# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=925 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 926 --- ## [Stop filter processing of the event on condition match and jump to output](https://discuss.elastic.co/t/stop-filter-processing-of-the-event-on-condition-match-and-jump-to-output/305673)
**Author:** [@esuser27](https://discuss.elastic.co/u/esuser27)\ **Replies:** 2\ **Last updated:** [May 26, 2022, 4:35pm UTC](https://discuss.elastic.co/t/stop-filter-processing-of-the-event-on-condition-match-and-jump-to-output/305673 "2022-05-26T16:35:16Z")
Hi Team, I want to know if there is any way to stop my filter processing of the event on condition match and jump to output for ex if \[log\] == "parsed" { stop processing next filter portion and jump to output } --- ## [Filebeat raise error:filestream input id already exist](https://discuss.elastic.co/t/filebeat-raise-error-filestream-input-id-already-exist/305241)
**Author:** [@duduniao](https://discuss.elastic.co/u/duduniao)\ **Replies:** 8\ **Last updated:** [May 26, 2022, 4:15pm UTC](https://discuss.elastic.co/t/filebeat-raise-error-filestream-input-id-already-exist/305241 "2022-05-26T16:15:01Z")
I install filebeat-8.1.2 on centos 7, then use filestream input to read log files: - type: filestream id: ro-server-run-log paths: \['/data/ro\_jplive/log/\*-\*-\*-????-??-??-??.log'\] prospector.scanner.exclude\_files:… --- ## [Update logstash geo\_ip lib file do you need to restart the system?](https://discuss.elastic.co/t/update-logstash-geo-ip-lib-file-do-you-need-to-restart-the-system/305670)
**Author:** [@zhanghao116560](https://discuss.elastic.co/u/zhanghao116560)\ **Replies:** 1\ **Last updated:** [May 26, 2022, 4:13pm UTC](https://discuss.elastic.co/t/update-logstash-geo-ip-lib-file-do-you-need-to-restart-the-system/305670 "2022-05-26T16:13:48Z")
I covered the logstash file/vendor/bundle/app / 2.3.0 / gems/logstash - filter - geoip - 5.0.3 - Java/vendor/GeoLite2 - City. mmdb, but much more special server, Check whether you need to restart the system to take effec… --- ## [My regExp doesn't work in mutate gsub](https://discuss.elastic.co/t/my-regexp-doesnt-work-in-mutate-gsub/305657)
**Author:** [@playingkim0916](https://discuss.elastic.co/u/playingkim0916)\ **Replies:** 1\ **Last updated:** [May 26, 2022, 4:10pm UTC](https://discuss.elastic.co/t/my-regexp-doesnt-work-in-mutate-gsub/305657 "2022-05-26T16:10:52Z")
The value value of \[@metadata\]\[test\] is 2022-05-24T08:50:05.000Z , but using the corresponding regular expression causes an error error msg is Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipelin… --- ## [How to see the broadband used by the Elastic-agent](https://discuss.elastic.co/t/how-to-see-the-broadband-used-by-the-elastic-agent/305522)
**Author:** [@SamuelSMendes](https://discuss.elastic.co/u/SamuelSMendes)\ **Replies:** 1\ **Last updated:** [May 26, 2022, 3:55pm UTC](https://discuss.elastic.co/t/how-to-see-the-broadband-used-by-the-elastic-agent/305522 "2022-05-26T15:55:54Z")
By the System Integration I can already see the inbout and outbound metrics. But I wanted to know how much of my internet is the Elastic-agent using when it sends metrics to the cluster. While checking the Elastic-agent… --- ## [Bitnami/elasticsearch](https://discuss.elastic.co/t/bitnami-elasticsearch/305726)
**Author:** [@Kazwell](https://discuss.elastic.co/u/Kazwell)\ **Replies:** 0\ **Last updated:** [May 26, 2022, 3:00pm UTC](https://discuss.elastic.co/t/bitnami-elasticsearch/305726 "2022-05-26T15:00:45Z")
Hello everyone, I'm using Caprover to deploy dockers, I deployed all the ELK applications with bitnami images....I was wondering if that is why security is not automatically enabled(xpack)? Is it possible to switch to t… --- ## [Language detection](https://discuss.elastic.co/t/language-detection/305565)
