# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=822 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 823 --- ## [Remove everything up to -\>](https://discuss.elastic.co/t/remove-everything-up-to/312623)
**Author:** [@ombit](https://discuss.elastic.co/u/ombit)\ **Replies:** 2\ **Last updated:** [August 22, 2022, 4:21pm UTC](https://discuss.elastic.co/t/remove-everything-up-to/312623 "2022-08-22T16:21:00Z")
Hi all, I have a log that is created from various different source servers. Using Wazuh, each item is forwarded to this one log which is then intended to go off to a remote QRADAR server. Wazuh is adding its own part … --- ## [¿Es posible indexar dinamicamente información en varios indices según un campo en un documento json?](https://discuss.elastic.co/t/es-posible-indexar-dinamicamente-informacion-en-varios-indices-segun-un-campo-en-un-documento-json/312635)
**Author:** [@Manuel\_Vazquez](https://discuss.elastic.co/u/Manuel_Vazquez)\ **Replies:** 1\ **Last updated:** [August 22, 2022, 4:04pm UTC](https://discuss.elastic.co/t/es-posible-indexar-dinamicamente-informacion-en-varios-indices-segun-un-campo-en-un-documento-json/312635 "2022-08-22T16:04:23Z")
¿Aun no he profundizado en la documentación de logstash, pero existe la posibiidad de indexar un documento json de forma que el nombre del indice donde se va indexar el documento venga o se calcule por el contenido o par… --- ## [Fillebeat keeps restarting in Kuberneates](https://discuss.elastic.co/t/fillebeat-keeps-restarting-in-kuberneates/309702)
**Author:** [@Jehutywong](https://discuss.elastic.co/u/Jehutywong)\ **Replies:** 3\ **Last updated:** [August 22, 2022, 4:01pm UTC](https://discuss.elastic.co/t/fillebeat-keeps-restarting-in-kuberneates/309702 "2022-08-22T16:01:33Z")
Filebeat Version: 8.3.2 (image gets from docker.elastic.co/beats/filebeat:8.3.2) I have roughly 40k logs in an NFS folder for Filebeat to collect. The Pod keeps restart itself in every ~10 minutes. And showing this erro… --- ## [Field is mapped as object but found a concrete value](https://discuss.elastic.co/t/field-is-mapped-as-object-but-found-a-concrete-value/312638)
**Author:** [@Thuunder7](https://discuss.elastic.co/u/Thuunder7)\ **Replies:** 0\ **Last updated:** [August 22, 2022, 3:43pm UTC](https://discuss.elastic.co/t/field-is-mapped-as-object-but-found-a-concrete-value/312638 "2022-08-22T15:43:49Z")
Hello guys, I know there is a boatload of threads about this topic, but unfortunately i cannot resolve my issue. I have an index that has this mapping: "debug": { "properties" : { "input" : { "properties" : { … --- ## [Filebeat exclude lines with multiline](https://discuss.elastic.co/t/filebeat-exclude-lines-with-multiline/312171)
**Author:** [@inhinyera16](https://discuss.elastic.co/u/inhinyera16)\ **Replies:** 1\ **Last updated:** [August 22, 2022, 3:34pm UTC](https://discuss.elastic.co/t/filebeat-exclude-lines-with-multiline/312171 "2022-08-22T15:34:27Z")
Hello, Is there any way we can exclude the lines first before splitting the logs via multiline pattern? I have one specific logs with 3 different log patterns, the problem is, the output is incorrect due the extra line… --- ## [New java client bug in GeoCentroidAggregation?](https://discuss.elastic.co/t/new-java-client-bug-in-geocentroidaggregation/312612)
**Author:** [@Alain\_Bod](https://discuss.elastic.co/u/Alain_Bod)\ **Replies:** 3\ **Last updated:** [August 22, 2022, 3:27pm UTC](https://discuss.elastic.co/t/new-java-client-bug-in-geocentroidaggregation/312612 "2022-08-22T15:27:17Z")
Hi, I believe I ran into a bug with the new Java Client (v8.3.3) I'm trying a GeoCentroidAggregation which returns 0 results. In that case I get an exception: POST /dataset/\_search?typed\_keys=true {"\_source":{"exclude… --- ## [No cpu/memory information from metricbeat docker module monitoring windows container](https://discuss.elastic.co/t/no-cpu-memory-information-from-metricbeat-docker-module-monitoring-windows-container/311923)
