# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=803 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 804 --- ## [Django syncs to ElasticSearch even when logstash container is removed?](https://discuss.elastic.co/t/django-syncs-to-elasticsearch-even-when-logstash-container-is-removed/313878)
**Author:** [@scheung38](https://discuss.elastic.co/u/scheung38)\ **Replies:** 0\ **Last updated:** [September 7, 2022, 11:29am UTC](https://discuss.elastic.co/t/django-syncs-to-elasticsearch-even-when-logstash-container-is-removed/313878 "2022-09-07T11:29:27Z")
What is the reason behind Django data updated to Elasticsearch when logstash container is removed? Initially checked no index here - (empty) http://localhost:5601/app/management/data/index\_management/indices docker ki… --- ## [Add profile option for fleet server host URL in fleet server settings](https://discuss.elastic.co/t/add-profile-option-for-fleet-server-host-url-in-fleet-server-settings/313874)
**Author:** [@frederikvandeputte](https://discuss.elastic.co/u/frederikvandeputte)\ **Replies:** 0\ **Last updated:** [September 7, 2022, 10:47am UTC](https://discuss.elastic.co/t/add-profile-option-for-fleet-server-host-url-in-fleet-server-settings/313874 "2022-09-07T10:47:59Z")
Alike to the outputs profiles for Elasticsearch/Logstash and the Agent Binary Download that you now can specify in Agent policy settings, it would be very useful to also be able to do that for the Fleet server hosts part… --- ## [How can I dynamically create elasticsearch indices using logtsash using jdbc?](https://discuss.elastic.co/t/how-can-i-dynamically-create-elasticsearch-indices-using-logtsash-using-jdbc/313873)
**Author:** [@shantam\_saxena](https://discuss.elastic.co/u/shantam_saxena)\ **Replies:** 0\ **Last updated:** [September 7, 2022, 10:21am UTC](https://discuss.elastic.co/t/how-can-i-dynamically-create-elasticsearch-indices-using-logtsash-using-jdbc/313873 "2022-09-07T10:21:43Z")
I have a table in snowflake for which I have a target column. The target column has 20 distinct values and will increase with time. My intention is to use logstash to create separate indices for all the unique values in … --- ## [Log alerting: trigger alert when specific log string has not been logged on specific time](https://discuss.elastic.co/t/log-alerting-trigger-alert-when-specific-log-string-has-not-been-logged-on-specific-time/313868)
**Author:** [@Remco1985](https://discuss.elastic.co/u/Remco1985)\ **Replies:** 0\ **Last updated:** [September 7, 2022, 9:49am UTC](https://discuss.elastic.co/t/log-alerting-trigger-alert-when-specific-log-string-has-not-been-logged-on-specific-time/313868 "2022-09-07T09:49:50Z")
Hello everbody, Hopefully somebody can help me out. For specific monitoring purposes i'm trying to achieve the following: We curruntly running ELK v 7.13.2 in our environment. We have a specific application server in w… --- ## [Query regarding scoring of ES8. 2](https://discuss.elastic.co/t/query-regarding-scoring-of-es8-2/312687)
**Author:** [@sajeeda](https://discuss.elastic.co/u/sajeeda)\ **Replies:** 3\ **Last updated:** [September 7, 2022, 9:10am UTC](https://discuss.elastic.co/t/query-regarding-scoring-of-es8-2/312687 "2022-09-07T09:10:54Z")
Hi All, I am trying to upgrade from ES6.3 to ES8.2. I am new to Elasticsearch and wanted to understand how the scoring is done on text search in both the versions. scores and the result set is all different when compa… --- ## [Find the number of search requests per day hitting ES Cluster](https://discuss.elastic.co/t/find-the-number-of-search-requests-per-day-hitting-es-cluster/313865)
