# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=725 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 726 --- ## [Parsing errors in Winlogbeat Powershell module](https://discuss.elastic.co/t/parsing-errors-in-winlogbeat-powershell-module/319468)
**Author:** [@amitypete](https://discuss.elastic.co/u/amitypete)\ **Replies:** 0\ **Last updated:** [November 21, 2022, 2:49pm UTC](https://discuss.elastic.co/t/parsing-errors-in-winlogbeat-powershell-module/319468 "2022-11-21T14:49:26Z")
I am trying to determine why I am getting so many Powershell parsing errors for event.code 800 events when ingesting with winlogbeat v 7.17.5. I'm seeing more than 50% of these ingested events being tagged with "\_js\_exc… --- ## [Aggregate on multiple data fields from time series data](https://discuss.elastic.co/t/aggregate-on-multiple-data-fields-from-time-series-data/319466)
**Author:** [@rvadiga](https://discuss.elastic.co/u/rvadiga)\ **Replies:** 0\ **Last updated:** [November 21, 2022, 2:40pm UTC](https://discuss.elastic.co/t/aggregate-on-multiple-data-fields-from-time-series-data/319466 "2022-11-21T14:40:10Z")
Dear Team, I am a newbie to ELK world so far. Please bear with my question. I have a time-series data which has many numeric data fields, needs a way to define an aggregation of those fields across time-series period. … --- ## [Fleet-server cannot write to a fleet managed index](https://discuss.elastic.co/t/fleet-server-cannot-write-to-a-fleet-managed-index/318138)
**Author:** [@twilson](https://discuss.elastic.co/u/twilson)\ **Replies:** 1\ **Last updated:** [November 21, 2022, 2:33pm UTC](https://discuss.elastic.co/t/fleet-server-cannot-write-to-a-fleet-managed-index/318138 "2022-11-21T14:33:04Z")
I created a custom ingest pipeline (logs-system.security@custom) that looks for event ID 5152 or 5157 in the Windows security log, and redirects those events to the iptables indexes (logs-iptables.log-default), after mod… --- ## [Rarest term filter](https://discuss.elastic.co/t/rarest-term-filter/319455)
**Author:** [@Karel\_Haerens](https://discuss.elastic.co/u/Karel_Haerens)\ **Replies:** 0\ **Last updated:** [November 21, 2022, 1:20pm UTC](https://discuss.elastic.co/t/rarest-term-filter/319455 "2022-11-21T13:20:22Z")
Hi all, would there be a way to filter matches to a query in such a way that only matches are accepted where (at least) the rarest term in the result occurs in the query. worded differently: there cannot be any unmatch… --- ## [Fail to checkin to fleet server](https://discuss.elastic.co/t/fail-to-checkin-to-fleet-server/318932)
**Author:** [@subash](https://discuss.elastic.co/u/subash)\ **Replies:** 7\ **Last updated:** [November 21, 2022, 1:42pm UTC](https://discuss.elastic.co/t/fail-to-checkin-to-fleet-server/318932 "2022-11-21T13:42:18Z")
We are using Elasticsearch 7.17.4 on private cloud. We have 4 elastic agents installed on windows 10 PCs and managed by fleet. It is observed that the Elastic agent status switches between 'Healthy' and 'Offline'. Belo… --- ## [Cmd/enroll\_cmd.go:776 Fleet Server - Error - x509: certificate is valid for (old hostname), not (current hostname)](https://discuss.elastic.co/t/cmd-enroll-cmd-go-776-fleet-server-error-x509-certificate-is-valid-for-old-hostname-not-current-hostname/318427)
