# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=263 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 264 --- ## [Graylog in kuberenetes cluster](https://discuss.elastic.co/t/graylog-in-kuberenetes-cluster/357416)
**Author:** [@cake007](https://discuss.elastic.co/u/cake007)\ **Replies:** 1\ **Last updated:** [April 15, 2024, 11:10am UTC](https://discuss.elastic.co/t/graylog-in-kuberenetes-cluster/357416 "2024-04-15T11:10:47Z")
I have graylog and elasticsearch deployed in kuberenetes. Three graylog nodes as cluster and three elasticsearch with 1 master and two master eligible nodes. The spec of the worker nodes is 64 core and 128gb ram and 20TB… --- ## [Search special characters](https://discuss.elastic.co/t/search-special-characters/357392)
**Author:** [@abekedevelop](https://discuss.elastic.co/u/abekedevelop)\ **Replies:** 6\ **Last updated:** [April 15, 2024, 10:48am UTC](https://discuss.elastic.co/t/search-special-characters/357392 "2024-04-15T10:48:46Z")
Hello! I am trying to search special characters in a field where values might be like BOSCH (+8) some other article BOSCH (+16) some article DENSO (+1) ik20 and so on. so i need to have possibility to search like +… --- ## [Elasticsearch timeouts/requests taking too long](https://discuss.elastic.co/t/elasticsearch-timeouts-requests-taking-too-long/357267)
**Author:** [@Joao\_Cardoso](https://discuss.elastic.co/u/Joao_Cardoso)\ **Replies:** 10\ **Last updated:** [April 15, 2024, 9:08am UTC](https://discuss.elastic.co/t/elasticsearch-timeouts-requests-taking-too-long/357267 "2024-04-15T09:08:40Z")
Elastic.Clients.Elasticsearch version: 8.12.0 Elasticsearch version: 8.x.x .NET runtime version: 8 Description of the problem including expected versus actual behavior: When submitted to loading tests (let's say a… --- ## [Filebeat loses or doesn't deliver messages from AWS CloudTrail](https://discuss.elastic.co/t/filebeat-loses-or-doesnt-deliver-messages-from-aws-cloudtrail/355291)
**Author:** [@San9](https://discuss.elastic.co/u/San9)\ **Replies:** 3\ **Last updated:** [April 15, 2024, 8:17am UTC](https://discuss.elastic.co/t/filebeat-loses-or-doesnt-deliver-messages-from-aws-cloudtrail/355291 "2024-04-15T08:17:28Z")
Hello team. I installed and configured filebeat to collect logs in aws. I use the aws module to collect logs cloudtrail. The data began to be collected, but I noticed that the data was not included in the log - "event… --- ## [Possessive\_english stemmer ignoring proctected keywords in Elasticsearch](https://discuss.elastic.co/t/possessive-english-stemmer-ignoring-proctected-keywords-in-elasticsearch/357395)
**Author:** [@Sarah\_Buchinger](https://discuss.elastic.co/u/Sarah_Buchinger)\ **Replies:** 0\ **Last updated:** [April 15, 2024, 8:12am UTC](https://discuss.elastic.co/t/possessive-english-stemmer-ignoring-proctected-keywords-in-elasticsearch/357395 "2024-04-15T08:12:40Z")
Hello ! Would love to get your help with the following. I want to use the possessive\_english stemmer with an exception list, to prevent the removal of the ending " 's " in specific words. However, the possessive\_eng… --- ## [How to Change Axis Tick Label Colors in Kibana Dark Theme for Better Readability?](https://discuss.elastic.co/t/how-to-change-axis-tick-label-colors-in-kibana-dark-theme-for-better-readability/356085)
**Author:** [@Behnam.R](https://discuss.elastic.co/u/Behnam.R)\ **Replies:** 2\ **Last updated:** [April 15, 2024, 8:04am UTC](https://discuss.elastic.co/t/how-to-change-axis-tick-label-colors-in-kibana-dark-theme-for-better-readability/356085 "2024-04-15T08:04:31Z")
Hi, I'm using Kibana 8.6.1 with the dark theme and facing readability issues with the axis tick labels on big screens in our operations center, as they appear in light grey. This readability concern is significant for … --- ## [ES permission filter](https://discuss.elastic.co/t/es-permission-filter/357393)
