# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=931 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 932 --- ## [ILM with existing indices](https://discuss.elastic.co/t/ilm-with-existing-indices/305316)
**Author:** [@lchan](https://discuss.elastic.co/u/lchan)\ **Replies:** 1\ **Last updated:** [May 20, 2022, 7:54pm UTC](https://discuss.elastic.co/t/ilm-with-existing-indices/305316 "2022-05-20T19:54:22Z")
I am following Manage existing indices | Elasticsearch Guide \[8.2\] | Elastic and I am trying to apply all existing indices (that are in hot node) with policy "existing-indices" so it can go through ilm but it the step is… --- ## [Custom Authorization Engine issue](https://discuss.elastic.co/t/custom-authorization-engine-issue/305024)
**Author:** [@ash\_n](https://discuss.elastic.co/u/ash_n)\ **Replies:** 8\ **Last updated:** [May 20, 2022, 7:25pm UTC](https://discuss.elastic.co/t/custom-authorization-engine-issue/305024 "2022-05-20T19:25:49Z")
I'm working on an implementation of a custom authorization engine by following the instructions on this page and using this sample. I'm using Elasticsearch v8.2.0. I've been able to generate the single zip file for my c… --- ## [Configuring Kibana Logging](https://discuss.elastic.co/t/configuring-kibana-logging/305112)
**Author:** [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Replies:** 2\ **Last updated:** [May 20, 2022, 7:16pm UTC](https://discuss.elastic.co/t/configuring-kibana-logging/305112 "2022-05-20T19:16:44Z")
I don't know why this is so hard, but I can't figure out the new way of configuring logging in Kibana. I am trying to output kibana logs to a file, below is what I have. It doesn't throw errors, but it also doesn't log… --- ## [Kibana failed to load CA: PEM routines:get\_name:no start line](https://discuss.elastic.co/t/kibana-failed-to-load-ca-pem-routinesno-start-line/305228)
**Author:** [@rileghft](https://discuss.elastic.co/u/rileghft)\ **Replies:** 2\ **Last updated:** [May 20, 2022, 7:11pm UTC](https://discuss.elastic.co/t/kibana-failed-to-load-ca-pem-routinesno-start-line/305228 "2022-05-20T19:11:54Z")
I setup an Elasticsearch cluster, and the cluster health is green. Elasticsearch cluster can be reached on kibana server, but kibana failed to start, showing PEM error. Environment: OS: Almalinux 8.6 Kibana version: … --- ## [Kibana issue connecting to elasticsearch via https](https://discuss.elastic.co/t/kibana-issue-connecting-to-elasticsearch-via-https/305237)
**Author:** [@GSood1](https://discuss.elastic.co/u/GSood1)\ **Replies:** 1\ **Last updated:** [May 20, 2022, 6:23pm UTC](https://discuss.elastic.co/t/kibana-issue-connecting-to-elasticsearch-via-https/305237 "2022-05-20T18:23:13Z")
So I've been informed by our IT that we need to enable SSL on our setup. Currently, we are using logstash, Elasticsearch, and kibana running via 3 separate docker containers. I got a DoD SSL cert from our IT folks and … --- ## [Error Kibana container is unhealthy](https://discuss.elastic.co/t/error-kibana-container-is-unhealthy/303409)
**Author:** [@Fabian\_Crespo\_Fernan](https://discuss.elastic.co/u/Fabian_Crespo_Fernan)\ **Replies:** 12\ **Last updated:** [May 20, 2022, 5:27pm UTC](https://discuss.elastic.co/t/error-kibana-container-is-unhealthy/303409 "2022-05-20T17:27:13Z")
Hello, We are trying to install and configure an Elasticsearch cluster in Ubuntu 20.04.4 LTS(x86-64) with the docker-compose.yml from https://www.elastic.co/guide/en/elasticsearch/reference/current/docker.html. The comm… --- ## [Setting Index.max\_result\_window to less than default value](https://discuss.elastic.co/t/setting-index-max-result-window-to-less-than-default-value/305305)
