# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=730 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 731 --- ## [Access to aggregation results using kibana alerting](https://discuss.elastic.co/t/access-to-aggregation-results-using-kibana-alerting/319112)
**Author:** [@Youssef\_Mouadden](https://discuss.elastic.co/u/Youssef_Mouadden)\ **Replies:** 1\ **Last updated:** [November 16, 2022, 4:45pm UTC](https://discuss.elastic.co/t/access-to-aggregation-results-using-kibana-alerting/319112 "2022-11-16T16:45:47Z")
Hello, I'm facing a problem with Kibana alerting: I defined my query DSL and defined an aggregation I want to access the result of the aggregation returned using the query. Kibana only suggest {{context.hits}} but I'm … --- ## [Searching logs by host name](https://discuss.elastic.co/t/searching-logs-by-host-name/316388)
**Author:** [@rsk0](https://discuss.elastic.co/u/rsk0)\ **Replies:** 7\ **Last updated:** [November 16, 2022, 4:33pm UTC](https://discuss.elastic.co/t/searching-logs-by-host-name/316388 "2022-11-16T16:33:31Z")
I have a little quandary. I'd like my customers to easily search for logs by host name. ECS has a field, host.name exactly for that information, but it's keyword, and that requires users know the exact capitalization a… --- ## [Unable to edit settings for agent policy](https://discuss.elastic.co/t/unable-to-edit-settings-for-agent-policy/319096)
**Author:** [@mammodde](https://discuss.elastic.co/u/mammodde)\ **Replies:** 0\ **Last updated:** [November 16, 2022, 3:32pm UTC](https://discuss.elastic.co/t/unable-to-edit-settings-for-agent-policy/319096 "2022-11-16T15:32:03Z")
Hi, I am trying to install an elastic agent on an apache web server. The problem is that the server is outside my system's network. In order to make it work, I added an output in the fleet settings which should send da… --- ## [Filebeat: send to multiple logstashes instances?](https://discuss.elastic.co/t/filebeat-send-to-multiple-logstashes-instances/319078)
**Author:** [@smm](https://discuss.elastic.co/u/smm)\ **Replies:** 1\ **Last updated:** [November 16, 2022, 3:04pm UTC](https://discuss.elastic.co/t/filebeat-send-to-multiple-logstashes-instances/319078 "2022-11-16T15:04:59Z")
Dear community, is there some kind of trick / best practice if you want in filebeat to sent to multiple logstash putput instances? I know there is some limitation in place by libbeat, but perhaps there is something you … --- ## [How to Create a Rule Based on Time Range](https://discuss.elastic.co/t/how-to-create-a-rule-based-on-time-range/318998)
**Author:** [@ElasticUser11](https://discuss.elastic.co/u/ElasticUser11)\ **Replies:** 0\ **Last updated:** [November 15, 2022, 8:06pm UTC](https://discuss.elastic.co/t/how-to-create-a-rule-based-on-time-range/318998 "2022-11-15T20:06:27Z")
I'm trying to create a rule that detects when users login outside business hours (7AM-6PM). I believe this can be done with machine Learning, but I don not have that type of subscription. So, I've tried several ways, alb… --- ## [Deprecated Log](https://discuss.elastic.co/t/deprecated-log/319091)
**Author:** [@EExisT](https://discuss.elastic.co/u/EExisT)\ **Replies:** 0\ **Last updated:** [November 16, 2022, 2:49pm UTC](https://discuss.elastic.co/t/deprecated-log/319091 "2022-11-16T14:49:52Z")
Hello, i'm trying to patch the deprecated settings in my ES cluster v.7.13.x. I runned into these 2 deprecated settings: \[2022-11-16T15:03:23,504\]\[DEPRECATION\]\[o.e.d.c.s.Settings \] \[es-md-01\] \[xpack.security.htt… --- ## [Filebeat version \> 7.13.X did not correctly process logs from AWS S3 Bucket](https://discuss.elastic.co/t/filebeat-version-7-13-x-did-not-correctly-process-logs-from-aws-s3-bucket/317631)
