# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=883 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 884 --- ## [Elastic Agent, System Integration, Processors](https://discuss.elastic.co/t/elastic-agent-system-integration-processors/308236)
**Author:** [@fran\_hernandez](https://discuss.elastic.co/u/fran_hernandez)\ **Replies:** 8\ **Last updated:** [June 29, 2022, 8:49am UTC](https://discuss.elastic.co/t/elastic-agent-system-integration-processors/308236 "2022-06-29T08:49:30Z")
Hello, I am trying to get the hostname of a given IP in a field (source.ip), I am doing this for an agent deployed within a system integration, I have defined some processors in the "processors" field some drop\_event. B… --- ## [High CPU Usage in Elastic](https://discuss.elastic.co/t/high-cpu-usage-in-elastic/308429)
**Author:** [@Muhammad\_Umair](https://discuss.elastic.co/u/Muhammad_Umair)\ **Replies:** 3\ **Last updated:** [June 29, 2022, 8:18am UTC](https://discuss.elastic.co/t/high-cpu-usage-in-elastic/308429 "2022-06-29T08:18:49Z")
High I have 2 nodes in Elasticsearch cluster. 1 master and 1 data node. The master node is also a data node I have 2 logstash instances running and one filebeat on separate machines. The load is not too much just a mod… --- ## [Elasticesearch upgrade from 7.17 version to 8.x version](https://discuss.elastic.co/t/elasticesearch-upgrade-from-7-17-version-to-8-x-version/308424)
**Author:** [@Priyanka\_chauhan](https://discuss.elastic.co/u/Priyanka_chauhan)\ **Replies:** 1\ **Last updated:** [June 29, 2022, 7:35am UTC](https://discuss.elastic.co/t/elasticesearch-upgrade-from-7-17-version-to-8-x-version/308424 "2022-06-29T07:35:57Z")
How to upgrade 7.17 elsasticsearch to 8.x version --- ## [Optionnal triggers in functionbeat](https://discuss.elastic.co/t/optionnal-triggers-in-functionbeat/308425)
**Author:** [@Lucas\_Zientek](https://discuss.elastic.co/u/Lucas_Zientek)\ **Replies:** 0\ **Last updated:** [June 29, 2022, 7:14am UTC](https://discuss.elastic.co/t/optionnal-triggers-in-functionbeat/308425 "2022-06-29T07:14:29Z")
Hello everyone, I have an issue on my functionbeat configuration, I want to have no triggers declared in my functionbeat.yml file. I am deploying the functionbeat lambda on aws using cloudformation that I edited myself… --- ## [Can't enroll token in elasticseacrh v8 in another vm](https://discuss.elastic.co/t/cant-enroll-token-in-elasticseacrh-v8-in-another-vm/308423)
**Author:** [@pencari\_berkah](https://discuss.elastic.co/u/pencari_berkah)\ **Replies:** 0\ **Last updated:** [June 29, 2022, 6:56am UTC](https://discuss.elastic.co/t/cant-enroll-token-in-elasticseacrh-v8-in-another-vm/308423 "2022-06-29T06:56:18Z")
i can't enroll kibana token in elasticseacrh, i create OVA my elastic server and move to new vm, but i don't know why elastic cannot enroll a new token now, please help. this error 13:45:56.788 \[main\] WARN org.elasti… --- ## [Some questions about PutComponentTemplateRequest in Java API](https://discuss.elastic.co/t/some-questions-about-putcomponenttemplaterequest-in-java-api/308308)
**Author:** [@black\_t](https://discuss.elastic.co/u/black_t)\ **Replies:** 1\ **Last updated:** [June 29, 2022, 6:41am UTC](https://discuss.elastic.co/t/some-questions-about-putcomponenttemplaterequest-in-java-api/308308 "2022-06-29T06:41:12Z")
Hi,guys. When i use the Elasticsearch of version 7.17.2, i found something when i use the PutComponentTemplateRequest. i used 7.11.1 in my last project, so i refer the guide document and follow it to create : PutCom… --- ## [Return first/last/mid characters of a keyword field](https://discuss.elastic.co/t/return-first-last-mid-characters-of-a-keyword-field/306372)