**Author:** [@meyer1](https://discuss.elastic.co/u/meyer1)\ **Replies:** 1\ **Last updated:** [May 26, 2022, 2:29pm UTC](https://discuss.elastic.co/t/language-detection/305565 "2022-05-26T14:29:02Z")
Hi everyone! I have a field "content" in my index with text in it. I would like to be able to create a field "language" that would detect the language of my field "content", is this possible? Please help me with the … --- ## [Logstash is not creating index in Elasticsearch](https://discuss.elastic.co/t/logstash-is-not-creating-index-in-elasticsearch/305675)
**Author:** [@ravis85](https://discuss.elastic.co/u/ravis85)\ **Replies:** 1\ **Last updated:** [May 26, 2022, 2:23pm UTC](https://discuss.elastic.co/t/logstash-is-not-creating-index-in-elasticsearch/305675 "2022-05-26T14:23:45Z")
Hello, I am running ELK stack in docker container. Everything is working fine. However I am having an issue with Logstash, that whenever I use a input type file and provide a path to my logfile, the Logstash is not cre… --- ## [ML jobs kibana not working as expected](https://discuss.elastic.co/t/ml-jobs-kibana-not-working-as-expected/305718)
**Author:** [@S-elk](https://discuss.elastic.co/u/S-elk)\ **Replies:** 2\ **Last updated:** [May 26, 2022, 1:58pm UTC](https://discuss.elastic.co/t/ml-jobs-kibana-not-working-as-expected/305718 "2022-05-26T13:58:01Z")
Hello! I have 3 machine learning jobs in kibana which seem to work correctly and then the error "datafeed has been retrieving no data for a while" appears. how can I avoid it?? Thanks in advanced. --- ## [Missing days on Elastic but command appears to be up to date?](https://discuss.elastic.co/t/missing-days-on-elastic-but-command-appears-to-be-up-to-date/305706)
**Author:** [@LionsELK](https://discuss.elastic.co/u/LionsELK)\ **Replies:** 1\ **Last updated:** [May 26, 2022, 1:28pm UTC](https://discuss.elastic.co/t/missing-days-on-elastic-but-command-appears-to-be-up-to-date/305706 "2022-05-26T13:28:27Z")
Hi all, my colleague has informed me that we're missing a couple of days on Elastic. I've had a look and we're missing the 24th and 25th May. I've gone into the command line and reran filebeat -e -d "publisher" and whil… --- ## [Problem to cretae token for kibana interface](https://discuss.elastic.co/t/problem-to-cretae-token-for-kibana-interface/304829)
**Author:** [@Firas\_Bougrine](https://discuss.elastic.co/u/Firas_Bougrine)\ **Replies:** 7\ **Last updated:** [May 26, 2022, 12:54pm UTC](https://discuss.elastic.co/t/problem-to-cretae-token-for-kibana-interface/304829 "2022-05-26T12:54:24Z")
elastic@elastic:/usr/share/Elasticsearch/bin$ sudo ./Elasticsearch-create-enrollment-token -s kibana \`Preformatted text\`:1415) ~\[?:?\] at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:450) … --- ## [ERROR pipeline/output.go:100 Failed to connect to backoff(elasticsearch(http://elasticsearch:9200)): 401 Unauthorized](https://discuss.elastic.co/t/error-pipeline-output-go-100-failed-to-connect-to-backoff-elasticsearch-http-elasticsearch-9200-401-unauthorized/305687)
**Author:** [@kosmylo](https://discuss.elastic.co/u/kosmylo)\ **Replies:** 2\ **Last updated:** [May 26, 2022, 11:13am UTC](https://discuss.elastic.co/t/error-pipeline-output-go-100-failed-to-connect-to-backoff-elasticsearch-http-elasticsearch-9200-401-unauthorized/305687 "2022-05-26T11:13:39Z")
I have an express app with nginx that writes the web access logs through filebeat/logstash/Elasticsearch/kibana. I wanted to add packetbeat to this pipeline. The docker-compose is the following: packetbeat: build: … --- ## [How to configure Kibana behind nginx balancer](https://discuss.elastic.co/t/how-to-configure-kibana-behind-nginx-balancer/304654)