**Author:** [@Kishore\_Pothireddy](https://discuss.elastic.co/u/Kishore_Pothireddy)\ **Replies:** 0\ **Last updated:** [May 20, 2022, 5:25pm UTC](https://discuss.elastic.co/t/setting-index-max-result-window-to-less-than-default-value/305305 "2022-05-20T17:25:53Z")
Hi, I would like to know if there will be any performance improvement if we set the Index.max\_result\_window to 5000 upfront and adverse effects if any in doing so. Can someone pls explain? Thank you. --- ## [Logstash elasticsearch-filter module return the wrong document](https://discuss.elastic.co/t/logstash-elasticsearch-filter-module-return-the-wrong-document/305304)
**Author:** [@CyaTo](https://discuss.elastic.co/u/CyaTo)\ **Replies:** 0\ **Last updated:** [May 20, 2022, 5:05pm UTC](https://discuss.elastic.co/t/logstash-elasticsearch-filter-module-return-the-wrong-document/305304 "2022-05-20T17:05:47Z")
Hi, I'm trying to run a logstash ingestion pipeline that is able to enrich an event by querying an Elasticsearch node But so far I can't get it to work 100%, here is what I did: My logstash pipeline look like that : i… --- ## [\]\[FATAL\]\[org.logstash.Logstash \] Logstash stopped processing because of an error: (SystemExit) exit org.jruby.exceptions.SystemExit: (SystemExit) exit](https://discuss.elastic.co/t/fatal-org-logstash-logstash-logstash-stopped-processing-because-of-an-error-systemexit-exit-org-jruby-exceptions-systemexit-systemexit-exit/305283)
**Author:** [@MOUNA1](https://discuss.elastic.co/u/MOUNA1)\ **Replies:** 5\ **Last updated:** [May 20, 2022, 11:18am UTC](https://discuss.elastic.co/t/fatal-org-logstash-logstash-logstash-stopped-processing-because-of-an-error-systemexit-exit-org-jruby-exceptions-systemexit-systemexit-exit/305283 "2022-05-20T11:18:20Z")
I want to configure logstash to receive logs from pfsense but i have an error when i tested the configuration via : /usr/share/logstash/bin/logstash --config.test\_and\_exit --log.level=debug -f /etc/logstash/conf.d/ --pa… --- ## [How to find data anomalies?](https://discuss.elastic.co/t/how-to-find-data-anomalies/305238)
**Author:** [@AdamYS](https://discuss.elastic.co/u/AdamYS)\ **Replies:** 9\ **Last updated:** [May 20, 2022, 3:58pm UTC](https://discuss.elastic.co/t/how-to-find-data-anomalies/305238 "2022-05-20T15:58:50Z")
We have various indexes in Elasticsearch and I wonder if it'd be possible to find anomalies in the data? For example: We have a document for each test we run. The document has the test name as one field and the result … --- ## [The offline installation with esrally-dist-2.4.0 give incompatible error](https://discuss.elastic.co/t/the-offline-installation-with-esrally-dist-2-4-0-give-incompatible-error/304362)
**Author:** [@keylane\_sbaas](https://discuss.elastic.co/u/keylane_sbaas)\ **Replies:** 3\ **Last updated:** [May 20, 2022, 3:28pm UTC](https://discuss.elastic.co/t/the-offline-installation-with-esrally-dist-2-4-0-give-incompatible-error/304362 "2022-05-20T15:28:37Z")
I was installing esrally on RHEL7 machine. At the point of installing there was an problem, that not enough dependencies where installed at the time. That is not the problem for this topic, but the ERROR while installing… --- ## [Select only one element inside an object](https://discuss.elastic.co/t/select-only-one-element-inside-an-object/305296)
