# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=780 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 781 --- ## [Logstash Failed to install template Error 400](https://discuss.elastic.co/t/logstash-failed-to-install-template-error-400/315403)
**Author:** [@fformoso](https://discuss.elastic.co/u/fformoso)\ **Replies:** 0\ **Last updated:** [September 28, 2022, 8:34pm UTC](https://discuss.elastic.co/t/logstash-failed-to-install-template-error-400/315403 "2022-09-28T20:34:39Z")
Dear all, I need help to understand root cause, I can add the template via api, but not using logstash 8.3 I've tried to fix it adding diferent roles to user =\> "logstash\_writer" and didnt work Error: \[2022-09-28T17… --- ## [Kibana index import success but different user none index](https://discuss.elastic.co/t/kibana-index-import-success-but-different-user-none-index/312977)
**Author:** [@laminus](https://discuss.elastic.co/u/laminus)\ **Replies:** 1\ **Last updated:** [September 28, 2022, 8:07pm UTC](https://discuss.elastic.co/t/kibana-index-import-success-but-different-user-none-index/312977 "2022-09-28T20:07:35Z")
hello please help me old kibana used index obect export and new kibana index obect import success but different user none index what can i do? --- ## [Is custom plugin creation methodology and code same for Kibana 7 and 8?](https://discuss.elastic.co/t/is-custom-plugin-creation-methodology-and-code-same-for-kibana-7-and-8/313236)
**Author:** [@Sheereen](https://discuss.elastic.co/u/Sheereen)\ **Replies:** 1\ **Last updated:** [September 28, 2022, 6:23pm UTC](https://discuss.elastic.co/t/is-custom-plugin-creation-methodology-and-code-same-for-kibana-7-and-8/313236 "2022-09-28T18:23:25Z")
Hi, I have already started creating a custom external plugin (using React) in Kibana 8.5 source code. Can I install the same plugin in any version of Kibana, given I specify the same (version) when building the plugin? … --- ## [How to display exact match and variations after](https://discuss.elastic.co/t/how-to-display-exact-match-and-variations-after/315394)
**Author:** [@Guilherme\_Mello](https://discuss.elastic.co/u/Guilherme_Mello)\ **Replies:** 1\ **Last updated:** [September 28, 2022, 5:47pm UTC](https://discuss.elastic.co/t/how-to-display-exact-match-and-variations-after/315394 "2022-09-28T17:47:34Z")
How can I display first the exact match and search variations after? example: query: all star results: all star red (exact) all star blue (exact) all star long (exact) dress all red (partial) shoes star (partial) … --- ## [How to change the logo in Kibana 8.3.3](https://discuss.elastic.co/t/how-to-change-the-logo-in-kibana-8-3-3/313462)
**Author:** [@Arsalan1](https://discuss.elastic.co/u/Arsalan1)\ **Replies:** 2\ **Last updated:** [September 28, 2022, 5:30pm UTC](https://discuss.elastic.co/t/how-to-change-the-logo-in-kibana-8-3-3/313462 "2022-09-28T17:30:56Z")
I am facing some issues during the logo customization in Kibana version 8.3.3. I don't know how to customize the logo in Kibana. So, I read some blogs and discussion related to this topic but all in vain. can any one hel… --- ## [Offline install of ELK stack on Oracle Linux](https://discuss.elastic.co/t/offline-install-of-elk-stack-on-oracle-linux/315389)
**Author:** [@ccloutr.alex](https://discuss.elastic.co/u/ccloutr.alex)\ **Replies:** 1\ **Last updated:** [September 28, 2022, 4:36pm UTC](https://discuss.elastic.co/t/offline-install-of-elk-stack-on-oracle-linux/315389 "2022-09-28T16:36:21Z")
I need to install ELK stack with all of its dependencies on a Oracle Linux box that is not connected to the internet. Is there a Offline install package that contains all dependencies? --- ## [Custom Pipeline with Elastic Agent AWS EC2 Cloudwatch Log integration](https://discuss.elastic.co/t/custom-pipeline-with-elastic-agent-aws-ec2-cloudwatch-log-integration/315031)
