# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=739 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 740 --- ## [Send syslogs in batches/an array of events records?](https://discuss.elastic.co/t/send-syslogs-in-batches-an-array-of-events-records/318477)
**Author:** [@ianbv](https://discuss.elastic.co/u/ianbv)\ **Replies:** 0\ **Last updated:** [November 8, 2022, 9:41pm UTC](https://discuss.elastic.co/t/send-syslogs-in-batches-an-array-of-events-records/318477 "2022-11-08T21:41:03Z")
Is there a way to group linux syslogs events together in to an array with a logstash filter or output plugin? Here is the example schema I need to get the logs into for sending to ADX: \[ { "records": \[ { r1 … --- ## [Send Ubuntu Syslogs to Azure Event Hub with Logstash - json issue](https://discuss.elastic.co/t/send-ubuntu-syslogs-to-azure-event-hub-with-logstash-json-issue/317990)
**Author:** [@ianbv](https://discuss.elastic.co/u/ianbv)\ **Replies:** 1\ **Last updated:** [November 8, 2022, 9:11pm UTC](https://discuss.elastic.co/t/send-ubuntu-syslogs-to-azure-event-hub-with-logstash-json-issue/317990 "2022-11-08T21:11:23Z")
Situation: Using Logstash to forward ubuntu (azure vm) syslogs to an azure event hub. Problem: Using "json" or "json\_batch" results in adding the \_jsonparseerror tag to events because the syslog isn't in json format. Is… --- ## [Elasticsearch OCI bucket](https://discuss.elastic.co/t/elasticsearch-oci-bucket/318006)
**Author:** [@Walter\_Hiranpat1](https://discuss.elastic.co/u/Walter_Hiranpat1)\ **Replies:** 3\ **Last updated:** [November 8, 2022, 9:02pm UTC](https://discuss.elastic.co/t/elasticsearch-oci-bucket/318006 "2022-11-08T21:02:22Z")
Has there been any support for using the oci (oracle cloud infrastructure) bucket to perform snapshot and restore? I thought oci bucket uses similar s3 configuration and would be compatible to use with the aws s3 plugin … --- ## [Split HTTP Poller Responses to Multiple Documents using Split Filter](https://discuss.elastic.co/t/split-http-poller-responses-to-multiple-documents-using-split-filter/318418)
**Author:** [@sajid](https://discuss.elastic.co/u/sajid)\ **Replies:** 3\ **Last updated:** [November 8, 2022, 8:33pm UTC](https://discuss.elastic.co/t/split-http-poller-responses-to-multiple-documents-using-split-filter/318418 "2022-11-08T20:33:14Z")
We have multiple healthcheck endpoint of different applications which give response in json about the health status of that application and its dependencies. Below are the response of two of the hc URLs: URL 1 Response… --- ## [Logstash failed to start (org.jruby.RubyKernel.exit(org/jruby/RubyKernel.java:790) ~\[jruby.jar:?\])](https://discuss.elastic.co/t/logstash-failed-to-start-org-jruby-rubykernel-exit-org-jruby-rubykernel-java-790-jruby-jar/318457)
**Author:** [@Rootlente](https://discuss.elastic.co/u/Rootlente)\ **Replies:** 12\ **Last updated:** [November 8, 2022, 8:18pm UTC](https://discuss.elastic.co/t/logstash-failed-to-start-org-jruby-rubykernel-exit-org-jruby-rubykernel-java-790-jruby-jar/318457 "2022-11-08T20:18:04Z")
Hello, I am building home lab environment to collect winevent logs using filebat and send them on my Ubuntu machine where i installed everything and configured them by documentation but every time i get this error i d… --- ## [Can someone see the dashboard without the need for sign in](https://discuss.elastic.co/t/can-someone-see-the-dashboard-without-the-need-for-sign-in/318388)
**Author:** [@Shashank02](https://discuss.elastic.co/u/Shashank02)\ **Replies:** 9\ **Last updated:** [November 8, 2022, 5:29pm UTC](https://discuss.elastic.co/t/can-someone-see-the-dashboard-without-the-need-for-sign-in/318388 "2022-11-08T17:29:49Z")
So, I've been building a website, where I want to show the dashboards of Kibana. So, on the website whenever the user clicks the link they will be redirected to the dashboard page in Kibana. but, the only thing I want to… --- ## [S3 Curator delete process slow - Is this a bad idea?](https://discuss.elastic.co/t/s3-curator-delete-process-slow-is-this-a-bad-idea/318430)
