# Latest **URL:** https://discuss.elastic.co/latest.md?page=1040 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1041 --- ## [After upgrading kibana to 8.2.3 i can only see audit logs on stack monitoring](https://discuss.elastic.co/t/after-upgrading-kibana-to-8-2-3-i-can-only-see-audit-logs-on-stack-monitoring/309860)
**Author:** [@Thuunder7](https://discuss.elastic.co/u/Thuunder7)\ **Replies:** 2\ **Last updated:** [July 20, 2022, 8:10am UTC](https://discuss.elastic.co/t/after-upgrading-kibana-to-8-2-3-i-can-only-see-audit-logs-on-stack-monitoring/309860 "2022-07-20T08:10:51Z")
Hello guys, Previously i had my elastic stack working on 7.16.3 version and recently i have upgraded to 8.2.3. I had my stack monitoring working well on the previous version, i could see "info", "warn" and "error" log l… --- ## [Elasticsearch - filter index on aggregated field](https://discuss.elastic.co/t/elasticsearch-filter-index-on-aggregated-field/310105)
**Author:** [@Julynell](https://discuss.elastic.co/u/Julynell)\ **Replies:** 0\ **Last updated:** [July 20, 2022, 8:00am UTC](https://discuss.elastic.co/t/elasticsearch-filter-index-on-aggregated-field/310105 "2022-07-20T08:00:48Z")
Hi, We could use your help. We have Elasticsearch with logstash. It is inserting data in elastic index from a jdbc source. In logstash we use an aggregate filter. The config looks like this: input { jdbc { … --- ## [Problems using multiline configurations](https://discuss.elastic.co/t/problems-using-multiline-configurations/309991)
**Author:** [@Hkh9966](https://discuss.elastic.co/u/Hkh9966)\ **Replies:** 4\ **Last updated:** [July 20, 2022, 8:06am UTC](https://discuss.elastic.co/t/problems-using-multiline-configurations/309991 "2022-07-20T08:06:33Z")
hello guys! I would like to ask a question about multi-line merging. I tried to test using the example provided by the official, but it didn't work.This is the link : Manage multiline messages | Filebeat Reference \[8.3\]… --- ## [Adding fields based on match](https://discuss.elastic.co/t/adding-fields-based-on-match/310094)
**Author:** [@rusty\_cole](https://discuss.elastic.co/u/rusty_cole)\ **Replies:** 0\ **Last updated:** [July 20, 2022, 6:53am UTC](https://discuss.elastic.co/t/adding-fields-based-on-match/310094 "2022-07-20T06:53:04Z")
Hi All, I have the following scenario: 1 index containing json fields. I need to match Event1\_fieldA to Event2\_fieldB. If there is a match, add additional existing field from Event2 to Event1. How would I achieve t… --- ## [Metricbeat restart with server](https://discuss.elastic.co/t/metricbeat-restart-with-server/309910)
**Author:** [@aji.shinde7](https://discuss.elastic.co/u/aji.shinde7)\ **Replies:** 2\ **Last updated:** [July 20, 2022, 7:50am UTC](https://discuss.elastic.co/t/metricbeat-restart-with-server/309910 "2022-07-20T07:50:36Z")
Hello Experts, I am a beginner in Elasticsearch. I want to register Metricbeat as service (not sure if it should be called as a service ) on Linux. I have instlled Metricbeat and ran it in background using "./Metricbe… --- ## [Kibana not installing on Ubuntu Server](https://discuss.elastic.co/t/kibana-not-installing-on-ubuntu-server/309988)
**Author:** [@Ronald\_Chinomona](https://discuss.elastic.co/u/Ronald_Chinomona)\ **Replies:** 3\ **Last updated:** [July 20, 2022, 7:50am UTC](https://discuss.elastic.co/t/kibana-not-installing-on-ubuntu-server/309988 "2022-07-20T07:50:27Z")
I have been trying to install Kibana on Ubuntu Server for the last two days. The package unpacking progress just gets stuck on 20%. I have tried on different VM's with different specs. I have made sure there is enough me… --- ## [Logstash to Logstash enable security SSL](https://discuss.elastic.co/t/logstash-to-logstash-enable-security-ssl/310103)