**Author:** [@sandeepkanabar](https://discuss.elastic.co/u/sandeepkanabar)\ **Replies:** 0\ **Last updated:** [September 7, 2022, 8:57am UTC](https://discuss.elastic.co/t/find-the-number-of-search-requests-per-day-hitting-es-cluster/313865 "2022-09-07T08:57:52Z")
Is there a way to know the (average) number of search requests per day hitting the Elasticsearch cluster? If my ES cluster contains day-wise indices and I want find the no of search requests that hit ES cluster in last … --- ## [Sorting by date in log stream](https://discuss.elastic.co/t/sorting-by-date-in-log-stream/313339)
**Author:** [@conor\_c](https://discuss.elastic.co/u/conor_c)\ **Replies:** 4\ **Last updated:** [September 7, 2022, 8:55am UTC](https://discuss.elastic.co/t/sorting-by-date-in-log-stream/313339 "2022-09-07T08:55:48Z")
Hi All, I've been searching and searching for a solution, but I've not managed to find any relevant answers. I suspect I am looking in the wrong place or have misunderstood how some of the ELK stack tools are connected. … --- ## [Auto\_expand\_replicas not working on enrich index](https://discuss.elastic.co/t/auto-expand-replicas-not-working-on-enrich-index/313569)
**Author:** [@ddolcimascolo](https://discuss.elastic.co/u/ddolcimascolo)\ **Replies:** 31\ **Last updated:** [September 7, 2022, 8:38am UTC](https://discuss.elastic.co/t/auto-expand-replicas-not-working-on-enrich-index/313569 "2022-09-07T08:38:03Z")
Hi guys, Our enrich indices are not replicated on our production cluster, and I don't understand why... Can you help to troubleshoot the issue? Context ES 7.17.1 3 Nodes Many various data indices Many ingest pipeline… --- ## [Elastic-agent cloudflare logpull and problem with using processors for filter events](https://discuss.elastic.co/t/elastic-agent-cloudflare-logpull-and-problem-with-using-processors-for-filter-events/312069)
**Author:** [@slast](https://discuss.elastic.co/u/slast)\ **Replies:** 1\ **Last updated:** [August 15, 2022, 10:43am UTC](https://discuss.elastic.co/t/elastic-agent-cloudflare-logpull-and-problem-with-using-processors-for-filter-events/312069 "2022-08-15T10:43:46Z")
Hi Everyone I have a problem with elastic-agent( ver 7.17.4) that we are using to collect logs from cloudflare. I want to drop some events by using processors in "Edit Cloudflare integration" - but nothing is work. … --- ## [Kibana TSVB to filter out aggregated result](https://discuss.elastic.co/t/kibana-tsvb-to-filter-out-aggregated-result/313859)
**Author:** [@inhinyera16](https://discuss.elastic.co/u/inhinyera16)\ **Replies:** 0\ **Last updated:** [September 7, 2022, 8:01am UTC](https://discuss.elastic.co/t/kibana-tsvb-to-filter-out-aggregated-result/313859 "2022-09-07T08:01:43Z")
Anyone knows how to filter tsvb aggregated result? In my example below, I used 3 aggregations then grouped by Cluster, to capture the remaining memory % avg (MemoryUsageGB) avg(MemoryTotalGB) bucket script to get the … --- ## [Logstash I/O error](https://discuss.elastic.co/t/logstash-i-o-error/313858)
**Author:** [@Hardy\_Fong](https://discuss.elastic.co/u/Hardy_Fong)\ **Replies:** 0\ **Last updated:** [September 7, 2022, 8:00am UTC](https://discuss.elastic.co/t/logstash-i-o-error/313858 "2022-09-07T08:00:51Z")
Dear all , I have one elk server collecting all decive syslog, and we found one of fibre switch(DELL DS6610B) have prompt this error in starting logstash. But the weird point is we have 3 fibre switch which are same c… --- ## [Squid Logs Integration (Technical preview) ignores custom DNS processor when added under the integration's advanced configuration section](https://discuss.elastic.co/t/squid-logs-integration-technical-preview-ignores-custom-dns-processor-when-added-under-the-integrations-advanced-configuration-section/313853)