**Author:** [@behappy\_alwayz0401](https://discuss.elastic.co/u/behappy_alwayz0401)\ **Replies:** 2\ **Last updated:** [June 29, 2022, 5:24am UTC](https://discuss.elastic.co/t/return-first-last-mid-characters-of-a-keyword-field/306372 "2022-06-29T05:24:46Z")
I have a field account name that has string values with spaces. I would like to return the first 5 and last 4 characters of each value in this field in a runtime painless field. how can this be done? thanks --- ## [Winlogbeat error connecting to Elasticsearch at https://ip:9200: Get "https://ip:9200": x509: certificate signed by unknown authority (possibly because of "crypto/rsa: verification error" while trying to verify candidate authority cert](https://discuss.elastic.co/t/winlogbeat-error-connecting-to-elasticsearch-at-https-ip-get-https-ip-9200-x509-certificate-signed-by-unknown-authority-possibly-because-of-crypto-rsa-verification-error-while-trying-to-verify-candidate-authority-cert/308419)
**Author:** [@alipujaistopo](https://discuss.elastic.co/u/alipujaistopo)\ **Replies:** 0\ **Last updated:** [June 29, 2022, 4:29am UTC](https://discuss.elastic.co/t/winlogbeat-error-connecting-to-elasticsearch-at-https-ip-get-https-ip-9200-x509-certificate-signed-by-unknown-authority-possibly-because-of-crypto-rsa-verification-error-while-trying-to-verify-candidate-authority-cert/308419 "2022-06-29T04:29:39Z")
i just try to install winlogbeat, and i put the ip into elasticsearch-ca.pem. but have an error like this. please help 2022-06-29T11:25:47.925+0700 INFO instance/beat.go:328 Setup Beat: winlogbeat; Version: 7.1… --- ## [How do you bind Elasticsearch server to public(ipV4) address?](https://discuss.elastic.co/t/how-do-you-bind-elasticsearch-server-to-public-ipv4-address/308415)
**Author:** [@DataStorageMuse](https://discuss.elastic.co/u/DataStorageMuse)\ **Replies:** 12\ **Last updated:** [June 29, 2022, 3:59am UTC](https://discuss.elastic.co/t/how-do-you-bind-elasticsearch-server-to-public-ipv4-address/308415 "2022-06-29T03:59:43Z")
I'm trying to use a http\_ca certificate to connect to an Elasticsearch server (using Python), and I was wondering how I can bind an instance to a public IP address. When I try to connect, I get this error: elastic\_trans… --- ## [Hi This is om I wanted some help so pls help me](https://discuss.elastic.co/t/hi-this-is-om-i-wanted-some-help-so-pls-help-me/308417)
**Author:** [@Draco\_King](https://discuss.elastic.co/u/Draco_King)\ **Replies:** 1\ **Last updated:** [June 29, 2022, 2:53am UTC](https://discuss.elastic.co/t/hi-this-is-om-i-wanted-some-help-so-pls-help-me/308417 "2022-06-29T02:53:28Z")
This is my python code and wanted help pls help #!/usr/bin/env python3 #-- coding: utf-8 -- import the Elasticsearch low-level client library from elasticsearch import Elasticsearch domain name, or server's IP addres… --- ## [How to dynamically pass range query variables](https://discuss.elastic.co/t/how-to-dynamically-pass-range-query-variables/308410)
**Author:** [@hitesh\_nagdev](https://discuss.elastic.co/u/hitesh_nagdev)\ **Replies:** 1\ **Last updated:** [June 29, 2022, 12:12am UTC](https://discuss.elastic.co/t/how-to-dynamically-pass-range-query-variables/308410 "2022-06-29T00:12:54Z")
hi We need to pass dynamic values for timestamp into the filter range query within script. something like below example. "filter": \[ { "range": { "@timestamp": { "lte": "now-{{dynamicValueLte}}", "gte": "now-{{dyn… --- ## [Elastic\_agent 8.2.3 unhealthy status](https://discuss.elastic.co/t/elastic-agent-8-2-3-unhealthy-status/308413)
