# Latest **URL:** https://discuss.elastic.co/latest.md?page=1131 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1132 --- ## [Integrate snort3 with elastic stack using filebeat](https://discuss.elastic.co/t/integrate-snort3-with-elastic-stack-using-filebeat/304749)
**Author:** [@Onsrm](https://discuss.elastic.co/u/Onsrm)\ **Replies:** 1\ **Last updated:** [May 16, 2022, 12:19am UTC](https://discuss.elastic.co/t/integrate-snort3-with-elastic-stack-using-filebeat/304749 "2022-05-16T00:19:02Z")
hello, i want to integrate snort3 with elk stack. when i use this command : sudo filebeat setup -E output.logstash.enabled=false -E output.elasticsearch.hosts=\['192.168.200.100:9200'\] -E setup.kibana.host=192.168.200.1… --- ## [Getaddrinfo EAI\_AGAIN elasticsearch](https://discuss.elastic.co/t/getaddrinfo-eai-again-elasticsearch/304757)
**Author:** [@cyberzlo](https://discuss.elastic.co/u/cyberzlo)\ **Replies:** 1\ **Last updated:** [May 15, 2022, 9:39pm UTC](https://discuss.elastic.co/t/getaddrinfo-eai-again-elasticsearch/304757 "2022-05-15T21:39:12Z")
I have following problem with Kibana, which just installed with whole ELK stack on fresh system Ubuntu 20.04.4 LTS: Kibana server is not ready yet. Error in logs: {"ecs":{"version":"8.0.0"},"@timestamp":"2022-05-15T15… --- ## [Terms query vs lot of term queries](https://discuss.elastic.co/t/terms-query-vs-lot-of-term-queries/304762)
**Author:** [@hunsw](https://discuss.elastic.co/u/hunsw)\ **Replies:** 0\ **Last updated:** [May 15, 2022, 9:27pm UTC](https://discuss.elastic.co/t/terms-query-vs-lot-of-term-queries/304762 "2022-05-15T21:27:54Z")
Does a terms query with n terms ORd together takes less computational resource than n separate term query? Or does ES / Lucene? internally rewrites the ORd terms to n term query? Ty! --- ## [Elastic-Agent - metricbeat x509 certificate signed by unknown authority](https://discuss.elastic.co/t/elastic-agent-metricbeat-x509-certificate-signed-by-unknown-authority/304735)
**Author:** [@KelvUK](https://discuss.elastic.co/u/KelvUK)\ **Replies:** 1\ **Last updated:** [May 15, 2022, 5:04pm UTC](https://discuss.elastic.co/t/elastic-agent-metricbeat-x509-certificate-signed-by-unknown-authority/304735 "2022-05-15T17:04:13Z")
I've elastic-agent running as a docker container configured as the fleet-server. The fleet-server registers without issue and can receive policy updates. However I'm getting no data from the metricbeat component of the… --- ## [Elasticsearch pod stuck when node scale down and up](https://discuss.elastic.co/t/elasticsearch-pod-stuck-when-node-scale-down-and-up/304200)
**Author:** [@devopsdymyr](https://discuss.elastic.co/u/devopsdymyr)\ **Replies:** 1\ **Last updated:** [May 15, 2022, 3:31pm UTC](https://discuss.elastic.co/t/elasticsearch-pod-stuck-when-node-scale-down-and-up/304200 "2022-05-15T15:31:41Z")
Hi team, I have installed elasticsearch in my EKS cluster using helm chart with PVC (gp2)and worked fine and tried to scaling down EKS nodegroup and scale up Nodegroup . all my pods went to pending state (base) devops@… --- ## [APM Ignore Exception Config defined in application.properties is not ignored and visible as error in APM](https://discuss.elastic.co/t/apm-ignore-exception-config-defined-in-application-properties-is-not-ignored-and-visible-as-error-in-apm/304706)
