# Latest **URL:** https://discuss.elastic.co/latest.md?page=1143 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1144 --- ## [Udp - Exception in inputworker - Logstash (7.4.2) with netflow plugin](https://discuss.elastic.co/t/udp-exception-in-inputworker-logstash-7-4-2-with-netflow-plugin/304056)
**Author:** [@gurumu](https://discuss.elastic.co/u/gurumu)\ **Replies:** 2\ **Last updated:** [May 5, 2022, 7:58pm UTC](https://discuss.elastic.co/t/udp-exception-in-inputworker-logstash-7-4-2-with-netflow-plugin/304056 "2022-05-05T19:58:39Z")
\[ERROR\] 2022-05-05 09:24:32.009 \[\java.lang.NullPointerException, "backtrace"=\>\["org.jruby.runtime.invokedynamic.InvokeDynamicSupport.callMethodMissing(InvokeDynamicSup… --- ## [Logstash s3 input plugin not working without prefix](https://discuss.elastic.co/t/logstash-s3-input-plugin-not-working-without-prefix/304067)
**Author:** [@sindhu\_vutukuri](https://discuss.elastic.co/u/sindhu_vutukuri)\ **Replies:** 0\ **Last updated:** [May 5, 2022, 7:47pm UTC](https://discuss.elastic.co/t/logstash-s3-input-plugin-not-working-without-prefix/304067 "2022-05-05T19:47:19Z")
I am trying to ingest msk logs from s3 bucket to Elasticsearch via logstash input s3 plugin. S3 bucket holds multiple msk cluster logs. Here is my logstash input config input { s3 { "region" =\> "{{ … --- ## [Cannot run EnterpriseSearch without security](https://discuss.elastic.co/t/cannot-run-enterprisesearch-without-security/303975)
**Author:** [@samiujan](https://discuss.elastic.co/u/samiujan)\ **Replies:** 1\ **Last updated:** [May 5, 2022, 7:46pm UTC](https://discuss.elastic.co/t/cannot-run-enterprisesearch-without-security/303975 "2022-05-05T19:46:51Z")
Hi I am trying to run a non-secure ES setup with Elasticsearch+Kibana+EnterpriseSearch on my Mac M1 - I have downloaded the tar.gz and am running them from the cmdline directly (after changing the config files) This is… --- ## [Elastic agent shows healthy (Also no error messages in Logs) in Kibana but fails to send data to elastic search](https://discuss.elastic.co/t/elastic-agent-shows-healthy-also-no-error-messages-in-logs-in-kibana-but-fails-to-send-data-to-elastic-search/302575)
**Author:** [@ajj31](https://discuss.elastic.co/u/ajj31)\ **Replies:** 5\ **Last updated:** [May 5, 2022, 7:29pm UTC](https://discuss.elastic.co/t/elastic-agent-shows-healthy-also-no-error-messages-in-logs-in-kibana-but-fails-to-send-data-to-elastic-search/302575 "2022-05-05T19:29:54Z")
v 7.17.2 - ELK Elastic Agent for EndPoint security gets enrolled and installed successfully. But instead of showing data received from elastic agent , it always goes to the attached screenshot " Next step: Enroll an … --- ## [Query regarding split function and conditionality](https://discuss.elastic.co/t/query-regarding-split-function-and-conditionality/303944)
**Author:** [@ianrobo](https://discuss.elastic.co/u/ianrobo)\ **Replies:** 7\ **Last updated:** [May 5, 2022, 7:06pm UTC](https://discuss.elastic.co/t/query-regarding-split-function-and-conditionality/303944 "2022-05-05T19:06:06Z")
Hi, I am a fairly new user to elastic and trying to develop an ingest pipeline to process Cisco logs. The format of the log is that the log.source.address is 1.1.1.1: I am using the split function to delimit on : and … --- ## [Elastic Agent keeps updating - Fleet](https://discuss.elastic.co/t/elastic-agent-keeps-updating-fleet/303855)