**Author:** [@Badr\_Atouhlaten](https://discuss.elastic.co/u/Badr_Atouhlaten)\ **Replies:** 2\ **Last updated:** [June 29, 2022, 12:00am UTC](https://discuss.elastic.co/t/elastic-agent-8-2-3-unhealthy-status/308413 "2022-06-29T00:00:55Z")
bellow error log in the client after i upgraded the elastic agent to 8.2.3 \[elastic\_agent\]\[error\] 2022-06-28T23:51:31Z - message: Application: filebeat--8.2.3\[23ef375c-440f-4504-aef6-26bfeb72d272\]: State changed to FAIL… --- ## [List of dictionaries mapping error](https://discuss.elastic.co/t/list-of-dictionaries-mapping-error/308273)
**Author:** [@cstone1492](https://discuss.elastic.co/u/cstone1492)\ **Replies:** 1\ **Last updated:** [June 28, 2022, 11:56pm UTC](https://discuss.elastic.co/t/list-of-dictionaries-mapping-error/308273 "2022-06-28T23:56:19Z")
I am using ES 7.15 and attempting to explicit map a list of dictionaries in an index. The goal is field for each doc something like: "authors" : \[ {"name": "Mary", "org": "Havard"}, {"name": "Joe", "… --- ## [Configuring kibana and elasticsearsh in HTTPS](https://discuss.elastic.co/t/configuring-kibana-and-elasticsearsh-in-https/308340)
**Author:** [@Firas\_Bougrine](https://discuss.elastic.co/u/Firas_Bougrine)\ **Replies:** 1\ **Last updated:** [June 28, 2022, 11:52pm UTC](https://discuss.elastic.co/t/configuring-kibana-and-elasticsearsh-in-https/308340 "2022-06-28T23:52:21Z")
how to configuring kibana and elasticsearsh in HTTPS and access to the interface of kibana with https ?? thanks . --- ## [Elasticsearch inbound/outbound traffic](https://discuss.elastic.co/t/elasticsearch-inbound-outbound-traffic/308352)
**Author:** [@Anton\_Schleenvoigt](https://discuss.elastic.co/u/Anton_Schleenvoigt)\ **Replies:** 2\ **Last updated:** [June 28, 2022, 11:50pm UTC](https://discuss.elastic.co/t/elasticsearch-inbound-outbound-traffic/308352 "2022-06-28T23:50:28Z")
Hi, I'm trying to find out the amount of data produced for internal traffic between elasticsearch nodes. Did not find any useful on internet, and i always think that someone have been playing around with this type of qu… --- ## [Elasticsearch Datehistogram Interval](https://discuss.elastic.co/t/elasticsearch-datehistogram-interval/308367)
**Author:** [@Soumen\_Das](https://discuss.elastic.co/u/Soumen_Das)\ **Replies:** 1\ **Last updated:** [June 28, 2022, 11:47pm UTC](https://discuss.elastic.co/t/elasticsearch-datehistogram-interval/308367 "2022-06-28T23:47:54Z")
I am creating a date histogram aggregation like this, where min and max of extended\_bounds are unix epoch values. "aggs": { "0": { "date\_histogram": { "field": "@timestamp", … --- ## [FortiGate-logs exporten from Graylog with GELF into ELK and read by "Fortinet Logs"](https://discuss.elastic.co/t/fortigate-logs-exporten-from-graylog-with-gelf-into-elk-and-read-by-fortinet-logs/308368)
**Author:** [@j0han](https://discuss.elastic.co/u/j0han)\ **Replies:** 0\ **Last updated:** [June 28, 2022, 1:57pm UTC](https://discuss.elastic.co/t/fortigate-logs-exporten-from-graylog-with-gelf-into-elk-and-read-by-fortinet-logs/308368 "2022-06-28T13:57:24Z")
Hi all! I have a problem where I'm getting logs exported from Graylog with GELF. I can read the logs with logstash and I get the data I need exported as JSON. But I'm having big problems to get the integration "Fortin… --- ## [Logs from Elastic itself](https://discuss.elastic.co/t/logs-from-elastic-itself/308383)
