# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=965 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 966 --- ## [Aggregate similar Logs](https://discuss.elastic.co/t/aggregate-similar-logs/302630)
**Author:** [@Bo-Wyatt](https://discuss.elastic.co/u/Bo-Wyatt)\ **Replies:** 2\ **Last updated:** [April 22, 2022, 11:39am UTC](https://discuss.elastic.co/t/aggregate-similar-logs/302630 "2022-04-22T11:39:32Z")
Hello, I have SIEM-like logs (with a unique identifier field) in a log flow (two or more logs, in every update/log there's extra info or updaded info). I need to preserve the last log or aggregate all the logs into one w… --- ## [Securing elastic using elastic ansible playbook](https://discuss.elastic.co/t/securing-elastic-using-elastic-ansible-playbook/303029)
**Author:** [@sligade](https://discuss.elastic.co/u/sligade)\ **Replies:** 0\ **Last updated:** [April 22, 2022, 12:12pm UTC](https://discuss.elastic.co/t/securing-elastic-using-elastic-ansible-playbook/303029 "2022-04-22T12:12:19Z")
Hello I am new to elastic, and trying to use ansible playbook to install set it up I was able to setup a test cluster without any issue, and now I want to secure using X-Pack security SSL/TLS setup as identified ansibl… --- ## [Office 365 filebeat error](https://discuss.elastic.co/t/office-365-filebeat-error/303026)
**Author:** [@ima](https://discuss.elastic.co/u/ima)\ **Replies:** 0\ **Last updated:** [April 22, 2022, 11:58am UTC](https://discuss.elastic.co/t/office-365-filebeat-error/303026 "2022-04-22T11:58:40Z")
Hello, we want to integrate office 365 with filebeat, we have activated the module and filled the config file as shown audit: enabled: true var.application\_id: "\*\*\*\*\* " var.tenants: \*\*- id: "" name: " .onmicrosoft.… --- ## [Logstash to elasticsearch ssl connection issue](https://discuss.elastic.co/t/logstash-to-elasticsearch-ssl-connection-issue/302842)
**Author:** [@fabek.75](https://discuss.elastic.co/u/fabek.75)\ **Replies:** 1\ **Last updated:** [April 22, 2022, 8:56am UTC](https://discuss.elastic.co/t/logstash-to-elasticsearch-ssl-connection-issue/302842 "2022-04-22T08:56:33Z")
Hi, I have setup an on-prem dev environment with Elasticsearch 8.x and from a client I'm trying to push some data through a Logstash pipeline (version is 8.1.2-1). It seems, however, Logstash wants absolutely that some … --- ## [EQL sequence performance issue](https://discuss.elastic.co/t/eql-sequence-performance-issue/300601)
**Author:** [@eufe](https://discuss.elastic.co/u/eufe)\ **Replies:** 3\ **Last updated:** [April 22, 2022, 9:16am UTC](https://discuss.elastic.co/t/eql-sequence-performance-issue/300601 "2022-04-22T09:16:35Z")
Environnement : V7.16.2 JVM : 31g (one node) RAM : 64G Hello, I'm trying to use EQL to detect some changes on a specific field. A concrete usecase would be to detect a regression on the administrative protocol on a… --- ## [Elastic-agent in docker - host metadata](https://discuss.elastic.co/t/elastic-agent-in-docker-host-metadata/303000)
**Author:** [@mkf1](https://discuss.elastic.co/u/mkf1)\ **Replies:** 0\ **Last updated:** [April 22, 2022, 9:04am UTC](https://discuss.elastic.co/t/elastic-agent-in-docker-host-metadata/303000 "2022-04-22T09:04:21Z")
Hi, When using elastic-agent in Docker is it possible to override/manually set the host metadata (host.ip, host.mac etc..) to the actual host? When elastic-agent is in a container it select the container ip and containe… --- ## [How to update fields in nested document without script](https://discuss.elastic.co/t/how-to-update-fields-in-nested-document-without-script/302999)
