# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=754 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 755 --- ## [Grab everything upto a specific word](https://discuss.elastic.co/t/grab-everything-upto-a-specific-word/317280)
**Author:** [@Rajeev\_Shrestha](https://discuss.elastic.co/u/Rajeev_Shrestha)\ **Replies:** 5\ **Last updated:** [October 24, 2022, 12:19pm UTC](https://discuss.elastic.co/t/grab-everything-upto-a-specific-word/317280 "2022-10-24T12:19:02Z")
Hi Guys, I am new to GROK and appreciate your help. The goal is to put everything leading up to the word 'user-agent' to a fieldname "details" and everything after "user-agent" to a fieldname "user-agent". The excerpt… --- ## [Add index\_options option to all text fields with dynamic templates](https://discuss.elastic.co/t/add-index-options-option-to-all-text-fields-with-dynamic-templates/317303)
**Author:** [@frank\_esg](https://discuss.elastic.co/u/frank_esg)\ **Replies:** 0\ **Last updated:** [October 24, 2022, 9:21am UTC](https://discuss.elastic.co/t/add-index-options-option-to-all-text-fields-with-dynamic-templates/317303 "2022-10-24T09:21:55Z")
Hello, we´re using component templates to define field mappings based on ECS for all of our indices. In the past we had some issues with search highlighting in Kibana , when text fields are very big. Now i would like t… --- ## [Kibana 8.4.2 new Control does not show options for runtime field](https://discuss.elastic.co/t/kibana-8-4-2-new-control-does-not-show-options-for-runtime-field/315015)
**Author:** [@Jonas\_S](https://discuss.elastic.co/u/Jonas_S)\ **Replies:** 7\ **Last updated:** [October 24, 2022, 8:18am UTC](https://discuss.elastic.co/t/kibana-8-4-2-new-control-does-not-show-options-for-runtime-field/315015 "2022-10-24T08:18:44Z")
Hello, i upgraded to the newest Kibana version to use the new Controls. I have a runtime field in my Data View that gets a value from the indexname: It can be used in all visualizations without problems. I tried to … --- ## [Indexes created automatically by the system](https://discuss.elastic.co/t/indexes-created-automatically-by-the-system/317125)
**Author:** [@dpelaezb](https://discuss.elastic.co/u/dpelaezb)\ **Replies:** 4\ **Last updated:** [October 24, 2022, 7:47am UTC](https://discuss.elastic.co/t/indexes-created-automatically-by-the-system/317125 "2022-10-24T07:47:40Z")
Hello everyone, We have an infrastructure that consists of several Filebeats that send the traces to a Logstash located on another machine where there is also a Metricbeat to plot Logstash. We have detected that a seri… --- ## [Impact of CVE-2022-42889 on Elastic stack](https://discuss.elastic.co/t/impact-of-cve-2022-42889-on-elastic-stack/316858)
**Author:** [@jgimenez](https://discuss.elastic.co/u/jgimenez)\ **Replies:** 4\ **Last updated:** [October 24, 2022, 7:28am UTC](https://discuss.elastic.co/t/impact-of-cve-2022-42889-on-elastic-stack/316858 "2022-10-24T07:28:56Z")
Hi there, is the Elastic software affected by CVE-2022-42889, and if so, what are the actions recommended? Thanks. --- ## [Kibana JSON inpus](https://discuss.elastic.co/t/kibana-json-inpus/317276)
**Author:** [@ChristianOelsner](https://discuss.elastic.co/u/ChristianOelsner)\ **Replies:** 5\ **Last updated:** [October 24, 2022, 7:05am UTC](https://discuss.elastic.co/t/kibana-json-inpus/317276 "2022-10-24T07:05:43Z")
Hello forum, I am trying to present some metrics in byte or even better gigabytes in a Data table visualization. I am unable to edit the index-pattern, but i can see that it is mapped as a long. I am trying to have th… --- ## [.ds-logstash shards remain](https://discuss.elastic.co/t/ds-logstash-shards-remain/316734)
