# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=781 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 782 --- ## [Filebeat 8.4.2 modules Panw : Panw modules does not parse log correctly](https://discuss.elastic.co/t/filebeat-8-4-2-modules-panw-panw-modules-does-not-parse-log-correctly/315299)
**Author:** [@soufiane\_adn](https://discuss.elastic.co/u/soufiane_adn)\ **Replies:** 0\ **Last updated:** [September 27, 2022, 6:17pm UTC](https://discuss.elastic.co/t/filebeat-8-4-2-modules-panw-panw-modules-does-not-parse-log-correctly/315299 "2022-09-27T18:17:50Z")
hello team, i found a problem with filebeat v 8.4.1 on parsing palo alto logs using panw modules. below the error: field \[generated\_time\] not present as part of path \[temp.generated\_time\] any help? PS: i received th… --- ## [Want term frequency in a individual document text fields with my query results. How?](https://discuss.elastic.co/t/want-term-frequency-in-a-individual-document-text-fields-with-my-query-results-how/315298)
**Author:** [@ljdtenny](https://discuss.elastic.co/u/ljdtenny)\ **Replies:** 0\ **Last updated:** [September 27, 2022, 6:01pm UTC](https://discuss.elastic.co/t/want-term-frequency-in-a-individual-document-text-fields-with-my-query-results-how/315298 "2022-09-27T18:01:37Z")
I have a text field which has large text values. I do a query, get my hits, highlights, all good. There's just one more thing I want. For each hit of my SIZE hits, I want the term frequency of the query term(s) within… --- ## [Generate reports from a script in CSV is not working](https://discuss.elastic.co/t/generate-reports-from-a-script-in-csv-is-not-working/314876)
**Author:** [@thirty2](https://discuss.elastic.co/u/thirty2)\ **Replies:** 4\ **Last updated:** [September 27, 2022, 5:33pm UTC](https://discuss.elastic.co/t/generate-reports-from-a-script-in-csv-is-not-working/314876 "2022-09-27T17:33:38Z")
Hi, i am trying to use a script to generate reports in CSV and i am following the steps as written in the documentation here When i try to run a curl command i am getting error like this: {"error":"Incorrect HTTP me… --- ## [Action \[indices:admin/flush\[s\]\] is unauthorized for user \[admin\] with roles \[superuser\] on restricted indices \[.kibana\_task\_manager\_7.17.5\_001\], this action is granted by the index privileges \[maintenance,manage,all\]](https://discuss.elastic.co/t/action-indices-admin-flush-s-is-unauthorized-for-user-admin-with-roles-superuser-on-restricted-indices-kibana-task-manager-7-17-5-001-this-action-is-granted-by-the-index-privileges-maintenance-manage-all/315291)
**Author:** [@Leonardo\_Henrique](https://discuss.elastic.co/u/Leonardo_Henrique)\ **Replies:** 1\ **Last updated:** [September 27, 2022, 5:27pm UTC](https://discuss.elastic.co/t/action-indices-admin-flush-s-is-unauthorized-for-user-admin-with-roles-superuser-on-restricted-indices-kibana-task-manager-7-17-5-001-this-action-is-granted-by-the-index-privileges-maintenance-manage-all/315291 "2022-09-27T17:27:40Z")
Hello, guys! I am running a rolling upgrade in a cluster 7.17.5 to 8.3.2. When I try to run the GET /\_flush I am receiving this error as return { "\_shards" : { "total" : 148, "successful" : 77, "failed" … --- ## [Error while fetching resource Kibana APM](https://discuss.elastic.co/t/error-while-fetching-resource-kibana-apm/315284)
**Author:** [@danksim](https://discuss.elastic.co/u/danksim)\ **Replies:** 1\ **Last updated:** [September 27, 2022, 4:07pm UTC](https://discuss.elastic.co/t/error-while-fetching-resource-kibana-apm/315284 "2022-09-27T16:07:55Z")
elasticsearch, logstash, kibana: 7.17.3 apm-server: 7.5.2 I am getting the following error when trying to access the APM tab on Kibana: Error while fetching resource search\_phase\_execution\_exception: \[illegal\_argume… --- ## [Search for documents containing an item not present in a list](https://discuss.elastic.co/t/search-for-documents-containing-an-item-not-present-in-a-list/314958)
