# Latest **URL:** https://discuss.elastic.co/latest.md?page=1128 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1129 --- ## [Use file values as variable or iterate over values](https://discuss.elastic.co/t/use-file-values-as-variable-or-iterate-over-values/304947)
**Author:** [@S-elk](https://discuss.elastic.co/u/S-elk)\ **Replies:** 1\ **Last updated:** [May 17, 2022, 3:42pm UTC](https://discuss.elastic.co/t/use-file-values-as-variable-or-iterate-over-values/304947 "2022-05-17T15:42:22Z")
Hello! Right now I have a pipeline that creates a field using a ruby scanner. When this scanner detects one of the values entered in the regular expression, it creates a field with that value. For example: if \[x\] { … --- ## [Get initial log from Logstash warning](https://discuss.elastic.co/t/get-initial-log-from-logstash-warning/304796)
**Author:** [@arazdolski](https://discuss.elastic.co/u/arazdolski)\ **Replies:** 9\ **Last updated:** [May 17, 2022, 3:37pm UTC](https://discuss.elastic.co/t/get-initial-log-from-logstash-warning/304796 "2022-05-17T15:37:05Z")
Hi, I have a rsyslog -\> logstash -\> Elasticsearch setup and noticed a lot of warnings with tried to parse field \[v\] as an object, but found a concrete value in Logstash logs, but I cannot find the initial syslog which L… --- ## [Removing transient settings from cluster](https://discuss.elastic.co/t/removing-transient-settings-from-cluster/304958)
**Author:** [@yquirion](https://discuss.elastic.co/u/yquirion)\ **Replies:** 1\ **Last updated:** [May 17, 2022, 3:16pm UTC](https://discuss.elastic.co/t/removing-transient-settings-from-cluster/304958 "2022-05-17T15:16:24Z")
Hello, I've set the following settings into my cluster for a temporatry moment: PUT \_cluster/settings { "transient": { "cluster.routing.allocation.disk.watermark.low": "90%", "cluster.routing.allocation.d… --- ## [Query fails with parse\_error](https://discuss.elastic.co/t/query-fails-with-parse-error/304956)
**Author:** [@ilBepi](https://discuss.elastic.co/u/ilBepi)\ **Replies:** 0\ **Last updated:** [May 17, 2022, 3:03pm UTC](https://discuss.elastic.co/t/query-fails-with-parse-error/304956 "2022-05-17T15:03:05Z")
Hello, I am trying to run a very simple query using the High Level Client for Java version 6.8.23 The query is like the following: { "query": { "wildcard": { "OBJECTINFO.NAME": { "wildcard": "test\*", "boo… --- ## [Enabling ILM after index exists / Enable ILM on first index creation with new version](https://discuss.elastic.co/t/enabling-ilm-after-index-exists-enable-ilm-on-first-index-creation-with-new-version/304957)
**Author:** [@cotjoey](https://discuss.elastic.co/u/cotjoey)\ **Replies:** 0\ **Last updated:** [May 17, 2022, 3:04pm UTC](https://discuss.elastic.co/t/enabling-ilm-after-index-exists-enable-ilm-on-first-index-creation-with-new-version/304957 "2022-05-17T15:04:26Z")
Hello, I hope I can find help in the community forum for this issue I've been having since the beginning of using Elastic. My problem statement is this: when I start using a new version of a beat (i.e. go from filebeat… --- ## [Logstash monitoring help not seeing in Kibana](https://discuss.elastic.co/t/logstash-monitoring-help-not-seeing-in-kibana/303689)
**Author:** [@Mary2022](https://discuss.elastic.co/u/Mary2022)\ **Replies:** 14\ **Last updated:** [May 17, 2022, 2:54pm UTC](https://discuss.elastic.co/t/logstash-monitoring-help-not-seeing-in-kibana/303689 "2022-05-17T14:54:40Z")
Hi, I am new to ELK and I have been trying to follow the guides and so far I have been abled to install version 7.17 in our 2 kibana nodes and our 3 elasticsearch nodes. If I go to Kibana and look under Cluster Over… --- ## [Getting Elasticsearch cluster status as RED](https://discuss.elastic.co/t/getting-elasticsearch-cluster-status-as-red/304939)
