# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=761 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 762 --- ## [Kubernetes Filebeat autodiscover does not find containers](https://discuss.elastic.co/t/kubernetes-filebeat-autodiscover-does-not-find-containers/316713)
**Author:** [@akiks](https://discuss.elastic.co/u/akiks)\ **Replies:** 0\ **Last updated:** [October 16, 2022, 9:17pm UTC](https://discuss.elastic.co/t/kubernetes-filebeat-autodiscover-does-not-find-containers/316713 "2022-10-16T21:17:53Z")
I'm trying to let filebeat collect logs of containers running within Kubernetes using a conditional autodiscover template, but filebeat does never print any of the containers logs. Here is an example container whose lo… --- ## [Heartbeat auto discovery generates second monitor which is always down](https://discuss.elastic.co/t/heartbeat-auto-discovery-generates-second-monitor-which-is-always-down/315491)
**Author:** [@kintetsu](https://discuss.elastic.co/u/kintetsu)\ **Replies:** 12\ **Last updated:** [October 17, 2022, 10:29am UTC](https://discuss.elastic.co/t/heartbeat-auto-discovery-generates-second-monitor-which-is-always-down/315491 "2022-10-17T10:29:04Z")
Hi, since we updated Heartbeat in our Kubernetes cluster from version 7.17.x to 8.3.3, we have a second monitor for every pod we have annotated. Both monitors have the same name and the same tags. Just one has no UR… --- ## [Exporting and visualizing with surrounding documents](https://discuss.elastic.co/t/exporting-and-visualizing-with-surrounding-documents/316753)
**Author:** [@Jose\_E](https://discuss.elastic.co/u/Jose_E)\ **Replies:** 2\ **Last updated:** [October 17, 2022, 10:28am UTC](https://discuss.elastic.co/t/exporting-and-visualizing-with-surrounding-documents/316753 "2022-10-17T10:28:20Z")
Hello, I've encountered a rather simple scenario that I don't know how to solve with Kibana. Our current deployment receives logs from all machines in the network, and our goal is to switch to Kibana as a way of debuggin… --- ## [What's the cause and the solution of this error](https://discuss.elastic.co/t/whats-the-cause-and-the-solution-of-this-error/315055)
**Author:** [@morad\_della3](https://discuss.elastic.co/u/morad_della3)\ **Replies:** 9\ **Last updated:** [October 17, 2022, 9:51am UTC](https://discuss.elastic.co/t/whats-the-cause-and-the-solution-of-this-error/315055 "2022-10-17T09:51:03Z")
ubuntu 22.04 VM elasticsearch,kibana,filebeat8.4.1 ,elastalert,suricata i have this error in the log of elasticsearch when i try to start elasticsearch it failed to start Failed to get the temporary directory; falling… --- ## [Elastic Aggregate](https://discuss.elastic.co/t/elastic-aggregate/316485)
**Author:** [@edhbs31](https://discuss.elastic.co/u/edhbs31)\ **Replies:** 5\ **Last updated:** [October 17, 2022, 9:40am UTC](https://discuss.elastic.co/t/elastic-aggregate/316485 "2022-10-17T09:40:26Z")
Hi Guys, I am very new at elastic.. and i need some help or advice.. i have elastic's json result like this: "results": \[ { "discount": "", }, And Aggregate like this.. "data": \[ { "count": 17081, "value": "" … --- ## [Why "conf.dfs.replication" : "1" is not SUCCESS?](https://discuss.elastic.co/t/why-conf-dfs-replication-1-is-not-success/316405)
**Author:** [@bo8888](https://discuss.elastic.co/u/bo8888)\ **Replies:** 12\ **Last updated:** [October 17, 2022, 9:38am UTC](https://discuss.elastic.co/t/why-conf-dfs-replication-1-is-not-success/316405 "2022-10-17T09:38:23Z")
I set snapshot use hdfs with conf conf.dfs.replication = 1 ,but I found the replication of data is also 3，i need to hdfs dfs -setrep -R -w 1 /es\_snapshots GET \_snapshot/es\_snapshots { "es\_snapshots" : { "type" : … --- ## [Log file when running Kibana from source](https://discuss.elastic.co/t/log-file-when-running-kibana-from-source/316735)
