# Latest **URL:** https://discuss.elastic.co/latest.md?page=1159 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1160 --- ## [Customise Webpack Configs for Kibana (V8) Plugin development](https://discuss.elastic.co/t/customise-webpack-configs-for-kibana-v8-plugin-development/302542)
**Author:** [@artalat](https://discuss.elastic.co/u/artalat)\ **Replies:** 9\ **Last updated:** [April 25, 2022, 1:30pm UTC](https://discuss.elastic.co/t/customise-webpack-configs-for-kibana-v8-plugin-development/302542 "2022-04-25T13:30:27Z")
Hi, I'm developing a custom plugin for Kibana. The requirement is to share some code with React Native/Expo app. For this purpose, I need to customize webpack configs. I found this existing thread here on the topic, but… --- ## [ES Rally - indexing time increasing](https://discuss.elastic.co/t/es-rally-indexing-time-increasing/303136)
**Author:** [@jsu](https://discuss.elastic.co/u/jsu)\ **Replies:** 5\ **Last updated:** [April 25, 2022, 1:19pm UTC](https://discuss.elastic.co/t/es-rally-indexing-time-increasing/303136 "2022-04-25T13:19:02Z")
Hi there, We set up a nightly race on an existing cluster to see the evolution of the cluster's performance. We are deleting existing indices from the previous race, indexing them again - 3, for a total of about 10G - … --- ## [Map Point to Point Custom Color Ramp Lower Limit](https://discuss.elastic.co/t/map-point-to-point-custom-color-ramp-lower-limit/303051)
**Author:** [@stefan.elser](https://discuss.elastic.co/u/stefan.elser)\ **Replies:** 2\ **Last updated:** [April 25, 2022, 1:28pm UTC](https://discuss.elastic.co/t/map-point-to-point-custom-color-ramp-lower-limit/303051 "2022-04-25T13:28:28Z")
Hi, I'm trying to customize a color ramp for my point to point visualization, but can't seem to be able to set the lower limit. The values range from 0 to 2, and are the result of an Average calculation. I want to set 0… --- ## [JMS instrumentation with APM](https://discuss.elastic.co/t/jms-instrumentation-with-apm/303147)
**Author:** [@Raushan](https://discuss.elastic.co/u/Raushan)\ **Replies:** 1\ **Last updated:** [April 25, 2022, 12:58pm UTC](https://discuss.elastic.co/t/jms-instrumentation-with-apm/303147 "2022-04-25T12:58:38Z")
Hi, we are using java apm agent version 1.30.0 with JMS Artemis ActiveMQ Server. Config is CREATE\_ARGUMENTS="${CREATE\_ARGUMENTS} -javaagent /var/lib/artemis-instance/elastic-apm-agent-${ELASTIC\_APM\_AGEN\_VERSION}.jar" C… --- ## [Need to send complete xml file from filebeat to logstash in message field](https://discuss.elastic.co/t/need-to-send-complete-xml-file-from-filebeat-to-logstash-in-message-field/302844)
**Author:** [@Rohit\_Goel1](https://discuss.elastic.co/u/Rohit_Goel1)\ **Replies:** 3\ **Last updated:** [April 25, 2022, 11:55am UTC](https://discuss.elastic.co/t/need-to-send-complete-xml-file-from-filebeat-to-logstash-in-message-field/302844 "2022-04-25T11:55:45Z")
Hi , I am using below filebeat config yaml to send below xml to logstash for filteration. but it is not sending complete xml file. and sometimes the xml being sent is not in correct format and tags are getting closed ea… --- ## [Deprecate and remove Multiple Data Paths](https://discuss.elastic.co/t/deprecate-and-remove-multiple-data-paths/297911)
