# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1887 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1888 --- ## [Elasticsearch + Filebeat + CrowdStrike](https://discuss.elastic.co/t/elasticsearch-filebeat-crowdstrike/243798)
**Author:** [@spinoz4](https://discuss.elastic.co/u/spinoz4)\ **Replies:** 0\ **Last updated:** [August 5, 2020, 1:06am UTC](https://discuss.elastic.co/t/elasticsearch-filebeat-crowdstrike/243798 "2020-08-05T01:06:20Z")
Hi folks. I did install the following scenario: Elasticsearh + Kibana + Filebeat + Crowdstrike Falcon's SIEM conector + Single CID it work flawless however in the multiple CIDs scenario, which involves multiple log fi… --- ## [Ask about the usage of negative query\_string](https://discuss.elastic.co/t/ask-about-the-usage-of-negative-query-string/243412)
**Author:** [@wajika](https://discuss.elastic.co/u/wajika)\ **Replies:** 2\ **Last updated:** [August 5, 2020, 1:01am UTC](https://discuss.elastic.co/t/ask-about-the-usage-of-negative-query-string/243412 "2020-08-05T01:01:21Z")
I've read the latest documentation and am sure I can't answer my question. https://www.elastic.co/guide/en/elasticsearch/reference/7.8/query-dsl-query-string-query.html#query-string-syntax The first DSL syntax succeede… --- ## [NEST Bulk API Validation Error: type is missing](https://discuss.elastic.co/t/nest-bulk-api-validation-error-type-is-missing/243752)
**Author:** [@lmattingly](https://discuss.elastic.co/u/lmattingly)\ **Replies:** 3\ **Last updated:** [August 5, 2020, 12:13am UTC](https://discuss.elastic.co/t/nest-bulk-api-validation-error-type-is-missing/243752 "2020-08-05T00:13:03Z")
Hi, I'm experiencing "Invalid NEST response built from a unsuccessful (400) low level call on POST: /indexname/\_bulk" Bad Request with '{Type: action\_request\_validation\_exception Reason: "Validation Failed: 1: type is… --- ## [Calculating Disk Space being used](https://discuss.elastic.co/t/calculating-disk-space-being-used/243778)
**Author:** [@The-Nebertcher](https://discuss.elastic.co/u/The-Nebertcher)\ **Replies:** 3\ **Last updated:** [August 4, 2020, 11:24pm UTC](https://discuss.elastic.co/t/calculating-disk-space-being-used/243778 "2020-08-04T23:24:48Z")
Hello All I am working on a potential upgrade for our Elk stack and need to find a few things. One is how much space is being taken up just by Elk indexing new logs as they come in. For example if I am taking in ~10gb … --- ## [Query\_string is not returning expected result ES 5.x vs ES 7.7](https://discuss.elastic.co/t/query-string-is-not-returning-expected-result-es-5-x-vs-es-7-7/243783)
**Author:** [@pappukhode](https://discuss.elastic.co/u/pappukhode)\ **Replies:** 1\ **Last updated:** [August 4, 2020, 9:05pm UTC](https://discuss.elastic.co/t/query-string-is-not-returning-expected-result-es-5-x-vs-es-7-7/243783 "2020-08-04T21:05:11Z")
Hi, I have upgraded my elasticsearch recently from 5.5 to 7.7. While running my automation test suite, I found that query\_string in ES 5.5 was returning me expected document but ES 7.7 is returning empty results. I no… --- ## [Alerts by mail in ELK 7.8.1 stack with basic license](https://discuss.elastic.co/t/alerts-by-mail-in-elk-7-8-1-stack-with-basic-license/243751)
