# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=950 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 951 --- ## [Using Regex in Kibana Query DSL](https://discuss.elastic.co/t/using-regex-in-kibana-query-dsl/303991)
**Author:** [@CaMaNi](https://discuss.elastic.co/u/CaMaNi)\ **Replies:** 4\ **Last updated:** [May 5, 2022, 3:18pm UTC](https://discuss.elastic.co/t/using-regex-in-kibana-query-dsl/303991 "2022-05-05T15:18:09Z")
Good day everyone, I am relatively new to the use of Kibana. And I have the following problem: I want to filter out all numbers and special characters like "\_" or "-" in a field in Discover mode, so that I only have Le… --- ## [ILM, Fielddata memory error on Warm nodes](https://discuss.elastic.co/t/ilm-fielddata-memory-error-on-warm-nodes/303916)
**Author:** [@benoitp](https://discuss.elastic.co/u/benoitp)\ **Replies:** 3\ **Last updated:** [May 5, 2022, 2:30pm UTC](https://discuss.elastic.co/t/ilm-fielddata-memory-error-on-warm-nodes/303916 "2022-05-05T14:30:06Z")
Hello I'm trying to understand something in the logic of Elasticsearch. Here is my setup : Graylog 4.2 cluster for ingesting logs Connected to an ES 7.10 cluster The Graylog cluster knows the ES Cluster by the Maste… --- ## [Creating processor \[set\_security\_user\] (tag \[null\]) on field \[\_security\] but authentication is not currently enabled](https://discuss.elastic.co/t/creating-processor-set-security-user-tag-null-on-field-security-but-authentication-is-not-currently-enabled/304020)
**Author:** [@elephant](https://discuss.elastic.co/u/elephant)\ **Replies:** 2\ **Last updated:** [May 5, 2022, 2:31pm UTC](https://discuss.elastic.co/t/creating-processor-set-security-user-tag-null-on-field-security-but-authentication-is-not-currently-enabled/304020 "2022-05-05T14:31:54Z")
Hi, I get this WARN in loop in our elastic logs. How can I disable them? We are inside dockers and don't want/need to enable authentication. {"@timestamp":"2022-05-05T10:24:53.093Z", "log.level": "WARN", "message":"Cre… --- ## [Connection to localhost:9200 refused](https://discuss.elastic.co/t/connection-to-localhost-9200-refused/304040)
**Author:** [@Akhil2](https://discuss.elastic.co/u/Akhil2)\ **Replies:** 6\ **Last updated:** [May 5, 2022, 2:28pm UTC](https://discuss.elastic.co/t/connection-to-localhost-9200-refused/304040 "2022-05-05T14:28:10Z")
Hello all, I am running a three node cluster with version 8.0.0. I start Elasticsearch nodes, they start without any errors. but when I load data from Logstash it gives me following errors. \[2022-05-04T14:54:41,780\]\[I… --- ## [Insert time range in TSVB markdown](https://discuss.elastic.co/t/insert-time-range-in-tsvb-markdown/303230)
**Author:** [@Chiaaa](https://discuss.elastic.co/u/Chiaaa)\ **Replies:** 1\ **Last updated:** [May 5, 2022, 2:24pm UTC](https://discuss.elastic.co/t/insert-time-range-in-tsvb-markdown/303230 "2022-05-05T14:24:44Z")
Hi! I want to insert in my markdown text dynamic time range , something like: " This report starting from Apr 18, 00:00:00 to Apr 24, 23:59:59" (Those dates are the result of kql filter on ReportDate field "now-8d/d" … --- ## [Kibana : Download data in form of CSV from Vega widget](https://discuss.elastic.co/t/kibana-download-data-in-form-of-csv-from-vega-widget/303602)
**Author:** [@pranay\_jain](https://discuss.elastic.co/u/pranay_jain)\ **Replies:** 1\ **Last updated:** [May 5, 2022, 2:19pm UTC](https://discuss.elastic.co/t/kibana-download-data-in-form-of-csv-from-vega-widget/303602 "2022-05-05T14:19:54Z")
Hi, I have a dashboard containing a vega chart in the form of table. And our customer would like to download the data from the widget in the form of csv. Is this possible? Below is the Kibana aggregation based data tab… --- ## [Json input](https://discuss.elastic.co/t/json-input/303578)
