Hello, I have configured Fluentbit in my k8s cluster to send logs to S3 and ELK stack to get logs from S3 and Visualise in Kibana. When I create Dataview in kibana for the Index, the kibana dashboard is not giving filte…
---
## [Can we connect to multiple clusters in JAVA using High level rest client](https://discuss.elastic.co/t/can-we-connect-to-multiple-clusters-in-java-using-high-level-rest-client/333310)
Hi team, I have a question about high level rest client lets suppose I have 2 clusters running on two different machines and those clusters have an index with the same name. I have a Java application which fetches dat…
---
## [Is there a way to recover kibana\_x file?](https://discuss.elastic.co/t/is-there-a-way-to-recover-kibana-x-file/333319)
Is there any possibility to recover from lost kibana\_x index? \[opc@elasticsearch-2 ~\]$ curl -XGET http://localhost:9200/\_cat/shards/.kibana\_7.12.0\_001 .kibana\_7.12.0\_001 0 p UNASSIGNED .kibana\_7.12.0\_001 0 r UNASSIG…
---
## [Elasticsearch Aggregations](https://discuss.elastic.co/t/elasticsearch-aggregations/333615)
I have a project in NodeJS with TypeScript that uses the library "@elastic/elasticsearch": "^8.7.0", to connect the server with Elastic Search 8.7.1. I'm trying to make a query where I retrieve the frequency of words fr…
---
## [How logstash jdbc plugin fetch data from database](https://discuss.elastic.co/t/how-logstash-jdbc-plugin-fetch-data-from-database/333103)
Hi I have informix database that contain tons of tables and records that need to join some of them and send to elasticsearch. Result of this join are 70 columns and 100M records. Here is the requirements: 1-For first …
---
## [Looking for help enabling Metricbeat](https://discuss.elastic.co/t/looking-for-help-enabling-metricbeat/333570)
Hello, I have a single node deploy of Elasticsearch Enterprise Search and Kibana all on version 8.6.2. In this node I enabled self-monitoring with xpack, but am trying to switch to using Metricbeat. While in 'Stack mon…
---
## [Issue with Beats forwarding to logstash](https://discuss.elastic.co/t/issue-with-beats-forwarding-to-logstash/333689)
Our enterprise configures our AWS EC2 instances with Auditbeat, Filebeat, Journalbeat, Metricbeat, and Packetbeat to forward to a set of logstash servers. Our /var/log/messages, and /var/log/secure files are filled with …
---
## [Grok error in official Azure integration](https://discuss.elastic.co/t/grok-error-in-official-azure-integration/333585)
Hey, the Azure integration currently (I'm using 8.7.0) fails to ingest some Azure Activity Logs with IPv6 source addresses. The reason is this processor: - grok: field: azure.activitylogs.callerIpAddress patter…
---
## [Which is better RAM allocation strategy?](https://discuss.elastic.co/t/which-is-better-ram-allocation-strategy/333497)
If I have a data node with 128GB of RAM. Is it better to allocate 64GB to ES and 64GB to system? Or would it be ok (or even better) to allocate say 100GB to ES and leave 28GB to system? Our system is write heavy; ther…
---
## [Kibana and logstash can't run using docker-compose](https://discuss.elastic.co/t/kibana-and-logstash-cant-run-using-docker-compose/333498)
hi ,hello everyone I run the elastic and logstash and kibana and mysql containers using docker-compose this the configuration that i use in my docker-compose file version: '3' services: mysql: container\_name: mysq…
---
## [Check if field from XML is object or array of objects?](https://discuss.elastic.co/t/check-if-field-from-xml-is-object-or-array-of-objects/333686)
I have the following case happening. I have an application that is configured to send data via a webhook like push method via HTTP rest api whenever data is inserted in the application database. Im using this functionali…
---
## [Winlogbeat yml file missing Elasticsearch output SSl Key](https://discuss.elastic.co/t/winlogbeat-yml-file-missing-elasticsearch-output-ssl-key/333679)
Configured my stack to SSL and lost log forwarding from Winlogbeat. Everything looks well on yml file with the exception of the Elasticsearch output key path. I did not receive a key when Elasticsearch SSL was configured…
---
## [Painless Script Error, Creating New Variable on Data View](https://discuss.elastic.co/t/painless-script-error-creating-new-variable-on-data-view/333599)
Hello! I am trying to create a new variable on a Data View using this painless script, but when trying to save, I am getting the generic error "Invalid Painless Script". The error also tells be to fix the highlighted err…
---
## [How do Searchable Snapshot snapshots get cleaned up?](https://discuss.elastic.co/t/how-do-searchable-snapshot-snapshots-get-cleaned-up/329831)
Hello All, I was curious if anyone knew the answer to the question: How do searchable snapshot snapshots get cleaned up. To explain the question a bit more, I'll use the below example: I have: A snapshot reposito…
---
## [How to integrate in-house ticketing tool with ELK using API's](https://discuss.elastic.co/t/how-to-integrate-in-house-ticketing-tool-with-elk-using-apis/333645)
Hi Everyone, I am currently working on integrating our in-house ticketing tool with ELK. Specifically, I would like to fetch data from ELK and automatically create incidents in our ticketing tool when specific conditions…
---
## [DEPRECATED: Treating the CommonName field on X.509 certificates as a host name when no Subject Alternative Names are present is going to be removed](https://discuss.elastic.co/t/deprecated-treating-the-commonname-field-on-x-509-certificates-as-a-host-name-when-no-subject-alternative-names-are-present-is-going-to-be-removed/333326)
I am getting the following deprecation warning in both filebeat and metricbeat. I am currently using ES 7.17.9, but will be upgrading to 8.x soon: DEPRECATED: Treating the CommonName field on X.509 certificates as a ho…
---
## [Is it possible to have multiple SQL queries into the Expression Editor?](https://discuss.elastic.co/t/is-it-possible-to-have-multiple-sql-queries-into-the-expression-editor/333596)
For the context, I have a query that brings me data from the last 24hous. And would like to have a second column which will deal only with information from the last 6minutes. The thing is, if I do both like: @timestamp…
---
## [How to upgrade ELK on docker from 8.4.3 to 8.7.0](https://discuss.elastic.co/t/how-to-upgrade-elk-on-docker-from-8-4-3-to-8-7-0/331352)
I have an elastdocker (elk version 8.4.3) in production for some time and I would like to upgrade the elk version (8.4.3 to 8.7.0). Volumes are configured on the instance to use persistent storage. The procedure would …
---
## [EFK Stack on Kubernetes - Collecting logs from default namespace](https://discuss.elastic.co/t/efk-stack-on-kubernetes-collecting-logs-from-default-namespace/333672)
Hi, I am using EFK stack on Kubernetes, I want to configure fluentd to collect logs from one specific namespace, the default namespace. This is my fleuntd config file: \