**Author:** [@jelocabral](https://discuss.elastic.co/u/jelocabral)\ **Replies:** 2\ **Last updated:** [August 4, 2020, 8:49pm UTC](https://discuss.elastic.co/t/alerts-by-mail-in-elk-7-8-1-stack-with-basic-license/243751 "2020-08-04T20:49:03Z")
Hi people, I have an ELK 7.8.1 stack with basic license. I heard that in the basic license there is no way to use alerts by emails, this is a feature from a paid license: Is there any way to have email alerts in ELK … --- ## [7.8.1 Kibana server not ready yet](https://discuss.elastic.co/t/7-8-1-kibana-server-not-ready-yet/243774)
**Author:** [@pzachry](https://discuss.elastic.co/u/pzachry)\ **Replies:** 4\ **Last updated:** [August 4, 2020, 8:44pm UTC](https://discuss.elastic.co/t/7-8-1-kibana-server-not-ready-yet/243774 "2020-08-04T20:44:30Z")
Hey guys, we are running 7.8 Elasticsearch, Kibana, and Logstash. We were able to set up our stack and everything was working fine. A week later and we started getting the "Kibana server is not ready yet" when we would g… --- ## [Regex Kibana Filter with backslash](https://discuss.elastic.co/t/regex-kibana-filter-with-backslash/243686)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 1\ **Last updated:** [August 4, 2020, 8:30pm UTC](https://discuss.elastic.co/t/regex-kibana-filter-with-backslash/243686 "2020-08-04T20:30:51Z")
Hello, How can I create a regex filter in Kibana containing an escaped dollar? When I double backslash, the regex does not work as expected. My goal is to exclude computer accounts (which end with a dollar). Grtz W… --- ## [How to do a match\_phrase query on all searchable fields instead of on a single field?](https://discuss.elastic.co/t/how-to-do-a-match-phrase-query-on-all-searchable-fields-instead-of-on-a-single-field/243760)
**Author:** [@mruthyu](https://discuss.elastic.co/u/mruthyu)\ **Replies:** 1\ **Last updated:** [August 4, 2020, 8:13pm UTC](https://discuss.elastic.co/t/how-to-do-a-match-phrase-query-on-all-searchable-fields-instead-of-on-a-single-field/243760 "2020-08-04T20:13:45Z")
How to do a match\_phrase query on all searchable fields instead of on a single field? I do see in the documentation as mentioned below where search can be done on only specific field. GET /\_search { "query": { "matc… --- ## [Supplying the After key to search template with aggregation](https://discuss.elastic.co/t/supplying-the-after-key-to-search-template-with-aggregation/243575)
**Author:** [@l570](https://discuss.elastic.co/u/l570)\ **Replies:** 1\ **Last updated:** [August 4, 2020, 7:41pm UTC](https://discuss.elastic.co/t/supplying-the-after-key-to-search-template-with-aggregation/243575 "2020-08-04T19:41:15Z")
I'm new to using search templates and aggregations. In previous queries using aggregations, I've used the "after" key to advance my search through the aggregations. Is it possible to do this with search templates? A… --- ## [Search in Kibana version 5.5.2](https://discuss.elastic.co/t/search-in-kibana-version-5-5-2/243750)
**Author:** [@Rafael\_Jordan](https://discuss.elastic.co/u/Rafael_Jordan)\ **Replies:** 4\ **Last updated:** [August 4, 2020, 7:33pm UTC](https://discuss.elastic.co/t/search-in-kibana-version-5-5-2/243750 "2020-08-04T19:33:25Z")
HI, We are currently using the Kibana tool for the treatment of CDRS (call detail records). We have tried to see the search options for certain types of calls and we are interested in filtering the following information… --- ## [Filebeat processing with external Javascript modules](https://discuss.elastic.co/t/filebeat-processing-with-external-javascript-modules/243775)