**Author:** [@anyon486](https://discuss.elastic.co/u/anyon486)\ **Replies:** 2\ **Last updated:** [November 16, 2022, 1:50pm UTC](https://discuss.elastic.co/t/filebeat-version-7-13-x-did-not-correctly-process-logs-from-aws-s3-bucket/317631 "2022-11-16T13:50:01Z")
Hi All! I work with filebeat to push logs from AWS RDS databases to a local instance of Elasticsearch. To do this, I configured AWS RDS to publish logs to specific Cloudwatch Log Group/Log Stream, and use AWS Kinesis F… --- ## [Elasticsearch 8.05.00.00 ODBC connection error](https://discuss.elastic.co/t/elasticsearch-8-05-00-00-odbc-connection-error/318341)
**Author:** [@Gianluca\_De\_Pasquale](https://discuss.elastic.co/u/Gianluca_De_Pasquale)\ **Replies:** 2\ **Last updated:** [November 16, 2022, 1:35pm UTC](https://discuss.elastic.co/t/elasticsearch-8-05-00-00-odbc-connection-error/318341 "2022-11-16T13:35:17Z")
Hi, I want to try out the Elasticsearch ODBC driver for importing data from Microsoft Power Bi . After installation, I created a system DSN configuration, but when I tested the connection, I got the following error : Un… --- ## [Elasticsearch 7.7](https://discuss.elastic.co/t/elasticsearch-7-7/319079)
**Author:** [@Tiger1](https://discuss.elastic.co/u/Tiger1)\ **Replies:** 2\ **Last updated:** [November 16, 2022, 1:12pm UTC](https://discuss.elastic.co/t/elasticsearch-7-7/319079 "2022-11-16T13:12:26Z")
I'm trying to deploy elasticsearch 7.7 cluster, there's problem: \[es2\] master not discovered yet, this node has not previously joined a bootstrapped (v7+) cluster, and this node must discover master-eligible nodes \[es1,… --- ## [Using conditions in watcher](https://discuss.elastic.co/t/using-conditions-in-watcher/318956)
**Author:** [@ErGeek](https://discuss.elastic.co/u/ErGeek)\ **Replies:** 5\ **Last updated:** [November 16, 2022, 12:55pm UTC](https://discuss.elastic.co/t/using-conditions-in-watcher/318956 "2022-11-16T12:55:41Z")
Hi All, I am trying to add conditions in a watcher. If the value of the ctx.payload.value is less than 100, it should print a particular message "Within the limit". And if not than it should print another message "Limi… --- ## [Put a rule that will allow me to detect brute force](https://discuss.elastic.co/t/put-a-rule-that-will-allow-me-to-detect-brute-force/319080)
**Author:** [@buhu698](https://discuss.elastic.co/u/buhu698)\ **Replies:** 0\ **Last updated:** [November 16, 2022, 12:40pm UTC](https://discuss.elastic.co/t/put-a-rule-that-will-allow-me-to-detect-brute-force/319080 "2022-11-16T12:40:52Z")
Hello, can you help me to put a rule that will allow me to detect brute force. type of rule ( event correlation or indicator match ). From the Kali machine, I run the following command: Hydra –L /usr/share/wordlists/… --- ## [Extract multiple substrings from a field using grok](https://discuss.elastic.co/t/extract-multiple-substrings-from-a-field-using-grok/319071)
**Author:** [@Matan\_Malka](https://discuss.elastic.co/u/Matan_Malka)\ **Replies:** 2\ **Last updated:** [November 16, 2022, 12:26pm UTC](https://discuss.elastic.co/t/extract-multiple-substrings-from-a-field-using-grok/319071 "2022-11-16T12:26:13Z")
Hi, I'm trying to extract the job name ("create-machine") and the build number ("\*\*") from the file path but it is not possible to use duplicate keys. Do you have any other suggestions? input{ file{ path =\> \[ "/bi… --- ## [Kubernetes elastic search and kibana communication issue](https://discuss.elastic.co/t/kubernetes-elastic-search-and-kibana-communication-issue/317023)
