# Latest **URL:** https://discuss.elastic.co/latest.md?page=1161 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1162 --- ## [Office 365 filebeat error](https://discuss.elastic.co/t/office-365-filebeat-error/303026)
**Author:** [@ima](https://discuss.elastic.co/u/ima)\ **Replies:** 0\ **Last updated:** [April 22, 2022, 11:58am UTC](https://discuss.elastic.co/t/office-365-filebeat-error/303026 "2022-04-22T11:58:40Z")
Hello, we want to integrate office 365 with filebeat, we have activated the module and filled the config file as shown audit: enabled: true var.application\_id: "\*\*\*\*\* " var.tenants: \*\*- id: "" name: " .onmicrosoft.… --- ## [Ingest data to Elastic Security using third-party collectors configured to ship ECS-compliant data](https://discuss.elastic.co/t/ingest-data-to-elastic-security-using-third-party-collectors-configured-to-ship-ecs-compliant-data/303023)
**Author:** [@msilva](https://discuss.elastic.co/u/msilva)\ **Replies:** 0\ **Last updated:** [April 22, 2022, 11:25am UTC](https://discuss.elastic.co/t/ingest-data-to-elastic-security-using-third-party-collectors-configured-to-ship-ecs-compliant-data/303023 "2022-04-22T11:25:20Z")
Hi, In Ingest data to Elastic Security | Elastic Security Solution \[8.1\] | Elastic, it is mentioned that data can be ingested to Elastic Security using third-party collectors configured to ship ECS-compliant data. What… --- ## [Logstash to elasticsearch ssl connection issue](https://discuss.elastic.co/t/logstash-to-elasticsearch-ssl-connection-issue/302842)
**Author:** [@fabek.75](https://discuss.elastic.co/u/fabek.75)\ **Replies:** 1\ **Last updated:** [April 22, 2022, 8:56am UTC](https://discuss.elastic.co/t/logstash-to-elasticsearch-ssl-connection-issue/302842 "2022-04-22T08:56:33Z")
Hi, I have setup an on-prem dev environment with Elasticsearch 8.x and from a client I'm trying to push some data through a Logstash pipeline (version is 8.1.2-1). It seems, however, Logstash wants absolutely that some … --- ## [EQL sequence performance issue](https://discuss.elastic.co/t/eql-sequence-performance-issue/300601)
**Author:** [@eufe](https://discuss.elastic.co/u/eufe)\ **Replies:** 3\ **Last updated:** [April 22, 2022, 9:16am UTC](https://discuss.elastic.co/t/eql-sequence-performance-issue/300601 "2022-04-22T09:16:35Z")
Environnement : V7.16.2 JVM : 31g (one node) RAM : 64G Hello, I'm trying to use EQL to detect some changes on a specific field. A concrete usecase would be to detect a regression on the administrative protocol on a… --- ## [Elastic-agent in docker - host metadata](https://discuss.elastic.co/t/elastic-agent-in-docker-host-metadata/303000)
**Author:** [@mkf1](https://discuss.elastic.co/u/mkf1)\ **Replies:** 0\ **Last updated:** [April 22, 2022, 9:04am UTC](https://discuss.elastic.co/t/elastic-agent-in-docker-host-metadata/303000 "2022-04-22T09:04:21Z")
Hi, When using elastic-agent in Docker is it possible to override/manually set the host metadata (host.ip, host.mac etc..) to the actual host? When elastic-agent is in a container it select the container ip and containe… --- ## [How to update fields in nested document without script](https://discuss.elastic.co/t/how-to-update-fields-in-nested-document-without-script/302999)
**Author:** [@martin\_wun](https://discuss.elastic.co/u/martin_wun)\ **Replies:** 0\ **Last updated:** [April 22, 2022, 9:00am UTC](https://discuss.elastic.co/t/how-to-update-fields-in-nested-document-without-script/302999 "2022-04-22T09:00:18Z")
Hi all, Is there a way to update an individual field in a nested document without having to use a script? I have found some answers here, but they all use a painless script in some form. E.g.: For example, say I have… --- ## [Indicator matching Rules](https://discuss.elastic.co/t/indicator-matching-rules/302346)
