# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=811 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 812 --- ## [Cross Cluster Search(CCS) or Cross Cluster Replication?](https://discuss.elastic.co/t/cross-cluster-search-ccs-or-cross-cluster-replication/313031)
**Author:** [@lcui\_dxc](https://discuss.elastic.co/u/lcui_dxc)\ **Replies:** 2\ **Last updated:** [August 31, 2022, 3:19pm UTC](https://discuss.elastic.co/t/cross-cluster-search-ccs-or-cross-cluster-replication/313031 "2022-08-31T15:19:47Z")
Hi there: We have a client, they sell goods over the world. They wanted to build a search engine so anyone over the world would be able to use the search engine to find their needs. The database for their goods informat… --- ## [New Install - error setting certificate location](https://discuss.elastic.co/t/new-install-error-setting-certificate-location/313373)
**Author:** [@dci-sigh](https://discuss.elastic.co/u/dci-sigh)\ **Replies:** 0\ **Last updated:** [August 31, 2022, 3:19pm UTC](https://discuss.elastic.co/t/new-install-error-setting-certificate-location/313373 "2022-08-31T15:19:26Z")
the issue in the link is marked as closed due to inactivity, but I am still having this issue - curl error 77 when doing a fresh elasticsearch 8.4 install (see link above). Below is a workaround. Any updates on this i… --- ## [Crowdstrike Fleet Integration Ingest Pipeline Modifies Agent Fields](https://discuss.elastic.co/t/crowdstrike-fleet-integration-ingest-pipeline-modifies-agent-fields/313368)
**Author:** [@BrianD](https://discuss.elastic.co/u/BrianD)\ **Replies:** 0\ **Last updated:** [August 31, 2022, 2:37pm UTC](https://discuss.elastic.co/t/crowdstrike-fleet-integration-ingest-pipeline-modifies-agent-fields/313368 "2022-08-31T14:37:15Z")
From my understanding, the 'agent' field holds information about the filebeat agent used to pull in data from the Fleet integration. However, the Crowdstrike integration makes several changes to the 'agent.type' and 'age… --- ## [Large number of entries in \`host.ip\` of almost all logs from Elastic Agent](https://discuss.elastic.co/t/large-number-of-entries-in-host-ip-of-almost-all-logs-from-elastic-agent/313359)
**Author:** [@woodywoodsta](https://discuss.elastic.co/u/woodywoodsta)\ **Replies:** 0\ **Last updated:** [August 31, 2022, 12:39pm UTC](https://discuss.elastic.co/t/large-number-of-entries-in-host-ip-of-almost-all-logs-from-elastic-agent/313359 "2022-08-31T12:39:30Z")
I have an ECK managed Elastic Agent shipping logs to ES. In logs and metrics documents, the host.ip field has a large list of duplicate IPV6 addresses. An example: \[\, … --- ## [Keyword field type keep getting Mapped as a Multifield](https://discuss.elastic.co/t/keyword-field-type-keep-getting-mapped-as-a-multifield/313267)
**Author:** [@xef](https://discuss.elastic.co/u/xef)\ **Replies:** 2\ **Last updated:** [August 31, 2022, 2:47pm UTC](https://discuss.elastic.co/t/keyword-field-type-keep-getting-mapped-as-a-multifield/313267 "2022-08-31T14:47:51Z")
Hi We are tryoing to create an index with a field of type Keyowrd, but elasticsearch keeps creating a mapping for a multifield even though we have specified the field as a keyowrd. i..e 2 fields one with field and one w… --- ## [Disable geoip](https://discuss.elastic.co/t/disable-geoip/313366)
**Author:** [@Jonas\_S](https://discuss.elastic.co/u/Jonas_S)\ **Replies:** 1\ **Last updated:** [August 31, 2022, 2:40pm UTC](https://discuss.elastic.co/t/disable-geoip/313366 "2022-08-31T14:40:51Z")
Hello, i have a logstash pipeline creating elasticsearch indices. Everytime a new index is created, geoip fields are already in the mappings. I do not use them and they never get filled with data. How do i stop them fro… --- ## [XML or Json into elasticasearch](https://discuss.elastic.co/t/xml-or-json-into-elasticasearch/311931)