**Author:** [@Foe\_Clicker](https://discuss.elastic.co/u/Foe_Clicker)\ **Replies:** 2\ **Last updated:** [November 21, 2022, 1:26pm UTC](https://discuss.elastic.co/t/cmd-enroll-cmd-go-776-fleet-server-error-x509-certificate-is-valid-for-old-hostname-not-current-hostname/318427 "2022-11-21T13:26:55Z")
Hi, I have the same issue like couple more people here, unfortinately they did not get any help, so I try myself:) Enrolling agent fails with message certificate is valid for (old hostname), not (current hostname). But… --- ## [Fleet server & integrations does not provide log/data](https://discuss.elastic.co/t/fleet-server-integrations-does-not-provide-log-data/316473)
**Author:** [@swchandu](https://discuss.elastic.co/u/swchandu)\ **Replies:** 3\ **Last updated:** [November 21, 2022, 1:23pm UTC](https://discuss.elastic.co/t/fleet-server-integrations-does-not-provide-log-data/316473 "2022-11-21T13:23:03Z")
Need help on fleet I have recently installed a cluster (8.4.0 docker) and facing issues with fleet/APM integration. Fleet container is running in the same elk server and getting registered with healthy status. However,… --- ## [Fleet data exporting to CSV](https://discuss.elastic.co/t/fleet-data-exporting-to-csv/318848)
**Author:** [@praveen\_raju](https://discuss.elastic.co/u/praveen_raju)\ **Replies:** 1\ **Last updated:** [November 21, 2022, 1:17pm UTC](https://discuss.elastic.co/t/fleet-data-exporting-to-csv/318848 "2022-11-21T13:17:52Z")
Hi, Is there way i can export Fleet data to CSV. I mean do we have a index for fleet for writing queries ?? my use case is i need to build a dashboard where it should show status of Elastic agent in each VM and way to … --- ## [\[Kibana Helm chart\] - UNABLE\_TO\_GET\_ISSUER\_CERT](https://discuss.elastic.co/t/kibana-helm-chart-unable-to-get-issuer-cert/319432)
**Author:** [@Vignesh\_Karthikeyan](https://discuss.elastic.co/u/Vignesh_Karthikeyan)\ **Replies:** 0\ **Last updated:** [November 21, 2022, 11:16am UTC](https://discuss.elastic.co/t/kibana-helm-chart-unable-to-get-issuer-cert/319432 "2022-11-21T11:16:18Z")
I was trying to deploy kibana helm chart where Elasticsearch was already deployed and running fine. kibana helm chart - helm-charts/kibana at main · elastic/helm-charts · GitHub After helm installation the deployment f… --- ## [Logstash Filter output in different files according to incomming IP address](https://discuss.elastic.co/t/logstash-filter-output-in-different-files-according-to-incomming-ip-address/319305)
**Author:** [@Flo\_h](https://discuss.elastic.co/u/Flo_h)\ **Replies:** 4\ **Last updated:** [November 21, 2022, 1:10pm UTC](https://discuss.elastic.co/t/logstash-filter-output-in-different-files-according-to-incomming-ip-address/319305 "2022-11-21T13:10:17Z")
Hello, I am using the last version of Logstash 8.5.1. And I am trying to output log in files according to the source IP in the logstash input. I DO know the incomming IPs. I am trying to filter them out in the filter pa… --- ## [Script painless use regex match not found](https://discuss.elastic.co/t/script-painless-use-regex-match-not-found/319433)
**Author:** [@wnn](https://discuss.elastic.co/u/wnn)\ **Replies:** 1\ **Last updated:** [November 21, 2022, 12:25pm UTC](https://discuss.elastic.co/t/script-painless-use-regex-match-not-found/319433 "2022-11-21T12:25:37Z")
i want find a word from my filed.i use the filed.keyword .but match not found def m=/.\*\[0-9\]+/.matcher("2020年11月"); i want get a result = 202011，but the true result is not match； so，my friend，please help me；thank you … --- ## [Elastic log Events ingest rate optimization](https://discuss.elastic.co/t/elastic-log-events-ingest-rate-optimization/319440)