**Author:** [@ragustin](https://discuss.elastic.co/u/ragustin)\ **Replies:** 1\ **Last updated:** [August 22, 2022, 3:21pm UTC](https://discuss.elastic.co/t/no-cpu-memory-information-from-metricbeat-docker-module-monitoring-windows-container/311923 "2022-08-22T15:21:18Z")
Hi, I'm trying to monitor my Windows Containers with metricbeat 8.3.3, and it seems that metricbeat is not gathering the stats for CPU, memory for Windows Containers. Operating System: Windows Server 2019 --- ## [Multiline under multiline filebeat](https://discuss.elastic.co/t/multiline-under-multiline-filebeat/311904)
**Author:** [@alex\_vermex](https://discuss.elastic.co/u/alex_vermex)\ **Replies:** 2\ **Last updated:** [August 22, 2022, 3:17pm UTC](https://discuss.elastic.co/t/multiline-under-multiline-filebeat/311904 "2022-08-22T15:17:06Z")
Hi, I split each log using multiline filebeat: - type: log enabled: true paths: - D:\\elastic\_stack\\journal\\\* fields: kafka\_topic: "kafka-topic-1" multiline.type: pattern multiline.pattern: '^\\s… --- ## [Unable to capture application log via filebeat but filebeat service gets stopped every one second after modifying yml file](https://discuss.elastic.co/t/unable-to-capture-application-log-via-filebeat-but-filebeat-service-gets-stopped-every-one-second-after-modifying-yml-file/311869)
**Author:** [@Nishi\_Shah](https://discuss.elastic.co/u/Nishi_Shah)\ **Replies:** 1\ **Last updated:** [August 22, 2022, 3:13pm UTC](https://discuss.elastic.co/t/unable-to-capture-application-log-via-filebeat-but-filebeat-service-gets-stopped-every-one-second-after-modifying-yml-file/311869 "2022-08-22T15:13:40Z")
Hi, I am trying to capture application logs from windows system via filebeat but service gets stopped every one second after modifying yml file. Unable to get data in kibana dashboard. Attached filebeat yml file .. Kind… --- ## [Filebeat can't read log file continuously](https://discuss.elastic.co/t/filebeat-cant-read-log-file-continuously/311756)
**Author:** [@mgazanayi](https://discuss.elastic.co/u/mgazanayi)\ **Replies:** 1\ **Last updated:** [August 22, 2022, 3:09pm UTC](https://discuss.elastic.co/t/filebeat-cant-read-log-file-continuously/311756 "2022-08-22T15:09:00Z")
Hello, I'm trying to continuously read a log file, and output it to an other file. (In reality, I'm trying to isolate why Filebeat only reads the log file once). Here is my Filebeat configuration: filebeat.inputs: - t… --- ## [Filebeat: Apache module : two paths and two access inputs to configure](https://discuss.elastic.co/t/filebeat-apache-module-two-paths-and-two-access-inputs-to-configure/311404)
**Author:** [@hboris](https://discuss.elastic.co/u/hboris)\ **Replies:** 2\ **Last updated:** [August 22, 2022, 2:50pm UTC](https://discuss.elastic.co/t/filebeat-apache-module-two-paths-and-two-access-inputs-to-configure/311404 "2022-08-22T14:50:17Z")
Hello, I am a newbie and i am planing to install elastic stack. Here is my architecture Here is what my apache module conf looks like: #-------------------------------- Apache Module ------------------------------… --- ## [Lack of debug logs on Filebeat kafka output](https://discuss.elastic.co/t/lack-of-debug-logs-on-filebeat-kafka-output/312633)