**Author:** [@waleedkh](https://discuss.elastic.co/u/waleedkh)\ **Replies:** 3\ **Last updated:** [October 24, 2022, 6:56am UTC](https://discuss.elastic.co/t/ds-logstash-shards-remain/316734 "2022-10-24T06:56:11Z")
I have an issue in that I have 2200 of these .ds-logstash-DATE indices that are not being cleaned out as part of the ILM policy. They are from a data stream. Below is the linked ILM policy PUT \_ilm/policy/logstash-lif… --- ## [How to push json into elasticsearch](https://discuss.elastic.co/t/how-to-push-json-into-elasticsearch/317275)
**Author:** [@ZahraZare](https://discuss.elastic.co/u/ZahraZare)\ **Replies:** 11\ **Last updated:** [October 24, 2022, 5:41am UTC](https://discuss.elastic.co/t/how-to-push-json-into-elasticsearch/317275 "2022-10-24T05:41:12Z")
I want to push the following Json data using Python in elasticsearch, I used the following code but there is no data in the index. json data : \[ "break", false, -1314177328.9280925, \[ -107585784.0005331, 11732320… --- ## [I can't get Elastic and Kibana to work with real certificates](https://discuss.elastic.co/t/i-cant-get-elastic-and-kibana-to-work-with-real-certificates/317282)
**Author:** [@abkrim](https://discuss.elastic.co/u/abkrim)\ **Replies:** 5\ **Last updated:** [October 24, 2022, 5:23am UTC](https://discuss.elastic.co/t/i-cant-get-elastic-and-kibana-to-work-with-real-certificates/317282 "2022-10-24T05:23:35Z")
I can't get Elastic and Kibana to work with real certificates from either Let's encrypt or Comodo. I've thought about it a thousand times, but no matter how much I read and reread, I can't find the error of something as… --- ## [Can I know the basic specifications for master, ingest, coordinate node?](https://discuss.elastic.co/t/can-i-know-the-basic-specifications-for-master-ingest-coordinate-node/317289)
**Author:** [@dms6978](https://discuss.elastic.co/u/dms6978)\ **Replies:** 2\ **Last updated:** [October 24, 2022, 2:00am UTC](https://discuss.elastic.co/t/can-i-know-the-basic-specifications-for-master-ingest-coordinate-node/317289 "2022-10-24T02:00:36Z")
Can I know the basic specifications for master, ingest, coordinate node? CPU, memory, heapsize..... --- ## [Can't Automatically Start Elasticsearch Service After Upgrade to 8.4.3](https://discuss.elastic.co/t/cant-automatically-start-elasticsearch-service-after-upgrade-to-8-4-3/317262)
**Author:** [@krmathieu](https://discuss.elastic.co/u/krmathieu)\ **Replies:** 1\ **Last updated:** [October 24, 2022, 1:25am UTC](https://discuss.elastic.co/t/cant-automatically-start-elasticsearch-service-after-upgrade-to-8-4-3/317262 "2022-10-24T01:25:40Z")
I can't get the Elasticsearch service to start using the Windows service on a Windows 10 machine after upgrading to 8.4.3.. I successfully used elasticsearch-service.bat to install the service and see it listed as an ava… --- ## [REGION MAP VISUALIZATION DOES NOT LOADING INITIALLY](https://discuss.elastic.co/t/region-map-visualization-does-not-loading-initially/316787)
**Author:** [@Sinchana\_P](https://discuss.elastic.co/u/Sinchana_P)\ **Replies:** 2\ **Last updated:** [October 24, 2022, 1:21am UTC](https://discuss.elastic.co/t/region-map-visualization-does-not-loading-initially/316787 "2022-10-24T01:21:12Z")
The region map does not load fully in the initial view. Initially, the region map dashboard is shown grey without loading any data in it as shown in the image below: Once page is reloaded or refresh button is clicked… --- ## [Can hacker use search api endpoint to update document or delete index?](https://discuss.elastic.co/t/can-hacker-use-search-api-endpoint-to-update-document-or-delete-index/317027)