**Author:** [@martin\_wun](https://discuss.elastic.co/u/martin_wun)\ **Replies:** 0\ **Last updated:** [April 22, 2022, 9:00am UTC](https://discuss.elastic.co/t/how-to-update-fields-in-nested-document-without-script/302999 "2022-04-22T09:00:18Z")
Hi all, Is there a way to update an individual field in a nested document without having to use a script? I have found some answers here, but they all use a painless script in some form. E.g.: For example, say I have… --- ## [Indicator matching Rules](https://discuss.elastic.co/t/indicator-matching-rules/302346)
**Author:** [@shinobu](https://discuss.elastic.co/u/shinobu)\ **Replies:** 2\ **Last updated:** [April 22, 2022, 8:46am UTC](https://discuss.elastic.co/t/indicator-matching-rules/302346 "2022-04-22T08:46:11Z")
Hello, I recently configured an Indicator Matching Rule that creates alarms if any indicator is found. The issue with this is that the indicator are matched partially. For instance if I have the indicator something.q77.… --- ## [Randomly xml tags are not showing in the elasticsearch 7.14](https://discuss.elastic.co/t/randomly-xml-tags-are-not-showing-in-the-elasticsearch-7-14/302994)
**Author:** [@Lakshani\_Gamage](https://discuss.elastic.co/u/Lakshani_Gamage)\ **Replies:** 0\ **Last updated:** [April 22, 2022, 8:06am UTC](https://discuss.elastic.co/t/randomly-xml-tags-are-not-showing-in-the-elasticsearch-7-14/302994 "2022-04-22T08:06:23Z")
I'm using Elasticsearch 7.14. When I check the JSON format of a message in the Elasticsearch, I can see below. "agent": { "ephemeral\_id": "2a4c1cb3-b7d6-4a1b-b244-0e669f1d7686", "type": "filebeat", "id": "3dfa6feb… --- ## [Read only searches for other users](https://discuss.elastic.co/t/read-only-searches-for-other-users/302928)
**Author:** [@afuente](https://discuss.elastic.co/u/afuente)\ **Replies:** 4\ **Last updated:** [April 22, 2022, 8:34am UTC](https://discuss.elastic.co/t/read-only-searches-for-other-users/302928 "2022-04-22T08:34:59Z")
Hello, everybody!! Does anybody know if it is possible to lock a saved search, a visualization, etc., for other users to be able to see the results but not change the filters and overwrite it? We are a lot of people us… --- ## [How to check logs were sending to elasticsearch](https://discuss.elastic.co/t/how-to-check-logs-were-sending-to-elasticsearch/302799)
**Author:** [@Hoa\_Nguy\_n\_Van](https://discuss.elastic.co/u/Hoa_Nguy_n_Van)\ **Replies:** 11\ **Last updated:** [April 22, 2022, 8:31am UTC](https://discuss.elastic.co/t/how-to-check-logs-were-sending-to-elasticsearch/302799 "2022-04-22T08:31:28Z")
I deployment my EFK stack on version 7.4.0. When deploying filebeat, logs from filebeat do not send to Elasticsearch. My configuration Filebeat on k8s: Logs from Filebeat: Help me for this issue. Thanks ! … --- ## [Winlogbeat message not parsed](https://discuss.elastic.co/t/winlogbeat-message-not-parsed/302979)
**Author:** [@Elie\_Sbat](https://discuss.elastic.co/u/Elie_Sbat)\ **Replies:** 7\ **Last updated:** [April 22, 2022, 8:25am UTC](https://discuss.elastic.co/t/winlogbeat-message-not-parsed/302979 "2022-04-22T08:25:03Z")
Hello, I am using elasticstack v8. The messages are sent from winlogbeat -\> kafka - \> logstash -\> elastic. The message is arrived unparsed. Logstash config: input { kafka{ bootstrap\_servers =\> … --- ## [Elasticsearch 7.16.2 failed to start when switching from Java 8 to Java 11](https://discuss.elastic.co/t/elasticsearch-7-16-2-failed-to-start-when-switching-from-java-8-to-java-11/301404)
