# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=953 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 954 --- ## [How to handle grok optional pattern (?:)](https://discuss.elastic.co/t/how-to-handle-grok-optional-pattern/303796)
**Author:** [@marwen](https://discuss.elastic.co/u/marwen)\ **Replies:** 6\ **Last updated:** [May 4, 2022, 7:36am UTC](https://discuss.elastic.co/t/how-to-handle-grok-optional-pattern/303796 "2022-05-04T07:36:37Z")
Hi everyone I'm new to Elastick Stack, I set grok custom pattern using RegEx: MODULE\_NAME (?:((?\<=\[\\\[\])\\/\\S\[^\\\]\]+)) the problem is it's optional pattern so I want the "module\_name" field to be empty instead of showing … --- ## [How to run elasticsearch-shard in a docker container](https://discuss.elastic.co/t/how-to-run-elasticsearch-shard-in-a-docker-container/303815)
**Author:** [@elaskibuser](https://discuss.elastic.co/u/elaskibuser)\ **Replies:** 0\ **Last updated:** [May 3, 2022, 10:27am UTC](https://discuss.elastic.co/t/how-to-run-elasticsearch-shard-in-a-docker-container/303815 "2022-05-03T10:27:20Z")
Through an unfortunate series of events, data was lost on a node on a 3 node cluster. All that is left a month old copy of a the data folder. I am not able to run Elasticsearch-shard --remove-corrupted-data because it … --- ## [Why logstash csv filter skip\_header param don't work](https://discuss.elastic.co/t/why-logstash-csv-filter-skip-header-param-dont-work/303894)
**Author:** [@zhanghao116560](https://discuss.elastic.co/u/zhanghao116560)\ **Replies:** 2\ **Last updated:** [May 4, 2022, 6:18am UTC](https://discuss.elastic.co/t/why-logstash-csv-filter-skip-header-param-dont-work/303894 "2022-05-04T06:18:35Z")
Using the Logstash CSV filter to parse my CSV file, I set the skip\_header parameter to true. I wanted the first line not to be printed, but the actual result program didn't skip the first line。 here is my config: input… --- ## [Logstash mutate not working after kv filter applied](https://discuss.elastic.co/t/logstash-mutate-not-working-after-kv-filter-applied/303849)
**Author:** [@splitmessage88](https://discuss.elastic.co/u/splitmessage88)\ **Replies:** 6\ **Last updated:** [May 4, 2022, 5:56am UTC](https://discuss.elastic.co/t/logstash-mutate-not-working-after-kv-filter-applied/303849 "2022-05-04T05:56:19Z")
Hi, I created a filter for cisco syslog, input source cisco FTD. All the fields are parsing correctly but I can't rename/remove fields with mutate after I used the kv {} filter. Is it possible to use mutate after kv … --- ## [Metric - show last consecutive values](https://discuss.elastic.co/t/metric-show-last-consecutive-values/303902)
**Author:** [@Itiel\_Olenick](https://discuss.elastic.co/u/Itiel_Olenick)\ **Replies:** 0\ **Last updated:** [May 4, 2022, 5:47am UTC](https://discuss.elastic.co/t/metric-show-last-consecutive-values/303902 "2022-05-04T05:47:05Z")
Hi there, We have data coming in from a health check we preform on our services, and i am trying to figure out a way to create a metric that will show the last consecutive fails. The data field for the health-check is … --- ## [Kibana Unable to retrieve version information from Elasticsearch nodes. socket hang up](https://discuss.elastic.co/t/kibana-unable-to-retrieve-version-information-from-elasticsearch-nodes-socket-hang-up/303528)