**Author:** [@kim\_frederiksen](https://discuss.elastic.co/u/kim_frederiksen)\ **Replies:** 3\ **Last updated:** [August 31, 2022, 2:01pm UTC](https://discuss.elastic.co/t/xml-or-json-into-elasticasearch/311931 "2022-08-31T14:01:39Z")
Hi everybody, I think we are doing something wrong here and I really need your help because we are stuck. We have several systems where we pass documents(xml/json) through. We want pass these document on to ELK so we c… --- ## [=\>"Expected one of \[ \\\\t\\\\r\\\\n\], \\"#\\", \\"{\\", \\"}\\"](https://discuss.elastic.co/t/expected-one-of-t-r-n/313258)
**Author:** [@syedabdullah](https://discuss.elastic.co/u/syedabdullah)\ **Replies:** 2\ **Last updated:** [August 31, 2022, 1:59pm UTC](https://discuss.elastic.co/t/expected-one-of-t-r-n/313258 "2022-08-31T13:59:17Z")
I am getting the following error and is resulting in a ingestion issue and cant seem to figure this out: \[2022-08-29T14:23:39,615\]\[ERROR\]\[logstash.agent \] Failed to execute action {:action=\>LogStash::PipelineA… --- ## [Highlighting not working after upgrade](https://discuss.elastic.co/t/highlighting-not-working-after-upgrade/312095)
**Author:** [@henke71](https://discuss.elastic.co/u/henke71)\ **Replies:** 1\ **Last updated:** [August 31, 2022, 1:17pm UTC](https://discuss.elastic.co/t/highlighting-not-working-after-upgrade/312095 "2022-08-31T13:17:35Z")
Highlighting has stopped working after upgrade from 7.16 to 8.3.3 This is when using must\_not. Steps to reproduce Create index PUT /test { "mappings": { "properties": { "Name": { "type": "text" }, "… --- ## [Field \[content\] not present as part of path \[content\] when update\_by\_query](https://discuss.elastic.co/t/field-content-not-present-as-part-of-path-content-when-update-by-query/313336)
**Author:** [@sherry\_cs](https://discuss.elastic.co/u/sherry_cs)\ **Replies:** 0\ **Last updated:** [August 31, 2022, 9:01am UTC](https://discuss.elastic.co/t/field-content-not-present-as-part-of-path-content-when-update-by-query/313336 "2022-08-31T09:01:00Z")
Hi, guys. I created an index with a pipeline which extracted field from the file attachments. It works well except the partial update. I tried the request : POST test\_know/\_update/G3LH2oIBXGHwpDNidXe9 { "doc": { … --- ## [Query\_string search on Date type returns incorrect results](https://discuss.elastic.co/t/query-string-search-on-date-type-returns-incorrect-results/313204)
**Author:** [@Miguel\_Rios](https://discuss.elastic.co/u/Miguel_Rios)\ **Replies:** 3\ **Last updated:** [August 31, 2022, 1:12pm UTC](https://discuss.elastic.co/t/query-string-search-on-date-type-returns-incorrect-results/313204 "2022-08-31T13:12:20Z")
We made a pretty big leap recently in elasticsearch versions and one issue we've run into is that when using query\_string's on Date fields we get items which are outside the range of the deadline date. I have the follow… --- ## [Change expected date format for Kibana dashboard add/edit filter dialogue with date field and range operator](https://discuss.elastic.co/t/change-expected-date-format-for-kibana-dashboard-add-edit-filter-dialogue-with-date-field-and-range-operator/313355)
**Author:** [@Jonas\_S](https://discuss.elastic.co/u/Jonas_S)\ **Replies:** 1\ **Last updated:** [August 31, 2022, 12:46pm UTC](https://discuss.elastic.co/t/change-expected-date-format-for-kibana-dashboard-add-edit-filter-dialogue-with-date-field-and-range-operator/313355 "2022-08-31T12:46:05Z")
Hello, i'm using Kibana 8.2, is it possible to change the date format that Kibana expects within the add/edit filter dialogue within a dashboard for a date field using a range operator? The default expects MM.DD.YYYY, … --- ## [Multiple Labels for same field](https://discuss.elastic.co/t/multiple-labels-for-same-field/313358)