**Author:** [@SamuelSMendes](https://discuss.elastic.co/u/SamuelSMendes)\ **Replies:** 2\ **Last updated:** [May 5, 2022, 7:01pm UTC](https://discuss.elastic.co/t/elastic-agent-keeps-updating-fleet/303855 "2022-05-05T19:01:42Z")
Hello everyone, I've been testing the Elastic Cloud by using the 14 days trial and so I wanted to check everything I could. Since I already used the APM agents with django and java on self-management, now on Cloud I've b… --- ## [Update/Upgrade?](https://discuss.elastic.co/t/update-upgrade/304059)
**Author:** [@jumpie](https://discuss.elastic.co/u/jumpie)\ **Replies:** 5\ **Last updated:** [May 5, 2022, 5:55pm UTC](https://discuss.elastic.co/t/update-upgrade/304059 "2022-05-05T17:55:57Z")
I don't see directions on how to update/upgrade Elastic. I see 8.2 came out for Linux. --- ## [ILM not deleting upcoming indices(ILM not working)](https://discuss.elastic.co/t/ilm-not-deleting-upcoming-indices-ilm-not-working/303009)
**Author:** [@jisha](https://discuss.elastic.co/u/jisha)\ **Replies:** 4\ **Last updated:** [May 5, 2022, 5:35pm UTC](https://discuss.elastic.co/t/ilm-not-deleting-upcoming-indices-ilm-not-working/303009 "2022-05-05T17:35:06Z")
Hi, I am using elk 8.0.0v in windows. Data deletion of upcoming indices is not happening for the time duration setted in ILM (ex:5mints (for testing purpose)).I have created ILM template and assigned metricbeat 8.0.0. T… --- ## [Logstash user permissions](https://discuss.elastic.co/t/logstash-user-permissions/304049)
**Author:** [@ksobon](https://discuss.elastic.co/u/ksobon)\ **Replies:** 5\ **Last updated:** [May 5, 2022, 5:25pm UTC](https://discuss.elastic.co/t/logstash-user-permissions/304049 "2022-05-05T17:25:06Z")
I have configured a "logstash" user with the following set of permissions: "{ "indices": \[{ "names": \["\*beat\*"\], "privileges": \["create", "create\_index", "view\_index\_metadata"\] } \] }" That however results in … --- ## [How to change style for kibana widgets](https://discuss.elastic.co/t/how-to-change-style-for-kibana-widgets/303994)
**Author:** [@kashifqazi](https://discuss.elastic.co/u/kashifqazi)\ **Replies:** 1\ **Last updated:** [May 5, 2022, 5:04pm UTC](https://discuss.elastic.co/t/how-to-change-style-for-kibana-widgets/303994 "2022-05-05T17:04:20Z")
How to change style(Like colour font etc) of kibana widgets like pie chart bar chart etc. --- ## [Elasticsearch Query Rule Group By](https://discuss.elastic.co/t/elasticsearch-query-rule-group-by/303314)
**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Replies:** 0\ **Last updated:** [April 26, 2022, 6:03pm UTC](https://discuss.elastic.co/t/elasticsearch-query-rule-group-by/303314 "2022-04-26T18:03:52Z")
Hi All, (Elasticsearch & Kibana 7.17.2) I'm trying to create an Elasticsearch query rule in Kibana observability which group bys a concept. I have the following rule configured: Index: synthetics-\* Size: 100 { "ag… --- ## [Can't query by IDs using logstash-filter-elasticserach](https://discuss.elastic.co/t/cant-query-by-ids-using-logstash-filter-elasticserach/304024)
**Author:** [@Gerard\_Purra](https://discuss.elastic.co/u/Gerard_Purra)\ **Replies:** 1\ **Last updated:** [May 5, 2022, 4:09pm UTC](https://discuss.elastic.co/t/cant-query-by-ids-using-logstash-filter-elasticserach/304024 "2022-05-05T16:09:11Z")
Hey folks, I’m using the logstash-filter-elasticsearch and I’d like to query using IDs (IDs | Elasticsearch Guide \[8.2\] | Elastic), and I find myself unable. Does anyone have any idea on how to work around that? The pr… --- ## [Logstash Input-Path as Index](https://discuss.elastic.co/t/logstash-input-path-as-index/304030)