**Author:** [@thahgr](https://discuss.elastic.co/u/thahgr)\ **Replies:** 0\ **Last updated:** [July 20, 2022, 7:49am UTC](https://discuss.elastic.co/t/logstash-to-logstash-enable-security-ssl/310103 "2022-07-20T07:49:28Z")
Logstash to logstash, how can we enable SSL communication with http out -\> http in plugins ? for the moment , unsecured, the two instances as below work fine output { http { url =\> "the url" http\_m… --- ## [How to see Snapshot storage?](https://discuss.elastic.co/t/how-to-see-snapshot-storage/310083)
**Author:** [@wonderland14](https://discuss.elastic.co/u/wonderland14)\ **Replies:** 2\ **Last updated:** [July 20, 2022, 7:19am UTC](https://discuss.elastic.co/t/how-to-see-snapshot-storage/310083 "2022-07-20T07:19:07Z")
Hi Team, is there a way to see my snapshot(full cluster) storage? So that I can know how many memory it consumed every time I take snapshot. --- ## [Logstash pipeline grok issue with regex](https://discuss.elastic.co/t/logstash-pipeline-grok-issue-with-regex/308252)
**Author:** [@Sharon\_Hacham](https://discuss.elastic.co/u/Sharon_Hacham)\ **Replies:** 24\ **Last updated:** [July 20, 2022, 6:49am UTC](https://discuss.elastic.co/t/logstash-pipeline-grok-issue-with-regex/308252 "2022-07-20T06:49:18Z")
Hi , we have a Logstash pipeline , for Kafka on-premise Confluent Platform logs - shipped using Filebeat Kafka module , We are using a grok pattern to extract some of the entries in the data in order to use that data i… --- ## [How logstash extracts specific characters from a path?](https://discuss.elastic.co/t/how-logstash-extracts-specific-characters-from-a-path/310090)
**Author:** [@wajika](https://discuss.elastic.co/u/wajika)\ **Replies:** 2\ **Last updated:** [July 20, 2022, 6:45am UTC](https://discuss.elastic.co/t/how-logstash-extracts-specific-characters-from-a-path/310090 "2022-07-20T06:45:21Z")
I want to extract "acpro" as the service name from the path below, can anyone offer some advice? /api/acpro/filter/dowork/ayc /api/acpro/filter/toko /api/acpro/filter/toko/user/passwd /api/acpro/account/getsales/b77dd0b… --- ## [Some elasticsearch index deleted after elasticsearch cluster restart](https://discuss.elastic.co/t/some-elasticsearch-index-deleted-after-elasticsearch-cluster-restart/310088)
**Author:** [@deepakdinkar311](https://discuss.elastic.co/u/deepakdinkar311)\ **Replies:** 1\ **Last updated:** [July 20, 2022, 6:36am UTC](https://discuss.elastic.co/t/some-elasticsearch-index-deleted-after-elasticsearch-cluster-restart/310088 "2022-07-20T06:36:16Z")
After restarting elasticsearch cluster some index are deleted automatically. --- ## [\[8.3.2\] bin/elasticsearch-users throws StringIndexOutOfBoundsException](https://discuss.elastic.co/t/8-3-2-bin-elasticsearch-users-throws-stringindexoutofboundsexception/309794)
**Author:** [@gerib](https://discuss.elastic.co/u/gerib)\ **Replies:** 3\ **Last updated:** [July 20, 2022, 6:21am UTC](https://discuss.elastic.co/t/8-3-2-bin-elasticsearch-users-throws-stringindexoutofboundsexception/309794 "2022-07-20T06:21:24Z")
elasticsearch@esmaster:~/bin$ . elasticsearch-users useradd su -p password -r superuser Exception in thread "main" java.lang.StringIndexOutOfBoundsException: Range \[13, 4) out of bounds for length 4 at java.base/… --- ## [Logstash Dissect against \\e control character](https://discuss.elastic.co/t/logstash-dissect-against-e-control-character/309993)