**Author:** [@saif.khan](https://discuss.elastic.co/u/saif.khan)\ **Replies:** 0\ **Last updated:** [August 31, 2022, 12:31pm UTC](https://discuss.elastic.co/t/multiple-labels-for-same-field/313358 "2022-08-31T12:31:45Z")
Hi, I'm using SNMP-Logstash plugin to get data from SNMP enabled Network devices(PDUs), It works fine to an extent, The issues comes in for a field that has multiple values, example "IP Address " as I have 3 endpoint d… --- ## [Custom id when inserting a document in existing index](https://discuss.elastic.co/t/custom-id-when-inserting-a-document-in-existing-index/313352)
**Author:** [@kibanauser4](https://discuss.elastic.co/u/kibanauser4)\ **Replies:** 2\ **Last updated:** [August 31, 2022, 12:13pm UTC](https://discuss.elastic.co/t/custom-id-when-inserting-a-document-in-existing-index/313352 "2022-08-31T12:13:02Z")
I am using Dev tools in Kibana to insert a new document in an existing index. But I can't figure out if I can set the \_id field to a custom value. Is there a way to do this? This is what I'm doing now: POST user/\_doc/1… --- ## [ERROR: Failed to determine the health of the cluster](https://discuss.elastic.co/t/error-failed-to-determine-the-health-of-the-cluster/313242)
**Author:** [@morad\_della3](https://discuss.elastic.co/u/morad_della3)\ **Replies:** 1\ **Last updated:** [August 31, 2022, 12:12pm UTC](https://discuss.elastic.co/t/error-failed-to-determine-the-health-of-the-cluster/313242 "2022-08-31T12:12:14Z")
when i try to create a password to kibana interface i get this problem root@kibana:/home/kibana# /usr/share/elasticsearch/bin/elasticsearch-reset-password -i -u elastic --url http://192.168.43.157:9200 ERROR: Failed t… --- ## [Logstash date filter error](https://discuss.elastic.co/t/logstash-date-filter-error/313253)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 10\ **Last updated:** [August 31, 2022, 12:07pm UTC](https://discuss.elastic.co/t/logstash-date-filter-error/313253 "2022-08-31T12:07:58Z")
I have this field in my logs event\_time=2022-08-30 17:30:42.000 my logstash pipeline file is filter { if "average\_weight" in \[tags\] { kv { source=\>"message" target =\> "test" field\_split=\>"," } mutate { rename =\> { "\[t… --- ## [Elastic Agent Synthetics integration - How to separate hosts in icmp monitor](https://discuss.elastic.co/t/elastic-agent-synthetics-integration-how-to-separate-hosts-in-icmp-monitor/313354)
**Author:** [@norgro2601](https://discuss.elastic.co/u/norgro2601)\ **Replies:** 0\ **Last updated:** [August 31, 2022, 12:07pm UTC](https://discuss.elastic.co/t/elastic-agent-synthetics-integration-how-to-separate-hosts-in-icmp-monitor/313354 "2022-08-31T12:07:10Z")
Hi, we want to start using the Synthetics integration to replace Heartbeats, but I'm not sure how to handle icmp monitors for different hosts in a single agent policy. When I setup the integration in the policy with ho… --- ## [How to calculate first pass logic and reren for testcase using logstash grok](https://discuss.elastic.co/t/how-to-calculate-first-pass-logic-and-reren-for-testcase-using-logstash-grok/313089)
