# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=253 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 254 --- ## [CEF Integration Dataset name](https://discuss.elastic.co/t/cef-integration-dataset-name/358230)
**Author:** [@jsalbre](https://discuss.elastic.co/u/jsalbre)\ **Replies:** 2\ **Last updated:** [April 29, 2024, 1:54pm UTC](https://discuss.elastic.co/t/cef-integration-dataset-name/358230 "2024-04-29T13:54:40Z")
Is there a hidden configuration setting (or plans to add a configuration setting) to change the dataset name in the CEF integration, like most other integrations? We're stuck with "logs-cef.log-default" for our data stre… --- ## [Optimizing Elasticsearch Performance with ILM: Seeking Guidance](https://discuss.elastic.co/t/optimizing-elasticsearch-performance-with-ilm-seeking-guidance/358431)
**Author:** [@Souvik\_Das](https://discuss.elastic.co/u/Souvik_Das)\ **Replies:** 0\ **Last updated:** [April 29, 2024, 1:50pm UTC](https://discuss.elastic.co/t/optimizing-elasticsearch-performance-with-ilm-seeking-guidance/358431 "2024-04-29T13:50:33Z")
Hey Folks, I'm reaching out for some guidance on grasping the ins and outs of ILM (Index Lifecycle Management). Currently, my ELK setup for production consists of a three-node Elasticsearch cluster, with dedicated serv… --- ## [Winlogbeat 8.13.0 dont start service](https://discuss.elastic.co/t/winlogbeat-8-13-0-dont-start-service/356671)
**Author:** [@brunopsitech](https://discuss.elastic.co/u/brunopsitech)\ **Replies:** 8\ **Last updated:** [April 29, 2024, 1:42pm UTC](https://discuss.elastic.co/t/winlogbeat-8-13-0-dont-start-service/356671 "2024-04-29T13:42:47Z")
I install Winlogbeat and its not start service, i use the default config file and nothing, i recive error 1053 from windows service. I am using windows 11. --- ## [Metricbeat is mixing Kubernetes resources](https://discuss.elastic.co/t/metricbeat-is-mixing-kubernetes-resources/358429)
**Author:** [@ebuildy](https://discuss.elastic.co/u/ebuildy)\ **Replies:** 0\ **Last updated:** [April 29, 2024, 1:25pm UTC](https://discuss.elastic.co/t/metricbeat-is-mixing-kubernetes-resources/358429 "2024-04-29T13:25:26Z")
Running metricbeat 8.13 with ECK, against Kubernetes AKS 1.28 The config is simple, I want only metrics about containers in a single namespace: autodiscover: providers: - hints: enabled: true default\_co… --- ## [Elastic Search Case Insensitive for key](https://discuss.elastic.co/t/elastic-search-case-insensitive-for-key/358402)
**Author:** [@Harinder\_Singh](https://discuss.elastic.co/u/Harinder_Singh)\ **Replies:** 3\ **Last updated:** [April 29, 2024, 12:09pm UTC](https://discuss.elastic.co/t/elastic-search-case-insensitive-for-key/358402 "2024-04-29T12:09:30Z")
Hi, I have a requirement where I need to do the Elasticsearch search case insensitivity, but need on both key and value field. Sample Documents POST test-index21/\_doc { "Name": "something" } POST test-index21/\_doc … --- ## [Collect Windows DNS Server Querries with Elastic Agent?](https://discuss.elastic.co/t/collect-windows-dns-server-querries-with-elastic-agent/358421)
**Author:** [@ben-sec](https://discuss.elastic.co/u/ben-sec)\ **Replies:** 0\ **Last updated:** [April 29, 2024, 11:33am UTC](https://discuss.elastic.co/t/collect-windows-dns-server-querries-with-elastic-agent/358421 "2024-04-29T11:33:44Z")
Hi! Can I use Elastic Agent to collect all Windows DNS server activity to store them in my Elastic Search server? If yes, do I have to setup the parsing on my own? Thanks in advance! Cheers, Ben --- ## [Elastic\_agent.metricbeat error fetching data from metricsets.kubernetes.system](https://discuss.elastic.co/t/elastic-agent-metricbeat-error-fetching-data-from-metricsets-kubernetes-system/358398)