**Author:** [@rituzza](https://discuss.elastic.co/u/rituzza)\ **Replies:** 1\ **Last updated:** [May 5, 2022, 2:11pm UTC](https://discuss.elastic.co/t/json-input/303578 "2022-05-05T14:11:59Z")
I would like to create a data table analysis in which some Kpi are not related to all documents but only to those that satisfy a certain condition. For example, I want to calculate sum (field1) for documents for which … --- ## [File is not a certificate adding metricbeat issue](https://discuss.elastic.co/t/file-is-not-a-certificate-adding-metricbeat-issue/303951)
**Author:** [@mangeshmj1992](https://discuss.elastic.co/u/mangeshmj1992)\ **Replies:** 2\ **Last updated:** [May 5, 2022, 2:07pm UTC](https://discuss.elastic.co/t/file-is-not-a-certificate-adding-metricbeat-issue/303951 "2022-05-05T14:07:34Z")
Hello team, While starting metricbeat , i am getting below error. D:\\path\\cert.jks; file is not a certificate adding tomcat.yml module: # Module: tomcat # Docs: https://www.elastic.co/guide/en/beats/metricbeat/7.5/… --- ## [Search large amounts of data as quickly as possible](https://discuss.elastic.co/t/search-large-amounts-of-data-as-quickly-as-possible/304021)
**Author:** [@error\_701](https://discuss.elastic.co/u/error_701)\ **Replies:** 1\ **Last updated:** [May 5, 2022, 1:48pm UTC](https://discuss.elastic.co/t/search-large-amounts-of-data-as-quickly-as-possible/304021 "2022-05-05T13:48:05Z")
hey, i think i need ur help: the following use case: Monitor IDS, I receive about 300 million records of IP addresses every day, I need to search them for every single unique IP address as the last entry. (event) My… --- ## [How can i conditionally change the unit of metric values i receive?](https://discuss.elastic.co/t/how-can-i-conditionally-change-the-unit-of-metric-values-i-receive/303576)
**Author:** [@ASHOK\_PRIYADARSHI](https://discuss.elastic.co/u/ASHOK_PRIYADARSHI)\ **Replies:** 1\ **Last updated:** [May 5, 2022, 1:32pm UTC](https://discuss.elastic.co/t/how-can-i-conditionally-change-the-unit-of-metric-values-i-receive/303576 "2022-05-05T13:32:09Z")
How can I change the unit as per my metric path ? --- ## [Logstash add custom jars to java class path](https://discuss.elastic.co/t/logstash-add-custom-jars-to-java-class-path/304039)
**Author:** [@ayout](https://discuss.elastic.co/u/ayout)\ **Replies:** 0\ **Last updated:** [May 5, 2022, 1:25pm UTC](https://discuss.elastic.co/t/logstash-add-custom-jars-to-java-class-path/304039 "2022-05-05T13:25:58Z")
how can i just add jars to logstash image ( i need them in order to be able to use custom jdbc driver ,) , when trying to do so the docker runs but fails after 1min . this is the Dockerfile : COPY ./\*.jar /usr/share/lo… --- ## [Kibana watcher sending alert cpu utilisation more than 90%](https://discuss.elastic.co/t/kibana-watcher-sending-alert-cpu-utilisation-more-than-90/303824)
**Author:** [@sanjaychahar](https://discuss.elastic.co/u/sanjaychahar)\ **Replies:** 2\ **Last updated:** [May 5, 2022, 1:24pm UTC](https://discuss.elastic.co/t/kibana-watcher-sending-alert-cpu-utilisation-more-than-90/303824 "2022-05-05T13:24:27Z")
Hi I have configured Kibana watcher to monitor cpu utilisation and its sending alert to out monitoring team stating cpu utilisation ec2 instance(Worker node) more than 90% but when I have checked in AWS CloudWatch cpu u… --- ## [\[filebeat\] - Json processor](https://discuss.elastic.co/t/filebeat-json-processor/303789)
