# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=768 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 769 --- ## [How to search for username that logged in to install a specific app](https://discuss.elastic.co/t/how-to-search-for-username-that-logged-in-to-install-a-specific-app/316249)
**Author:** [@BabyElkUser](https://discuss.elastic.co/u/BabyElkUser)\ **Replies:** 1\ **Last updated:** [October 11, 2022, 12:20am UTC](https://discuss.elastic.co/t/how-to-search-for-username-that-logged-in-to-install-a-specific-app/316249 "2022-10-11T00:20:51Z")
Hi folks, I'm very new to Elk and am attempting to help our Information Security office with a few tasks. Per our Information Security Office, applications must be approved prior to being installed on a computer. Unfort… --- ## [Uptime in Cross-Cluster Search](https://discuss.elastic.co/t/uptime-in-cross-cluster-search/316256)
**Author:** [@Tim\_Mobley](https://discuss.elastic.co/u/Tim_Mobley)\ **Replies:** 1\ **Last updated:** [October 11, 2022, 12:02am UTC](https://discuss.elastic.co/t/uptime-in-cross-cluster-search/316256 "2022-10-11T00:02:46Z")
We recently set-up Heartbeat for two ES clusters (everything running version 8.3.2). However, data from these clusters are viewed from a Cross-Cluster Search (CCS) instance. When I view Uptime from the local cluster Kiba… --- ## [Best security pratice for elastich search?](https://discuss.elastic.co/t/best-security-pratice-for-elastich-search/316251)
**Author:** [@Nikolas1306](https://discuss.elastic.co/u/Nikolas1306)\ **Replies:** 1\ **Last updated:** [October 10, 2022, 11:47pm UTC](https://discuss.elastic.co/t/best-security-pratice-for-elastich-search/316251 "2022-10-10T23:47:16Z")
hello what is best security pratice for elk? --- ## [Elastic docker restart](https://discuss.elastic.co/t/elastic-docker-restart/314582)
**Author:** [@Isekai](https://discuss.elastic.co/u/Isekai)\ **Replies:** 3\ **Last updated:** [October 10, 2022, 10:29pm UTC](https://discuss.elastic.co/t/elastic-docker-restart/314582 "2022-10-10T22:29:14Z")
Hi everyone, We have an elastic instance that we feed data from CI jobs. It is single node instance. Maybe some data from the cluster: "cluster\_name" : "docker-cluster", "status" : "yellow", "timed\_out" : false… --- ## [Automatically move old documents from a index, to a new index, without deleting the original index](https://discuss.elastic.co/t/automatically-move-old-documents-from-a-index-to-a-new-index-without-deleting-the-original-index/316161)
**Author:** [@jinlauter94](https://discuss.elastic.co/u/jinlauter94)\ **Replies:** 1\ **Last updated:** [October 10, 2022, 10:24pm UTC](https://discuss.elastic.co/t/automatically-move-old-documents-from-a-index-to-a-new-index-without-deleting-the-original-index/316161 "2022-10-10T22:24:12Z")
There is a lot of helpful documents showing how to turn a hot index into a warm or cold one. But, in my case, I have a lot of independent applications that do the "same" thing, and can be very different. I would like to … --- ## [Cross Cluster Replication between AWS Opensearch and Elastic Cloud it is possibile?](https://discuss.elastic.co/t/cross-cluster-replication-between-aws-opensearch-and-elastic-cloud-it-is-possibile/315947)
