# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=277 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 278 --- ## [Metricbeat Cloudwatch 지표 수집 문의](https://discuss.elastic.co/t/metricbeat-cloudwatch/356154)
**Author:** [@kukjisu](https://discuss.elastic.co/u/kukjisu)\ **Replies:** 0\ **Last updated:** [March 26, 2024, 8:35am UTC](https://discuss.elastic.co/t/metricbeat-cloudwatch/356154 "2024-03-26T08:35:59Z")
안녕하세요 ELK 8.12 Ver으로 구성하여 테스트 중에 있습니다. 구성: Metricbeat -\> Logstash -\> Elasticsearch -\> Kibana aws.yml을 활용하여 metricsets(Cloudwatch)으로 설정 후 period '5m'으로 설정하고 $metricbeat -e 로 실행하여 Kibana에 표시된 지표를 보면 현재 시점 데이터가 아닌 최소 5분 … --- ## [Winlogbeat 8.12.0 not working with filters](https://discuss.elastic.co/t/winlogbeat-8-12-0-not-working-with-filters/354938)
**Author:** [@kriti\_dabas](https://discuss.elastic.co/u/kriti_dabas)\ **Replies:** 3\ **Last updated:** [March 26, 2024, 6:58am UTC](https://discuss.elastic.co/t/winlogbeat-8-12-0-not-working-with-filters/354938 "2024-03-26T06:58:56Z")
Currently I am using winlogbeat service version 8.12.0 on my system. I am trying to apply the same filters on it which are working perfectly fine with winlogbeat 7.14 version. system - kafka topic - logstash - elasticse… --- ## [Display top 500 based on ltr and remaining top 500 based on initial scores](https://discuss.elastic.co/t/display-top-500-based-on-ltr-and-remaining-top-500-based-on-initial-scores/356141)
**Author:** [@Sri\_Devi\_Gollapudi](https://discuss.elastic.co/u/Sri_Devi_Gollapudi)\ **Replies:** 0\ **Last updated:** [March 26, 2024, 4:33am UTC](https://discuss.elastic.co/t/display-top-500-based-on-ltr-and-remaining-top-500-based-on-initial-scores/356141 "2024-03-26T04:33:12Z")
I want to use one model to retrieve top 1000 documents and for top 500 documents I want to rescore using ltr model while displaying results I want to display top 500 sorted based on ltr scores and remaining 500 using ini… --- ## [Netflow Exporters only from Filebeat Host](https://discuss.elastic.co/t/netflow-exporters-only-from-filebeat-host/355712)
**Author:** [@Yusran](https://discuss.elastic.co/u/Yusran)\ **Replies:** 2\ **Last updated:** [March 26, 2024, 2:54am UTC](https://discuss.elastic.co/t/netflow-exporters-only-from-filebeat-host/355712 "2024-03-26T02:54:10Z")
Hi Team, I just finished to Deploy Elastic Stack to Visualize Netflow data from several network devices, with the following deployment: Network devices -\> Filebeat (Netflow Module) -\> Elasticsearch -\> Kibana. Filebeat… --- ## [Multiple Inputs going to different Log Analytics tables](https://discuss.elastic.co/t/multiple-inputs-going-to-different-log-analytics-tables/356135)
**Author:** [@Mike\_Reprogle](https://discuss.elastic.co/u/Mike_Reprogle)\ **Replies:** 0\ **Last updated:** [March 26, 2024, 2:31am UTC](https://discuss.elastic.co/t/multiple-inputs-going-to-different-log-analytics-tables/356135 "2024-03-26T02:31:58Z")
This is my first time setting up Logstash as opposed to just using a standard syslog server to throw data at Log Analytics. I basically have an Azure VM set up with port 514 open to specific IPs. I am hoping to use port … --- ## [Elastic Agent Unhealthy - No valid comms client available](https://discuss.elastic.co/t/elastic-agent-unhealthy-no-valid-comms-client-available/356133)
**Author:** [@Kreb](https://discuss.elastic.co/u/Kreb)\ **Replies:** 0\ **Last updated:** [March 26, 2024, 1:40am UTC](https://discuss.elastic.co/t/elastic-agent-unhealthy-no-valid-comms-client-available/356133 "2024-03-26T01:40:36Z")
When I install the elastic agent onto a Ubuntu machine through Security Onion the device will check in as healthy for about 30 seconds and then it will go to an Unhealthy state. I have installed the agent on another Ubun… --- ## [Help need to find the best approach and logic to combine the all orders of same fingerprint](https://discuss.elastic.co/t/help-need-to-find-the-best-approach-and-logic-to-combine-the-all-orders-of-same-fingerprint/356124)
