version on 7.3.0, when I checked the Management Option there is no Security option available. But as per https://www.elast… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1884) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1886)