**Author:** [@Subrahmanyam\_Veerank](https://discuss.elastic.co/u/Subrahmanyam_Veerank)\ **Replies:** 2\ **Last updated:** [April 29, 2024, 10:02am UTC](https://discuss.elastic.co/t/elastic-agent-metricbeat-error-fetching-data-from-metricsets-kubernetes-system/358398 "2024-04-29T10:02:32Z")
Sir, Deployed elastic agent (fleet managed) in kubernetes cluster but the metric related details are not getting shown in the dashboards and observing the below errors. Kindly help us resolve the issue. \[elastic\_agent.… --- ## [@timestamp not match with log timestamp](https://discuss.elastic.co/t/timestamp-not-match-with-log-timestamp/358403)
**Author:** [@Ken\_Pang](https://discuss.elastic.co/u/Ken_Pang)\ **Replies:** 1\ **Last updated:** [April 29, 2024, 9:47am UTC](https://discuss.elastic.co/t/timestamp-not-match-with-log-timestamp/358403 "2024-04-29T09:47:58Z")
I'm new to ELK, I've search the related post here, but still unable to get my event timestamp work, anyone can help? my sample data 2024/04/29 15:46:11.833 Dev = TTA10B6001-01, Data: Current State = ReadTagStatus, New… --- ## [Facing some challenges with elastic storage in the cloud](https://discuss.elastic.co/t/facing-some-challenges-with-elastic-storage-in-the-cloud/357909)
**Author:** [@Fayis\_Vadakkan](https://discuss.elastic.co/u/Fayis_Vadakkan)\ **Replies:** 7\ **Last updated:** [April 29, 2024, 9:16am UTC](https://discuss.elastic.co/t/facing-some-challenges-with-elastic-storage-in-the-cloud/357909 "2024-04-29T09:16:22Z")
I am facing some challenges with elastic storage in the cloud. Is there any way to transfer unwanted logs directly to frozen storage to reduce hot storage consumption? --- ## [Using BoolQuery.Builder with NativeQuery](https://discuss.elastic.co/t/using-boolquery-builder-with-nativequery/358363)
**Author:** [@ajt001](https://discuss.elastic.co/u/ajt001)\ **Replies:** 1\ **Last updated:** [April 29, 2024, 8:54am UTC](https://discuss.elastic.co/t/using-boolquery-builder-with-nativequery/358363 "2024-04-29T08:54:25Z")
Hi. Maybe this is basic, but I can't find the answer. I used to have this code: ... BoolQueryBuilder boolQueryBuilder = processElasticRequest() NativeSearchQuery query = new NativeSearchQueryBuilder() .withQ… --- ## [Compare a field between two Index](https://discuss.elastic.co/t/compare-a-field-between-two-index/358401)
**Author:** [@ajaya\_panda](https://discuss.elastic.co/u/ajaya_panda)\ **Replies:** 1\ **Last updated:** [April 29, 2024, 8:07am UTC](https://discuss.elastic.co/t/compare-a-field-between-two-index/358401 "2024-04-29T08:07:40Z")
Hi Team, I want to compare a field between two index are have same value or not. How can we perform that? please provide the suggestions. Example: Let's say I have two indexes one is onlineSale and another is offlineS… --- ## [Formula in lens metrics in kibana](https://discuss.elastic.co/t/formula-in-lens-metrics-in-kibana/358201)
**Author:** [@aram215](https://discuss.elastic.co/u/aram215)\ **Replies:** 5\ **Last updated:** [April 29, 2024, 8:00am UTC](https://discuss.elastic.co/t/formula-in-lens-metrics-in-kibana/358201 "2024-04-29T08:00:19Z")
How to create a formula in lens-metrics that gives me the sum of 'value A' where there's a max in 'value B'. --- ## [Jsonify fortigate](https://discuss.elastic.co/t/jsonify-fortigate/358391)