**Author:** [@yago82](https://discuss.elastic.co/u/yago82)\ **Replies:** 3\ **Last updated:** [October 10, 2022, 10:20pm UTC](https://discuss.elastic.co/t/cross-cluster-replication-between-aws-opensearch-and-elastic-cloud-it-is-possibile/315947 "2022-10-10T22:20:18Z")
Hi, as already mentioned in the title, is it possibile to use Cross Cluster Replication between AWS Opensearch and Elastic Cloud. My goal is to migrate from AWS OpenSearch to Elastic Cloud using CCR, and then dismiss t… --- ## [Question regarding backup](https://discuss.elastic.co/t/question-regarding-backup/316254)
**Author:** [@linkerc](https://discuss.elastic.co/u/linkerc)\ **Replies:** 1\ **Last updated:** [October 10, 2022, 9:27pm UTC](https://discuss.elastic.co/t/question-regarding-backup/316254 "2022-10-10T21:27:24Z")
Supposed I am running a backup everyday for my entire cluster. I understand that ES does incremental backup, so the first backup would be huge, but subsequent ones would be small. Let's say I have one month worth of ba… --- ## [Elasticsearch Upgrade 7.9.1 to 8.4](https://discuss.elastic.co/t/elasticsearch-upgrade-7-9-1-to-8-4/316229)
**Author:** [@jacknino](https://discuss.elastic.co/u/jacknino)\ **Replies:** 2\ **Last updated:** [October 10, 2022, 8:10pm UTC](https://discuss.elastic.co/t/elasticsearch-upgrade-7-9-1-to-8-4/316229 "2022-10-10T20:10:47Z")
Hi Channel, We are planning to upgrade Elasticsearch opensource 7.9.1 to 8.4. while upgrading we noticed multiple data disk path deprecation warning . Could anyone help us how we can proceed further. FYI, Elasticsearc… --- ## [How to store index in elasticsearch if disk space is full on server](https://discuss.elastic.co/t/how-to-store-index-in-elasticsearch-if-disk-space-is-full-on-server/315520)
**Author:** [@aniketdatir](https://discuss.elastic.co/u/aniketdatir)\ **Replies:** 2\ **Last updated:** [October 10, 2022, 7:21pm UTC](https://discuss.elastic.co/t/how-to-store-index-in-elasticsearch-if-disk-space-is-full-on-server/315520 "2022-10-10T19:21:25Z")
Hi team, I want to store disk space related data in to elastic index through Metricbeat. kindly guide me how to achieve this? --- ## [Ndjson appears to be ignoring my log line](https://discuss.elastic.co/t/ndjson-appears-to-be-ignoring-my-log-line/315971)
**Author:** [@ledzepp4eva](https://discuss.elastic.co/u/ledzepp4eva)\ **Replies:** 1\ **Last updated:** [October 10, 2022, 7:14pm UTC](https://discuss.elastic.co/t/ndjson-appears-to-be-ignoring-my-log-line/315971 "2022-10-10T19:14:47Z")
Hey, I am hoping you can point out my silly mistake here. filebeat.inputs: - type: filestream id: nginx-stream-json-id paths: - /var/log/nginx/\*.stream.access.log parser: - ndjson: t… --- ## [Permissions for ES\_KEYSTORE\_PASSPHRASE\_FILE](https://discuss.elastic.co/t/permissions-for-es-keystore-passphrase-file/314219)
**Author:** [@tepus](https://discuss.elastic.co/u/tepus)\ **Replies:** 2\ **Last updated:** [October 10, 2022, 7:06pm UTC](https://discuss.elastic.co/t/permissions-for-es-keystore-passphrase-file/314219 "2022-10-10T19:06:26Z")
Dear Community, our Keystore is protected with a password. In order to provide the password to the cluster and start it, we created the file /etc/elasticsearch/my\_pwd\_file.tmp under root:elasticsearch containing the pas… --- ## [Painless script - counting equal values in a field](https://discuss.elastic.co/t/painless-script-counting-equal-values-in-a-field/316252)
**Author:** [@Aleksei](https://discuss.elastic.co/u/Aleksei)\ **Replies:** 0\ **Last updated:** [October 10, 2022, 6:06pm UTC](https://discuss.elastic.co/t/painless-script-counting-equal-values-in-a-field/316252 "2022-10-10T18:06:31Z")
Hi. I'm not good with pineless syntax. Please tell me by painless script. How to count the same values in a field ? For example, in the field 1 = 111 three times. How to count duplicates ? --- ## [Elastic password generate error](https://discuss.elastic.co/t/elastic-password-generate-error/316239)
