# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=760 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 761 --- ## [Palo alto sent to server via syslog](https://discuss.elastic.co/t/palo-alto-sent-to-server-via-syslog/316870)
**Author:** [@GEHsu](https://discuss.elastic.co/u/GEHsu)\ **Replies:** 0\ **Last updated:** [October 18, 2022, 9:40am UTC](https://discuss.elastic.co/t/palo-alto-sent-to-server-via-syslog/316870 "2022-10-18T09:40:34Z")
I tried paloalto (TRAFFIC/THREAT) 2 kinds of logs. Build to a different index. Below is my Logstash config input { syslog { port =\> "4560" } } filter { # Traffic Logs grok { match =\> { "message" =\> "%{… --- ## [Error 400 when using API to create index pattern](https://discuss.elastic.co/t/error-400-when-using-api-to-create-index-pattern/316791)
**Author:** [@JorisV](https://discuss.elastic.co/u/JorisV)\ **Replies:** 1\ **Last updated:** [October 18, 2022, 9:34am UTC](https://discuss.elastic.co/t/error-400-when-using-api-to-create-index-pattern/316791 "2022-10-18T09:34:52Z")
Hi, i'm trying to use Kibana API to create an index pattern with a specific ID. Here's my code var req0 = new XMLHttpRequest(); var req1 = new XMLHttpRequest(); req0.open("DELETE","https://my.server/kb/api/index\_patter… --- ## [Filebeat and logstash ssl config is correct?](https://discuss.elastic.co/t/filebeat-and-logstash-ssl-config-is-correct/316868)
**Author:** [@Nikolas1306](https://discuss.elastic.co/u/Nikolas1306)\ **Replies:** 1\ **Last updated:** [October 18, 2022, 9:31am UTC](https://discuss.elastic.co/t/filebeat-and-logstash-ssl-config-is-correct/316868 "2022-10-18T09:31:23Z")
filebeat filebeat.inputs: - type: filestream paths: - G:\\filebeat-8.4.3-windows-x86\_64\\logs\\\*.\* output.logstash: hosts: \["172.22.10.202:5044"\] protocol: "http" ssl.enabled: true ssl.certificate\_a… --- ## [Unhide System Indices](https://discuss.elastic.co/t/unhide-system-indices/316736)
**Author:** [@Ankita\_Pachauri](https://discuss.elastic.co/u/Ankita_Pachauri)\ **Replies:** 7\ **Last updated:** [October 18, 2022, 8:04am UTC](https://discuss.elastic.co/t/unhide-system-indices/316736 "2022-10-18T08:04:32Z")
Hi Team, I am using searchguard for alerting purpose. The indices of searchguard are stored in elasticsearch with .signals naming convention. I need to get the alert ID for the alerts. However, i cannot write a search q… --- ## [Domain redirection is not happening for workplace search endpoint](https://discuss.elastic.co/t/domain-redirection-is-not-happening-for-workplace-search-endpoint/316852)
**Author:** [@Elastic\_User3](https://discuss.elastic.co/u/Elastic_User3)\ **Replies:** 0\ **Last updated:** [October 18, 2022, 7:51am UTC](https://discuss.elastic.co/t/domain-redirection-is-not-happening-for-workplace-search-endpoint/316852 "2022-10-18T07:51:37Z")
we tried to change the domain and redirect to searchcapillary.com but its not happening. https://searchabc.in we are trying to point below mentioned endpoint to above mentioned end point, but once we done with that. we… --- ## [Add a new field to the .ml-anomalies-shared index](https://discuss.elastic.co/t/add-a-new-field-to-the-ml-anomalies-shared-index/316847)
**Author:** [@irivas95](https://discuss.elastic.co/u/irivas95)\ **Replies:** 0\ **Last updated:** [October 18, 2022, 6:58am UTC](https://discuss.elastic.co/t/add-a-new-field-to-the-ml-anomalies-shared-index/316847 "2022-10-18T06:58:26Z")
Hi, I need to add a new field, "anomaly level" to the .ml-anomalies-shared index to new data and already indexed data. The field would have a different value based on the value of the record score field, for example: i… --- ## [Elastic-agent disappeared](https://discuss.elastic.co/t/elastic-agent-disappeared/316846)
