# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=792 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 793 --- ## [Issues with outside certificate provider - nodes not connecting](https://discuss.elastic.co/t/issues-with-outside-certificate-provider-nodes-not-connecting/312307)
**Author:** [@jamesp](https://discuss.elastic.co/u/jamesp)\ **Replies:** 7\ **Last updated:** [September 15, 2022, 10:02pm UTC](https://discuss.elastic.co/t/issues-with-outside-certificate-provider-nodes-not-connecting/312307 "2022-09-15T22:02:50Z")
Hello, I set up a test instance of elasticsearch 7.11.1 on a Windows VM and created the certificates for SSL encryption following the processes in the documentation, which worked without an issue. I then created CSR's … --- ## [Match filter queries with OR instead of AND](https://discuss.elastic.co/t/match-filter-queries-with-or-instead-of-and/314533)
**Author:** [@mattshubs](https://discuss.elastic.co/u/mattshubs)\ **Replies:** 0\ **Last updated:** [September 15, 2022, 7:15pm UTC](https://discuss.elastic.co/t/match-filter-queries-with-or-instead-of-and/314533 "2022-09-15T19:15:01Z")
Hi, I am setting up alerting off of kibana logs search. Was not able to find documention for my desired use case. Is there a way to match multiple queries under a filter with OR instead of AND? This is \*.yml file. Examp… --- ## [Filebeat 8.4.1: Autodiscovery and processor not working as expected as per the doc](https://discuss.elastic.co/t/filebeat-8-4-1-autodiscovery-and-processor-not-working-as-expected-as-per-the-doc/314530)
**Author:** [@Ivan\_Gonzalez](https://discuss.elastic.co/u/Ivan_Gonzalez)\ **Replies:** 0\ **Last updated:** [September 15, 2022, 5:12pm UTC](https://discuss.elastic.co/t/filebeat-8-4-1-autodiscovery-and-processor-not-working-as-expected-as-per-the-doc/314530 "2022-09-15T17:12:13Z")
Hi. I am new to filebeat (previously using fluentbit to send kubernetes logs to graylog) and I am struggling with some things that seems not to work as it is in the doc. Maybe I am missing something, so please be benevo… --- ## [Logstash cipher fragment error](https://discuss.elastic.co/t/logstash-cipher-fragment-error/314523)
**Author:** [@RaonyO](https://discuss.elastic.co/u/RaonyO)\ **Replies:** 3\ **Last updated:** [September 15, 2022, 3:41pm UTC](https://discuss.elastic.co/t/logstash-cipher-fragment-error/314523 "2022-09-15T15:41:03Z")
I have an error in a pipeline in logstash, the input is via tcp and ssl. config: input { tcp { port =\> 7771 codec =\> line ssl\_verify =\> false ssl\_enable =\> true ssl\_cert =\> "/etc/logstash/certs/cert.crt… --- ## [RequestOption](https://discuss.elastic.co/t/requestoption/314516)
**Author:** [@avnere](https://discuss.elastic.co/u/avnere)\ **Replies:** 1\ **Last updated:** [September 15, 2022, 2:39pm UTC](https://discuss.elastic.co/t/requestoption/314516 "2022-09-15T14:39:32Z")
What does RequestOptions means? When we need to custom it? client.bulk(\_bulkRequest, RequestOptions.DEFAULT); --- ## [Ways to build Json doc in ES8 Java API client](https://discuss.elastic.co/t/ways-to-build-json-doc-in-es8-java-api-client/314459)
**Author:** [@ijaxahmed](https://discuss.elastic.co/u/ijaxahmed)\ **Replies:** 1\ **Last updated:** [September 15, 2022, 2:22pm UTC](https://discuss.elastic.co/t/ways-to-build-json-doc-in-es8-java-api-client/314459 "2022-09-15T14:22:09Z")
How to build Json document In Elasticsearch 8 API client , as In older Client APIs its possible to build using XContentBuilder like XContentBuilder builder = jsonBuilder() .startObject() .field("firstName", … --- ## [How is the state (last read file or position in a file) is maintained for multiple pods running logstash](https://discuss.elastic.co/t/how-is-the-state-last-read-file-or-position-in-a-file-is-maintained-for-multiple-pods-running-logstash/314502)
