# Latest **URL:** https://discuss.elastic.co/latest.md?page=1110 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1111 --- ## [Unable to parse svclog using filbeat](https://discuss.elastic.co/t/unable-to-parse-svclog-using-filbeat/305778)
**Author:** [@Gaurav\_kr](https://discuss.elastic.co/u/Gaurav_kr)\ **Replies:** 4\ **Last updated:** [May 31, 2022, 7:52am UTC](https://discuss.elastic.co/t/unable-to-parse-svclog-using-filbeat/305778 "2022-05-31T07:52:14Z")
Hi Team, I am unable to parse the svclog ( a XML family) using Filebeat. Please suggest how i can par --- ## [Functionbeat unable to export cloudwatch logs to elastic](https://discuss.elastic.co/t/functionbeat-unable-to-export-cloudwatch-logs-to-elastic/305927)
**Author:** [@rishabhtryroll](https://discuss.elastic.co/u/rishabhtryroll)\ **Replies:** 2\ **Last updated:** [May 31, 2022, 7:16am UTC](https://discuss.elastic.co/t/functionbeat-unable-to-export-cloudwatch-logs-to-elastic/305927 "2022-05-31T07:16:51Z")
I am using function beat to export cloud watch logs to elastic but got no data in the indices. Followed that doc https://www.elastic.co/guide/en/beats/functionbeat/current/functionbeat-installation-configuration.html T… --- ## [200 pipelines in logstash causing scalability issues](https://discuss.elastic.co/t/200-pipelines-in-logstash-causing-scalability-issues/305999)
**Author:** [@jatin\_gupta](https://discuss.elastic.co/u/jatin_gupta)\ **Replies:** 0\ **Last updated:** [May 31, 2022, 6:21am UTC](https://discuss.elastic.co/t/200-pipelines-in-logstash-causing-scalability-issues/305999 "2022-05-31T06:21:24Z")
Hey I need a design suggestion. We have 200 microservices and a 4 node logstash HA setup. Now each microservice has to send logs to a different index. Current setup I have is, for each microservice we have a different… --- ## [Search guard is not installing in Elasticsearch windows server](https://discuss.elastic.co/t/search-guard-is-not-installing-in-elasticsearch-windows-server/305996)
**Author:** [@jisha](https://discuss.elastic.co/u/jisha)\ **Replies:** 1\ **Last updated:** [May 31, 2022, 6:12am UTC](https://discuss.elastic.co/t/search-guard-is-not-installing-in-elasticsearch-windows-server/305996 "2022-05-31T06:12:33Z")
Hi, I have installed a Elasticsearch 7.13.3 in windows server, I have downloaded and search guard 53.1.0v. I have edited Elasticsearch.yml by adding following command: searchguard.enterprise\_modules\_enabled: false An… --- ## [Wrong term search result with case\_insensitive=true](https://discuss.elastic.co/t/wrong-term-search-result-with-case-insensitive-true/305916)
**Author:** [@MikeSER](https://discuss.elastic.co/u/MikeSER)\ **Replies:** 4\ **Last updated:** [May 31, 2022, 5:02am UTC](https://discuss.elastic.co/t/wrong-term-search-result-with-case-insensitive-true/305916 "2022-05-31T05:02:05Z")
I have a problem with a specific search when using a term query and case\_insensitive=true. To demonstrate that I've created a shell script. It deletes then creates index "a" with an attribute "my\_kw" of type "keyword". … --- ## [How can I known who update my doc](https://discuss.elastic.co/t/how-can-i-known-who-update-my-doc/305991)
**Author:** [@nanili](https://discuss.elastic.co/u/nanili)\ **Replies:** 1\ **Last updated:** [May 31, 2022, 3:48am UTC](https://discuss.elastic.co/t/how-can-i-known-who-update-my-doc/305991 "2022-05-31T03:48:55Z")
If somebody call the POST restful to update my doc,how can I know who do it,when do it. XPack can give me the answer? --- ## [How to read the monitoring log of filebeat?](https://discuss.elastic.co/t/how-to-read-the-monitoring-log-of-filebeat/305721)