**Author:** [@Robsen\_Inc](https://discuss.elastic.co/u/Robsen_Inc)\ **Replies:** 1\ **Last updated:** [May 5, 2022, 4:06pm UTC](https://discuss.elastic.co/t/logstash-input-path-as-index/304030 "2022-05-05T16:06:36Z")
Hi Community, I would like to use the Path as an index. The question has been asked many times in different forums, but unfortunately the solutions presented do not work for me. Maybe you can help me. Specifically, I… --- ## [Grok ignore possible extra word/text at end of the line?](https://discuss.elastic.co/t/grok-ignore-possible-extra-word-text-at-end-of-the-line/304026)
**Author:** [@tjswe](https://discuss.elastic.co/u/tjswe)\ **Replies:** 3\ **Last updated:** [May 5, 2022, 4:03pm UTC](https://discuss.elastic.co/t/grok-ignore-possible-extra-word-text-at-end-of-the-line/304026 "2022-05-05T16:03:48Z")
Slightly embarrassed, but i can not find the answer of a what feels like simple question. Data looks like this ABC WORD1 DEF WORD2 GHI WORD3 or ABC WORD1 DEF WORD2 GHI WORD3 (nonimportanttext) This below works with … --- ## [Change Text mapping to Double/Number](https://discuss.elastic.co/t/change-text-mapping-to-double-number/304047)
**Author:** [@AmyMCollins](https://discuss.elastic.co/u/AmyMCollins)\ **Replies:** 1\ **Last updated:** [May 5, 2022, 3:58pm UTC](https://discuss.elastic.co/t/change-text-mapping-to-double-number/304047 "2022-05-05T15:58:03Z")
Hi, I need to change the mapping of a field 'AmountExcVat' from Text to double. I have tried: but I am getting the following error: Can someone help me please? Thanks in advance, Amy --- ## [setCustomContext not showing data after upgrade from 7.9 to 8.1.2](https://discuss.elastic.co/t/setcustomcontext-not-showing-data-after-upgrade-from-7-9-to-8-1-2/304004)
**Author:** [@hertzden](https://discuss.elastic.co/u/hertzden)\ **Replies:** 0\ **Last updated:** [May 5, 2022, 7:56am UTC](https://discuss.elastic.co/t/setcustomcontext-not-showing-data-after-upgrade-from-7-9-to-8-1-2/304004 "2022-05-05T07:56:10Z")
We have setup custom context to fetch session FCP data for all our apps, last month we upgraded elastic version from 7.9 to 8.1.2 on 11th April, 2022. Since that date we are not able to see data in console while running … --- ## [Permission Rules for CSV Export on Basic License](https://discuss.elastic.co/t/permission-rules-for-csv-export-on-basic-license/303979)
**Author:** [@tadgh](https://discuss.elastic.co/u/tadgh)\ **Replies:** 1\ **Last updated:** [May 5, 2022, 3:47pm UTC](https://discuss.elastic.co/t/permission-rules-for-csv-export-on-basic-license/303979 "2022-05-05T15:47:25Z")
Hey there, we run an ECK instance, which runs ES 7.16.2 However recently, users who were previously able to generate CSV reports are no longer able to generate CSV reports. We didn't upgade the stack or anything, just su… --- ## [Use Ingestion Pipeline to split between two indexes](https://discuss.elastic.co/t/use-ingestion-pipeline-to-split-between-two-indexes/303958)
**Author:** [@painless\_elastic](https://discuss.elastic.co/u/painless_elastic)\ **Replies:** 9\ **Last updated:** [May 5, 2022, 3:34pm UTC](https://discuss.elastic.co/t/use-ingestion-pipeline-to-split-between-two-indexes/303958 "2022-05-05T15:34:02Z")
I have documents containing the field "Status", this can have three values "Draft", "In Progress", or "Approved". I am trying to pass this document through a ingest pipeline, and if the status is equal to "Approved" then… --- ## [Packetbeat Version 8.2 file size](https://discuss.elastic.co/t/packetbeat-version-8-2-file-size/304053)