**Author:** [@mmoreram](https://discuss.elastic.co/u/mmoreram)\ **Replies:** 3\ **Last updated:** [May 20, 2022, 3:09pm UTC](https://discuss.elastic.co/t/select-only-one-element-inside-an-object/305296 "2022-05-20T15:09:43Z")
Let's say I have an object with N fields, and I only want to return one of them. How can I do that? Can I exclude the whole object and then include one of their childs? Thanks. --- ## [How fast can Filebeat send logs from disk?](https://discuss.elastic.co/t/how-fast-can-filebeat-send-logs-from-disk/305295)
**Author:** [@mikewillis](https://discuss.elastic.co/u/mikewillis)\ **Replies:** 1\ **Last updated:** [May 20, 2022, 3:03pm UTC](https://discuss.elastic.co/t/how-fast-can-filebeat-send-logs-from-disk/305295 "2022-05-20T15:03:53Z")
Filebeat 7.17 sending over the network to Logstash 6 (we're looking to get it upgraded) running on CentOS 7, 64GB RAM, 2 x 14 core Intel Xeon E5-2690. We've got some logs which often total as much as ~1.4b single line … --- ## [Populating User Information From AD Authentication](https://discuss.elastic.co/t/populating-user-information-from-ad-authentication/305236)
**Author:** [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Replies:** 2\ **Last updated:** [May 20, 2022, 3:05pm UTC](https://discuss.elastic.co/t/populating-user-information-from-ad-authentication/305236 "2022-05-20T15:05:54Z")
Is it possible to populate a user's Elasticsearch/Kibana fields when authenticated against AD? I'm guessing it's through the use of the xpack.security.authc.realms.activedirectory.metadata setting, but I'm not sure what … --- ## [Kibana Painless script documentation](https://discuss.elastic.co/t/kibana-painless-script-documentation/305292)
**Author:** [@behappy\_alwayz0401](https://discuss.elastic.co/u/behappy_alwayz0401)\ **Replies:** 1\ **Last updated:** [May 20, 2022, 2:14pm UTC](https://discuss.elastic.co/t/kibana-painless-script-documentation/305292 "2022-05-20T14:14:36Z")
Hi, Where can we find a complete list of all possible script codes along with the functions they perform that can be used in Painless Kibana Scripting? thank you.. --- ## [Heartbeat: response code in case of error](https://discuss.elastic.co/t/heartbeat-response-code-in-case-of-error/304493)
**Author:** [@aviral\_srivastava](https://discuss.elastic.co/u/aviral_srivastava)\ **Replies:** 6\ **Last updated:** [May 20, 2022, 1:14pm UTC](https://discuss.elastic.co/t/heartbeat-response-code-in-case-of-error/304493 "2022-05-20T13:14:08Z")
Hi, I am using heartbeat 6.4.0. I can see that in case of successful connection, unauthorized access, not found it returns http.response.status\_code as 200, 401, 404 respectively. But, in case of errors like below ther… --- ## [If condition for text field](https://discuss.elastic.co/t/if-condition-for-text-field/305291)
**Author:** [@behappy\_alwayz0401](https://discuss.elastic.co/u/behappy_alwayz0401)\ **Replies:** 1\ **Last updated:** [May 20, 2022, 12:59pm UTC](https://discuss.elastic.co/t/if-condition-for-text-field/305291 "2022-05-20T12:59:26Z")
Hi, I am trying to search a text field for a particular value and perform an operation on the result. E.g. say, the text field is Region with values DA, DP, DE, RA, RP, RE. The condition I require is "if Region is DA, … --- ## [Snapshot repository missing after remounting network disk](https://discuss.elastic.co/t/snapshot-repository-missing-after-remounting-network-disk/304921)
**Author:** [@elaskibuser](https://discuss.elastic.co/u/elaskibuser)\ **Replies:** 9\ **Last updated:** [May 20, 2022, 12:50pm UTC](https://discuss.elastic.co/t/snapshot-repository-missing-after-remounting-network-disk/304921 "2022-05-20T12:50:45Z")
Hi All, We decided to increase the amount of storage we have for snapshots On a three node cluster elastic cluster v7. We did that by copying the contents of the old disk to the bigger disk. When copying was done, we u… --- ## [Integration Misp using Filebeat](https://discuss.elastic.co/t/integration-misp-using-filebeat/305229)
