# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=286 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 287 --- ## [Constantly repeated "Configured paths" logs in filebeat](https://discuss.elastic.co/t/constantly-repeated-configured-paths-logs-in-filebeat/355418)
**Author:** [@tsmith](https://discuss.elastic.co/u/tsmith)\ **Replies:** 0\ **Last updated:** [March 14, 2024, 3:14pm UTC](https://discuss.elastic.co/t/constantly-repeated-configured-paths-logs-in-filebeat/355418 "2024-03-14T15:14:22Z")
Hello, we are seeing these logs continuously being repeated in our filebeat container logs, it can be up to 20 logs per second constantly. The "input ticker" stops and then logs about configured paths, it seems like fil… --- ## [Elasticsearch not loading logs from logstash and filebeat](https://discuss.elastic.co/t/elasticsearch-not-loading-logs-from-logstash-and-filebeat/355391)
**Author:** [@codi639](https://discuss.elastic.co/u/codi639)\ **Replies:** 3\ **Last updated:** [March 14, 2024, 3:10pm UTC](https://discuss.elastic.co/t/elasticsearch-not-loading-logs-from-logstash-and-filebeat/355391 "2024-03-14T15:10:25Z")
Hello guys, I'm trying to build a SIEM, after searching for different solutions I wanted to try the ELK-Stack with Filebeat. I've followed this tutorial, and occur the error at the end of the fourth part. I tried to re… --- ## [Key-value split failing on comma in field](https://discuss.elastic.co/t/key-value-split-failing-on-comma-in-field/355408)
**Author:** [@e.vedelaar](https://discuss.elastic.co/u/e.vedelaar)\ **Replies:** 1\ **Last updated:** [March 14, 2024, 2:36pm UTC](https://discuss.elastic.co/t/key-value-split-failing-on-comma-in-field/355408 "2024-03-14T14:36:12Z")
When ingesting fortigate logs i come across the following error message: field \[syslog5424\_sd\] does not contain value\_split \[=\] this occurs because i do KV splits on ",". While this works with most logs, there are a fe… --- ## [Not able to start standalone Elastic Agent in my windows machine](https://discuss.elastic.co/t/not-able-to-start-standalone-elastic-agent-in-my-windows-machine/355384)
**Author:** [@Raminder\_Gujral](https://discuss.elastic.co/u/Raminder_Gujral)\ **Replies:** 4\ **Last updated:** [March 14, 2024, 1:44pm UTC](https://discuss.elastic.co/t/not-able-to-start-standalone-elastic-agent-in-my-windows-machine/355384 "2024-03-14T13:44:57Z")
Can you please help - I am trying to start standalone elastic agent in my windows machine and it keeps trying connecting to end point without any success. Here are the logs please: ERROR MESSAGE: {"log.level":"info","@… --- ## [Opposite of "Append" processor?](https://discuss.elastic.co/t/opposite-of-append-processor/355095)
**Author:** [@Balu](https://discuss.elastic.co/u/Balu)\ **Replies:** 10\ **Last updated:** [March 14, 2024, 1:16pm UTC](https://discuss.elastic.co/t/opposite-of-append-processor/355095 "2024-03-14T13:16:02Z")
Hell guys, what ingest processor can I use to remove an item from an array? In my case I want to remove an "error tag" that was added to the "tags" field. --- ## [Elasticsearch tokens with adjacent concat while preserving other words](https://discuss.elastic.co/t/elasticsearch-tokens-with-adjacent-concat-while-preserving-other-words/355399)
**Author:** [@bhavyajain](https://discuss.elastic.co/u/bhavyajain)\ **Replies:** 1\ **Last updated:** [March 14, 2024, 11:45am UTC](https://discuss.elastic.co/t/elasticsearch-tokens-with-adjacent-concat-while-preserving-other-words/355399 "2024-03-14T11:45:12Z")
I want to create a custom analyzer which generates tokens so that in each token, one pair of adjacent words are concatenated while preserving rest of the query string. Example Query : "quick brown fox jumps" Generated … --- ## [State Timline in Kibana](https://discuss.elastic.co/t/state-timline-in-kibana/354923)