**Author:** [@DougR](https://discuss.elastic.co/u/DougR)\ **Replies:** 2\ **Last updated:** [September 28, 2022, 4:00pm UTC](https://discuss.elastic.co/t/custom-pipeline-with-elastic-agent-aws-ec2-cloudwatch-log-integration/315031 "2022-09-28T16:00:13Z")
I'm trying to migrate some Cloudwatch logs currently being captured by Functionbeat to a fleet-managed Elastic Agent integration (AWS EC2 Cloudwatch). The logs are being captured, as expected. However, I am getting a gro… --- ## [Hot indices vs cold indices in same cluster](https://discuss.elastic.co/t/hot-indices-vs-cold-indices-in-same-cluster/315294)
**Author:** [@sara251186](https://discuss.elastic.co/u/sara251186)\ **Replies:** 1\ **Last updated:** [September 28, 2022, 3:36pm UTC](https://discuss.elastic.co/t/hot-indices-vs-cold-indices-in-same-cluster/315294 "2022-09-28T15:36:04Z")
I have a cluster for 12 data nodes running for a e commerce search, we also have 6 indices representing countries like US, CA, DE etc. I was running perf test against this cluster with just 1 index (i.e US - this compri… --- ## [Getting runtime\_exception exceeds maxClauseCount after Elasticsearch upgrade](https://discuss.elastic.co/t/getting-runtime-exception-exceeds-maxclausecount-after-elasticsearch-upgrade/315380)
**Author:** [@gwillis](https://discuss.elastic.co/u/gwillis)\ **Replies:** 0\ **Last updated:** [September 28, 2022, 2:55pm UTC](https://discuss.elastic.co/t/getting-runtime-exception-exceeds-maxclausecount-after-elasticsearch-upgrade/315380 "2022-09-28T14:55:23Z")
We are upgrading from Elasticsearch 6.2.4 to Elasticsearch 8.4.1 and are experiencing problems with several queries getting a runtime\_exception exceeds maxClauseCount. Elasticsearch 6.2.4 uses the default for index.query… --- ## [Is there a plan to update nodejs version to v16.17.1 in kibana 7.17?](https://discuss.elastic.co/t/is-there-a-plan-to-update-nodejs-version-to-v16-17-1-in-kibana-7-17/315350)
**Author:** [@tan\_minkee](https://discuss.elastic.co/u/tan_minkee)\ **Replies:** 2\ **Last updated:** [September 28, 2022, 1:30pm UTC](https://discuss.elastic.co/t/is-there-a-plan-to-update-nodejs-version-to-v16-17-1-in-kibana-7-17/315350 "2022-09-28T13:30:53Z")
As per subject. Would like to request kibana v7.17 to update nodejs to v16.17.1 due to its vulnerability in CVE - CVE-2022-35255 (mitre.org) and CVE - CVE-2022-35256 (mitre.org) --- ## [How to Send the alerts to opsgenie from kibana using ALERT-API URL](https://discuss.elastic.co/t/how-to-send-the-alerts-to-opsgenie-from-kibana-using-alert-api-url/315370)
**Author:** [@ankamsandeep](https://discuss.elastic.co/u/ankamsandeep)\ **Replies:** 1\ **Last updated:** [September 28, 2022, 1:02pm UTC](https://discuss.elastic.co/t/how-to-send-the-alerts-to-opsgenie-from-kibana-using-alert-api-url/315370 "2022-09-28T13:02:46Z")
Hi all, I am new to Elastic and Kibana, can anyone help in how can i integrate opsgenie with Kibana using Alert api. Unable to find the solution, if any one of you can assist on this would be really helpful. Looking … --- ## [Why does Elasticsearch's default settings for logging via log4j2 retain such large amounts logs?](https://discuss.elastic.co/t/why-does-elasticsearchs-default-settings-for-logging-via-log4j2-retain-such-large-amounts-logs/315255)