**Author:** [@Roshan1](https://discuss.elastic.co/u/Roshan1)\ **Replies:** 8\ **Last updated:** [May 4, 2022, 4:46am UTC](https://discuss.elastic.co/t/kibana-unable-to-retrieve-version-information-from-elasticsearch-nodes-socket-hang-up/303528 "2022-05-04T04:46:46Z")
Dear Team, kindly advise why error occurs when starting Kibana? da46c1"}} {"ecs":{"version":"8.0.0"},"@timestamp":"2022-04-28T18:37:07.516+04:00","message":"Unable to retrieve version information from Elasticsearch nod… --- ## [Logstash plugin 0.5 fraction on number field](https://discuss.elastic.co/t/logstash-plugin-0-5-fraction-on-number-field/303890)
**Author:** [@Altiano\_Gerung](https://discuss.elastic.co/u/Altiano_Gerung)\ **Replies:** 1\ **Last updated:** [May 4, 2022, 3:27am UTC](https://discuss.elastic.co/t/logstash-plugin-0-5-fraction-on-number-field/303890 "2022-05-04T03:27:46Z")
With logstash google pub/sub output plugin.. How do you set : delay\_threshold\_secs =\> "0.5" ? If I set to 1.x or 2.x, it'll work, but for 0.x it'll never work, so I guess it's just a matter of syntax error.. --- ## [Logstash filter out log lines](https://discuss.elastic.co/t/logstash-filter-out-log-lines/302230)
**Author:** [@shivendra95](https://discuss.elastic.co/u/shivendra95)\ **Replies:** 5\ **Last updated:** [May 4, 2022, 3:11am UTC](https://discuss.elastic.co/t/logstash-filter-out-log-lines/302230 "2022-05-04T03:11:35Z")
Hi, I have json logs that I want to filter based on the message field. {"@timestamp":"2022-04-05T01:20:50.917+00:00","severity":"INFO","service":"service","pid":"18245","thread":"http-nio-8102-exec-1","class":"class","… --- ## [Transform --\> Default a pivot groupBy keyName is does not exist](https://discuss.elastic.co/t/transform-default-a-pivot-groupby-keyname-is-does-not-exist/303871)
**Author:** [@lupolo](https://discuss.elastic.co/u/lupolo)\ **Replies:** 2\ **Last updated:** [May 4, 2022, 1:47am UTC](https://discuss.elastic.co/t/transform-default-a-pivot-groupby-keyname-is-does-not-exist/303871 "2022-05-04T01:47:21Z")
In a transform under the section of "pivot": and "group\_by": I would like to default a value if keyName does not exist. Example: \ **Author:** [@erik\_n](https://discuss.elastic.co/u/erik_n)\ **Replies:** 8\ **Last updated:** [May 4, 2022, 12:13am UTC](https://discuss.elastic.co/t/revisiting-lookup-table-concept/303791 "2022-05-04T00:13:13Z") I've read all of the previous topics about this and done some searching, but I can't figure it out, so I'll ask specifically about my situation. I have one cluster that is explicitly for reporting and visualizations. I'… --- ## [Restoring datastreams isn't working as planned](https://discuss.elastic.co/t/restoring-datastreams-isnt-working-as-planned/303870)
**Author:** [@seanziee](https://discuss.elastic.co/u/seanziee)\ **Replies:** 1\ **Last updated:** [May 4, 2022, 12:12am UTC](https://discuss.elastic.co/t/restoring-datastreams-isnt-working-as-planned/303870 "2022-05-04T00:12:32Z")
I'm getting to about the end of my wits with trying to restore a backing index to a datastream. Essentially I have a set up that I have a datastream-1 with backing indices .ds-datastream-1-2022-04.01 and .ds-datastream… --- ## [Spring4Shell ::Spring Framework Remote Code Execution Vulnerability](https://discuss.elastic.co/t/spring4shell-spring-framework-remote-code-execution-vulnerability/301229)
**Author:** [@Vishnu\_Vijay](https://discuss.elastic.co/u/Vishnu_Vijay)\ **Replies:** 5\ **Last updated:** [May 3, 2022, 11:55pm UTC](https://discuss.elastic.co/t/spring4shell-spring-framework-remote-code-execution-vulnerability/301229 "2022-05-03T23:55:49Z")
Hello, We are using Elasticsearch 6.3.2 & 6.8.23 Please let us know, whether ES is using spring boot war and whether Elasticsearch is impacted any way by the reported spring shell vulnerability. Please suggest, wheth… --- ## [The UI windows of ES ODBC Driver is too small](https://discuss.elastic.co/t/the-ui-windows-of-es-odbc-driver-is-too-small/303858)