**Author:** [@ipaq](https://discuss.elastic.co/u/ipaq)\ **Replies:** 0\ **Last updated:** [September 7, 2022, 7:16am UTC](https://discuss.elastic.co/t/squid-logs-integration-technical-preview-ignores-custom-dns-processor-when-added-under-the-integrations-advanced-configuration-section/313853 "2022-09-07T07:16:47Z")
Hi elastic community, I've been discussing this issue with support for a little while however they've advised this may be a bug that could need looking into so I've been referred here. We have some routers running both… --- ## [Filebeat index](https://discuss.elastic.co/t/filebeat-index/313849)
**Author:** [@Milan\_Dangol](https://discuss.elastic.co/u/Milan_Dangol)\ **Replies:** 4\ **Last updated:** [September 7, 2022, 7:28am UTC](https://discuss.elastic.co/t/filebeat-index/313849 "2022-09-07T07:28:45Z")
Greetings everyone, I have a question regarding filebeat index. The scenarios is: I am transferring Nginx access and error logs from filebeat to my Elasticsearch server. Is the size of filbeat index is equal to the si… --- ## [Metricbeat](https://discuss.elastic.co/t/metricbeat/313660)
**Author:** [@Shashi\_Prakash](https://discuss.elastic.co/u/Shashi_Prakash)\ **Replies:** 15\ **Last updated:** [September 7, 2022, 6:49am UTC](https://discuss.elastic.co/t/metricbeat/313660 "2022-09-07T06:49:59Z")
i am geting error in connecting metricbeat to kibana as it shows in logs ERROR \[kibana.stats\] stats/stats.go:82 error making http request: Get http://localhost:5601/api/status: dial tcp 127.0.0.1:5601: connection refuse… --- ## [How to create a runtime field to create an alert?](https://discuss.elastic.co/t/how-to-create-a-runtime-field-to-create-an-alert/312997)
**Author:** [@sirineb](https://discuss.elastic.co/u/sirineb)\ **Replies:** 7\ **Last updated:** [September 7, 2022, 6:48am UTC](https://discuss.elastic.co/t/how-to-create-a-runtime-field-to-create-an-alert/312997 "2022-09-07T06:48:42Z")
Hi, I've created a field with a script to set the boolean "office\_hours" to true of false depending on the log hours. My painless script is : def office; if (doc\['@timestamp'\].value.hour \< 5 || doc\['@timestamp'\].value.… --- ## [Logstash on docker does not work with auditbeat](https://discuss.elastic.co/t/logstash-on-docker-does-not-work-with-auditbeat/313657)
**Author:** [@mammodde](https://discuss.elastic.co/u/mammodde)\ **Replies:** 5\ **Last updated:** [September 7, 2022, 6:48am UTC](https://discuss.elastic.co/t/logstash-on-docker-does-not-work-with-auditbeat/313657 "2022-09-07T06:48:04Z")
Hi, I am currently trying to configure a docker with Logstash by sending there logs with auditbeat installed on my pc. The problem is that I constantly receive the same error when I do .\\auditbeat.exe setup -e Exiting: … --- ## [Fail to run pre-built alerts due to non-existing fields](https://discuss.elastic.co/t/fail-to-run-pre-built-alerts-due-to-non-existing-fields/313801)
**Author:** [@sirineb](https://discuss.elastic.co/u/sirineb)\ **Replies:** 0\ **Last updated:** [September 6, 2022, 1:53pm UTC](https://discuss.elastic.co/t/fail-to-run-pre-built-alerts-due-to-non-existing-fields/313801 "2022-09-06T13:53:35Z")
Hi, I am trying to use the pre-built alerts in Security \> Rules but the alert " Remote Computer Account DnsHostName Update" doesn't work. Here's the execution log of the rule "Remote Computer Account DnsHostName Updat… --- ## [Grok pattern - sometimes nesting bracket](https://discuss.elastic.co/t/grok-pattern-sometimes-nesting-bracket/313797)
**Author:** [@elkuser1234](https://discuss.elastic.co/u/elkuser1234)\ **Replies:** 2\ **Last updated:** [September 7, 2022, 6:34am UTC](https://discuss.elastic.co/t/grok-pattern-sometimes-nesting-bracket/313797 "2022-09-07T06:34:08Z")
Hi I have a difficult log for me. Because sometimes I have nested bracket and sometimes i don't How to parse it in a grok. \[2022-09-05 17:27:24,537\] \[apps-thread | test-policy\] WARN \[2022-09-06 14:19:25,708\] \[App (ap… --- ## [Reverting Index Logging Settings](https://discuss.elastic.co/t/reverting-index-logging-settings/313770)
