# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=244 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 245 --- ## [Faceted Search with multiple selections from one facet](https://discuss.elastic.co/t/faceted-search-with-multiple-selections-from-one-facet/359181)
**Author:** [@Brandon\_Brown](https://discuss.elastic.co/u/Brandon_Brown)\ **Replies:** 0\ **Last updated:** [May 9, 2024, 12:38pm UTC](https://discuss.elastic.co/t/faceted-search-with-multiple-selections-from-one-facet/359181 "2024-05-09T12:38:47Z")
I'm trying to implement a faceted search on my website that allows users to select multiple facets within a group, but it also needs to filter out irrelevant options in other facets based on selections. Here's the scenar… --- ## [Post Upgrade - To REINDEX or not to REINDEX](https://discuss.elastic.co/t/post-upgrade-to-reindex-or-not-to-reindex/359179)
**Author:** [@peledc](https://discuss.elastic.co/u/peledc)\ **Replies:** 0\ **Last updated:** [May 9, 2024, 12:26pm UTC](https://discuss.elastic.co/t/post-upgrade-to-reindex-or-not-to-reindex/359179 "2024-05-09T12:26:57Z")
This is more of general "Best Practice" question: We have a 1TB of data in our ES7 indices. We intend to upgrade it to version 8.xx Question is - Should we REINDEX existing indices (which were created in version 7.xx)… --- ## [Query\_string search not working on text field](https://discuss.elastic.co/t/query-string-search-not-working-on-text-field/359166)
**Author:** [@yanir\_goldin](https://discuss.elastic.co/u/yanir_goldin)\ **Replies:** 1\ **Last updated:** [May 9, 2024, 11:46am UTC](https://discuss.elastic.co/t/query-string-search-not-working-on-text-field/359166 "2024-05-09T11:46:25Z")
Hi, I have a field with type "name": { "type": "text", "fields": { "keyword": { "type": "keyword", "normalizer": "case\_insensitive" } } … --- ## [How to Ingest data from Microsoft SCOM DatawarehouseDB to ELK](https://discuss.elastic.co/t/how-to-ingest-data-from-microsoft-scom-datawarehousedb-to-elk/359172)
**Author:** [@rpgani](https://discuss.elastic.co/u/rpgani)\ **Replies:** 0\ **Last updated:** [May 9, 2024, 11:22am UTC](https://discuss.elastic.co/t/how-to-ingest-data-from-microsoft-scom-datawarehousedb-to-elk/359172 "2024-05-09T11:22:43Z")
We have Microsoft SCOM, which monitors the infra and it has all the alert data and performance data collected and stored in the Datawarehouse DB. May i know how to utilize those data in our ELK, so that we can utilize i… --- ## [How can set multiline in filebeat](https://discuss.elastic.co/t/how-can-set-multiline-in-filebeat/358552)
**Author:** [@baber1223](https://discuss.elastic.co/u/baber1223)\ **Replies:** 3\ **Last updated:** [May 9, 2024, 11:22am UTC](https://discuss.elastic.co/t/how-can-set-multiline-in-filebeat/358552 "2024-05-09T11:22:35Z")
This is my log sample that all lines are starting with follow : 134.255.248.30 - - \[01/May/2024:13:54:53 +0330\] I want to use multiline pattern in my filebeat.yml file so I used follow syntax parsers: multiline: ty… --- ## [How can free up /var on logstash server](https://discuss.elastic.co/t/how-can-free-up-var-on-logstash-server/359136)
**Author:** [@baber1223](https://discuss.elastic.co/u/baber1223)\ **Replies:** 1\ **Last updated:** [May 9, 2024, 10:45am UTC](https://discuss.elastic.co/t/how-can-free-up-var-on-logstash-server/359136 "2024-05-09T10:45:09Z")
My logstash path on /var is full so logstash service cannot start . Now want to know How can free up /var on log server ? Do I have to remove file manually from /var/log or have to do free up by elastic GUI ? --- ## [Unknown field - Filebeat json parsing](https://discuss.elastic.co/t/unknown-field-filebeat-json-parsing/359162)