**Author:** [@bhguo](https://discuss.elastic.co/u/bhguo)\ **Replies:** 0\ **Last updated:** [May 3, 2022, 4:33pm UTC](https://discuss.elastic.co/t/the-ui-windows-of-es-odbc-driver-is-too-small/303858 "2022-05-03T16:33:48Z")
Dear sirs, I want to use Elasticsearch ODBC Driver to access ES data, I have downloaded and installed it in my computer, I meet some troubles in using it. When I set ODBC DSN in control panel, I find the windows is too… --- ## [Add agent feedback](https://discuss.elastic.co/t/add-agent-feedback/303883)
**Author:** [@schapman](https://discuss.elastic.co/u/schapman)\ **Replies:** 0\ **Last updated:** [May 3, 2022, 10:26pm UTC](https://discuss.elastic.co/t/add-agent-feedback/303883 "2022-05-03T22:26:06Z")
Clicking on "Send Feedback" brings me here, so here I will leave my feed back. When adding an agent. step 2 is "Download the Elastic Agent to your host" and step 3 is "Enroll and start the Elastic Agent". The combinatio… --- ## [Unable to Delete Copied Dashboard Panel](https://discuss.elastic.co/t/unable-to-delete-copied-dashboard-panel/302677)
**Author:** [@Bartu\_Gokalp](https://discuss.elastic.co/u/Bartu_Gokalp)\ **Replies:** 14\ **Last updated:** [May 3, 2022, 10:15pm UTC](https://discuss.elastic.co/t/unable-to-delete-copied-dashboard-panel/302677 "2022-05-03T22:15:40Z")
I have copied a from one dashboard to another. Than I have deleted original panel from first dashboard. Options \> more \> Delete from dashboard is not visible in editing mode. So, I am unable to delete it. (see screensho… --- ## [Installing and running Docker plugin - help with syntax needed](https://discuss.elastic.co/t/installing-and-running-docker-plugin-help-with-syntax-needed/302529)
**Author:** [@paolovalladolid](https://discuss.elastic.co/u/paolovalladolid)\ **Replies:** 1\ **Last updated:** [May 3, 2022, 10:14pm UTC](https://discuss.elastic.co/t/installing-and-running-docker-plugin-help-with-syntax-needed/302529 "2022-05-03T22:14:38Z")
I get the error "docker run" requires at least 1 argument(s). when I run this command docker run --log-driver=elastic/elastic-logging-plugin:8.1.2 --log-opt hosts="thehost" I then tried to fix the error by adding wha… --- ## [Indices keep getting deleted automatically](https://discuss.elastic.co/t/indices-keep-getting-deleted-automatically/303555)
**Author:** [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\ **Replies:** 4\ **Last updated:** [May 3, 2022, 9:07pm UTC](https://discuss.elastic.co/t/indices-keep-getting-deleted-automatically/303555 "2022-05-03T21:07:30Z")
We are running ELK 7.6.2 stack. It seems that indices are getting deleted / cleaned automatically by ES. We have ILM policy of 2 days retention for the index, but somehow it deletes the current one too. After enabling… --- ## [Logstash- /var/log/logstash - has no files](https://discuss.elastic.co/t/logstash-var-log-logstash-has-no-files/303780)
**Author:** [@gurumu](https://discuss.elastic.co/u/gurumu)\ **Replies:** 7\ **Last updated:** [May 3, 2022, 8:46pm UTC](https://discuss.elastic.co/t/logstash-var-log-logstash-has-no-files/303780 "2022-05-03T20:46:35Z")
Hello- I have installed Elasticsearch, Kibana and Logstash version 8.1.0 on my ubuntu VM. I am trying to ingest auth.log into ES by passing it through logstash. attached is the configuration file screenshots. I am not se… --- ## [Logstash Permission denied - NUL error](https://discuss.elastic.co/t/logstash-permission-denied-nul-error/303686)