**Author:** [@shinobu](https://discuss.elastic.co/u/shinobu)\ **Replies:** 2\ **Last updated:** [April 22, 2022, 8:46am UTC](https://discuss.elastic.co/t/indicator-matching-rules/302346 "2022-04-22T08:46:11Z")
Hello, I recently configured an Indicator Matching Rule that creates alarms if any indicator is found. The issue with this is that the indicator are matched partially. For instance if I have the indicator something.q77.… --- ## [Randomly xml tags are not showing in the elasticsearch 7.14](https://discuss.elastic.co/t/randomly-xml-tags-are-not-showing-in-the-elasticsearch-7-14/302994)
**Author:** [@Lakshani\_Gamage](https://discuss.elastic.co/u/Lakshani_Gamage)\ **Replies:** 0\ **Last updated:** [April 22, 2022, 8:06am UTC](https://discuss.elastic.co/t/randomly-xml-tags-are-not-showing-in-the-elasticsearch-7-14/302994 "2022-04-22T08:06:23Z")
I'm using Elasticsearch 7.14. When I check the JSON format of a message in the Elasticsearch, I can see below. "agent": { "ephemeral\_id": "2a4c1cb3-b7d6-4a1b-b244-0e669f1d7686", "type": "filebeat", "id": "3dfa6feb… --- ## [Read only searches for other users](https://discuss.elastic.co/t/read-only-searches-for-other-users/302928)
**Author:** [@afuente](https://discuss.elastic.co/u/afuente)\ **Replies:** 4\ **Last updated:** [April 22, 2022, 8:34am UTC](https://discuss.elastic.co/t/read-only-searches-for-other-users/302928 "2022-04-22T08:34:59Z")
Hello, everybody!! Does anybody know if it is possible to lock a saved search, a visualization, etc., for other users to be able to see the results but not change the filters and overwrite it? We are a lot of people us… --- ## [How to check logs were sending to elasticsearch](https://discuss.elastic.co/t/how-to-check-logs-were-sending-to-elasticsearch/302799)
**Author:** [@Hoa\_Nguy\_n\_Van](https://discuss.elastic.co/u/Hoa_Nguy_n_Van)\ **Replies:** 11\ **Last updated:** [April 22, 2022, 8:31am UTC](https://discuss.elastic.co/t/how-to-check-logs-were-sending-to-elasticsearch/302799 "2022-04-22T08:31:28Z")
I deployment my EFK stack on version 7.4.0. When deploying filebeat, logs from filebeat do not send to Elasticsearch. My configuration Filebeat on k8s: Logs from Filebeat: Help me for this issue. Thanks ! … --- ## [Winlogbeat message not parsed](https://discuss.elastic.co/t/winlogbeat-message-not-parsed/302979)
**Author:** [@Elie\_Sbat](https://discuss.elastic.co/u/Elie_Sbat)\ **Replies:** 7\ **Last updated:** [April 22, 2022, 8:25am UTC](https://discuss.elastic.co/t/winlogbeat-message-not-parsed/302979 "2022-04-22T08:25:03Z")
Hello, I am using elasticstack v8. The messages are sent from winlogbeat -\> kafka - \> logstash -\> elastic. The message is arrived unparsed. Logstash config: input { kafka{ bootstrap\_servers =\> … --- ## [Elasticsearch 7.16.2 failed to start when switching from Java 8 to Java 11](https://discuss.elastic.co/t/elasticsearch-7-16-2-failed-to-start-when-switching-from-java-8-to-java-11/301404)