**Author:** [@Clippy](https://discuss.elastic.co/u/Clippy)\ **Replies:** 0\ **Last updated:** [August 4, 2020, 7:22pm UTC](https://discuss.elastic.co/t/filebeat-processing-with-external-javascript-modules/243775 "2020-08-04T19:22:21Z")
Does anybody know if it is possible to run a Filebeat processor using external modules. The logs are telling me that it isn't allowed natively but I would love to be able to use the File System (fs) module with my proces… --- ## [Starting ES-7.8.0 hung up CLI](https://discuss.elastic.co/t/starting-es-7-8-0-hung-up-cli/241768)
**Author:** [@dzyubanv](https://discuss.elastic.co/u/dzyubanv)\ **Replies:** 10\ **Last updated:** [August 4, 2020, 3:37pm UTC](https://discuss.elastic.co/t/starting-es-7-8-0-hung-up-cli/241768 "2020-08-04T15:37:43Z")
Hello, I setup ES-7.8.0 cluster on 2 hosts (Linux), 2 master and 2 data nodes on each host. I'm able to start all 4 nodes, the cluster health=GREEN and I can see all nodes joined the cluster. Environment: ES-7.8.0 (el… --- ## [Ingest manager without security enabled](https://discuss.elastic.co/t/ingest-manager-without-security-enabled/243756)
**Author:** [@Sc7565](https://discuss.elastic.co/u/Sc7565)\ **Replies:** 1\ **Last updated:** [August 4, 2020, 5:37pm UTC](https://discuss.elastic.co/t/ingest-manager-without-security-enabled/243756 "2020-08-04T17:37:33Z")
Can ingest manager work without security enabled? --- ## [What version of gosigar does Metricbeat 6.4.3 pull in?](https://discuss.elastic.co/t/what-version-of-gosigar-does-metricbeat-6-4-3-pull-in/243757)
**Author:** [@mehagar](https://discuss.elastic.co/u/mehagar)\ **Replies:** 0\ **Last updated:** [August 4, 2020, 5:31pm UTC](https://discuss.elastic.co/t/what-version-of-gosigar-does-metricbeat-6-4-3-pull-in/243757 "2020-08-04T17:31:58Z")
I'm trying to figure out if this PR: https://github.com/elastic/gosigar/pull/71/files Has been incorporated into the 6.4.3 release of Metricbeat, which is what we are using. This might help explain the discrepancy betwe… --- ## [NewRelic not showing JVM node after upgrade to 6.8.10](https://discuss.elastic.co/t/newrelic-not-showing-jvm-node-after-upgrade-to-6-8-10/243549)
**Author:** [@het](https://discuss.elastic.co/u/het)\ **Replies:** 2\ **Last updated:** [August 4, 2020, 5:18pm UTC](https://discuss.elastic.co/t/newrelic-not-showing-jvm-node-after-upgrade-to-6-8-10/243549 "2020-08-04T17:18:45Z")
Hi team, I have upgraded the Elastic-Search cluster from 5.3 to 6.8.10. When I am on 5.3 Version of ES, I have added the below the line in my jvm.option. -javaagent:$NEW\_RELIC\_HOME/newrelic.jar So with this, I can show… --- ## [POST adding new keys](https://discuss.elastic.co/t/post-adding-new-keys/243753)
**Author:** [@gdiaz](https://discuss.elastic.co/u/gdiaz)\ **Replies:** 0\ **Last updated:** [August 4, 2020, 5:15pm UTC](https://discuss.elastic.co/t/post-adding-new-keys/243753 "2020-08-04T17:15:17Z")
Hi all, I'm writing a service where other services can CRUD ElasticSearch. I'm have a schema that I stick to it to create POST body. I'm testing the service with Postman and I notice something unexpected. Just for giggl… --- ## [How to delete the indices older than 30 days](https://discuss.elastic.co/t/how-to-delete-the-indices-older-than-30-days/242182)
**Author:** [@nikhilesh](https://discuss.elastic.co/u/nikhilesh)\ **Replies:** 11\ **Last updated:** [August 4, 2020, 4:54pm UTC](https://discuss.elastic.co/t/how-to-delete-the-indices-older-than-30-days/242182 "2020-08-04T16:54:52Z")
Hi Team, i am using ELK version 7.5, i would like to delete the indices which are older than 30 days. can i create the index life cycle policy to achieve this? Also, does this policy deletes the default indices which … --- ## [Coalesce field values together](https://discuss.elastic.co/t/coalesce-field-values-together/242378)