**Author:** [@kishorkumar](https://discuss.elastic.co/u/kishorkumar)\ **Replies:** 0\ **Last updated:** [March 25, 2024, 7:16pm UTC](https://discuss.elastic.co/t/help-need-to-find-the-best-approach-and-logic-to-combine-the-all-orders-of-same-fingerprint/356124 "2024-03-25T19:16:39Z")
Can you help me this , i have orders data , in ndjson on which i use split to separate the docs and create a unique fingerprint on the basis of the items upc + displayName . code and dataset is given below now i want t… --- ## [Error fetching fields for data view](https://discuss.elastic.co/t/error-fetching-fields-for-data-view/356018)
**Author:** [@Chris\_Stone](https://discuss.elastic.co/u/Chris_Stone)\ **Replies:** 3\ **Last updated:** [March 25, 2024, 6:58pm UTC](https://discuss.elastic.co/t/error-fetching-fields-for-data-view/356018 "2024-03-25T18:58:20Z")
Update: I've resolved the CSP and 403 errors I saw, but now am being blocked by this: https://elk-1.XXXXX.com/internal/data\_views/\_fields\_for\_wildcard?pattern=ecs-logstash-\*&meta\_fields=\_source&meta\_fields=\_id&meta\_fiel… --- ## [Drop Events while using elastic kubernetes integration to collect logs](https://discuss.elastic.co/t/drop-events-while-using-elastic-kubernetes-integration-to-collect-logs/356083)
**Author:** [@Jobin\_James](https://discuss.elastic.co/u/Jobin_James)\ **Replies:** 3\ **Last updated:** [March 25, 2024, 5:19pm UTC](https://discuss.elastic.co/t/drop-events-while-using-elastic-kubernetes-integration-to-collect-logs/356083 "2024-03-25T17:19:04Z")
Hello, Elastic search Version: 8.12.2 ECK Operator Version: 2.11.0 I am using elastic Kubernetes integration for pushing logs from the k8s cluster using an elastic agent. I would like to know how can i drop the unwant… --- ## [Logstash not able to parse logs with spaces between key value pair in json object](https://discuss.elastic.co/t/logstash-not-able-to-parse-logs-with-spaces-between-key-value-pair-in-json-object/356011)
**Author:** [@Dhruvi\_Shah](https://discuss.elastic.co/u/Dhruvi_Shah)\ **Replies:** 10\ **Last updated:** [March 25, 2024, 5:27pm UTC](https://discuss.elastic.co/t/logstash-not-able-to-parse-logs-with-spaces-between-key-value-pair-in-json-object/356011 "2024-03-25T17:27:55Z")
I have a log containing json object. The log gets parsed if json object has no spaces. If it has spaces between key value pair, it is not getting parsed. Configuration file used input { syslog { port =\> 3011 } } filte… --- ## [Master not discovered yet, this node has not previously joined a bootstrapped (v7+) cluster](https://discuss.elastic.co/t/master-not-discovered-yet-this-node-has-not-previously-joined-a-bootstrapped-v7-cluster/356116)
**Author:** [@horra\_hayfa](https://discuss.elastic.co/u/horra_hayfa)\ **Replies:** 0\ **Last updated:** [March 25, 2024, 4:53pm UTC](https://discuss.elastic.co/t/master-not-discovered-yet-this-node-has-not-previously-joined-a-bootstrapped-v7-cluster/356116 "2024-03-25T16:53:22Z")
hello i'm trying to install elasticsearch7.17.13 in my vmware workstation along with wazuh 4.5 follwing wazuh documentation ""/deployment-options/elastic-stack/distributed-deployment/elasticsearch-cluster/elasticsearch… --- ## [Kibana Dashboards Gallery](https://discuss.elastic.co/t/kibana-dashboards-gallery/355950)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 4\ **Last updated:** [March 25, 2024, 4:27pm UTC](https://discuss.elastic.co/t/kibana-dashboards-gallery/355950 "2024-03-25T16:27:39Z")