**Author:** [@Yogendra\_Pratap\_Sing](https://discuss.elastic.co/u/Yogendra_Pratap_Sing)\ **Replies:** 16\ **Last updated:** [May 17, 2022, 2:24pm UTC](https://discuss.elastic.co/t/getting-elasticsearch-cluster-status-as-red/304939 "2022-05-17T14:24:25Z")
Hi Community, I'm using Elastic stack on k8s and facing ES cluster status as RED but indices are all in green below is cluster health status \[Elasticsearch@Elasticsearch-master-0 ~\]$ curl -XGET 'localhost:9200/\_cluste… --- ## [How to change index pattern](https://discuss.elastic.co/t/how-to-change-index-pattern/304925)
**Author:** [@wagnar](https://discuss.elastic.co/u/wagnar)\ **Replies:** 3\ **Last updated:** [May 17, 2022, 1:59pm UTC](https://discuss.elastic.co/t/how-to-change-index-pattern/304925 "2022-05-17T13:59:02Z")
I have two different index in Elasticsearch prod and dev. I developed everything in dev pattern and after the export I changed the ID for index pattern in ndjson file. after import it is throwing error and I am not able … --- ## [How to get index contents of a website](https://discuss.elastic.co/t/how-to-get-index-contents-of-a-website/304944)
**Author:** [@Tasdiq\_Shaikh](https://discuss.elastic.co/u/Tasdiq_Shaikh)\ **Replies:** 1\ **Last updated:** [May 17, 2022, 1:39pm UTC](https://discuss.elastic.co/t/how-to-get-index-contents-of-a-website/304944 "2022-05-17T13:39:15Z")
How can I index and perform search operations on the contents of a website of a given web link like discuss.elastic.co using Java 1.8 and Elasticsearch 7.12.0? --- ## [Is Elasticsearch webcrawler an open source feature or it is paid?](https://discuss.elastic.co/t/is-elasticsearch-webcrawler-an-open-source-feature-or-it-is-paid/304789)
**Author:** [@Tasdiq\_Shaikh](https://discuss.elastic.co/u/Tasdiq_Shaikh)\ **Replies:** 6\ **Last updated:** [May 17, 2022, 1:12pm UTC](https://discuss.elastic.co/t/is-elasticsearch-webcrawler-an-open-source-feature-or-it-is-paid/304789 "2022-05-17T13:12:19Z")
What is the roadmap to implement webcrawler in my ES application using Java 1.8 and Elasticsearch version 7.12.0 --- ## [Filebeat haproxy with dns processor](https://discuss.elastic.co/t/filebeat-haproxy-with-dns-processor/304501)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 9\ **Last updated:** [May 17, 2022, 12:56pm UTC](https://discuss.elastic.co/t/filebeat-haproxy-with-dns-processor/304501 "2022-05-17T12:56:47Z")
I have succssfully send haproxy log to Elasticsearch using filebeat. next step I am trying to do is to change destination.ip and source.ip to name but I don't think I am using dns processor correctly. I am not getting… --- ## [Filebeat 7.16 drop\_fields processor not working](https://discuss.elastic.co/t/filebeat-7-16-drop-fields-processor-not-working/304916)
**Author:** [@Sederfo](https://discuss.elastic.co/u/Sederfo)\ **Replies:** 0\ **Last updated:** [May 17, 2022, 10:09am UTC](https://discuss.elastic.co/t/filebeat-7-16-drop-fields-processor-not-working/304916 "2022-05-17T10:09:21Z")
Hello! We are having trouble dropping fields from messages using Filebeat 7.16. We tried to drop fields using the "drop\_fields" processor: processors: - drop\_fields: fields: \["cisco.ftd.message\_id"\] ignor… --- ## [Logstash bulk request to ElasticSearch error - may be due to old indexes](https://discuss.elastic.co/t/logstash-bulk-request-to-elasticsearch-error-may-be-due-to-old-indexes/304943)