**Author:** [@anuj99](https://discuss.elastic.co/u/anuj99)\ **Replies:** 0\ **Last updated:** [April 15, 2024, 7:30am UTC](https://discuss.elastic.co/t/es-permission-filter/357393 "2024-04-15T07:30:30Z")
I am storing data in ES as follows: I have text and storing chunks of text as separate documents in ES. Each text has different permissions as to which user can view it. I need most relevant passages and not text when… --- ## [Can I use 8.x instead of 7.x?](https://discuss.elastic.co/t/can-i-use-8-x-instead-of-7-x/357385)
**Author:** [@m\_pahlevanzadeh](https://discuss.elastic.co/u/m_pahlevanzadeh)\ **Replies:** 1\ **Last updated:** [April 15, 2024, 6:15am UTC](https://discuss.elastic.co/t/can-i-use-8-x-instead-of-7-x/357385 "2024-04-15T06:15:11Z")
I want to install ELK, in an article I read 7.x or less are open source. Can I install 8.x without buying? --- ## [Is it possible to make the Vega script dynamically retrieve data from OpenSearch every time the visualization is clicked, rather than just once?](https://discuss.elastic.co/t/is-it-possible-to-make-the-vega-script-dynamically-retrieve-data-from-opensearch-every-time-the-visualization-is-clicked-rather-than-just-once/357384)
**Author:** [@Aigerim\_Kubanychbeko](https://discuss.elastic.co/u/Aigerim_Kubanychbeko)\ **Replies:** 1\ **Last updated:** [April 15, 2024, 3:37am UTC](https://discuss.elastic.co/t/is-it-possible-to-make-the-vega-script-dynamically-retrieve-data-from-opensearch-every-time-the-visualization-is-clicked-rather-than-just-once/357384 "2024-04-15T03:37:55Z")
OpenSearch v2.11.1 Vega v5 I have already posted this question in OpenSearch community. I think I might get additional help in this group. { "$schema": "...modified/schema/vega/v5.json", "description": "An arc … --- ## [Filebeat has been updated from 8.11.1 to 8.13.1, but the Filebeat agent in Kibana is still 8.11.1](https://discuss.elastic.co/t/filebeat-has-been-updated-from-8-11-1-to-8-13-1-but-the-filebeat-agent-in-kibana-is-still-8-11-1/357188)
**Author:** [@Harry\_Huang](https://discuss.elastic.co/u/Harry_Huang)\ **Replies:** 0\ **Last updated:** [April 11, 2024, 7:22am UTC](https://discuss.elastic.co/t/filebeat-has-been-updated-from-8-11-1-to-8-13-1-but-the-filebeat-agent-in-kibana-is-still-8-11-1/357188 "2024-04-11T07:22:25Z")
ELK is installed on RHEL 8.8, and Filebeat is installed on Kubernetes. Currently, all versions have been updated from 8.11.1 to 8.13.1. Below is the complete information about the current environment: Elasticsearch ve… --- ## [Is it possible to get start position of highlighted value? (end position as well) and \_score filter also](https://discuss.elastic.co/t/is-it-possible-to-get-start-position-of-highlighted-value-end-position-as-well-and-score-filter-also/357380)
**Author:** [@sojoong.dev](https://discuss.elastic.co/u/sojoong.dev)\ **Replies:** 0\ **Last updated:** [April 15, 2024, 1:10am UTC](https://discuss.elastic.co/t/is-it-possible-to-get-start-position-of-highlighted-value-end-position-as-well-and-score-filter-also/357380 "2024-04-15T01:10:16Z")
Hi. First of all, Here is the query... GET /my\_doc/\_search { "query": { "function\_score": { "query": { "bool": { "must": \[ { "multi\_match": { "qu… --- ## [Performance of Range queries on Keyword fields](https://discuss.elastic.co/t/performance-of-range-queries-on-keyword-fields/357274)