**Author:** [@chinaxushi](https://discuss.elastic.co/u/chinaxushi)\ **Replies:** 0\ **Last updated:** [May 5, 2022, 3:32pm UTC](https://discuss.elastic.co/t/packetbeat-version-8-2-file-size/304053 "2022-05-05T15:32:35Z")
What major changes have been made in version 8.2? The file size has changed from more than 80M in version 8.1.2 to 160M now. --- ## [Rollup job - should and minimum\_should\_match not working](https://discuss.elastic.co/t/rollup-job-should-and-minimum-should-match-not-working/303829)
**Author:** [@hunsw](https://discuss.elastic.co/u/hunsw)\ **Replies:** 5\ **Last updated:** [May 5, 2022, 3:23pm UTC](https://discuss.elastic.co/t/rollup-job-should-and-minimum-should-match-not-working/303829 "2022-05-05T15:23:05Z")
When querying rollup jobs minimum\_should\_match is not working (v7.17) making should clauses useless. Is there a fix/workaround for this? The rollup job limitations page lists compound queries explicitly as allowed ones… --- ## [Using Regex in Kibana Query DSL](https://discuss.elastic.co/t/using-regex-in-kibana-query-dsl/303991)
**Author:** [@CaMaNi](https://discuss.elastic.co/u/CaMaNi)\ **Replies:** 4\ **Last updated:** [May 5, 2022, 3:18pm UTC](https://discuss.elastic.co/t/using-regex-in-kibana-query-dsl/303991 "2022-05-05T15:18:09Z")
Good day everyone, I am relatively new to the use of Kibana. And I have the following problem: I want to filter out all numbers and special characters like "\_" or "-" in a field in Discover mode, so that I only have Le… --- ## [ILM, Fielddata memory error on Warm nodes](https://discuss.elastic.co/t/ilm-fielddata-memory-error-on-warm-nodes/303916)
**Author:** [@benoitp](https://discuss.elastic.co/u/benoitp)\ **Replies:** 3\ **Last updated:** [May 5, 2022, 2:30pm UTC](https://discuss.elastic.co/t/ilm-fielddata-memory-error-on-warm-nodes/303916 "2022-05-05T14:30:06Z")
Hello I'm trying to understand something in the logic of Elasticsearch. Here is my setup : Graylog 4.2 cluster for ingesting logs Connected to an ES 7.10 cluster The Graylog cluster knows the ES Cluster by the Maste… --- ## [Creating processor \[set\_security\_user\] (tag \[null\]) on field \[\_security\] but authentication is not currently enabled](https://discuss.elastic.co/t/creating-processor-set-security-user-tag-null-on-field-security-but-authentication-is-not-currently-enabled/304020)
**Author:** [@elephant](https://discuss.elastic.co/u/elephant)\ **Replies:** 2\ **Last updated:** [May 5, 2022, 2:31pm UTC](https://discuss.elastic.co/t/creating-processor-set-security-user-tag-null-on-field-security-but-authentication-is-not-currently-enabled/304020 "2022-05-05T14:31:54Z")
Hi, I get this WARN in loop in our elastic logs. How can I disable them? We are inside dockers and don't want/need to enable authentication. {"@timestamp":"2022-05-05T10:24:53.093Z", "log.level": "WARN", "message":"Cre… --- ## [Connection to localhost:9200 refused](https://discuss.elastic.co/t/connection-to-localhost-9200-refused/304040)
**Author:** [@Akhil2](https://discuss.elastic.co/u/Akhil2)\ **Replies:** 6\ **Last updated:** [May 5, 2022, 2:28pm UTC](https://discuss.elastic.co/t/connection-to-localhost-9200-refused/304040 "2022-05-05T14:28:10Z")
Hello all, I am running a three node cluster with version 8.0.0. I start Elasticsearch nodes, they start without any errors. but when I load data from Logstash it gives me following errors. \[2022-05-04T14:54:41,780\]\[I… --- ## [Insert time range in TSVB markdown](https://discuss.elastic.co/t/insert-time-range-in-tsvb-markdown/303230)