**Author:** [@Silver137](https://discuss.elastic.co/u/Silver137)\ **Replies:** 2\ **Last updated:** [July 20, 2022, 6:01am UTC](https://discuss.elastic.co/t/logstash-dissect-against-e-control-character/309993 "2022-07-20T06:01:38Z")
My line to dissect begins with \\e\[92mContent , I need extract Content avoiding \\e\[92 I have already try: dissect { mapping =\> { "message" =\> "\\e\[92m%{content}"}} But not works --- ## [Have configured Heartbeat and logstash and influxdb but measurements are not getting created in database](https://discuss.elastic.co/t/have-configured-heartbeat-and-logstash-and-influxdb-but-measurements-are-not-getting-created-in-database/310085)
**Author:** [@sagarpathak](https://discuss.elastic.co/u/sagarpathak)\ **Replies:** 0\ **Last updated:** [July 20, 2022, 5:48am UTC](https://discuss.elastic.co/t/have-configured-heartbeat-and-logstash-and-influxdb-but-measurements-are-not-getting-created-in-database/310085 "2022-07-20T05:48:05Z")
have configured Heartbeat and logstash and influxdb but measurements are not getting created in database(telegraf) --- ## [Logstash running without logstash.yml](https://discuss.elastic.co/t/logstash-running-without-logstash-yml/307338)
**Author:** [@vikram\_singh](https://discuss.elastic.co/u/vikram_singh)\ **Replies:** 5\ **Last updated:** [July 20, 2022, 5:47am UTC](https://discuss.elastic.co/t/logstash-running-without-logstash-yml/307338 "2022-07-20T05:47:40Z")
Hi, I am running logstash for a single file by sudo /usr/share/logstash/bin/logstash --path.settings /etc/logstash/ -f /etc/logstash/conf.d/myfile.conf it is running correctly. But when I start logstash as a service… --- ## [Http input plugins is not behaving as expected](https://discuss.elastic.co/t/http-input-plugins-is-not-behaving-as-expected/309982)
**Author:** [@priyankamondalhcl](https://discuss.elastic.co/u/priyankamondalhcl)\ **Replies:** 2\ **Last updated:** [July 20, 2022, 5:20am UTC](https://discuss.elastic.co/t/http-input-plugins-is-not-behaving-as-expected/309982 "2022-07-20T05:20:22Z")
Hi, I am using http input plugins, which should be capable to expect json events, and the amount of data is huge (around 7,00,000 in 30 mins). after processing some data it stopped working and throwing error: \[13004ae0f… --- ## [Copy contents of one field to same field of another row if certain condition matches](https://discuss.elastic.co/t/copy-contents-of-one-field-to-same-field-of-another-row-if-certain-condition-matches/308339)
**Author:** [@Ashutosh\_Vaidya](https://discuss.elastic.co/u/Ashutosh_Vaidya)\ **Replies:** 14\ **Last updated:** [July 20, 2022, 5:20am UTC](https://discuss.elastic.co/t/copy-contents-of-one-field-to-same-field-of-another-row-if-certain-condition-matches/308339 "2022-07-20T05:20:07Z")
I need to copy contents of “Service” field from No. 15256 into the :path field of No.15257 if “Stream\_Identifier” of both lines in 15256 and 15257 are matching. Kindly suggest how to get this done in the conf file of lo… --- ## [Turning a Filebeat Log into a configured index](https://discuss.elastic.co/t/turning-a-filebeat-log-into-a-configured-index/309926)
**Author:** [@SamuelSMendes](https://discuss.elastic.co/u/SamuelSMendes)\ **Replies:** 8\ **Last updated:** [July 20, 2022, 4:23am UTC](https://discuss.elastic.co/t/turning-a-filebeat-log-into-a-configured-index/309926 "2022-07-20T04:23:53Z")
So I've been using Filebeat for a while and so far it worked fined, but is getting into the cluster a single message; I want to have it setted into the cluster as separate fields in a way that I could manipulate it bet… --- ## [Get previous problem after adding to docker group](https://discuss.elastic.co/t/get-previous-problem-after-adding-to-docker-group/310077)