**Author:** [@Siva\_Priya](https://discuss.elastic.co/u/Siva_Priya)\ **Replies:** 1\ **Last updated:** [October 19, 2022, 9:47pm UTC](https://discuss.elastic.co/t/kubernetes-elastic-search-and-kibana-communication-issue/317023 "2022-10-19T21:47:11Z")
Am trying to set up the Elasticsearch and kibana in Kubernetes cluster as per the instructions mentioned in How to run Elastic Cloud on Kubernetes from Azure Kubernetes Service | Elastic Blog. Everything is fine But I am… --- ## [Timezone issue](https://discuss.elastic.co/t/timezone-issue/318620)
**Author:** [@MahithaSarala](https://discuss.elastic.co/u/MahithaSarala)\ **Replies:** 10\ **Last updated:** [November 16, 2022, 12:12pm UTC](https://discuss.elastic.co/t/timezone-issue/318620 "2022-11-16T12:12:32Z")
In our current kibana setup , the timezone has been set to browser timezone. This dashboard is live for users in India as well as users in Ireland . The kibana setup is live and linked to spinnaker to monitor the pipelin… --- ## [Update Elasticsearch and Kibana](https://discuss.elastic.co/t/update-elasticsearch-and-kibana/319027)
**Author:** [@Clonky](https://discuss.elastic.co/u/Clonky)\ **Replies:** 6\ **Last updated:** [November 16, 2022, 11:55am UTC](https://discuss.elastic.co/t/update-elasticsearch-and-kibana/319027 "2022-11-16T11:55:48Z")
Hello, I am running on a local server Elasticsearch in version 7.16 and Kibana in version 7.17 I want both to be updated to version 8.5. I have read, that I should use the Update Assistance in the wiki However, when I… --- ## [Search for documents containing words with and without dots (e.g. “ceo”, “c.e.o”, “c.e.o.”)](https://discuss.elastic.co/t/search-for-documents-containing-words-with-and-without-dots-e-g-ceo-c-e-o-c-e-o/319035)
**Author:** [@revencu](https://discuss.elastic.co/u/revencu)\ **Replies:** 11\ **Last updated:** [November 16, 2022, 11:43am UTC](https://discuss.elastic.co/t/search-for-documents-containing-words-with-and-without-dots-e-g-ceo-c-e-o-c-e-o/319035 "2022-11-16T11:43:04Z")
{ "query":{ "match":{ "title": "ceo" } } } this query returns docs that only contain "ceo", "Ceo", "CEO". But the index has values like "c.e.o.", "C.E.O.", "c.e.o" How to set up a query so th… --- ## [How to use condition in canvas markdown render](https://discuss.elastic.co/t/how-to-use-condition-in-canvas-markdown-render/319069)
**Author:** [@tofpad](https://discuss.elastic.co/u/tofpad)\ **Replies:** 0\ **Last updated:** [November 16, 2022, 11:33am UTC](https://discuss.elastic.co/t/how-to-use-condition-in-canvas-markdown-render/319069 "2022-11-16T11:33:09Z")
Hi all, I want to hide a part of the content of a markdown render if there are no entries in my query result. For that i try tu use if in my markdown but i can't make it to work. filters | essql query={string "selec… --- ## [ODBC connected to Power BI not doing "query folding"](https://discuss.elastic.co/t/odbc-connected-to-power-bi-not-doing-query-folding/318028)