**Author:** [@francescouk](https://discuss.elastic.co/u/francescouk)\ **Replies:** 4\ **Last updated:** [May 20, 2022, 12:38pm UTC](https://discuss.elastic.co/t/integration-misp-using-filebeat/305229 "2022-05-20T12:38:02Z")
Hi there, I´m trying to integrate MISP using the documentation using filebeat but no go. I´ve tried both (Misp module and Threatintel module) and none of them gets into ELK Stack. Follow the errors from filebeat journa… --- ## [Multiple beats are not sharing the same data path](https://discuss.elastic.co/t/multiple-beats-are-not-sharing-the-same-data-path/305280)
**Author:** [@Rajesh119](https://discuss.elastic.co/u/Rajesh119)\ **Replies:** 1\ **Last updated:** [May 20, 2022, 11:00am UTC](https://discuss.elastic.co/t/multiple-beats-are-not-sharing-the-same-data-path/305280 "2022-05-20T11:00:15Z")
Iam new to ELK. Can You please anyone help regarding this issue. filebeat -e -c /etc/filebeat/filebeat.yml {"log.level":"info","@timestamp":"2022-05-20T10:43:40.450Z","log.origin":{"file.name":"instance/beat.go","fil… --- ## [After enabling the xpack security, couldn't access into kibana](https://discuss.elastic.co/t/after-enabling-the-xpack-security-couldnt-access-into-kibana/305036)
**Author:** [@fanfan01127](https://discuss.elastic.co/u/fanfan01127)\ **Replies:** 5\ **Last updated:** [May 20, 2022, 10:54am UTC](https://discuss.elastic.co/t/after-enabling-the-xpack-security-couldnt-access-into-kibana/305036 "2022-05-20T10:54:12Z")
First of all, I am currently using Elasticsearch 7.17 on Linux Redhat 8. Since I want to install the elastic agent on my windows client, so I get into Fleet to set it up. But there is a message told me that missing sec… --- ## [Corrupt indexes](https://discuss.elastic.co/t/corrupt-indexes/305277)
**Author:** [@frankshad](https://discuss.elastic.co/u/frankshad)\ **Replies:** 0\ **Last updated:** [May 20, 2022, 10:27am UTC](https://discuss.elastic.co/t/corrupt-indexes/305277 "2022-05-20T10:27:17Z")
The NFS server that stores ES indices got disconnected from my server while my provider was doing some maintenance. This corrupted two indices: .kibana\_task\_manager\_7.12.1\_001 and a custom one called applications. The fo… --- ## [Elastic Performance is slow](https://discuss.elastic.co/t/elastic-performance-is-slow/304927)
**Author:** [@nagrgk](https://discuss.elastic.co/u/nagrgk)\ **Replies:** 15\ **Last updated:** [May 20, 2022, 10:22am UTC](https://discuss.elastic.co/t/elastic-performance-is-slow/304927 "2022-05-20T10:22:06Z")
Hi Team I have custom cluster built with 3 nodes and all of them are master and data nodes. (at any point only one can master) we have seen very quick data pull and push with response time is around 150ms to 250ms, but… --- ## [Logstash Error - Unknown setting 'chedule' for jdbc](https://discuss.elastic.co/t/logstash-error-unknown-setting-chedule-for-jdbc/305268)
**Author:** [@Dr.Rask](https://discuss.elastic.co/u/Dr.Rask)\ **Replies:** 2\ **Last updated:** [May 20, 2022, 10:00am UTC](https://discuss.elastic.co/t/logstash-error-unknown-setting-chedule-for-jdbc/305268 "2022-05-20T10:00:37Z")
Hi, Getting this error when running logstash 8.2.0 on a windows machine PS C:\\logstash-oss-8.2.0\\bin\> .\\logstash -f logstash.config \[logstash.inputs.jdbc \] Unknown setting 'chedule' for jdbc input { jdbc{ jdbc… --- ## [Error downloading GeoIP behind proxy in Elasticsearch](https://discuss.elastic.co/t/error-downloading-geoip-behind-proxy-in-elasticsearch/297152)