**Author:** [@saelastic](https://discuss.elastic.co/u/saelastic)\ **Replies:** 1\ **Last updated:** [May 15, 2022, 8:27am UTC](https://discuss.elastic.co/t/apm-ignore-exception-config-defined-in-application-properties-is-not-ignored-and-visible-as-error-in-apm/304706 "2022-05-15T08:27:31Z")
APM Server version: 7.13 APM Agent language and version: Java 1.28.0 We have config defined in Java spring application.proerties defined as elastic.apm.ignore\_exceptions=com.base.org.application.core.Exception.Exam… --- ## [How to uninstall logstash service in windows?](https://discuss.elastic.co/t/how-to-uninstall-logstash-service-in-windows/304740)
**Author:** [@jisha](https://discuss.elastic.co/u/jisha)\ **Replies:** 2\ **Last updated:** [May 15, 2022, 6:31am UTC](https://discuss.elastic.co/t/how-to-uninstall-logstash-service-in-windows/304740 "2022-05-15T06:31:42Z")
I want to know how to uninstall Logstash in the windows server? someone please help me with the appropriate command. --- ## [Getting error on logstash server](https://discuss.elastic.co/t/getting-error-on-logstash-server/304742)
**Author:** [@mangeshmj1992](https://discuss.elastic.co/u/mangeshmj1992)\ **Replies:** 0\ **Last updated:** [May 15, 2022, 5:57am UTC](https://discuss.elastic.co/t/getting-error-on-logstash-server/304742 "2022-05-15T05:57:32Z")
Hello team, I am getting below error on logstash. Can you please help me on this. How to handle this in logstash "log"=\>"{\\"timestamp\\":\\"2022-05-15 09:50:00,012+0400\\",\\"nodeId\\":\\"E9EBC60D-F4BD50A1-E285711E-EFEABBB0-… --- ## [8.2 Rule Preview Not Working](https://discuss.elastic.co/t/8-2-rule-preview-not-working/304739)
**Author:** [@bm11100](https://discuss.elastic.co/u/bm11100)\ **Replies:** 0\ **Last updated:** [May 15, 2022, 2:04am UTC](https://discuss.elastic.co/t/8-2-rule-preview-not-working/304739 "2022-05-15T02:04:21Z")
We just upgraded to 8.2 and we create different roles for users to allow for certain behavior. I'm following this guide, and I want to allow users to preview rules but not give them full admin access - Detections prereq… --- ## [Insufficient memory to run logstash-keystore](https://discuss.elastic.co/t/insufficient-memory-to-run-logstash-keystore/304734)
**Author:** [@mcosta](https://discuss.elastic.co/u/mcosta)\ **Replies:** 2\ **Last updated:** [May 14, 2022, 10:16pm UTC](https://discuss.elastic.co/t/insufficient-memory-to-run-logstash-keystore/304734 "2022-05-14T22:16:17Z")
Hi all, Running logstash 7.17.3 on a 8 GB RHEL 8.5 with -Xms4g -Xmx4g. Until now I was able to run "bin/logstash-keystore --path.settings ${LOGSTASH\_CONF} list" command but now I get the following error: OpenJDK 64-Bi… --- ## [Elasticsearch query on specific key](https://discuss.elastic.co/t/elasticsearch-query-on-specific-key/304731)
**Author:** [@mostafaelsayed](https://discuss.elastic.co/u/mostafaelsayed)\ **Replies:** 7\ **Last updated:** [May 14, 2022, 5:44pm UTC](https://discuss.elastic.co/t/elasticsearch-query-on-specific-key/304731 "2022-05-14T17:44:25Z")
Suppose I have these 3 docs in Elasticsearch { id: "1", eventName: "ShipmentLoaded" }, { id: "1", eventName: "ShipmentPlanned" }, { id: "2", eventName: "ShipmentLoaded" } I want to retrieve the … --- ## [Match query](https://discuss.elastic.co/t/match-query/304310)
**Author:** [@RohitBR\_K](https://discuss.elastic.co/u/RohitBR_K)\ **Replies:** 10\ **Last updated:** [May 14, 2022, 4:07pm UTC](https://discuss.elastic.co/t/match-query/304310 "2022-05-14T16:07:30Z")
Can we add fields to match query like multi\_match , I can't add fuzziness to multi\_match with type phrase. I need to know how to add fields in match , if it can I can easily add fuzziness to fields in match query. --- ## [Want Alert when New IP Found, How to do that?](https://discuss.elastic.co/t/want-alert-when-new-ip-found-how-to-do-that/304730)