**Author:** [@Raul\_Uria](https://discuss.elastic.co/u/Raul_Uria)\ **Replies:** 1\ **Last updated:** [November 16, 2022, 11:15am UTC](https://discuss.elastic.co/t/odbc-connected-to-power-bi-not-doing-query-folding/318028 "2022-11-16T11:15:47Z")
Hi, we´re trying ODBC driver, using it to connect PowerBI to Elasticsearch. We can see data into PowerBI, but performance is less than optimal, it seems like driver is not making "query folding" as "View native query" o… --- ## [Node stats API fails with a Null Pointer exception for data nodes](https://discuss.elastic.co/t/node-stats-api-fails-with-a-null-pointer-exception-for-data-nodes/319016)
**Author:** [@Dheeraj\_Gupta](https://discuss.elastic.co/u/Dheeraj_Gupta)\ **Replies:** 1\ **Last updated:** [November 16, 2022, 11:15am UTC](https://discuss.elastic.co/t/node-stats-api-fails-with-a-null-pointer-exception-for-data-nodes/319016 "2022-11-16T11:15:32Z")
Hi, We have recently upgraded to 8.5.0 from 8.4.1. We use the node stats API (\_nodes/stats) to pull stats about various nodes for storage into graphite. Since the update all data nodes are showing the following failure … --- ## [Iam trying to parse fortigate syslog to logstash](https://discuss.elastic.co/t/iam-trying-to-parse-fortigate-syslog-to-logstash/319059)
**Author:** [@hasan.idriss](https://discuss.elastic.co/u/hasan.idriss)\ **Replies:** 0\ **Last updated:** [November 16, 2022, 10:55am UTC](https://discuss.elastic.co/t/iam-trying-to-parse-fortigate-syslog-to-logstash/319059 "2022-11-16T10:55:04Z")
when i run the command: /usr/share/logstash/bin/logstash -f /etc/logstash/conf.d/fortigate.conf I get the error : udp - UDP listener died {:exception=\>#\ **Author:** [@wrobitza\_aveq](https://discuss.elastic.co/u/wrobitza_aveq)\ **Replies:** 7\ **Last updated:** [November 16, 2022, 10:45am UTC](https://discuss.elastic.co/t/how-can-i-clear-keyword-entries-that-have-no-documents/318537 "2022-11-16T10:45:21Z") I accidentally indexed a document with a wrong text/keyword field. I later removed the document, but the keyword is still there. For instance, when I run the query: GET \_search { "size": 0, "aggs": { "group\_by\_… --- ## [Get some log in file but not all in filebeat](https://discuss.elastic.co/t/get-some-log-in-file-but-not-all-in-filebeat/319046)
**Author:** [@devikingno](https://discuss.elastic.co/u/devikingno)\ **Replies:** 0\ **Last updated:** [November 16, 2022, 9:35am UTC](https://discuss.elastic.co/t/get-some-log-in-file-but-not-all-in-filebeat/319046 "2022-11-16T09:35:11Z")
Hello everyone, i have a problem to collect log from Filebeat to Logstash. The problem is that in the log file that I configure, I only want to get the log messages about the user's login and the other logs won't be fetc… --- ## [Elastic DSL Query](https://discuss.elastic.co/t/elastic-dsl-query/319040)
**Author:** [@Nikhil\_Sharma2](https://discuss.elastic.co/u/Nikhil_Sharma2)\ **Replies:** 0\ **Last updated:** [November 16, 2022, 9:05am UTC](https://discuss.elastic.co/t/elastic-dsl-query/319040 "2022-11-16T09:05:38Z")
I have a query in sql which I want to transform in ES. Select \* from items where ( (State=== Open AND (userId=== '123' OR contributers.include('123'))) OR ( (State=== Review) AND ( AntherState=== Submitted AND A… --- ## [Grok Pattern For Java stack traces](https://discuss.elastic.co/t/grok-pattern-for-java-stack-traces/319036)
**Author:** [@Nessy](https://discuss.elastic.co/u/Nessy)\ **Replies:** 0\ **Last updated:** [November 16, 2022, 8:56am UTC](https://discuss.elastic.co/t/grok-pattern-for-java-stack-traces/319036 "2022-11-16T08:56:34Z")
Hello, I have been workin on this topic for a long time. Here my logstash conf : filter { if \[fields\]\[application\_name\] =~ "APPNAME" { grok { match =\> { "message" =\> "(?\%{TIMESTAMP\_ISO8601})… --- ## [Kibana Observability dashboard custom field](https://discuss.elastic.co/t/kibana-observability-dashboard-custom-field/318991)