**Author:** [@Nikolas1306](https://discuss.elastic.co/u/Nikolas1306)\ **Replies:** 2\ **Last updated:** [October 10, 2022, 5:49pm UTC](https://discuss.elastic.co/t/elastic-password-generate-error/316239 "2022-10-10T17:49:06Z")
sudo ./elasticsearch-setup-passwords auto warning: ignoring JAVA\_HOME=/usr/lib/jvm/java-11-openjdk-amd64; using bundled JDK 14:42:41.915 \[main\] WARN org.elasticsearch.common.ssl.DiagnosticTrustManager - failed to estab… --- ## [Logstash not starting](https://discuss.elastic.co/t/logstash-not-starting/316188)
**Author:** [@sandeep\_singh3](https://discuss.elastic.co/u/sandeep_singh3)\ **Replies:** 2\ **Last updated:** [October 10, 2022, 5:44pm UTC](https://discuss.elastic.co/t/logstash-not-starting/316188 "2022-10-10T17:44:57Z")
I am trying to run Logstash on my window machine but unable to do so due below error \\Eclipse was unexpected at this time. Command used to run the logstash logstash.bat -f logstash.conf Version of Logstash - 7.16.3 l… --- ## [Docker Filebeats for raspberrpi 4 aarch64](https://discuss.elastic.co/t/docker-filebeats-for-raspberrpi-4-aarch64/316011)
**Author:** [@Nlmyr](https://discuss.elastic.co/u/Nlmyr)\ **Replies:** 3\ **Last updated:** [October 10, 2022, 5:39pm UTC](https://discuss.elastic.co/t/docker-filebeats-for-raspberrpi-4-aarch64/316011 "2022-10-10T17:39:38Z")
Is Docker Filebeats for raspberrpi 4 aarch64 available? --- ## [Build your own Beat in Go](https://discuss.elastic.co/t/build-your-own-beat-in-go/316066)
**Author:** [@adrianfusco](https://discuss.elastic.co/u/adrianfusco)\ **Replies:** 4\ **Last updated:** [October 10, 2022, 5:38pm UTC](https://discuss.elastic.co/t/build-your-own-beat-in-go/316066 "2022-10-10T17:38:11Z")
I needed to send messages to Logstash using Beat from a little app I'm developing in Go. I've seen different ways to do it without doing calling services as filebeat to not create a dependency. I was taking a look to t… --- ## [Winlogbeat may leak PublisherHandle, and lead to failure of sysmon uninstalling](https://discuss.elastic.co/t/winlogbeat-may-leak-publisherhandle-and-lead-to-failure-of-sysmon-uninstalling/316246)
**Author:** [@Serinalice](https://discuss.elastic.co/u/Serinalice)\ **Replies:** 0\ **Last updated:** [October 10, 2022, 4:21pm UTC](https://discuss.elastic.co/t/winlogbeat-may-leak-publisherhandle-and-lead-to-failure-of-sysmon-uninstalling/316246 "2022-10-10T16:21:06Z")
When I use "github.com/elastic/beats/v7/winlogbeat" library to build my app which manages sysmon and reads events of sysmon from windows event system, I found the app uninstall sysmon failed. This is the minimal code to … --- ## [Filebeat can't process all the logs](https://discuss.elastic.co/t/filebeat-cant-process-all-the-logs/316017)
**Author:** [@adityak248](https://discuss.elastic.co/u/adityak248)\ **Replies:** 1\ **Last updated:** [October 10, 2022, 3:56pm UTC](https://discuss.elastic.co/t/filebeat-cant-process-all-the-logs/316017 "2022-10-10T15:56:01Z")
Hello team, Greeting, I have a setup that will push the logs from filebeat to logstash to elastic. Here is my filebeat configs filebeat.inputs: - type: log enabled: true paths: - '/var/www/log/myapp.log' clos… --- ## [Set variable in configuration file](https://discuss.elastic.co/t/set-variable-in-configuration-file/316096)
