# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=935 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 936 --- ## [Extract CSV Data](https://discuss.elastic.co/t/extract-csv-data/304687)
**Author:** [@Angad\_Panesar1](https://discuss.elastic.co/u/Angad_Panesar1)\ **Replies:** 1\ **Last updated:** [May 18, 2022, 4:20pm UTC](https://discuss.elastic.co/t/extract-csv-data/304687 "2022-05-18T16:20:02Z")
Hi, I am attempting to extract more than 1 month's worth of data and put it into a CSV through the discover tab. Unfortunately, when I tried to do that I only get a day's worth of data. Is there any way that you can help… --- ## [How to add image against new custom plugin?](https://discuss.elastic.co/t/how-to-add-image-against-new-custom-plugin/304683)
**Author:** [@niveditakathal](https://discuss.elastic.co/u/niveditakathal)\ **Replies:** 1\ **Last updated:** [May 18, 2022, 4:18pm UTC](https://discuss.elastic.co/t/how-to-add-image-against-new-custom-plugin/304683 "2022-05-18T16:18:31Z")
Hi All, I am bit new to kibana custom plugin development. Based on elastic documentation , I have added euiIconType to add image path under "core.application.register()" However , I don't see any icon in kibana along … --- ## [Export Dashboard to pdf](https://discuss.elastic.co/t/export-dashboard-to-pdf/304666)
**Author:** [@marcw](https://discuss.elastic.co/u/marcw)\ **Replies:** 1\ **Last updated:** [May 18, 2022, 4:12pm UTC](https://discuss.elastic.co/t/export-dashboard-to-pdf/304666 "2022-05-18T16:12:58Z")
We use a trial key to test export to pdf functionality. I created a dashboard containing a graph and a datatable. In the dashboard the graph is shown and the full datatable is visible (a few 100 lines). When I create the… --- ## [Best way to parse multiple message patterns](https://discuss.elastic.co/t/best-way-to-parse-multiple-message-patterns/304836)
**Author:** [@Thuunder7](https://discuss.elastic.co/u/Thuunder7)\ **Replies:** 7\ **Last updated:** [May 18, 2022, 3:59pm UTC](https://discuss.elastic.co/t/best-way-to-parse-multiple-message-patterns/304836 "2022-05-18T15:59:02Z")
Hello, I want to ask if it is possible to have multiple dissect patterns? I know i can create conditionals based on the "\_dissectfailure" and create another dissect to parse other patterns, but this doesn't prevent the… --- ## [Sorting by Geo Distance with Relevance Score](https://discuss.elastic.co/t/sorting-by-geo-distance-with-relevance-score/304953)
**Author:** [@icgncl](https://discuss.elastic.co/u/icgncl)\ **Replies:** 6\ **Last updated:** [May 18, 2022, 3:19pm UTC](https://discuss.elastic.co/t/sorting-by-geo-distance-with-relevance-score/304953 "2022-05-18T15:19:04Z")
Hello everyone, I want to sort results according to relevance score and geo distance together. What is the best way to do so? --- ## [Using field value as value in message\[x\]](https://discuss.elastic.co/t/using-field-value-as-value-in-message-x/305035)
**Author:** [@alex\_vermex](https://discuss.elastic.co/u/alex_vermex)\ **Replies:** 4\ **Last updated:** [May 18, 2022, 2:43pm UTC](https://discuss.elastic.co/t/using-field-value-as-value-in-message-x/305035 "2022-05-18T14:43:47Z")
Hi, I would like to ask that i have field x =\> 0 it was an integer field value and i have a message\[\] array i want to consume the value of x inside the message for example: message\[x\] . here is an example of my code: f… --- ## [Filebeat eats all space on disks when Elastic is down](https://discuss.elastic.co/t/filebeat-eats-all-space-on-disks-when-elastic-is-down/304653)