**Author:** [@Kuo\_Hugo](https://discuss.elastic.co/u/Kuo_Hugo)\ **Replies:** 2\ **Last updated:** [May 31, 2022, 3:24am UTC](https://discuss.elastic.co/t/how-to-read-the-monitoring-log-of-filebeat/305721 "2022-05-31T03:24:40Z")
I'm working on tuning for the filebeat to process logs. Changing the output.Elasticsearch There're 7 Elasticsearch targets in the hosts list. workers:2 bulk\_max\_size: 2048 flush\_interval: 5 It's around 600 log line… --- ## [New documents not searchable](https://discuss.elastic.co/t/new-documents-not-searchable/305961)
**Author:** [@abls1](https://discuss.elastic.co/u/abls1)\ **Replies:** 3\ **Last updated:** [May 31, 2022, 2:35am UTC](https://discuss.elastic.co/t/new-documents-not-searchable/305961 "2022-05-31T02:35:36Z")
I created an index with 44 documents then, I added 10 more documents and they are seen in kibana but, when I do a search on The web search box they are not found, is there a way to add new documents without have to rein… --- ## [Kubernetes filebeat best practices](https://discuss.elastic.co/t/kubernetes-filebeat-best-practices/305270)
**Author:** [@lbchv](https://discuss.elastic.co/u/lbchv)\ **Replies:** 1\ **Last updated:** [May 31, 2022, 2:31am UTC](https://discuss.elastic.co/t/kubernetes-filebeat-best-practices/305270 "2022-05-31T02:31:55Z")
The documentation says to avoid harvesting symlinks when dialing with file rotation (link): When dealing with file rotation, avoid harvesting symlinks. Instead use the paths setting to point to the original file, and s… --- ## [How search in datastream by timestamp works?](https://discuss.elastic.co/t/how-search-in-datastream-by-timestamp-works/305694)
**Author:** [@Chanturia\_Dmitry](https://discuss.elastic.co/u/Chanturia_Dmitry)\ **Replies:** 4\ **Last updated:** [May 31, 2022, 2:10am UTC](https://discuss.elastic.co/t/how-search-in-datastream-by-timestamp-works/305694 "2022-05-31T02:10:35Z")
Hello. Can U explain how works search in datastream by timestamp field? For example: I have a datastream with two indexes. Each Index have 10 primary shards. What happens when I search by timestamp? Elastic will be s… --- ## [How to use maximum bm25 score among original term and its synonyms?](https://discuss.elastic.co/t/how-to-use-maximum-bm25-score-among-original-term-and-its-synonyms/305986)
**Author:** [@Junhyeok](https://discuss.elastic.co/u/Junhyeok)\ **Replies:** 0\ **Last updated:** [May 31, 2022, 2:08am UTC](https://discuss.elastic.co/t/how-to-use-maximum-bm25-score-among-original-term-and-its-synonyms/305986 "2022-05-31T02:08:31Z")
Hi, I am a newbie in Elasticsearch. I'm using synonym filters in analyzer. e.g. air conditioner -\> "air", "conditioner", "circulator" (synonym) When i use match query, it will calculate bm25 score for every matching t… --- ## [Kibana crashing when storing complex items on Elasticsearch](https://discuss.elastic.co/t/kibana-crashing-when-storing-complex-items-on-elasticsearch/305984)
**Author:** [@robjennings](https://discuss.elastic.co/u/robjennings)\ **Replies:** 6\ **Last updated:** [May 31, 2022, 1:32am UTC](https://discuss.elastic.co/t/kibana-crashing-when-storing-complex-items-on-elasticsearch/305984 "2022-05-31T01:32:31Z")
Hello, This is my first post in the community. I've been following this forum over the last months as I started to use more and more Elasticsearch on my day to day. I've been using Elasticsearch to store data from sever… --- ## [How to change Lucene version?](https://discuss.elastic.co/t/how-to-change-lucene-version/305959)