**Author:** [@nutcno](https://discuss.elastic.co/u/nutcno)\ **Replies:** 1\ **Last updated:** [September 7, 2022, 5:50am UTC](https://discuss.elastic.co/t/reverting-index-logging-settings/313770 "2022-09-07T05:50:15Z")
I want to add new index settings for all indices to add some additional configs to debug/info/warn and trace. So like below I have this curl command - curl -XPUT 'http://localhost:9200/\_all/\_settings?preserve\_existing=… --- ## [Can we pull up logs using Web API either through filebeat or logstash?](https://discuss.elastic.co/t/can-we-pull-up-logs-using-web-api-either-through-filebeat-or-logstash/313841)
**Author:** [@Blason](https://discuss.elastic.co/u/Blason)\ **Replies:** 4\ **Last updated:** [September 7, 2022, 3:48am UTC](https://discuss.elastic.co/t/can-we-pull-up-logs-using-web-api-either-through-filebeat-or-logstash/313841 "2022-09-07T03:48:44Z")
Hi Team, I need to pull up the logs using web API; can someone suggest a method by which I could pull up the logs using web api? Or do I need to write a script and then pull up the logs? TIA Blason R --- ## [Xpack.security.transport.ssl setup issue](https://discuss.elastic.co/t/xpack-security-transport-ssl-setup-issue/313757)
**Author:** [@cheching](https://discuss.elastic.co/u/cheching)\ **Replies:** 3\ **Last updated:** [September 7, 2022, 2:50am UTC](https://discuss.elastic.co/t/xpack-security-transport-ssl-setup-issue/313757 "2022-09-07T02:50:09Z")
Hi Team, Need yours assist to look into below issue, I'm using self hosted Kibana & Elasticsearch as well. But I have an error after I generated the certificates and copy it into the etc/elasticsearch/certs path. And af… --- ## [Import CA Cert as PrivateKeyEntry to HTTP Keystore - Solve Unable to create enrollment token Error](https://discuss.elastic.co/t/import-ca-cert-as-privatekeyentry-to-http-keystore-solve-unable-to-create-enrollment-token-error/313780)
**Author:** [@aold619](https://discuss.elastic.co/u/aold619)\ **Replies:** 3\ **Last updated:** [September 7, 2022, 2:48am UTC](https://discuss.elastic.co/t/import-ca-cert-as-privatekeyentry-to-http-keystore-solve-unable-to-create-enrollment-token-error/313780 "2022-09-07T02:48:40Z")
Problem Yesterday I installed Elasticsearch for the first time, and after I configured the security manully according to the docs: Basic Security / Basic Security plus HTTPS, I try to generate token for Kibana, and I met… --- ## [If possible to increase that ILM Condition](https://discuss.elastic.co/t/if-possible-to-increase-that-ilm-condition/313440)
**Author:** [@yasar](https://discuss.elastic.co/u/yasar)\ **Replies:** 4\ **Last updated:** [September 7, 2022, 2:45am UTC](https://discuss.elastic.co/t/if-possible-to-increase-that-ilm-condition/313440 "2022-09-07T02:45:04Z")
Hi team, we are having that 5.1 TB Hot node and 8.34 TB warm node in production with below condition Condition 1: 2 Days Condition 2: 50 GB We are using 4.5 TB disk Usage only and we can see more spaces are free in o… --- ## [Add Custom Anomaly Jobs to Kibana Metric Inventory](https://discuss.elastic.co/t/add-custom-anomaly-jobs-to-kibana-metric-inventory/313805)
**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Replies:** 0\ **Last updated:** [September 6, 2022, 2:38pm UTC](https://discuss.elastic.co/t/add-custom-anomaly-jobs-to-kibana-metric-inventory/313805 "2022-09-06T14:38:25Z")
Hi All, I was wondering if there is a way to have Custom Anomaly Jobs to the Observability -\> Metrics -\> Inventory section. Context: Kibana 8.3.2 If I have a custom anomaly job that matches a host, it doesn't show up … --- ## [Input Controls in dark mode in v.8.4.1](https://discuss.elastic.co/t/input-controls-in-dark-mode-in-v-8-4-1/313760)