**Author:** [@st4r.f1sch](https://discuss.elastic.co/u/st4r.f1sch)\ **Replies:** 9\ **Last updated:** [April 25, 2022, 11:05am UTC](https://discuss.elastic.co/t/deprecate-and-remove-multiple-data-paths/297911 "2022-04-25T11:05:25Z")
Hi there, While I don't agree that this should be discussed here, but if that helps ¯\_(ツ)\_/¯ The issue is that Elastic is removing multiple data paths from the configuration that is a big issue when you have a ton of d… --- ## [Filestream input ID without ID might lead to data duplication](https://discuss.elastic.co/t/filestream-input-id-without-id-might-lead-to-data-duplication/302471)
**Author:** [@jean.bissonnette](https://discuss.elastic.co/u/jean.bissonnette)\ **Replies:** 3\ **Last updated:** [April 25, 2022, 10:53am UTC](https://discuss.elastic.co/t/filestream-input-id-without-id-might-lead-to-data-duplication/302471 "2022-04-25T10:53:49Z")
Filebeat 8.1.2 is installed on a windows server with web applications generating log files and using IIS. I have this error when I start filebeat via windows service. {"log.level":"error","@timestamp":"2022-04-14T15:21… --- ## [Audit log fields](https://discuss.elastic.co/t/audit-log-fields/302874)
**Author:** [@anushka1203](https://discuss.elastic.co/u/anushka1203)\ **Replies:** 2\ **Last updated:** [April 25, 2022, 10:46am UTC](https://discuss.elastic.co/t/audit-log-fields/302874 "2022-04-25T10:46:06Z")
Hi, I have a set of audit call events, Example: type=SYSCALL msg=audit(1647800652.003:104): arch=c00000b7 syscall=221 success=yes exit=0 a0=ffff96c3a518 a1=ffffe65a32e8 a2=ffffe65a3c78 a3=8 items=0 ppid=5916 pid=7997 au… --- ## [M365 Defender Logs integration- duplicated alerts from Defender for Endpoint](https://discuss.elastic.co/t/m365-defender-logs-integration-duplicated-alerts-from-defender-for-endpoint/303141)
**Author:** [@misiel](https://discuss.elastic.co/u/misiel)\ **Replies:** 0\ **Last updated:** [April 25, 2022, 9:46am UTC](https://discuss.elastic.co/t/m365-defender-logs-integration-duplicated-alerts-from-defender-for-endpoint/303141 "2022-04-25T09:46:29Z")
Hello! M365 Defender Logs integration is spamming with duplicated Microsft Defender for Endpoint alerts. It retrieves the same alerts every 5 minutes, even when the alerts and incidents are already marked as resoled in… --- ## [Darktrace integration](https://discuss.elastic.co/t/darktrace-integration/303030)
**Author:** [@Pim\_Bos](https://discuss.elastic.co/u/Pim_Bos)\ **Replies:** 1\ **Last updated:** [April 25, 2022, 9:26am UTC](https://discuss.elastic.co/t/darktrace-integration/303030 "2022-04-25T09:26:41Z")
Hi there, Currently I am using splunk for monitoring log. For consolidation reasons we like to migrate this to elastic. I am confident this will work in most cases, but one thing I am not so sure off. Splunk has an gre… --- ## [Fields returned on a certain index are out of scope](https://discuss.elastic.co/t/fields-returned-on-a-certain-index-are-out-of-scope/303133)
**Author:** [@Draken](https://discuss.elastic.co/u/Draken)\ **Replies:** 0\ **Last updated:** [April 25, 2022, 9:03am UTC](https://discuss.elastic.co/t/fields-returned-on-a-certain-index-are-out-of-scope/303133 "2022-04-25T09:03:14Z")
Hello, we are currently working on a monitoring application which utilizes Elasticsearch for data storage, we are working with Elasticsearch 7.17.0 and currently using RestHighLevelClient to interact with it from our app… --- ## [Elastic CORS Problem ....disappear after a refresh](https://discuss.elastic.co/t/elastic-cors-problem-disappear-after-a-refresh/303132)