**Author:** [@eliumoraes](https://discuss.elastic.co/u/eliumoraes)\ **Replies:** 1\ **Last updated:** [June 28, 2022, 11:39pm UTC](https://discuss.elastic.co/t/logs-from-elastic-itself/308383 "2022-06-28T23:39:21Z")
Hello, I'm trying to find how to get the logs from elastic itself. I am using elastic cloud (with azure) and would like to see events such as reboots or system events, out of memory, green-to-yellow status, creation and… --- ## [All Log login activity Kibana](https://discuss.elastic.co/t/all-log-login-activity-kibana/308389)
**Author:** [@renato473](https://discuss.elastic.co/u/renato473)\ **Replies:** 1\ **Last updated:** [June 28, 2022, 11:36pm UTC](https://discuss.elastic.co/t/all-log-login-activity-kibana/308389 "2022-06-28T23:36:01Z")
Hello, I would like to know how do I have access logs to kibana of activities performed by users. my cluster is in the cloud and when trying to use the xpack.security.audit.enabled option return the following error. "… --- ## [Indices full of data](https://discuss.elastic.co/t/indices-full-of-data/308406)
**Author:** [@Badr\_Atouhlaten](https://discuss.elastic.co/u/Badr_Atouhlaten)\ **Replies:** 3\ **Last updated:** [June 28, 2022, 11:35pm UTC](https://discuss.elastic.co/t/indices-full-of-data/308406 "2022-06-28T23:35:10Z")
how i can clear the data in .ds-packetbeat-8.2.3-2022.06.21\*\] , i want to keep only 3 or 4 days worth of data, this way i can make sure i will not run out of disk space. --- ## [Difference between network.host, transport.host and http.host settings](https://discuss.elastic.co/t/difference-between-network-host-transport-host-and-http-host-settings/308215)
**Author:** [@Firas\_Bougrine](https://discuss.elastic.co/u/Firas_Bougrine)\ **Replies:** 5\ **Last updated:** [June 28, 2022, 11:23pm UTC](https://discuss.elastic.co/t/difference-between-network-host-transport-host-and-http-host-settings/308215 "2022-06-28T23:23:56Z")
Why http.host: and #transport.host: are still 0.0.0.0 after changing network.host: to a static @ i know that i have been configured my network.host before "0.0.0.0" but it still 0.0.0.0 in this two settings { http.host: … --- ## [Bug: Elastic Search Highlight Queries (Does not do Phrase match )](https://discuss.elastic.co/t/bug-elastic-search-highlight-queries-does-not-do-phrase-match/308407)
**Author:** [@soumilshah1995](https://discuss.elastic.co/u/soumilshah1995)\ **Replies:** 0\ **Last updated:** [June 28, 2022, 11:02pm UTC](https://discuss.elastic.co/t/bug-elastic-search-highlight-queries-does-not-do-phrase-match/308407 "2022-06-28T23:02:32Z")
Hello All hope you are doing fine I have stumbled upon a bug and looking to seek advice from a community Problem Statment I want to highlight that "dreams may come" Here is what elk return PUT /test/\_doc/\_mappings … --- ## [Updating index settings by key-value pair](https://discuss.elastic.co/t/updating-index-settings-by-key-value-pair/308382)
**Author:** [@ALX\_DM](https://discuss.elastic.co/u/ALX_DM)\ **Replies:** 2\ **Last updated:** [June 28, 2022, 10:25pm UTC](https://discuss.elastic.co/t/updating-index-settings-by-key-value-pair/308382 "2022-06-28T22:25:01Z")
In the new elasticsearch-java api client, is it possible to update a specific index setting by a key-value pair? Say, you have these keys: static final String NUMBER\_OF\_REPLICAS\_KEY = "index.number\_of\_replicas"; … --- ## [Date Histogram Only Return the Last Bucket](https://discuss.elastic.co/t/date-histogram-only-return-the-last-bucket/307537)
**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Replies:** 3\ **Last updated:** [June 28, 2022, 10:12pm UTC](https://discuss.elastic.co/t/date-histogram-only-return-the-last-bucket/307537 "2022-06-28T22:12:24Z")
Hi All, I was wondering if anyone knows of a way to get only the last bucket of a date histogram to be returned. I have the following query: GET metrics-system.filesystem-\*/\_search { "size": 0, "query": { "boo… --- ## [Output to redis with a "sorted set" datatype](https://discuss.elastic.co/t/output-to-redis-with-a-sorted-set-datatype/308401)