**Author:** [@Steve\_McDuff](https://discuss.elastic.co/u/Steve_McDuff)\ **Replies:** 0\ **Last updated:** [August 22, 2022, 2:47pm UTC](https://discuss.elastic.co/t/lack-of-debug-logs-on-filebeat-kafka-output/312633 "2022-08-22T14:47:45Z")
While using filebeat, I encountered an odd issue where two servers configured with the same way behaved very differently. One of them works perfectly fine and the other one works at a very slow pace. So I know the proble… --- ## [Filebeat file path not working](https://discuss.elastic.co/t/filebeat-file-path-not-working/311473)
**Author:** [@shivendra95](https://discuss.elastic.co/u/shivendra95)\ **Replies:** 1\ **Last updated:** [August 22, 2022, 2:44pm UTC](https://discuss.elastic.co/t/filebeat-file-path-not-working/311473 "2022-08-22T14:44:56Z")
I have filebeat deployed through ECK on my Kubernetes cluster. I want to read the logs from a specific pod whose log file name is something like this dev-be-svc-logistic-8c9bfbd85-qs6ng\_smartbox-dev\_dev-be-svc-logistic-4… --- ## [How to update user profile using API without \`manage\_security\` privilege](https://discuss.elastic.co/t/how-to-update-user-profile-using-api-without-manage-security-privilege/312545)
**Author:** [@Azhar\_Uddin1](https://discuss.elastic.co/u/Azhar_Uddin1)\ **Replies:** 3\ **Last updated:** [August 22, 2022, 2:39pm UTC](https://discuss.elastic.co/t/how-to-update-user-profile-using-api-without-manage-security-privilege/312545 "2022-08-22T14:39:58Z")
I am trying to update the user profile using Flask API if user is logged in then he/she can update his profile fields full name, email only when I trying to update user using put\_user #es=Elasticsearch instance sscl… --- ## [Kibana to Elastic Search Communication Not Working with Wildcard Certificate](https://discuss.elastic.co/t/kibana-to-elastic-search-communication-not-working-with-wildcard-certificate/312037)
**Author:** [@hoover63](https://discuss.elastic.co/u/hoover63)\ **Replies:** 3\ **Last updated:** [August 22, 2022, 1:52pm UTC](https://discuss.elastic.co/t/kibana-to-elastic-search-communication-not-working-with-wildcard-certificate/312037 "2022-08-22T13:52:44Z")
For the last couple of days I have been trying to add a wildcard certificate to a new ELK server (one server running ES+Kibana). I have gotten the cert to work with ES, however, Kibana is unable to communicate with ES us… --- ## [Unable to find ip releted filed in rollups](https://discuss.elastic.co/t/unable-to-find-ip-releted-filed-in-rollups/312342)
**Author:** [@Surendra\_Hire](https://discuss.elastic.co/u/Surendra_Hire)\ **Replies:** 1\ **Last updated:** [August 22, 2022, 12:35am UTC](https://discuss.elastic.co/t/unable-to-find-ip-releted-filed-in-rollups/312342 "2022-08-22T00:35:46Z")
Hello i am applying rollups function on my data. there are mutiple filed in ES. but when i applyed rollup job i cound found ip releted fileds. first image i have apply rollup and second image i can not found ip rel… --- ## [Kibana 8.2.3 heat map was not ok](https://discuss.elastic.co/t/kibana-8-2-3-heat-map-was-not-ok/312243)
**Author:** [@Marco1221](https://discuss.elastic.co/u/Marco1221)\ **Replies:** 2\ **Last updated:** [August 22, 2022, 1:15pm UTC](https://discuss.elastic.co/t/kibana-8-2-3-heat-map-was-not-ok/312243 "2022-08-22T13:15:52Z")
I‘m chinese，so my english just soso I found Kibana 8.2.3 heat map was not ok， The heat map is displayed only once！ that 2 pictures in one video who can help me！ thanks！ --- ## [Array Sort Script to sort array by index](https://discuss.elastic.co/t/array-sort-script-to-sort-array-by-index/312617)