**Author:** [@jthegoodlife](https://discuss.elastic.co/u/jthegoodlife)\ **Replies:** 7\ **Last updated:** [November 8, 2022, 7:52pm UTC](https://discuss.elastic.co/t/s3-curator-delete-process-slow-is-this-a-bad-idea/318430 "2022-11-08T19:52:51Z")
We have a backup process using curator that is backup to S3, unfortunately, the delete job for the snapshots has not been processed. Deleting from curator is very slow for s3 and reading on the forums this is caused by t… --- ## [How to work with es enrollment token and kibana verification code when working in kubernetes](https://discuss.elastic.co/t/how-to-work-with-es-enrollment-token-and-kibana-verification-code-when-working-in-kubernetes/316394)
**Author:** [@Kracozebr](https://discuss.elastic.co/u/Kracozebr)\ **Replies:** 0\ **Last updated:** [October 12, 2022, 3:24am UTC](https://discuss.elastic.co/t/how-to-work-with-es-enrollment-token-and-kibana-verification-code-when-working-in-kubernetes/316394 "2022-10-12T03:24:29Z")
I need to have opportunity to collect logs from my embedded device and has chosen elasticsearch and kibana for that. I can connect to my embedded device through Ethernet from my PC. I installed elasticsearch and kibana … --- ## [How to stop refresh activity while using scroll](https://discuss.elastic.co/t/how-to-stop-refresh-activity-while-using-scroll/318382)
**Author:** [@ykonathala](https://discuss.elastic.co/u/ykonathala)\ **Replies:** 5\ **Last updated:** [November 8, 2022, 5:08pm UTC](https://discuss.elastic.co/t/how-to-stop-refresh-activity-while-using-scroll/318382 "2022-11-08T17:08:55Z")
Team Can someone help or suggest the way to pause or disable refresh while I update all the docs within scroll request ?? I do see there is a http curl request that we can do against single or multiple indexes but I am… --- ## [How to plot a line chart pointing to zero instead of smoothing out till end](https://discuss.elastic.co/t/how-to-plot-a-line-chart-pointing-to-zero-instead-of-smoothing-out-till-end/317979)
**Author:** [@Tukaram](https://discuss.elastic.co/u/Tukaram)\ **Replies:** 7\ **Last updated:** [November 8, 2022, 5:03pm UTC](https://discuss.elastic.co/t/how-to-plot-a-line-chart-pointing-to-zero-instead-of-smoothing-out-till-end/317979 "2022-11-08T17:03:06Z")
As per attached graph, I am expecting that line graph should show some round circle if values after 5 on x axis are missing or just drop to zero on x axis. --- ## [How to create API Key for user with \`viewer\` role?](https://discuss.elastic.co/t/how-to-create-api-key-for-user-with-viewer-role/318359)
**Author:** [@learningelastic](https://discuss.elastic.co/u/learningelastic)\ **Replies:** 7\ **Last updated:** [November 8, 2022, 4:57pm UTC](https://discuss.elastic.co/t/how-to-create-api-key-for-user-with-viewer-role/318359 "2022-11-08T16:57:16Z")
I've been able to successfully create api keys for super user accounts. But I don't seem to have the option to create api keys for users that only have the role viewer. So for example, I made this user: But when I … --- ## [Stop auto-placement of visualisations within a dashboard](https://discuss.elastic.co/t/stop-auto-placement-of-visualisations-within-a-dashboard/318442)
**Author:** [@ChrizK](https://discuss.elastic.co/u/ChrizK)\ **Replies:** 2\ **Last updated:** [November 8, 2022, 3:53pm UTC](https://discuss.elastic.co/t/stop-auto-placement-of-visualisations-within-a-dashboard/318442 "2022-11-08T15:53:12Z")
Continuing the discussion from Stop Graphs Auto-Filling Blank Space in Dashboard: Hi, could you provide the steps to creating an empty markdown visualisation? Sorry, I don't understand how this is done. I am editing … --- ## [Elastic agent healthy but no logs sent](https://discuss.elastic.co/t/elastic-agent-healthy-but-no-logs-sent/318447)