**Author:** [@dzyubanv](https://discuss.elastic.co/u/dzyubanv)\ **Replies:** 9\ **Last updated:** [April 22, 2022, 8:16am UTC](https://discuss.elastic.co/t/elasticsearch-7-16-2-failed-to-start-when-switching-from-java-8-to-java-11/301404 "2022-04-22T08:16:03Z")
I'm testing Elasticsearch (ES) single node cluster with Java 8 and Java 11 Java 8 and Java 11 are installed on Linux server RHEL release 7.9 in directories: /usr/java/jdk1.8.0\_281-amd64 includes subdirectories bin, inc… --- ## [How can I use kerberos under python elasticsearch?](https://discuss.elastic.co/t/how-can-i-use-kerberos-under-python-elasticsearch/302981)
**Author:** [@papi1992](https://discuss.elastic.co/u/papi1992)\ **Replies:** 1\ **Last updated:** [April 22, 2022, 8:06am UTC](https://discuss.elastic.co/t/how-can-i-use-kerberos-under-python-elasticsearch/302981 "2022-04-22T08:06:35Z")
I checked the documentation of elasticsearch:7.x but still didn't find the way how I can force the python ES package to use my kerberos token. I can reach the ES through a browser, curl ( curl --negotiate -u ) and reque… --- ## [Compound score computation details](https://discuss.elastic.co/t/compound-score-computation-details/302940)
**Author:** [@med\_rgn](https://discuss.elastic.co/u/med_rgn)\ **Replies:** 0\ **Last updated:** [April 21, 2022, 3:48pm UTC](https://discuss.elastic.co/t/compound-score-computation-details/302940 "2022-04-21T15:48:25Z")
Hello context In my use case I rank documents regarding an input request relying on a compound score used for the ranking. This compound score is a weighted sum of 3 text similarity scores as follow: score = weight1 \*… --- ## [Harvest only till last but one line?](https://discuss.elastic.co/t/harvest-only-till-last-but-one-line/302988)
**Author:** [@gbml](https://discuss.elastic.co/u/gbml)\ **Replies:** 0\ **Last updated:** [April 22, 2022, 7:15am UTC](https://discuss.elastic.co/t/harvest-only-till-last-but-one-line/302988 "2022-04-22T07:15:59Z")
Hello. Im trying to ship logs via filebeat 8.1.2 I have an app that generate text log, but in strange manner: After first event log file look like this: Line 1\\n (space\_symgol\_1)(space\_symgol\_2)...(space\_symgol\_1\_000… --- ## [FIlebeat\[8.1.2\] - Juniper module not able to Setup pipeline](https://discuss.elastic.co/t/filebeat-8-1-2-juniper-module-not-able-to-setup-pipeline/302986)
**Author:** [@Azeem\_Ismail](https://discuss.elastic.co/u/Azeem_Ismail)\ **Replies:** 0\ **Last updated:** [April 22, 2022, 6:54am UTC](https://discuss.elastic.co/t/filebeat-8-1-2-juniper-module-not-able-to-setup-pipeline/302986 "2022-04-22T06:54:07Z")
Hello, After installing filebeat 8.1.3 as an upgrade, Juniper module is not able to setup pipelines. The error received was "Exiting: module juniper is configured but has no enabled filesets" The command ran to setup … --- ## [Grok Parsing for multiple patterns in single log file](https://discuss.elastic.co/t/grok-parsing-for-multiple-patterns-in-single-log-file/302948)
**Author:** [@venkatkumar229](https://discuss.elastic.co/u/venkatkumar229)\ **Replies:** 2\ **Last updated:** [April 22, 2022, 5:18am UTC](https://discuss.elastic.co/t/grok-parsing-for-multiple-patterns-in-single-log-file/302948 "2022-04-22T05:18:15Z")
Hi Everyone, I am writing a grok pattern to parse a log file where i have two types of log lines. 2022-04-13 06:38:24.472 DBG Microsoft.AspNet.server --- Connection Id "Xxxxxxxx" accepted 2022-04-13 06:38:19.330 d… --- ## [Redis: Error fetching data for metricset i/o timeout error](https://discuss.elastic.co/t/redis-error-fetching-data-for-metricset-i-o-timeout-error/302813)