**Author:** [@abkonred](https://discuss.elastic.co/u/abkonred)\ **Replies:** 0\ **Last updated:** [November 21, 2022, 12:11pm UTC](https://discuss.elastic.co/t/elastic-log-events-ingest-rate-optimization/319440 "2022-11-21T12:11:56Z")
Hello Team, I have ingested the data around 14.7GB, it took me around 29 minutes (From Filebeat-Logstash-Elasticsearch)to load the complete data. and later on next day the shard has been compressed to 10.5 GB. could yo… --- ## [Beats won't send multiple log files or updated log file](https://discuss.elastic.co/t/beats-wont-send-multiple-log-files-or-updated-log-file/319438)
**Author:** [@Daniel4](https://discuss.elastic.co/u/Daniel4)\ **Replies:** 0\ **Last updated:** [November 21, 2022, 12:03pm UTC](https://discuss.elastic.co/t/beats-wont-send-multiple-log-files-or-updated-log-file/319438 "2022-11-21T12:03:04Z")
So I just got started with the ELK stack, I have configured filebeat to send log files to logstash \> logstash then ships these logs to elasticsearch, now I have faced multiple setbacks I can't seem to fix, filebeat behav… --- ## [Setup Logstash with Loki in Kubernetes](https://discuss.elastic.co/t/setup-logstash-with-loki-in-kubernetes/319431)
**Author:** [@jijesh\_vu](https://discuss.elastic.co/u/jijesh_vu)\ **Replies:** 0\ **Last updated:** [November 21, 2022, 11:13am UTC](https://discuss.elastic.co/t/setup-logstash-with-loki-in-kubernetes/319431 "2022-11-21T11:13:44Z")
Hi any documentations for configuring Logstash with Loki in kubernetes without filebeat --- ## [Replace special character in stirng to other special character](https://discuss.elastic.co/t/replace-special-character-in-stirng-to-other-special-character/319382)
**Author:** [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Replies:** 2\ **Last updated:** [November 21, 2022, 9:54am UTC](https://discuss.elastic.co/t/replace-special-character-in-stirng-to-other-special-character/319382 "2022-11-21T09:54:08Z")
Hi all I have a case that i've been trying to do for a very long time. I have a string that contain #0D#0A character that i want to replace them with the string \\r\\n I've been trying to use gsub but it doesn't seem to… --- ## [Enable Testing for ARM64 platform on CI](https://discuss.elastic.co/t/enable-testing-for-arm64-platform-on-ci/319423)
**Author:** [@odidev](https://discuss.elastic.co/u/odidev)\ **Replies:** 0\ **Last updated:** [November 21, 2022, 10:51am UTC](https://discuss.elastic.co/t/enable-testing-for-arm64-platform-on-ci/319423 "2022-11-21T10:51:46Z")
Hi Team, I am working with Elastic Beats on the Linux ARM64 platform. Although it seems support for ARM64 is present, testing is not included in the CI. Do you have any plan to include the ARM64 testing for Linux? If … --- ## [Unable to install elastic agent for Fleet Server](https://discuss.elastic.co/t/unable-to-install-elastic-agent-for-fleet-server/318979)
**Author:** [@Tucker\_Green](https://discuss.elastic.co/u/Tucker_Green)\ **Replies:** 1\ **Last updated:** [November 21, 2022, 10:25am UTC](https://discuss.elastic.co/t/unable-to-install-elastic-agent-for-fleet-server/318979 "2022-11-21T10:25:55Z")
I keep getting the following error when trying to install the elastic agent so that I can get a fleet server up and running... I have tried adding the certificate authorities, and the troubleshooting docs don't help. Doe… --- ## [Logstash not stopping if elasticsearch down - although persistent pipeline queue is enabled](https://discuss.elastic.co/t/logstash-not-stopping-if-elasticsearch-down-although-persistent-pipeline-queue-is-enabled/318403)