**Author:** [@Nguyen\_Nam](https://discuss.elastic.co/u/Nguyen_Nam)\ **Replies:** 1\ **Last updated:** [May 9, 2024, 10:06am UTC](https://discuss.elastic.co/t/unknown-field-filebeat-json-parsing/359162 "2024-05-09T10:06:09Z")
Hi. Im using filebeat to send to Opensearch a preformatted json logfile. The files are parsing fine, but i have an unknown field and i don´t know why: My log file : {"data": {"affected\_items": \[{"cpu": {"cores": 8,… --- ## [Xuggle-xuggler🫙5.4 is not available](https://discuss.elastic.co/t/xuggle-xuggler5-4-is-not-available/359051)
**Author:** [@Radhika1](https://discuss.elastic.co/u/Radhika1)\ **Replies:** 8\ **Last updated:** [May 9, 2024, 9:37am UTC](https://discuss.elastic.co/t/xuggle-xuggler5-4-is-not-available/359051 "2024-05-09T09:37:42Z")
@carly.richmond @spinscale Downloading from elasticsearch-releases: https://artifacts.elastic.co/maven/javax/servlet/servlet-api/maven-metadata.xml Could not transfer metadata javax.servlet:servlet-api/maven-metadata.… --- ## [Post data not getting captured in server side, which is posted from client-side](https://discuss.elastic.co/t/post-data-not-getting-captured-in-server-side-which-is-posted-from-client-side/359008)
**Author:** [@Lokesh\_s](https://discuss.elastic.co/u/Lokesh_s)\ **Replies:** 1\ **Last updated:** [May 9, 2024, 9:22am UTC](https://discuss.elastic.co/t/post-data-not-getting-captured-in-server-side-which-is-posted-from-client-side/359008 "2024-05-09T09:22:42Z")
Hi Team, With post i am trying to send formData to the server end to push it to the elasticsearch. but the formData is always empty in the server end. I have data in formData from the client side. can someone help me if… --- ## [Actual value](https://discuss.elastic.co/t/actual-value/359159)
**Author:** [@zi\_ninja](https://discuss.elastic.co/u/zi_ninja)\ **Replies:** 0\ **Last updated:** [May 9, 2024, 9:16am UTC](https://discuss.elastic.co/t/actual-value/359159 "2024-05-09T09:16:23Z")
I created 2 jobs both using data as A, as below JOB1 "analysis\_config": { "bucket\_span": "15m", "detectors": \[ { "detector\_description": "High count of events", "function": "count", … --- ## [Hostname/IP does not match certificate's altnames](https://discuss.elastic.co/t/hostname-ip-does-not-match-certificates-altnames/359158)
**Author:** [@usrRea77](https://discuss.elastic.co/u/usrRea77)\ **Replies:** 0\ **Last updated:** [May 9, 2024, 9:14am UTC](https://discuss.elastic.co/t/hostname-ip-does-not-match-certificates-altnames/359158 "2024-05-09T09:14:58Z")
I have a question about enrolling my Kibana after fresh re-installation just recently. My app lately stopped running and I made a mistake by removing the Kibana container. Then, the error below has been persisting since … --- ## [Vxlan protocol capturing](https://discuss.elastic.co/t/vxlan-protocol-capturing/359156)
**Author:** [@Alisher\_Nabiev](https://discuss.elastic.co/u/Alisher_Nabiev)\ **Replies:** 0\ **Last updated:** [May 9, 2024, 9:09am UTC](https://discuss.elastic.co/t/vxlan-protocol-capturing/359156 "2024-05-09T09:09:06Z")
Hi, I need to capture VXLAN protocol from my EC2 interface. I am trying to perform port mirroring in AWS, but based on the logs, it seems that VXLAN is not being recognized. The error message I am receiving is: "2024-05-… --- ## [\> May 09 03:22:39 KaliPurple kibana\[45550\]: FATAL CLI ERROR YAMLException: duplicated mapping key at line 186, column 1: May 09 03:22:39 KaliPurple kibana\[45550\]: server.host: "KaliPurple.kali.pu](https://discuss.elastic.co/t/may-09-0339-kalipurple-kibana-45550-fatal-cli-error-yamlexception-duplicated-mapping-key-at-line-186-column-1-may-09-0339-kalipurple-kibana-45550-server-host-kalipurple-kali-pu/359154)