**Author:** [@mammodde](https://discuss.elastic.co/u/mammodde)\ **Replies:** 0\ **Last updated:** [November 8, 2022, 3:49pm UTC](https://discuss.elastic.co/t/elastic-agent-healthy-but-no-logs-sent/318447 "2022-11-08T15:49:11Z")
Hi, I am trying to install Elastic Agents, they are labelled as healthy but I do not receive any log. I am pretty sure it has to do with certificates, as always. sorry for the image, but why I cannot choose a differ… --- ## [Sending report (csv or pdf) or rollup indices to third party apps (e.g. kafka)](https://discuss.elastic.co/t/sending-report-csv-or-pdf-or-rollup-indices-to-third-party-apps-e-g-kafka/315931)
**Author:** [@mikhatanu](https://discuss.elastic.co/u/mikhatanu)\ **Replies:** 3\ **Last updated:** [November 8, 2022, 3:30pm UTC](https://discuss.elastic.co/t/sending-report-csv-or-pdf-or-rollup-indices-to-third-party-apps-e-g-kafka/315931 "2022-11-08T15:30:59Z")
Hello, I'm thinking of sending data of kibana reports to third party service. So far, i can generate report automatically (csv) using the API and create rollup jobs but it does not download or sent automatically. Is ther… --- ## [Kibana logs when in developer mode](https://discuss.elastic.co/t/kibana-logs-when-in-developer-mode/316329)
**Author:** [@Sheereen](https://discuss.elastic.co/u/Sheereen)\ **Replies:** 2\ **Last updated:** [November 8, 2022, 3:20pm UTC](https://discuss.elastic.co/t/kibana-logs-when-in-developer-mode/316329 "2022-11-08T15:20:43Z")
Hi, How can I see kibana logs when in developer mode? The log is not getting written to the file I mention in the kibana.yml file I am using Kibana 7.17 in developer mode Thanks --- ## [FATAL Error: Port 5601 is already in use. Another instance of Kibana may be running!](https://discuss.elastic.co/t/fatal-error-port-5601-is-already-in-use-another-instance-of-kibana-may-be-running/318383)
**Author:** [@Shadow\_CHN](https://discuss.elastic.co/u/Shadow_CHN)\ **Replies:** 1\ **Last updated:** [November 8, 2022, 3:13pm UTC](https://discuss.elastic.co/t/fatal-error-port-5601-is-already-in-use-another-instance-of-kibana-may-be-running/318383 "2022-11-08T15:13:28Z")
Hello Team I installed Kibana in docker, while the first set up it showed \[2022-11-07T09:58:18.929+00:00\]\[INFO \]\[node\] Kibana process configured with roles: \[background\_tasks, ui\] \[2022-11-07T09:58:40.484+00:00\]\[INFO \]… --- ## [Elasticsearch 7.17.7 does not start - "java.security.AccessControlException: access denied"](https://discuss.elastic.co/t/elasticsearch-7-17-7-does-not-start-java-security-accesscontrolexception-access-denied/318013)
**Author:** [@jacotec](https://discuss.elastic.co/u/jacotec)\ **Replies:** 5\ **Last updated:** [November 8, 2022, 2:51pm UTC](https://discuss.elastic.co/t/elasticsearch-7-17-7-does-not-start-java-security-accesscontrolexception-access-denied/318013 "2022-11-08T14:51:45Z")
Hi, I'm despairing with Elasticsearch on one of my Ubuntu 20.04 LTS VM's. I've just installed ES 7.17.7 from the official repo, did no config changes or something else, just did apt install elasticsearch systemctl daem… --- ## [Metricbeat - Limit of total fields \[1000\] has been exceeded](https://discuss.elastic.co/t/metricbeat-limit-of-total-fields-1000-has-been-exceeded/317660)