**Author:** [@aish794726](https://discuss.elastic.co/u/aish794726)\ **Replies:** 4\ **Last updated:** [August 31, 2022, 11:23am UTC](https://discuss.elastic.co/t/how-to-calculate-first-pass-logic-and-reren-for-testcase-using-logstash-grok/313089 "2022-08-31T11:23:50Z")
am working on grok, have very few knowledge about it, we are preparing regression dashboard there we need first pass and reren so that system should understand, these script got pass infirst these are fail n might requir… --- ## [How to add additional timestamp field in an index](https://discuss.elastic.co/t/how-to-add-additional-timestamp-field-in-an-index/313346)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 0\ **Last updated:** [August 31, 2022, 10:38am UTC](https://discuss.elastic.co/t/how-to-add-additional-timestamp-field-in-an-index/313346 "2022-08-31T10:38:25Z")
pipeline file date { match =\>\["\[event\]\[time\]","YYYY-MM-dd HH:mm:ss.SSS"\] target =\> "time" } however when i do GET my\_index/\_mapping there is no time field , my objective is two have two field one is @timestamp defaul… --- ## [NEST: inference derived class into base class using condition with automapping](https://discuss.elastic.co/t/nest-inference-derived-class-into-base-class-using-condition-with-automapping/313348)
**Author:** [@Alex83](https://discuss.elastic.co/u/Alex83)\ **Replies:** 0\ **Last updated:** [August 31, 2022, 10:48am UTC](https://discuss.elastic.co/t/nest-inference-derived-class-into-base-class-using-condition-with-automapping/313348 "2022-08-31T10:48:47Z")
Hi, i have in my model an object type "Order" that it contains a property of type "Customer". Customer is a base class with some tipically fields (customerType, name, surname, etc.) and its a base class because customer… --- ## [What's the cause of this prob and what's the solution](https://discuss.elastic.co/t/whats-the-cause-of-this-prob-and-whats-the-solution/313086)
**Author:** [@morad\_della3](https://discuss.elastic.co/u/morad_della3)\ **Replies:** 12\ **Last updated:** [August 31, 2022, 10:32am UTC](https://discuss.elastic.co/t/whats-the-cause-of-this-prob-and-whats-the-solution/313086 "2022-08-31T10:32:13Z")
what's the cause of this prob and what's the solution when i want to create a token for kibana ileged$0(SocketAccess.java:42) ~\[?:?\] at java.security.AccessController.doPrivileged(AccessController.java:569) ~\[?:… --- ## [Export Kibana APM Service Map](https://discuss.elastic.co/t/export-kibana-apm-service-map/313343)
**Author:** [@gchiartosini](https://discuss.elastic.co/u/gchiartosini)\ **Replies:** 0\ **Last updated:** [August 31, 2022, 10:26am UTC](https://discuss.elastic.co/t/export-kibana-apm-service-map/313343 "2022-08-31T10:26:10Z")
Summary: looking for help/information about Kibana APM Service Map Context: we have a 7.12.1 Elastic Stack installed "on premise" on dedicated VMs in a Google Cloud Platform environment with Platinum licence; stack … --- ## [Plugin imap: get attachment](https://discuss.elastic.co/t/plugin-imap-get-attachment/313342)
**Author:** [@Bepsi](https://discuss.elastic.co/u/Bepsi)\ **Replies:** 0\ **Last updated:** [August 31, 2022, 10:17am UTC](https://discuss.elastic.co/t/plugin-imap-get-attachment/313342 "2022-08-31T10:17:17Z")
Hi all, With logstash-oss v7.17.6, i want to read a .zip attachment in a mail. I can read the mail itself, but the attachment can not be read. Logstash conf file: input { imap { id =\> "dmarc" host =\> "xxx" … --- ## [Elastic certificates](https://discuss.elastic.co/t/elastic-certificates/313340)
**Author:** [@morad\_della3](https://discuss.elastic.co/u/morad_della3)\ **Replies:** 0\ **Last updated:** [August 31, 2022, 9:55am UTC](https://discuss.elastic.co/t/elastic-certificates/313340 "2022-08-31T09:55:03Z")
Hello, it's is necessary when i install Elasticsearch and Kibana i should configure the elastic certificates in this doc ici : elasticsearch-certutil | Elasticsearch Guide \[8.4\] | Elastic thanks. --- ## [Elasticsearch disk usage issue](https://discuss.elastic.co/t/elasticsearch-disk-usage-issue/313338)