**Author:** [@ihatekalilinux](https://discuss.elastic.co/u/ihatekalilinux)\ **Replies:** 0\ **Last updated:** [May 9, 2024, 8:55am UTC](https://discuss.elastic.co/t/may-09-0339-kalipurple-kibana-45550-fatal-cli-error-yamlexception-duplicated-mapping-key-at-line-186-column-1-may-09-0339-kalipurple-kibana-45550-server-host-kalipurple-kali-pu/359154 "2024-05-09T08:55:17Z")
please i have no clue what i am doing iv tried for like an hour to fix if anyone can help ill be thankful \ **Author:** [@zi\_ninja](https://discuss.elastic.co/u/zi_ninja)\ **Replies:** 0\ **Last updated:** [May 9, 2024, 7:18am UTC](https://discuss.elastic.co/t/anomaly-detection-algorithm/359140 "2024-05-09T07:18:09Z") I also have this question that I want answered. I looked at the links in the article, but most of them only generally explain what that value is, not detailed algorithms or calculations. Book link I can't read because … --- ## [Typical value](https://discuss.elastic.co/t/typical-value/358043)
**Author:** [@zi\_ninja](https://discuss.elastic.co/u/zi_ninja)\ **Replies:** 2\ **Last updated:** [May 9, 2024, 7:08am UTC](https://discuss.elastic.co/t/typical-value/358043 "2024-05-09T07:08:30Z")
In the single metric viewer, I see that the actual value is the value calculated from the actual data, but what about the typical value? How can I determine this typical value? Is the typical value being calculated accor… --- ## [MIB conversion of received traps using logstash snmptrap plugin](https://discuss.elastic.co/t/mib-conversion-of-received-traps-using-logstash-snmptrap-plugin/359137)
**Author:** [@miya-dit](https://discuss.elastic.co/u/miya-dit)\ **Replies:** 0\ **Last updated:** [May 9, 2024, 6:53am UTC](https://discuss.elastic.co/t/mib-conversion-of-received-traps-using-logstash-snmptrap-plugin/359137 "2024-05-09T06:53:04Z")
I want to convert MIBs for traps received using the logstash snmptrap plugin. Currently, Logstash inputs SNMPTRAP as follows and outputs it to AWS SNS. SNMPTRAP -\> Logstash -\> AWS SNS (E-mail) SNS notifications are se… --- ## [Hardware requirements for elasticssearch](https://discuss.elastic.co/t/hardware-requirements-for-elasticssearch/359059)
**Author:** [@Muhammad\_Shahyan](https://discuss.elastic.co/u/Muhammad_Shahyan)\ **Replies:** 4\ **Last updated:** [May 9, 2024, 6:51am UTC](https://discuss.elastic.co/t/hardware-requirements-for-elasticssearch/359059 "2024-05-09T06:51:28Z")
what are the minimum hardware requirements for high availability elk cluster. --- ## [When queue.mem.events reaches the maximum value, are new events waiting or discarded? Hope for an answer.](https://discuss.elastic.co/t/when-queue-mem-events-reaches-the-maximum-value-are-new-events-waiting-or-discarded-hope-for-an-answer/359062)
**Author:** [@sunrdd](https://discuss.elastic.co/u/sunrdd)\ **Replies:** 6\ **Last updated:** [May 9, 2024, 6:01am UTC](https://discuss.elastic.co/t/when-queue-mem-events-reaches-the-maximum-value-are-new-events-waiting-or-discarded-hope-for-an-answer/359062 "2024-05-09T06:01:22Z")
When queue.mem.events reaches the maximum value, are new events waiting or discarded? Hope for an answer. --- ## [ILM enabled Logstash Pipeline Issue](https://discuss.elastic.co/t/ilm-enabled-logstash-pipeline-issue/358697)