**Author:** [@gx\_zhao](https://discuss.elastic.co/u/gx_zhao)\ **Replies:** 0\ **Last updated:** [October 18, 2022, 6:43am UTC](https://discuss.elastic.co/t/elastic-agent-disappeared/316846 "2022-10-18T06:43:59Z")
I'm using elk 8.4.3, and deploy by eck 2.4.0. My fleet server and agents always disappeared about 10 days after enrollment. I suspect it is because I changed some Index Lifecycle Policy, like 'logs' or 'metrics', by adde… --- ## [Time Zone issue with Range Query](https://discuss.elastic.co/t/time-zone-issue-with-range-query/316764)
**Author:** [@vipin.meshram13098](https://discuss.elastic.co/u/vipin.meshram13098)\ **Replies:** 0\ **Last updated:** [October 17, 2022, 10:53am UTC](https://discuss.elastic.co/t/time-zone-issue-with-range-query/316764 "2022-10-17T10:53:12Z")
Hello, I am facing one strange issue with range query "time\_zone" parameter. I have the Elasticsearch documents stored in the server of America/Chicago timezone. Basically, I am trying to fetch records from "12:00 AM … --- ## [Create indexes from previous nginx access logs](https://discuss.elastic.co/t/create-indexes-from-previous-nginx-access-logs/316818)
**Author:** [@kosmylo](https://discuss.elastic.co/u/kosmylo)\ **Replies:** 3\ **Last updated:** [October 18, 2022, 5:21am UTC](https://discuss.elastic.co/t/create-indexes-from-previous-nginx-access-logs/316818 "2022-10-18T05:21:59Z")
I use filebeat to send nginx access logs to logstash to parse them and then to elasticsearch. The folder includes access logs my previous days, but when I deploy the ELK stack, only the newly arrived nginx access logs ar… --- ## [When starting up a ELK Cluster, one Node fails with Java lang out of memory error](https://discuss.elastic.co/t/when-starting-up-a-elk-cluster-one-node-fails-with-java-lang-out-of-memory-error/316693)
**Author:** [@AKAM14](https://discuss.elastic.co/u/AKAM14)\ **Replies:** 8\ **Last updated:** [October 18, 2022, 2:46am UTC](https://discuss.elastic.co/t/when-starting-up-a-elk-cluster-one-node-fails-with-java-lang-out-of-memory-error/316693 "2022-10-18T02:46:34Z")
I have a 3 node ELK Cluster - with two logstash and 1 kibana server . When i start my Elk cluster it is giving an error in two nodes and fails. it is all realted to Jvm memory error. I have attached the error screenshot. … --- ## [WebNMS security vulnerability](https://discuss.elastic.co/t/webnms-security-vulnerability/316766)
**Author:** [@aligege123](https://discuss.elastic.co/u/aligege123)\ **Replies:** 3\ **Last updated:** [October 18, 2022, 1:19am UTC](https://discuss.elastic.co/t/webnms-security-vulnerability/316766 "2022-10-18T01:19:18Z")
Is elasticsearch related with ZOHO webNMS ? I recently meet a vulnerability report from es http server port 9200 about webNMS. The vulnerability detail: CVE - CVE-2016-6600 (mitre.org) My elasticsearch version is 7.6.1.… --- ## [Combine value for a common field from search results and remove one of the result](https://discuss.elastic.co/t/combine-value-for-a-common-field-from-search-results-and-remove-one-of-the-result/316831)
**Author:** [@Calvin\_Feng](https://discuss.elastic.co/u/Calvin_Feng)\ **Replies:** 2\ **Last updated:** [October 18, 2022, 12:46am UTC](https://discuss.elastic.co/t/combine-value-for-a-common-field-from-search-results-and-remove-one-of-the-result/316831 "2022-10-18T00:46:49Z")
Hi dear, We have a some documents saved in Elasticsearch with a common value, like group\_id. When we do the search, we'd like to combine the value of specific field if the documents are having the same group\_id. Then we… --- ## [Eland - exactly which of the pandas are supported?](https://discuss.elastic.co/t/eland-exactly-which-of-the-pandas-are-supported/316829)