**Author:** [@jbond](https://discuss.elastic.co/u/jbond)\ **Replies:** 6\ **Last updated:** [October 23, 2022, 11:52pm UTC](https://discuss.elastic.co/t/can-hacker-use-search-api-endpoint-to-update-document-or-delete-index/317027 "2022-10-23T23:52:58Z")
My company use free version of Elasticsearch software so no security on it. Our Elasticsearch server is running on internal network and internet user cannot access to it. We have a public app need to call Elasticsearch A… --- ## [WINLOGBEAT-NIFI-LISTENBEATS1.18.0 don't work correctly](https://discuss.elastic.co/t/winlogbeat-nifi-listenbeats1-18-0-dont-work-correctly/317110)
**Author:** [@IamYipi](https://discuss.elastic.co/u/IamYipi)\ **Replies:** 2\ **Last updated:** [October 23, 2022, 11:32pm UTC](https://discuss.elastic.co/t/winlogbeat-nifi-listenbeats1-18-0-dont-work-correctly/317110 "2022-10-23T23:32:44Z")
Hi All, I ship windows events using ListenBeats in NiFi, when the data arrived is duplicated in 2 FlowFiles. I show winlogbeat's config: winlogbeat.event\_logs: name: Microsoft-Windows-Windows Defender/Operational -… --- ## [Delete Duplicate id documents in Search Result](https://discuss.elastic.co/t/delete-duplicate-id-documents-in-search-result/317190)
**Author:** [@manupoti](https://discuss.elastic.co/u/manupoti)\ **Replies:** 1\ **Last updated:** [October 23, 2022, 11:14pm UTC](https://discuss.elastic.co/t/delete-duplicate-id-documents-in-search-result/317190 "2022-10-23T23:14:11Z")
1.Created two indexes and with same alias name 2.Inseart document with \_id in "doc1" index with alias 3.Insert same document with same \_id in "doc2" with alias 4.Search with \_id and Search result should return only on… --- ## [Can't setup Elasticsearch cluster monitoring with Metricbeat](https://discuss.elastic.co/t/cant-setup-elasticsearch-cluster-monitoring-with-metricbeat/317159)
**Author:** [@Ensjo](https://discuss.elastic.co/u/Ensjo)\ **Replies:** 0\ **Last updated:** [October 21, 2022, 1:36am UTC](https://discuss.elastic.co/t/cant-setup-elasticsearch-cluster-monitoring-with-metricbeat/317159 "2022-10-21T01:36:44Z")
Hello. I have a cluster with 3 Elasticsearch master servers (7.17.6) on Windows 10. Here is my elasticsearch.yml for the first server (commented lines deleted, names and IPs edited): cluster.name: MyCluster node.name: M… --- ## [Pattern: grok/mutate dont work?](https://discuss.elastic.co/t/pattern-grok-mutate-dont-work/317212)
**Author:** [@kurdit](https://discuss.elastic.co/u/kurdit)\ **Replies:** 9\ **Last updated:** [October 23, 2022, 10:59pm UTC](https://discuss.elastic.co/t/pattern-grok-mutate-dont-work/317212 "2022-10-23T22:59:40Z")
hi all! i ran into a problem. i have a pipeline: input { tcp { host =\> "10.10.10.10" port =\> "5959" codec =\> "json" type =\> "my\_type" mode =\> "server" } } filter { if \[… --- ## [Throw error when doc id already exists in index with NEST](https://discuss.elastic.co/t/throw-error-when-doc-id-already-exists-in-index-with-nest/317283)
**Author:** [@johanwallenborg](https://discuss.elastic.co/u/johanwallenborg)\ **Replies:** 2\ **Last updated:** [October 23, 2022, 7:29pm UTC](https://discuss.elastic.co/t/throw-error-when-doc-id-already-exists-in-index-with-nest/317283 "2022-10-23T19:29:37Z")
Hello, I'm using BulkAll-method when indexing documents. Everything works fine but I wonder if there's a way too report back if an document with same document id already exists in index. Is there any? --- ## [Data replication across data centers](https://discuss.elastic.co/t/data-replication-across-data-centers/316740)