**Author:** [@yaks-hw](https://discuss.elastic.co/u/yaks-hw)\ **Replies:** 2\ **Last updated:** [May 18, 2022, 2:06pm UTC](https://discuss.elastic.co/t/filebeat-eats-all-space-on-disks-when-elastic-is-down/304653 "2022-05-18T14:06:44Z")
Hello All, Our Elastic instance is down sometimes due to high load and human mistakes (we are in the middle of setting everything fine). When this happens, disks are getting full by Filebeat logs that notifies us that i… --- ## [Filebeat sophos module error: Provided Grok expressions do not match field value](https://discuss.elastic.co/t/filebeat-sophos-module-error-provided-grok-expressions-do-not-match-field-value/304675)
**Author:** [@Joshua\_H](https://discuss.elastic.co/u/Joshua_H)\ **Replies:** 16\ **Last updated:** [May 18, 2022, 1:56pm UTC](https://discuss.elastic.co/t/filebeat-sophos-module-error-provided-grok-expressions-do-not-match-field-value/304675 "2022-05-18T13:56:11Z")
Hello Everyone, I am trying to setup the Filebeat Sophos Module for a Sophos-XG Firewall. Filebeat Output is send directly to Elasticsearch. I enabled the sophos module and the initialized it sucessfully with filebeat… --- ## [Kibana won't start after 8.2.0 upgrade](https://discuss.elastic.co/t/kibana-wont-start-after-8-2-0-upgrade/304881)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 6\ **Last updated:** [May 18, 2022, 1:52pm UTC](https://discuss.elastic.co/t/kibana-wont-start-after-8-2-0-upgrade/304881 "2022-05-18T13:52:04Z")
I had 8.1.1 running and I upgraded to 8.2.0 this is single node test system. hence I shutdown Elasticsearch and kibana upgrade and start kibana is complaining like this \[2022-05-16T19:33:11.618-05:00\]\[FATAL\]\[root\] Er… --- ## [Kibana get 502 Bad Gateway](https://discuss.elastic.co/t/kibana-get-502-bad-gateway/304989)
**Author:** [@rachelyang](https://discuss.elastic.co/u/rachelyang)\ **Replies:** 2\ **Last updated:** [May 18, 2022, 1:38pm UTC](https://discuss.elastic.co/t/kibana-get-502-bad-gateway/304989 "2022-05-18T13:38:10Z")
Kibana status is active, but the webpage shows me 502 Bad Gateway. I checked the kibana.log. Here are the error message: {"type":"log","@timestamp":"2022-05-17T18:56:18+00:00","tags":\["error","savedobjects-service"\],"pi… --- ## [Lens not working](https://discuss.elastic.co/t/lens-not-working/305041)
**Author:** [@adis3421](https://discuss.elastic.co/u/adis3421)\ **Replies:** 2\ **Last updated:** [May 18, 2022, 1:21pm UTC](https://discuss.elastic.co/t/lens-not-working/305041 "2022-05-18T13:21:42Z")
Hi, After update kibana from 8.1.2 to 8.2 When i try to create new visualization in Lens option nothing showing. On Oracle Linux 8.4 --- ## [Not Getting Logs in Elastic Stack](https://discuss.elastic.co/t/not-getting-logs-in-elastic-stack/305025)
**Author:** [@Rajesh119](https://discuss.elastic.co/u/Rajesh119)\ **Replies:** 19\ **Last updated:** [May 18, 2022, 1:13pm UTC](https://discuss.elastic.co/t/not-getting-logs-in-elastic-stack/305025 "2022-05-18T13:13:37Z")
Hi, i recently install latest version of elastic stack(Elasticsearch, kibana, logstash and filebeat) but iam not getting logs in elastic stack. please any one help me. curl -X GET "localhost:9200/\_cat/indices?v" outp… --- ## [Script alerts](https://discuss.elastic.co/t/script-alerts/305056)
**Author:** [@bdaniel7](https://discuss.elastic.co/u/bdaniel7)\ **Replies:** 1\ **Last updated:** [May 18, 2022, 1:02pm UTC](https://discuss.elastic.co/t/script-alerts/305056 "2022-05-18T13:02:26Z")
Hi, Is it possible to define alerts as Painless scripts? So I don't have to use the web interface on each environment where I install ELK? --- ## [Elastic Agent Custom Windows Event Logs](https://discuss.elastic.co/t/elastic-agent-custom-windows-event-logs/304485)