Hello, I don't believe this exists but is there a way where we can have a repository of custom dashboards, where people can share all their own creations. It would help alot of people to use other dashboards as templat… --- ## [Updating nested in Elasticsearch DSL within DRF?](https://discuss.elastic.co/t/updating-nested-in-elasticsearch-dsl-within-drf/356014)
**Author:** [@Manikandan\_FMJ](https://discuss.elastic.co/u/Manikandan_FMJ)\ **Replies:** 2\ **Last updated:** [March 25, 2024, 4:14pm UTC](https://discuss.elastic.co/t/updating-nested-in-elasticsearch-dsl-within-drf/356014 "2024-03-25T16:14:24Z")
When updating nested objects in Django Rest Framework (DRF), they might be stored as objects instead of Nested, causing issues during search queries. How can I resolve this issue? View file profile = DetailsDocument.ge… --- ## [Geoip2 ASN resolution in Ingest Pipeline](https://discuss.elastic.co/t/geoip2-asn-resolution-in-ingest-pipeline/356093)
**Author:** [@Patryk\_Ostrowski](https://discuss.elastic.co/u/Patryk_Ostrowski)\ **Replies:** 5\ **Last updated:** [March 25, 2024, 2:41pm UTC](https://discuss.elastic.co/t/geoip2-asn-resolution-in-ingest-pipeline/356093 "2024-03-25T14:41:48Z")
Hello, I tried to use GeoIP2 plugin to resolve iP to ASN. Unfortunately during log processing I have information in tag: \[netflow, forwarded, \_geoip\_database\_unavailable\_GeoLite2-City.mmdb, \_geoip\_database\_unavailable… --- ## [Query cache is getting evicted though we have enough memory available (8.10 and 8.12 version)](https://discuss.elastic.co/t/query-cache-is-getting-evicted-though-we-have-enough-memory-available-8-10-and-8-12-version/356104)
**Author:** [@Balaji5007](https://discuss.elastic.co/u/Balaji5007)\ **Replies:** 0\ **Last updated:** [March 25, 2024, 2:45pm UTC](https://discuss.elastic.co/t/query-cache-is-getting-evicted-though-we-have-enough-memory-available-8-10-and-8-12-version/356104 "2024-03-25T14:45:37Z")
Query cache is getting evicted though we have enough memory available. We are seeing this behavior only from version 8.10, we tried upgrading the cluster to 8.12 as well but still the last workable stable version on this… --- ## [How to create a hidden control to my dashboard?](https://discuss.elastic.co/t/how-to-create-a-hidden-control-to-my-dashboard/356005)
**Author:** [@Federico\_Ruso](https://discuss.elastic.co/u/Federico_Ruso)\ **Replies:** 6\ **Last updated:** [March 25, 2024, 2:26pm UTC](https://discuss.elastic.co/t/how-to-create-a-hidden-control-to-my-dashboard/356005 "2024-03-25T14:26:58Z")
Hello, i need to create a hidden control to my dashboard. I'm using ES v 8.12.1. Thks!! --- ## [Send logs from Fleet Docker Integration to specific data stream](https://discuss.elastic.co/t/send-logs-from-fleet-docker-integration-to-specific-data-stream/352668)
**Author:** [@DougR](https://discuss.elastic.co/u/DougR)\ **Replies:** 1\ **Last updated:** [March 25, 2024, 2:16pm UTC](https://discuss.elastic.co/t/send-logs-from-fleet-docker-integration-to-specific-data-stream/352668 "2024-03-25T14:16:02Z")
I am using Fleet to manage our deployment. Most of our container-based logging is through Kubernetes, using the Kubernetes integration which allows me to specify the data\_set.datastream to send the logs to (e.g., myapp.l… --- ## [GeoIP challenges - Custom-City.mmdb](https://discuss.elastic.co/t/geoip-challenges-custom-city-mmdb/355173)
**Author:** [@SteveB1963](https://discuss.elastic.co/u/SteveB1963)\ **Replies:** 16\ **Last updated:** [March 25, 2024, 2:08pm UTC](https://discuss.elastic.co/t/geoip-challenges-custom-city-mmdb/355173 "2024-03-25T14:08:57Z")
I am new to the forum, but not new to Elastic Stack. I have been using it for about 7 years. Started with Version 5 and upgraded to 8 over time. Sorry for the long post but felt that some foundation was necessary. Curr… --- ## [How is the agent upgrade availability is detected in fleet env (on-prem)](https://discuss.elastic.co/t/how-is-the-agent-upgrade-availability-is-detected-in-fleet-env-on-prem/354956)