**Author:** [@SayMyNameSB](https://discuss.elastic.co/u/SayMyNameSB)\ **Replies:** 3\ **Last updated:** [April 14, 2024, 10:38pm UTC](https://discuss.elastic.co/t/performance-of-range-queries-on-keyword-fields/357274 "2024-04-14T22:38:48Z")
Hello, how is the performance of Range queries on Keyword (string) fields? The date fields with values in ISO formats \[yyyy-MM-dd'T'HH:mm:ss. SSSXXX\] are indexed as keyword instead of date. There is a need to filter th… --- ## [Renew SSL certificate certificates on ES nodes](https://discuss.elastic.co/t/renew-ssl-certificate-certificates-on-es-nodes/357364)
**Author:** [@Naman\_Gandhi](https://discuss.elastic.co/u/Naman_Gandhi)\ **Replies:** 0\ **Last updated:** [April 14, 2024, 1:24pm UTC](https://discuss.elastic.co/t/renew-ssl-certificate-certificates-on-es-nodes/357364 "2024-04-14T13:24:48Z")
Hi everyone I am currently using Elastic. Search deployed on kubernetes And I have to renew Sel certificate certificates. I recently saw Get Hub that if I delete secrets they are renewed automatically But I am not able … --- ## ["Merging is blocked"](https://discuss.elastic.co/t/merging-is-blocked/357359)
**Author:** [@zeynepyz](https://discuss.elastic.co/u/zeynepyz)\ **Replies:** 0\ **Last updated:** [April 14, 2024, 11:55am UTC](https://discuss.elastic.co/t/merging-is-blocked/357359 "2024-04-14T11:55:07Z")
Hi i made pr a long ago and i was trying to success in all checks. In some point i was lost in git and i made some mistakes and i have to force-push to fix it properly. Now my project has merging is blocked error and whe… --- ## [Beginner Elasticsearch question: AND vs +](https://discuss.elastic.co/t/beginner-elasticsearch-question-and-vs/357345)
**Author:** [@chris312o](https://discuss.elastic.co/u/chris312o)\ **Replies:** 3\ **Last updated:** [April 13, 2024, 8:53pm UTC](https://discuss.elastic.co/t/beginner-elasticsearch-question-and-vs/357345 "2024-04-13T20:53:30Z")
I have a beginner's question about search syntax: are the following searches identical? or if not what is the difference? United AND Kingdom United +Kingdom Thank you --- ## [I have configuration of logstash for syslog , it is collecting from multiple devices, how can i create separate indices for each device](https://discuss.elastic.co/t/i-have-configuration-of-logstash-for-syslog-it-is-collecting-from-multiple-devices-how-can-i-create-separate-indices-for-each-device/357339)
**Author:** [@Sandeep\_Baljepally](https://discuss.elastic.co/u/Sandeep_Baljepally)\ **Replies:** 3\ **Last updated:** [April 13, 2024, 2:20pm UTC](https://discuss.elastic.co/t/i-have-configuration-of-logstash-for-syslog-it-is-collecting-from-multiple-devices-how-can-i-create-separate-indices-for-each-device/357339 "2024-04-13T14:20:49Z")
here is my snippet: syslog { port =\> 9111 syslog\_field =\> "syslog" grok\_pattern =\> "\<%{POSINT:priority}\>%{SYSLOGTIMESTAMP:timestamp} %{SYSLOGHOST:host} %{DATA:loglevel}: %{GREEDYDATA:messag… --- ## [Attach pipeline to index pattern](https://discuss.elastic.co/t/attach-pipeline-to-index-pattern/357342)
**Author:** [@ashish25](https://discuss.elastic.co/u/ashish25)\ **Replies:** 1\ **Last updated:** [April 13, 2024, 11:31am UTC](https://discuss.elastic.co/t/attach-pipeline-to-index-pattern/357342 "2024-04-13T11:31:14Z")
Please let us know how to link pipeline to a index pattern? I already created a pipeline and want to attach to a index pattern so that it will be applicable for multiple index. --- ## [Elastic script to update document based on documents present in other index](https://discuss.elastic.co/t/elastic-script-to-update-document-based-on-documents-present-in-other-index/357313)
