# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=864 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 865 --- ## [Capture network traffic](https://discuss.elastic.co/t/capture-network-traffic/309738)
**Author:** [@brkw](https://discuss.elastic.co/u/brkw)\ **Replies:** 0\ **Last updated:** [July 15, 2022, 1:14pm UTC](https://discuss.elastic.co/t/capture-network-traffic/309738 "2022-07-15T13:14:06Z")
Hi all. I want to use ELk stack with beats to capture all traffic in my network. I installed ELK stack on VM and I want to capture all the traffic which goes in or out in my network. My configuration is set in this way: … --- ## [How to implement with complicate wording (hero hero hero)](https://discuss.elastic.co/t/how-to-implement-with-complicate-wording-hero-hero-hero/309722)
**Author:** [@Ch\_Corporate](https://discuss.elastic.co/u/Ch_Corporate)\ **Replies:** 10\ **Last updated:** [July 15, 2022, 1:00pm UTC](https://discuss.elastic.co/t/how-to-implement-with-complicate-wording-hero-hero-hero/309722 "2022-07-15T13:00:58Z")
My data is Doc 1 hero hero hero Doc 2 hero hero Doc 3 hero We would have Result is Doc 3:"hero" How do I implement this case use regular expression or wild card --- ## [NEST C# Client - Bulk Partial update of a Nested List by condition](https://discuss.elastic.co/t/nest-c-client-bulk-partial-update-of-a-nested-list-by-condition/309733)
**Author:** [@krishnapss](https://discuss.elastic.co/u/krishnapss)\ **Replies:** 0\ **Last updated:** [July 15, 2022, 12:17pm UTC](https://discuss.elastic.co/t/nest-c-client-bulk-partial-update-of-a-nested-list-by-condition/309733 "2022-07-15T12:17:28Z")
Hi, I have an index which has nested list object. I need to only update certain values based on a condition. List of history with dates and values I need to update only values matching with dates. In the below example … --- ## [Creating type in ES](https://discuss.elastic.co/t/creating-type-in-es/308666)
**Author:** [@smitak](https://discuss.elastic.co/u/smitak)\ **Replies:** 23\ **Last updated:** [July 15, 2022, 12:13pm UTC](https://discuss.elastic.co/t/creating-type-in-es/308666 "2022-07-15T12:13:18Z")
Hello , I am new to Elasticsearch. I have created index. And Now adding type and document. But getting error. {"error":"no handler found for uri \[/my\_first\_index/message\] and method \[POST\]"} Entering this command c… --- ## [Unable to run Logstash 8.3.1 (not even to check plugins): Errno::EACCES: Permission denied - NUL](https://discuss.elastic.co/t/unable-to-run-logstash-8-3-1-not-even-to-check-plugins-errno-permission-denied-nul/308871)
**Author:** [@stevedearl](https://discuss.elastic.co/u/stevedearl)\ **Replies:** 4\ **Last updated:** [July 15, 2022, 10:54am UTC](https://discuss.elastic.co/t/unable-to-run-logstash-8-3-1-not-even-to-check-plugins-errno-permission-denied-nul/308871 "2022-07-15T10:54:35Z")
I'm seeing an issue after installing Logstash 8.3.1 on Windows 10 (as part of an upgrade from Logstash 8.1.2 which has been running perfectly fine). All I've done is unpack the Logstash 8.3.1 zip file into a suitable fo… --- ## [How to filter out "-" values in Kibana?](https://discuss.elastic.co/t/how-to-filter-out-values-in-kibana/309389)
**Author:** [@Mebravo](https://discuss.elastic.co/u/Mebravo)\ **Replies:** 2\ **Last updated:** [July 15, 2022, 9:37am UTC](https://discuss.elastic.co/t/how-to-filter-out-values-in-kibana/309389 "2022-07-15T09:37:34Z")
Hi, I am trying to visualize the top process with their CPU percentage. However, when I put this in a table some values are "-". These are also sorted above normal percentages. Is there a way to filter these values out … --- ## [Error: getsockopt: connection refused](https://discuss.elastic.co/t/error-getsockopt-connection-refused/309564)