**Author:** [@Seo](https://discuss.elastic.co/u/Seo)\ **Replies:** 4\ **Last updated:** [May 31, 2022, 12:29am UTC](https://discuss.elastic.co/t/how-to-change-lucene-version/305959 "2022-05-31T00:29:48Z")
Hello. I have some questions about Lucene version. Are there any methods to change version of Lucene without change of Elasticsearch version? I want to apply the modified Lucene code(without version change) to my Elas… --- ## [Support for mongoose version \> 5.7](https://discuss.elastic.co/t/support-for-mongoose-version-5-7/305849)
**Author:** [@Arjun\_Agarwal1](https://discuss.elastic.co/u/Arjun_Agarwal1)\ **Replies:** 1\ **Last updated:** [May 30, 2022, 11:34pm UTC](https://discuss.elastic.co/t/support-for-mongoose-version-5-7/305849 "2022-05-30T23:34:31Z")
when will support be added for mongoose version \> 5.7 as some random mongoose spans are missing (especially find spans). Any alternative solution if support will not be added? --- ## [Security strategy on different server roles?](https://discuss.elastic.co/t/security-strategy-on-different-server-roles/305978)
**Author:** [@Ulrik](https://discuss.elastic.co/u/Ulrik)\ **Replies:** 0\ **Last updated:** [May 30, 2022, 9:21pm UTC](https://discuss.elastic.co/t/security-strategy-on-different-server-roles/305978 "2022-05-30T21:21:37Z")
Are there any best practices for how to setup and configure the Elastic monitoring on different server roles (IIS web server, MSSQL server, ...)? Is it reasonable to run Endpoint Security on a backend servers (SQL)? --- ## [License on a self-managed elasticsearch cluster](https://discuss.elastic.co/t/license-on-a-self-managed-elasticsearch-cluster/305975)
**Author:** [@irivas95](https://discuss.elastic.co/u/irivas95)\ **Replies:** 2\ **Last updated:** [May 30, 2022, 9:00pm UTC](https://discuss.elastic.co/t/license-on-a-self-managed-elasticsearch-cluster/305975 "2022-05-30T21:00:59Z")
Hi, I have a question about elastic licenses in self-managed clusters. I have seen in this page of elastic Official Elasticsearch Pricing: Elastic Cloud, Managed Elasticsearch | Elastic, the prices for subscriptions fo… --- ## [Cannot able to pull RDS metrics using metricbeat](https://discuss.elastic.co/t/cannot-able-to-pull-rds-metrics-using-metricbeat/305717)
**Author:** [@venkatkumar229](https://discuss.elastic.co/u/venkatkumar229)\ **Replies:** 2\ **Last updated:** [May 30, 2022, 8:08pm UTC](https://discuss.elastic.co/t/cannot-able-to-pull-rds-metrics-using-metricbeat/305717 "2022-05-30T20:08:40Z")
Hi Team, I am trying to pull the AWS RDS metrics from metricbeat using AWS module and i have got the arn\_role to pull the metrics. But when i run metricbeat i am getting below error. Could you please help me to solve th… --- ## [Difference between Elasticsearch and Solr](https://discuss.elastic.co/t/difference-between-elasticsearch-and-solr/305969)
**Author:** [@fizhhh1997](https://discuss.elastic.co/u/fizhhh1997)\ **Replies:** 2\ **Last updated:** [May 30, 2022, 7:15pm UTC](https://discuss.elastic.co/t/difference-between-elasticsearch-and-solr/305969 "2022-05-30T19:15:28Z")
Hello all, how can i use proximity search and relevant score to get data with high accurate, and difference between Elasticsearch and Solr --- ## [RESOURCE\_LOCKED messages](https://discuss.elastic.co/t/resource-locked-messages/305628)