**Author:** [@dzyubanv](https://discuss.elastic.co/u/dzyubanv)\ **Replies:** 9\ **Last updated:** [April 22, 2022, 8:16am UTC](https://discuss.elastic.co/t/elasticsearch-7-16-2-failed-to-start-when-switching-from-java-8-to-java-11/301404 "2022-04-22T08:16:03Z")
I'm testing Elasticsearch (ES) single node cluster with Java 8 and Java 11 Java 8 and Java 11 are installed on Linux server RHEL release 7.9 in directories: /usr/java/jdk1.8.0\_281-amd64 includes subdirectories bin, inc… --- ## [How can I use kerberos under python elasticsearch?](https://discuss.elastic.co/t/how-can-i-use-kerberos-under-python-elasticsearch/302981)
**Author:** [@papi1992](https://discuss.elastic.co/u/papi1992)\ **Replies:** 1\ **Last updated:** [April 22, 2022, 8:06am UTC](https://discuss.elastic.co/t/how-can-i-use-kerberos-under-python-elasticsearch/302981 "2022-04-22T08:06:35Z")
I checked the documentation of elasticsearch:7.x but still didn't find the way how I can force the python ES package to use my kerberos token. I can reach the ES through a browser, curl ( curl --negotiate -u ) and reque… --- ## [Compound score computation details](https://discuss.elastic.co/t/compound-score-computation-details/302940)
**Author:** [@med\_rgn](https://discuss.elastic.co/u/med_rgn)\ **Replies:** 0\ **Last updated:** [April 21, 2022, 3:48pm UTC](https://discuss.elastic.co/t/compound-score-computation-details/302940 "2022-04-21T15:48:25Z")
Hello context In my use case I rank documents regarding an input request relying on a compound score used for the ranking. This compound score is a weighted sum of 3 text similarity scores as follow: score = weight1 \*… --- ## [Harvest only till last but one line?](https://discuss.elastic.co/t/harvest-only-till-last-but-one-line/302988)
**Author:** [@gbml](https://discuss.elastic.co/u/gbml)\ **Replies:** 0\ **Last updated:** [April 22, 2022, 7:15am UTC](https://discuss.elastic.co/t/harvest-only-till-last-but-one-line/302988 "2022-04-22T07:15:59Z")
Hello. Im trying to ship logs via filebeat 8.1.2 I have an app that generate text log, but in strange manner: After first event log file look like this: Line 1\\n (space\_symgol\_1)(space\_symgol\_2)...(space\_symgol\_1\_000… --- ## [FIlebeat\[8.1.2\] - Juniper module not able to Setup pipeline](https://discuss.elastic.co/t/filebeat-8-1-2-juniper-module-not-able-to-setup-pipeline/302986)
**Author:** [@Azeem\_Ismail](https://discuss.elastic.co/u/Azeem_Ismail)\ **Replies:** 0\ **Last updated:** [April 22, 2022, 6:54am UTC](https://discuss.elastic.co/t/filebeat-8-1-2-juniper-module-not-able-to-setup-pipeline/302986 "2022-04-22T06:54:07Z")
Hello, After installing filebeat 8.1.3 as an upgrade, Juniper module is not able to setup pipelines. The error received was "Exiting: module juniper is configured but has no enabled filesets" The command ran to setup … --- ## [Grok Parsing for multiple patterns in single log file](https://discuss.elastic.co/t/grok-parsing-for-multiple-patterns-in-single-log-file/302948)
**Author:** [@venkatkumar229](https://discuss.elastic.co/u/venkatkumar229)\ **Replies:** 2\ **Last updated:** [April 22, 2022, 5:18am UTC](https://discuss.elastic.co/t/grok-parsing-for-multiple-patterns-in-single-log-file/302948 "2022-04-22T05:18:15Z")
Hi Everyone, I am writing a grok pattern to parse a log file where i have two types of log lines. 2022-04-13 06:38:24.472 DBG Microsoft.AspNet.server --- Connection Id "Xxxxxxxx" accepted 2022-04-13 06:38:19.330 d… --- ## [Redis: Error fetching data for metricset i/o timeout error](https://discuss.elastic.co/t/redis-error-fetching-data-for-metricset-i-o-timeout-error/302813)