**Author:** [@RickT](https://discuss.elastic.co/u/RickT)\ **Replies:** 5\ **Last updated:** [October 10, 2022, 3:41pm UTC](https://discuss.elastic.co/t/set-variable-in-configuration-file/316096 "2022-10-10T15:41:30Z")
Hi all ! Simply, is there some method in Logstash news versions to code a variable which can be used in input, filter and output sections ? if so, how to code it ? Thanks. --- ## [Choosing tracks that contain long-running tasks](https://discuss.elastic.co/t/choosing-tracks-that-contain-long-running-tasks/316193)
**Author:** [@Sunt-ing](https://discuss.elastic.co/u/Sunt-ing)\ **Replies:** 2\ **Last updated:** [October 10, 2022, 3:34pm UTC](https://discuss.elastic.co/t/choosing-tracks-that-contain-long-running-tasks/316193 "2022-10-10T15:34:44Z")
Hi all! I need to benchmark on a track that contains some long-running (such as larger than 10s) tasks. Benchmarking one track after another is definitely an approach and I'm working on that, but there are so many tracks… --- ## [Updating elastic search document by id is not working](https://discuss.elastic.co/t/updating-elastic-search-document-by-id-is-not-working/316240)
**Author:** [@Atul\_Joshi1](https://discuss.elastic.co/u/Atul_Joshi1)\ **Replies:** 1\ **Last updated:** [October 10, 2022, 3:26pm UTC](https://discuss.elastic.co/t/updating-elastic-search-document-by-id-is-not-working/316240 "2022-10-10T15:26:05Z")
I have document structure as below stored in Elasticsearch - { "\_index" : "testIndex", "\_type" : "\_doc", "\_id" : "6ZR6soMBLkXUqNwMnccZ", "\_score" : 3.4454321, "\_source" : { … --- ## [New Java client how to estimate size of BulkRequest](https://discuss.elastic.co/t/new-java-client-how-to-estimate-size-of-bulkrequest/316211)
**Author:** [@fabian-froehlich](https://discuss.elastic.co/u/fabian-froehlich)\ **Replies:** 0\ **Last updated:** [October 10, 2022, 11:32am UTC](https://discuss.elastic.co/t/new-java-client-how-to-estimate-size-of-bulkrequest/316211 "2022-10-10T11:32:00Z")
Is there a efferent way to estimate the size of the bulk request in the new ElasticsearchClient ? Currently our in the HighLevelRest-Client we use the method bulkRequest.estimatedSizeInBytes() to check whether another … --- ## [Script field is automatically deleted from the index pattern](https://discuss.elastic.co/t/script-field-is-automatically-deleted-from-the-index-pattern/316175)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 1\ **Last updated:** [October 10, 2022, 12:23pm UTC](https://discuss.elastic.co/t/script-field-is-automatically-deleted-from-the-index-pattern/316175 "2022-10-10T12:23:50Z")
Hi Community, recently we add a custom field that parse the string field to integer field that time it was showing and after 7 days it is deleted. We have added the field by clicking on Add Field. --- ## [Kibana field filter suggester settings](https://discuss.elastic.co/t/kibana-field-filter-suggester-settings/315665)
**Author:** [@gribna](https://discuss.elastic.co/u/gribna)\ **Replies:** 2\ **Last updated:** [October 10, 2022, 10:39am UTC](https://discuss.elastic.co/t/kibana-field-filter-suggester-settings/315665 "2022-10-10T10:39:18Z")
Which setting affects the appearance of value suggestion list in filters and in queries? We have several environments and it doesn't work for one of them. The difference between environments is that the one that doesn't… --- ## [Kibana cannot startup - always tried to migrate](https://discuss.elastic.co/t/kibana-cannot-startup-always-tried-to-migrate/316200)
