# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=281 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 282 --- ## [How to exclude one specific index from Kibana index patterns in ELK 7.17 version](https://discuss.elastic.co/t/how-to-exclude-one-specific-index-from-kibana-index-patterns-in-elk-7-17-version/355803)
**Author:** [@Pavan\_Kumar\_Nallam](https://discuss.elastic.co/u/Pavan_Kumar_Nallam)\ **Replies:** 1\ **Last updated:** [March 20, 2024, 3:36pm UTC](https://discuss.elastic.co/t/how-to-exclude-one-specific-index-from-kibana-index-patterns-in-elk-7-17-version/355803 "2024-03-20T15:36:00Z")
I need to exclude the highlighted index from the index pattern, can any one please help on this --- ## [Fleet (.fleet-agents) dataview not visible on non-default space](https://discuss.elastic.co/t/fleet-fleet-agents-dataview-not-visible-on-non-default-space/355829)
**Author:** [@nmurilo](https://discuss.elastic.co/u/nmurilo)\ **Replies:** 0\ **Last updated:** [March 20, 2024, 2:55pm UTC](https://discuss.elastic.co/t/fleet-fleet-agents-dataview-not-visible-on-non-default-space/355829 "2024-03-20T14:55:03Z")
I shared the fleet data view with both Default and Test space and copied one dashboard with fields like agent.version, local\_metadata.host.name,keyword, etc. to Test space. But I'm not able to see those fields on test … --- ## [Randomly encountered auth errors in Kibana severity increased](https://discuss.elastic.co/t/randomly-encountered-auth-errors-in-kibana-severity-increased/354102)
**Author:** [@FALEN](https://discuss.elastic.co/u/FALEN)\ **Replies:** 5\ **Last updated:** [March 20, 2024, 2:53pm UTC](https://discuss.elastic.co/t/randomly-encountered-auth-errors-in-kibana-severity-increased/354102 "2024-03-20T14:53:08Z")
Hi Community, I'm randomly encountering auth errors as shared below, severity of these errors are increased and now i cannot stay logged in for 1-2 minutes before encountering one security\_exception Root causes: securi… --- ## [Calculating time between two events from same request id](https://discuss.elastic.co/t/calculating-time-between-two-events-from-same-request-id/354880)
**Author:** [@Mohammad\_Alam](https://discuss.elastic.co/u/Mohammad_Alam)\ **Replies:** 3\ **Last updated:** [March 20, 2024, 2:45pm UTC](https://discuss.elastic.co/t/calculating-time-between-two-events-from-same-request-id/354880 "2024-03-20T14:45:57Z")
I am new to Elastic and Kibana so any help here would be helpful. I have logs coming in to elastic where a request with a unique id will go through various action stages, from request created to request approved to requ… --- ## [Need advice on building a new production ELK cluster](https://discuss.elastic.co/t/need-advice-on-building-a-new-production-elk-cluster/354344)
**Author:** [@anon85145925](https://discuss.elastic.co/u/anon85145925)\ **Replies:** 1\ **Last updated:** [February 28, 2024, 2:20pm UTC](https://discuss.elastic.co/t/need-advice-on-building-a-new-production-elk-cluster/354344 "2024-02-28T14:20:49Z")
Hello, We are in the process of building a new ELK cluster, we are looking to incorporate HA and data resiliency in a DR setup (across 2 sites). We will be using a SAN in each of our 2 sites and will be looking to be i… --- ## [Getting error "The requested resource could not be found" while trying to access /api/v1/stack/versions](https://discuss.elastic.co/t/getting-error-the-requested-resource-could-not-be-found-while-trying-to-access-api-v1-stack-versions/355415)