**Author:** [@xalastoi](https://discuss.elastic.co/u/xalastoi)\ **Replies:** 0\ **Last updated:** [August 31, 2022, 9:39am UTC](https://discuss.elastic.co/t/elasticsearch-disk-usage-issue/313338 "2022-08-31T09:39:36Z")
Hello! i have a strange issue in my elasticsearch cluster so i have 5 nodes ( 4 data and masters and 1 master only node ) so each node has 5.7 tb disk space on it but on the first node my disk is almost completely ful… --- ## [Winlogbeat SSL setup with ElasticSearch and Kibana with SSL enabled](https://discuss.elastic.co/t/winlogbeat-ssl-setup-with-elasticsearch-and-kibana-with-ssl-enabled/313094)
**Author:** [@RonH8](https://discuss.elastic.co/u/RonH8)\ **Replies:** 1\ **Last updated:** [August 31, 2022, 9:20am UTC](https://discuss.elastic.co/t/winlogbeat-ssl-setup-with-elasticsearch-and-kibana-with-ssl-enabled/313094 "2022-08-31T09:20:00Z")
Hey I've set up Elasticsearch and Kibana with SSL enabled for both of them with certificates that were generated using elasticsearch-certutil, running on Ubuntu 22.04.1 LTS. It's my first time setting up Elasticsearch,… --- ## [Inquiry about the configuration of network.host in elasticsearch.yml](https://discuss.elastic.co/t/inquiry-about-the-configuration-of-network-host-in-elasticsearch-yml/313329)
**Author:** [@morad\_della3](https://discuss.elastic.co/u/morad_della3)\ **Replies:** 3\ **Last updated:** [August 31, 2022, 9:06am UTC](https://discuss.elastic.co/t/inquiry-about-the-configuration-of-network-host-in-elasticsearch-yml/313329 "2022-08-31T09:06:40Z")
I already installed Elasticsearch 8.4.0 in ubuntu and I find in the elasticsearch.yml file that the HTTP.host: 0.0.0.0 and #transport.host: 0.0.0.0 is that mean that I should put the network.host also 0.0.0.0 ?? than… --- ## [What's the cause and the solution of this problem plz](https://discuss.elastic.co/t/whats-the-cause-and-the-solution-of-this-problem-plz/313269)
**Author:** [@morad\_della3](https://discuss.elastic.co/u/morad_della3)\ **Replies:** 3\ **Last updated:** [August 31, 2022, 9:05am UTC](https://discuss.elastic.co/t/whats-the-cause-and-the-solution-of-this-problem-plz/313269 "2022-08-31T09:05:05Z")
I installed elasticsearch and kibana 8.4.0 in the same ubuntu 22.04 VM and i try to connect them by token and when i try to create a token i get this error help plz and thanks kibana@kibana:/usr/share/elasticsearch/bin$… --- ## [Unable to connect filebeat with kibana to load dashboard](https://discuss.elastic.co/t/unable-to-connect-filebeat-with-kibana-to-load-dashboard/313300)
**Author:** [@Ahlam\_Abubaker](https://discuss.elastic.co/u/Ahlam_Abubaker)\ **Replies:** 5\ **Last updated:** [August 31, 2022, 9:01am UTC](https://discuss.elastic.co/t/unable-to-connect-filebeat-with-kibana-to-load-dashboard/313300 "2022-08-31T09:01:11Z")
Hi there, I'm running kibana behind apache2 proxy kibana is running in localhost port 5601 and my apache2 IP & port as 46.246.x.x:yyyy when I ran ./filebeat setup -e command in order to connect filebeat on client ser… --- ## [To find out which agent has not sent logs](https://discuss.elastic.co/t/to-find-out-which-agent-has-not-sent-logs/313334)
**Author:** [@hadi\_farzipour](https://discuss.elastic.co/u/hadi_farzipour)\ **Replies:** 1\ **Last updated:** [August 31, 2022, 8:29am UTC](https://discuss.elastic.co/t/to-find-out-which-agent-has-not-sent-logs/313334 "2022-08-31T08:29:07Z")
I have 1000 agents sending their logs to my ELK stack like following lines every 10 seconds { "\_index": "my\_logs", "@timestamp": "2022-08-31T08:11:21.622Z", "agent\_name":"agent\_1", "size" : 15 } I know a way to… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=810) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=812)