**Author:** [@Avinash\_123](https://discuss.elastic.co/u/Avinash_123)\ **Replies:** 0\ **Last updated:** [April 25, 2022, 8:48am UTC](https://discuss.elastic.co/t/elastic-cors-problem-disappear-after-a-refresh/303132 "2022-04-25T08:48:24Z")
Hi Team, We have enabled the CORS with below configuration in Elastic cloud environment which we are using for production. http.cors.enabled: true http.cors.allow-origin: /^(https?://).\*?(websitename).\\w+(.\\w+)?$/ ht… --- ## [Export Openshift metrics to an external ELK cluster](https://discuss.elastic.co/t/export-openshift-metrics-to-an-external-elk-cluster/303129)
**Author:** [@yvan.l](https://discuss.elastic.co/u/yvan.l)\ **Replies:** 0\ **Last updated:** [April 25, 2022, 8:20am UTC](https://discuss.elastic.co/t/export-openshift-metrics-to-an-external-elk-cluster/303129 "2022-04-25T08:20:59Z")
Hello We are running multiple Openshift Cluster with version 4.9.x Prometheus is monitoring openshift by default As we have an Internal (not inside openshift) ELK Cluster (7.16.2) We would like to forward metrics fro… --- ## [Trying to make all the fields as Dynamic false](https://discuss.elastic.co/t/trying-to-make-all-the-fields-as-dynamic-false/303117)
**Author:** [@Shaiju\_Sam](https://discuss.elastic.co/u/Shaiju_Sam)\ **Replies:** 1\ **Last updated:** [April 25, 2022, 7:51am UTC](https://discuss.elastic.co/t/trying-to-make-all-the-fields-as-dynamic-false/303117 "2022-04-25T07:51:02Z")
Hi Team, I am getting an error in logstash from an index since the total fields crossed 2000. I am trying to make all the fields as dynamic=false so there wont be additional fields adding up. Can someone pls let me know… --- ## [Resource management with Ingest and Transform](https://discuss.elastic.co/t/resource-management-with-ingest-and-transform/302239)
**Author:** [@bianca6](https://discuss.elastic.co/u/bianca6)\ **Replies:** 7\ **Last updated:** [April 25, 2022, 7:23am UTC](https://discuss.elastic.co/t/resource-management-with-ingest-and-transform/302239 "2022-04-25T07:23:13Z")
Hi, I currently have a running pipeline like this: Filebeat -\> Logstash -\> Elasticsearch \> Elasticsearch Transform I'm trying to process 10GB of logs. The data ingestion (Logstash -\> Elasticsearch) takes 30 mins, use… --- ## [Grok Match but not include](https://discuss.elastic.co/t/grok-match-but-not-include/303046)
**Author:** [@sukur55](https://discuss.elastic.co/u/sukur55)\ **Replies:** 2\ **Last updated:** [April 25, 2022, 6:42am UTC](https://discuss.elastic.co/t/grok-match-but-not-include/303046 "2022-04-25T06:42:27Z")
Hello, I am trying to parse a custom date&time field like: date=2022-04-22 time=09:38:04, currently I have filter like: (?\%{YEAR}-%{MONTHNUM}-%{MONTHDAY} time=%{TIME}) and result of timestamp is: 2022-04… --- ## [Two Transform jobs overwrite result doc ID of each other (duplicate \_id)](https://discuss.elastic.co/t/two-transform-jobs-overwrite-result-doc-id-of-each-other-duplicate-id/303064)
**Author:** [@goldsky](https://discuss.elastic.co/u/goldsky)\ **Replies:** 1\ **Last updated:** [April 25, 2022, 6:14am UTC](https://discuss.elastic.co/t/two-transform-jobs-overwrite-result-doc-id-of-each-other-duplicate-id/303064 "2022-04-25T06:14:10Z")
Hello, during my journey with migration of existing, "home-made" transformations to Transform API (continuous mode), I faced one minor issue - ability to add static fields into result documents, on the beginning I tried… --- ## [Filebeat: docker autodiscover problem](https://discuss.elastic.co/t/filebeat-docker-autodiscover-problem/301452)