**Author:** [@Dhia\_Saibi](https://discuss.elastic.co/u/Dhia_Saibi)\ **Replies:** 0\ **Last updated:** [May 14, 2022, 2:29pm UTC](https://discuss.elastic.co/t/want-alert-when-new-ip-found-how-to-do-that/304730 "2022-05-14T14:29:16Z")
Hi, I've parsed the logs to get new fields and specifically the client.ip field using this ingest piepline PUT \_ingest/pipeline/disscus-ip { "description": "", "processors": \[ { "grok": { "field":… --- ## [How to Parse Log to Get IP Address](https://discuss.elastic.co/t/how-to-parse-log-to-get-ip-address/304690)
**Author:** [@Dhia\_Saibi](https://discuss.elastic.co/u/Dhia_Saibi)\ **Replies:** 10\ **Last updated:** [May 14, 2022, 2:35pm UTC](https://discuss.elastic.co/t/how-to-parse-log-to-get-ip-address/304690 "2022-05-14T14:35:24Z")
Hello I've been stuck in a problem for 3 days now..I am trying to alert on new IP address but the format of log file is not helping me so I've used a pipeline to parse the log with grok %{NUMBER:bytes} %{IP:client}… --- ## [Disable login kibana 8.2](https://discuss.elastic.co/t/disable-login-kibana-8-2/304599)
**Author:** [@crimson\_riot](https://discuss.elastic.co/u/crimson_riot)\ **Replies:** 5\ **Last updated:** [May 14, 2022, 2:19pm UTC](https://discuss.elastic.co/t/disable-login-kibana-8-2/304599 "2022-05-14T14:19:59Z")
We are using eck operator and oauth2-proxy for single sign on. And we want to disable the kibana login page so that after successful sign in, oauth2 directly will take the user to dashboard. But how should we do that? wh… --- ## [Help: winlogbeat.yaml error](https://discuss.elastic.co/t/help-winlogbeat-yaml-error/304727)
**Author:** [@roman-tasi](https://discuss.elastic.co/u/roman-tasi)\ **Replies:** 3\ **Last updated:** [May 14, 2022, 12:34pm UTC](https://discuss.elastic.co/t/help-winlogbeat-yaml-error/304727 "2022-05-14T12:34:38Z")
I copied and pasted the same winlogbeat.yaml file o ver to a new server to use. However it is giving an error. I never got this error on the old servers that I was using. Here is the error: PS C:\\Program Files\\Winlogbe… --- ## [Limit logstash 7.5 memory usage](https://discuss.elastic.co/t/limit-logstash-7-5-memory-usage/304556)
**Author:** [@smm](https://discuss.elastic.co/u/smm)\ **Replies:** 10\ **Last updated:** [May 14, 2022, 12:26pm UTC](https://discuss.elastic.co/t/limit-logstash-7-5-memory-usage/304556 "2022-05-14T12:26:38Z")
Hi there, is there a way to limit memory consumption of logstash 7.5? In our case logstash 'eats up' all the memory so that Elasticsearch itself gets killed on the same host (OOM killer). From 7.8 onwards a possibility… --- ## [Elastic readiness probe faliure](https://discuss.elastic.co/t/elastic-readiness-probe-faliure/304725)
**Author:** [@arieltar](https://discuss.elastic.co/u/arieltar)\ **Replies:** 0\ **Last updated:** [May 14, 2022, 10:51am UTC](https://discuss.elastic.co/t/elastic-readiness-probe-faliure/304725 "2022-05-14T10:51:36Z")
hello , i am trying to helm install using the official elastic repo: helm repo add elastic https://helm.elastic.co this is my values.yaml: clusterName: "elasticsearch" nodeGroup: "master" # Elasticsearch roles that … --- ## [Autocomplete address search](https://discuss.elastic.co/t/autocomplete-address-search/304715)