**Author:** [@Florian\_Wattenbach](https://discuss.elastic.co/u/Florian_Wattenbach)\ **Replies:** 1\ **Last updated:** [March 14, 2024, 10:57am UTC](https://discuss.elastic.co/t/state-timline-in-kibana/354923 "2024-03-14T10:57:13Z")
Hello Everyone. Is it possible to create a state timeline in Lens such as the one which can be seen under the following picture. In my index I have documents (representing each state) containing fields with the stat… --- ## [Adding chromeNavControls to default apps in Kibana](https://discuss.elastic.co/t/adding-chromenavcontrols-to-default-apps-in-kibana/355251)
**Author:** [@Neeecu](https://discuss.elastic.co/u/Neeecu)\ **Replies:** 1\ **Last updated:** [March 14, 2024, 10:55am UTC](https://discuss.elastic.co/t/adding-chromenavcontrols-to-default-apps-in-kibana/355251 "2024-03-14T10:55:37Z")
Hello! I was wondering if there is a way to add custom navigation controls (like a logout button for a custom authentification) in the default Kibana apps (e.g. home, discover, dashboard, visualize etc.). It is possibl… --- ## [Multiple questions about http\_poller input plugin](https://discuss.elastic.co/t/multiple-questions-about-http-poller-input-plugin/355329)
**Author:** [@nilsen](https://discuss.elastic.co/u/nilsen)\ **Replies:** 3\ **Last updated:** [March 14, 2024, 10:24am UTC](https://discuss.elastic.co/t/multiple-questions-about-http-poller-input-plugin/355329 "2024-03-14T10:24:06Z")
Hello, I decided to merge all of my questions into one thread, instead of making multiple threads, considering they are all http\_poller related. Goal: I'm trying to get Logstash to do an http request to our local Active… --- ## [Is it possible to configure replica shards to synchronize data?](https://discuss.elastic.co/t/is-it-possible-to-configure-replica-shards-to-synchronize-data/355371)
**Author:** [@wangxr1985](https://discuss.elastic.co/u/wangxr1985)\ **Replies:** 5\ **Last updated:** [March 14, 2024, 9:19am UTC](https://discuss.elastic.co/t/is-it-possible-to-configure-replica-shards-to-synchronize-data/355371 "2024-03-14T09:19:26Z")
By default, Elasticsearch replicates data from primary shards to replica shards. However, in some cases, this can lead to performance issues. For example: When the cluster experiences high query volume and has many re… --- ## [Seek a reference for scope of work and efforts required to setup Elasticsearch](https://discuss.elastic.co/t/seek-a-reference-for-scope-of-work-and-efforts-required-to-setup-elasticsearch/355373)
**Author:** [@guojun.qiao](https://discuss.elastic.co/u/guojun.qiao)\ **Replies:** 1\ **Last updated:** [March 14, 2024, 8:15am UTC](https://discuss.elastic.co/t/seek-a-reference-for-scope-of-work-and-efforts-required-to-setup-elasticsearch/355373 "2024-03-14T08:15:43Z")
Hi I would like to setup Elasticsearch in two data centers. Two data centers will have same setup (refer to screenshot attached). Three nodes for master and data role. One node for Kibana. Could anyone share me a refer… --- ## [Does metricbeat hint based autodiscovery support kubernetes service resources?](https://discuss.elastic.co/t/does-metricbeat-hint-based-autodiscovery-support-kubernetes-service-resources/355375)