**Author:** [@m\_pahlevanzadeh](https://discuss.elastic.co/u/m_pahlevanzadeh)\ **Replies:** 1\ **Last updated:** [July 20, 2022, 4:00am UTC](https://discuss.elastic.co/t/get-previous-problem-after-adding-to-docker-group/310077 "2022-07-20T04:00:39Z")
after adding mohsen user to docker group, I get the The UID or GID must not be smaller than 1000. But id mohsen output is: uid=1000(mohsen) gid=143(docker) groups=143(docker),24(cdrom),25(floppy),29(audio),30(dip),44(v… --- ## [This article is outdated, what's the updated article about this?](https://discuss.elastic.co/t/this-article-is-outdated-whats-the-updated-article-about-this/310078)
**Author:** [@davecomputertips](https://discuss.elastic.co/u/davecomputertips)\ **Replies:** 1\ **Last updated:** [July 20, 2022, 2:54am UTC](https://discuss.elastic.co/t/this-article-is-outdated-whats-the-updated-article-about-this/310078 "2022-07-20T02:54:09Z")
Please share a latest updated article about Elasticsearch types of index(same topic mentioned there and many). --- ## [Upgrade ES 6 Index to 7 Without Reindex](https://discuss.elastic.co/t/upgrade-es-6-index-to-7-without-reindex/309940)
**Author:** [@Jerjef](https://discuss.elastic.co/u/Jerjef)\ **Replies:** 5\ **Last updated:** [July 20, 2022, 12:05am UTC](https://discuss.elastic.co/t/upgrade-es-6-index-to-7-without-reindex/309940 "2022-07-20T00:05:35Z")
I know this sounds obvious, but I need to ask to be sure. I have an ES 6 index in an ES 7 instance. I know it's backward compatible, but is there a way or upgrading the index to an ES 7 schema without reindexing due to… --- ## [Problem with docker pull](https://discuss.elastic.co/t/problem-with-docker-pull/310056)
**Author:** [@Serhio\_Duran](https://discuss.elastic.co/u/Serhio_Duran)\ **Replies:** 1\ **Last updated:** [July 19, 2022, 10:05pm UTC](https://discuss.elastic.co/t/problem-with-docker-pull/310056 "2022-07-19T22:05:11Z")
I can't download docker pull elastic , my ip address -\> 51.158.163.158, 403 forrbiden (( --- ## [How to create filter for strings with separator and calculate string?](https://discuss.elastic.co/t/how-to-create-filter-for-strings-with-separator-and-calculate-string/310073)
**Author:** [@Bohdan\_Repetskyi](https://discuss.elastic.co/u/Bohdan_Repetskyi)\ **Replies:** 0\ **Last updated:** [July 19, 2022, 9:57pm UTC](https://discuss.elastic.co/t/how-to-create-filter-for-strings-with-separator-and-calculate-string/310073 "2022-07-19T21:57:26Z")
I have a simple config file: input { file{ path =\> "/tmp/data\_for\_logstach" start\_position =\> "beginning" } } filter { } output { file{ path =\> "/tmp/logstash\_convert" action =\> "update" } } H… --- ## [How to setup Ingest Pipeline](https://discuss.elastic.co/t/how-to-setup-ingest-pipeline/310057)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 0\ **Last updated:** [July 19, 2022, 6:26pm UTC](https://discuss.elastic.co/t/how-to-setup-ingest-pipeline/310057 "2022-07-19T18:26:02Z")
This is not a question but rather a solution. last week I was trying to find some simple to do list of how to setup ingest pipleline and make that for particular index. and was hard to find this info. All elastic docume… --- ## [Logstash kafka](https://discuss.elastic.co/t/logstash-kafka/310064)