**Author:** [@Sheereen](https://discuss.elastic.co/u/Sheereen)\ **Replies:** 1\ **Last updated:** [October 17, 2022, 8:38am UTC](https://discuss.elastic.co/t/log-file-when-running-kibana-from-source/316735 "2022-10-17T08:38:10Z")
Hi, I am running kibana from source. I am not getting the logs whatever be the file I specify in the kibana.yml file. The following is my yml file. server.port: 5600 server.host: \ elasticsearch.hosts: http:/… --- ## [Completion suggester issue](https://discuss.elastic.co/t/completion-suggester-issue/316657)
**Author:** [@Mahesh\_Hegde](https://discuss.elastic.co/u/Mahesh_Hegde)\ **Replies:** 3\ **Last updated:** [October 17, 2022, 7:50am UTC](https://discuss.elastic.co/t/completion-suggester-issue/316657 "2022-10-17T07:50:11Z")
Issue - completion suggester with custom keyword lowercase analyzer not working as expected. We can reproduce the issue with following steps. Not able to understand whats causing issue here. However, if we search for "P… --- ## [How to match text fields which ends with .s3.amazonaws.com using KQL?](https://discuss.elastic.co/t/how-to-match-text-fields-which-ends-with-s3-amazonaws-com-using-kql/316731)
**Author:** [@shi](https://discuss.elastic.co/u/shi)\ **Replies:** 2\ **Last updated:** [October 17, 2022, 7:36am UTC](https://discuss.elastic.co/t/how-to-match-text-fields-which-ends-with-s3-amazonaws-com-using-kql/316731 "2022-10-17T07:36:00Z")
We are trying to match s3.amazonaws.com from the following text field which is indexed. goto-desktop.s3.amazonaws.com We found that 1. DNSQuery : \*amazonaws\* matched amazonaws.com goto-desktop.s3.amazonaws.com 2. D… --- ## [Elastic agent elastic-agent-control.sock does not exist](https://discuss.elastic.co/t/elastic-agent-elastic-agent-control-sock-does-not-exist/316619)
**Author:** [@stoza](https://discuss.elastic.co/u/stoza)\ **Replies:** 2\ **Last updated:** [October 17, 2022, 7:23am UTC](https://discuss.elastic.co/t/elastic-agent-elastic-agent-control-sock-does-not-exist/316619 "2022-10-17T07:23:40Z")
Hi Everyone, I'm trying to install an elastic agent and to enroll it with fleet. The enrollment is working, I can see the agent on my fleet server but after few seconds it goes into the unhealthy state. when I run ela… --- ## [Upgrade OpenJDK](https://discuss.elastic.co/t/upgrade-openjdk/315659)
**Author:** [@hugo.barbosa](https://discuss.elastic.co/u/hugo.barbosa)\ **Replies:** 2\ **Last updated:** [October 17, 2022, 6:23am UTC](https://discuss.elastic.co/t/upgrade-openjdk/315659 "2022-10-17T06:23:27Z")
Dear all I would like to upgrade or check the current OpenJDK Java version on my three ubuntu nodes. Asking the dev tools about my version, it says 18 But asking on the ubuntu servers commandline, I got version 11. … --- ## [Fatal exception while booting Elasticsearchjava.nio.file.NoSuchFileException:](https://discuss.elastic.co/t/fatal-exception-while-booting-elasticsearchjava-nio-file-nosuchfileexception/316603)
**Author:** [@Arun\_Singh2](https://discuss.elastic.co/u/Arun_Singh2)\ **Replies:** 2\ **Last updated:** [October 17, 2022, 5:50am UTC](https://discuss.elastic.co/t/fatal-exception-while-booting-elasticsearchjava-nio-file-nosuchfileexception/316603 "2022-10-17T05:50:31Z")
i cant find any way to solve this error java version on my laptop is 19 nad i have added ES dir to path also these are logs --\> \[2022-10-14T12:45:26,597\]\[ERROR\]\[o.e.b.Elasticsearch \] \[LT0148506\] fatal exception w… --- ## [Debugging role-based access control to documents](https://discuss.elastic.co/t/debugging-role-based-access-control-to-documents/316628)