**Author:** [@Adrian\_Fresco](https://discuss.elastic.co/u/Adrian_Fresco)\ **Replies:** 2\ **Last updated:** [September 27, 2022, 3:48pm UTC](https://discuss.elastic.co/t/search-for-documents-containing-an-item-not-present-in-a-list/314958 "2022-09-27T15:48:40Z")
I have indexed documents that contain a field name with a string value: \[ { "fruits": \[ { "name": "apple", "color": "red" }, { … --- ## [403 Forbidden when using '"es.nodes.path.prefix" pyspark 8.4.1 pyspark 3.3](https://discuss.elastic.co/t/403-forbidden-when-using-es-nodes-path-prefix-pyspark-8-4-1-pyspark-3-3/315084)
**Author:** [@rbigley](https://discuss.elastic.co/u/rbigley)\ **Replies:** 8\ **Last updated:** [September 27, 2022, 3:42pm UTC](https://discuss.elastic.co/t/403-forbidden-when-using-es-nodes-path-prefix-pyspark-8-4-1-pyspark-3-3/315084 "2022-09-27T15:42:01Z")
Pyspark 3.3 with elasticsearch-spark-30\_2.12-8.4.1.jar (I've also tried with the elasticsearch-spark-30\_2.12-717.6.jar with same result) I have access to the index and have validated via curl and the normal python elas… --- ## [Logstash on docker not listening to port](https://discuss.elastic.co/t/logstash-on-docker-not-listening-to-port/315285)
**Author:** [@Juan\_Fernandez\_Bern1](https://discuss.elastic.co/u/Juan_Fernandez_Bern1)\ **Replies:** 0\ **Last updated:** [September 27, 2022, 3:33pm UTC](https://discuss.elastic.co/t/logstash-on-docker-not-listening-to-port/315285 "2022-09-27T15:33:49Z")
Hello, im running logstash with docker-compose and for some reason im unable to listen to port 9015 in one of the nodes. image: docker.elastic.co/logstash/logstash:7.12.0 container\_name: logstash-node03 port… --- ## [Enable CORS settings in a Self-Managed Azure Cluster?](https://discuss.elastic.co/t/enable-cors-settings-in-a-self-managed-azure-cluster/315282)
**Author:** [@Dante\_Nahuel](https://discuss.elastic.co/u/Dante_Nahuel)\ **Replies:** 0\ **Last updated:** [September 27, 2022, 3:20pm UTC](https://discuss.elastic.co/t/enable-cors-settings-in-a-self-managed-azure-cluster/315282 "2022-09-27T15:20:36Z")
Hi I deployed an Azure Elasticsearch Self-Managed cluster. According to our Dev team, we need to enable CORS by adding these settings into the Configuration File yaml: "http.cors.enabled": true, "http.cors.allo… --- ## [User control and management](https://discuss.elastic.co/t/user-control-and-management/315279)
**Author:** [@meyer1](https://discuss.elastic.co/u/meyer1)\ **Replies:** 1\ **Last updated:** [September 27, 2022, 3:18pm UTC](https://discuss.elastic.co/t/user-control-and-management/315279 "2022-09-27T15:18:58Z")
Hello everyone, I need a little information, is it possible to create a user on kibana and give him access to a certain dashboard? Or is he obliged to have access to all of them? If it is possible to do it, how to do i… --- ## [Winlogbeat Sending Bad Json Message](https://discuss.elastic.co/t/winlogbeat-sending-bad-json-message/315271)
**Author:** [@Rohit\_Kumbhar](https://discuss.elastic.co/u/Rohit_Kumbhar)\ **Replies:** 0\ **Last updated:** [September 27, 2022, 2:16pm UTC](https://discuss.elastic.co/t/winlogbeat-sending-bad-json-message/315271 "2022-09-27T14:16:02Z")
Hi @elastic Team, All versions are 7.16.2 My Setup is Winlogbeat(logstash output)=\>(beats input)collector(logstash TCP output)=\> (tcp input)loadbalancer(elastic output) I am able to receive most of the data from serve… --- ## [Facing communication issue while sending data from SQL to logstash](https://discuss.elastic.co/t/facing-communication-issue-while-sending-data-from-sql-to-logstash/315269)