**Author:** [@shreyaa](https://discuss.elastic.co/u/shreyaa)\ **Replies:** 3\ **Last updated:** [March 20, 2024, 2:19pm UTC](https://discuss.elastic.co/t/getting-error-the-requested-resource-could-not-be-found-while-trying-to-access-api-v1-stack-versions/355415 "2024-03-20T14:19:39Z")
I am trying to fetch the available Elastic Stack versions through the Elasticsearch Service API using the url "https://api.elastic-cloud.com/api/v1/stack/versions" but I am getting the error as "The requested resource co… --- ## [Unable to push to elasticsearch getting 400](https://discuss.elastic.co/t/unable-to-push-to-elasticsearch-getting-400/355492)
**Author:** [@Johnson\_will](https://discuss.elastic.co/u/Johnson_will)\ **Replies:** 2\ **Last updated:** [March 20, 2024, 2:08pm UTC](https://discuss.elastic.co/t/unable-to-push-to-elasticsearch-getting-400/355492 "2024-03-20T14:08:59Z")
\[2024-03-15T13:47:54,432\]\[WARN \]\[logstash.outputs.elasticsearch\] Could not index event to Elasticsearch. {:status=\>400, :action=\>\["index", {:\_id=\>"64836160a3a2926d6a156148", :\_index=\>"job", :routing=\>nil}, {"startDate"=\>n… --- ## [MetricBeats cannot collect data from Kibana, the error message is passed version is not semver](https://discuss.elastic.co/t/metricbeats-cannot-collect-data-from-kibana-the-error-message-is-passed-version-is-not-semver/355808)
**Author:** [@jacksparrow414](https://discuss.elastic.co/u/jacksparrow414)\ **Replies:** 1\ **Last updated:** [March 20, 2024, 2:07pm UTC](https://discuss.elastic.co/t/metricbeats-cannot-collect-data-from-kibana-the-error-message-is-passed-version-is-not-semver/355808 "2024-03-20T14:07:40Z")
Hi, community. When I configured the Kibana module for MetricBeats, I found the following error log when starting MetricBeats Error fetching data for metricset kibana.node\_actions: passed version is not semver Error fe… --- ## [User\_agent.version gets mapped as date](https://discuss.elastic.co/t/user-agent-version-gets-mapped-as-date/355721)
**Author:** [@apaulo](https://discuss.elastic.co/u/apaulo)\ **Replies:** 4\ **Last updated:** [March 20, 2024, 12:14pm UTC](https://discuss.elastic.co/t/user-agent-version-gets-mapped-as-date/355721 "2024-03-20T12:14:19Z")
Hi, I keep running into this error when I try to index documents and use user\_agent to parse a field that includes user agent information: { "type": "mapper\_parsing\_exception", "reason": "failed to parse field \[con… --- ## [Sending email when alerts trigger](https://discuss.elastic.co/t/sending-email-when-alerts-trigger/355805)
**Author:** [@codi639](https://discuss.elastic.co/u/codi639)\ **Replies:** 2\ **Last updated:** [March 20, 2024, 11:55am UTC](https://discuss.elastic.co/t/sending-email-when-alerts-trigger/355805 "2024-03-20T11:55:52Z")
Hello everyone, I'm using ELK-Stack version 8.12 and I don't have any license, I need everything for free. I've created alerts, and I'm trying to send them by email or using the Telegram API. I saw this topic, which l… --- ## [Search query not fethcing all the results](https://discuss.elastic.co/t/search-query-not-fethcing-all-the-results/355790)
**Author:** [@Mohan\_T](https://discuss.elastic.co/u/Mohan_T)\ **Replies:** 7\ **Last updated:** [March 20, 2024, 11:25am UTC](https://discuss.elastic.co/t/search-query-not-fethcing-all-the-results/355790 "2024-03-20T11:25:34Z")
If am searching for italian marble flooring need to search for a combination of the below with the priority 1. italian marble flooring 2. italian marble 3. marble flooring 4. italian flooring 5. italian 6. marble 7… --- ## [Security Exception](https://discuss.elastic.co/t/security-exception/355581)