**Author:** [@foxy](https://discuss.elastic.co/u/foxy)\ **Replies:** 3\ **Last updated:** [October 17, 2022, 4:47am UTC](https://discuss.elastic.co/t/debugging-role-based-access-control-to-documents/316628 "2022-10-17T04:47:52Z")
Is there a way to see how access to a particular document set has been granted (i.e: where the permission has come from)? context We have several indices that employ document level security to restrict access, by role,… --- ## [Random sample of non-null values using Eland](https://discuss.elastic.co/t/random-sample-of-non-null-values-using-eland/316720)
**Author:** [@wpm](https://discuss.elastic.co/u/wpm)\ **Replies:** 0\ **Last updated:** [October 17, 2022, 3:25am UTC](https://discuss.elastic.co/t/random-sample-of-non-null-values-using-eland/316720 "2022-10-17T03:25:55Z")
I have indexed a bunch of documents containing an optional field called value. How do I use Eland to take a random sample of n non-null instances of value with replacement? If I had a pandas data frame I would do the fo… --- ## [Ho set size search?](https://discuss.elastic.co/t/ho-set-size-search/316666)
**Author:** [@Nikolas1306](https://discuss.elastic.co/u/Nikolas1306)\ **Replies:** 0\ **Last updated:** [October 14, 2022, 6:15pm UTC](https://discuss.elastic.co/t/ho-set-size-search/316666 "2022-10-14T18:15:03Z")
in kibana discovery search Can't store an async search response larger than \[10485760\] bytes. This limit can be set by changing the \[search.max\_async\_search\_response\_size\] setting. --- ## [Filebeat ignore all pattern](https://discuss.elastic.co/t/filebeat-ignore-all-pattern/316705)
**Author:** [@Nikolas1306](https://discuss.elastic.co/u/Nikolas1306)\ **Replies:** 2\ **Last updated:** [October 17, 2022, 2:04am UTC](https://discuss.elastic.co/t/filebeat-ignore-all-pattern/316705 "2022-10-17T02:04:42Z")
i used simple config parsers: - multiline: type: pattern pattern: '^test' negate: false match: after output.console: pretty: true ter\_id":"41e9015a-67cd-4e5a-b602-6ce8a0eba50d","ecs.version":"1.6… --- ## [Elasticsearch filter, ca\_file problem](https://discuss.elastic.co/t/elasticsearch-filter-ca-file-problem/316699)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 1\ **Last updated:** [October 16, 2022, 10:50pm UTC](https://discuss.elastic.co/t/elasticsearch-filter-ca-file-problem/316699 "2022-10-16T22:50:39Z")
Hi Im trying to use elasticsearch filter and I get this error: Host name 'my-elastic-ip' does not match the certificate subject provided by the peer (CN=instance)\> this is my conf: filter{ elasticsearch { hosts =\>… --- ## [Logstash strange warning](https://discuss.elastic.co/t/logstash-strange-warning/316676)
**Author:** [@Nikolas1306](https://discuss.elastic.co/u/Nikolas1306)\ **Replies:** 0\ **Last updated:** [October 15, 2022, 9:50am UTC](https://discuss.elastic.co/t/logstash-strange-warning/316676 "2022-10-15T09:50:55Z")
\[2022-10-15T09:46:37,901\]\[WARN \]\[logstash.outputs.elasticsearch\]\[prima\] Elasticsearch Output configured with ecs\_compatibility =\> v8, which resolved to an UNRELEASED preview of version 8.0.0 of the Elastic Common Schema.… --- ## [Slow queries (fuzzy) - how to disable score calculation](https://discuss.elastic.co/t/slow-queries-fuzzy-how-to-disable-score-calculation/316711)