**Author:** [@surjray](https://discuss.elastic.co/u/surjray)\ **Replies:** 2\ **Last updated:** [August 4, 2020, 4:44pm UTC](https://discuss.elastic.co/t/coalesce-field-values-together/242378 "2020-08-04T16:44:24Z")
Is there a way to coalesce field content values into one value so that when we visualize in Kibana it shows up as one value, e.g. Say I have a field that has several values, 2 of them being system\_test, and system\_Test. … --- ## [How to make range filter on a multi-field field?](https://discuss.elastic.co/t/how-to-make-range-filter-on-a-multi-field-field/243653)
**Author:** [@opsuthar](https://discuss.elastic.co/u/opsuthar)\ **Replies:** 7\ **Last updated:** [August 4, 2020, 4:34pm UTC](https://discuss.elastic.co/t/how-to-make-range-filter-on-a-multi-field-field/243653 "2020-08-04T16:34:27Z")
Here is the mapping file, I am using: { "settings": { "number\_of\_shards": 2 }, "mappings": { "properties": { "SensitiveInfoTypeData": { "type": "nested", … --- ## [Unable to create the response header 'set-cookie' in Kibana 7.6.2](https://discuss.elastic.co/t/unable-to-create-the-response-header-set-cookie-in-kibana-7-6-2/243461)
**Author:** [@Natarajan](https://discuss.elastic.co/u/Natarajan)\ **Replies:** 1\ **Last updated:** [August 4, 2020, 4:29pm UTC](https://discuss.elastic.co/t/unable-to-create-the-response-header-set-cookie-in-kibana-7-6-2/243461 "2020-08-04T16:29:16Z")
I am using Kibana 7.6.2. I tried to hit /internal/security/login with valid credentials from iFrame . But getting 404 error. I just want to authenticate user and create the response header set-cookie which will create a… --- ## [No Security (Users,RBAC) menus in Kibana 7.6.2](https://discuss.elastic.co/t/no-security-users-rbac-menus-in-kibana-7-6-2/243464)
**Author:** [@Natarajan](https://discuss.elastic.co/u/Natarajan)\ **Replies:** 3\ **Last updated:** [August 4, 2020, 4:26pm UTC](https://discuss.elastic.co/t/no-security-users-rbac-menus-in-kibana-7-6-2/243464 "2020-08-04T16:26:25Z")
I am using ES 7.6.2 and Kibana 7.6.2 . I am able to login into kibana but with minimal access . I am unable to see/create users/roles . My license is basic.Is there any config missing ? --- ## [Cannot log to logstash when xpack security is enabled](https://discuss.elastic.co/t/cannot-log-to-logstash-when-xpack-security-is-enabled/243348)
**Author:** [@Beefstew](https://discuss.elastic.co/u/Beefstew)\ **Replies:** 8\ **Last updated:** [August 4, 2020, 4:04pm UTC](https://discuss.elastic.co/t/cannot-log-to-logstash-when-xpack-security-is-enabled/243348 "2020-08-04T16:04:30Z")
Hi I am running Elk 7.0.0 on Windows server 2016 As soon as I set xpack.security.enabled: true in Elasticsearch.yml logging fails from wionlogbeat clients. What config changes do I need to make in the winlogbeat.yml f… --- ## [Update mapping index parameter of existing field](https://discuss.elastic.co/t/update-mapping-index-parameter-of-existing-field/243749)
**Author:** [@gitterhh](https://discuss.elastic.co/u/gitterhh)\ **Replies:** 0\ **Last updated:** [August 4, 2020, 4:00pm UTC](https://discuss.elastic.co/t/update-mapping-index-parameter-of-existing-field/243749 "2020-08-04T16:00:38Z")
I have the mapping { "test" : { "mappings" : { "properties" : { "description" : { "type" : "text" }, "location" : { "type" : "keyword", "index" : false … --- ## [Offline Logstash install \[Unable to download data from https://rubygems.org\]](https://discuss.elastic.co/t/offline-logstash-install-unable-to-download-data-from-https-rubygems-org/243706)