**Author:** [@Ganesh\_DV1](https://discuss.elastic.co/u/Ganesh_DV1)\ **Replies:** 7\ **Last updated:** [March 20, 2024, 10:43am UTC](https://discuss.elastic.co/t/security-exception/355581 "2024-03-20T10:43:55Z")
Hi team ! It will be very helpful if the following problem is resolved by any members in community!! Due to shards deletion on server wrt indices \>\> 1. fleet-servers-7, 2. .async-search The status of cluster is RED an… --- ## [Disabling of Index management not possible](https://discuss.elastic.co/t/disabling-of-index-management-not-possible/355742)
**Author:** [@sopraf](https://discuss.elastic.co/u/sopraf)\ **Replies:** 3\ **Last updated:** [March 20, 2024, 10:21am UTC](https://discuss.elastic.co/t/disabling-of-index-management-not-possible/355742 "2024-03-20T10:21:57Z")
Hey, I'm currently working on setting up a filebeat system to send logs of my application server to logstash. I'm using multiple inputs to monitor my application logs as well as a nginx proxy. When I start the service o… --- ## [Service not found](https://discuss.elastic.co/t/service-not-found/355760)
**Author:** [@laurent\_mandine](https://discuss.elastic.co/u/laurent_mandine)\ **Replies:** 1\ **Last updated:** [March 20, 2024, 10:09am UTC](https://discuss.elastic.co/t/service-not-found/355760 "2024-03-20T10:09:46Z")
can t figure out why it doesn t work thanks --- ## [I can't create agent on fleet server](https://discuss.elastic.co/t/i-cant-create-agent-on-fleet-server/355795)
**Author:** [@jed](https://discuss.elastic.co/u/jed)\ **Replies:** 0\ **Last updated:** [March 20, 2024, 9:21am UTC](https://discuss.elastic.co/t/i-cant-create-agent-on-fleet-server/355795 "2024-03-20T09:21:02Z")
I just add fleet server and I deleted now I install it's back but it's doesn't work for here is error. I try to research but can't solve this problem. Please help! Best regards. --- ## [Filebeat journald input truncates custom fields at ~64KiB](https://discuss.elastic.co/t/filebeat-journald-input-truncates-custom-fields-at-64kib/352833)
**Author:** [@mrflibble](https://discuss.elastic.co/u/mrflibble)\ **Replies:** 2\ **Last updated:** [March 20, 2024, 9:19am UTC](https://discuss.elastic.co/t/filebeat-journald-input-truncates-custom-fields-at-64kib/352833 "2024-03-20T09:19:27Z")
I have an issue where custom fields in systemd-journald entries are being truncated at ~64KiB. The regular "MESSAGE" field doesn't seem to be affected, only custom fields. I can't seem to find an option in the docs that… --- ## [Need the query to get the only matched records](https://discuss.elastic.co/t/need-the-query-to-get-the-only-matched-records/355793)
**Author:** [@IndRajesh](https://discuss.elastic.co/u/IndRajesh)\ **Replies:** 5\ **Last updated:** [March 20, 2024, 9:10am UTC](https://discuss.elastic.co/t/need-the-query-to-get-the-only-matched-records/355793 "2024-03-20T09:10:02Z")
HI , I need to get the only matched records from table:employee,users for the below mapping. put /testsqljoin { "mappings" : { "properties" : { "first\_name" : { "type" : "text", "fields" : { … --- ## [ECK Kibana securityContext on kubernetes \>= 1.26](https://discuss.elastic.co/t/eck-kibana-securitycontext-on-kubernetes-1-26/355789)
**Author:** [@codedoings](https://discuss.elastic.co/u/codedoings)\ **Replies:** 1\ **Last updated:** [March 20, 2024, 8:43am UTC](https://discuss.elastic.co/t/eck-kibana-securitycontext-on-kubernetes-1-26/355789 "2024-03-20T08:43:06Z")
Im trying to get elasticsearch and kibana up and running using ECK on kubernetes 1.26. I´ve managed to modify the podtemplate for the elasticsearch resource so that it sets the seccompProfile in the securityContext but I… --- ## [Status column on Rules page disappeared](https://discuss.elastic.co/t/status-column-on-rules-page-disappeared/355312)