**Author:** [@asp](https://discuss.elastic.co/u/asp)\ **Replies:** 1\ **Last updated:** [November 21, 2022, 9:32am UTC](https://discuss.elastic.co/t/logstash-not-stopping-if-elasticsearch-down-although-persistent-pipeline-queue-is-enabled/318403 "2022-11-21T09:32:12Z")
Hi, I am using multi-pipelining in logstash. I encountered issues before when I want to stop logstash and elasticsearch is unavailable. Thought the issue was the following: logstash has read events from redis and pro… --- ## [Master-Slave architecture Log Collection and Mapping](https://discuss.elastic.co/t/master-slave-architecture-log-collection-and-mapping/319410)
**Author:** [@Poongkuyil\_Muse](https://discuss.elastic.co/u/Poongkuyil_Muse)\ **Replies:** 0\ **Last updated:** [November 21, 2022, 9:28am UTC](https://discuss.elastic.co/t/master-slave-architecture-log-collection-and-mapping/319410 "2022-11-21T09:28:55Z")
I am able to retrieve apache web logs from one system and visualize them in kibana. However, we have more than one system that work as master-slave. My Scenario: If there are 3 systems A,B,C A - Master (IP1: 192.165.… --- ## [Check if index pattern exists using curl](https://discuss.elastic.co/t/check-if-index-pattern-exists-using-curl/319408)
**Author:** [@Neelam\_Zanvar](https://discuss.elastic.co/u/Neelam_Zanvar)\ **Replies:** 0\ **Last updated:** [November 21, 2022, 9:24am UTC](https://discuss.elastic.co/t/check-if-index-pattern-exists-using-curl/319408 "2022-11-21T09:24:56Z")
Hi i am using ansible to create index patterns and data views in elk. Before creating a data view for a index pattern i would want to check if index pattern exists. Currently using this command curl -I -XHEAD --write-o… --- ## [Only first path being harvested](https://discuss.elastic.co/t/only-first-path-being-harvested/319403)
**Author:** [@jrubenc](https://discuss.elastic.co/u/jrubenc)\ **Replies:** 1\ **Last updated:** [November 21, 2022, 9:19am UTC](https://discuss.elastic.co/t/only-first-path-being-harvested/319403 "2022-11-21T09:19:11Z")
Hello, I have the following simple configuration: # cat /etc/filebeat/filebeat.yml # Workaround manually managed ################### filebeat Configuration ######################### ############################# fil… --- ## [Failed to ingest Data to an Index](https://discuss.elastic.co/t/failed-to-ingest-data-to-an-index/319405)
**Author:** [@Jecks\_Speed](https://discuss.elastic.co/u/Jecks_Speed)\ **Replies:** 0\ **Last updated:** [November 21, 2022, 8:58am UTC](https://discuss.elastic.co/t/failed-to-ingest-data-to-an-index/319405 "2022-11-21T08:58:53Z")
Hi everyone, Good day! I am newbie to ELK. currently i am working a return data of an API. upon checking my target body it has the return data from API call, However after processing these data using mutate and some if… --- ## [Script\_exception - runtime error - Illegal list shortcut value](https://discuss.elastic.co/t/script-exception-runtime-error-illegal-list-shortcut-value/319297)
**Author:** [@JuanCarPC](https://discuss.elastic.co/u/JuanCarPC)\ **Replies:** 1\ **Last updated:** [November 21, 2022, 8:09am UTC](https://discuss.elastic.co/t/script-exception-runtime-error-illegal-list-shortcut-value/319297 "2022-11-21T08:09:29Z")
Hi, I made this update by query POST documento2/\_update\_by\_query { "script": { "source": """ for (int i = 0; i \< ctx.\_source.innResultado.innResultadoEfectos.size(); i++) { if(ctx.\_source.innResul… --- ## [Cloudflare Logpush Elasticsearch](https://discuss.elastic.co/t/cloudflare-logpush-elasticsearch/319393)
**Author:** [@tomikoooo](https://discuss.elastic.co/u/tomikoooo)\ **Replies:** 1\ **Last updated:** [November 21, 2022, 7:18am UTC](https://discuss.elastic.co/t/cloudflare-logpush-elasticsearch/319393 "2022-11-21T07:18:59Z")
Im trying to connect elasticsearch to cloudflare via logpush. I have no choice to use ssl since cloudflare does not accept http. Whenever I tried to use the SSL configuration it does not start. I tried running netstat -… --- ## [Elasticsearch m1 macbook arm64 xpack.ml](https://discuss.elastic.co/t/elasticsearch-m1-macbook-arm64-xpack-ml/319387)