**Author:** [@DenSeb](https://discuss.elastic.co/u/DenSeb)\ **Replies:** 0\ **Last updated:** [May 17, 2022, 12:26pm UTC](https://discuss.elastic.co/t/logstash-bulk-request-to-elasticsearch-error-may-be-due-to-old-indexes/304943 "2022-05-17T12:26:23Z")
If you get these errors in LogStash : Attempted to send a bulk request to elasticsearch' but Elasticsearch appears to be unreachable or down! {:error\_message=\>"Elasticsearch Unreachable: \[http://localhost:9200/\]\[Mantico… --- ## [Rules ( EMail variables Alerts )](https://discuss.elastic.co/t/rules-email-variables-alerts/304811)
**Author:** [@sbemiller](https://discuss.elastic.co/u/sbemiller)\ **Replies:** 4\ **Last updated:** [May 17, 2022, 12:25pm UTC](https://discuss.elastic.co/t/rules-email-variables-alerts/304811 "2022-05-17T12:25:38Z")
We have email alerts on two rules that stopped working upon the Update to 8.1.3 This example shown below is the Rule that shows the Windows Service Accounts that have failed log ons. I have this working as shown below a… --- ## [Why can't I use user.name as field in machine learning job, but the standard jobs can?](https://discuss.elastic.co/t/why-cant-i-use-user-name-as-field-in-machine-learning-job-but-the-standard-jobs-can/304245)
**Author:** [@anddam](https://discuss.elastic.co/u/anddam)\ **Replies:** 24\ **Last updated:** [May 17, 2022, 11:58am UTC](https://discuss.elastic.co/t/why-cant-i-use-user-name-as-field-in-machine-learning-job-but-the-standard-jobs-can/304245 "2022-05-17T11:58:17Z")
Why is it not possible for me to use the user.name field in the "by field" section of a machine learning job, but the standard jobs have no problem with it? As you can see it is not an option for me: But the standar… --- ## [Grok pattern Syslog auth](https://discuss.elastic.co/t/grok-pattern-syslog-auth/304911)
**Author:** [@CemG](https://discuss.elastic.co/u/CemG)\ **Replies:** 2\ **Last updated:** [May 17, 2022, 11:47am UTC](https://discuss.elastic.co/t/grok-pattern-syslog-auth/304911 "2022-05-17T11:47:51Z")
Hello, I have to grok my syslog auth logs from Linux, I have a pattern, but it still nonmatch with the logs, can someone help me to see if there is an error in my gros pattern ? My filter filter { json { … --- ## [Update by Query insert new child document](https://discuss.elastic.co/t/update-by-query-insert-new-child-document/304928)
**Author:** [@Daniel\_Debray](https://discuss.elastic.co/u/Daniel_Debray)\ **Replies:** 0\ **Last updated:** [May 17, 2022, 11:39am UTC](https://discuss.elastic.co/t/update-by-query-insert-new-child-document/304928 "2022-05-17T11:39:30Z")
Hi, i would like to know whether its possible to insert a new child document during a Update by Query task. Our situation (simplified): A product has n attributes modeled using a join field. Index template: { "m… --- ## [Java APM with new SpringBoot 2.6.7 is erroring out on Zuul components](https://discuss.elastic.co/t/java-apm-with-new-springboot-2-6-7-is-erroring-out-on-zuul-components/304248)
**Author:** [@Kim\_Attree](https://discuss.elastic.co/u/Kim_Attree)\ **Replies:** 9\ **Last updated:** [May 17, 2022, 11:31am UTC](https://discuss.elastic.co/t/java-apm-with-new-springboot-2-6-7-is-erroring-out-on-zuul-components/304248 "2022-05-17T11:31:11Z")
Kibana version: 7.16.1 Elasticsearch version: 7.16.1 APM Server version: 7.16.1 APM Agent language and version: 1.30.1 Browser version: n/a Original install method (e.g. download page, yum, deb, from source, etc.) a… --- ## [Transaction names are hex after agent upgrade](https://discuss.elastic.co/t/transaction-names-are-hex-after-agent-upgrade/304136)