**Author:** [@harijld](https://discuss.elastic.co/u/harijld)\ **Replies:** 2\ **Last updated:** [October 23, 2022, 6:14pm UTC](https://discuss.elastic.co/t/data-replication-across-data-centers/316740 "2022-10-23T18:14:21Z")
Dear Team, Regarding data replication between data centers, I have a quick question. To replicate the data between data centers, we have several options. cross cluster replication taking snapshot from prod and moving… --- ## [Filebeat service doesn't send apache logs](https://discuss.elastic.co/t/filebeat-service-doesnt-send-apache-logs/317277)
**Author:** [@sevbans](https://discuss.elastic.co/u/sevbans)\ **Replies:** 1\ **Last updated:** [October 23, 2022, 4:19pm UTC](https://discuss.elastic.co/t/filebeat-service-doesnt-send-apache-logs/317277 "2022-10-23T16:19:49Z")
This is my current configuration file. filebeat.inputs: - type: log enabled: true paths: - /var/log/apache2/\*.log output.logstash: hosts: \["localhost:5044"\] enabled: true setup.dashboards.enabled: true set… --- ## [Replace empty field with a meaning word](https://discuss.elastic.co/t/replace-empty-field-with-a-meaning-word/317266)
**Author:** [@Roger\_Huang](https://discuss.elastic.co/u/Roger_Huang)\ **Replies:** 3\ **Last updated:** [October 23, 2022, 4:23pm UTC](https://discuss.elastic.co/t/replace-empty-field-with-a-meaning-word/317266 "2022-10-23T16:23:53Z")
Hi everyone, I am trying to replace empty fields instead of %{} So i used this code: if ! \[xxevent.fw\_app\_id\] { mutate { update =\> { "xxevent.fw\_app\_id" =\> "EMPTY" } } } … --- ## [ERROR: Failed to determine the health of the cluster when initial password setting](https://discuss.elastic.co/t/error-failed-to-determine-the-health-of-the-cluster-when-initial-password-setting/317252)
**Author:** [@tmdgk490255](https://discuss.elastic.co/u/tmdgk490255)\ **Replies:** 5\ **Last updated:** [October 23, 2022, 3:31pm UTC](https://discuss.elastic.co/t/error-failed-to-determine-the-health-of-the-cluster-when-initial-password-setting/317252 "2022-10-23T15:31:45Z")
I tried to set up initial password with following command and got this error message $ ./elasticsearch-reset-password -u elasticsearch ERROR: Failed to determine the health of the cluster. Here is my elasticsearch.ym… --- ## [Search.max\_async\_search\_response\_size](https://discuss.elastic.co/t/search-max-async-search-response-size/317202)
**Author:** [@Roger\_Huang](https://discuss.elastic.co/u/Roger_Huang)\ **Replies:** 7\ **Last updated:** [October 23, 2022, 5:17am UTC](https://discuss.elastic.co/t/search-max-async-search-response-size/317202 "2022-10-23T05:17:45Z")
Hi all, I am new to Elasticsearch stack. Any suggestions or help is greatly appreciated please. I encountered this error after doing a http\_poller in Logstash. {"@timestamp":"2022-10-21T13:17:56.029Z", "log.level":"ERR… --- ## [Multiple kibana indices in recovered snapshot](https://discuss.elastic.co/t/multiple-kibana-indices-in-recovered-snapshot/317025)
**Author:** [@not\_correct](https://discuss.elastic.co/u/not_correct)\ **Replies:** 6\ **Last updated:** [October 22, 2022, 5:24pm UTC](https://discuss.elastic.co/t/multiple-kibana-indices-in-recovered-snapshot/317025 "2022-10-22T17:24:07Z")
Hi team, I have recovered a snapshot with multiple kibana indices, please see kibana dedicated indices in the snapshot summary, using GET \_snapshot/rep\_2/monthly-snapshot-2022.09.01?pretty { "feature\_name" :… --- ## [Module system syslog logs of Filebeat and auditbeat](https://discuss.elastic.co/t/module-system-syslog-logs-of-filebeat-and-auditbeat/317250)