**Author:** [@JH82](https://discuss.elastic.co/u/JH82)\ **Replies:** 1\ **Last updated:** [May 5, 2022, 1:20pm UTC](https://discuss.elastic.co/t/filebeat-json-processor/303789 "2022-05-05T13:20:15Z")
Hello, I try to make a JSON transform with processor in filebeat (with http\_endpoint as input). 2 questions : when I send a simple json message like {"message":"OK"} I receive : {"message": "success"} but I get man… --- ## [How to query multiple hosts using in elasticsearch using wildcard](https://discuss.elastic.co/t/how-to-query-multiple-hosts-using-in-elasticsearch-using-wildcard/303913)
**Author:** [@Gojo](https://discuss.elastic.co/u/Gojo)\ **Replies:** 1\ **Last updated:** [May 5, 2022, 12:43pm UTC](https://discuss.elastic.co/t/how-to-query-multiple-hosts-using-in-elasticsearch-using-wildcard/303913 "2022-05-05T12:43:42Z")
hey all iam new to elk , iam trying to get all the hosts in the Elasticsearch db , i tried using a wildcard and "wild\_card": "hosts", "query": { "host.keyword": "test\*", "severity.keyword": "err" }, consider there … --- ## [Dial tcp {kubelet\_ip}:10250 i/o timeout while trying to get Metricbeat to talk to Azure Kubernetes Service](https://discuss.elastic.co/t/dial-tcp-kubelet-ip-10250-i-o-timeout-while-trying-to-get-metricbeat-to-talk-to-azure-kubernetes-service/303874)
**Author:** [@surprised\_ferret](https://discuss.elastic.co/u/surprised_ferret)\ **Replies:** 5\ **Last updated:** [May 5, 2022, 12:33pm UTC](https://discuss.elastic.co/t/dial-tcp-kubelet-ip-10250-i-o-timeout-while-trying-to-get-metricbeat-to-talk-to-azure-kubernetes-service/303874 "2022-05-05T12:33:23Z")
Getting these errors when trying to install metricbeat as a daemonset using terraform. What could be the issue, metricbeat or AKS ? 2022-05-03T20:09:01.492Z ERROR module/wrapper.go:259 Error fetching data for metricset… --- ## [Windows server 2003 and Elastic agent](https://discuss.elastic.co/t/windows-server-2003-and-elastic-agent/304029)
**Author:** [@JimG](https://discuss.elastic.co/u/JimG)\ **Replies:** 0\ **Last updated:** [May 5, 2022, 12:10pm UTC](https://discuss.elastic.co/t/windows-server-2003-and-elastic-agent/304029 "2022-05-05T12:10:55Z")
Allright.. I know Windows server 2003 logs is not supported. But is it possible to solve? I use a powershell script to collect Windows server 2003 logs to a Windows server 2022 then Im using Elastic Agent with a custom… --- ## [How to simulate small frequent updates parallel to constant queries](https://discuss.elastic.co/t/how-to-simulate-small-frequent-updates-parallel-to-constant-queries/303918)
**Author:** [@jmlucjav](https://discuss.elastic.co/u/jmlucjav)\ **Replies:** 1\ **Last updated:** [May 5, 2022, 11:59am UTC](https://discuss.elastic.co/t/how-to-simulate-small-frequent-updates-parallel-to-constant-queries/303918 "2022-05-05T11:59:35Z")
Hi, when I am benchmarking my querying with Rally, I would like to simulate also the fact that I get some frequent but small updates. Not sure what would be the best way to achieve this? Say I want to have a throughput… --- ## [Sizing question](https://discuss.elastic.co/t/sizing-question/304014)
**Author:** [@marek\_duciuc](https://discuss.elastic.co/u/marek_duciuc)\ **Replies:** 1\ **Last updated:** [May 5, 2022, 11:01am UTC](https://discuss.elastic.co/t/sizing-question/304014 "2022-05-05T11:01:09Z")
Elasticsearch recommendations is as follows: Maximum of 32 GB heap 20 shards per 1 GB of heap 40 to 60 GB of data per shard this gives approximately 25TB to 39TB of data per node. Is this only theoretical or would… --- ## [Docs count delay - docs added regularly, but docs count 0](https://discuss.elastic.co/t/docs-count-delay-docs-added-regularly-but-docs-count-0/303740)