**Author:** [@rnappert](https://discuss.elastic.co/u/rnappert)\ **Replies:** 7\ **Last updated:** [May 30, 2022, 7:02pm UTC](https://discuss.elastic.co/t/resource-locked-messages/305628 "2022-05-30T19:02:27Z")
I have a three Logstash instances running a fairly old release ( 6.2.3). Two are running in a standby mode, and one in a active mode. The node, which has the vip is considered the active node. All this said, all three … --- ## [Trace queries and filters for audit](https://discuss.elastic.co/t/trace-queries-and-filters-for-audit/305821)
**Author:** [@Gustavo\_Llermaly](https://discuss.elastic.co/u/Gustavo_Llermaly)\ **Replies:** 1\ **Last updated:** [May 30, 2022, 5:57pm UTC](https://discuss.elastic.co/t/trace-queries-and-filters-for-audit/305821 "2022-05-30T17:57:04Z")
Hello, I enabled audit logs in Kibana but I cant find a way to track what is being put in the search bar, and which filters are being applied to dashboards/search sessions. Is there a way to achieve this? Thanks --- ## [Fleet Server - Error - x509: certificate is valid for 127.0.0.1, not x.x.x.x](https://discuss.elastic.co/t/fleet-server-error-x509-certificate-is-valid-for-127-0-0-1-not-x-x-x-x/305226)
**Author:** [@Carlos\_Vinicius](https://discuss.elastic.co/u/Carlos_Vinicius)\ **Replies:** 2\ **Last updated:** [May 30, 2022, 5:23pm UTC](https://discuss.elastic.co/t/fleet-server-error-x509-certificate-is-valid-for-127-0-0-1-not-x-x-x-x/305226 "2022-05-30T17:23:14Z")
Dear, good afternoon! I would like to ask for your support to solve a problem that I have been facing in the configuration of a fleet server in self mode, I created the CA, my Elasticsearch responds to HTTPS, I created … --- ## [Logstash - Parse txt with xml](https://discuss.elastic.co/t/logstash-parse-txt-with-xml/305936)
**Author:** [@Ely\_96](https://discuss.elastic.co/u/Ely_96)\ **Replies:** 4\ **Last updated:** [May 30, 2022, 5:18pm UTC](https://discuss.elastic.co/t/logstash-parse-txt-with-xml/305936 "2022-05-30T17:18:14Z")
Hi guys, I am having trouble reading a txt file that contains free text (tab separated) and xml text that I would like to read. The goal is to read only the content of the xml text, but I have no idea how to reach the g… --- ## [Elastic Agent Elasticsearch output via proxy](https://discuss.elastic.co/t/elastic-agent-elasticsearch-output-via-proxy/305639)
**Author:** [@RLPowellJr](https://discuss.elastic.co/u/RLPowellJr)\ **Replies:** 1\ **Last updated:** [May 30, 2022, 4:47pm UTC](https://discuss.elastic.co/t/elastic-agent-elasticsearch-output-via-proxy/305639 "2022-05-30T16:47:38Z")
Greetings all! I am looking for a sample proxy configuration to use with the Elasticsearch output for Fleet-managed Elastic Agents. I'm working with a group who wants to expose as little as possible of their Elastic St… --- ## [Zombie process generated by elastic-agent](https://discuss.elastic.co/t/zombie-process-generated-by-elastic-agent/305569)
**Author:** [@gklink2](https://discuss.elastic.co/u/gklink2)\ **Replies:** 1\ **Last updated:** [May 30, 2022, 4:45pm UTC](https://discuss.elastic.co/t/zombie-process-generated-by-elastic-agent/305569 "2022-05-30T16:45:21Z")
after the host installed elastic-agent,we can found 2 zombie process, it can be solved after kill 9, but the host is offine,system restart dosen't work. command: ps aux | grep Z elastic-agent version:8.0.0---8.2.1 e… --- ## [Unable to uninstall elastic-agent](https://discuss.elastic.co/t/unable-to-uninstall-elastic-agent/305347)