**Author:** [@RdrgPorto](https://discuss.elastic.co/u/RdrgPorto)\ **Replies:** 1\ **Last updated:** [May 20, 2022, 9:49am UTC](https://discuss.elastic.co/t/error-downloading-geoip-behind-proxy-in-elasticsearch/297152 "2022-05-20T09:49:50Z")
Hi, everyone I have just installed Elasticsearch 7.16.3 in Red Hat 7.9. This virtual machine is behind a proxy. Looking over Elasticsearch's log, I have found an error related to GeoIP: \[2022-02-14T15:14:29,056\]\[ERROR\]… --- ## [Faster/easier way to secure a v7 production-mode Cluster without loosing data](https://discuss.elastic.co/t/faster-easier-way-to-secure-a-v7-production-mode-cluster-without-loosing-data/305258)
**Author:** [@hulaux](https://discuss.elastic.co/u/hulaux)\ **Replies:** 4\ **Last updated:** [May 20, 2022, 9:37am UTC](https://discuss.elastic.co/t/faster-easier-way-to-secure-a-v7-production-mode-cluster-without-loosing-data/305258 "2022-05-20T09:37:19Z")
Fact is one cannot use Elasticsearch-setup-passwords in a unsecure production-mode Elasticsearch 7.17 Cluster. I know some people turned each possible master node into a single dev-mode cluster with data apart (so Elast… --- ## [Passing env variables to kibana through docker-compose](https://discuss.elastic.co/t/passing-env-variables-to-kibana-through-docker-compose/305266)
**Author:** [@sanskar-panchal-gith](https://discuss.elastic.co/u/sanskar-panchal-gith)\ **Replies:** 0\ **Last updated:** [May 20, 2022, 9:23am UTC](https://discuss.elastic.co/t/passing-env-variables-to-kibana-through-docker-compose/305266 "2022-05-20T09:23:55Z")
Hi , I want to pass some external urls as env variables to dockerized kibana setup. I found a topic which has this answer but it is too old now -Reading config/env variable inside kibana plugin I want to do the same i… --- ## [Kibana active directory](https://discuss.elastic.co/t/kibana-active-directory/304917)
**Author:** [@Dmitrymig](https://discuss.elastic.co/u/Dmitrymig)\ **Replies:** 6\ **Last updated:** [May 20, 2022, 9:14am UTC](https://discuss.elastic.co/t/kibana-active-directory/304917 "2022-05-20T09:14:02Z")
Guys help me, I can't log in kibana, error 401, my settings are in Elasticsearch xpack.security.enabled: true xpack: security: authc: realms: active\_directory: my\_ad: domain\_nam… --- ## [Multiple Kibana instances on elasticsearch cluster](https://discuss.elastic.co/t/multiple-kibana-instances-on-elasticsearch-cluster/305205)
**Author:** [@George\_Dimitropoulos](https://discuss.elastic.co/u/George_Dimitropoulos)\ **Replies:** 3\ **Last updated:** [May 20, 2022, 8:40am UTC](https://discuss.elastic.co/t/multiple-kibana-instances-on-elasticsearch-cluster/305205 "2022-05-20T08:40:33Z")
I have two kibana instances on version 8.1.2 . I installed the first one with rpm and for the second one I followed kibana dev guide and built an localized kibana in order to translate the UI to greek. I used to have… --- ## [Question: Non-Productive Licence?](https://discuss.elastic.co/t/question-non-productive-licence/305260)
**Author:** [@smm](https://discuss.elastic.co/u/smm)\ **Replies:** 3\ **Last updated:** [May 20, 2022, 8:39am UTC](https://discuss.elastic.co/t/question-non-productive-licence/305260 "2022-05-20T08:39:26Z")
Dear Elastic, what is the common proceedings in such cases related to licences: We will (again) buy a bunch of licences (this time platinum ones) for our production environments. In the past we also got non-production l… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=930) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=932)