**Author:** [@jb79](https://discuss.elastic.co/u/jb79)\ **Replies:** 1\ **Last updated:** [May 5, 2022, 10:38am UTC](https://discuss.elastic.co/t/docs-count-delay-docs-added-regularly-but-docs-count-0/303740 "2022-05-05T10:38:35Z")
Hi, Docs added regularly, but the count (after all added) could be verified after several minutes : Added docs ( @timestamp from logstash): Transport traffic Indexing rate: Docs count Seems that sth wr… --- ## [Filebeats autodiscover on kubernetes doesn't collect logs from annotated pods](https://discuss.elastic.co/t/filebeats-autodiscover-on-kubernetes-doesnt-collect-logs-from-annotated-pods/304018)
**Author:** [@Ivan\_Kovacic](https://discuss.elastic.co/u/Ivan_Kovacic)\ **Replies:** 0\ **Last updated:** [May 5, 2022, 10:19am UTC](https://discuss.elastic.co/t/filebeats-autodiscover-on-kubernetes-doesnt-collect-logs-from-annotated-pods/304018 "2022-05-05T10:19:18Z")
Hi, I have an issue with filebeat when trying to collect logs from annotated pods, i have been following the documentation but without success. I am using filebeats 7.17 on kubernetes v1.21.5. This is my filebeat confi… --- ## [Storing images , videos in elasticserch](https://discuss.elastic.co/t/storing-images-videos-in-elasticserch/303985)
**Author:** [@Naga\_Prudhvi](https://discuss.elastic.co/u/Naga_Prudhvi)\ **Replies:** 8\ **Last updated:** [May 5, 2022, 10:17am UTC](https://discuss.elastic.co/t/storing-images-videos-in-elasticserch/303985 "2022-05-05T10:17:20Z")
Can someone help me how can I store images in elasticserch? 1st way: using logstash conf file 2nd way; using directly elasticserch --- ## [Attempting to acquire leader lease ... Get "https://10.43.0.1:443/apis/coordination.k8s.io/v1/namespaces/bilalnamespace/leases/metricbeat-cluster-leader": Forbidden](https://discuss.elastic.co/t/attempting-to-acquire-leader-lease-get-https-10-43-0-1-443-apis-coordination-k8s-io-v1-namespaces-bilalnamespace-leases-metricbeat-cluster-leader-forbidden/304012)
**Author:** [@Bilal\_El\_Mahdaoui](https://discuss.elastic.co/u/Bilal_El_Mahdaoui)\ **Replies:** 0\ **Last updated:** [May 5, 2022, 9:44am UTC](https://discuss.elastic.co/t/attempting-to-acquire-leader-lease-get-https-10-43-0-1-443-apis-coordination-k8s-io-v1-namespaces-bilalnamespace-leases-metricbeat-cluster-leader-forbidden/304012 "2022-05-05T09:44:43Z")
Hello, I want to monitor my Kubernetes cluster using metricbeat, and I'm using for that metricbeat autodiscover feature . Also I use a custom docker image based on my custom debian bullseye image. I made all the neces… --- ## [Data migrate from one cluster to another Elasticsearch](https://discuss.elastic.co/t/data-migrate-from-one-cluster-to-another-elasticsearch/304001)
**Author:** [@ranju](https://discuss.elastic.co/u/ranju)\ **Replies:** 1\ **Last updated:** [May 5, 2022, 9:14am UTC](https://discuss.elastic.co/t/data-migrate-from-one-cluster-to-another-elasticsearch/304001 "2022-05-05T09:14:08Z")
Need to Migrate one index data from AWS elastic to Azure Elasticsearch. Which one is the best way 1: Reindex 2: logstash : input as AWS elastic and output as Azure elastic. Any input much appreciated, Thanks in Advan… --- ## [How to refresh/stop shrink action](https://discuss.elastic.co/t/how-to-refresh-stop-shrink-action/303733)
**Author:** [@INS](https://discuss.elastic.co/u/INS)\ **Replies:** 3\ **Last updated:** [May 5, 2022, 8:31am UTC](https://discuss.elastic.co/t/how-to-refresh-stop-shrink-action/303733 "2022-05-05T08:31:35Z")
HI Can You help me out how I can refresh and disable shrink for indices? during, from the devtool console I didn't find any onging actoin, but it seems that a few a indices are hanging on that steps? Such state doe… --- ## [ELK reindex - no input realtime data](https://discuss.elastic.co/t/elk-reindex-no-input-realtime-data/303928)
