# Latest **URL:** https://discuss.elastic.co/latest.md?page=1170 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1171 --- ## [Spring4Shell ::Spring Framework Remote Code Execution Vulnerability for eck operator](https://discuss.elastic.co/t/spring4shell-spring-framework-remote-code-execution-vulnerability-for-eck-operator/302455)
**Author:** [@Sagarika\_Mahalik](https://discuss.elastic.co/u/Sagarika_Mahalik)\ **Replies:** 0\ **Last updated:** [April 14, 2022, 4:31pm UTC](https://discuss.elastic.co/t/spring4shell-spring-framework-remote-code-execution-vulnerability-for-eck-operator/302455 "2022-04-14T16:31:48Z")
Hello, We are using eck operator 1.9.1. I see the code for eck operator is written on go lang. So then is eck operator not affected any way by the reported spring shell vulnerability? Please suggest, whether we need t… --- ## [Any way to have Custom Fields for Environment Variables within Metrics Inventory using Elastic Agent](https://discuss.elastic.co/t/any-way-to-have-custom-fields-for-environment-variables-within-metrics-inventory-using-elastic-agent/302466)
**Author:** [@jtocher](https://discuss.elastic.co/u/jtocher)\ **Replies:** 0\ **Last updated:** [April 14, 2022, 6:26pm UTC](https://discuss.elastic.co/t/any-way-to-have-custom-fields-for-environment-variables-within-metrics-inventory-using-elastic-agent/302466 "2022-04-14T18:26:53Z")
We've deployed Elastic Agent across our organization, and use the 'system' integration to grab system metrics from every VM. We view this in the Metrics App in Kibana. We have different environments - Development, Regre… --- ## [VPN Connection Alerts](https://discuss.elastic.co/t/vpn-connection-alerts/302457)
**Author:** [@rwilson](https://discuss.elastic.co/u/rwilson)\ **Replies:** 1\ **Last updated:** [April 14, 2022, 5:31pm UTC](https://discuss.elastic.co/t/vpn-connection-alerts/302457 "2022-04-14T17:31:10Z")
Good morning, I am trying to configure an alert to email admins whenever there is a new user connecting to a VPN. I am fairly new to the Elastic platform and need some assistance in creating these alerts. The only pre… --- ## [Kibana server is not ready yet, unavailable\_shards\_exception](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet-unavailable-shards-exception/302459)
**Author:** [@Dave\_G](https://discuss.elastic.co/u/Dave_G)\ **Replies:** 1\ **Last updated:** [April 14, 2022, 5:24pm UTC](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet-unavailable-shards-exception/302459 "2022-04-14T17:24:58Z")
We have a four-node Elasticsearch cluster running ES 7.16.2 and Kibana 7.16.2. Since the last upgrade, our Kibana page is showing Kibana server is not ready yet The Kibana log shows this error repeated numerous times: … --- ## [v8.X Docker image does not accept bin/elasticsearch env variables](https://discuss.elastic.co/t/v8-x-docker-image-does-not-accept-bin-elasticsearch-env-variables/302446)
**Author:** [@violetaria](https://discuss.elastic.co/u/violetaria)\ **Replies:** 2\ **Last updated:** [April 14, 2022, 4:56pm UTC](https://discuss.elastic.co/t/v8-x-docker-image-does-not-accept-bin-elasticsearch-env-variables/302446 "2022-04-14T16:56:31Z")
Using the existing docker image does not accept positional arguments for Elasticsearch environment variables correctly. The documentation states that we should be able to pass the arguments in with this command docker … --- ## [Not fetching Data streams](https://discuss.elastic.co/t/not-fetching-data-streams/302448)