**Author:** [@benjamin\_brightson](https://discuss.elastic.co/u/benjamin_brightson)\ **Replies:** 1\ **Last updated:** [July 15, 2022, 9:04am UTC](https://discuss.elastic.co/t/error-getsockopt-connection-refused/309564 "2022-07-15T09:04:29Z")
Hi Team, This is to inform you that am trying to setup the multiple beat config with logstash , so initially i started with the single beat config where am facing the " \[Error: getsockopt: connection refused\]" this erro… --- ## [Issue for the multiline input](https://discuss.elastic.co/t/issue-for-the-multiline-input/309459)
**Author:** [@INS](https://discuss.elastic.co/u/INS)\ **Replies:** 5\ **Last updated:** [July 15, 2022, 9:00am UTC](https://discuss.elastic.co/t/issue-for-the-multiline-input/309459 "2022-07-15T09:00:08Z")
Hi @leandrojmp There we will continue topic from Grok for data - #13 by leandrojmp now we need to complete process for parsing below date with the exact content: input { file { mode =\> read path =\>… --- ## [I need to query restaurants scoring by match +distance](https://discuss.elastic.co/t/i-need-to-query-restaurants-scoring-by-match-distance/308746)
**Author:** [@Ch\_Corporate](https://discuss.elastic.co/u/Ch_Corporate)\ **Replies:** 5\ **Last updated:** [July 15, 2022, 8:41am UTC](https://discuss.elastic.co/t/i-need-to-query-restaurants-scoring-by-match-distance/308746 "2022-07-15T08:41:31Z")
I need to query restaurants scoring by match +distance here is what I want Example Data field “restaurant name”:burger(nearest) , BurgerA Case 1 if in put is “burger” The result must be 1.Burger (Nearest) 2.Burger A … --- ## [Insert a Loadbalancer between Filebeat and Logstash, and encrypt traffic](https://discuss.elastic.co/t/insert-a-loadbalancer-between-filebeat-and-logstash-and-encrypt-traffic/309721)
**Author:** [@yago82](https://discuss.elastic.co/u/yago82)\ **Replies:** 0\ **Last updated:** [July 15, 2022, 8:31am UTC](https://discuss.elastic.co/t/insert-a-loadbalancer-between-filebeat-and-logstash-and-encrypt-traffic/309721 "2022-07-15T08:31:01Z")
Hi, starting from the assumption that filebeat has its loadbalancer; Is it possbile to insert a loadbalancer between logstash and filebeat? And if it's possibile, how can encrypt traffic/data from filebeat to Loadbala… --- ## [How to analyze data in ES？](https://discuss.elastic.co/t/how-to-analyze-data-in-es/309719)
**Author:** [@wentao\_Xiong](https://discuss.elastic.co/u/wentao_Xiong)\ **Replies:** 0\ **Last updated:** [July 15, 2022, 8:11am UTC](https://discuss.elastic.co/t/how-to-analyze-data-in-es/309719 "2022-07-15T08:11:22Z")
Environment Description: Rocky Linux 8 JDK 1.8 elasticsearch-7.17.5, logstash-7.17.5, kibana-7.17.5, filebeat-7.17.5 Statement of needs: The log data has been collected into ELK, and now it is necessary to analyze t… --- ## [Setting dynamic\_templates mapping field from Java using RestHighLevelClient 7.17 for ES v8.2](https://discuss.elastic.co/t/setting-dynamic-templates-mapping-field-from-java-using-resthighlevelclient-7-17-for-es-v8-2/309715)
**Author:** [@CamiloPDL](https://discuss.elastic.co/u/CamiloPDL)\ **Replies:** 0\ **Last updated:** [July 15, 2022, 7:55am UTC](https://discuss.elastic.co/t/setting-dynamic-templates-mapping-field-from-java-using-resthighlevelclient-7-17-for-es-v8-2/309715 "2022-07-15T07:55:29Z")
Hello community! I am trying to use RestHighLevelClient (RHLC) 7.17 with compatibility mode to create indices on an ES cluster running version 8.2. I know RHLC is deprecated but at this moment we cannot afford to migrat… --- ## [Determine search fields dynamically based on user input - native Elastic solution?](https://discuss.elastic.co/t/determine-search-fields-dynamically-based-on-user-input-native-elastic-solution/309711)