**Author:** [@Anders80](https://discuss.elastic.co/u/Anders80)\ **Replies:** 2\ **Last updated:** [March 20, 2024, 7:26am UTC](https://discuss.elastic.co/t/status-column-on-rules-page-disappeared/355312 "2024-03-20T07:26:06Z")
Hi, My company recently update kibana from 8.5.3 to 8.12. And to my great regret the Status column (and ability to sort by Status) has disappeared from the app/management/insightsAndAlerting/triggersActions/rules-page. … --- ## [Reindex issue](https://discuss.elastic.co/t/reindex-issue/355772)
**Author:** [@Alan\_Hsiao](https://discuss.elastic.co/u/Alan_Hsiao)\ **Replies:** 5\ **Last updated:** [March 20, 2024, 6:46am UTC](https://discuss.elastic.co/t/reindex-issue/355772 "2024-03-20T06:46:07Z")
I have some issue while I am reindex this is my result of reindex when I use GET my\_index in devtool my data show this Does \_source enabled false made my reindex fall? How can I fix it? --- ## [Exception Bad certificate when connecting to ES8 from Tomcat10](https://discuss.elastic.co/t/exception-bad-certificate-when-connecting-to-es8-from-tomcat10/355688)
**Author:** [@Irgnar](https://discuss.elastic.co/u/Irgnar)\ **Replies:** 2\ **Last updated:** [March 20, 2024, 5:16am UTC](https://discuss.elastic.co/t/exception-bad-certificate-when-connecting-to-es8-from-tomcat10/355688 "2024-03-20T05:16:42Z")
Hello, i'm migratiing an app from SpringBoot2.7.5 / Tomcat9 / ES7 to SpringBoot 3 / Tomcat10 / ES8, and i have this exception on the tomcat side : Caused by: java.lang.RuntimeException: Received fatal alert: bad\_certifi… --- ## [elasticsearch cannot read certificate file](https://discuss.elastic.co/t/elasticsearch-cannot-read-certificate-file/355757)
**Author:** [@vivere-dally](https://discuss.elastic.co/u/vivere-dally)\ **Replies:** 1\ **Last updated:** [March 20, 2024, 5:10am UTC](https://discuss.elastic.co/t/elasticsearch-cannot-read-certificate-file/355757 "2024-03-20T05:10:00Z")
I generated a certificate file with certbot. It is placed in /etc/letsencrypt/.... I created a group called elk where I added the elasticsearch user, and I recursively set it as the owning group for /etc/letsencrypt and… --- ## [How to input response type of "application/yang-data+json" in filebeat httpjson module](https://discuss.elastic.co/t/how-to-input-response-type-of-application-yang-data-json-in-filebeat-httpjson-module/355598)
**Author:** [@saxena\_shk7](https://discuss.elastic.co/u/saxena_shk7)\ **Replies:** 1\ **Last updated:** [March 20, 2024, 4:22am UTC](https://discuss.elastic.co/t/how-to-input-response-type-of-application-yang-data-json-in-filebeat-httpjson-module/355598 "2024-03-20T04:22:36Z")
I have http URL REST API endpoint which is returning the content-type "application/yang-data+json" and i want to use filebeat httpjson module to take a input from API endpoint and store it into elasticsearch, However the… --- ## [Can't delete index - Bad Request](https://discuss.elastic.co/t/cant-delete-index-bad-request/319870)
**Author:** [@lamp123432](https://discuss.elastic.co/u/lamp123432)\ **Replies:** 4\ **Last updated:** [November 27, 2022, 4:04pm UTC](https://discuss.elastic.co/t/cant-delete-index-bad-request/319870 "2022-11-27T16:04:16Z")
Trying to delete index: Bad Request, any idea? I used to be able to delete them in earlier versions of Elastic Cloud. --- ## [Filebeat collects incomplete data,How to solve it](https://discuss.elastic.co/t/filebeat-collects-incomplete-data-how-to-solve-it/355778)