**Author:** [@111207](https://discuss.elastic.co/u/111207)\ **Replies:** 3\ **Last updated:** [April 25, 2022, 6:08am UTC](https://discuss.elastic.co/t/filebeat-docker-autodiscover-problem/301452 "2022-04-25T06:08:05Z")
I need to using filebeat auto discover to input the docker container log My container log name pantsel/konga This is my config in filebeat.yml #==============Using Autodiscover======================= filebeat.autodisc… --- ## [Logstash SNMP Input 분리 관련 문의](https://discuss.elastic.co/t/logstash-snmp-input/303113)
**Author:** [@inwoo1](https://discuss.elastic.co/u/inwoo1)\ **Replies:** 0\ **Last updated:** [April 25, 2022, 5:44am UTC](https://discuss.elastic.co/t/logstash-snmp-input/303113 "2022-04-25T05:44:04Z")
안녕하세요~! 고수님들의 고견을 기다려봅니다. snmp 수신을 받고 있는데, 한개의 설정 파일에서 snmp를 두개 따로 설정하는게 혹시 가능한가요? 예를 들면 아래와 같이 설정하는게 가능한지 궁금합니다. --- ## [How to persist data after logstash pod restart?](https://discuss.elastic.co/t/how-to-persist-data-after-logstash-pod-restart/303108)
**Author:** [@amruth](https://discuss.elastic.co/u/amruth)\ **Replies:** 0\ **Last updated:** [April 25, 2022, 1:35am UTC](https://discuss.elastic.co/t/how-to-persist-data-after-logstash-pod-restart/303108 "2022-04-25T01:35:27Z")
Hello All, I am using Logstash helm chart. I want to persist a file after logstash pod restart. For that I can see an option persistence: enabled: true But there is no much documentation on it on how to pass variabl… --- ## [데이터가 있지만 대시보드에 보여지지 않습니다](https://discuss.elastic.co/t/topic/302168)
**Author:** [@inwoo1](https://discuss.elastic.co/u/inwoo1)\ **Replies:** 4\ **Last updated:** [April 25, 2022, 1:20am UTC](https://discuss.elastic.co/t/topic/302168 "2022-04-25T01:20:47Z")
안녕하세요~ 고수님들의 고견을 기다립니다 데이터가 존재하지만 대시보드에 표시되지 않는 현상이 매우 빈번하게 발생합니다. 왜 이런 현상이 발생하는 것인가요?? 제가 뭐 설정을 잘못한걸까요? 혹시 아시는 분 계실까요? --- ## [Logstash Kafka SASL\_PLAIN input plugin config](https://discuss.elastic.co/t/logstash-kafka-sasl-plain-input-plugin-config/303107)
**Author:** [@Prateek\_Tiwari](https://discuss.elastic.co/u/Prateek_Tiwari)\ **Replies:** 0\ **Last updated:** [April 24, 2022, 10:04pm UTC](https://discuss.elastic.co/t/logstash-kafka-sasl-plain-input-plugin-config/303107 "2022-04-24T22:04:49Z")
Hi, I have been trying to connect logstash to my remote kafka instance, which has SASL\_PLAIN authentication method, but still not able establish the connection and getting the following error : org.apache.kafka.clients… --- ## [DSL query not working post upgrade](https://discuss.elastic.co/t/dsl-query-not-working-post-upgrade/303095)
**Author:** [@Ankit\_Chauhan1](https://discuss.elastic.co/u/Ankit_Chauhan1)\ **Replies:** 3\ **Last updated:** [April 24, 2022, 6:55pm UTC](https://discuss.elastic.co/t/dsl-query-not-working-post-upgrade/303095 "2022-04-24T18:55:08Z")
Earlier below query was working well in the DSL query mode. but the same has stopped working post elastic upgrade to 7.17.1 {"query":{"bool":{"must":\[{"match":{"eT.keyword":"TRANSFER"}},{"nested": {"path": "actions","qu… --- ## [Issue with PVC in ECK](https://discuss.elastic.co/t/issue-with-pvc-in-eck/301071)
**Author:** [@Nids\_Rai](https://discuss.elastic.co/u/Nids_Rai)\ **Replies:** 2\ **Last updated:** [April 24, 2022, 4:58pm UTC](https://discuss.elastic.co/t/issue-with-pvc-in-eck/301071 "2022-04-24T16:58:47Z")
Trying to setup elastic cluster using ECK documentation, but it fails and stays in Pending state kubectl get pvc -n staging NAME STATUS VOLUME CAPACITY ACCESS MODES STORA… --- ## [Logstash-CIDR Plugin](https://discuss.elastic.co/t/logstash-cidr-plugin/301990)