**Author:** [@Joshua\_H](https://discuss.elastic.co/u/Joshua_H)\ **Replies:** 4\ **Last updated:** [May 18, 2022, 12:55pm UTC](https://discuss.elastic.co/t/elastic-agent-custom-windows-event-logs/304485 "2022-05-18T12:55:53Z")
Hello everyone, I am struggling to add custom Windows Event Logs to my Elastic-Agents / my Agent-Policy and make it work. For example I would like to ingest Elasticsearch with Event Logs from the Serverrole Remotedeskt… --- ## [New Java API client BulkRequest lacks documentation/features](https://discuss.elastic.co/t/new-java-api-client-bulkrequest-lacks-documentation-features/304809)
**Author:** [@frankmontyne](https://discuss.elastic.co/u/frankmontyne)\ **Replies:** 2\ **Last updated:** [May 18, 2022, 12:55pm UTC](https://discuss.elastic.co/t/new-java-api-client-bulkrequest-lacks-documentation-features/304809 "2022-05-18T12:55:35Z")
Can somebody show me a more elaborate example of using the new Java API BulkRequest? I used to be able to set things like bulk size, bulk actions, concurrent requests,... I already took a look at elasticsearch-java/Requ… --- ## [O365 authentication details shows up after 2 hr in kibana](https://discuss.elastic.co/t/o365-authentication-details-shows-up-after-2-hr-in-kibana/305062)
**Author:** [@niveditakathal](https://discuss.elastic.co/u/niveditakathal)\ **Replies:** 2\ **Last updated:** [May 18, 2022, 12:47pm UTC](https://discuss.elastic.co/t/o365-authentication-details-shows-up-after-2-hr-in-kibana/305062 "2022-05-18T12:47:58Z")
Hi Experts, I added the O365 integration in elastic 8.2 with all default Content types enabled to monitor the successful/failure login details ; However when I was testing the possible test cases, I noticed that If I l… --- ## [How do I connect logstash with ES?](https://discuss.elastic.co/t/how-do-i-connect-logstash-with-es/304797)
**Author:** [@McLaine](https://discuss.elastic.co/u/McLaine)\ **Replies:** 2\ **Last updated:** [May 18, 2022, 12:00pm UTC](https://discuss.elastic.co/t/how-do-i-connect-logstash-with-es/304797 "2022-05-18T12:00:43Z")
Hi! What do I have to do? Something like Elasticsearch-users useradd ? And add some roles? Best Andy --- ## [Remove fields based on a regex in the ingest pipeline](https://discuss.elastic.co/t/remove-fields-based-on-a-regex-in-the-ingest-pipeline/304447)
**Author:** [@Althea\_Vestrit](https://discuss.elastic.co/u/Althea_Vestrit)\ **Replies:** 2\ **Last updated:** [May 18, 2022, 11:23am UTC](https://discuss.elastic.co/t/remove-fields-based-on-a-regex-in-the-ingest-pipeline/304447 "2022-05-18T11:23:23Z")
Hello, I use elastic-agents to save docker logs by using the "Custom logs" integration. When uploading logs, fields are added according to the labels of the different containers from which the logs are retrieved. Howe… --- ## [Filebeat topics with 'when' conditions](https://discuss.elastic.co/t/filebeat-topics-with-when-conditions/305054)
**Author:** [@juliang](https://discuss.elastic.co/u/juliang)\ **Replies:** 0\ **Last updated:** [May 18, 2022, 11:20am UTC](https://discuss.elastic.co/t/filebeat-topics-with-when-conditions/305054 "2022-05-18T11:20:13Z")
Hi there, I have the below defined in my output.kafka section topics: - topic: "my-topic" when: and: - equals: kubernetes.namespace: "test" - has\_… --- ## [What's the limit of specified values on a DLS filter?](https://discuss.elastic.co/t/whats-the-limit-of-specified-values-on-a-dls-filter/305050)