**Author:** [@JorenThijs](https://discuss.elastic.co/u/JorenThijs)\ **Replies:** 0\ **Last updated:** [March 14, 2024, 8:14am UTC](https://discuss.elastic.co/t/does-metricbeat-hint-based-autodiscovery-support-kubernetes-service-resources/355375 "2024-03-14T08:14:27Z")
I am trying to configure metricbeat using autodiscovery for monitoring our RabbitMQ cluster. Our rabbitMQ cluster has 3 nodes. Putting autodiscovery hints on the pods makes our logs duplicated 3 times. See Configure Met… --- ## [How to check if results are empty in SearchHitIterator in php](https://discuss.elastic.co/t/how-to-check-if-results-are-empty-in-searchhititerator-in-php/355366)
**Author:** [@Aditya\_Dixit1](https://discuss.elastic.co/u/Aditya_Dixit1)\ **Replies:** 0\ **Last updated:** [March 14, 2024, 7:25am UTC](https://discuss.elastic.co/t/how-to-check-if-results-are-empty-in-searchhititerator-in-php/355366 "2024-03-14T07:25:05Z")
I am using a SearchHitIterator in php like this $params = \[ 'index' =\> 'empire', 'body' =\> \[ 'query' =\> \[ 'match' =\> \[ … --- ## [Logstash HTTP Filter sending once per node](https://discuss.elastic.co/t/logstash-http-filter-sending-once-per-node/355360)
**Author:** [@JoelAU](https://discuss.elastic.co/u/JoelAU)\ **Replies:** 2\ **Last updated:** [March 14, 2024, 5:25am UTC](https://discuss.elastic.co/t/logstash-http-filter-sending-once-per-node/355360 "2024-03-14T05:25:48Z")
I currently have a Logstash pipeline with a JDBC input, a HTTP filter (to send externally), and an output to Elasticsearch. There is also two Logstash nodes running. Everything is working as expected, except that a HTTP… --- ## [Can we collect DB metrics and logs using elastic agent](https://discuss.elastic.co/t/can-we-collect-db-metrics-and-logs-using-elastic-agent/355361)
**Author:** [@nkreddyp](https://discuss.elastic.co/u/nkreddyp)\ **Replies:** 0\ **Last updated:** [March 14, 2024, 5:08am UTC](https://discuss.elastic.co/t/can-we-collect-db-metrics-and-logs-using-elastic-agent/355361 "2024-03-14T05:08:55Z")
Dear Team, with the elastic agent can we collect the metrics and logs i have checked for the option in kibana integrations however it is showing to install the seperate metricbeat and filebeat for this , if any one use… --- ## [AWS Integration and Inspector](https://discuss.elastic.co/t/aws-integration-and-inspector/354145)
**Author:** [@jeffmaley](https://discuss.elastic.co/u/jeffmaley)\ **Replies:** 2\ **Last updated:** [March 13, 2024, 10:37pm UTC](https://discuss.elastic.co/t/aws-integration-and-inspector/354145 "2024-03-13T22:37:42Z")
I have ELK running with the AWS integration. I have one agent policy running on several agents with a role configured for the agent to use. The agents are running on EC2 and are able to assume the role easily. I've setup… --- ## [Getting internal "\_id" field via jdbc](https://discuss.elastic.co/t/getting-internal-id-field-via-jdbc/355314)
**Author:** [@Kenjiro](https://discuss.elastic.co/u/Kenjiro)\ **Replies:** 4\ **Last updated:** [March 13, 2024, 7:34pm UTC](https://discuss.elastic.co/t/getting-internal-id-field-via-jdbc/355314 "2024-03-13T19:34:50Z")
Hello, I'm new to elasticsearch and as far as I've read, \_id field is not accesible via sql endpoint at the moment. I've read some posts about duplicating it as a regular field in order to reach via sql endpoint. But I… --- ## [Version issue with Jaeger using elastic search](https://discuss.elastic.co/t/version-issue-with-jaeger-using-elastic-search/355099)
**Author:** [@Ranjit\_Kumar](https://discuss.elastic.co/u/Ranjit_Kumar)\ **Replies:** 2\ **Last updated:** [March 13, 2024, 6:39pm UTC](https://discuss.elastic.co/t/version-issue-with-jaeger-using-elastic-search/355099 "2024-03-13T18:39:54Z")
We are using Jaeger with ELK stack in Azure. Recently updated the Jaeger version to 1.52 and Elasticsearch version to 8.11. After upgrade the Jaeger UI is not showing any services not even the Jaeger services. But we can… --- ## [KV pairs automatically parsed by logstash?](https://discuss.elastic.co/t/kv-pairs-automatically-parsed-by-logstash/355331)