**Author:** [@Ersan](https://discuss.elastic.co/u/Ersan)\ **Replies:** 3\ **Last updated:** [May 3, 2022, 8:32pm UTC](https://discuss.elastic.co/t/logstash-permission-denied-nul-error/303686 "2022-05-03T20:32:57Z")
Hello I am new to EleasticSearch. I try to run logstash on Windows for the first time with different instrutions/Java versions/Logtash versions but always get the same error. I checked out the forms too but could not f… --- ## [Error enrolling Fleet Server: FAILED: Missed two check-ins](https://discuss.elastic.co/t/error-enrolling-fleet-server-failed-missed-two-check-ins/303875)
**Author:** [@mhoward](https://discuss.elastic.co/u/mhoward)\ **Replies:** 0\ **Last updated:** [May 3, 2022, 8:12pm UTC](https://discuss.elastic.co/t/error-enrolling-fleet-server-failed-missed-two-check-ins/303875 "2022-05-03T20:12:44Z")
I am in the process of adding a Fleet server to a self-managed Elastic cluster in Production mode using my own generated certificates. I'm running into the following error of Elastic-agent failing to start when running … --- ## [How to start a elastic cluster 8.1 with three or more nodes](https://discuss.elastic.co/t/how-to-start-a-elastic-cluster-8-1-with-three-or-more-nodes/303540)
**Author:** [@Adrian\_Gtz](https://discuss.elastic.co/u/Adrian_Gtz)\ **Replies:** 8\ **Last updated:** [May 3, 2022, 8:10pm UTC](https://discuss.elastic.co/t/how-to-start-a-elastic-cluster-8-1-with-three-or-more-nodes/303540 "2022-05-03T20:10:59Z")
I have the first node, but I don't know what is next. What do I have to do to define the master and join new nodes to the cluster. Is there a guide or something explained ? Thanks in advanced. --- ## [Issues with winlogbeat set up](https://discuss.elastic.co/t/issues-with-winlogbeat-set-up/303793)
**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Replies:** 1\ **Last updated:** [May 3, 2022, 6:59pm UTC](https://discuss.elastic.co/t/issues-with-winlogbeat-set-up/303793 "2022-05-03T18:59:07Z")
ES version 7.16.2, winlogbeat 7.16.1 Trying to get winlogbeat working on a new cluster. We seem to have got thought the setup phase and started to send data. Each event gets a warning (status=400): {"type":"illegal\_a… --- ## [Elasticsearch Upgrade from 2.x to 6.x](https://discuss.elastic.co/t/elasticsearch-upgrade-from-2-x-to-6-x/301590)
**Author:** [@veenarvg](https://discuss.elastic.co/u/veenarvg)\ **Replies:** 0\ **Last updated:** [April 5, 2022, 6:24am UTC](https://discuss.elastic.co/t/elasticsearch-upgrade-from-2-x-to-6-x/301590 "2022-04-05T06:24:33Z")
This category relates to the Enterprise Search set of products - App Search, Site Search and Workplace Search. If your question relates to core Elasticsearch functionality, please head over to the #elastic-stack:elastic… --- ## [If else query on elastic search](https://discuss.elastic.co/t/if-else-query-on-elastic-search/302663)
**Author:** [@anime\_lover](https://discuss.elastic.co/u/anime_lover)\ **Replies:** 0\ **Last updated:** [April 19, 2022, 4:48am UTC](https://discuss.elastic.co/t/if-else-query-on-elastic-search/302663 "2022-04-19T04:48:08Z")
Hi there , i am facing some problem on searching . My problem is : Suppose i have three field A,B and C . If i search for certain text then it should search on field A first if found ,stop searching and return result i… --- ## [Kibana lens formula distinct by rows](https://discuss.elastic.co/t/kibana-lens-formula-distinct-by-rows/303847)