**Author:** [@bassistcz](https://discuss.elastic.co/u/bassistcz)\ **Replies:** 4\ **Last updated:** [September 28, 2022, 12:22pm UTC](https://discuss.elastic.co/t/why-does-elasticsearchs-default-settings-for-logging-via-log4j2-retain-such-large-amounts-logs/315255 "2022-09-28T12:22:33Z")
I am curious about the logging settings for Elasticsearch, (I am running 7.17.3) as they appear much larger then what I typically expect for application logging. I have run into issues where the logs have filled my loggi… --- ## [Add fleet server self signed certificate error](https://discuss.elastic.co/t/add-fleet-server-self-signed-certificate-error/315187)
**Author:** [@david-a76](https://discuss.elastic.co/u/david-a76)\ **Replies:** 2\ **Last updated:** [September 28, 2022, 12:17pm UTC](https://discuss.elastic.co/t/add-fleet-server-self-signed-certificate-error/315187 "2022-09-28T12:17:39Z")
I'm trying to install Fleet with Kabana's Quick Start Wizard. When I run the installer: ./elastic-agent install --fleet-server-es=https://192.168.80.10:9200 --fleet-server-service-token=AAE....MQQ --fleet-server-policy… --- ## [Filebeat Index with Module in Name -\> Alias and ILM](https://discuss.elastic.co/t/filebeat-index-with-module-in-name-alias-and-ilm/315346)
**Author:** [@BoKu](https://discuss.elastic.co/u/BoKu)\ **Replies:** 0\ **Last updated:** [September 28, 2022, 9:50am UTC](https://discuss.elastic.co/t/filebeat-index-with-module-in-name-alias-and-ilm/315346 "2022-09-28T09:50:56Z")
Hello there, i do have the following situation. I run Filebeat on an dedicated server for the panw-Module, with a dedicated Port. Our Paloalto Firewall is shipping the logs via syslog to the filebeat-server. If i run f… --- ## [Found encoding issue with Filebeat MS SQL module](https://discuss.elastic.co/t/found-encoding-issue-with-filebeat-ms-sql-module/315351)
**Author:** [@imad\_orange](https://discuss.elastic.co/u/imad_orange)\ **Replies:** 0\ **Last updated:** [September 28, 2022, 10:03am UTC](https://discuss.elastic.co/t/found-encoding-issue-with-filebeat-ms-sql-module/315351 "2022-09-28T10:03:54Z")
Hello, For people who find a probleme to read files Error of SQL server with the module mssql, you should add encoding: utf-16le-bom in module\\mssql\\log\\config\\config.yml file. Thanks to @varun1992 (Found encoding iss… --- ## [Bucket aggregation And Java client](https://discuss.elastic.co/t/bucket-aggregation-and-java-client/315136)
**Author:** [@Shubh](https://discuss.elastic.co/u/Shubh)\ **Replies:** 1\ **Last updated:** [September 28, 2022, 10:00am UTC](https://discuss.elastic.co/t/bucket-aggregation-and-java-client/315136 "2022-09-28T10:00:02Z")
Hi all, can you help me with my query result the out is not coming as i expected. below is my query pls check if i have to make any changes in the query GET /\_search { "query": { "bool": { "filter": \[ … --- ## [Consultation about a use case](https://discuss.elastic.co/t/consultation-about-a-use-case/315305)
**Author:** [@royassis](https://discuss.elastic.co/u/royassis)\ **Replies:** 1\ **Last updated:** [September 28, 2022, 9:49am UTC](https://discuss.elastic.co/t/consultation-about-a-use-case/315305 "2022-09-28T09:49:56Z")
Hey In my company we are building a awb application. Out application data resided in multiple data sources : aws s3, postgres, mongodb. I was looking for a way to speed up some of the queries. There are some drop dow… --- ## [Lens Download as CSV](https://discuss.elastic.co/t/lens-download-as-csv/315325)
**Author:** [@Anil\_Alapati](https://discuss.elastic.co/u/Anil_Alapati)\ **Replies:** 1\ **Last updated:** [September 28, 2022, 7:58am UTC](https://discuss.elastic.co/t/lens-download-as-csv/315325 "2022-09-28T07:58:22Z")
Hi, I am using Lens method to create bar views on Kibana. I am using Vertical stack bar. Once the Bar Graph is created. I am trying to download the data of the Bar Graph as Csv file. The csv file download has the multip… --- ## [Can I enable Elasticsearch with ssl without authentication](https://discuss.elastic.co/t/can-i-enable-elasticsearch-with-ssl-without-authentication/315322)