**Author:** [@sachinsdesai](https://discuss.elastic.co/u/sachinsdesai)\ **Replies:** 0\ **Last updated:** [October 17, 2022, 10:10pm UTC](https://discuss.elastic.co/t/eland-exactly-which-of-the-pandas-are-supported/316829 "2022-10-17T22:10:38Z")
I am looking at Supported Pandas APIs — eland 8.3.0 documentation and several of the APIs are not supported. An an example, sort\_values is not supported, but the documentation says it is. Where can I get info about exact… --- ## [Docker Image not uploading to ecr from jenkins](https://discuss.elastic.co/t/docker-image-not-uploading-to-ecr-from-jenkins/316616)
**Author:** [@veera\_ravala](https://discuss.elastic.co/u/veera_ravala)\ **Replies:** 1\ **Last updated:** [October 17, 2022, 11:54pm UTC](https://discuss.elastic.co/t/docker-image-not-uploading-to-ecr-from-jenkins/316616 "2022-10-17T23:54:40Z")
=I created a CI/CD pipline which builds a docker image and pushes to docker image to amazon ecr. The docker image build perfectly but does not upload to ecr After building the image it keeps retrying to upload the imag… --- ## [Elasticsearch cross cluster data migration approach](https://discuss.elastic.co/t/elasticsearch-cross-cluster-data-migration-approach/316692)
**Author:** [@Sarthak\_Agarwal](https://discuss.elastic.co/u/Sarthak_Agarwal)\ **Replies:** 1\ **Last updated:** [October 17, 2022, 11:50pm UTC](https://discuss.elastic.co/t/elasticsearch-cross-cluster-data-migration-approach/316692 "2022-10-17T23:50:19Z")
Hi, We have an existing cluster running ES 5.6.7 version. We want to create a new cluster running ES 7.17.5 version and migrate all data to this cluster. We have close to 300 Million documents present on the existing c… --- ## [LDAP Group members can't login in elasticsearch](https://discuss.elastic.co/t/ldap-group-members-cant-login-in-elasticsearch/316446)
**Author:** [@Tarah](https://discuss.elastic.co/u/Tarah)\ **Replies:** 7\ **Last updated:** [October 17, 2022, 11:39pm UTC](https://discuss.elastic.co/t/ldap-group-members-cant-login-in-elasticsearch/316446 "2022-10-17T23:39:41Z")
Hi Elastic Team, I think I'm missing something here. E456 uid can't login to elasticsearch even if it is a member of ou=people,ou=ec,o=world. But when using E123 uid, it is successful. E456 and E123 belongs to the same … --- ## [EQL with time filter](https://discuss.elastic.co/t/eql-with-time-filter/316781)
**Author:** [@kmz161](https://discuss.elastic.co/u/kmz161)\ **Replies:** 0\ **Last updated:** [October 17, 2022, 12:24pm UTC](https://discuss.elastic.co/t/eql-with-time-filter/316781 "2022-10-17T12:24:31Z")
Hello! I use rule for checking Sysmon logs '''any where event.code == 1 and process.executable: "C:\\Windows\\System32\\sc.exe" ''' The rule is working, but it checks all existing indexes. And my ELK is very loaded. How… --- ## [Replace the last search result in the log](https://discuss.elastic.co/t/replace-the-last-search-result-in-the-log/316801)
**Author:** [@lmo](https://discuss.elastic.co/u/lmo)\ **Replies:** 0\ **Last updated:** [October 17, 2022, 2:34pm UTC](https://discuss.elastic.co/t/replace-the-last-search-result-in-the-log/316801 "2022-10-17T14:34:00Z")
I am currently monitoring the database(Jdbc). This bank refers to product sales, where at first the status of the sale receives "WAITING FOR PAYMENT" and after payment it receives the status of "PAID". however, when th… --- ## [Elastic Agent / Endpoint no longer can connect to fleet server](https://discuss.elastic.co/t/elastic-agent-endpoint-no-longer-can-connect-to-fleet-server/316702)