**Author:** [@morad\_della3](https://discuss.elastic.co/u/morad_della3)\ **Replies:** 1\ **Last updated:** [October 22, 2022, 4:29pm UTC](https://discuss.elastic.co/t/module-system-syslog-logs-of-filebeat-and-auditbeat/317250 "2022-10-22T16:29:56Z")
Difference btween module system syslog logs of Filebeat and auditbeat the two collect the linux logs ? --- ## [Windows could not start the elastic winglogbeat-Oss 8.3.3 service](https://discuss.elastic.co/t/windows-could-not-start-the-elastic-winglogbeat-oss-8-3-3-service/316455)
**Author:** [@iqworks](https://discuss.elastic.co/u/iqworks)\ **Replies:** 6\ **Last updated:** [October 22, 2022, 3:40pm UTC](https://discuss.elastic.co/t/windows-could-not-start-the-elastic-winglogbeat-oss-8-3-3-service/316455 "2022-10-22T15:40:06Z")
Hi, I installed winlogbeat. I tried to start the service and I got this? --- ## [Finding a geo point inside a geoshape rectangle](https://discuss.elastic.co/t/finding-a-geo-point-inside-a-geoshape-rectangle/317160)
**Author:** [@antonpious](https://discuss.elastic.co/u/antonpious)\ **Replies:** 12\ **Last updated:** [October 22, 2022, 2:40pm UTC](https://discuss.elastic.co/t/finding-a-geo-point-inside-a-geoshape-rectangle/317160 "2022-10-22T14:40:39Z")
All the documentation seems to point to either having geo points and then having a bounding box to select these geo points. Is the reverse feature possible in Elastic Search? The only closest I could find in this form … --- ## [Proposed way to use Elasticsearch Java API Client to generate requests](https://discuss.elastic.co/t/proposed-way-to-use-elasticsearch-java-api-client-to-generate-requests/317239)
**Author:** [@Michael\_Gattinger](https://discuss.elastic.co/u/Michael_Gattinger)\ **Replies:** 0\ **Last updated:** [October 22, 2022, 5:37am UTC](https://discuss.elastic.co/t/proposed-way-to-use-elasticsearch-java-api-client-to-generate-requests/317239 "2022-10-22T05:37:00Z")
Hello, as i found for my self there are a bunch of ways how to use Elasticsearch Java API Client to generate requests. write JSON (in file or programm code) and push it over the low level Rest Client instead of the ES… --- ## [Creation/error of a x.509 certificate](https://discuss.elastic.co/t/creation-error-of-a-x-509-certificate/317201)
**Author:** [@EExisT](https://discuss.elastic.co/u/EExisT)\ **Replies:** 11\ **Last updated:** [October 22, 2022, 1:35pm UTC](https://discuss.elastic.co/t/creation-error-of-a-x-509-certificate/317201 "2022-10-22T13:35:43Z")
Hello, I'm trying to produce x.509 crt and key for 4 instances that I have saved in a .yml file(Elastic, Kibana, Winlogbeat and Metricbeat) I was trying to ro run the command /usr/share/elasticsearch/bin/elasticsearch-… --- ## [Cannot get Auditbeat add\_docker\_metadata to work](https://discuss.elastic.co/t/cannot-get-auditbeat-add-docker-metadata-to-work/317243)
**Author:** [@m-a-x-e-d](https://discuss.elastic.co/u/m-a-x-e-d)\ **Replies:** 0\ **Last updated:** [October 22, 2022, 9:37am UTC](https://discuss.elastic.co/t/cannot-get-auditbeat-add-docker-metadata-to-work/317243 "2022-10-22T09:37:29Z")
Hello there! I am running an ELK Stack 7.17.6 in Docker on Linux and am trying to collect audit data with auditbeat. Everything works fine, but for some reason, no docker metadata is added to events, even if the process… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=753) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=755)