**Author:** [@misterking7](https://discuss.elastic.co/u/misterking7)\ **Replies:** 0\ **Last updated:** [October 10, 2022, 9:47am UTC](https://discuss.elastic.co/t/kibana-cannot-startup-always-tried-to-migrate/316200 "2022-10-10T09:47:42Z")
Hello team, I have issue with Kibana that cannot start up . before it was deployed into Openshift3 , Kibana version showed as 7.9.3 - Elasticsearch is 7.9.2 now, I tried to shutdown old cluster instance on Openshift3 … --- ## [Roadmap for "Stateless" Elasticsearch](https://discuss.elastic.co/t/roadmap-for-stateless-elasticsearch/316107)
**Author:** [@benjismith](https://discuss.elastic.co/u/benjismith)\ **Replies:** 8\ **Last updated:** [October 10, 2022, 9:28am UTC](https://discuss.elastic.co/t/roadmap-for-stateless-elasticsearch/316107 "2022-10-10T09:28:46Z")
I read yesterday's blog post about the future of a "stateless" Elasticsearch architecture, where one of the big benefits is the ability to scale indexing workloads separately from search workloads... I have a 30+ node… --- ## [Disable default secret creating in kubernetes](https://discuss.elastic.co/t/disable-default-secret-creating-in-kubernetes/316196)
**Author:** [@Norsu296](https://discuss.elastic.co/u/Norsu296)\ **Replies:** 0\ **Last updated:** [October 10, 2022, 8:46am UTC](https://discuss.elastic.co/t/disable-default-secret-creating-in-kubernetes/316196 "2022-10-10T08:46:03Z")
Hi, how can I disable secret creating for elasticsearch? I'm using deployment with Kind: Elasticsearch and I want to use my own password but elastic is still recreating k8s password like elastic: password with name xyz-e… --- ## [Linking Dashboard and Discover tab to view documents based on filter](https://discuss.elastic.co/t/linking-dashboard-and-discover-tab-to-view-documents-based-on-filter/315687)
**Author:** [@ashit\_pupu](https://discuss.elastic.co/u/ashit_pupu)\ **Replies:** 3\ **Last updated:** [October 10, 2022, 7:13am UTC](https://discuss.elastic.co/t/linking-dashboard-and-discover-tab-to-view-documents-based-on-filter/315687 "2022-10-10T07:13:05Z")
Hi Team, I am looking for any feature availability in Kibana which would enable me to link my dashboard to the discover tab to view the documents. So the idea is I have a dashboard created based on field aggregation I … --- ## [Case Insensitive search in kibana dahboard](https://discuss.elastic.co/t/case-insensitive-search-in-kibana-dahboard/315653)
**Author:** [@vikram\_singh](https://discuss.elastic.co/u/vikram_singh)\ **Replies:** 1\ **Last updated:** [October 10, 2022, 7:11am UTC](https://discuss.elastic.co/t/case-insensitive-search-in-kibana-dahboard/315653 "2022-10-10T07:11:12Z")
Hi, I created dashboard with some visualization and add filters on it. But these are case sensitive. Is it possible to search with lower or upper case. For exam Adam name searchable from Adam or adam or aDaM. Thanks --- ## [Same index pattern in multiple namespaces](https://discuss.elastic.co/t/same-index-pattern-in-multiple-namespaces/316085)
**Author:** [@umesh2020](https://discuss.elastic.co/u/umesh2020)\ **Replies:** 1\ **Last updated:** [October 10, 2022, 7:07am UTC](https://discuss.elastic.co/t/same-index-pattern-in-multiple-namespaces/316085 "2022-10-10T07:07:26Z")
Hi I am using Kibana/Elasticsearch version 7.16.3. I have trouble creating the same index pattern within multiple namespaces. I am using bulk create API to create multiple index patterns and for one of the patterns … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=767) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=769)