**Author:** [@InesCM](https://discuss.elastic.co/u/InesCM)\ **Replies:** 0\ **Last updated:** [May 18, 2022, 10:52am UTC](https://discuss.elastic.co/t/whats-the-limit-of-specified-values-on-a-dls-filter/305050 "2022-05-18T10:52:15Z")
Hi! I need to perform a query on a set of specified values, and for that I'm using a filter with a manually defined DSL query such as this one (this is an example recommended in another thread that works fine): { "que… --- ## [ILM forcemerge of empty index takes ~5 minutes](https://discuss.elastic.co/t/ilm-forcemerge-of-empty-index-takes-5-minutes/305048)
**Author:** [@nisow95612](https://discuss.elastic.co/u/nisow95612)\ **Replies:** 0\ **Last updated:** [May 18, 2022, 10:46am UTC](https://discuss.elastic.co/t/ilm-forcemerge-of-empty-index-takes-5-minutes/305048 "2022-05-18T10:46:03Z")
This is a minor observation on 7.17: When ILM tries to forcemerge a new & completely empty index, it takes surprisingly long. I often reindex like this: I first create and empty index with index.lifecycle.origination\_d… --- ## [How to create login page for kibana 7.16.2](https://discuss.elastic.co/t/how-to-create-login-page-for-kibana-7-16-2/305047)
**Author:** [@Madhu\_Adi](https://discuss.elastic.co/u/Madhu_Adi)\ **Replies:** 0\ **Last updated:** [May 18, 2022, 10:45am UTC](https://discuss.elastic.co/t/how-to-create-login-page-for-kibana-7-16-2/305047 "2022-05-18T10:45:01Z")
Hi I am using traefik as Ingress in kubernetes. Before I was using traefik 1.7 version everything was working fine, but after upgrading traefik 2.6 then I cannot see the login page of kibana and directly populating to th… --- ## [Is a Authentication neccessary?](https://discuss.elastic.co/t/is-a-authentication-neccessary/304656)
**Author:** [@frankmehlhop](https://discuss.elastic.co/u/frankmehlhop)\ **Replies:** 16\ **Last updated:** [May 18, 2022, 8:45am UTC](https://discuss.elastic.co/t/is-a-authentication-neccessary/304656 "2022-05-18T08:45:01Z")
Hi, I installed Elastic and Kibana localy on my device and I create a index. Than I create a C# console project using .NET6.0 and Visual Studio as described here. But I can't get it running. The problem I described he… --- ## [Add\_kubernetes\_metadata with elatsicsearch on kubernetes, elasticsearch-operator does not add k8s field in kibana](https://discuss.elastic.co/t/add-kubernetes-metadata-with-elatsicsearch-on-kubernetes-elasticsearch-operator-does-not-add-k8s-field-in-kibana/304646)
**Author:** [@ryuseongryong](https://discuss.elastic.co/u/ryuseongryong)\ **Replies:** 1\ **Last updated:** [May 18, 2022, 8:15am UTC](https://discuss.elastic.co/t/add-kubernetes-metadata-with-elatsicsearch-on-kubernetes-elasticsearch-operator-does-not-add-k8s-field-in-kibana/304646 "2022-05-18T08:15:56Z")
hi, I've got a problem with add\_kubernetes\_metadata setting in my filebeat.yaml set-up with Elasticsearch-operator and Elasticsearch, metricbeat and filebeat, kibana as elasticsearch.k8s.elastic.co/v1, beat.k8s.elastic.… --- ## [How to create a custom dropdown which will populate the elasticsearch multi bucket data as different bar charts](https://discuss.elastic.co/t/how-to-create-a-custom-dropdown-which-will-populate-the-elasticsearch-multi-bucket-data-as-different-bar-charts/305033)