**Author:** [@eduhernandezm](https://discuss.elastic.co/u/eduhernandezm)\ **Replies:** 4\ **Last updated:** [May 26, 2022, 11:02am UTC](https://discuss.elastic.co/t/how-to-configure-kibana-behind-nginx-balancer/304654 "2022-05-26T11:02:32Z")
Hi to everyone, I have recently configured ELK in our enterprise environment. I have configured Kibana by default, without making changes, so to access Kibana, I do it by the configured host name and port: http://tfvs0… --- ## [Raw logs to data compression ratio](https://discuss.elastic.co/t/raw-logs-to-data-compression-ratio/305440)
**Author:** [@michaelv](https://discuss.elastic.co/u/michaelv)\ **Replies:** 16\ **Last updated:** [May 26, 2022, 9:23am UTC](https://discuss.elastic.co/t/raw-logs-to-data-compression-ratio/305440 "2022-05-26T09:23:20Z")
Hi All, I've been investigating some compression ratios of my live logs. Two main catergories. Auditd logs and other logs like /var/log/messages etc. Both being ingested via filebeat 7.11 and running 7.11 cluster. S… --- ## [Must have all items in array query](https://discuss.elastic.co/t/must-have-all-items-in-array-query/305561)
**Author:** [@Amit4](https://discuss.elastic.co/u/Amit4)\ **Replies:** 2\ **Last updated:** [May 26, 2022, 8:02am UTC](https://discuss.elastic.co/t/must-have-all-items-in-array-query/305561 "2022-05-26T08:02:10Z")
Hello, i have the next document structure { id: 'offering\_1', qualification: \['11', '22'\] }, { id: 'offering\_2', qualification: \['11', '22', '33'\] } I wish to run a query that will return only records from index… --- ## [Monitoring svclog using filebeat](https://discuss.elastic.co/t/monitoring-svclog-using-filebeat/305534)
**Author:** [@Gaurav\_kr](https://discuss.elastic.co/u/Gaurav_kr)\ **Replies:** 2\ **Last updated:** [May 26, 2022, 7:07am UTC](https://discuss.elastic.co/t/monitoring-svclog-using-filebeat/305534 "2022-05-26T07:07:25Z")
Hi All, I am trying to find a way to monitor .svclog using filebeat. I can get the log but having some trouble like: Unable to harvest svclog which has large log line not sure if we have any command to make sure all … --- ## [How can i schedule logstash every minute for jdbc input plugin?](https://discuss.elastic.co/t/how-can-i-schedule-logstash-every-minute-for-jdbc-input-plugin/305662)
**Author:** [@Ashok\_Priyadarshi1](https://discuss.elastic.co/u/Ashok_Priyadarshi1)\ **Replies:** 1\ **Last updated:** [May 26, 2022, 6:31am UTC](https://discuss.elastic.co/t/how-can-i-schedule-logstash-every-minute-for-jdbc-input-plugin/305662 "2022-05-26T06:31:11Z")
Please explain to me the syntax to write the cron jobs for getting jdbc input every 1 minute? --- ## [Logstash install xpack plugin error](https://discuss.elastic.co/t/logstash-install-xpack-plugin-error/305660)
**Author:** [@1065916870](https://discuss.elastic.co/u/1065916870)\ **Replies:** 1\ **Last updated:** [May 26, 2022, 6:24am UTC](https://discuss.elastic.co/t/logstash-install-xpack-plugin-error/305660 "2022-05-26T06:24:58Z")
I used docker-compose setup with logstash-oss image, but I get an error when I install xpack plugin , I want to monitor my logstash service on kibana You are using the OSS-only distribution of Logstash. As of version 6.… --- ## [Security vulnerabilities in Elasticsearch docker images - v 8.2.0](https://discuss.elastic.co/t/security-vulnerabilities-in-elasticsearch-docker-images-v-8-2-0/305559)