**Author:** [@Duane\_DSouza](https://discuss.elastic.co/u/Duane_DSouza)\ **Replies:** 2\ **Last updated:** [April 21, 2022, 2:49pm UTC](https://discuss.elastic.co/t/redis-error-fetching-data-for-metricset-i-o-timeout-error/302813 "2022-04-21T14:49:49Z")
Hi , I am trying to use metricbeat (version 8.1.2) module for Redis. Redis cluster is managed app.redislabs.com Also tried with Redis service for the Google Cloud Platform. Here is config: metricsets: \["info", "ke… --- ## [S3 input: Unable to list objects. Access Denied](https://discuss.elastic.co/t/s3-input-unable-to-list-objects-access-denied/302380)
**Author:** [@elker](https://discuss.elastic.co/u/elker)\ **Replies:** 1\ **Last updated:** [April 22, 2022, 3:01am UTC](https://discuss.elastic.co/t/s3-input-unable-to-list-objects-access-denied/302380 "2022-04-22T03:01:00Z")
I am using the s3 input plugin to use assume a role using an aws\_access\_key/secret key and read from a bucket using a date based key. The Logstash role allows AssumeRole, and the bucket allows the role to ListBucket an… --- ## [Unexpected result from Synonym Filter if Char Filter is also used](https://discuss.elastic.co/t/unexpected-result-from-synonym-filter-if-char-filter-is-also-used/302896)
**Author:** [@Patrick\_N](https://discuss.elastic.co/u/Patrick_N)\ **Replies:** 0\ **Last updated:** [April 21, 2022, 10:29am UTC](https://discuss.elastic.co/t/unexpected-result-from-synonym-filter-if-char-filter-is-also-used/302896 "2022-04-21T10:29:18Z")
I have a field which uses both a char filter (it converts Chinese words to some separator text) and a synonym filter. PUT test { "mappings": { "properties": { "description": { "an… --- ## [How to attach Index Lifecycle Policy to indices created by Logstash?](https://discuss.elastic.co/t/how-to-attach-index-lifecycle-policy-to-indices-created-by-logstash/301657)
**Author:** [@pritster5](https://discuss.elastic.co/u/pritster5)\ **Replies:** 5\ **Last updated:** [April 21, 2022, 9:40pm UTC](https://discuss.elastic.co/t/how-to-attach-index-lifecycle-policy-to-indices-created-by-logstash/301657 "2022-04-21T21:40:05Z")
I have a Logstash Config file that looks like this: input { s3 { bucket =\> "testbucket" region =\> "us-east-1" codec =\> "json" additional\_settings =\> { force\_path\_style =\> … --- ## [Why contexts?](https://discuss.elastic.co/t/why-contexts/302957)
**Author:** [@aleding](https://discuss.elastic.co/u/aleding)\ **Replies:** 7\ **Last updated:** [April 21, 2022, 8:32pm UTC](https://discuss.elastic.co/t/why-contexts/302957 "2022-04-21T20:32:42Z")
In debugging a Filebeat module, I have had to dig into Painless scripts & contexts which has led to several questions: Why contexts? Can the same data not be accessed via \_doc? (I've also seen this asked in other … --- ## [Multiple hostname (DNS) output for beats?](https://discuss.elastic.co/t/multiple-hostname-dns-output-for-beats/302964)
**Author:** [@parthmaniar](https://discuss.elastic.co/u/parthmaniar)\ **Replies:** 0\ **Last updated:** [April 21, 2022, 8:00pm UTC](https://discuss.elastic.co/t/multiple-hostname-dns-output-for-beats/302964 "2022-04-21T20:00:53Z")
Hello, Is it possible to use multiple FQDN's as part of output to logstash via beats? My usecase: I want to send a publically routable logging destination - logging.maniarfamily.com which will resolve to a public IP … --- ## [Failed to install kibana 7.17.2 on Amazon Linux 2](https://discuss.elastic.co/t/failed-to-install-kibana-7-17-2-on-amazon-linux-2/302945)