**Author:** [@seb.sch](https://discuss.elastic.co/u/seb.sch)\ **Replies:** 1\ **Last updated:** [July 15, 2022, 7:37am UTC](https://discuss.elastic.co/t/determine-search-fields-dynamically-based-on-user-input-native-elastic-solution/309711 "2022-07-15T07:37:43Z")
Hello, let's assume my index looks like the following: "mappings" : { "properties" : { "id" : { "type" : "text" }, "mail" : { "type" : "text" }, "fullName" : { "type" : "text" }, "dateOfBirth" : { … --- ## [Update license needs a restart? (Elastic version 6.8.14)](https://discuss.elastic.co/t/update-license-needs-a-restart-elastic-version-6-8-14/309666)
**Author:** [@yago82](https://discuss.elastic.co/u/yago82)\ **Replies:** 2\ **Last updated:** [July 15, 2022, 7:30am UTC](https://discuss.elastic.co/t/update-license-needs-a-restart-elastic-version-6-8-14/309666 "2022-07-15T07:30:52Z")
Hi, according the documentation from 7.17 to 8.3: \*\*"Licenses are provided as a JSON file and have an effective date and an expiration date. You cannot install a new license before its effective date. License updates t… --- ## [Logstash logfile manipulation](https://discuss.elastic.co/t/logstash-logfile-manipulation/309513)
**Author:** [@hiteshadabala](https://discuss.elastic.co/u/hiteshadabala)\ **Replies:** 1\ **Last updated:** [July 15, 2022, 7:09am UTC](https://discuss.elastic.co/t/logstash-logfile-manipulation/309513 "2022-07-15T07:09:16Z")
one log file is this way line1 line2 line3 When givenn as input to logstash with grok match "message":".\*$", the log file is entered into ES as "message":"line1\\nline2\\nline3" Each \\n is considered new line and can s… --- ## [Assistance with Grok and regex](https://discuss.elastic.co/t/assistance-with-grok-and-regex/309600)
**Author:** [@JeremyP](https://discuss.elastic.co/u/JeremyP)\ **Replies:** 2\ **Last updated:** [July 15, 2022, 7:00am UTC](https://discuss.elastic.co/t/assistance-with-grok-and-regex/309600 "2022-07-15T07:00:18Z")
Hello, I'm attempting to pull the name of a software package from a CPE from NIST. This is my sample data: cpe:2.3:a:libexpat\_project:libexpat:\*:\*:\*:\*:\*:\*:\*:\* With regular regex the following expression matches the st… --- ## [Filter by the same timestamp in Kibana Query DSL](https://discuss.elastic.co/t/filter-by-the-same-timestamp-in-kibana-query-dsl/308997)
**Author:** [@CaMaNi](https://discuss.elastic.co/u/CaMaNi)\ **Replies:** 2\ **Last updated:** [July 15, 2022, 6:54am UTC](https://discuss.elastic.co/t/filter-by-the-same-timestamp-in-kibana-query-dsl/308997 "2022-07-15T06:54:04Z")
Good day dear Elastic community, I have a problem regarding my Kibana dashboard. I would like to find out what data has been accessed at the same time - as it is probably irrelevant for my consideration. Therefore, via … --- ## [Get distinct values from "text field" without remapping](https://discuss.elastic.co/t/get-distinct-values-from-text-field-without-remapping/309694)
**Author:** [@lwwalker](https://discuss.elastic.co/u/lwwalker)\ **Replies:** 5\ **Last updated:** [July 15, 2022, 6:23am UTC](https://discuss.elastic.co/t/get-distinct-values-from-text-field-without-remapping/309694 "2022-07-15T06:23:01Z")
I'm querying ~350 TB of documents. Re-indexing is not an option. Performance, within reason, is not a concern. my documents have a field s3\_filename {"type": "text"}. It doesn't have any subfields. Setting fielddata:… --- ## [Version consistency of Elastic products](https://discuss.elastic.co/t/version-consistency-of-elastic-products/309620)
**Author:** [@its-ogawa](https://discuss.elastic.co/u/its-ogawa)\ **Replies:** 3\ **Last updated:** [July 15, 2022, 6:03am UTC](https://discuss.elastic.co/t/version-consistency-of-elastic-products/309620 "2022-07-15T06:03:02Z")
I am currently attempting to configure an Elasticsearch cluster. At this time I found the following article According to this article, it is not possible to configure a cluster between different versions of Elasticsea… --- ## [Elastic-agent loading default Dashboards](https://discuss.elastic.co/t/elastic-agent-loading-default-dashboards/309556)