**Author:** [@ashish25](https://discuss.elastic.co/u/ashish25)\ **Replies:** 5\ **Last updated:** [April 13, 2024, 11:01am UTC](https://discuss.elastic.co/t/elastic-script-to-update-document-based-on-documents-present-in-other-index/357313 "2024-04-13T11:01:39Z")
Hi Team, I want to update document based on other index document. I am trying something like below but I am getting "illegal\_argument\_exception" error. I am wondering is it possible or I am missing something? POST tes… --- ## [Filebeat netflow module reject document with status 400](https://discuss.elastic.co/t/filebeat-netflow-module-reject-document-with-status-400/356561)
**Author:** [@metie](https://discuss.elastic.co/u/metie)\ **Replies:** 16\ **Last updated:** [April 13, 2024, 10:53am UTC](https://discuss.elastic.co/t/filebeat-netflow-module-reject-document-with-status-400/356561 "2024-04-13T10:53:34Z")
Hello, I've updated filebeat, elasticsearch and kibana from the version 8.12.2 to 8.13.0 on ubuntu. After that i get an error when the stack is trying to ingest netflow. filebeat\[2101\]: {"log.level":"debug","@timestamp… --- ## [I want to monitor the creation of an AD account between 9 a.m. and 5 p.m](https://discuss.elastic.co/t/i-want-to-monitor-the-creation-of-an-ad-account-between-9-a-m-and-5-p-m/357095)
**Author:** [@Syphax](https://discuss.elastic.co/u/Syphax)\ **Replies:** 7\ **Last updated:** [April 13, 2024, 8:22am UTC](https://discuss.elastic.co/t/i-want-to-monitor-the-creation-of-an-ad-account-between-9-a-m-and-5-p-m/357095 "2024-04-13T08:22:55Z")
Hi every one, I want to create a KQL rule to detect all accounts created outside of working hours. I used @timestamp but it shows me an errors what I did but it didn't work: event.code: "4726" and (@timestamp\>= 09:00… --- ## [Create a new indices for each random directory](https://discuss.elastic.co/t/create-a-new-indices-for-each-random-directory/357329)
**Author:** [@Sandeep\_Baljepally](https://discuss.elastic.co/u/Sandeep_Baljepally)\ **Replies:** 3\ **Last updated:** [April 13, 2024, 7:22am UTC](https://discuss.elastic.co/t/create-a-new-indices-for-each-random-directory/357329 "2024-04-13T07:22:45Z")
Hi Team, I have a requirement to create randomly generated directories from scripts to create separate indices i.e /mnt/data/logger/xyz/xyz-1.1.1.1 and /mnt/data/logger/xyz/xyz-1.2.1.1 here xyz-x.x.x.x these are gen… --- ## [Problem using logstash-input-google\_pubsub with an https proxy](https://discuss.elastic.co/t/problem-using-logstash-input-google-pubsub-with-an-https-proxy/357295)
**Author:** [@Pedro\_Baldanta](https://discuss.elastic.co/u/Pedro_Baldanta)\ **Replies:** 1\ **Last updated:** [April 13, 2024, 6:48am UTC](https://discuss.elastic.co/t/problem-using-logstash-input-google-pubsub-with-an-https-proxy/357295 "2024-04-13T06:48:39Z")
Hi all, I'm using this plugin locally with direct internet connection without problem, but when I try to use in my prod env that use a http/https proxy, it does not work, it does not work. With debug I cannot see any er… --- ## [Error pushing slow log display on Kibana](https://discuss.elastic.co/t/error-pushing-slow-log-display-on-kibana/357328)
**Author:** [@vanhaiit90](https://discuss.elastic.co/u/vanhaiit90)\ **Replies:** 0\ **Last updated:** [April 13, 2024, 4:53am UTC](https://discuss.elastic.co/t/error-pushing-slow-log-display-on-kibana/357328 "2024-04-13T04:53:28Z")
Hi everyone I got any incident. Any day recently I got an error "Error pushing slow log display on Kibana". and show infomation in the following the image Although the log on the agent server is still complete, w… --- ## [Azure Activity Logs Agent Integration event message parsing and further field usage](https://discuss.elastic.co/t/azure-activity-logs-agent-integration-event-message-parsing-and-further-field-usage/356822)