**Author:** [@m\_pahlevanzadeh](https://discuss.elastic.co/u/m_pahlevanzadeh)\ **Replies:** 1\ **Last updated:** [April 29, 2024, 7:32am UTC](https://discuss.elastic.co/t/jsonify-fortigate/358391 "2024-04-29T07:32:00Z")
I visit the following page: At end of above line, it mentioned to fortinet fields. My scenario: I get fortiGate syslog and I can put into elastics. Now I want to jsonify , because I need to search according in kibana… --- ## [Search template with compare equal](https://discuss.elastic.co/t/search-template-with-compare-equal/358390)
**Author:** [@h\_ng\_d\_ng](https://discuss.elastic.co/u/h_ng_d_ng)\ **Replies:** 3\ **Last updated:** [April 29, 2024, 7:24am UTC](https://discuss.elastic.co/t/search-template-with-compare-equal/358390 "2024-04-29T07:24:11Z")
Hi i am trying using search template to compare equal string to return specific records, it looks like this {{#equals false isJobInProgress}} ,{"bool":{"should":\[{"term":{"is\_job\_in\_progress":false}},{"bool":{"must\_no… --- ## [JDBC password needs to be retrieved from CyberArk and cached locally](https://discuss.elastic.co/t/jdbc-password-needs-to-be-retrieved-from-cyberark-and-cached-locally/358193)
**Author:** [@forabraham1](https://discuss.elastic.co/u/forabraham1)\ **Replies:** 3\ **Last updated:** [April 29, 2024, 7:09am UTC](https://discuss.elastic.co/t/jdbc-password-needs-to-be-retrieved-from-cyberark-and-cached-locally/358193 "2024-04-29T07:09:24Z")
In our setup, there are ~ 30 JDBC configs \*.conf (one per client) within that it will have one input section with 4 different jdbc section (one per functionality). Every functionality JDBC sections are scheduled to run e… --- ## [Is logstash supports multiple grok pattern?](https://discuss.elastic.co/t/is-logstash-supports-multiple-grok-pattern/358393)
**Author:** [@abhishekacharya828](https://discuss.elastic.co/u/abhishekacharya828)\ **Replies:** 3\ **Last updated:** [April 29, 2024, 6:46am UTC](https://discuss.elastic.co/t/is-logstash-supports-multiple-grok-pattern/358393 "2024-04-29T06:46:31Z")
filter { grok { match =\> { "message" =\> \[ "%{TIMESTAMP\_ISO8601:timestamp} \[%{LOGLEVEL:loglevel}\] %{GREEDYDATA:message}", "\\\[%{LOGLEVEL:log\_level}\\\] System Metrics: CPU %{NUMBER:cpu\_usage}%\\, Memory %{NUMBER:memory\_… --- ## [Filebeat is not sending logs to Elasticsearch](https://discuss.elastic.co/t/filebeat-is-not-sending-logs-to-elasticsearch/358322)
**Author:** [@TflGustavo](https://discuss.elastic.co/u/TflGustavo)\ **Replies:** 4\ **Last updated:** [April 28, 2024, 7:29pm UTC](https://discuss.elastic.co/t/filebeat-is-not-sending-logs-to-elasticsearch/358322 "2024-04-28T19:29:52Z")
Hello! I created a Spring application and now I'm trying to use Filebeat to send this application's logs to Elasticsearch, so that I can view the information in Kibana. The problem is that even though I configure the f… --- ## [Elastic Agent Fleet](https://discuss.elastic.co/t/elastic-agent-fleet/358377)
**Author:** [@Ankita\_Pachauri](https://discuss.elastic.co/u/Ankita_Pachauri)\ **Replies:** 0\ **Last updated:** [April 28, 2024, 6:30pm UTC](https://discuss.elastic.co/t/elastic-agent-fleet/358377 "2024-04-28T18:30:36Z")
Hi Folks, Can somebody help me understand with the following questions? What is the difference wrt data flow or loss if two machines are using a single fleet policy and different policy? When we use fleet in Elast… --- ## [I have data in Azure Table storage and i want to publish that data in Elasticsearch for better filtration](https://discuss.elastic.co/t/i-have-data-in-azure-table-storage-and-i-want-to-publish-that-data-in-elasticsearch-for-better-filtration/358372)