**Author:** [@salvoj](https://discuss.elastic.co/u/salvoj)\ **Replies:** 2\ **Last updated:** [May 26, 2022, 5:23am UTC](https://discuss.elastic.co/t/security-vulnerabilities-in-elasticsearch-docker-images-v-8-2-0/305559 "2022-05-26T05:23:56Z")
Hi, My team recently deployed Elasticsearch v 8.2.0 into an HPE Ezmeral Container Platform (kubernetes based) using ECK. Everything is working. However, this platform run a Vulnerability scan on new containers and det… --- ## [Kibana painless tutorials](https://discuss.elastic.co/t/kibana-painless-tutorials/305653)
**Author:** [@behappy\_alwayz0401](https://discuss.elastic.co/u/behappy_alwayz0401)\ **Replies:** 0\ **Last updated:** [May 26, 2022, 4:46am UTC](https://discuss.elastic.co/t/kibana-painless-tutorials/305653 "2022-05-26T04:46:21Z")
Hi, I would like some guidance on where I can take a comprehensive course to learn Kibana painless scripting from scratch. I am not a technical person but have to understand the application to create visualizations. Tha… --- ## [Disable Kibana Help button](https://discuss.elastic.co/t/disable-kibana-help-button/305651)
**Author:** [@RaonyO](https://discuss.elastic.co/u/RaonyO)\ **Replies:** 0\ **Last updated:** [May 26, 2022, 4:41am UTC](https://discuss.elastic.co/t/disable-kibana-help-button/305651 "2022-05-26T04:41:46Z")
is there any way to remove or hide the help button? --- ## [Metricbeat error: missing field accessing 'metricbeat.modules.21.hosts.0](https://discuss.elastic.co/t/metricbeat-error-missing-field-accessing-metricbeat-modules-21-hosts-0/305648)
**Author:** [@alexander2](https://discuss.elastic.co/u/alexander2)\ **Replies:** 0\ **Last updated:** [May 26, 2022, 2:15am UTC](https://discuss.elastic.co/t/metricbeat-error-missing-field-accessing-metricbeat-modules-21-hosts-0/305648 "2022-05-26T02:15:28Z")
Hello guys. i installed metricbeat on my centos 8 machine. with this configuration file. ########################## Metricbeat Configuration ########################### # This file is a full configuration example docu… --- ## [Empty server certificate chain after upgrading from ES 6.8.0.1 to ES 6.8.22](https://discuss.elastic.co/t/empty-server-certificate-chain-after-upgrading-from-es-6-8-0-1-to-es-6-8-22/305598)
**Author:** [@Sandhyarani\_Sahoo](https://discuss.elastic.co/u/Sandhyarani_Sahoo)\ **Replies:** 0\ **Last updated:** [May 25, 2022, 11:20am UTC](https://discuss.elastic.co/t/empty-server-certificate-chain-after-upgrading-from-es-6-8-0-1-to-es-6-8-22/305598 "2022-05-25T11:20:00Z")
Hello, After the upgrade from 6.8.0.1 to ES 6.8.22 to resolve log4J issue, Elastic threw exception in the logs an "empty server certificate chain" exception. I am using the following configuration: Elasticsearch.yml: … --- ## [Unable to retrieve version information from Elasticsearch nodes. connect ETIMEDOUT 53.244.254.96:9200](https://discuss.elastic.co/t/unable-to-retrieve-version-information-from-elasticsearch-nodes-connect-etimedout-53-244-254-96-9200/305570)
**Author:** [@Maximus0x](https://discuss.elastic.co/u/Maximus0x)\ **Replies:** 1\ **Last updated:** [May 25, 2022, 11:45pm UTC](https://discuss.elastic.co/t/unable-to-retrieve-version-information-from-elasticsearch-nodes-connect-etimedout-53-244-254-96-9200/305570 "2022-05-25T23:45:53Z")
Kibana.yml--\> # For more configuration options see the configuration guide for Kibana in # https://www.elastic.co/guide/index.html # =================== System: Kibana Server =================== # Kibana is served by a… --- ## [Delete unnecessary mappings from a given index](https://discuss.elastic.co/t/delete-unnecessary-mappings-from-a-given-index/305612)