**Author:** [@Duane\_DSouza](https://discuss.elastic.co/u/Duane_DSouza)\ **Replies:** 2\ **Last updated:** [April 21, 2022, 2:49pm UTC](https://discuss.elastic.co/t/redis-error-fetching-data-for-metricset-i-o-timeout-error/302813 "2022-04-21T14:49:49Z")
Hi , I am trying to use metricbeat (version 8.1.2) module for Redis. Redis cluster is managed app.redislabs.com Also tried with Redis service for the Google Cloud Platform. Here is config: metricsets: \["info", "ke… --- ## [S3 input: Unable to list objects. Access Denied](https://discuss.elastic.co/t/s3-input-unable-to-list-objects-access-denied/302380)
**Author:** [@elker](https://discuss.elastic.co/u/elker)\ **Replies:** 1\ **Last updated:** [April 22, 2022, 3:01am UTC](https://discuss.elastic.co/t/s3-input-unable-to-list-objects-access-denied/302380 "2022-04-22T03:01:00Z")
I am using the s3 input plugin to use assume a role using an aws\_access\_key/secret key and read from a bucket using a date based key. The Logstash role allows AssumeRole, and the bucket allows the role to ListBucket an… --- ## [Unexpected result from Synonym Filter if Char Filter is also used](https://discuss.elastic.co/t/unexpected-result-from-synonym-filter-if-char-filter-is-also-used/302896)
**Author:** [@Patrick\_N](https://discuss.elastic.co/u/Patrick_N)\ **Replies:** 0\ **Last updated:** [April 21, 2022, 10:29am UTC](https://discuss.elastic.co/t/unexpected-result-from-synonym-filter-if-char-filter-is-also-used/302896 "2022-04-21T10:29:18Z")
I have a field which uses both a char filter (it converts Chinese words to some separator text) and a synonym filter. PUT test { "mappings": { "properties": { "description": { "an… --- ## [How to attach Index Lifecycle Policy to indices created by Logstash?](https://discuss.elastic.co/t/how-to-attach-index-lifecycle-policy-to-indices-created-by-logstash/301657)
**Author:** [@pritster5](https://discuss.elastic.co/u/pritster5)\ **Replies:** 5\ **Last updated:** [April 21, 2022, 9:40pm UTC](https://discuss.elastic.co/t/how-to-attach-index-lifecycle-policy-to-indices-created-by-logstash/301657 "2022-04-21T21:40:05Z")
I have a Logstash Config file that looks like this: input { s3 { bucket =\> "testbucket" region =\> "us-east-1" codec =\> "json" additional\_settings =\> { force\_path\_style =\> … --- ## [Why contexts?](https://discuss.elastic.co/t/why-contexts/302957)
**Author:** [@aleding](https://discuss.elastic.co/u/aleding)\ **Replies:** 7\ **Last updated:** [April 21, 2022, 8:32pm UTC](https://discuss.elastic.co/t/why-contexts/302957 "2022-04-21T20:32:42Z")
In debugging a Filebeat module, I have had to dig into Painless scripts & contexts which has led to several questions: Why contexts? Can the same data not be accessed via \_doc? (I've also seen this asked in other … --- ## [Multiple hostname (DNS) output for beats?](https://discuss.elastic.co/t/multiple-hostname-dns-output-for-beats/302964)
**Author:** [@parthmaniar](https://discuss.elastic.co/u/parthmaniar)\ **Replies:** 0\ **Last updated:** [April 21, 2022, 8:00pm UTC](https://discuss.elastic.co/t/multiple-hostname-dns-output-for-beats/302964 "2022-04-21T20:00:53Z")
Hello, Is it possible to use multiple FQDN's as part of output to logstash via beats? My usecase: I want to send a publically routable logging destination - logging.maniarfamily.com which will resolve to a public IP … --- ## [Failed to install kibana 7.17.2 on Amazon Linux 2](https://discuss.elastic.co/t/failed-to-install-kibana-7-17-2-on-amazon-linux-2/302945)