**Author:** [@Next\_generation](https://discuss.elastic.co/u/Next_generation)\ **Replies:** 2\ **Last updated:** [May 4, 2022, 9:33pm UTC](https://discuss.elastic.co/t/elk-reindex-no-input-realtime-data/303928 "2022-05-04T21:33:15Z")
how to assign template to specific elk index i created the correct index template and migrated the data from the old index but it is not written further in real time How to make it write? (used by fluentd) --- ## [Filebeat to elasticsearch using ingest pipeline](https://discuss.elastic.co/t/filebeat-to-elasticsearch-using-ingest-pipeline/303341)
**Author:** [@shrikantgulia](https://discuss.elastic.co/u/shrikantgulia)\ **Replies:** 5\ **Last updated:** [May 5, 2022, 7:45am UTC](https://discuss.elastic.co/t/filebeat-to-elasticsearch-using-ingest-pipeline/303341 "2022-05-05T07:45:04Z")
Dear Team, need a advise we are ingesting data from filebeat to ES using the ingest pipeline in ES I have created an ingest pipeline and also created an index template in that defined the ingest pipeline "PUT \_ingest/… --- ## [Kibana 401 Unauthorized](https://discuss.elastic.co/t/kibana-401-unauthorized/303954)
**Author:** [@CemG](https://discuss.elastic.co/u/CemG)\ **Replies:** 2\ **Last updated:** [May 5, 2022, 7:12am UTC](https://discuss.elastic.co/t/kibana-401-unauthorized/303954 "2022-05-05T07:12:50Z")
Hello, I would like to setup the dashboard of Winlogbeat in Kibana, but when I start Winlogbeat I have an error. I have done a curl, and saw that I got the error 401 as response. My architecture is : Winlogbeat → Kafk… --- ## [How to fix security issue with kibana 5.6 Timelion widget](https://discuss.elastic.co/t/how-to-fix-security-issue-with-kibana-5-6-timelion-widget/303996)
**Author:** [@kashifqazi](https://discuss.elastic.co/u/kashifqazi)\ **Replies:** 1\ **Last updated:** [May 5, 2022, 6:29am UTC](https://discuss.elastic.co/t/how-to-fix-security-issue-with-kibana-5-6-timelion-widget/303996 "2022-05-05T06:29:22Z")
How to fix security issue with kibana 5.6 Timelion widget. --- ## [Using Regex in Kibana Query DSL (filter-option in discover mode)](https://discuss.elastic.co/t/using-regex-in-kibana-query-dsl-filter-option-in-discover-mode/303937)
**Author:** [@CaMaNi](https://discuss.elastic.co/u/CaMaNi)\ **Replies:** 4\ **Last updated:** [May 5, 2022, 5:45am UTC](https://discuss.elastic.co/t/using-regex-in-kibana-query-dsl-filter-option-in-discover-mode/303937 "2022-05-05T05:45:38Z")
Good day everyone, I am relatively new to the use of Kibana. And I have the following problem: I want to filter out all numbers and special characters like "\_" or "-" in a field in Discover mode, so that I only have Le… --- ## [Want to send this logs to Elasticsearch without logstash](https://discuss.elastic.co/t/want-to-send-this-logs-to-elasticsearch-without-logstash/303990)
**Author:** [@dharminfadia](https://discuss.elastic.co/u/dharminfadia)\ **Replies:** 1\ **Last updated:** [May 5, 2022, 5:28am UTC](https://discuss.elastic.co/t/want-to-send-this-logs-to-elasticsearch-without-logstash/303990 "2022-05-05T05:28:58Z")
Hello Every One I have Following Logs I want sent this logs using script (Powershell) to Elasticsearch without using logstash no need mediator any one can help How can I ? { "Id": "4280", "AppKey": "StoreSearchAPIUR… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=949) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=951)