**Author:** [@Dakshay\_Agarwal](https://discuss.elastic.co/u/Dakshay_Agarwal)\ **Replies:** 2\ **Last updated:** [August 22, 2022, 12:50pm UTC](https://discuss.elastic.co/t/array-sort-script-to-sort-array-by-index/312617 "2022-08-22T12:50:04Z")
PUT /my-index-000001/\_doc/1?refresh { "product": "chocolate", "salesManager" :\["a","z","r"\] } PUT /my-index-000001/\_doc/2?refresh { "product": "chocolate", "salesManager" :\["v","f","d"\] } PUT /my-index-0000… --- ## [How to automatically create a new Elasticsearch cluster (via Terraform and user-data scripts)?](https://discuss.elastic.co/t/how-to-automatically-create-a-new-elasticsearch-cluster-via-terraform-and-user-data-scripts/312619)
**Author:** [@burnersk](https://discuss.elastic.co/u/burnersk)\ **Replies:** 0\ **Last updated:** [August 22, 2022, 12:19pm UTC](https://discuss.elastic.co/t/how-to-automatically-create-a-new-elasticsearch-cluster-via-terraform-and-user-data-scripts/312619 "2022-08-22T12:19:19Z")
I am about to create a small Terraform script for an Elastic Stack "training" (not an actual training, just infrastructure description for a playground cluster), which setups Elasticsearch using a Cloud-init user-data sc… --- ## [Syntax for running async search in PHP client?](https://discuss.elastic.co/t/syntax-for-running-async-search-in-php-client/312464)
**Author:** [@me24](https://discuss.elastic.co/u/me24)\ **Replies:** 2\ **Last updated:** [August 22, 2022, 11:40am UTC](https://discuss.elastic.co/t/syntax-for-running-async-search-in-php-client/312464 "2022-08-22T11:40:14Z")
Hi, I'm trying to fire multiple search requests in parallel (same input but different queries) to save on execution time - running them in series seems wasteful. I'm using PHP 7.4 and ES 7.5.2 at the moment, running "re… --- ## [Super-long wildcard query (must be a better way!)](https://discuss.elastic.co/t/super-long-wildcard-query-must-be-a-better-way/312605)
**Author:** [@Richie\_Jarvis](https://discuss.elastic.co/u/Richie_Jarvis)\ **Replies:** 1\ **Last updated:** [August 22, 2022, 11:35am UTC](https://discuss.elastic.co/t/super-long-wildcard-query-must-be-a-better-way/312605 "2022-08-22T11:35:41Z")
Hi All, I am playing with some flight data at the moment, and wanted to view the Eastbourne Airshow data I have captured with my aerial & dump1090 integration. To this end, I want to exclude all commercial flights from… --- ## [Nodes disconnected randomly](https://discuss.elastic.co/t/nodes-disconnected-randomly/312599)
**Author:** [@c48105fb5be692da920e](https://discuss.elastic.co/u/c48105fb5be692da920e)\ **Replies:** 0\ **Last updated:** [August 22, 2022, 10:31am UTC](https://discuss.elastic.co/t/nodes-disconnected-randomly/312599 "2022-08-22T10:31:26Z")
I'm running Elasticsearch cluster (7.10.2) with 8 nodes of cluster (3 master, 3 data, and 2 client node). It was running smoothly till now , now the nodes began to disconnect from the cluster one node at a day , when I… --- ## [Index template shows a policy that doesn't exist](https://discuss.elastic.co/t/index-template-shows-a-policy-that-doesnt-exist/312598)
**Author:** [@salmuhammady](https://discuss.elastic.co/u/salmuhammady)\ **Replies:** 0\ **Last updated:** [August 22, 2022, 10:24am UTC](https://discuss.elastic.co/t/index-template-shows-a-policy-that-doesnt-exist/312598 "2022-08-22T10:24:55Z")
Index Template is showing a policy lifecycle that doesn't exist. any idea how come this happens? GET /index-name/\_ilm/explain?pretty { "indices" : { ".ds-index-name-2022.01.12-000001" : { "index" : ".ds-ind… --- ## [Impossible to find index template path](https://discuss.elastic.co/t/impossible-to-find-index-template-path/312541)
**Author:** [@Samuele\_Lolli](https://discuss.elastic.co/u/Samuele_Lolli)\ **Replies:** 4\ **Last updated:** [August 22, 2022, 9:38am UTC](https://discuss.elastic.co/t/impossible-to-find-index-template-path/312541 "2022-08-22T09:38:43Z")
I created a index template from the Kibana UI but i can't configure properly the index inside my logstash pipeline because i can't find the path of the index template. --- ## [Can only use wildcard queries on keyword, text and wildcard fields](https://discuss.elastic.co/t/can-only-use-wildcard-queries-on-keyword-text-and-wildcard-fields/312591)