**Author:** [@Jyoti\_Patel](https://discuss.elastic.co/u/Jyoti_Patel)\ **Replies:** 4\ **Last updated:** [September 15, 2022, 2:12pm UTC](https://discuss.elastic.co/t/how-is-the-state-last-read-file-or-position-in-a-file-is-maintained-for-multiple-pods-running-logstash/314502 "2022-09-15T14:12:00Z")
Hi Everyone, I just have a query regarding last read s3 file or the last read line in the s3 file. How or where is that data stored? and how is that shared among multiple pods running logstash? What if the pod is repl… --- ## [Metricbeat - Azure: Linux OS Guest metrics not included in compute\_vm metricset](https://discuss.elastic.co/t/metricbeat-azure-linux-os-guest-metrics-not-included-in-compute-vm-metricset/314519)
**Author:** [@Harm](https://discuss.elastic.co/u/Harm)\ **Replies:** 0\ **Last updated:** [September 15, 2022, 2:00pm UTC](https://discuss.elastic.co/t/metricbeat-azure-linux-os-guest-metrics-not-included-in-compute-vm-metricset/314519 "2022-09-15T14:00:04Z")
Hi, I have created a data collection rule in Azure Monitor to collect both Windows and Linux Guest OS metrics (type: Performance Counters). I was happily surprised to see that the Windows Guest OS metrics are already co… --- ## [Has support for percolating multiple EXISTING documents been added?](https://discuss.elastic.co/t/has-support-for-percolating-multiple-existing-documents-been-added/314450)
**Author:** [@fedreg](https://discuss.elastic.co/u/fedreg)\ **Replies:** 2\ **Last updated:** [September 15, 2022, 1:52pm UTC](https://discuss.elastic.co/t/has-support-for-percolating-multiple-existing-documents-been-added/314450 "2022-09-15T13:52:49Z")
Hello! Question about Percolator Queries in ES 8.x... Wondering if the ability to query multiple EXISTING docs has been added to the API? I know I can query multiple raw documents such as GET /my-index-000001/\_search… --- ## [CSV Export not available when xpack.reporting.roles.enabled set to false](https://discuss.elastic.co/t/csv-export-not-available-when-xpack-reporting-roles-enabled-set-to-false/313445)
**Author:** [@Harm](https://discuss.elastic.co/u/Harm)\ **Replies:** 5\ **Last updated:** [September 15, 2022, 1:49pm UTC](https://discuss.elastic.co/t/csv-export-not-available-when-xpack-reporting-roles-enabled-set-to-false/313445 "2022-09-15T13:49:48Z")
Hi, since the xpack.reporting.roles settings are deprecated since v7.14.0, I have disabled the use of the reporting role in our 7.17.6 environment by setting: xpack.reporting.roles.enabled: false The new subfeatures … --- ## [Logstash and filebeat data streams](https://discuss.elastic.co/t/logstash-and-filebeat-data-streams/314488)
**Author:** [@gborg](https://discuss.elastic.co/u/gborg)\ **Replies:** 1\ **Last updated:** [September 15, 2022, 1:24pm UTC](https://discuss.elastic.co/t/logstash-and-filebeat-data-streams/314488 "2022-09-15T13:24:35Z")
Hello I have a setup where I run filebeats, which send their logs to a queue, logstash reads off the queue and writes the data to elasticsearch. With version 7 I had no issues, I recently upgraded to elasticsearch to e… --- ## [Elasticsearch cut strings with forward slash](https://discuss.elastic.co/t/elasticsearch-cut-strings-with-forward-slash/314355)