**Author:** [@Joe\_Martin](https://discuss.elastic.co/u/Joe_Martin)\ **Replies:** 3\ **Last updated:** [March 13, 2024, 6:17pm UTC](https://discuss.elastic.co/t/kv-pairs-automatically-parsed-by-logstash/355331 "2024-03-13T18:17:56Z")
I have a device sending syslogs in standard kv pair format; with a comma (,) separating fields and equal (=) separating key from value. sample: key1="value1",key2="value2",key3="value3",... In order to ensure ECS comp… --- ## [How to add a second logstash instance for clustering](https://discuss.elastic.co/t/how-to-add-a-second-logstash-instance-for-clustering/355334)
**Author:** [@Patrick.kirk](https://discuss.elastic.co/u/Patrick.kirk)\ **Replies:** 0\ **Last updated:** [March 13, 2024, 5:37pm UTC](https://discuss.elastic.co/t/how-to-add-a-second-logstash-instance-for-clustering/355334 "2024-03-13T17:37:37Z")
I'm trying to add a second logstash instance and cluster logstash to help with in coming windows logs. Within the outputs section of kibana, I need to add a second cert and key. How do I do this? Thanks in advance --- ## [How to install netflow on linux and use it for flow collector](https://discuss.elastic.co/t/how-to-install-netflow-on-linux-and-use-it-for-flow-collector/355332)
**Author:** [@jatindersharma1](https://discuss.elastic.co/u/jatindersharma1)\ **Replies:** 0\ **Last updated:** [March 13, 2024, 5:08pm UTC](https://discuss.elastic.co/t/how-to-install-netflow-on-linux-and-use-it-for-flow-collector/355332 "2024-03-13T17:08:21Z")
HI We are currently in the process of implementing a NetFlow-based flow collector for our network infrastructure, and we are seeking assistance with the installation procedure and configuration details for deploying the… --- ## [Is it possible to make a stock futures prediction model?](https://discuss.elastic.co/t/is-it-possible-to-make-a-stock-futures-prediction-model/354688)
**Author:** [@hoseok210](https://discuss.elastic.co/u/hoseok210)\ **Replies:** 1\ **Last updated:** [March 13, 2024, 4:22pm UTC](https://discuss.elastic.co/t/is-it-possible-to-make-a-stock-futures-prediction-model/354688 "2024-03-13T16:22:54Z")
I'd like to make a model that predicts stock price fluctuations, so can I make it while following the guide document at the bottom? --- ## [Find documents where same field value is found in any outer or nested fields](https://discuss.elastic.co/t/find-documents-where-same-field-value-is-found-in-any-outer-or-nested-fields/355325)
**Author:** [@spinesmovie](https://discuss.elastic.co/u/spinesmovie)\ **Replies:** 0\ **Last updated:** [March 13, 2024, 4:00pm UTC](https://discuss.elastic.co/t/find-documents-where-same-field-value-is-found-in-any-outer-or-nested-fields/355325 "2024-03-13T16:00:16Z")
Elasticsearch has an index where \_source is of schema { ... "color" : "white", "items" : \[ { ... "color": "blue", "items": \[...\] }, { ... "color": "red", "items": \[.… --- ## [Please explain how to customize filebeat settings when using Agent](https://discuss.elastic.co/t/please-explain-how-to-customize-filebeat-settings-when-using-agent/355306)
**Author:** [@mgotechlock](https://discuss.elastic.co/u/mgotechlock)\ **Replies:** 1\ **Last updated:** [March 13, 2024, 3:03pm UTC](https://discuss.elastic.co/t/please-explain-how-to-customize-filebeat-settings-when-using-agent/355306 "2024-03-13T15:03:16Z")
I am used to Filebeat and customizing it to do what I want, but now am testing Agent and those same methods in Filebeat do not seem to work. Note: I started with Fleet, but moved to standalone agents at this point. I co… --- ## [Reindex api is not copying the \_ignored field values from source index](https://discuss.elastic.co/t/reindex-api-is-not-copying-the-ignored-field-values-from-source-index/355316)