**Author:** [@shrikantgulia](https://discuss.elastic.co/u/shrikantgulia)\ **Replies:** 0\ **Last updated:** [August 22, 2022, 9:36am UTC](https://discuss.elastic.co/t/can-only-use-wildcard-queries-on-keyword-text-and-wildcard-fields/312591 "2022-08-22T09:36:07Z")
Hi, I have defined mappings for my index when i am doing wildcard search ipaddress i am getting an error Can only use wildcard queries on keyword, text and wildcard fields - not on \[scan\_iteration\] which is of type \[i… --- ## [Logstash behavior to output to Elastic Search closed index](https://discuss.elastic.co/t/logstash-behavior-to-output-to-elastic-search-closed-index/312590)
**Author:** [@sg.gpar](https://discuss.elastic.co/u/sg.gpar)\ **Replies:** 0\ **Last updated:** [August 22, 2022, 9:23am UTC](https://discuss.elastic.co/t/logstash-behavior-to-output-to-elastic-search-closed-index/312590 "2022-08-22T09:23:54Z")
logstash output is configured as Elastic Search index. Somehow index was closed in between after loading some data, For pending data it will reload automatically after index was opened ? --- ## [Kibana Scripted Field HourOfDay](https://discuss.elastic.co/t/kibana-scripted-field-hourofday/311447)
**Author:** [@fim01](https://discuss.elastic.co/u/fim01)\ **Replies:** 3\ **Last updated:** [August 22, 2022, 8:14am UTC](https://discuss.elastic.co/t/kibana-scripted-field-hourofday/311447 "2022-08-22T08:14:14Z")
I followed documentation to create a simple scripted field to calculate HourOfDay doc\['@timestamp'\].date.hourOfDay error: { "took": 5, "timed\_out": false, "\_shards": { "total": 9, "successful": 8, … --- ## [Can't connect with elasticsearch because of https or SSL security](https://discuss.elastic.co/t/cant-connect-with-elasticsearch-because-of-https-or-ssl-security/312581)
**Author:** [@Sarindra\_Therese](https://discuss.elastic.co/u/Sarindra_Therese)\ **Replies:** 2\ **Last updated:** [August 22, 2022, 7:34am UTC](https://discuss.elastic.co/t/cant-connect-with-elasticsearch-because-of-https-or-ssl-security/312581 "2022-08-22T07:34:04Z")
Hey, I have some problems when i want to connect elasticsearch port, for example i can't connect python to elasticsearch because of ssl, the https, the same for kafka confluent, I've already use some technique like ad… --- ## [Kibana LDAP authentication via apache proxy](https://discuss.elastic.co/t/kibana-ldap-authentication-via-apache-proxy/312385)
**Author:** [@thirty2](https://discuss.elastic.co/u/thirty2)\ **Replies:** 4\ **Last updated:** [August 22, 2022, 7:27am UTC](https://discuss.elastic.co/t/kibana-ldap-authentication-via-apache-proxy/312385 "2022-08-22T07:27:57Z")
Hi, with xpack and TLS for elasticserach + kibana disable i can use ldap authentication via apache. I can login to kibana with my ldap account. Kibana config: server.port: 5601 server.host: "myhost" elasticsearch.hos… --- ## [Need to upgrade to ES 8](https://discuss.elastic.co/t/need-to-upgrade-to-es-8/312579)
**Author:** [@Jana03](https://discuss.elastic.co/u/Jana03)\ **Replies:** 1\ **Last updated:** [August 22, 2022, 6:50am UTC](https://discuss.elastic.co/t/need-to-upgrade-to-es-8/312579 "2022-08-22T06:50:52Z")
Hi, We need to upgrade ES to 8+ version, for that i need the compatible fluentd and fluentd es plugin versions. can you please help [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=821) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=823)