**Author:** [@leela](https://discuss.elastic.co/u/leela)\ **Replies:** 12\ **Last updated:** [April 24, 2022, 4:57pm UTC](https://discuss.elastic.co/t/logstash-cidr-plugin/301990 "2022-04-24T16:57:31Z")
How can we pass multiple IP's and Location names in Logstash config file with CIDR plugin for Source and Destination --- ## [Tuning ranking in search result](https://discuss.elastic.co/t/tuning-ranking-in-search-result/303097)
**Author:** [@kentoto](https://discuss.elastic.co/u/kentoto)\ **Replies:** 1\ **Last updated:** [April 24, 2022, 1:12pm UTC](https://discuss.elastic.co/t/tuning-ranking-in-search-result/303097 "2022-04-24T13:12:00Z")
doc1 = {"id":1,"text":"tonight"} doc2 = {"id":2,"text":"tonight tonight"} doc3 = {"id":3,"text":"tonight tonight tonight"} doc4 = {"id":4,"text":"tonight and something else"} doc5 = {"id":5,"text":"tonight and you"} es.… --- ## [How to solve index millions of files content with scalable approach?](https://discuss.elastic.co/t/how-to-solve-index-millions-of-files-content-with-scalable-approach/303084)
**Author:** [@sushilprj](https://discuss.elastic.co/u/sushilprj)\ **Replies:** 5\ **Last updated:** [April 24, 2022, 11:49am UTC](https://discuss.elastic.co/t/how-to-solve-index-millions-of-files-content-with-scalable-approach/303084 "2022-04-24T11:49:02Z")
I am working with an application that requires indexing thousands of files' content to make the content searchable. I use tika to extract the file content and then index it to Elasticsearch. I also tried to ingest pipeli… --- ## [What is the correct workflow for standalone elastic agent on docker swarm?](https://discuss.elastic.co/t/what-is-the-correct-workflow-for-standalone-elastic-agent-on-docker-swarm/303093)
**Author:** [@UchihaYuki](https://discuss.elastic.co/u/UchihaYuki)\ **Replies:** 0\ **Last updated:** [April 24, 2022, 10:08am UTC](https://discuss.elastic.co/t/what-is-the-correct-workflow-for-standalone-elastic-agent-on-docker-swarm/303093 "2022-04-24T10:08:51Z")
I don't use fleet server, because I hope everything is up and running in production environment just as what I have configured in development environment. I don't think fleet server can do this. It seems I have to config… --- ## [When the output target stops for a period of time and then resumes, filebeat is in a blocking state](https://discuss.elastic.co/t/when-the-output-target-stops-for-a-period-of-time-and-then-resumes-filebeat-is-in-a-blocking-state/303086)
**Author:** [@lhb6540](https://discuss.elastic.co/u/lhb6540)\ **Replies:** 0\ **Last updated:** [April 24, 2022, 7:51am UTC](https://discuss.elastic.co/t/when-the-output-target-stops-for-a-period-of-time-and-then-resumes-filebeat-is-in-a-blocking-state/303086 "2022-04-24T07:51:34Z")
version: 7.16 os: centos 7.6 install: rpm Steps to Reproduce: When the input of filebeat is an http endpoint, and the output is configured as a logstash. filebeat has a large qps, such as 60/s, you can use a script … --- ## [Autodiscover not working on docker swarm](https://discuss.elastic.co/t/autodiscover-not-working-on-docker-swarm/303082)
**Author:** [@UchihaYuki](https://discuss.elastic.co/u/UchihaYuki)\ **Replies:** 0\ **Last updated:** [April 24, 2022, 6:09am UTC](https://discuss.elastic.co/t/autodiscover-not-working-on-docker-swarm/303082 "2022-04-24T06:09:26Z")
If I config directly in metricbeat.yml: - module: traefik metricsets: - health hosts: \["http://traefik:8080"\] period: 10s enabled: true It will work. But If I use autodiscover, by configuring m… [Previous page](https://discuss.elastic.co/latest.md?page=1158) [Next page](https://discuss.elastic.co/latest.md?page=1160)