**Author:** [@spo](https://discuss.elastic.co/u/spo)\ **Replies:** 1\ **Last updated:** [April 14, 2022, 3:46pm UTC](https://discuss.elastic.co/t/not-fetching-data-streams/302448 "2022-04-14T15:46:24Z")
Hi I have a fleet server , status : healthy. I have added AWS and IIS integrations to the agent policy( Default Fleet Server policy) of the fleet server but I do not see any logs pulling in the data stream pane from th… --- ## [Cannot log into Kibana using the standard UN and PW](https://discuss.elastic.co/t/cannot-log-into-kibana-using-the-standard-un-and-pw/302440)
**Author:** [@ella.parker](https://discuss.elastic.co/u/ella.parker)\ **Replies:** 3\ **Last updated:** [April 14, 2022, 3:00pm UTC](https://discuss.elastic.co/t/cannot-log-into-kibana-using-the-standard-un-and-pw/302440 "2022-04-14T15:00:01Z")
I have tried accessing Kibana using both my "Elastic Training" e-mail and password. I was then advised to use the standard log in ("training" username and password). I still cannot access Kibana. Any help would be apprec… --- ## [Fleet-server failed: context canceled](https://discuss.elastic.co/t/fleet-server-failed-context-canceled/302348)
**Author:** [@spo](https://discuss.elastic.co/u/spo)\ **Replies:** 2\ **Last updated:** [April 14, 2022, 3:00pm UTC](https://discuss.elastic.co/t/fleet-server-failed-context-canceled/302348 "2022-04-14T15:00:01Z")
Hi Having trouble enrolling fleet server Elasticsearch kibana and elastic agent versions 7.17.2 command I used is .\\elastic-agent.exe install --url=https://fleet server ip:8220 --fleet-server-es=https://elasticsearch… --- ## [Extracting data between two phrases with GROK](https://discuss.elastic.co/t/extracting-data-between-two-phrases-with-grok/302269)
**Author:** [@ARDiver86](https://discuss.elastic.co/u/ARDiver86)\ **Replies:** 3\ **Last updated:** [April 14, 2022, 2:31pm UTC](https://discuss.elastic.co/t/extracting-data-between-two-phrases-with-grok/302269 "2022-04-14T14:31:27Z")
I'm trying to extract a powershell signature block from powershell scripts that are being ran in our environment. At the end of the powershell.file.script\_block\_text field there is sometimes a signature in this format: #… --- ## [Rest Template Span - no parent Transaction](https://discuss.elastic.co/t/rest-template-span-no-parent-transaction/302233)
**Author:** [@sadu](https://discuss.elastic.co/u/sadu)\ **Replies:** 3\ **Last updated:** [April 14, 2022, 2:17pm UTC](https://discuss.elastic.co/t/rest-template-span-no-parent-transaction/302233 "2022-04-14T14:17:21Z")
Kibana/Elasticsearch version: Stack 7.17.0 APM Agent language and version: 1.28.4 java Original install method (e.g. download page, yum, deb, from source, etc.) and version: Download page and local setup Is there a… --- ## [Installation of ELK on Windows help](https://discuss.elastic.co/t/installation-of-elk-on-windows-help/302333)
**Author:** [@insurin](https://discuss.elastic.co/u/insurin)\ **Replies:** 5\ **Last updated:** [April 14, 2022, 1:39pm UTC](https://discuss.elastic.co/t/installation-of-elk-on-windows-help/302333 "2022-04-14T13:39:39Z")
Hi all, need some help with Windows install. Windows Server 2022, ELK 8.12. I am trying to install everything on the 1 box. Steps for far Installed Elasticsearch using Elasticsearch.bat. This creates the elastic passwo… --- ## [Kibana keeps restarting with no error](https://discuss.elastic.co/t/kibana-keeps-restarting-with-no-error/301868)
**Author:** [@radw](https://discuss.elastic.co/u/radw)\ **Replies:** 10\ **Last updated:** [April 14, 2022, 1:35pm UTC](https://discuss.elastic.co/t/kibana-keeps-restarting-with-no-error/301868 "2022-04-14T13:35:01Z")
Hi all. I've deployed an EK stack on GKE, with operator 1.9.1, but my kibana pod keeps restarting. The only pertinent log which I've been able to extract from kibana's pods is this: rpc error: code = NotFound desc = a… --- ## [Snort with Elastic Cloud](https://discuss.elastic.co/t/snort-with-elastic-cloud/302436)