**Author:** [@Arethusa](https://discuss.elastic.co/u/Arethusa)\ **Replies:** 2\ **Last updated:** [August 4, 2020, 3:54pm UTC](https://discuss.elastic.co/t/offline-logstash-install-unable-to-download-data-from-https-rubygems-org/243706 "2020-08-04T15:54:48Z")
Hello, I must install logstash and his plugin on offline VM. First on online VM I do: Install Java and Logstash yum install --downloadonly --downloaddir=/home/logstash/ logstash yum install --downloadonly --download… --- ## [Create one new index for eah type of entry](https://discuss.elastic.co/t/create-one-new-index-for-eah-type-of-entry/243743)
**Author:** [@robertitox](https://discuss.elastic.co/u/robertitox)\ **Replies:** 0\ **Last updated:** [August 4, 2020, 3:36pm UTC](https://discuss.elastic.co/t/create-one-new-index-for-eah-type-of-entry/243743 "2020-08-04T15:36:13Z")
Dear all, I have an ELK 7.8.0 server with syslog and cisco module enabled from Filebeat. At the moment I'm receiving data from: Linux servers (syslog) Cisco ASA (filebeat, cisco module, asa data set) Cisco IOS (filebe… --- ## [ElasticSearch query to filter out distinct results](https://discuss.elastic.co/t/elasticsearch-query-to-filter-out-distinct-results/243622)
**Author:** [@karna98](https://discuss.elastic.co/u/karna98)\ **Replies:** 2\ **Last updated:** [August 4, 2020, 3:30pm UTC](https://discuss.elastic.co/t/elasticsearch-query-to-filter-out-distinct-results/243622 "2020-08-04T15:30:21Z")
Consider a table, where artifacts are mapped to publications. ------------------------------------------------------------------ id | artifact\_id | publication\_id | A | B | C | --------------------… --- ## [How to pull error logs from Kibana?](https://discuss.elastic.co/t/how-to-pull-error-logs-from-kibana/243709)
**Author:** [@Tiny\_Jacob](https://discuss.elastic.co/u/Tiny_Jacob)\ **Replies:** 1\ **Last updated:** [August 4, 2020, 3:27pm UTC](https://discuss.elastic.co/t/how-to-pull-error-logs-from-kibana/243709 "2020-08-04T15:27:49Z")
Is it possible to pull out error logs from Kibana? --- ## [Filebeat O365 Module, API proxy support](https://discuss.elastic.co/t/filebeat-o365-module-api-proxy-support/242368)
**Author:** [@robertnixon](https://discuss.elastic.co/u/robertnixon)\ **Replies:** 1\ **Last updated:** [August 4, 2020, 3:10pm UTC](https://discuss.elastic.co/t/filebeat-o365-module-api-proxy-support/242368 "2020-08-04T15:10:49Z")
Is there a way to tell Filebeat to use a proxy when attempting to connect to the Microsoft API when pulling down O365 Audit logs? Here are some errors. Jul 23 14:45:57 \ filebeat\[22797\]: 2020-07-23T14:45:57.12… --- ## [2 instance filebeat reading the same file](https://discuss.elastic.co/t/2-instance-filebeat-reading-the-same-file/243704)
**Author:** [@zeO](https://discuss.elastic.co/u/zeO)\ **Replies:** 3\ **Last updated:** [August 4, 2020, 3:07pm UTC](https://discuss.elastic.co/t/2-instance-filebeat-reading-the-same-file/243704 "2020-08-04T15:07:42Z")
Hi, I am using Elastic Kibana and filebeat to read and monitor my docker container (docker stack) logs. for compagnie policy reason I need to send the logs at 2 elasticsearch locations (the project instance and the compa… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1886) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1888)