**Author:** [@Bhanuji\_paluri](https://discuss.elastic.co/u/Bhanuji_paluri)\ **Replies:** 0\ **Last updated:** [September 27, 2022, 2:08pm UTC](https://discuss.elastic.co/t/facing-communication-issue-while-sending-data-from-sql-to-logstash/315269 "2022-09-27T14:08:41Z")
find the logs from logstash side. \[2022-09-27T15:47:00,258\]\[ERROR\]\[logstash.inputs.jdbc \]\[test\]\[f4db26278744478bf3c5e76b57171244092a989c2d32ce74f9029d5a6e668706\] Unable to connect to database. Tried 1 times {:error\_… --- ## [Boost value depending on number of common terms](https://discuss.elastic.co/t/boost-value-depending-on-number-of-common-terms/315267)
**Author:** [@pzmudzinski](https://discuss.elastic.co/u/pzmudzinski)\ **Replies:** 0\ **Last updated:** [September 27, 2022, 2:05pm UTC](https://discuss.elastic.co/t/boost-value-depending-on-number-of-common-terms/315267 "2022-09-27T14:05:10Z")
Assuming we have index called users and each of them have hobbies stored as array of strings like :\["basketball", "games"\]. We want to fetch users with common hobbies, although we want to boost users with more than one … --- ## [Default elastic user with superuser role has no access to APM API](https://discuss.elastic.co/t/default-elastic-user-with-superuser-role-has-no-access-to-apm-api/314955)
**Author:** [@danksim](https://discuss.elastic.co/u/danksim)\ **Replies:** 5\ **Last updated:** [September 27, 2022, 1:54pm UTC](https://discuss.elastic.co/t/default-elastic-user-with-superuser-role-has-no-access-to-apm-api/314955 "2022-09-27T13:54:36Z")
Elasticsearch and Kibana are both running v7.6.2 on EKS using Helm When logged in as the default elastic user with the superuser role, I am getting a 500 Internal Server Error when making requests to the APM API in the … --- ## [Default Index Pattern (logstash-yyyy.MM.dd) Failing](https://discuss.elastic.co/t/default-index-pattern-logstash-yyyy-mm-dd-failing/315195)
**Author:** [@scriner](https://discuss.elastic.co/u/scriner)\ **Replies:** 7\ **Last updated:** [September 27, 2022, 1:33pm UTC](https://discuss.elastic.co/t/default-index-pattern-logstash-yyyy-mm-dd-failing/315195 "2022-09-27T13:33:43Z")
Hi all. We are using the following pipeline config file to ship syslogs to Logstash: input { tcp { port =\> 1514 codec =\> "json" type =\> "syslog" } udp { port =\> 1514 codec =\> "json" type =\> … --- ## [Search within "text" field in discover mode](https://discuss.elastic.co/t/search-within-text-field-in-discover-mode/314120)
**Author:** [@Mark\_S](https://discuss.elastic.co/u/Mark_S)\ **Replies:** 4\ **Last updated:** [September 27, 2022, 1:05pm UTC](https://discuss.elastic.co/t/search-within-text-field-in-discover-mode/314120 "2022-09-27T13:05:28Z")
kibana filters in "discover" mode seem to have "exist", "is", "is not" but no "contains" value. Is there any way to use "contains" for a text field? e.g. with Elasticsearch Query DSL? --- ## [How to chain multiple input in Logstash](https://discuss.elastic.co/t/how-to-chain-multiple-input-in-logstash/315179)
**Author:** [@anand\_tripathi](https://discuss.elastic.co/u/anand_tripathi)\ **Replies:** 3\ **Last updated:** [September 27, 2022, 12:50pm UTC](https://discuss.elastic.co/t/how-to-chain-multiple-input-in-logstash/315179 "2022-09-27T12:50:47Z")
My use case is something like below First Input(Mysql JDBC) I'm selecting some data from MySQL like select pk\_id, score, other\_id from \ Second Chained Input (Elasticsearch) Then I want to pass the data p… --- ## [How to modify scores of documents based on partial and exact match](https://discuss.elastic.co/t/how-to-modify-scores-of-documents-based-on-partial-and-exact-match/315010)
**Author:** [@Binish\_Shams](https://discuss.elastic.co/u/Binish_Shams)\ **Replies:** 2\ **Last updated:** [September 27, 2022, 12:11pm UTC](https://discuss.elastic.co/t/how-to-modify-scores-of-documents-based-on-partial-and-exact-match/315010 "2022-09-27T12:11:08Z")
Hello I am finding a solution to achieve a scenario where an index having suppose 10 records each record having last name, first name and phone number etc fields and I want to do partial match and exact match for these f… --- ## [FATAL Error: "elastalert-kibana-plugin.serverHost" and "elastalert-kibana-plugin.serverPort" settings were not applied](https://discuss.elastic.co/t/fatal-error-elastalert-kibana-plugin-serverhost-and-elastalert-kibana-plugin-serverport-settings-were-not-applied/315242)