**Author:** [@nunex\_17](https://discuss.elastic.co/u/nunex_17)\ **Replies:** 1\ **Last updated:** [May 25, 2022, 11:43pm UTC](https://discuss.elastic.co/t/delete-unnecessary-mappings-from-a-given-index/305612 "2022-05-25T23:43:33Z")
Hi, I have an index template called "suricata-ids" created by default from Filebeat. This index template has many fields that are simply not used by the suricata logs. How can i delete that unnecessary fields? Is it pos… --- ## [Elastic Search text similarity search](https://discuss.elastic.co/t/elastic-search-text-similarity-search/305643)
**Author:** [@gkumargaur](https://discuss.elastic.co/u/gkumargaur)\ **Replies:** 1\ **Last updated:** [May 25, 2022, 10:59pm UTC](https://discuss.elastic.co/t/elastic-search-text-similarity-search/305643 "2022-05-25T22:59:24Z")
what is the best way to search San Jose and SanJose in Elasticsearch. Data is stored as text and correct value in ES is San Jose. Sample query not working: { "match" : { "cssot\_city" : { "… --- ## [Recorded Future Integration Package Setup Stack Traces](https://discuss.elastic.co/t/recorded-future-integration-package-setup-stack-traces/303559)
**Author:** [@codewriterguy](https://discuss.elastic.co/u/codewriterguy)\ **Replies:** 7\ **Last updated:** [May 25, 2022, 9:52pm UTC](https://discuss.elastic.co/t/recorded-future-integration-package-setup-stack-traces/303559 "2022-05-25T21:52:01Z")
Setting up the Recorded Future integration package. Package installed smoothly and I was setting up feeds for domain, hash, url, ip. When setting up the url feed, I got an error when clicking Save. Believe it was from c… --- ## [Logstash aggregating through different events](https://discuss.elastic.co/t/logstash-aggregating-through-different-events/305492)
**Author:** [@alyafeai](https://discuss.elastic.co/u/alyafeai)\ **Replies:** 1\ **Last updated:** [May 25, 2022, 8:06pm UTC](https://discuss.elastic.co/t/logstash-aggregating-through-different-events/305492 "2022-05-25T20:06:51Z")
Hello, I have a question regarding aggregating with logstash my usecase is that I a csv file with specific attrbuites but some of the attrbuites come empty then I receive another file that contain these missing attrbu… --- ## [How to find which indices are mostly queried](https://discuss.elastic.co/t/how-to-find-which-indices-are-mostly-queried/305250)
**Author:** [@dimitris\_sb](https://discuss.elastic.co/u/dimitris_sb)\ **Replies:** 3\ **Last updated:** [May 25, 2022, 7:59pm UTC](https://discuss.elastic.co/t/how-to-find-which-indices-are-mostly-queried/305250 "2022-05-25T19:59:40Z")
Hi All, What is the best way to rank the indices in a cluster according to how many requests they get? API Index stats? Thank you in advance for your insights/opinons! --- ## [Improving runtime for dense embedding rescoring](https://discuss.elastic.co/t/improving-runtime-for-dense-embedding-rescoring/304445)
**Author:** [@armin20](https://discuss.elastic.co/u/armin20)\ **Replies:** 1\ **Last updated:** [May 25, 2022, 7:53pm UTC](https://discuss.elastic.co/t/improving-runtime-for-dense-embedding-rescoring/304445 "2022-05-25T19:53:07Z")
Hello, I'm using script\_score queries for rescoring search results using query and document embeddings. As expected, the runtime is notably longer than my baseline multi\_match queries and I'm looking into ways to work a… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=924) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=926)