**Author:** [@Giorgos\_Katiforis](https://discuss.elastic.co/u/Giorgos_Katiforis)\ **Replies:** 0\ **Last updated:** [October 16, 2022, 6:52pm UTC](https://discuss.elastic.co/t/slow-queries-fuzzy-how-to-disable-score-calculation/316711 "2022-10-16T18:52:01Z")
The query has several match conditions with fuzziness 2, which makes it quite expensive. I don't want to search for document relevance or any kind of scoring, just identify the list of document IDs that match the query c… --- ## [ElasticSearch - Searching partial text in String](https://discuss.elastic.co/t/elasticsearch-searching-partial-text-in-string/316649)
**Author:** [@Sachin\_Sharma](https://discuss.elastic.co/u/Sachin_Sharma)\ **Replies:** 3\ **Last updated:** [October 16, 2022, 11:59am UTC](https://discuss.elastic.co/t/elasticsearch-searching-partial-text-in-string/316649 "2022-10-16T11:59:59Z")
What is the best way to use Elasticsearch to search exact partial text in String? In SQL the method would be: %PARTIAL TEXT%, %ARTIAL TEX% In Elastic Search current method being used: { "query": { "match\_p… --- ## [Document(s) failed to index | mapper\_parsing\_exception](https://discuss.elastic.co/t/document-s-failed-to-index-mapper-parsing-exception/316690)
**Author:** [@mohitthakkar\_ihm](https://discuss.elastic.co/u/mohitthakkar_ihm)\ **Replies:** 2\ **Last updated:** [October 16, 2022, 8:52am UTC](https://discuss.elastic.co/t/document-s-failed-to-index-mapper-parsing-exception/316690 "2022-10-16T08:52:36Z")
Hi, I have an ES instance with the following mapping & config: { "settings": { "number\_of\_shards": 5, "number\_of\_replicas": 1, "analysis": { "analyzer": { "custom\_analyzer": { "tok… --- ## [👀 Host.network.ingress.bytes looks broken](https://discuss.elastic.co/t/host-network-ingress-bytes-looks-broken/316696)
**Author:** [@Its\_Anton](https://discuss.elastic.co/u/Its_Anton)\ **Replies:** 4\ **Last updated:** [October 15, 2022, 10:17pm UTC](https://discuss.elastic.co/t/host-network-ingress-bytes-looks-broken/316696 "2022-10-15T22:17:57Z")
Hi! I have a Docker Swarm cluster with 4 nodes and Metricbeat installed on every node as a global service. According to docs: host.network.ingress.bytes The number of bytes received (gauge) on all network interfaces … --- ## [No Activity From Agent - Agent Renamed](https://discuss.elastic.co/t/no-activity-from-agent-agent-renamed/315492)
**Author:** [@Marko\_Todoric](https://discuss.elastic.co/u/Marko_Todoric)\ **Replies:** 1\ **Last updated:** [October 15, 2022, 9:58pm UTC](https://discuss.elastic.co/t/no-activity-from-agent-agent-renamed/315492 "2022-10-15T21:58:18Z")
Hello everyone, I have this glitch with Kibana where i added an agent to fleet , then figured i need to rename it so i renamed the host. Rename was successful, howerver I'm getting alerts " No Activity From Agent" whole… --- ## [Self-hosted deployment- licence question](https://discuss.elastic.co/t/self-hosted-deployment-licence-question/316698)
**Author:** [@misztol](https://discuss.elastic.co/u/misztol)\ **Replies:** 1\ **Last updated:** [October 15, 2022, 9:13pm UTC](https://discuss.elastic.co/t/self-hosted-deployment-licence-question/316698 "2022-10-15T21:13:25Z")
Dear Elastic I am attempting to build self-hosted deployment for SIEM purposes. I would like to use Platinum license features. I wonder how many licenses are required for following build: Hot tier (logs ingestion and … --- ## [Csv: map each field name to an array index](https://discuss.elastic.co/t/csv-map-each-field-name-to-an-array-index/316673)