**Author:** [@marfrarsi](https://discuss.elastic.co/u/marfrarsi)\ **Replies:** 2\ **Last updated:** [March 25, 2024, 2:05pm UTC](https://discuss.elastic.co/t/how-is-the-agent-upgrade-availability-is-detected-in-fleet-env-on-prem/354956 "2024-03-25T14:05:21Z")
Hello! Elastic 3 node Linux cluster on prem, with some Elastic Agent managed by a fleet server. I've upgraded the whole stack from 8.11.3 to 8.12 (Elasticsearch, kibana and fleet server). Now I would like to upgrade al… --- ## [Fleet Setting output remote elasticsearch Status Unhealthy issues](https://discuss.elastic.co/t/fleet-setting-output-remote-elasticsearch-status-unhealthy-issues/355333)
**Author:** [@fa\_dai](https://discuss.elastic.co/u/fa_dai)\ **Replies:** 1\ **Last updated:** [March 25, 2024, 2:02pm UTC](https://discuss.elastic.co/t/fleet-setting-output-remote-elasticsearch-status-unhealthy-issues/355333 "2024-03-25T14:02:18Z")
Hello I set up remote elasticsearch and want to output kibana log to another elasticsearch cluster, but there is an authentication problem. In addition to obtaining the service token from remote elasticsearch, do I … --- ## [Elastic and Fleet without xpack.security](https://discuss.elastic.co/t/elastic-and-fleet-without-xpack-security/355903)
**Author:** [@michal\_XD](https://discuss.elastic.co/u/michal_XD)\ **Replies:** 1\ **Last updated:** [March 25, 2024, 1:49pm UTC](https://discuss.elastic.co/t/elastic-and-fleet-without-xpack-security/355903 "2024-03-25T13:49:29Z")
Hello !! I need confgiure APM and Fleet on my ELK stakc instance. But I want to d thaht witout this "xpack.security.enabled: true xpack.security.authc.api\_key.enabled: true" We didnt need it on our organization. We … --- ## [SNOW connector to create cases instead of incidents](https://discuss.elastic.co/t/snow-connector-to-create-cases-instead-of-incidents/356096)
**Author:** [@hectorGC](https://discuss.elastic.co/u/hectorGC)\ **Replies:** 0\ **Last updated:** [March 25, 2024, 1:30pm UTC](https://discuss.elastic.co/t/snow-connector-to-create-cases-instead-of-incidents/356096 "2024-03-25T13:30:03Z")
Hi guys, I want to use the SNOW connector to, after create a case in elastic, create case or incident on SNOW depending on the situation. I know it only creates a incident right now, is there any possibility to create a… --- ## [Snapshot in local drive](https://discuss.elastic.co/t/snapshot-in-local-drive/356092)
**Author:** [@manikandanid](https://discuss.elastic.co/u/manikandanid)\ **Replies:** 5\ **Last updated:** [March 25, 2024, 12:52pm UTC](https://discuss.elastic.co/t/snapshot-in-local-drive/356092 "2024-03-25T12:52:00Z")
Can we take snapshot of index on the local drive. All the docs are pointing towards snapshot in cloud providers and no doc for how to snapshot to a local network drive. --- ## [Ignore fields when indexing using JsonData.of](https://discuss.elastic.co/t/ignore-fields-when-indexing-using-jsondata-of/356084)
**Author:** [@ndtreviv](https://discuss.elastic.co/u/ndtreviv)\ **Replies:** 5\ **Last updated:** [March 25, 2024, 12:41pm UTC](https://discuss.elastic.co/t/ignore-fields-when-indexing-using-jsondata-of/356084 "2024-03-25T12:41:57Z")
I'm using the Java SDK to update a document, like so: UpdateResponse\ response = elasticsearchService.getClient().update(u -\> u.index(INDEX) .id(id) .doc(JsonData.of(myObject)).refresh(Refresh.True), Void.c… --- ## [Logstash and Filebeat not showing in stack monitoring](https://discuss.elastic.co/t/logstash-and-filebeat-not-showing-in-stack-monitoring/356060)