**Author:** [@ethranes](https://discuss.elastic.co/u/ethranes)\ **Replies:** 8\ **Last updated:** [May 17, 2022, 11:30am UTC](https://discuss.elastic.co/t/transaction-names-are-hex-after-agent-upgrade/304136 "2022-05-17T11:30:06Z")
We've recently done an APM Java agent upgrade from 1.17 to 1.30.1. For most of our APM monitoring things have gone smoothly but one of our services, all of the transaction names are coming through as hex values instead o… --- ## [Match financial transactions and merchants](https://discuss.elastic.co/t/match-financial-transactions-and-merchants/304588)
**Author:** [@fabiobozzo](https://discuss.elastic.co/u/fabiobozzo)\ **Replies:** 0\ **Last updated:** [May 12, 2022, 2:35pm UTC](https://discuss.elastic.co/t/match-financial-transactions-and-merchants/304588 "2022-05-12T14:35:58Z")
I have an Elastic index with billions of transactions. An example tx: { "id": "54bfa9af-009a-437d-bd21-caaf651f7218", "amount": 100.0, "currency": "EUR", "type": "expense", ... "note": "CARD PAYMENT … --- ## [Map MySQL columns into nested fields Elastic using Logstash](https://discuss.elastic.co/t/map-mysql-columns-into-nested-fields-elastic-using-logstash/304820)
**Author:** [@Alrote](https://discuss.elastic.co/u/Alrote)\ **Replies:** 4\ **Last updated:** [May 17, 2022, 11:20am UTC](https://discuss.elastic.co/t/map-mysql-columns-into-nested-fields-elastic-using-logstash/304820 "2022-05-17T11:20:03Z")
Hello, I am struggling getting done some filtering to get in Elastic the information in the format I want. First, I have a MySQL table that I process in the input (no problem in that part). I want some of the columns t… --- ## [Response time logs](https://discuss.elastic.co/t/response-time-logs/304918)
**Author:** [@The-morpho](https://discuss.elastic.co/u/The-morpho)\ **Replies:** 0\ **Last updated:** [May 17, 2022, 10:16am UTC](https://discuss.elastic.co/t/response-time-logs/304918 "2022-05-17T10:16:42Z")
Hello, I'm working on log files that contains information about some operations on differents levels, I have a field timestamp that representsthe time when each operation has occured on each level. I want to calculate … --- ## [Action \[indices:admin/auto\_create\] is unauthorized for API key id \[AJJWM4ABcxc0XhdJgk1e\] of user \[elastic\], this action is granted by the index privileges \[auto\_configure,create\_index,manage,all\]](https://discuss.elastic.co/t/action-indices-admin-auto-create-is-unauthorized-for-api-key-id-ajjwm4abcxc0xhdjgk1e-of-user-elastic-this-action-is-granted-by-the-index-privileges-auto-configure-create-index-manage-all/302633)
**Author:** [@Mehakdeep\_singh](https://discuss.elastic.co/u/Mehakdeep_singh)\ **Replies:** 1\ **Last updated:** [May 17, 2022, 10:29am UTC](https://discuss.elastic.co/t/action-indices-admin-auto-create-is-unauthorized-for-api-key-id-ajjwm4abcxc0xhdjgk1e-of-user-elastic-this-action-is-granted-by-the-index-privileges-auto-configure-create-index-manage-all/302633 "2022-05-17T10:29:14Z")
Hi guys, I am using metricbeat to ship my AWS EC2 metrics to Elasticsearch. On running metricbeat I'm getting the below error as shown in screenshot: Please guide me to resolve this issue, as I'm new to Elasticsearc… --- ## [SSL configuration assistance](https://discuss.elastic.co/t/ssl-configuration-assistance/304778)
**Author:** [@rajvel](https://discuss.elastic.co/u/rajvel)\ **Replies:** 6\ **Last updated:** [May 17, 2022, 9:51am UTC](https://discuss.elastic.co/t/ssl-configuration-assistance/304778 "2022-05-17T09:51:16Z")
Hello Team, We are having a single node ELK configuration, In the same server we have installed Elasticsearch logstash and kibana (8.0.1) (on-premises) As per the guide if we are installing the elasticsearch generates … --- ## [Can't connecte to elasticsearch using python](https://discuss.elastic.co/t/cant-connecte-to-elasticsearch-using-python/304910)