**Author:** [@wiwinagtor](https://discuss.elastic.co/u/wiwinagtor)\ **Replies:** 2\ **Last updated:** [May 3, 2022, 6:31pm UTC](https://discuss.elastic.co/t/kibana-lens-formula-distinct-by-rows/303847 "2022-05-03T18:31:00Z")
Is there a way to perform using kibana lens a calculated fields table where the formulas changes by row? For example: Or there is another way to do it, Thanks everyone --- ## [Fortinet Logs Integration](https://discuss.elastic.co/t/fortinet-logs-integration/303788)
**Author:** [@jumpie](https://discuss.elastic.co/u/jumpie)\ **Replies:** 8\ **Last updated:** [May 3, 2022, 6:27pm UTC](https://discuss.elastic.co/t/fortinet-logs-integration/303788 "2022-05-03T18:27:15Z")
Hello, I've installed the Fortinet Logs Integration and configured the Fortigate to send syslogs for 9004. I was able to test that the Fortigate is sending logs but nothing shows up in Elastic. Is there something I am m… --- ## [Packetbeat on windows 10 : error connecting to kibana, fail to get the kibana version : HTTP GET request to http://192.168.217.128:5601](https://discuss.elastic.co/t/packetbeat-on-windows-10-error-connecting-to-kibana-fail-to-get-the-kibana-version-http-get-request-to-http-192-168-217-128-5601/303655)
**Author:** [@TARIK\_MAZOUZ](https://discuss.elastic.co/u/TARIK_MAZOUZ)\ **Replies:** 21\ **Last updated:** [May 3, 2022, 5:17pm UTC](https://discuss.elastic.co/t/packetbeat-on-windows-10-error-connecting-to-kibana-fail-to-get-the-kibana-version-http-get-request-to-http-192-168-217-128-5601/303655 "2022-05-03T17:17:34Z")
hey everybody, so i do have a problem with packetbeat in my windows 10 VM, so when i execute the command is powershell as an administrator , .\\packetbeat.exe setup -e , the error i get is : Exiting: error connecting to … --- ## [How to update a plugin to a newer yet unsupported Kibana version?](https://discuss.elastic.co/t/how-to-update-a-plugin-to-a-newer-yet-unsupported-kibana-version/303560)
**Author:** [@pritster5](https://discuss.elastic.co/u/pritster5)\ **Replies:** 1\ **Last updated:** [May 3, 2022, 4:59pm UTC](https://discuss.elastic.co/t/how-to-update-a-plugin-to-a-newer-yet-unsupported-kibana-version/303560 "2022-05-03T16:59:22Z")
I am trying to update a plugin (SigmaUI by SOC Prime) written for an older version of Kibana (confirmed working on ELK 7.5). The plugin does not work on ELK 8.X+ (because the way plugins are handled was changed in ELK 7… --- ## [Logstash Conf | Extracting Filename from Path](https://discuss.elastic.co/t/logstash-conf-extracting-filename-from-path/303818)
**Author:** [@srii](https://discuss.elastic.co/u/srii)\ **Replies:** 2\ **Last updated:** [May 3, 2022, 4:36pm UTC](https://discuss.elastic.co/t/logstash-conf-extracting-filename-from-path/303818 "2022-05-03T16:36:14Z")
I am trying to setup Logstash to feed Elasticsearch. In course, I've created the following conf file that seem to work nicely: input { beats { port =\> 5044 } file { path =\> "C:/f1/f2/Logs/f3/LocalHost#b… --- ## [Is there any tool which will create dummy document based on index mapping for testing?](https://discuss.elastic.co/t/is-there-any-tool-which-will-create-dummy-document-based-on-index-mapping-for-testing/279935)
**Author:** [@Nishikant\_Tayade](https://discuss.elastic.co/u/Nishikant_Tayade)\ **Replies:** 1\ **Last updated:** [May 3, 2022, 4:30pm UTC](https://discuss.elastic.co/t/is-there-any-tool-which-will-create-dummy-document-based-on-index-mapping-for-testing/279935 "2022-05-03T16:30:12Z")
I have created a wrapper around ES index bulk document API, I need to test the performance of it. I want to create at least, 1000 documents based on my index mapping, so that I can test the performance of my API. Is th… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=952) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=954)