**Author:** [@zzdntjd](https://discuss.elastic.co/u/zzdntjd)\ **Replies:** 1\ **Last updated:** [November 21, 2022, 6:59am UTC](https://discuss.elastic.co/t/elasticsearch-m1-macbook-arm64-xpack-ml/319387 "2022-11-21T06:59:51Z")
hello! os : (apple silicon m1 macbook) mac os ventura elasticsearch version : 7.10.1 problem i start elasticsearch on m1 macbook air. suddenly, error to log on term. error is need to (xpack.ml.enabled: false) setti… --- ## [Reports Generation on Kibana](https://discuss.elastic.co/t/reports-generation-on-kibana/317319)
**Author:** [@tifty](https://discuss.elastic.co/u/tifty)\ **Replies:** 4\ **Last updated:** [October 25, 2022, 2:12pm UTC](https://discuss.elastic.co/t/reports-generation-on-kibana/317319 "2022-10-25T14:12:45Z")
Is it possible to generate .PNG or .PDF reports directly from the free version of Kibana? Or can I use any 3rd party tool that embeds with Kibana? Thanks --- ## [Sort data per date in kibana discover](https://discuss.elastic.co/t/sort-data-per-date-in-kibana-discover/318918)
**Author:** [@2019240081](https://discuss.elastic.co/u/2019240081)\ **Replies:** 4\ **Last updated:** [November 21, 2022, 6:49am UTC](https://discuss.elastic.co/t/sort-data-per-date-in-kibana-discover/318918 "2022-11-21T06:49:24Z")
I want to filter log dadta per date in kibana discover and this is the only way I've discovered so far How can I filter data per date more easily ? --- ## [\[ERROR\] Cannot race. pid file not available after 60 seconds! in rally](https://discuss.elastic.co/t/error-cannot-race-pid-file-not-available-after-60-seconds-in-rally/319367)
**Author:** [@qksjdhi1212](https://discuss.elastic.co/u/qksjdhi1212)\ **Replies:** 2\ **Last updated:** [November 21, 2022, 6:42am UTC](https://discuss.elastic.co/t/error-cannot-race-pid-file-not-available-after-60-seconds-in-rally/319367 "2022-11-21T06:42:51Z")
I tried to run rally with following command esrally race --distribution-version=8.4.0 --track=geonames --challenge=append-no-conflicts but I got this error message \[ERROR\] Cannot race. pid file not available after 60… --- ## [Cluster with all system indices in RED status](https://discuss.elastic.co/t/cluster-with-all-system-indices-in-red-status/319285)
**Author:** [@ylasri](https://discuss.elastic.co/u/ylasri)\ **Replies:** 2\ **Last updated:** [November 21, 2022, 6:26am UTC](https://discuss.elastic.co/t/cluster-with-all-system-indices-in-red-status/319285 "2022-11-21T06:26:14Z")
Hello, I have a cluster where i lost some nodes that are storing primaries & replicas of all system indices. index shard prirep state .reporting-2022-09-18 0 p UNASSIGNED .reporting-2022-09-18 0 r UNASSIGNED … --- ## [Kibana : Not able to generate large reports](https://discuss.elastic.co/t/kibana-not-able-to-generate-large-reports/318145)
**Author:** [@shobhit](https://discuss.elastic.co/u/shobhit)\ **Replies:** 4\ **Last updated:** [November 21, 2022, 5:52am UTC](https://discuss.elastic.co/t/kibana-not-able-to-generate-large-reports/318145 "2022-11-21T05:52:16Z")
Hi, I am using ELK Version 7.17.2 . We are trying to generate reports for more then a million rows CSV. Getting below error. Error Error: Max attempts reached (3). Queue timeout reached. ###kibana.yml \*server.host… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=724) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=726)