**Author:** [@Muhammed\_Ashique](https://discuss.elastic.co/u/Muhammed_Ashique)\ **Replies:** 5\ **Last updated:** [July 15, 2022, 5:50am UTC](https://discuss.elastic.co/t/elastic-agent-loading-default-dashboards/309556 "2022-07-15T05:50:36Z")
I am upgrading beats to elastic-agents for shipping the logs. How can i load default dashboards using elastic beats. what are the communication port i need to enable to achieve this requirements --- ## [請教如何讓兩台filebeat client各自產生自己的index](https://discuss.elastic.co/t/filebeat-client-index/309699)
**Author:** [@jim220617](https://discuss.elastic.co/u/jim220617)\ **Replies:** 0\ **Last updated:** [July 15, 2022, 3:28am UTC](https://discuss.elastic.co/t/filebeat-client-index/309699 "2022-07-15T03:28:24Z")
我有一台ELK server，收了自己的filebeat log，也收了一台client端filebeat log，想各自產生自己的index。應該要怎樣做? 使用版本: CentOS 7.9 elasticsearch 8.3.1 filebeat 8.3.1 kibana 8.3.1 logstash 8.3.1 謝謝 --- ## [Exiting: 1 error: failed to create audit client: failed to get audit status: operation not permitted](https://discuss.elastic.co/t/exiting-1-error-failed-to-create-audit-client-failed-to-get-audit-status-operation-not-permitted/309579)
**Author:** [@alexus](https://discuss.elastic.co/u/alexus)\ **Replies:** 2\ **Last updated:** [July 15, 2022, 3:07am UTC](https://discuss.elastic.co/t/exiting-1-error-failed-to-create-audit-client-failed-to-get-audit-status-operation-not-permitted/309579 "2022-07-15T03:07:56Z")
Hello World! I'm trying to Run Auditbeat on Docker | Auditbeat Reference \[7.17\] | Elastic, yet running into following issue: # docker compose logs --tail 1 auditbeat | Exiting: 1 error: failed to create audit client: … --- ## [Cannot change omitNorms=false to inconsistent omitNorms=true](https://discuss.elastic.co/t/cannot-change-omitnorms-false-to-inconsistent-omitnorms-true/309361)
**Author:** [@Johnny\_Yang](https://discuss.elastic.co/u/Johnny_Yang)\ **Replies:** 3\ **Last updated:** [July 15, 2022, 1:48am UTC](https://discuss.elastic.co/t/cannot-change-omitnorms-false-to-inconsistent-omitnorms-true/309361 "2022-07-15T01:48:26Z")
I recently used the update\_mapping API to set one of the fields in my index to "norms:false", but then when I try to save new documents to it, it gives error: "{"error":{"root\_cause":\[{"type":"illegal\_argument\_exception"… --- ## [Master not discovered exception](https://discuss.elastic.co/t/master-not-discovered-exception/309677)
**Author:** [@NadyLeez123](https://discuss.elastic.co/u/NadyLeez123)\ **Replies:** 1\ **Last updated:** [July 15, 2022, 1:36am UTC](https://discuss.elastic.co/t/master-not-discovered-exception/309677 "2022-07-15T01:36:57Z")
We have an elasticsearch cluster of 2 masters et 6 data nodes since 2 years. Yesterday, requests became very slow, we started experiencing a time out in elasticsearch and kibana. We then discovered this on one of the tw… --- ## [Trying to analyze data but getting wrong data format from log what are the options its big data](https://discuss.elastic.co/t/trying-to-analyze-data-but-getting-wrong-data-format-from-log-what-are-the-options-its-big-data/309376)
**Author:** [@Gaming\_zone](https://discuss.elastic.co/u/Gaming_zone)\ **Replies:** 2\ **Last updated:** [July 15, 2022, 1:27am UTC](https://discuss.elastic.co/t/trying-to-analyze-data-but-getting-wrong-data-format-from-log-what-are-the-options-its-big-data/309376 "2022-07-15T01:27:17Z")
I have to analyze the given kind of data but the data format is not n json what is the problem and how i might change it. this is the dummy json and i have to analyze data in original {"\_index": "dummy\_elk","\_id": "dum… --- ## [Kibana alerting mechanism](https://discuss.elastic.co/t/kibana-alerting-mechanism/309414)