**Author:** [@Chiaaa](https://discuss.elastic.co/u/Chiaaa)\ **Replies:** 1\ **Last updated:** [May 5, 2022, 2:24pm UTC](https://discuss.elastic.co/t/insert-time-range-in-tsvb-markdown/303230 "2022-05-05T14:24:44Z")
Hi! I want to insert in my markdown text dynamic time range , something like: " This report starting from Apr 18, 00:00:00 to Apr 24, 23:59:59" (Those dates are the result of kql filter on ReportDate field "now-8d/d" … --- ## [Kibana : Download data in form of CSV from Vega widget](https://discuss.elastic.co/t/kibana-download-data-in-form-of-csv-from-vega-widget/303602)
**Author:** [@pranay\_jain](https://discuss.elastic.co/u/pranay_jain)\ **Replies:** 1\ **Last updated:** [May 5, 2022, 2:19pm UTC](https://discuss.elastic.co/t/kibana-download-data-in-form-of-csv-from-vega-widget/303602 "2022-05-05T14:19:54Z")
Hi, I have a dashboard containing a vega chart in the form of table. And our customer would like to download the data from the widget in the form of csv. Is this possible? Below is the Kibana aggregation based data tab… --- ## [Json input](https://discuss.elastic.co/t/json-input/303578)
**Author:** [@rituzza](https://discuss.elastic.co/u/rituzza)\ **Replies:** 1\ **Last updated:** [May 5, 2022, 2:11pm UTC](https://discuss.elastic.co/t/json-input/303578 "2022-05-05T14:11:59Z")
I would like to create a data table analysis in which some Kpi are not related to all documents but only to those that satisfy a certain condition. For example, I want to calculate sum (field1) for documents for which … --- ## [File is not a certificate adding metricbeat issue](https://discuss.elastic.co/t/file-is-not-a-certificate-adding-metricbeat-issue/303951)
**Author:** [@mangeshmj1992](https://discuss.elastic.co/u/mangeshmj1992)\ **Replies:** 2\ **Last updated:** [May 5, 2022, 2:07pm UTC](https://discuss.elastic.co/t/file-is-not-a-certificate-adding-metricbeat-issue/303951 "2022-05-05T14:07:34Z")
Hello team, While starting metricbeat , i am getting below error. D:\\path\\cert.jks; file is not a certificate adding tomcat.yml module: # Module: tomcat # Docs: https://www.elastic.co/guide/en/beats/metricbeat/7.5/… --- ## [Search large amounts of data as quickly as possible](https://discuss.elastic.co/t/search-large-amounts-of-data-as-quickly-as-possible/304021)
**Author:** [@error\_701](https://discuss.elastic.co/u/error_701)\ **Replies:** 1\ **Last updated:** [May 5, 2022, 1:48pm UTC](https://discuss.elastic.co/t/search-large-amounts-of-data-as-quickly-as-possible/304021 "2022-05-05T13:48:05Z")
hey, i think i need ur help: the following use case: Monitor IDS, I receive about 300 million records of IP addresses every day, I need to search them for every single unique IP address as the last entry. (event) My… --- ## [How can i conditionally change the unit of metric values i receive?](https://discuss.elastic.co/t/how-can-i-conditionally-change-the-unit-of-metric-values-i-receive/303576)
**Author:** [@ASHOK\_PRIYADARSHI](https://discuss.elastic.co/u/ASHOK_PRIYADARSHI)\ **Replies:** 1\ **Last updated:** [May 5, 2022, 1:32pm UTC](https://discuss.elastic.co/t/how-can-i-conditionally-change-the-unit-of-metric-values-i-receive/303576 "2022-05-05T13:32:09Z")
How can I change the unit as per my metric path ? [Previous page](https://discuss.elastic.co/latest.md?page=1142) [Next page](https://discuss.elastic.co/latest.md?page=1144)