**Author:** [@chrisbra](https://discuss.elastic.co/u/chrisbra)\ **Replies:** 2\ **Last updated:** [April 21, 2022, 7:21pm UTC](https://discuss.elastic.co/t/failed-to-install-kibana-7-17-2-on-amazon-linux-2/302945 "2022-04-21T19:21:09Z")
I I downloaded kibana 7.17.2 as rpm package. Unfortunately, when trying to run it, it fails with those errors: ~ $ sudo /usr/share/kibana/bin/kibana /usr/share/kibana/bin/../node/bin/node: /lib/libstdc++.so.6: version … --- ## [Custom Plugin: Grab user context](https://discuss.elastic.co/t/custom-plugin-grab-user-context/302949)
**Author:** [@Gustavo\_Llermaly](https://discuss.elastic.co/u/Gustavo_Llermaly)\ **Replies:** 2\ **Last updated:** [April 21, 2022, 6:23pm UTC](https://discuss.elastic.co/t/custom-plugin-grab-user-context/302949 "2022-04-21T18:23:30Z")
Hello there, I need to build an action that sends to a custom API user context information like username and user roles. Is there a service that provides this data like the one that provides search state? thanks! --- ## [Bash Script – Remove Indices from x Days Ago](https://discuss.elastic.co/t/bash-script-remove-indices-from-x-days-ago/302925)
**Author:** [@Shanu\_Modi](https://discuss.elastic.co/u/Shanu_Modi)\ **Replies:** 3\ **Last updated:** [April 21, 2022, 5:57pm UTC](https://discuss.elastic.co/t/bash-script-remove-indices-from-x-days-ago/302925 "2022-04-21T17:57:42Z")
Hi please help or suggest any solution. My cluster is running over pod on eks --- ## [Value in Legend \[Pie Chart\]](https://discuss.elastic.co/t/value-in-legend-pie-chart/302934)
**Author:** [@Bo-Wyatt](https://discuss.elastic.co/u/Bo-Wyatt)\ **Replies:** 1\ **Last updated:** [April 21, 2022, 5:01pm UTC](https://discuss.elastic.co/t/value-in-legend-pie-chart/302934 "2022-04-21T17:01:52Z")
Hello, I want to display the metric of each value in the legend. For example in the photo, show my metric on the right side the value, next to the three dots. --- ## [Logstash fail to rewrite json files](https://discuss.elastic.co/t/logstash-fail-to-rewrite-json-files/302942)
**Author:** [@Math](https://discuss.elastic.co/u/Math)\ **Replies:** 1\ **Last updated:** [April 21, 2022, 4:41pm UTC](https://discuss.elastic.co/t/logstash-fail-to-rewrite-json-files/302942 "2022-04-21T16:41:16Z")
Hi, I want to send json files with filebeat to logstash and then logstash rewrite these json files locally. Filebeat version: 8.1.2 Logstash version: 8.1.2 There is my filebeat conf: filebeat.inputs: - type: filest… --- ## [Logstash is not reading some files from filebeat](https://discuss.elastic.co/t/logstash-is-not-reading-some-files-from-filebeat/302570)
**Author:** [@Rohini\_Gadge28](https://discuss.elastic.co/u/Rohini_Gadge28)\ **Replies:** 5\ **Last updated:** [April 21, 2022, 4:38pm UTC](https://discuss.elastic.co/t/logstash-is-not-reading-some-files-from-filebeat/302570 "2022-04-21T16:38:35Z")
There is data in a folder which is read by filebeat and forwarded to Logstash . So we write to logs file everyday and based on date multiple files(eg. : 2022-03-29-1.log , 2022-03-30-1.log, etc) get created. But somehow… --- ## [Deploy ElasticSearch on AWS EKS](https://discuss.elastic.co/t/deploy-elasticsearch-on-aws-eks/302856)
**Author:** [@zxuz111](https://discuss.elastic.co/u/zxuz111)\ **Replies:** 2\ **Last updated:** [April 21, 2022, 4:29pm UTC](https://discuss.elastic.co/t/deploy-elasticsearch-on-aws-eks/302856 "2022-04-21T16:29:31Z")
We are planning to use Amazon OpenSearch Service, but it doesn't work with FS Crawler, so we are considering the solution of deploying Elasticsearch on AWS EKS, and then we found the Elastic Cloud on Kubernetes (ECK). Co… [Previous page](https://discuss.elastic.co/latest.md?page=1160) [Next page](https://discuss.elastic.co/latest.md?page=1162)