**Author:** [@MdRashid](https://discuss.elastic.co/u/MdRashid)\ **Replies:** 1\ **Last updated:** [September 27, 2022, 11:48am UTC](https://discuss.elastic.co/t/fatal-error-elastalert-kibana-plugin-serverhost-and-elastalert-kibana-plugin-serverport-settings-were-not-applied/315242 "2022-09-27T11:48:48Z")
Issue or Error i got #docker logs elk\_kibana.1.nobzh4lt68m3wgacvuh3vfijs {"type":"log","@timestamp":"2022-09-27T08:46:23Z","tags":\["fatal","root"\],"pid":1,"message":"{ Error: \\"elastalert-kibana-plugin.serverHost\\" and… --- ## [The data store is normal, and the fuzzy search is empty？](https://discuss.elastic.co/t/the-data-store-is-normal-and-the-fuzzy-search-is-empty/315238)
**Author:** [@kingsKangKang](https://discuss.elastic.co/u/kingsKangKang)\ **Replies:** 5\ **Last updated:** [September 27, 2022, 11:05am UTC](https://discuss.elastic.co/t/the-data-store-is-normal-and-the-fuzzy-search-is-empty/315238 "2022-09-27T11:05:45Z")
I have a piece of data that says: 善恩康生物科技(苏州)有限公司 Field is： {"name": {"type": "text","analyzer": "ik\_max\_word", "search\_analyzer": "ik\_smart" }} My search statement is: {"query":{"match\_phrase":{"name":{"query":"善恩康… --- ## [Bm25 tune parameters using elasticsearch](https://discuss.elastic.co/t/bm25-tune-parameters-using-elasticsearch/315245)
**Author:** [@dayzero](https://discuss.elastic.co/u/dayzero)\ **Replies:** 0\ **Last updated:** [September 27, 2022, 9:52am UTC](https://discuss.elastic.co/t/bm25-tune-parameters-using-elasticsearch/315245 "2022-09-27T09:52:22Z")
Hi, I indexed the data with some b and k1 values of the default bm25 algorithm. The thing is implementing relevance feedback on the search engine to tune those b and k1 values. How can I not use reindexing for each time… --- ## [Update document structure without duplication](https://discuss.elastic.co/t/update-document-structure-without-duplication/315244)
**Author:** [@reed](https://discuss.elastic.co/u/reed)\ **Replies:** 0\ **Last updated:** [September 27, 2022, 9:27am UTC](https://discuss.elastic.co/t/update-document-structure-without-duplication/315244 "2022-09-27T09:27:26Z")
Hi all, I need to read alla index documents and for all add a new field with default value, my code is this: input { elasticsearch { hosts =\> \["http://myelastic:9200"\] index =\> "myindex-txt" user =\> aaa passwor… --- ## [Unable to find certificate for ca\_cert argument while connecting to kibana (for developer)](https://discuss.elastic.co/t/unable-to-find-certificate-for-ca-cert-argument-while-connecting-to-kibana-for-developer/314377)
**Author:** [@Azhar\_Uddin1](https://discuss.elastic.co/u/Azhar_Uddin1)\ **Replies:** 2\ **Last updated:** [September 27, 2022, 9:07am UTC](https://discuss.elastic.co/t/unable-to-find-certificate-for-ca-cert-argument-while-connecting-to-kibana-for-developer/314377 "2022-09-27T09:07:28Z")
When downloading elastic kibana for here we were getting the certificate in a terminal which look like below HTTP CA certificate SHA-256 fingerprint: a52dd93511e8c6045e21f16654b77c9ee0f34aea26d9f40320b531c474676228 I… --- ## [Phrase query with collate with Elastic Java Client 8.4](https://discuss.elastic.co/t/phrase-query-with-collate-with-elastic-java-client-8-4/315218)