**Author:** [@Souvik\_Das](https://discuss.elastic.co/u/Souvik_Das)\ **Replies:** 8\ **Last updated:** [May 9, 2024, 4:57am UTC](https://discuss.elastic.co/t/ilm-enabled-logstash-pipeline-issue/358697 "2024-05-09T04:57:57Z")
Hi Folks, I am facing an issue with a ILM enabled logstash pipeline. Let me describe my objective. So I have created a logstash pipeline that has upsert feature to update/insert documents in the elasticsearch index. My … --- ## [Avoid duplicate in nested table via logstagh](https://discuss.elastic.co/t/avoid-duplicate-in-nested-table-via-logstagh/359123)
**Author:** [@karthikeyanc2003](https://discuss.elastic.co/u/karthikeyanc2003)\ **Replies:** 1\ **Last updated:** [May 9, 2024, 4:26am UTC](https://discuss.elastic.co/t/avoid-duplicate-in-nested-table-via-logstagh/359123 "2024-05-09T04:26:09Z")
Can someone please help with mapping when there are more than 1 nested type properties in the aggregate mapping I am seeing a duplicate of data getting created in the document for the nested type properties, when in the… --- ## [Auditbeat memory leak in 8.13.0](https://discuss.elastic.co/t/auditbeat-memory-leak-in-8-13-0/357512)
**Author:** [@nemo](https://discuss.elastic.co/u/nemo)\ **Replies:** 25\ **Last updated:** [May 9, 2024, 2:40am UTC](https://discuss.elastic.co/t/auditbeat-memory-leak-in-8-13-0/357512 "2024-05-09T02:40:53Z")
Hi! I use auditbeat v8.13.0, and the memory grows very large. The auditbeat running on a web server with less requests. Below there's some screen shots: --- ## [\[Elasticsearch\] How to keep cache consistent](https://discuss.elastic.co/t/elasticsearch-how-to-keep-cache-consistent/359116)
**Author:** [@david89](https://discuss.elastic.co/u/david89)\ **Replies:** 0\ **Last updated:** [May 9, 2024, 12:37am UTC](https://discuss.elastic.co/t/elasticsearch-how-to-keep-cache-consistent/359116 "2024-05-09T00:37:09Z")
Hello, I am applying rollover for my cluster, also refresh\_interval = 7d for old rollover index But sometimes the cache/or indice is refreshed, I do not know the reason Do you know the way I can keep the Elasticsearch … --- ## [Elastic Agent (IronBank) Components: Missing Executable Permissions on GO CLI Binaries](https://discuss.elastic.co/t/elastic-agent-ironbank-components-missing-executable-permissions-on-go-cli-binaries/358997)
**Author:** [@zedtran](https://discuss.elastic.co/u/zedtran)\ **Replies:** 1\ **Last updated:** [May 8, 2024, 9:08pm UTC](https://discuss.elastic.co/t/elastic-agent-ironbank-components-missing-executable-permissions-on-go-cli-binaries/358997 "2024-05-08T21:08:00Z")
The following files are missing the executable permission in the resulting Elastic Agent image stored in the IronBank container registry (File Type: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically lin… --- ## [Http\_poller time out error](https://discuss.elastic.co/t/http-poller-time-out-error/359099)
**Author:** [@kishorkumar](https://discuss.elastic.co/u/kishorkumar)\ **Replies:** 1\ **Last updated:** [May 8, 2024, 7:45pm UTC](https://discuss.elastic.co/t/http-poller-time-out-error/359099 "2024-05-08T19:45:43Z")
we are recieving the timeout error in http\_poller by connecting it to guardium, our database is guardium . my http pollar settings as follow input { http\_poller { urls = \> { "d1" … --- ## [Auditbeat does not log all commands executed by users](https://discuss.elastic.co/t/auditbeat-does-not-log-all-commands-executed-by-users/359088)