**Author:** [@foobar2022](https://discuss.elastic.co/u/foobar2022)\ **Replies:** 6\ **Last updated:** [May 14, 2022, 5:42am UTC](https://discuss.elastic.co/t/autocomplete-address-search/304715 "2022-05-14T05:42:59Z")
Hi, I'm trying to build an index & query for address search autocomplete for City, State & Country. I have a structured data fields: City, State Country Full (a complete field that concatenates City State & Country, … --- ## [Need to add time range filter condition in below watcher](https://discuss.elastic.co/t/need-to-add-time-range-filter-condition-in-below-watcher/304719)
**Author:** [@mangeshmj1992](https://discuss.elastic.co/u/mangeshmj1992)\ **Replies:** 0\ **Last updated:** [May 14, 2022, 5:36am UTC](https://discuss.elastic.co/t/need-to-add-time-range-filter-condition-in-below-watcher/304719 "2022-05-14T05:36:24Z")
Hello team, Need to add time range filter condition in below watcher. i am unable to identify where i need to exactly put below condions: I think my script is checking whole data if i not mentioned any range filter. I … --- ## [Quotas per Index?](https://discuss.elastic.co/t/quotas-per-index/304718)
**Author:** [@smm](https://discuss.elastic.co/u/smm)\ **Replies:** 1\ **Last updated:** [May 14, 2022, 5:27am UTC](https://discuss.elastic.co/t/quotas-per-index/304718 "2022-05-14T05:27:08Z")
Dear community, I have a general question regarding Elasticsearch. We have a big centrl environment with many projects. Each project has its own Kibana space and index. So far so good. But some projects are much bigger … --- ## [No such index \[.ds-.fleet-actions-results-\*\]](https://discuss.elastic.co/t/no-such-index-ds-fleet-actions-results/302181)
**Author:** [@zx8086](https://discuss.elastic.co/u/zx8086)\ **Replies:** 2\ **Last updated:** [May 14, 2022, 2:01am UTC](https://discuss.elastic.co/t/no-such-index-ds-fleet-actions-results/302181 "2022-05-14T02:01:05Z")
Can't modify settings for these indicies via Dev Tool or UI and the data stream doesn't have a delete action. PUT /.ds-.fleet-actions-results-\*/\_settings { "index" : { "number\_of\_replicas" : 0 } } { "error" … --- ## [ELK STACK - suricatas](https://discuss.elastic.co/t/elk-stack-suricatas/304560)
**Author:** [@TARIK\_MAZOUZ](https://discuss.elastic.co/u/TARIK_MAZOUZ)\ **Replies:** 1\ **Last updated:** [May 13, 2022, 9:47pm UTC](https://discuss.elastic.co/t/elk-stack-suricatas/304560 "2022-05-13T21:47:55Z")
hey everyone, i hope u all doing good, please i need your help here, well i have installed 3 VM, first one is the server where i've already install Elasticsearch and kibana, the second VM is a linux client , and the thir… --- ## [Running logstash(pipeline.conf) through terminal by passing environment variables](https://discuss.elastic.co/t/running-logstash-pipeline-conf-through-terminal-by-passing-environment-variables/304649)
**Author:** [@vaseemQA](https://discuss.elastic.co/u/vaseemQA)\ **Replies:** 5\ **Last updated:** [May 13, 2022, 8:56pm UTC](https://discuss.elastic.co/t/running-logstash-pipeline-conf-through-terminal-by-passing-environment-variables/304649 "2022-05-13T20:56:01Z")
Hi Team, I need some help in running my Logstash project files. I've a list of .conf files in a project called pilotProject, currently I test them from my local by running following command ./logstash -f ~/pilotProjec… --- ## [Kibana - Nginx 502 Bad Gateway](https://discuss.elastic.co/t/kibana-nginx-502-bad-gateway/304709)