**Author:** [@athul\_prasad](https://discuss.elastic.co/u/athul_prasad)\ **Replies:** 3\ **Last updated:** [March 25, 2024, 10:49am UTC](https://discuss.elastic.co/t/logstash-and-filebeat-not-showing-in-stack-monitoring/356060 "2024-03-25T10:49:05Z")
Hii Iam new to elk, I can't see logstash nodes and filebeat nodes in kibana stack monitoring . I can see both kibana's and elasticsearches node, could you please help me here to setup that by giving a proper doc or some … --- ## [How to group or merge multiple fields to one field name](https://discuss.elastic.co/t/how-to-group-or-merge-multiple-fields-to-one-field-name/355985)
**Author:** [@Aton](https://discuss.elastic.co/u/Aton)\ **Replies:** 7\ **Last updated:** [March 25, 2024, 10:31am UTC](https://discuss.elastic.co/t/how-to-group-or-merge-multiple-fields-to-one-field-name/355985 "2024-03-25T10:31:40Z")
hi, I have a problem, I have several fields with similar names, for example: rest.direction, mmu.direction, xml.direction, and I need them to be displayed in Kiban only under one field, for example "direction". Is it po… --- ## [Avoid hiting unecessary shards with wildcard dated index](https://discuss.elastic.co/t/avoid-hiting-unecessary-shards-with-wildcard-dated-index/354526)
**Author:** [@voharunado](https://discuss.elastic.co/u/voharunado)\ **Replies:** 2\ **Last updated:** [March 25, 2024, 10:00am UTC](https://discuss.elastic.co/t/avoid-hiting-unecessary-shards-with-wildcard-dated-index/354526 "2024-03-25T10:00:19Z")
I have multiple indices with a date in the name that stores data for specific days for each months, so I have day-2024.01.01, day-2024.02.01 and so on. The indices are managed by ILM and I always have 2 years of future d… --- ## [Elasticsearch: search relevent query using washbasin and fetch the result for wash basin related result](https://discuss.elastic.co/t/elasticsearch-search-relevent-query-using-washbasin-and-fetch-the-result-for-wash-basin-related-result/356068)
**Author:** [@Mohan\_T](https://discuss.elastic.co/u/Mohan_T)\ **Replies:** 1\ **Last updated:** [March 25, 2024, 8:32am UTC](https://discuss.elastic.co/t/elasticsearch-search-relevent-query-using-washbasin-and-fetch-the-result-for-wash-basin-related-result/356068 "2024-03-25T08:32:33Z")
search documents have the value of Doc 1 { "s\_title": "washbasin" } Doc 2 { "s\_title": "wash basin" } Doc 3 { "s\_title": "wash and basin" } Doc 4 { "s\_title": "wash basin tap" } Doc 5 { "s\_t… --- ## [O365 integration Return Wrong data Types](https://discuss.elastic.co/t/o365-integration-return-wrong-data-types/355276)
**Author:** [@rajith\_pathiraja](https://discuss.elastic.co/u/rajith_pathiraja)\ **Replies:** 3\ **Last updated:** [March 25, 2024, 7:35am UTC](https://discuss.elastic.co/t/o365-integration-return-wrong-data-types/355276 "2024-03-25T07:35:56Z")
Hi I have tried to integrate Microsoft O365 with Elastic and i have followed the given instruction but still didnt get log details return. So i tried using Dev tools and saw im getting below " { "statusCode": 400, "er… --- ## [ELK PROD Cluster - Running multiple data docker containers on same machine. Docker Swarm](https://discuss.elastic.co/t/elk-prod-cluster-running-multiple-data-docker-containers-on-same-machine-docker-swarm/356074)
**Author:** [@vdcharter](https://discuss.elastic.co/u/vdcharter)\ **Replies:** 0\ **Last updated:** [March 25, 2024, 5:55am UTC](https://discuss.elastic.co/t/elk-prod-cluster-running-multiple-data-docker-containers-on-same-machine-docker-swarm/356074 "2024-03-25T05:55:19Z")
Hi, I have a 16 server PROD cluster with 3 VM's and 13 Baremetal servers. These are very high performance servers with below configurations 3 VM's with each having -- 8x vCPU, 48GB RAM, ~900GB Storage (ES Masters) 13 … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=276) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=278)