**Author:** [@rkbbce](https://discuss.elastic.co/u/rkbbce)\ **Replies:** 0\ **Last updated:** [March 13, 2024, 2:40pm UTC](https://discuss.elastic.co/t/reindex-api-is-not-copying-the-ignored-field-values-from-source-index/355316 "2024-03-13T14:40:02Z")
Hello Folks, I am trying to reindex the app search documents index from older version of es v7.17 to v8.8 but the target index is not maintaining the same \_ignored field value as source index. do we have any options in… --- ## [Filebeat setup issues on PC](https://discuss.elastic.co/t/filebeat-setup-issues-on-pc/355248)
**Author:** [@bk\_elk](https://discuss.elastic.co/u/bk_elk)\ **Replies:** 8\ **Last updated:** [March 13, 2024, 2:22pm UTC](https://discuss.elastic.co/t/filebeat-setup-issues-on-pc/355248 "2024-03-13T14:22:59Z")
Exiting: couldn't connect to any of the configured Elasticsearch hosts. Errors: \[error connecting to Elasticsearch at https://myendpoint.ex.com --- ## [How to know and manage Filbeat writes on Storage Account when ingesting from Event Hubs](https://discuss.elastic.co/t/how-to-know-and-manage-filbeat-writes-on-storage-account-when-ingesting-from-event-hubs/353344)
**Author:** [@rrodrmal](https://discuss.elastic.co/u/rrodrmal)\ **Replies:** 1\ **Last updated:** [March 13, 2024, 2:16pm UTC](https://discuss.elastic.co/t/how-to-know-and-manage-filbeat-writes-on-storage-account-when-ingesting-from-event-hubs/353344 "2024-03-13T14:16:22Z")
Hello, I know this topic seems quite similar to others already created in these forums, but those relate to Logstash instead of Filebeat, so I guess the resolution might be different in this case. We have an ecosystem … --- ## [Searching special characters in elastic](https://discuss.elastic.co/t/searching-special-characters-in-elastic/355016)
**Author:** [@peter\_falk](https://discuss.elastic.co/u/peter_falk)\ **Replies:** 3\ **Last updated:** [March 13, 2024, 12:30pm UTC](https://discuss.elastic.co/t/searching-special-characters-in-elastic/355016 "2024-03-13T12:30:18Z")
Hello, I have a problem I could not index special characters in Elasticsearch. I try to do it like that: PUT my-index-000001 { "settings": { "index": { "max\_result\_window": 100000, "n… --- ## [Kibana server is not ready yet](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet/355176)
**Author:** [@AKASH\_AT](https://discuss.elastic.co/u/AKASH_AT)\ **Replies:** 12\ **Last updated:** [March 13, 2024, 11:49am UTC](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet/355176 "2024-03-13T11:49:47Z")
Hi, When i tried to access the kibana GUI i got this as output "Kibana server is not ready yet." Here is the kibana log for the reference {"service":{"node":{"roles":\["background\_tasks","ui"\]}},"ecs":{"version":"8.6.1… --- ## [Kibana dashboard - drill down to dashboard into new tab - want to keep embed=true](https://discuss.elastic.co/t/kibana-dashboard-drill-down-to-dashboard-into-new-tab-want-to-keep-embed-true/354985)
**Author:** [@longtake](https://discuss.elastic.co/u/longtake)\ **Replies:** 2\ **Last updated:** [March 13, 2024, 11:23am UTC](https://discuss.elastic.co/t/kibana-dashboard-drill-down-to-dashboard-into-new-tab-want-to-keep-embed-true/354985 "2024-03-13T11:23:40Z")
Hi there In one of my spaces, I have a dashboard which is opened from a canvas link which includes the embed=true parameter to prevent the elastic top menu showing. If I create a drilldown to another dashboard from this… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=285) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=287)