**Author:** [@parthmaniar](https://discuss.elastic.co/u/parthmaniar)\ **Replies:** 1\ **Last updated:** [November 8, 2022, 2:44pm UTC](https://discuss.elastic.co/t/metricbeat-limit-of-total-fields-1000-has-been-exceeded/317660 "2022-11-08T14:44:30Z")
Hello, I hope my question finds you and your loved ones safe and healthy. I am having errors trying to ingest system metrics (system module) from a single Ubuntu system running 22.04.1 using Metricbeat (version 7.17.7 … --- ## [Create an API key in SSL curl](https://discuss.elastic.co/t/create-an-api-key-in-ssl-curl/318424)
**Author:** [@diegz](https://discuss.elastic.co/u/diegz)\ **Replies:** 1\ **Last updated:** [November 8, 2022, 1:55pm UTC](https://discuss.elastic.co/t/create-an-api-key-in-ssl-curl/318424 "2022-11-08T13:55:23Z")
Hello, I can't create an api key with the curl command in SSL. I have tried different command without success. Could you tell me the right command? And if I should authenticate with the node certificate or with the CA… --- ## [Unable to install Fleet Server](https://discuss.elastic.co/t/unable-to-install-fleet-server/318255)
**Author:** [@themetman](https://discuss.elastic.co/u/themetman)\ **Replies:** 3\ **Last updated:** [November 8, 2022, 1:31pm UTC](https://discuss.elastic.co/t/unable-to-install-fleet-server/318255 "2022-11-08T13:31:01Z")
I am new to Elastic Stack, but well over 20 years as a Linux (Gentoo) User. I have set up Elasticsearch, Kibana and Logstash using https on a Virtualbox system with 2 Linux Servers. I now have Elasticsearch and Kibana on… --- ## [Elastic Cloud: exceeds the automatic field expansion limit of \[1024\]](https://discuss.elastic.co/t/elastic-cloud-exceeds-the-automatic-field-expansion-limit-of-1024/318411)
**Author:** [@rcowart](https://discuss.elastic.co/u/rcowart)\ **Replies:** 1\ **Last updated:** [November 8, 2022, 12:33pm UTC](https://discuss.elastic.co/t/elastic-cloud-exceeds-the-automatic-field-expansion-limit-of-1024/318411 "2022-11-08T12:33:25Z")
Is there a new limitation in Elastic Cloud 8.x instances that prevents the use of index.mapping.total\_fields.limit greater than 1024 in an index template? Seeing a deprecation issue “exceeds the automatic field expansion… --- ## [KQL query for fields with a value which is not \`-\`](https://discuss.elastic.co/t/kql-query-for-fields-with-a-value-which-is-not/318098)
**Author:** [@mikewillis](https://discuss.elastic.co/u/mikewillis)\ **Replies:** 7\ **Last updated:** [November 8, 2022, 11:12am UTC](https://discuss.elastic.co/t/kql-query-for-fields-with-a-value-which-is-not/318098 "2022-11-08T11:12:08Z")
Kibana 7.17. I've got some indices where documents contain a field called username . Sometimes the value is a username, like bob or alice and often the value is -. What's a KQL query that will return documents where … --- ## [Logstash 7.17 update OpenJDK to 11.0.17](https://discuss.elastic.co/t/logstash-7-17-update-openjdk-to-11-0-17/317350)
**Author:** [@brilong](https://discuss.elastic.co/u/brilong)\ **Replies:** 2\ **Last updated:** [November 8, 2022, 10:56am UTC](https://discuss.elastic.co/t/logstash-7-17-update-openjdk-to-11-0-17/317350 "2022-11-08T10:56:29Z")
Is Logstash 7.17 still maintained and is there a plan to upgrade the built-in JDK to 11.0.17? This fixes various CVEs for those of us unable to upgrade to logstash 8.4 at this time. https://openjdk.org/groups/vulnerabi… --- ## [Autodiscover with custom pipeline](https://discuss.elastic.co/t/autodiscover-with-custom-pipeline/318377)
**Author:** [@zeitler](https://discuss.elastic.co/u/zeitler)\ **Replies:** 0\ **Last updated:** [November 8, 2022, 2:00am UTC](https://discuss.elastic.co/t/autodiscover-with-custom-pipeline/318377 "2022-11-08T02:00:32Z")
Hi I'm sorry if this has been already asked and explained, but I'm missing it... My goal is to have a custom grok configuration. My configuration: filebeat.autodiscover: providers: - type: kubernetes node… --- ## [Cloudflare Integration problem with delayed ingestion](https://discuss.elastic.co/t/cloudflare-integration-problem-with-delayed-ingestion/317381)