**Author:** [@kesako](https://discuss.elastic.co/u/kesako)\ **Replies:** 0\ **Last updated:** [April 14, 2022, 1:31pm UTC](https://discuss.elastic.co/t/snort-with-elastic-cloud/302436 "2022-04-14T13:31:19Z")
Hi, I'm trying to configure Snort to send his logs to Elastic cloud but the Snort integration doesn't work. What other way do I have to get those logs automatically ? Thanks Have a nice day --- ## [Advice to get different unstrctured log data into structured format](https://discuss.elastic.co/t/advice-to-get-different-unstrctured-log-data-into-structured-format/302433)
**Author:** [@Bavaria](https://discuss.elastic.co/u/Bavaria)\ **Replies:** 0\ **Last updated:** [April 14, 2022, 1:08pm UTC](https://discuss.elastic.co/t/advice-to-get-different-unstrctured-log-data-into-structured-format/302433 "2022-04-14T13:08:17Z")
I am new to Logstash. I have a processing question. I am getting these kind of logs with Filebeat on the "mmesage" field, from the same host. Sometimes different Files. How would I process to make those Messages I am get… --- ## [Slow handling of documents when large text in a field](https://discuss.elastic.co/t/slow-handling-of-documents-when-large-text-in-a-field/302431)
**Author:** [@lubosvr](https://discuss.elastic.co/u/lubosvr)\ **Replies:** 0\ **Last updated:** [April 14, 2022, 12:34pm UTC](https://discuss.elastic.co/t/slow-handling-of-documents-when-large-text-in-a-field/302431 "2022-04-14T12:34:54Z")
Hi, We have problems when handling for documents with large content in a single field. We have index with mapping like this: "mappings" : { "dynamic" : "false",... "properties" : { "created" : … --- ## [Netscout arbor legacy syslog parsing - Audit log issue](https://discuss.elastic.co/t/netscout-arbor-legacy-syslog-parsing-audit-log-issue/302340)
**Author:** [@Xor44](https://discuss.elastic.co/u/Xor44)\ **Replies:** 5\ **Last updated:** [April 14, 2022, 12:40pm UTC](https://discuss.elastic.co/t/netscout-arbor-legacy-syslog-parsing-audit-log-issue/302340 "2022-04-14T12:40:58Z")
Hi Folks , I need your help to resolve the issue below . I'm trying since many days to parse some audit logs .You will find some sample below . Idea is to simply extract these field . Field Need to be extracted … --- ## [How to retrieve the number of matched terms?](https://discuss.elastic.co/t/how-to-retrieve-the-number-of-matched-terms/302430)
**Author:** [@Filip4D](https://discuss.elastic.co/u/Filip4D)\ **Replies:** 0\ **Last updated:** [April 14, 2022, 12:33pm UTC](https://discuss.elastic.co/t/how-to-retrieve-the-number-of-matched-terms/302430 "2022-04-14T12:33:57Z")
Hey everyone, is there a way to count the number of matching words in the results. I.e. if I have the following query, I'd like to know for the results set, how many of the words: african, american and male were matched … --- ## [Twitter Logstash pipeline stops after a certain period](https://discuss.elastic.co/t/twitter-logstash-pipeline-stops-after-a-certain-period/302425)
**Author:** [@dihiaselma](https://discuss.elastic.co/u/dihiaselma)\ **Replies:** 2\ **Last updated:** [April 14, 2022, 12:31pm UTC](https://discuss.elastic.co/t/twitter-logstash-pipeline-stops-after-a-certain-period/302425 "2022-04-14T12:31:21Z")
Hello; I have created a pipeline logstash to retrieve data from twitter, then insert these data into Elasticsearch. It works fine for a certain period then, it stops without any error in logs. I have just to restart i… --- ## [Email trace logs in the Microsoft Office 365 integration](https://discuss.elastic.co/t/email-trace-logs-in-the-microsoft-office-365-integration/301649)