**Author:** [@Peter\_Strasser](https://discuss.elastic.co/u/Peter_Strasser)\ **Replies:** 6\ **Last updated:** [September 27, 2022, 8:59am UTC](https://discuss.elastic.co/t/phrase-query-with-collate-with-elastic-java-client-8-4/315218 "2022-09-27T08:59:51Z")
Hi Elastic Community, I am looking to run a phrase suggestion with the collate parameter in the Elastic Java Client Version 8.4., but I can not get any working example running. I currently encounter 2 problems: The … --- ## [Retrieving script field in elasticsearch for ML](https://discuss.elastic.co/t/retrieving-script-field-in-elasticsearch-for-ml/315165)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 2\ **Last updated:** [September 27, 2022, 8:56am UTC](https://discuss.elastic.co/t/retrieving-script-field-in-elasticsearch-for-ml/315165 "2022-09-27T08:56:43Z")
Hi Team I added this field recently and now i have to apply high function in this field using single metric ML. But this field is not showin , i know this is runtime field but is there any solution for this. --- ## [Add total row in Canvas Datatable](https://discuss.elastic.co/t/add-total-row-in-canvas-datatable/315144)
**Author:** [@Chiaaa](https://discuss.elastic.co/u/Chiaaa)\ **Replies:** 2\ **Last updated:** [September 27, 2022, 8:35am UTC](https://discuss.elastic.co/t/add-total-row-in-canvas-datatable/315144 "2022-09-27T08:35:36Z")
Hi everyone, I have a question: I need to add a line with totals on my Canvas datatable. It's possibile ? I created in Canvas a table with ES SQL Query and I cannot import Table object from Kibana, because in Canvas I… --- ## [Elasticsearch index\_search\_slowlog.log has error](https://discuss.elastic.co/t/elasticsearch-index-search-slowlog-log-has-error/315240)
**Author:** [@hellocomputer](https://discuss.elastic.co/u/hellocomputer)\ **Replies:** 0\ **Last updated:** [September 27, 2022, 7:26am UTC](https://discuss.elastic.co/t/elasticsearch-index-search-slowlog-log-has-error/315240 "2022-09-27T07:26:36Z")
Hello, I'm working with Elasticsearch 7.14.0 version in ubuntu 18.04 version. We want to gain "search keyword" from Elasticsearch slow log. Suddenly, Elasticsearch doesn't make new search log. What is the problem in thi… --- ## [Cisco Filebeat module (umbrella) - Improve ECS utilization](https://discuss.elastic.co/t/cisco-filebeat-module-umbrella-improve-ecs-utilization/315127)
**Author:** [@aforfot](https://discuss.elastic.co/u/aforfot)\ **Replies:** 2\ **Last updated:** [September 27, 2022, 7:15am UTC](https://discuss.elastic.co/t/cisco-filebeat-module-umbrella-improve-ecs-utilization/315127 "2022-09-27T07:15:28Z")
We are ingesting Cisco Umbrella data into our Elasticsearch for search, detection in Elastic Security and visualization through Kibana. However, we have noticed a few specific fields where the Cisco module does not optim… --- ## [Office 365 Filebeat Module - Improve ECS utilization](https://discuss.elastic.co/t/office-365-filebeat-module-improve-ecs-utilization/315126)
**Author:** [@aforfot](https://discuss.elastic.co/u/aforfot)\ **Replies:** 2\ **Last updated:** [September 27, 2022, 7:14am UTC](https://discuss.elastic.co/t/office-365-filebeat-module-improve-ecs-utilization/315126 "2022-09-27T07:14:29Z")
We are ingesting O365 data into our Elasticsearch for search, detection in Elastic Security and visualiation through Kibana. However, we have noticed a few areas for improvement within the module. What is most interestin… --- ## [Microsoft Filebeat Module - Lack of ECS utilization](https://discuss.elastic.co/t/microsoft-filebeat-module-lack-of-ecs-utilization/315125)
**Author:** [@aforfot](https://discuss.elastic.co/u/aforfot)\ **Replies:** 6\ **Last updated:** [September 27, 2022, 7:12am UTC](https://discuss.elastic.co/t/microsoft-filebeat-module-lack-of-ecs-utilization/315125 "2022-09-27T07:12:21Z")
We are ingesting Microsoft ATP and M365 Defender data into our Elasticsearch for search, detection in Elastic Security, and visualization through Kibana. However, we have noticed a few specific fields where the Microsoft… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=780) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=782)