**Author:** [@uklipse](https://discuss.elastic.co/u/uklipse)\ **Replies:** 1\ **Last updated:** [May 13, 2022, 7:54pm UTC](https://discuss.elastic.co/t/kibana-nginx-502-bad-gateway/304709 "2022-05-13T19:54:33Z")
I tried logging into Kibana and was greeted with a 502 Bad Gateway error. Our setup is a single server hosting elastic, logstash and kibana. On the server, I got a 302 redirect when running curl -i http://localhost:5601.… --- ## [Connecting app ssearch to prestashop via modules](https://discuss.elastic.co/t/connecting-app-ssearch-to-prestashop-via-modules/304711)
**Author:** [@Ines\_ZAYANI](https://discuss.elastic.co/u/Ines_ZAYANI)\ **Replies:** 0\ **Last updated:** [May 13, 2022, 6:52pm UTC](https://discuss.elastic.co/t/connecting-app-ssearch-to-prestashop-via-modules/304711 "2022-05-13T18:52:55Z")
Hi everyone, Does any of you have any experience with connecting app search to the cms prestashop ? I'm currently working on that and found some useful modules like elasticsearchconnector and wkelasticsearch the proble… --- ## [Substring logstash](https://discuss.elastic.co/t/substring-logstash/304710)
**Author:** [@mvasqueznr](https://discuss.elastic.co/u/mvasqueznr)\ **Replies:** 1\ **Last updated:** [May 13, 2022, 6:53pm UTC](https://discuss.elastic.co/t/substring-logstash/304710 "2022-05-13T18:53:52Z")
Hi. Im use grok patterns to extract info from Palo Alto log. But im try to extract a substring on description field like this authenticated for user 'newUser'. auth profile 'D', server profile 'LTY', server address … --- ## [App search won't start on port 3002](https://discuss.elastic.co/t/app-search-wont-start-on-port-3002/303060)
**Author:** [@Ines\_ZAYANI](https://discuss.elastic.co/u/Ines_ZAYANI)\ **Replies:** 2\ **Last updated:** [May 13, 2022, 6:44pm UTC](https://discuss.elastic.co/t/app-search-wont-start-on-port-3002/303060 "2022-05-13T18:44:36Z")
hi everyone, I'm kinda new to Elasticsearch and I'm seeking some help. so, i installed the elk stack and enterprise search in hopes of using the app search. Accessing app search through kibana is a lot of trouble makes … --- ## [How do I transfer certificate from one cluster to another?](https://discuss.elastic.co/t/how-do-i-transfer-certificate-from-one-cluster-to-another/304703)
**Author:** [@Blason](https://discuss.elastic.co/u/Blason)\ **Replies:** 1\ **Last updated:** [May 13, 2022, 6:21pm UTC](https://discuss.elastic.co/t/how-do-i-transfer-certificate-from-one-cluster-to-another/304703 "2022-05-13T18:21:57Z")
Hi Team, I need to move data from my single node cluster to another. I have around 80 Windows servers which are connected to Elasticsearch through elastic agent and this communication I believe happens through certifica… --- ## [ElasticSearch cluster design](https://discuss.elastic.co/t/elasticsearch-cluster-design/304707)
**Author:** [@Rayyanalbaz](https://discuss.elastic.co/u/Rayyanalbaz)\ **Replies:** 1\ **Last updated:** [May 13, 2022, 6:11pm UTC](https://discuss.elastic.co/t/elasticsearch-cluster-design/304707 "2022-05-13T18:11:49Z")
Hello Elastic Team/Community I’m currently in the process of designing a cluster that has 3 nodes. I was a bit confused on how will the requests be sent to the cluster. Should I be targeting the master node? Or split … [Previous page](https://discuss.elastic.co/latest.md?page=1130) [Next page](https://discuss.elastic.co/latest.md?page=1132)