**Author:** [@Priya\_Bari](https://discuss.elastic.co/u/Priya_Bari)\ **Replies:** 0\ **Last updated:** [May 18, 2022, 8:11am UTC](https://discuss.elastic.co/t/how-to-create-a-custom-dropdown-which-will-populate-the-elasticsearch-multi-bucket-data-as-different-bar-charts/305033 "2022-05-18T08:11:15Z")
I am trying to create a custom visualization for which will be fetching details from Elasticsearch using following query GET sample/\_search { "aggs": { "open\_entries": { "filter": { "range": { … --- ## [MaxListenersExceededWarning in kibana 8.2.0](https://discuss.elastic.co/t/maxlistenersexceededwarning-in-kibana-8-2-0/305031)
**Author:** [@wo7387196](https://discuss.elastic.co/u/wo7387196)\ **Replies:** 0\ **Last updated:** [May 18, 2022, 8:00am UTC](https://discuss.elastic.co/t/maxlistenersexceededwarning-in-kibana-8-2-0/305031 "2022-05-18T08:00:42Z")
\[2022-05-18T15:52:58.633+08:00\]\[WARN \]\[process\] MaxListenersExceededWarning: Possible EventTarget memory leak detected. 11 abort listeners added to \[AbortSignal\]. Use events.setMaxListeners() to increase limit at Abo… --- ## [Filebeat allow only specific line or content](https://discuss.elastic.co/t/filebeat-allow-only-specific-line-or-content/305017)
**Author:** [@abhi.logs](https://discuss.elastic.co/u/abhi.logs)\ **Replies:** 5\ **Last updated:** [May 18, 2022, 7:47am UTC](https://discuss.elastic.co/t/filebeat-allow-only-specific-line-or-content/305017 "2022-05-18T07:47:23Z")
Hello, How can I allow only specific lines and for specific log files as well? example: I have lots of files in the inputs.d file but for the xyz.log file, I wanna set up the filter only to allow "out of memory" line o… --- ## [About the implements of alias, addAlias and removeAlias](https://discuss.elastic.co/t/about-the-implements-of-alias-addalias-and-removealias/305013)
**Author:** [@xingzhao](https://discuss.elastic.co/u/xingzhao)\ **Replies:** 3\ **Last updated:** [May 18, 2022, 7:32am UTC](https://discuss.elastic.co/t/about-the-implements-of-alias-addalias-and-removealias/305013 "2022-05-18T07:32:35Z")
Hello, I would like to ask about the methods of alias, how are addAlias and removeAlias implemented? How do they avoid problems with atomicity among other operations? For example, how to ensure that the alias information… --- ## [Wrong Mapping of ECS fields on fleet-managed datastreams causing multiple issues](https://discuss.elastic.co/t/wrong-mapping-of-ecs-fields-on-fleet-managed-datastreams-causing-multiple-issues/305014)
**Author:** [@Bryan\_Hamilton](https://discuss.elastic.co/u/Bryan_Hamilton)\ **Replies:** 0\ **Last updated:** [May 18, 2022, 4:27am UTC](https://discuss.elastic.co/t/wrong-mapping-of-ecs-fields-on-fleet-managed-datastreams-causing-multiple-issues/305014 "2022-05-18T04:27:37Z")
Hi, We recently migrated part of our environment from beats to the elastic-agent managed by fleet integrations. While this makes agent management very easy, it introduced a lot of mapping issues which then cause search … --- ## [Elasticsearch with Go and Docker](https://discuss.elastic.co/t/elasticsearch-with-go-and-docker/305008)
**Author:** [@mrfirdauss-20](https://discuss.elastic.co/u/mrfirdauss-20)\ **Replies:** 2\ **Last updated:** [May 18, 2022, 4:21am UTC](https://discuss.elastic.co/t/elasticsearch-with-go-and-docker/305008 "2022-05-18T04:21:43Z")
I use docker and Elasticsearch, i got confused, when i set the Elasticsearch url (when initialize it) in golang to "Elasticsearch:9200", the massages shows \> "health check timeout: no Elasticsearch node available" but … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=934) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=936)