**Author:** [@Ting\_sf](https://discuss.elastic.co/u/Ting_sf)\ **Replies:** 1\ **Last updated:** [October 17, 2022, 8:07pm UTC](https://discuss.elastic.co/t/elastic-agent-endpoint-no-longer-can-connect-to-fleet-server/316702 "2022-10-17T20:07:44Z")
I had elastic agent / end point installed on about 10 computers, they were working for pass months, I just noted today that all pcs are showing offline status, and I check logs, all show following error: \[elastic\_agent\]… --- ## [Disk Usage - Something isnt adding up](https://discuss.elastic.co/t/disk-usage-something-isnt-adding-up/316822)
**Author:** [@Kurtis\_Schlienger](https://discuss.elastic.co/u/Kurtis_Schlienger)\ **Replies:** 1\ **Last updated:** [October 17, 2022, 7:17pm UTC](https://discuss.elastic.co/t/disk-usage-something-isnt-adding-up/316822 "2022-10-17T19:17:43Z")
I recently was looking into the shard distribution in my Elasticsearch cluster, and I noticed a heavy weighting on half of my cluster (some nodes have barely any shards on them). When looking into the distribution what I… --- ## [Getting Configuration Error (No configuration found in the configured sources) : Logstash in Windows 11 Systems](https://discuss.elastic.co/t/getting-configuration-error-no-configuration-found-in-the-configured-sources-logstash-in-windows-11-systems/316784)
**Author:** [@SP003](https://discuss.elastic.co/u/SP003)\ **Replies:** 6\ **Last updated:** [October 17, 2022, 7:14pm UTC](https://discuss.elastic.co/t/getting-configuration-error-no-configuration-found-in-the-configured-sources-logstash-in-windows-11-systems/316784 "2022-10-17T19:14:07Z")
Hello, Greetings ! I am running Logstash from my system (windows 11) I have configured Elasticsearch and Kibana and its running fine. But Getting below error, while configuring log stash. Could you please tell me w… --- ## [Data node left cluster. /media/Data/elasticsearch missing](https://discuss.elastic.co/t/data-node-left-cluster-media-data-elasticsearch-missing/316800)
**Author:** [@mhoward](https://discuss.elastic.co/u/mhoward)\ **Replies:** 2\ **Last updated:** [October 17, 2022, 7:01pm UTC](https://discuss.elastic.co/t/data-node-left-cluster-media-data-elasticsearch-missing/316800 "2022-10-17T19:01:41Z")
Hello. Yesterday one of our data nodes left our cluster and we've been unable to get it to rejoin. I'm still able to SSH into the physical server and noticed an error in the elasticsearch logs that led me to discover t… --- ## [RestHighLevelClient 7.17 not able to parse extended\_stats response](https://discuss.elastic.co/t/resthighlevelclient-7-17-not-able-to-parse-extended-stats-response/316368)
**Author:** [@swamy\_sandeep\_kommur](https://discuss.elastic.co/u/swamy_sandeep_kommur)\ **Replies:** 3\ **Last updated:** [October 17, 2022, 6:59pm UTC](https://discuss.elastic.co/t/resthighlevelclient-7-17-not-able-to-parse-extended-stats-response/316368 "2022-10-17T18:59:56Z")
Below is the query I am trying to make on Elasticsearch 8.3, using RestHighLevelClient 7.17 Query --------- { "size": 0, "timeout": "600000ms", "query": { "bool": { "filter": \[ { "range… --- ## [Filebeat's logs doesn't create](https://discuss.elastic.co/t/filebeats-logs-doesnt-create/316710)
**Author:** [@sevbans](https://discuss.elastic.co/u/sevbans)\ **Replies:** 10\ **Last updated:** [October 17, 2022, 6:40pm UTC](https://discuss.elastic.co/t/filebeats-logs-doesnt-create/316710 "2022-10-17T18:40:02Z")
This is my current configuration file. filebeat.inputs: - type: log enabled: true paths: - /var/log/\*.log output.elasticsearch: hosts: \["localhost:9200"\] username: "elastic" password: "1" enabled: false… --- ## [ERROR checkpoint/checkpoint.go:200](https://discuss.elastic.co/t/error-checkpoint-checkpoint-go-200/316644)