**Author:** [@liwenbo97](https://discuss.elastic.co/u/liwenbo97)\ **Replies:** 1\ **Last updated:** [May 30, 2022, 4:43pm UTC](https://discuss.elastic.co/t/unable-to-uninstall-elastic-agent/305347 "2022-05-30T16:43:43Z")
n227-012-170 ➜ ~ sudo elastic-agent uninstall Error: can only be uninstall by executing the installed Elastic Agent at: /usr/bin/elastic-agent For help, please see our troubleshooting guide at Troubleshoot common probl… --- ## [Ruby filter in logstash](https://discuss.elastic.co/t/ruby-filter-in-logstash/305952)
**Author:** [@Iss](https://discuss.elastic.co/u/Iss)\ **Replies:** 1\ **Last updated:** [May 30, 2022, 4:18pm UTC](https://discuss.elastic.co/t/ruby-filter-in-logstash/305952 "2022-05-30T16:18:31Z")
Hi! I have a list of geo\_points coverage: \[{"lon": \*\*\* , "lat": \*\*\*} , {"lon": \*\*\*, "lat": \*\*\*},...\] in a field (coverage) but logstash reads them as text. I put a new location (type geo\_point) tremplate PUT logsta… --- ## [Could not start some language models for NLP tasks](https://discuss.elastic.co/t/could-not-start-some-language-models-for-nlp-tasks/297888)
**Author:** [@Ilia](https://discuss.elastic.co/u/Ilia)\ **Replies:** 7\ **Last updated:** [May 30, 2022, 3:52pm UTC](https://discuss.elastic.co/t/could-not-start-some-language-models-for-nlp-tasks/297888 "2022-05-30T15:52:47Z")
I've installed Eland and have imported a model from huggingface as follows: eland\_import\_hub\_model --url http://localhost:9200/ \\ --hub-model-id HooshvareLab/bert-fa-zwnj-base-ner \\ --task-type ner I can see it in h… --- ## [Filebeat 8.2.1 kubernetes autodiscover template with multiple conditions doesn't work](https://discuss.elastic.co/t/filebeat-8-2-1-kubernetes-autodiscover-template-with-multiple-conditions-doesnt-work/305693)
**Author:** [@codrut\_alexandru](https://discuss.elastic.co/u/codrut_alexandru)\ **Replies:** 1\ **Last updated:** [May 30, 2022, 3:16pm UTC](https://discuss.elastic.co/t/filebeat-8-2-1-kubernetes-autodiscover-template-with-multiple-conditions-doesnt-work/305693 "2022-05-30T15:16:12Z")
Hi, Configuring filebeat version 8.2.1 autodiscover template with multiple conditions doesn't work: This works: templates: - condition.or: - not.equals: … --- ## [Can ElasticAgent/filebeat ingest a log/filestream input metadata as document data?](https://discuss.elastic.co/t/can-elasticagent-filebeat-ingest-a-log-filestream-input-metadata-as-document-data/305734)
**Author:** [@bunjamins](https://discuss.elastic.co/u/bunjamins)\ **Replies:** 1\ **Last updated:** [May 30, 2022, 3:12pm UTC](https://discuss.elastic.co/t/can-elasticagent-filebeat-ingest-a-log-filestream-input-metadata-as-document-data/305734 "2022-05-30T15:12:35Z")
specifically we have a legacy app that doesn't log a timestamp but logs to new files, is it possible to read file ctime as @timestamp? --- ## [Can documents returned during fetch phase have changed since query phase](https://discuss.elastic.co/t/can-documents-returned-during-fetch-phase-have-changed-since-query-phase/305773)
**Author:** [@davidbkemp](https://discuss.elastic.co/u/davidbkemp)\ **Replies:** 1\ **Last updated:** [May 30, 2022, 3:08pm UTC](https://discuss.elastic.co/t/can-documents-returned-during-fetch-phase-have-changed-since-query-phase/305773 "2022-05-30T15:08:46Z")
Our system assumes the documents returned by a search actually satisfy the query. Is it possible that, if a document is modified between the query and fetch phases of a search that the returned document doesn’t actually … [Previous page](https://discuss.elastic.co/latest.md?page=1109) [Next page](https://discuss.elastic.co/latest.md?page=1111)