**Author:** [@ktomu](https://discuss.elastic.co/u/ktomu)\ **Replies:** 3\ **Last updated:** [October 15, 2022, 8:41pm UTC](https://discuss.elastic.co/t/csv-map-each-field-name-to-an-array-index/316673 "2022-10-15T20:41:21Z")
Hi, I have a csv file with 2000 fields and I need only 5 from them and I know their position. It's easy to get that 5 fields using filebeat (decode\_csv\_fields and extract\_array) because everything that I need it just map… --- ## [Filebeat bugs not respect pattern go](https://discuss.elastic.co/t/filebeat-bugs-not-respect-pattern-go/316695)
**Author:** [@Nikolas1306](https://discuss.elastic.co/u/Nikolas1306)\ **Replies:** 0\ **Last updated:** [October 15, 2022, 7:18pm UTC](https://discuss.elastic.co/t/filebeat-bugs-not-respect-pattern-go/316695 "2022-10-15T19:18:51Z")
i ve used this filebeat.inputs: - type: log enabled: true paths: - G:\\\\logs\\\\test\\\\\*.\* parsers: - multiline: type: pattern pattern: '^\\d{4}-\\d{2}-\\d{2}' negate: true m… --- ## [How can match exact string first and then spilt matches ElasticSearch (7.16.2) and Nest (7.16.2)](https://discuss.elastic.co/t/how-can-match-exact-string-first-and-then-spilt-matches-elasticsearch-7-16-2-and-nest-7-16-2/316694)
**Author:** [@Abid\_Hussain1](https://discuss.elastic.co/u/Abid_Hussain1)\ **Replies:** 0\ **Last updated:** [October 15, 2022, 6:35pm UTC](https://discuss.elastic.co/t/how-can-match-exact-string-first-and-then-spilt-matches-elasticsearch-7-16-2-and-nest-7-16-2/316694 "2022-10-15T18:35:20Z")
For example i want below searching with this string "we added a large" string from the (paragraph and subject ) fields, and paragraph contain this string below "We encountered elevated H2S levels today in the trailer… --- ## [ElasticSearch on-premise pricing](https://discuss.elastic.co/t/elasticsearch-on-premise-pricing/316683)
**Author:** [@dominique.bejean](https://discuss.elastic.co/u/dominique.bejean)\ **Replies:** 2\ **Last updated:** [October 15, 2022, 3:53pm UTC](https://discuss.elastic.co/t/elasticsearch-on-premise-pricing/316683 "2022-10-15T15:53:46Z")
Hi, For Elasticsearch on-premise pricing, according to this page (Tarifs officiels Elasticsearch : Elastic Cloud, offre Elasticsearch gérée | Elastic), I understand, the pricing is per month and per server for any serve… --- ## [Invalid protocol when filebeat send to logstash](https://discuss.elastic.co/t/invalid-protocol-when-filebeat-send-to-logstash/316681)
**Author:** [@Nikolas1306](https://discuss.elastic.co/u/Nikolas1306)\ **Replies:** 16\ **Last updated:** [October 15, 2022, 2:07pm UTC](https://discuss.elastic.co/t/invalid-protocol-when-filebeat-send-to-logstash/316681 "2022-10-15T14:07:06Z")
\[2022-10-15T11:01:12,651\]\[INFO \]\[org.logstash.beats.BeatsHandler\]\[terza\]\[7bd5f0adbbfa46b9e9ef1e064135c6f8c54b821b69f260da353a735193b5fe7d\] \[local: 172.19.1.12:5044, remote: 172.19.0.1:53380\] Handling exception: io.netty.… --- ## [Monitor Elasticsearch in Grafana](https://discuss.elastic.co/t/monitor-elasticsearch-in-grafana/316688)
**Author:** [@ZahraZare](https://discuss.elastic.co/u/ZahraZare)\ **Replies:** 2\ **Last updated:** [October 15, 2022, 2:06pm UTC](https://discuss.elastic.co/t/monitor-elasticsearch-in-grafana/316688 "2022-10-15T14:06:34Z")
I want to monitor Elasticsearch in Grafana,( not ٍELK stack). How can I do this without elastic exporter and prometheus? Can I monitor elasticsearch with X-pack? How? I have found this link(Elasticsearch Monitoring base… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=760) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=762)