**Author:** [@dsv](https://discuss.elastic.co/u/dsv)\ **Replies:** 1\ **Last updated:** [April 14, 2022, 8:17am UTC](https://discuss.elastic.co/t/email-trace-logs-in-the-microsoft-office-365-integration/301649 "2022-04-14T08:17:05Z")
Hello, Is it possible to get the email trace logs (delivery status, sender, recipient, subject and attachments fields) in the Microsoft Office 365 integration in the Kibana 7.16.3? Some of these fields are presented at… --- ## [What is proper configuration for metrics in elasticstack to reduce memory footprint?](https://discuss.elastic.co/t/what-is-proper-configuration-for-metrics-in-elasticstack-to-reduce-memory-footprint/299950)
**Author:** [@sokolmateusz](https://discuss.elastic.co/u/sokolmateusz)\ **Replies:** 1\ **Last updated:** [April 14, 2022, 10:49am UTC](https://discuss.elastic.co/t/what-is-proper-configuration-for-metrics-in-elasticstack-to-reduce-memory-footprint/299950 "2022-04-14T10:49:55Z")
I'm using elasticstack for monitoring and logging our kubernetes cluster (with elasticsearch , filebeat , metricbeat , and kibana ). For some reason metricbeat collects unprecedented amount of data for just few pods (af… --- ## [Deployement resources for our specific use case](https://discuss.elastic.co/t/deployement-resources-for-our-specific-use-case/302417)
**Author:** [@Kevin\_Hemelrijk](https://discuss.elastic.co/u/Kevin_Hemelrijk)\ **Replies:** 0\ **Last updated:** [April 14, 2022, 10:11am UTC](https://discuss.elastic.co/t/deployement-resources-for-our-specific-use-case/302417 "2022-04-14T10:11:12Z")
Hello Elastic Community, We are doing a case-study about how many resources we need if we deploy Elastic Security on the cloud. Our use-case is about 300+ Windows Servers, 50+ Linux servers and a couple hundred of endpo… --- ## [QDSL Query: date\_histogram aggregating the results of a date\_histogram](https://discuss.elastic.co/t/qdsl-query-date-histogram-aggregating-the-results-of-a-date-histogram/302414)
**Author:** [@sebneu](https://discuss.elastic.co/u/sebneu)\ **Replies:** 0\ **Last updated:** [April 14, 2022, 9:29am UTC](https://discuss.elastic.co/t/qdsl-query-date-histogram-aggregating-the-results-of-a-date-histogram/302414 "2022-04-14T09:29:41Z")
Hi, I would like to stack two date-histograms, but I do not have a clue how to do it... Say, it's the traffic going through an interface and I want to receive the daily or hourly peaks of data in 60 minutes. For the p… --- ## [Elasticsearch immutable](https://discuss.elastic.co/t/elasticsearch-immutable/302413)
**Author:** [@111401](https://discuss.elastic.co/u/111401)\ **Replies:** 0\ **Last updated:** [April 14, 2022, 9:28am UTC](https://discuss.elastic.co/t/elasticsearch-immutable/302413 "2022-04-14T09:28:58Z")
Hi, I try to understand immutable in Elasticsearch, and read the article Updating API and Partial Update API , but still not clear about it. The article said Documents in Elasticsearch are immutable, but the Update API… --- ## [Questions about the apm-agent-php specification](https://discuss.elastic.co/t/questions-about-the-apm-agent-php-specification/302412)
**Author:** [@Akk](https://discuss.elastic.co/u/Akk)\ **Replies:** 0\ **Last updated:** [April 14, 2022, 9:24am UTC](https://discuss.elastic.co/t/questions-about-the-apm-agent-php-specification/302412 "2022-04-14T09:24:11Z")
This is a rudimentary question, but I would like to ask about the working specifications of apm-agent-php. Question1: Will apm-agent-php work within an existing process (php-fpm: pool www) when transferring data to the… --- ## [Logstash UDP input losing messages](https://discuss.elastic.co/t/logstash-udp-input-losing-messages/302411)