**Author:** [@yasin\_mohammed](https://discuss.elastic.co/u/yasin_mohammed)\ **Replies:** 1\ **Last updated:** [September 28, 2022, 7:40am UTC](https://discuss.elastic.co/t/can-i-enable-elasticsearch-with-ssl-without-authentication/315322 "2022-09-28T07:40:42Z")
Hi... As we are planning to use Elasticsearch ssl and have authentication enabled at firewall is it possible disable Elasticsearch authentication and keep only ssl --- ## [Dissect\_parsing\_error for Apache Tomcat Integration](https://discuss.elastic.co/t/dissect-parsing-error-for-apache-tomcat-integration/315330)
**Author:** [@Marko\_Todoric](https://discuss.elastic.co/u/Marko_Todoric)\ **Replies:** 0\ **Last updated:** [September 28, 2022, 7:36am UTC](https://discuss.elastic.co/t/dissect-parsing-error-for-apache-tomcat-integration/315330 "2022-09-28T07:36:13Z")
Hello everyone, I'm running 3 node Elasticsearch Cluster with ES Version 8.3.3. Elastic Agent is running with same version on Ubuntu 18.04.6 and trying to collect logs from Apache Tomcat 8.5.24 by reading catalina.out … --- ## [Kibana 8.4 expanded document views objects in multiple rows](https://discuss.elastic.co/t/kibana-8-4-expanded-document-views-objects-in-multiple-rows/315252)
**Author:** [@Kadir\_Goktas](https://discuss.elastic.co/u/Kadir_Goktas)\ **Replies:** 6\ **Last updated:** [September 28, 2022, 6:58am UTC](https://discuss.elastic.co/t/kibana-8-4-expanded-document-views-objects-in-multiple-rows/315252 "2022-09-28T06:58:57Z")
we have recently upgraded our stack to 8.4 and noticed that when we expand a document object fields are displayed in multiple rows as attached below; previously the field is displayed as a json with a toggle details … --- ## [How to write a range query for a date field with an interval on Elasticsearch?](https://discuss.elastic.co/t/how-to-write-a-range-query-for-a-date-field-with-an-interval-on-elasticsearch/315328)
**Author:** [@Ahkam\_Naseek](https://discuss.elastic.co/u/Ahkam_Naseek)\ **Replies:** 0\ **Last updated:** [September 28, 2022, 6:55am UTC](https://discuss.elastic.co/t/how-to-write-a-range-query-for-a-date-field-with-an-interval-on-elasticsearch/315328 "2022-09-28T06:55:23Z")
This is my current query which fetches documents which are older than 365 days from now. "query": { "bool": { "must": \[ { "match": { "doc\_type": "AP - ACH CHECKS" } }, { "range":… --- ## [Cannot parse suricata.eve.http.content\_range](https://discuss.elastic.co/t/cannot-parse-suricata-eve-http-content-range/315295)
**Author:** [@opoplawski](https://discuss.elastic.co/u/opoplawski)\ **Replies:** 8\ **Last updated:** [September 27, 2022, 11:13pm UTC](https://discuss.elastic.co/t/cannot-parse-suricata-eve-http-content-range/315295 "2022-09-27T23:13:41Z")
I'm using the suricata module from beats 7.17.3 to parse suricata 6.0.4 EVE json logs and I'm getting the following parse error: "error"=\>{"type"=\>"mapper\_parsing\_exception", "reason"=\>"object mapping for \[suricata.eve.… --- ## [Error when connecting to powerBI through ODBC](https://discuss.elastic.co/t/error-when-connecting-to-powerbi-through-odbc/315307)
**Author:** [@David\_Arancibia](https://discuss.elastic.co/u/David_Arancibia)\ **Replies:** 1\ **Last updated:** [September 27, 2022, 8:52pm UTC](https://discuss.elastic.co/t/error-when-connecting-to-powerbi-through-odbc/315307 "2022-09-27T20:52:30Z")
I recently migrated from self hosted ELK to elastic cloud, everything is working well except the ODBC connector to powerBI i've been using. It seems to be able to see the data but for some reason its slightly larger th… --- ## [DeprecationWarning for request\_timeout](https://discuss.elastic.co/t/deprecationwarning-for-request-timeout/315311)