**Author:** [@ktomu](https://discuss.elastic.co/u/ktomu)\ **Replies:** 1\ **Last updated:** [June 28, 2022, 9:26pm UTC](https://discuss.elastic.co/t/output-to-redis-with-a-sorted-set-datatype/308401 "2022-06-28T21:26:43Z")
Hi, I wanna find a way to send output to redis with datatype as "sorted set" and in batch mode. As I see now, logstash supports only list and channel as a datatype. Is there any other way how to do it? --- ## [Faceting/aggregations of nested fields](https://discuss.elastic.co/t/faceting-aggregations-of-nested-fields/308144)
**Author:** [@vadim-permakoff](https://discuss.elastic.co/u/vadim-permakoff)\ **Replies:** 2\ **Last updated:** [June 28, 2022, 9:11pm UTC](https://discuss.elastic.co/t/faceting-aggregations-of-nested-fields/308144 "2022-06-28T21:11:22Z")
Hi, I need to implement a faceting feature for nested fields. For example, I have two documents, each has an “applicability” array, which defines nested fields state, lob and year, specifying where this document is appl… --- ## [Send data from Google tag Manager to Elastic search](https://discuss.elastic.co/t/send-data-from-google-tag-manager-to-elastic-search/308391)
**Author:** [@DILIP\_SHARMA](https://discuss.elastic.co/u/DILIP_SHARMA)\ **Replies:** 0\ **Last updated:** [June 28, 2022, 7:02pm UTC](https://discuss.elastic.co/t/send-data-from-google-tag-manager-to-elastic-search/308391 "2022-06-28T19:02:58Z")
Hi Can we add Elasticsearch as Tag in Google tag manager and send data to Elasticsearch from google tag manager ? --- ## [Search API returns TotalHits 1 but zero hits in array](https://discuss.elastic.co/t/search-api-returns-totalhits-1-but-zero-hits-in-array/308390)
**Author:** [@ewolfman](https://discuss.elastic.co/u/ewolfman)\ **Replies:** 0\ **Last updated:** [June 28, 2022, 6:55pm UTC](https://discuss.elastic.co/t/search-api-returns-totalhits-1-but-zero-hits-in-array/308390 "2022-06-28T18:55:27Z")
Hi, I ran into a scenario today with relatively old and robust code where the Search API returned totalHits of 1 (as expected) but hits array was empty. The Java client threw the following exception when tying to get t… --- ## [Need help creating a status panel using Heartbeat data](https://discuss.elastic.co/t/need-help-creating-a-status-panel-using-heartbeat-data/306170)
**Author:** [@paolovalladolid](https://discuss.elastic.co/u/paolovalladolid)\ **Replies:** 6\ **Last updated:** [June 28, 2022, 6:51pm UTC](https://discuss.elastic.co/t/need-help-creating-a-status-panel-using-heartbeat-data/306170 "2022-06-28T18:51:32Z")
I am trying to partially recreate the example dashboard shown here: In particular, I want to create a panel that uses a table, and I want the first column to be an up/down status column. This is the desired look: W… --- ## [Issue with very long TCP messages](https://discuss.elastic.co/t/issue-with-very-long-tcp-messages/308377)
**Author:** [@legoguy1000](https://discuss.elastic.co/u/legoguy1000)\ **Replies:** 3\ **Last updated:** [June 28, 2022, 6:49pm UTC](https://discuss.elastic.co/t/issue-with-very-long-tcp-messages/308377 "2022-06-28T18:49:31Z")
We are trying to ingest data via TCP into logstash and send to elasticsearch. Most messages are fine but sometimes our tool produces very long TCP messages and we end up with the first message getting trimmed and the re… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=882) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=884)