**Author:** [@emmanuel\_stevens\_LED](https://discuss.elastic.co/u/emmanuel_stevens_LED)\ **Replies:** 0\ **Last updated:** [July 19, 2022, 7:55pm UTC](https://discuss.elastic.co/t/logstash-kafka/310064 "2022-07-19T19:55:03Z")
Hello, I need some help to understand someting. I am new in elk stack so i will ask a lot of questions for the next weeks. With th persistant queue in logstash and the Filebeat backpressure-sensitive protocol when send… --- ## [Vulnerabilities in latest docker image of Elasticsearch 8.3.1](https://discuss.elastic.co/t/vulnerabilities-in-latest-docker-image-of-elasticsearch-8-3-1/310031)
**Author:** [@chitransh\_1](https://discuss.elastic.co/u/chitransh_1)\ **Replies:** 1\ **Last updated:** [July 19, 2022, 9:30pm UTC](https://discuss.elastic.co/t/vulnerabilities-in-latest-docker-image-of-elasticsearch-8-3-1/310031 "2022-07-19T21:30:13Z")
Hi, We are using Elasticsearch 8.3.1 for one of our projects. While scanning the Elasticsearch 8.3.1 with Aquasec Scanner, we are getting a few CVEs: These CVE are associated with various Java based packages which hav… --- ## [Updating Debian package does not copy state.yml](https://discuss.elastic.co/t/updating-debian-package-does-not-copy-state-yml/310037)
**Author:** [@nessus](https://discuss.elastic.co/u/nessus)\ **Replies:** 0\ **Last updated:** [July 19, 2022, 2:55pm UTC](https://discuss.elastic.co/t/updating-debian-package-does-not-copy-state-yml/310037 "2022-07-19T14:55:46Z")
Hello I just wanted to report a probably not wanted interaction between the elastic-agent debian packages when managed by a fleet Server. We had the problem, that we always needed to enroll an agent again after an upda… --- ## [Why does it need cluster:monitor/main permission](https://discuss.elastic.co/t/why-does-it-need-cluster-monitor-main-permission/310069)
**Author:** [@xliu](https://discuss.elastic.co/u/xliu)\ **Replies:** 1\ **Last updated:** [July 19, 2022, 9:14pm UTC](https://discuss.elastic.co/t/why-does-it-need-cluster-monitor-main-permission/310069 "2022-07-19T21:14:38Z")
ES 7.17 cloud is hosted in https://xxx.elastic-cloud.com:9243 Using Java High Level REST client, I was able to connect to server ES client 7.9.3. Now I update to ES client 7.17.4. But it gives me permission issue. "roo… --- ## [Integrating Serilog with applications](https://discuss.elastic.co/t/integrating-serilog-with-applications/310068)
**Author:** [@wes.campbell](https://discuss.elastic.co/u/wes.campbell)\ **Replies:** 0\ **Last updated:** [July 19, 2022, 9:08pm UTC](https://discuss.elastic.co/t/integrating-serilog-with-applications/310068 "2022-07-19T21:08:56Z")
The logs for our applications are captured by Serilog and sent to Elasticsearch. All of our configuration info for connecting to Elasticsearch is in the application config file. What do I need to enter in the config rega… --- ## [Problem with fleet server, intake/v2/events not found](https://discuss.elastic.co/t/problem-with-fleet-server-intake-v2-events-not-found/310051)
**Author:** [@Cpt\_Falcon](https://discuss.elastic.co/u/Cpt_Falcon)\ **Replies:** 0\ **Last updated:** [July 19, 2022, 4:41pm UTC](https://discuss.elastic.co/t/problem-with-fleet-server-intake-v2-events-not-found/310051 "2022-07-19T16:41:57Z")
Hello, I'm currently trying to use fleet server locally on docker desktop. I feel like I've almost got it working but there seems to be a bug with the fleet server as intake/v2/events does not exist? I really don't unde… [Previous page](https://discuss.elastic.co/latest.md?page=1039) [Next page](https://discuss.elastic.co/latest.md?page=1041)