**Author:** [@S\_DevOps](https://discuss.elastic.co/u/S_DevOps)\ **Replies:** 0\ **Last updated:** [April 28, 2024, 1:38pm UTC](https://discuss.elastic.co/t/i-have-data-in-azure-table-storage-and-i-want-to-publish-that-data-in-elasticsearch-for-better-filtration/358372 "2024-04-28T13:38:56Z")
Hi All, I have data stored in Azure Table storage(attached image for reference). I want that data in to our elastic cloud for better filtration and bifurcation based on requirement. Need your Support to achieve it. I;m … --- ## [Docker elasticsearch FileSystemException - Not a directory](https://discuss.elastic.co/t/docker-elasticsearch-filesystemexception-not-a-directory/358362)
**Author:** [@bharat\_soni1](https://discuss.elastic.co/u/bharat_soni1)\ **Replies:** 3\ **Last updated:** [April 28, 2024, 11:53am UTC](https://discuss.elastic.co/t/docker-elasticsearch-filesystemexception-not-a-directory/358362 "2024-04-28T11:53:40Z")
Hi, I'm very new to Docker as well as Elasticsearch. I was following a tutorial and used this docker compose file to install Elasticsearch: version: "4.6" services: es01: image: "docker.elastic.co/elasticsearch/el… --- ## [ES + ES Enterprise Search via Docker Compose ignores password](https://discuss.elastic.co/t/es-es-enterprise-search-via-docker-compose-ignores-password/358358)
**Author:** [@fherder](https://discuss.elastic.co/u/fherder)\ **Replies:** 0\ **Last updated:** [April 28, 2024, 12:05am UTC](https://discuss.elastic.co/t/es-es-enterprise-search-via-docker-compose-ignores-password/358358 "2024-04-28T00:05:22Z")
Hey all, I'm trying to get Elasticsearch configured with Enterprise Search. I'm using docker compose to do so. I'm using the following files: # Password for the 'elastic' user (at least 6 characters) ELASTIC\_PASSWORD=su… --- ## [Filter out the exact errors in kibana](https://discuss.elastic.co/t/filter-out-the-exact-errors-in-kibana/358336)
**Author:** [@Vansh1](https://discuss.elastic.co/u/Vansh1)\ **Replies:** 1\ **Last updated:** [April 27, 2024, 10:32pm UTC](https://discuss.elastic.co/t/filter-out-the-exact-errors-in-kibana/358336 "2024-04-27T22:32:41Z")
Hello guys i am creating a dashboard where i can see the exact errors occuring but i am only able to add the log.file.path in the dashboard which shows error message not the exact error. like i want to visualize which e… --- ## [Error in Creating Elastic Config file - JAVA - Springboot](https://discuss.elastic.co/t/error-in-creating-elastic-config-file-java-springboot/356542)
**Author:** [@Priyam\_Omer](https://discuss.elastic.co/u/Priyam_Omer)\ **Replies:** 10\ **Last updated:** [April 27, 2024, 10:05pm UTC](https://discuss.elastic.co/t/error-in-creating-elastic-config-file-java-springboot/356542 "2024-04-27T22:05:31Z")
package com.example.springbootelasticseach; import org.springframework.context.annotation.Configuration; import org.springframework.data.elasticsearch.client.ClientConfiguration; import org.springframework.data.elastics… --- ## [Definition of plugin "urlForwarding" not found and may have failed to load](https://discuss.elastic.co/t/definition-of-plugin-urlforwarding-not-found-and-may-have-failed-to-load/357810)
**Author:** [@ZhenyaPav](https://discuss.elastic.co/u/ZhenyaPav)\ **Replies:** 2\ **Last updated:** [April 27, 2024, 9:49pm UTC](https://discuss.elastic.co/t/definition-of-plugin-urlforwarding-not-found-and-may-have-failed-to-load/357810 "2024-04-27T21:49:27Z")
When trying to access Kibana from a reverse proxy with Cloudflare DNS, I get this error: Version: 8.13.2 Build: 72154 Error: Definition of plugin "urlForwarding" not found and may have failed to load. createPluginInstan… --- ## [Can I deploy open source ELK stack for multi cloud scenario like GCP and AWS for capturing logs, metrics and Kibana dashboard centrally on GCP of the cloud? Or does multi cloud scenario require a licensed version only?](https://discuss.elastic.co/t/can-i-deploy-open-source-elk-stack-for-multi-cloud-scenario-like-gcp-and-aws-for-capturing-logs-metrics-and-kibana-dashboard-centrally-on-gcp-of-the-cloud-or-does-multi-cloud-scenario-require-a-licensed-version-only/358352)