**Author:** [@jeroen1](https://discuss.elastic.co/u/jeroen1)\ **Replies:** 0\ **Last updated:** [September 27, 2022, 8:37pm UTC](https://discuss.elastic.co/t/deprecationwarning-for-request-timeout/315311 "2022-09-27T20:37:45Z")
I initialize my ES connection in Python with Elasticsearch.options(), setting a global timeout. For some complex searches I need a custom (longer) timeout. To achieve this, I use es.search(request\_timeout=timeout, \[..\]).… --- ## [Fleet Custom Logs integration add\_fields processor](https://discuss.elastic.co/t/fleet-custom-logs-integration-add-fields-processor/315070)
**Author:** [@Gustavo\_Llermaly](https://discuss.elastic.co/u/Gustavo_Llermaly)\ **Replies:** 11\ **Last updated:** [September 27, 2022, 8:25pm UTC](https://discuss.elastic.co/t/fleet-custom-logs-integration-add-fields-processor/315070 "2022-09-27T20:25:42Z")
Hello Team, we are trying to add fields to a Custom Logs integration via "Advanced settings" tried many formats but none of them is working: - processors: add\_fields: target: fields: foo:ba… --- ## [Agent returns access denied](https://discuss.elastic.co/t/agent-returns-access-denied/315310)
**Author:** [@simpleman](https://discuss.elastic.co/u/simpleman)\ **Replies:** 0\ **Last updated:** [September 27, 2022, 8:21pm UTC](https://discuss.elastic.co/t/agent-returns-access-denied/315310 "2022-09-27T20:21:34Z")
We have an air gapped network. We use Symantec Endpoint Security. We have successfully installed ELK 8.4.1 on VM. On the same VM we have the fleet server running. The registry is running on docker in another VM. I try to… --- ## [Watcher creation help](https://discuss.elastic.co/t/watcher-creation-help/315309)
**Author:** [@ffmdsuperit](https://discuss.elastic.co/u/ffmdsuperit)\ **Replies:** 0\ **Last updated:** [September 27, 2022, 8:20pm UTC](https://discuss.elastic.co/t/watcher-creation-help/315309 "2022-09-27T20:20:09Z")
Hello! I'm very new to Elasticsearch and I am attempting to create a Watcher, but I just can't seem to put the pieces together. I have a index named "transactions". For that index I run this query "TerminalID : 999999 a… --- ## [Machine Learning low sum is not working as expected](https://discuss.elastic.co/t/machine-learning-low-sum-is-not-working-as-expected/315292)
**Author:** [@Ann\_Abbott](https://discuss.elastic.co/u/Ann_Abbott)\ **Replies:** 1\ **Last updated:** [September 27, 2022, 7:08pm UTC](https://discuss.elastic.co/t/machine-learning-low-sum-is-not-working-as-expected/315292 "2022-09-27T19:08:54Z")
Hi, I am trying to use machine learning - anomaly detection. Whenever I try to use regular sum function it detects both low and high anomalies. High sum is also working expected since it's only showing high anomalies. … --- ## [How to add search\_type in settings](https://discuss.elastic.co/t/how-to-add-search-type-in-settings/314717)
**Author:** [@prashantreddy](https://discuss.elastic.co/u/prashantreddy)\ **Replies:** 4\ **Last updated:** [September 27, 2022, 6:46pm UTC](https://discuss.elastic.co/t/how-to-add-search-type-in-settings/314717 "2022-09-27T18:46:49Z")
Hello, I am pretty new to ES and i use templates for search. we have separate settings file to add analyzers and all. I am trying to add search\_type in same file. is it possible to add search\_type in settings file? i t… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=779) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=781)