**Author:** [@s.buksa](https://discuss.elastic.co/u/s.buksa)\ **Replies:** 6\ **Last updated:** [April 13, 2024, 3:21am UTC](https://discuss.elastic.co/t/azure-activity-logs-agent-integration-event-message-parsing-and-further-field-usage/356822 "2024-04-13T03:21:15Z")
Trying to understand where is the issue and what can be done regarding parsing and information further usage. Azure Activity Logs are streamed to Event Hub from where Standalone Agent (version 8.12.1) picks them up and i… --- ## [Fleet Server on host Ubuntu and Elastic Agent on Window](https://discuss.elastic.co/t/fleet-server-on-host-ubuntu-and-elastic-agent-on-window/356575)
**Author:** [@My\_Bach\_Toan](https://discuss.elastic.co/u/My_Bach_Toan)\ **Replies:** 3\ **Last updated:** [April 13, 2024, 12:37am UTC](https://discuss.elastic.co/t/fleet-server-on-host-ubuntu-and-elastic-agent-on-window/356575 "2024-04-13T00:37:55Z")
I have a Fleet Server on Ubuntu and i try to add elastic agent on Window. i dont know how to fix it !!! HELP ME --- ## [Dealing with highly confidential fields](https://discuss.elastic.co/t/dealing-with-highly-confidential-fields/357319)
**Author:** [@EricLewandowski](https://discuss.elastic.co/u/EricLewandowski)\ **Replies:** 3\ **Last updated:** [April 12, 2024, 10:46pm UTC](https://discuss.elastic.co/t/dealing-with-highly-confidential-fields/357319 "2024-04-12T22:46:19Z")
Hello! I need to store and search documents containing highly confidential fields. I need to make some searches based on these fields. I do not need to get the values of these fields when I send a query to Elastic Sea… --- ## [Failed to create query: the query vector has a different dimension \[384\] than the index vectors \[768\]](https://discuss.elastic.co/t/failed-to-create-query-the-query-vector-has-a-different-dimension-384-than-the-index-vectors-768/357317)
**Author:** [@wnmills3](https://discuss.elastic.co/u/wnmills3)\ **Replies:** 6\ **Last updated:** [April 12, 2024, 8:05pm UTC](https://discuss.elastic.co/t/failed-to-create-query-the-query-vector-has-a-different-dimension-384-than-the-index-vectors-768/357317 "2024-04-12T20:05:37Z")
How does one set the dimension in the query to avoid this message? --- ## [Combining ngram tokenizer with stopwords](https://discuss.elastic.co/t/combining-ngram-tokenizer-with-stopwords/357303)
**Author:** [@Dimitri\_Gamkrelidze](https://discuss.elastic.co/u/Dimitri_Gamkrelidze)\ **Replies:** 1\ **Last updated:** [April 12, 2024, 7:16pm UTC](https://discuss.elastic.co/t/combining-ngram-tokenizer-with-stopwords/357303 "2024-04-12T19:16:39Z")
Helllo everyone I'm trieing to create custom tokenizer with ngram. GET /\_analyze { "tokenizer": { "type":"ngram", "min\_gram":3, "max\_gram":3, "token\_chars": \[ "letter", "digit", "punctuatio… --- ## [Support of nested queries in Kibana](https://discuss.elastic.co/t/support-of-nested-queries-in-kibana/357265)
**Author:** [@hans\_hupe](https://discuss.elastic.co/u/hans_hupe)\ **Replies:** 1\ **Last updated:** [April 12, 2024, 7:00pm UTC](https://discuss.elastic.co/t/support-of-nested-queries-in-kibana/357265 "2024-04-12T19:00:50Z")
I have an index with documents like this { "id":1, "logs":\[ { "who":"max", "action":"delete" }, { "who":"peter", "action":"save" } \] }, { "id":2, … --- ## [Anomaly detection - Forecast](https://discuss.elastic.co/t/anomaly-detection-forecast/355024)
**Author:** [@NamithaJ97](https://discuss.elastic.co/u/NamithaJ97)\ **Replies:** 1\ **Last updated:** [April 12, 2024, 6:59pm UTC](https://discuss.elastic.co/t/anomaly-detection-forecast/355024 "2024-04-12T18:59:02Z")
I want to create forecast for all distinct values in "versions" field using single metric viewer- forecast in anomaly detection but unfortunately there are no anomalies for 6 versions and anomalies exists for only two an… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=262) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=264)