**Author:** [@dwjvaughan](https://discuss.elastic.co/u/dwjvaughan)\ **Replies:** 0\ **Last updated:** [April 14, 2022, 9:23am UTC](https://discuss.elastic.co/t/logstash-udp-input-losing-messages/302411 "2022-04-14T09:23:54Z")
I'm using the official logstash container (7.17.0) to ingest some logs over UDP (~8k a minute, with spikes probably around 30k a minute). This is running in AWS Fargate (at the moment 2 containers running, with a load ba… --- ## [Doc count per day and avearge](https://discuss.elastic.co/t/doc-count-per-day-and-avearge/302317)
**Author:** [@meyer1](https://discuss.elastic.co/u/meyer1)\ **Replies:** 2\ **Last updated:** [April 14, 2022, 8:53am UTC](https://discuss.elastic.co/t/doc-count-per-day-and-avearge/302317 "2022-04-14T08:53:55Z")
hello everyone is it possible to get the number of documents that we have in our index per day? and then, after getting that (which I have already done) get the average of that, ie doc\_count per day. I aim to integrate… --- ## [Send all data to one index and specific fields to another at same time](https://discuss.elastic.co/t/send-all-data-to-one-index-and-specific-fields-to-another-at-same-time/302381)
**Author:** [@adrianfusco](https://discuss.elastic.co/u/adrianfusco)\ **Replies:** 2\ **Last updated:** [April 14, 2022, 8:50am UTC](https://discuss.elastic.co/t/send-all-data-to-one-index-and-specific-fields-to-another-at-same-time/302381 "2022-04-14T08:50:24Z")
Hello, I've been reading for a long time in different sources if it's possible to send all data processed by logstash to one index and at the same time send just some specific fields of this data to another different in… --- ## [Use field name in datastream namespace or dataset](https://discuss.elastic.co/t/use-field-name-in-datastream-namespace-or-dataset/302188)
**Author:** [@sirReeall](https://discuss.elastic.co/u/sirReeall)\ **Replies:** 5\ **Last updated:** [April 14, 2022, 8:17am UTC](https://discuss.elastic.co/t/use-field-name-in-datastream-namespace-or-dataset/302188 "2022-04-14T08:17:11Z")
I'm trying to use a field with logstash output to Elasticsearch but I can't seem to get this to work. My configuration is as below: output { elasticsearch { hosts =\> "es01" data\_stream =\> "true" data… --- ## [Waiting on default policy with Fleet Server integration](https://discuss.elastic.co/t/waiting-on-default-policy-with-fleet-server-integration/302398)
**Author:** [@tirelibirefe](https://discuss.elastic.co/u/tirelibirefe)\ **Replies:** 2\ **Last updated:** [April 14, 2022, 8:12am UTC](https://discuss.elastic.co/t/waiting-on-default-policy-with-fleet-server-integration/302398 "2022-04-14T08:12:14Z")
Hello, I am not able to run fleet 8.2.2 on EKS Kubernetes. I am not able to find what I'm missing and need to your adises. Here is my config: apiVersion: agent.k8s.elastic.co/v1alpha1 kind: Agent metadata: name: $FL… --- ## [How to export Kibana search query results to CSV file with more than one million records](https://discuss.elastic.co/t/how-to-export-kibana-search-query-results-to-csv-file-with-more-than-one-million-records/301412)
**Author:** [@fymaterials](https://discuss.elastic.co/u/fymaterials)\ **Replies:** 3\ **Last updated:** [April 14, 2022, 7:39am UTC](https://discuss.elastic.co/t/how-to-export-kibana-search-query-results-to-csv-file-with-more-than-one-million-records/301412 "2022-04-14T07:39:27Z")
I used Kibana to query the index, and use export under resource tab to export query results. How can I export query results if there are million records? [Previous page](https://discuss.elastic.co/latest.md?page=1169) [Next page](https://discuss.elastic.co/latest.md?page=1171)