**Author:** [@abolinhas](https://discuss.elastic.co/u/abolinhas)\ **Replies:** 1\ **Last updated:** [September 15, 2022, 12:43pm UTC](https://discuss.elastic.co/t/elasticsearch-cut-strings-with-forward-slash/314355 "2022-09-15T12:43:43Z")
I have configured my squid proxy to send the logs to Elasticsearch 7.17.6, everything is working fine, except the USER mapping. The string expect is DOMAIN/USER, the ELK recieves it correctly on original message but the… --- ## [While creating new dashboard and search I get fields just from one index](https://discuss.elastic.co/t/while-creating-new-dashboard-and-search-i-get-fields-just-from-one-index/314416)
**Author:** [@111363](https://discuss.elastic.co/u/111363)\ **Replies:** 3\ **Last updated:** [September 15, 2022, 11:38am UTC](https://discuss.elastic.co/t/while-creating-new-dashboard-and-search-i-get-fields-just-from-one-index/314416 "2022-09-15T11:38:34Z")
Hi, I have few indexes in Kibana ("index1", "index2", ...). I have created a new dashboard. Added some visualizations that I created with "index2". Now I use search for filter data but the only fields I get are from "i… --- ## [Search a string in Kibana](https://discuss.elastic.co/t/search-a-string-in-kibana/314468)
**Author:** [@sree3](https://discuss.elastic.co/u/sree3)\ **Replies:** 2\ **Last updated:** [September 15, 2022, 11:01am UTC](https://discuss.elastic.co/t/search-a-string-in-kibana/314468 "2022-09-15T11:01:34Z")
Hi, We could see below custom message from one of the indices. I'm trying to filter a string "heap.memory.used/total=7" so that an action can triggered if the used heap memory used greater than 9\*%. Every time if is try… --- ## [Fetch results with wildcard issue](https://discuss.elastic.co/t/fetch-results-with-wildcard-issue/314254)
**Author:** [@mani7](https://discuss.elastic.co/u/mani7)\ **Replies:** 2\ **Last updated:** [September 15, 2022, 10:22am UTC](https://discuss.elastic.co/t/fetch-results-with-wildcard-issue/314254 "2022-09-15T10:22:52Z")
is there have any way to fetch elastic results with lower case letter with wildcard. but data in elastic index is in capital letter. --- ## [Rang query with format](https://discuss.elastic.co/t/rang-query-with-format/314495)
**Author:** [@casterQ](https://discuss.elastic.co/u/casterQ)\ **Replies:** 0\ **Last updated:** [September 15, 2022, 9:59am UTC](https://discuss.elastic.co/t/rang-query-with-format/314495 "2022-09-15T09:59:51Z")
This DSL works: POST xxxxx/\_search?size=1 { "profile": "true", "query": { "range": { "date\_createdAt": { "gte": "2005W161", "lt": "2005W171", "format": "basic\_week\_date" } … --- ## [Functionbeat unable to extract microsecond @timestamp using decode\_json\_fields](https://discuss.elastic.co/t/functionbeat-unable-to-extract-microsecond-timestamp-using-decode-json-fields/314494)
**Author:** [@adrian-skybaker](https://discuss.elastic.co/u/adrian-skybaker)\ **Replies:** 0\ **Last updated:** [September 15, 2022, 9:55am UTC](https://discuss.elastic.co/t/functionbeat-unable-to-extract-microsecond-timestamp-using-decode-json-fields/314494 "2022-09-15T09:55:15Z")
I'm having issues extracting a @timestamp field from a nested JSON string (in standard ISO format), It works if the nested timestamp has millisecond precision. It doesn't if it has microsecond or nanosecond precision. T… --- ## [Best practice of using volumes across a cluster](https://discuss.elastic.co/t/best-practice-of-using-volumes-across-a-cluster/314483)
**Author:** [@Dmitry\_Kulik](https://discuss.elastic.co/u/Dmitry_Kulik)\ **Replies:** 4\ **Last updated:** [September 15, 2022, 9:51am UTC](https://discuss.elastic.co/t/best-practice-of-using-volumes-across-a-cluster/314483 "2022-09-15T09:51:10Z")
Hi all. Wanted to ask you, what is the best approach for using volumes within a cluster? So basically I have a cluster with 3 master/data nodes (combined, not separate). And I want to increase this cluster and not lose … --- ## [Logs from filebeat not being written to kafka topic](https://discuss.elastic.co/t/logs-from-filebeat-not-being-written-to-kafka-topic/314490)