**Author:** [@Jathurshan\_Sumandira](https://discuss.elastic.co/u/Jathurshan_Sumandira)\ **Replies:** 1\ **Last updated:** [July 15, 2022, 12:27am UTC](https://discuss.elastic.co/t/kibana-alerting-mechanism/309414 "2022-07-15T00:27:02Z")
Hi Team, I am using Kibana alert rules and I used Elasticsearch query type. This query is scheduled to run every 1 minute. I have 20 alert rules with Elasticsearch query types. I need to know that, is it possible to co… --- ## [Terraform - Is it possible to start an elasticsearch cluster locally on docker-desktop/k8s with terraform?](https://discuss.elastic.co/t/terraform-is-it-possible-to-start-an-elasticsearch-cluster-locally-on-docker-desktop-k8s-with-terraform/309695)
**Author:** [@Rem](https://discuss.elastic.co/u/Rem)\ **Replies:** 0\ **Last updated:** [July 15, 2022, 12:22am UTC](https://discuss.elastic.co/t/terraform-is-it-possible-to-start-an-elasticsearch-cluster-locally-on-docker-desktop-k8s-with-terraform/309695 "2022-07-15T00:22:06Z")
I would like to use kubernetes provider on terraform to start an elasticsearch clusters. Is that feasible? What's the proper way to do it? Thank you --- ## [Exiting: fail to create the Kibana loader: Error creating Kibana client: Error creating Kibana client: fail to get the Kibana version: HTTP GET request ls: fail to execute the HTTP GET request: Get http://localhost:5601/api/status: dial tcp localhost:5601](https://discuss.elastic.co/t/exiting-fail-to-create-the-kibana-loader-error-creating-kibana-client-error-creating-kibana-client-fail-to-get-the-kibana-version-http-get-request-ls-fail-to-execute-the-http-get-request-get-http-localhost-5601-api-status-dial-tcp-localhost-5601/309310)
**Author:** [@Jass](https://discuss.elastic.co/u/Jass)\ **Replies:** 1\ **Last updated:** [July 14, 2022, 11:48pm UTC](https://discuss.elastic.co/t/exiting-fail-to-create-the-kibana-loader-error-creating-kibana-client-error-creating-kibana-client-fail-to-get-the-kibana-version-http-get-request-ls-fail-to-execute-the-http-get-request-get-http-localhost-5601-api-status-dial-tcp-localhost-5601/309310 "2022-07-14T23:48:11Z")
Hello, Currently I am working on Elasticsearch, filebeat and Kibana. I do have a problem with Kibana. When I execute the commande "sudo filebeat setup" , I got this kind of message error : Loaded index template Loadin… --- ## [View Specific Index-pattern data in a specific kibana space](https://discuss.elastic.co/t/view-specific-index-pattern-data-in-a-specific-kibana-space/309299)
**Author:** [@Saad\_Ansari](https://discuss.elastic.co/u/Saad_Ansari)\ **Replies:** 1\ **Last updated:** [July 14, 2022, 11:41pm UTC](https://discuss.elastic.co/t/view-specific-index-pattern-data-in-a-specific-kibana-space/309299 "2022-07-14T23:41:15Z")
Hi Team, I have a single elastic-cloud managed cluster, all my app env's (prod/stage/dev/etc...) are streaming data to this single cluster. Now to separate these diff env data, I've created different agent policies with… --- ## [Set Limit for Date Filter in Elastic cluster](https://discuss.elastic.co/t/set-limit-for-date-filter-in-elastic-cluster/309247)
**Author:** [@lstoneir](https://discuss.elastic.co/u/lstoneir)\ **Replies:** 2\ **Last updated:** [July 14, 2022, 11:28pm UTC](https://discuss.elastic.co/t/set-limit-for-date-filter-in-elastic-cluster/309247 "2022-07-14T23:28:17Z")
Hi I have a general question! I have a elastic with a lot of docs in index! I want to set threshold on datetime filter and not allow users to execute heavy queries on cluster. for example i set datetime\_max\_filter = … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=863) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=865)