**Author:** [@lsbitri88](https://discuss.elastic.co/u/lsbitri88)\ **Replies:** 4\ **Last updated:** [October 17, 2022, 5:45pm UTC](https://discuss.elastic.co/t/error-checkpoint-checkpoint-go-200/316644 "2022-10-17T17:45:40Z")
Hi all, trying to find out what is the root cause of this error : // ERROR checkpoint/checkpoint.go:200 rename X:\\Directory\\winlogbeat\\data.winlogbeat.yml.new X:\\Directory\\winlogbeat\\data.winlogbeat.yml: Access is den… --- ## [Filebeat unable to ship logs to Logstash](https://discuss.elastic.co/t/filebeat-unable-to-ship-logs-to-logstash/316802)
**Author:** [@charlot\_Attard](https://discuss.elastic.co/u/charlot_Attard)\ **Replies:** 1\ **Last updated:** [October 17, 2022, 3:05pm UTC](https://discuss.elastic.co/t/filebeat-unable-to-ship-logs-to-logstash/316802 "2022-10-17T15:05:52Z")
Dear all, I am encountering a strange issue. I am configuring filebeat on a windows server forwarding logs to logstash on a linux server. Network access is reachable. When configuring filebeat agents to connect to logst… --- ## [Dynamic mapping](https://discuss.elastic.co/t/dynamic-mapping/316475)
**Author:** [@cool999](https://discuss.elastic.co/u/cool999)\ **Replies:** 8\ **Last updated:** [October 17, 2022, 2:48pm UTC](https://discuss.elastic.co/t/dynamic-mapping/316475 "2022-10-17T14:48:04Z")
Hi Team, I am trying to understand if we can partially customize elasticsearch's dynamic mapping i.e for some of the fields we will set the data type explicitely and all the remaining fields (which are not mentioned exp… --- ## [How to edit role descriptor for a service account](https://discuss.elastic.co/t/how-to-edit-role-descriptor-for-a-service-account/316379)
**Author:** [@CarlosD](https://discuss.elastic.co/u/CarlosD)\ **Replies:** 4\ **Last updated:** [October 17, 2022, 2:20pm UTC](https://discuss.elastic.co/t/how-to-edit-role-descriptor-for-a-service-account/316379 "2022-10-17T14:20:38Z")
I would like to edit the default role descriptor for service account elastic/kibana, however, I do not find a way to achieve this. Alternatively, I created a role with the privileges I want to have on service account el… --- ## [Update\_by\_query fails to update all documents in ElasticSearch, getting true in between](https://discuss.elastic.co/t/update-by-query-fails-to-update-all-documents-in-elasticsearch-getting-true-in-between/316744)
**Author:** [@PriyaSmartShore](https://discuss.elastic.co/u/PriyaSmartShore)\ **Replies:** 1\ **Last updated:** [October 17, 2022, 1:55pm UTC](https://discuss.elastic.co/t/update-by-query-fails-to-update-all-documents-in-elasticsearch-getting-true-in-between/316744 "2022-10-17T13:55:27Z")
I have over 25 million documents in Elasticsearch (version - 7.6.2), those are having duplicates among them. So I have written a script in painless to delete one instance of duplicated document. I have tried running the … --- ## [Unbalanced distribution of index (shards) between HOT servers ES](https://discuss.elastic.co/t/unbalanced-distribution-of-index-shards-between-hot-servers-es/315603)
**Author:** [@Aleksei](https://discuss.elastic.co/u/Aleksei)\ **Replies:** 6\ **Last updated:** [October 17, 2022, 1:44pm UTC](https://discuss.elastic.co/t/unbalanced-distribution-of-index-shards-between-hot-servers-es/315603 "2022-10-17T13:44:03Z")
Hi community ! I apologize if this topic has been covered for a long time. But I never found it in the open Elastic Сommunity. :face\_with\_peeking\_eye: We have 11 cluster servers in the infrastructure ES: Servers HOT … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=759) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=761)