**Author:** [@shivendra95](https://discuss.elastic.co/u/shivendra95)\ **Replies:** 0\ **Last updated:** [September 15, 2022, 9:38am UTC](https://discuss.elastic.co/t/logs-from-filebeat-not-being-written-to-kafka-topic/314490 "2022-09-15T09:38:29Z")
Hi, I have filebeat application deployed on ec2 instance. I'm trying to connect to kafka that is deployed on EKS cluster. When I'm trying to connect to kafka, the connection gets established but nothing is being writte… --- ## ["latest" continuous transform destination index does not have all unique key docs consistently/continually](https://discuss.elastic.co/t/latest-continuous-transform-destination-index-does-not-have-all-unique-key-docs-consistently-continually/314414)
**Author:** [@Mark\_Duncan](https://discuss.elastic.co/u/Mark_Duncan)\ **Replies:** 6\ **Last updated:** [September 15, 2022, 9:27am UTC](https://discuss.elastic.co/t/latest-continuous-transform-destination-index-does-not-have-all-unique-key-docs-consistently-continually/314414 "2022-09-15T09:27:38Z")
I have the following latest continuous transform running. The source index has 10 unique key values. The destination index, at various times, will have between 1 and 10 docs in it when I view (and repeatedly refresh) th… --- ## [Snapshot - no space left on device](https://discuss.elastic.co/t/snapshot-no-space-left-on-device/314486)
**Author:** [@mcosta](https://discuss.elastic.co/u/mcosta)\ **Replies:** 0\ **Last updated:** [September 15, 2022, 9:11am UTC](https://discuss.elastic.co/t/snapshot-no-space-left-on-device/314486 "2022-09-15T09:11:27Z")
Hi all, Today we run out of disk space for snapshots. The major problem is that it's impossible to delete old snapshots when there is no space left. I faced this problem in the past and was able to manage it by doing … --- ## [Logic Error after ingesting number](https://discuss.elastic.co/t/logic-error-after-ingesting-number/314331)
**Author:** [@hnf](https://discuss.elastic.co/u/hnf)\ **Replies:** 7\ **Last updated:** [September 15, 2022, 8:32am UTC](https://discuss.elastic.co/t/logic-error-after-ingesting-number/314331 "2022-09-15T08:32:38Z")
I have an xlsx file that I convert in CSV file using ssconvert tool. In the new generated file, there's one field in floating point type. But after ingestion, the values taken from the file is no more in float. For exem… --- ## [Increase interval of Lens "last value"](https://discuss.elastic.co/t/increase-interval-of-lens-last-value/312727)
**Author:** [@A\_Chichi](https://discuss.elastic.co/u/A_Chichi)\ **Replies:** 6\ **Last updated:** [September 15, 2022, 7:27am UTC](https://discuss.elastic.co/t/increase-interval-of-lens-last-value/312727 "2022-09-15T07:27:56Z")
Hello, I've created serveral Lens visualizations with "last value" parameter. My datas are ingested once per day. The "last value" parameter of Lens visualization has an interval of 3 hours : How can I increase that … --- ## [FATAL CLI ERROR Error: EACCES: permission denied, open '/etc/kibana/kibana.yml'](https://discuss.elastic.co/t/fatal-cli-error-error-eacces-permission-denied-open-etc-kibana-kibana-yml/314474)
**Author:** [@Neyo](https://discuss.elastic.co/u/Neyo)\ **Replies:** 1\ **Last updated:** [September 15, 2022, 4:33am UTC](https://discuss.elastic.co/t/fatal-cli-error-error-eacces-permission-denied-open-etc-kibana-kibana-yml/314474 "2022-09-15T04:33:25Z")
am unable to access the webpage via ip-address it gives "Unable to Connect Error" but without configuring I can access that with the localhost:5601/?code=xxxxxx and having the enrollment token messi@football:/etc$ sudo … --- ## [How to search for specific word and exact match in Elasticsearch](https://discuss.elastic.co/t/how-to-search-for-specific-word-and-exact-match-in-elasticsearch/314471)