**Author:** [@Claudio\_Ract\_Costa](https://discuss.elastic.co/u/Claudio_Ract_Costa)\ **Replies:** 1\ **Last updated:** [May 8, 2024, 6:28pm UTC](https://discuss.elastic.co/t/auditbeat-does-not-log-all-commands-executed-by-users/359088 "2024-05-08T18:28:08Z")
Hi All, How can I configure auditbeat to log all commands executed by users ? I am asking it because when i execute "echo test" command, it is not logged by auditbeat, but when i execute "/usr/bin/echo test" command, i… --- ## [Uptime Monitoring Hierarchy: Main Monitor Status Based on Server Availability](https://discuss.elastic.co/t/uptime-monitoring-hierarchy-main-monitor-status-based-on-server-availability/358806)
**Author:** [@kasecen637](https://discuss.elastic.co/u/kasecen637)\ **Replies:** 1\ **Last updated:** [May 8, 2024, 5:04pm UTC](https://discuss.elastic.co/t/uptime-monitoring-hierarchy-main-monitor-status-based-on-server-availability/358806 "2024-05-08T17:04:29Z")
Hello Elastic Community, I Need to create a hierarchical tree structure for monitoring uptime across three servers, labeled A, B, and C. I want to have a main monitor, and when all three servers are running, the main mo… --- ## [Superuser user mistaken as kibana\_system](https://discuss.elastic.co/t/superuser-user-mistaken-as-kibana-system/359081)
**Author:** [@simran\_sandhu](https://discuss.elastic.co/u/simran_sandhu)\ **Replies:** 0\ **Last updated:** [May 8, 2024, 3:11pm UTC](https://discuss.elastic.co/t/superuser-user-mistaken-as-kibana-system/359081 "2024-05-08T15:11:32Z")
So I made an integration package using elastic-package. When I try to push the zip file to elastic using my credentials, which have superuser role access, I get the following error: {"statusCode":500,"error":"Internal S… --- ## [I want to create a table inside kibana watcher and add the relevant data in it. Urgent](https://discuss.elastic.co/t/i-want-to-create-a-table-inside-kibana-watcher-and-add-the-relevant-data-in-it-urgent/358957)
**Author:** [@maheenali081995](https://discuss.elastic.co/u/maheenali081995)\ **Replies:** 4\ **Last updated:** [May 8, 2024, 2:04pm UTC](https://discuss.elastic.co/t/i-want-to-create-a-table-inside-kibana-watcher-and-add-the-relevant-data-in-it-urgent/358957 "2024-05-08T14:04:58Z")
I'm trying to create a kibana watcher for alerting purpose. I need help how i can create a table inside kibana watcher and add the relevant fields in it. Below is my watcher json { "trigger": { "schedule": { "interv… --- ## [Anomaly Detection API](https://discuss.elastic.co/t/anomaly-detection-api/359075)
**Author:** [@tr0lln](https://discuss.elastic.co/u/tr0lln)\ **Replies:** 0\ **Last updated:** [May 8, 2024, 2:02pm UTC](https://discuss.elastic.co/t/anomaly-detection-api/359075 "2024-05-08T14:02:41Z")
Hi, I've created an Anomaly Detection job which I'm wanting to integrate into one of our playbook orchestration tools (XSoar). In short, when triggered i want to pull the current anomaly score from the job for the speci… --- ## [Rollover to Frozen Tier](https://discuss.elastic.co/t/rollover-to-frozen-tier/359056)
**Author:** [@ksremo](https://discuss.elastic.co/u/ksremo)\ **Replies:** 1\ **Last updated:** [May 8, 2024, 1:46pm UTC](https://discuss.elastic.co/t/rollover-to-frozen-tier/359056 "2024-05-08T13:46:27Z")
Hello, As I understand it, it is necessary to have an alias defined before using ILM for migrating from the hot phase to the frozen phase. However, this is not all; the alias configuration also needs to specify which in… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=243) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=245)