**Author:** [@Mario\_Fimiani](https://discuss.elastic.co/u/Mario_Fimiani)\ **Replies:** 2\ **Last updated:** [November 16, 2022, 8:52am UTC](https://discuss.elastic.co/t/kibana-observability-dashboard-custom-field/318991 "2022-11-16T08:52:14Z")
Ciao can anyone know if the Observability Dashboard can be customized in term of fields shows ? We are able to change the field but when we refresh the page we miss the customization. Stack v. 7.17.3 --- ## [\[DOCS\] Monitoring](https://discuss.elastic.co/t/docs-monitoring/317197)
**Author:** [@sp-kyn](https://discuss.elastic.co/u/sp-kyn)\ **Replies:** 1\ **Last updated:** [November 16, 2022, 8:36am UTC](https://discuss.elastic.co/t/docs-monitoring/317197 "2022-11-16T08:36:26Z")
Hello, I'm new here, trying to understand the monitoring setup on a basic up to date 8.4.1 self-hosted elk stack. Continuing the discussion from No need to set \`xpack.monitoring.collection.enabled\` to true when using m… --- ## [Elasticsearch picking wrong port](https://discuss.elastic.co/t/elasticsearch-picking-wrong-port/318978)
**Author:** [@harijld](https://discuss.elastic.co/u/harijld)\ **Replies:** 8\ **Last updated:** [November 16, 2022, 7:57am UTC](https://discuss.elastic.co/t/elasticsearch-picking-wrong-port/318978 "2022-11-16T07:57:37Z")
Hi Team, I am facing strange behavior in prod environment. I used same configuration in prod and DR servers but in prod its working fine, in DR elasticserch is not connecting to different node when I am configuring clu… --- ## [Mustache double quotes problem in search templates](https://discuss.elastic.co/t/mustache-double-quotes-problem-in-search-templates/318736)
**Author:** [@D1sturbance](https://discuss.elastic.co/u/D1sturbance)\ **Replies:** 7\ **Last updated:** [November 16, 2022, 7:52am UTC](https://discuss.elastic.co/t/mustache-double-quotes-problem-in-search-templates/318736 "2022-11-16T07:52:23Z")
What is the best way to use mustache False values feature in Elasticsearch template? At the moment I am trying to select function based on boolean value. Rendering seems to be working according to the logic, but it pri… --- ## [Transform not updating documents](https://discuss.elastic.co/t/transform-not-updating-documents/318209)
**Author:** [@tommycahir](https://discuss.elastic.co/u/tommycahir)\ **Replies:** 8\ **Last updated:** [November 16, 2022, 7:50am UTC](https://discuss.elastic.co/t/transform-not-updating-documents/318209 "2022-11-16T07:50:48Z")
Hi I have a continious transform running with the following query applied which should only allow documents with the status open or closed in the trasnform destination however when documents in these status are updated … --- ## [Comparing Two Indices Across Clusters](https://discuss.elastic.co/t/comparing-two-indices-across-clusters/318904)
**Author:** [@connellyethan](https://discuss.elastic.co/u/connellyethan)\ **Replies:** 5\ **Last updated:** [November 16, 2022, 7:37am UTC](https://discuss.elastic.co/t/comparing-two-indices-across-clusters/318904 "2022-11-16T07:37:08Z")
Hi All, We are currently attempting to compare two indices across clusters to verify we did not lose any records or fields during the process of cross cluster replication, which is how we chose to do this data migration… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=729) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=731)