**Author:** [@Amitav](https://discuss.elastic.co/u/Amitav)\ **Replies:** 1\ **Last updated:** [September 15, 2022, 5:49am UTC](https://discuss.elastic.co/t/how-to-search-for-specific-word-and-exact-match-in-elasticsearch/314471 "2022-09-15T05:49:10Z")
sample data for title actiontype test booleanTest test-demo test\_demo Test new account object sync accounts data test default Mapping for title "title": { "type": "text", "fields": { "keyword… --- ## [Error 7024 windows 10 pro](https://discuss.elastic.co/t/error-7024-windows-10-pro/313812)
**Author:** [@David\_Dudi\_Hefer](https://discuss.elastic.co/u/David_Dudi_Hefer)\ **Replies:** 15\ **Last updated:** [September 15, 2022, 5:41am UTC](https://discuss.elastic.co/t/error-7024-windows-10-pro/313812 "2022-09-15T05:41:39Z")
The Elasticsearch 7.16.3 (elasticsearch-service-x64) service terminated with the following service-specific error: Incorrect function. can't browse localhost:9200 please help !! --- ## [From Kibana Server not ready yet to Unable to Connect Error](https://discuss.elastic.co/t/from-kibana-server-not-ready-yet-to-unable-to-connect-error/314415)
**Author:** [@Neophyte](https://discuss.elastic.co/u/Neophyte)\ **Replies:** 1\ **Last updated:** [September 15, 2022, 4:39am UTC](https://discuss.elastic.co/t/from-kibana-server-not-ready-yet-to-unable-to-connect-error/314415 "2022-09-15T04:39:31Z")
Earlier I was receiving that "Kibana Server is not ready yet." and after the following changes given below am receiving Unable to Connect error: messi@fifa:/etc$ sudo systemctl status kibana elasticsearch ● kibana.servi… --- ## [How to print input data to logstash-plain.log file?](https://discuss.elastic.co/t/how-to-print-input-data-to-logstash-plain-log-file/314466)
**Author:** [@WonhyeongCho](https://discuss.elastic.co/u/WonhyeongCho)\ **Replies:** 3\ **Last updated:** [September 15, 2022, 4:37am UTC](https://discuss.elastic.co/t/how-to-print-input-data-to-logstash-plain-log-file/314466 "2022-09-15T04:37:49Z")
Hello. I'm using logstash for log collection. I want to write data coming into logstash to a log file. I tried many plugins to write data to log file but it didn't work. And I edit log4j2 settings like logger.logstas… --- ## [SHA256 GPG Key](https://discuss.elastic.co/t/sha256-gpg-key/314426)
**Author:** [@6igwig](https://discuss.elastic.co/u/6igwig)\ **Replies:** 0\ **Last updated:** [September 14, 2022, 2:38pm UTC](https://discuss.elastic.co/t/sha256-gpg-key/314426 "2022-09-14T14:38:38Z")
Installing logstash on Rocky Linux 9 is failing with this error message: "Key import failed (code 2)" I'm not 100% sure, but I think the problem may be that RHEL 9 has deprecated SHA-1. Is there a SHA256 or SHA521 vers… --- ## [Elastic Agent Windows Deployment Symlink Issue 8.4.1](https://discuss.elastic.co/t/elastic-agent-windows-deployment-symlink-issue-8-4-1/314462)
**Author:** [@Ad3t0](https://discuss.elastic.co/u/Ad3t0)\ **Replies:** 1\ **Last updated:** [September 15, 2022, 4:19am UTC](https://discuss.elastic.co/t/elastic-agent-windows-deployment-symlink-issue-8-4-1/314462 "2022-09-15T04:19:59Z")
Hello, When attempting to deploy the Elastic agent via Windows Server GPO I receive the error "Error: symlink C:\\Program Files\\Elastic\\Agent\\data\\elastic-agent-8d7885\\elastic-agent .exe C:\\Program Files\\Elastic\\Agent\\… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=791) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=793)