**Author:** [@chrisbra](https://discuss.elastic.co/u/chrisbra)\ **Replies:** 2\ **Last updated:** [April 21, 2022, 7:21pm UTC](https://discuss.elastic.co/t/failed-to-install-kibana-7-17-2-on-amazon-linux-2/302945 "2022-04-21T19:21:09Z")
I I downloaded kibana 7.17.2 as rpm package. Unfortunately, when trying to run it, it fails with those errors: ~ $ sudo /usr/share/kibana/bin/kibana /usr/share/kibana/bin/../node/bin/node: /lib/libstdc++.so.6: version … --- ## [Custom Plugin: Grab user context](https://discuss.elastic.co/t/custom-plugin-grab-user-context/302949)
**Author:** [@Gustavo\_Llermaly](https://discuss.elastic.co/u/Gustavo_Llermaly)\ **Replies:** 2\ **Last updated:** [April 21, 2022, 6:23pm UTC](https://discuss.elastic.co/t/custom-plugin-grab-user-context/302949 "2022-04-21T18:23:30Z")
Hello there, I need to build an action that sends to a custom API user context information like username and user roles. Is there a service that provides this data like the one that provides search state? thanks! --- ## [Bash Script – Remove Indices from x Days Ago](https://discuss.elastic.co/t/bash-script-remove-indices-from-x-days-ago/302925)
**Author:** [@Shanu\_Modi](https://discuss.elastic.co/u/Shanu_Modi)\ **Replies:** 3\ **Last updated:** [April 21, 2022, 5:57pm UTC](https://discuss.elastic.co/t/bash-script-remove-indices-from-x-days-ago/302925 "2022-04-21T17:57:42Z")
Hi please help or suggest any solution. My cluster is running over pod on eks --- ## [Value in Legend \[Pie Chart\]](https://discuss.elastic.co/t/value-in-legend-pie-chart/302934)
**Author:** [@Bo-Wyatt](https://discuss.elastic.co/u/Bo-Wyatt)\ **Replies:** 1\ **Last updated:** [April 21, 2022, 5:01pm UTC](https://discuss.elastic.co/t/value-in-legend-pie-chart/302934 "2022-04-21T17:01:52Z")
Hello, I want to display the metric of each value in the legend. For example in the photo, show my metric on the right side the value, next to the three dots. --- ## [Logstash fail to rewrite json files](https://discuss.elastic.co/t/logstash-fail-to-rewrite-json-files/302942)
**Author:** [@Math](https://discuss.elastic.co/u/Math)\ **Replies:** 1\ **Last updated:** [April 21, 2022, 4:41pm UTC](https://discuss.elastic.co/t/logstash-fail-to-rewrite-json-files/302942 "2022-04-21T16:41:16Z")
Hi, I want to send json files with filebeat to logstash and then logstash rewrite these json files locally. Filebeat version: 8.1.2 Logstash version: 8.1.2 There is my filebeat conf: filebeat.inputs: - type: filest… --- ## [Logstash is not reading some files from filebeat](https://discuss.elastic.co/t/logstash-is-not-reading-some-files-from-filebeat/302570)
**Author:** [@Rohini\_Gadge28](https://discuss.elastic.co/u/Rohini_Gadge28)\ **Replies:** 5\ **Last updated:** [April 21, 2022, 4:38pm UTC](https://discuss.elastic.co/t/logstash-is-not-reading-some-files-from-filebeat/302570 "2022-04-21T16:38:35Z")
There is data in a folder which is read by filebeat and forwarded to Logstash . So we write to logs file everyday and based on date multiple files(eg. : 2022-03-29-1.log , 2022-03-30-1.log, etc) get created. But somehow… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=964) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=966)