**Author:** [@safaeaz](https://discuss.elastic.co/u/safaeaz)\ **Replies:** 2\ **Last updated:** [May 17, 2022, 9:39am UTC](https://discuss.elastic.co/t/cant-connecte-to-elasticsearch-using-python/304910 "2022-05-17T09:39:55Z")
i have my Elasticsearch container running on my virtual machine en port 8081:9200 and i need to connect to it using python code when runnnig a script to create index in Elasticsearch # Import packages from elasticsearch… --- ## [How to restrict index pattern list view for a particular role in kibana?](https://discuss.elastic.co/t/how-to-restrict-index-pattern-list-view-for-a-particular-role-in-kibana/304805)
**Author:** [@Yash\_garg](https://discuss.elastic.co/u/Yash_garg)\ **Replies:** 2\ **Last updated:** [May 17, 2022, 9:35am UTC](https://discuss.elastic.co/t/how-to-restrict-index-pattern-list-view-for-a-particular-role-in-kibana/304805 "2022-05-17T09:35:39Z")
Hi there, I am using multiple server to send logs to logstash using filebeat. then i am sending logs from logstash to Elasticsearch to kibana. I defined a user and role in kibana. But I want to restrict each user to vi… --- ## [Querying for length of document](https://discuss.elastic.co/t/querying-for-length-of-document/304833)
**Author:** [@TomZa](https://discuss.elastic.co/u/TomZa)\ **Replies:** 2\ **Last updated:** [May 17, 2022, 9:12am UTC](https://discuss.elastic.co/t/querying-for-length-of-document/304833 "2022-05-17T09:12:14Z")
Hi, I have documents indexed like this: "words": "Yellow dogs are barking" The example above has four tokens. While querying now via matchPhrase, is it possible to set a minimum of tokens which should be in the docu… --- ## [Seperate email alerts per detection?](https://discuss.elastic.co/t/seperate-email-alerts-per-detection/302112)
**Author:** [@Josh\_G](https://discuss.elastic.co/u/Josh_G)\ **Replies:** 2\ **Last updated:** [May 17, 2022, 8:58am UTC](https://discuss.elastic.co/t/seperate-email-alerts-per-detection/302112 "2022-05-17T08:58:23Z")
Hi Everyone, I've been doing some testing with the Email Alerts, to alert us when a specific event code is generated. I've done this under Security \> Rules, and it runs every 5 minutes. It works absolutely fine but the… --- ## [Null id Agent Policy](https://discuss.elastic.co/t/null-id-agent-policy/303837)
**Author:** [@Leandre](https://discuss.elastic.co/u/Leandre)\ **Replies:** 2\ **Last updated:** [May 17, 2022, 8:30am UTC](https://discuss.elastic.co/t/null-id-agent-policy/303837 "2022-05-17T08:30:38Z")
Using the fleet API, I created a new Agent Policy. But by accident, I provided the ID for the new Policy : "null". Now when I try to view my policies using the UI or the API, I get this : {"statusCode":500, "error":"Int… --- ## [Where I set the variable ELASTIC\_CLIENT\_APIVERSIONING?](https://discuss.elastic.co/t/where-i-set-the-variable-elastic-client-apiversioning/304901)
**Author:** [@frankmehlhop](https://discuss.elastic.co/u/frankmehlhop)\ **Replies:** 0\ **Last updated:** [May 17, 2022, 8:29am UTC](https://discuss.elastic.co/t/where-i-set-the-variable-elastic-client-apiversioning/304901 "2022-05-17T08:29:46Z")
At the elastic documentation I read, that I should set the variable ELASTIC\_CLIENT\_APIVERSIONING on true. But where I should set the variable? At my device / Windows 11 as environment variable? Or in which configuration … [Previous page](https://discuss.elastic.co/latest.md?page=1127) [Next page](https://discuss.elastic.co/latest.md?page=1129)