**Author:** [@hsinha09](https://discuss.elastic.co/u/hsinha09)\ **Replies:** 3\ **Last updated:** [April 27, 2024, 6:32pm UTC](https://discuss.elastic.co/t/can-i-deploy-open-source-elk-stack-for-multi-cloud-scenario-like-gcp-and-aws-for-capturing-logs-metrics-and-kibana-dashboard-centrally-on-gcp-of-the-cloud-or-does-multi-cloud-scenario-require-a-licensed-version-only/358352 "2024-04-27T18:32:43Z")
Can someone help me with details around how to install opensource ELK tools on multi cloud environment GKE and EKS to achive end to end central observability for logs and metrics. What are the limitations of open sourc… --- ## [Kibana 8 windows zip file](https://discuss.elastic.co/t/kibana-8-windows-zip-file/357872)
**Author:** [@altink](https://discuss.elastic.co/u/altink)\ **Replies:** 2\ **Last updated:** [April 27, 2024, 5:56pm UTC](https://discuss.elastic.co/t/kibana-8-windows-zip-file/357872 "2024-04-27T17:56:52Z")
HI Did download ElasticSearchm LogStash and Kibana 8.13.2 for Windows. The file kibana-8.13.2-windows-x86\_64.zip: has no folder when opened with Rar files cannot be extracted with Winzip. Winzip hangs with "Not respo… --- ## [I am getting the dynamic method error](https://discuss.elastic.co/t/i-am-getting-the-dynamic-method-error/358337)
**Author:** [@Anil\_Alapati](https://discuss.elastic.co/u/Anil_Alapati)\ **Replies:** 1\ **Last updated:** [April 27, 2024, 2:46pm UTC](https://discuss.elastic.co/t/i-am-getting-the-dynamic-method-error/358337 "2024-04-27T14:46:26Z")
Hi, I am getting the dynamic method error . dynamic method \[java.time.ZonedDateTime, toString/1\] not found. the issue sis related to datetime field. epoch = (doc\['field'\].value).tostring("MM.dd.yyyy HH:mm:ss"); Could… --- ## [Disable the basic user authentication in kibana: 7.17](https://discuss.elastic.co/t/disable-the-basic-user-authentication-in-kibana-7-17/358266)
**Author:** [@nkarthik](https://discuss.elastic.co/u/nkarthik)\ **Replies:** 2\ **Last updated:** [April 27, 2024, 2:42pm UTC](https://discuss.elastic.co/t/disable-the-basic-user-authentication-in-kibana-7-17/358266 "2024-04-27T14:42:22Z")
Hi, I have integrated AD to authenticate users to kibana. So, I want to disable the basic user authentication page. I tried setting xpack.security.enabled: false but I am getting below error. Can anyone please help me … --- ## [Kibana Upgrade Migration issue](https://discuss.elastic.co/t/kibana-upgrade-migration-issue/358330)
**Author:** [@prasathb](https://discuss.elastic.co/u/prasathb)\ **Replies:** 0\ **Last updated:** [April 27, 2024, 5:22am UTC](https://discuss.elastic.co/t/kibana-upgrade-migration-issue/358330 "2024-04-27T05:22:34Z")
{"service":{"node":{"roles":\["background\_tasks","ui"\]}},"ecs":{"version":"8.11.0"},"@timestamp":"2024-04-27T01:11:58.206-04:00","message":"\[.kibana\_task\_manager\] OUTDATED\_DOCUMENTS\_TRANSFORM -\> TRANSFORMED\_DOCUMENTS\_BULK… --- ## [Query to list all \_ignored field values](https://discuss.elastic.co/t/query-to-list-all-ignored-field-values/358312)
**Author:** [@Alex\_Raguero](https://discuss.elastic.co/u/Alex_Raguero)\ **Replies:** 4\ **Last updated:** [April 26, 2024, 11:05pm UTC](https://discuss.elastic.co/t/query-to-list-all-ignored-field-values/358312 "2024-04-26T23:05:23Z")
I am running ES version 7.10. What is the query to get all docs where \_ignored field exists and lists the value? [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=252) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=254)