**Author:** [@m-amano](https://discuss.elastic.co/u/m-amano)\ **Replies:** 2\ **Last updated:** [September 7, 2022, 1:14am UTC](https://discuss.elastic.co/t/input-controls-in-dark-mode-in-v-8-4-1/313760 "2022-09-07T01:14:28Z")
I upgraded ElastcCloud v.7.17.6 to v.8.4.1. Input controls seem to be not a better look and became unreadable in the suggestion list. The same data is in the suggestion list in v.7.17.6. --- ## [Auditbeat dashboard in kibana shows empty results](https://discuss.elastic.co/t/auditbeat-dashboard-in-kibana-shows-empty-results/313782)
**Author:** [@Sargu\_Xcode](https://discuss.elastic.co/u/Sargu_Xcode)\ **Replies:** 2\ **Last updated:** [September 7, 2022, 1:07am UTC](https://discuss.elastic.co/t/auditbeat-dashboard-in-kibana-shows-empty-results/313782 "2022-09-07T01:07:56Z")
Hi All , I am trying to build a monitoring system for auditctl using auditbeat on Elasticsearch 7.8.1 and Kibana 7.8.1. Everything is successfully setup , including auditbeat. But the auditbeat dashboard seems empty whe… --- ## [Only one log is output from auditbeat](https://discuss.elastic.co/t/only-one-log-is-output-from-auditbeat/313726)
**Author:** [@aurantiacus](https://discuss.elastic.co/u/aurantiacus)\ **Replies:** 3\ **Last updated:** [September 7, 2022, 12:58am UTC](https://discuss.elastic.co/t/only-one-log-is-output-from-auditbeat/313726 "2022-09-07T00:58:41Z")
I am using auditbeat (6.4) on windows 10. I have specified the C drive as the monitoring destination. Other computers output a lot of data in 'file\_integrity'. When I start auditbeat on only one computer, I get only o… --- ## [Upgrade steps 8.3 - 8.4](https://discuss.elastic.co/t/upgrade-steps-8-3-8-4/313716)
**Author:** [@ymoriarty](https://discuss.elastic.co/u/ymoriarty)\ **Replies:** 4\ **Last updated:** [September 6, 2022, 11:35pm UTC](https://discuss.elastic.co/t/upgrade-steps-8-3-8-4/313716 "2022-09-06T23:35:57Z")
Where are the instructions to upgrade Elasticsearch, Kibana and Enterprise Search from 8.3 to 8.4.x? I am running this on prem on a single host with the basic license. I have search all over your site and do not find a… --- ## [Change local ip address to "any text" in elasticsearch logs](https://discuss.elastic.co/t/change-local-ip-address-to-any-text-in-elasticsearch-logs/313771)
**Author:** [@kurdit](https://discuss.elastic.co/u/kurdit)\ **Replies:** 6\ **Last updated:** [September 6, 2022, 10:36pm UTC](https://discuss.elastic.co/t/change-local-ip-address-to-any-text-in-elasticsearch-logs/313771 "2022-09-06T22:36:54Z")
hi all! we collect nginx access logs in elasticsearch. here is an example of incoming nginx access logs: kibana-linux.elk.com 10.211.45.45 - \[05/Sep/2022:15:26:54 +0300\] UNIX-TIME-1662380814.467 "GET /internal/security… --- ## [Kibana - Metricbeat Calculate time in application](https://discuss.elastic.co/t/kibana-metricbeat-calculate-time-in-application/313832)
**Author:** [@Matt.Wash](https://discuss.elastic.co/u/Matt.Wash)\ **Replies:** 0\ **Last updated:** [September 6, 2022, 10:00pm UTC](https://discuss.elastic.co/t/kibana-metricbeat-calculate-time-in-application/313832 "2022-09-06T22:00:44Z")
I am trying to get a total time a user has spent in an application through metricbeat process.name field. I am able to show the following, but cannot work out a way to calculate a total time in the application. Any idea… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=802) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=804)