**Author:** [@kevin1811](https://discuss.elastic.co/u/kevin1811)\ **Replies:** 0\ **Last updated:** [March 20, 2024, 2:42am UTC](https://discuss.elastic.co/t/filebeat-collects-incomplete-data-how-to-solve-it/355778 "2024-03-20T02:42:02Z")
When FileBeat collects a certain file, only a portion is collected, and the rest is not collected further. This problem only exists on a certain machine. Here is my FileBeat.yml, which writes a large amount of data at a … --- ## [Can I replace the @timestamp of the dashboard with the time at which the event get logged in the file](https://discuss.elastic.co/t/can-i-replace-the-timestamp-of-the-dashboard-with-the-time-at-which-the-event-get-logged-in-the-file/355607)
**Author:** [@Shrimad\_Mishra](https://discuss.elastic.co/u/Shrimad_Mishra)\ **Replies:** 16\ **Last updated:** [March 20, 2024, 2:12am UTC](https://discuss.elastic.co/t/can-i-replace-the-timestamp-of-the-dashboard-with-the-time-at-which-the-event-get-logged-in-the-file/355607 "2024-03-20T02:12:23Z")
Hi there, I wanted to replace the @timestamp value with the log time. I am using filebeat as a logs collector. Here is my filter value which I am trying grok { match =\> { "message" =\> "\\\[%{DATA:datetime}\\\] I… --- ## [Not able to create Alerts for log threshold](https://discuss.elastic.co/t/not-able-to-create-alerts-for-log-threshold/355186)
**Author:** [@syal](https://discuss.elastic.co/u/syal)\ **Replies:** 1\ **Last updated:** [March 19, 2024, 10:29pm UTC](https://discuss.elastic.co/t/not-able-to-create-alerts-for-log-threshold/355186 "2024-03-19T22:29:59Z")
I am not able to save this alert. It do not throw any errors. So, no idea why I am not able to create it. Help please --- ## [Snoozed alerts suddenly un-snoozed](https://discuss.elastic.co/t/snoozed-alerts-suddenly-un-snoozed/355766)
**Author:** [@pras](https://discuss.elastic.co/u/pras)\ **Replies:** 0\ **Last updated:** [March 19, 2024, 9:07pm UTC](https://discuss.elastic.co/t/snoozed-alerts-suddenly-un-snoozed/355766 "2024-03-19T21:07:25Z")
hi guys I have a weird issue. I have number of alerts which are active only for very brief time window say for 30 minutes to 2 hour other time they are snoozed via snooze shedule. However since last 2-3 days I am gettin… --- ## [Checking if a User Has a Specific Role in Node.js with Elasticsearch ClusterClient](https://discuss.elastic.co/t/checking-if-a-user-has-a-specific-role-in-node-js-with-elasticsearch-clusterclient/355236)
**Author:** [@bertugmete](https://discuss.elastic.co/u/bertugmete)\ **Replies:** 1\ **Last updated:** [March 19, 2024, 8:58pm UTC](https://discuss.elastic.co/t/checking-if-a-user-has-a-specific-role-in-node-js-with-elasticsearch-clusterclient/355236 "2024-03-19T20:58:18Z")
I'm trying to check if a user has a specific role using the following Node.js function. However, the clusterClient.asInternalUser.security.getUser() function returns information about all users in Kibana. My goal is to o… --- ## [Expected 0, got exponential](https://discuss.elastic.co/t/expected-0-got-exponential/355765)
**Author:** [@admendary](https://discuss.elastic.co/u/admendary)\ **Replies:** 0\ **Last updated:** [March 19, 2024, 8:52pm UTC](https://discuss.elastic.co/t/expected-0-got-exponential/355765 "2024-03-19T20:52:11Z")
Kibana version: 8.9 Type: Aggregation Based/Data table Behavior: When I add sum() as aggregation and there´s a positive number and the same but negative, I would expect see 0 in the result area, but see exponential … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=280) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=282)