**Author:** [@yago82](https://discuss.elastic.co/u/yago82)\ **Replies:** 3\ **Last updated:** [November 8, 2022, 10:01am UTC](https://discuss.elastic.co/t/cloudflare-integration-problem-with-delayed-ingestion/317381 "2022-11-08T10:01:32Z")
Hi everybody, using Cloduflare integration I noticed that if the machine where the elastic agent is installed falls for a certain period, Elastic is not able to recover the accumulated ingestion delay. I'm talking abou… --- ## [How can fields received by Filebeat http\_endpoint be add to the document root](https://discuss.elastic.co/t/how-can-fields-received-by-filebeat-http-endpoint-be-add-to-the-document-root/317847)
**Author:** [@rcowart](https://discuss.elastic.co/u/rcowart)\ **Replies:** 0\ **Last updated:** [October 31, 2022, 8:25pm UTC](https://discuss.elastic.co/t/how-can-fields-received-by-filebeat-http-endpoint-be-add-to-the-document-root/317847 "2022-10-31T20:25:27Z")
(post deleted by author) --- ## [Hide/Disable runtime fields from Kibana available fields](https://discuss.elastic.co/t/hide-disable-runtime-fields-from-kibana-available-fields/301848)
**Author:** [@Ofir\_Edi](https://discuss.elastic.co/u/Ofir_Edi)\ **Replies:** 11\ **Last updated:** [November 8, 2022, 9:34am UTC](https://discuss.elastic.co/t/hide-disable-runtime-fields-from-kibana-available-fields/301848 "2022-11-08T09:34:09Z")
Hi, Is there a way to hide/disable/pick certain runtime fields from available fields in Discover? When applying many runtime fields, Discover page takes forever to load due to the number of available fields, While Elast… --- ## [8.4.2: "incompatible encodings: CP850 and UTF-8" - Issue sending DB records to Elastic after upgrade to Elastic 8.4.2 from 8.3.2](https://discuss.elastic.co/t/8-4-2-incompatible-encodings-cp850-and-utf-8-issue-sending-db-records-to-elastic-after-upgrade-to-elastic-8-4-2-from-8-3-2/315697)
**Author:** [@stevedearl](https://discuss.elastic.co/u/stevedearl)\ **Replies:** 4\ **Last updated:** [November 8, 2022, 8:59am UTC](https://discuss.elastic.co/t/8-4-2-incompatible-encodings-cp850-and-utf-8-issue-sending-db-records-to-elastic-after-upgrade-to-elastic-8-4-2-from-8-3-2/315697 "2022-11-08T08:59:40Z")
Hi All, I've been running the 8.3.2 Elastic products for some months (ELK), using logstash to poll an MSSQL DB regularly and pull the data into Elasticsearch. This has been working without any significant problems. I … --- ## [What's the correct ILM setup for .monitoring-\*-7 indices?](https://discuss.elastic.co/t/whats-the-correct-ilm-setup-for-monitoring-7-indices/318398)
**Author:** [@alytkowski](https://discuss.elastic.co/u/alytkowski)\ **Replies:** 0\ **Last updated:** [November 8, 2022, 8:38am UTC](https://discuss.elastic.co/t/whats-the-correct-ilm-setup-for-monitoring-7-indices/318398 "2022-11-08T08:38:15Z")
As per title, what's the correct ILM setup for the .monitoring-\*-7 indices? By default, they rollover every day and delete after 7 days. However, I need them to delete much faster, because in my small ELK setup, these in… --- ## [ES cannot search for special characters when using wildcard search](https://discuss.elastic.co/t/es-cannot-search-for-special-characters-when-using-wildcard-search/318332)
**Author:** [@surkovoleg2010](https://discuss.elastic.co/u/surkovoleg2010)\ **Replies:** 3\ **Last updated:** [November 8, 2022, 8:15am UTC](https://discuss.elastic.co/t/es-cannot-search-for-special-characters-when-using-wildcard-search/318332 "2022-11-08T08:15:51Z")
Hello, We are using query\_string for a quick search but looks like does not correctly work. For instance I can find results using: { "query": { "query\_string": { "query": "oleg$qwerty.com", … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=738) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=740)