# Latest **URL:** https://discuss.elastic.co/latest.md?page=1181 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1182 --- ## [Filebeat multiline Pattern on Apache Logs does not work as expected (Filebeat -\> Logstash -\> ES)](https://discuss.elastic.co/t/filebeat-multiline-pattern-on-apache-logs-does-not-work-as-expected-filebeat-logstash-es/301747)
**Author:** [@Bndlr](https://discuss.elastic.co/u/Bndlr)\ **Replies:** 2\ **Last updated:** [April 7, 2022, 6:23am UTC](https://discuss.elastic.co/t/filebeat-multiline-pattern-on-apache-logs-does-not-work-as-expected-filebeat-logstash-es/301747 "2022-04-07T06:23:13Z")
Hello, if have the following multiline pattern in Filebeat Configuration: multiline.pattern: ^((-)\*\[0-9\]{4}-\[0-9\]{2}-\[0-9\]{2}|\[0-9\]{1,3}\\.\[0-9\]{1,3}\\.\[0-9\]{1,3}\\.\[0-9\]{1,3} ) to handle mulitline Log Patterns that cont… --- ## [Bucket Script and Gaps](https://discuss.elastic.co/t/bucket-script-and-gaps/301619)
**Author:** [@bianca6](https://discuss.elastic.co/u/bianca6)\ **Replies:** 3\ **Last updated:** [April 7, 2022, 7:06am UTC](https://discuss.elastic.co/t/bucket-script-and-gaps/301619 "2022-04-07T07:06:26Z")
Hi, According to the documentation, the bucket script should be able to deal with gaps: https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-pipeline.html#gap-policy But in my case, I go… --- ## [Cross cluster index in kibana](https://discuss.elastic.co/t/cross-cluster-index-in-kibana/301833)
**Author:** [@subham](https://discuss.elastic.co/u/subham)\ **Replies:** 0\ **Last updated:** [April 7, 2022, 6:21am UTC](https://discuss.elastic.co/t/cross-cluster-index-in-kibana/301833 "2022-04-07T06:21:11Z")
Hi All, Can someone tell whether we can get indices from cross cluster in Index Management. I am able to get the data of new index from remote cluster in dev tools but not able to see the same index in kibana. Please … --- ## [How to upgrade more than 1 Elastic Agent at the same time](https://discuss.elastic.co/t/how-to-upgrade-more-than-1-elastic-agent-at-the-same-time/301745)
**Author:** [@JimG](https://discuss.elastic.co/u/JimG)\ **Replies:** 2\ **Last updated:** [April 7, 2022, 6:14am UTC](https://discuss.elastic.co/t/how-to-upgrade-more-than-1-elastic-agent-at-the-same-time/301745 "2022-04-07T06:14:19Z")
Hi, Is it possible to upgrade more than 1 Elastic agent at a time? I dont know if it is a missing feature or if i just dont have the knowledge how to do this. With 750+ enrolled agents, it's a long proces to manual upg… --- ## [Fields not coming in discover](https://discuss.elastic.co/t/fields-not-coming-in-discover/301181)
**Author:** [@Shubham\_Singh](https://discuss.elastic.co/u/Shubham_Singh)\ **Replies:** 7\ **Last updated:** [April 7, 2022, 6:11am UTC](https://discuss.elastic.co/t/fields-not-coming-in-discover/301181 "2022-04-07T06:11:16Z")
I have a stack\_trace field in log file but in kibana it turn out to be in hidden field with no value. Rest other fields are coming as expected. I can see the field in vizualization but not in discover . The field type is… --- ## [Index Data Ingestion](https://discuss.elastic.co/t/index-data-ingestion/301830)
**Author:** [@vikasp](https://discuss.elastic.co/u/vikasp)\ **Replies:** 1\ **Last updated:** [April 7, 2022, 5:36am UTC](https://discuss.elastic.co/t/index-data-ingestion/301830 "2022-04-07T05:36:23Z")
Hi, I am trying to understand how the ingestion works. Lets say I created an index with 6 primary shards, 1 replica. and I am ingesting to the cluster (say logstash is continuously pushing data) to a coordinating only… --- ## [Rule Failure - Rule Mapping Error](https://discuss.elastic.co/t/rule-failure-rule-mapping-error/301827)
**Author:** [@inf](https://discuss.elastic.co/u/inf)\ **Replies:** 0\ **Last updated:** [April 7, 2022, 5:03am UTC](https://discuss.elastic.co/t/rule-failure-rule-mapping-error/301827 "2022-04-07T05:03:46Z")
Hi there, I am facing the same issue as Rules failing due to field mapping errors, except that I am using Winlogbeat. (instead of Auditbeat) I am also not using Logstash or any log transformation tools, and I am using … --- ## [Logstash-input-file scans non latin character file name cause InvalidPathException and stopped working](https://discuss.elastic.co/t/logstash-input-file-scans-non-latin-character-file-name-cause-invalidpathexception-and-stopped-working/301818)
**Author:** [@lixplor](https://discuss.elastic.co/u/lixplor)\ **Replies:** 1\ **Last updated:** [April 7, 2022, 3:37am UTC](https://discuss.elastic.co/t/logstash-input-file-scans-non-latin-character-file-name-cause-invalidpathexception-and-stopped-working/301818 "2022-04-07T03:37:14Z")
Hi, I'm using Logstash 6.8.23 with file input plugin 4.1.18 on a JRE 8 env. OS is suse11 and system default locale is zh\_CN.gbk. When Logstash collecting logs, it reached a file with non-latin name. eg. 你好.xml. Then Lo… --- ## [Bulk Import of data for different indices in presence of enrich ingest pipeline](https://discuss.elastic.co/t/bulk-import-of-data-for-different-indices-in-presence-of-enrich-ingest-pipeline/301689)
**Author:** [@Matthew\_Dominic\_Ramp](https://discuss.elastic.co/u/Matthew_Dominic_Ramp)\ **Replies:** 4\ **Last updated:** [April 7, 2022, 3:21am UTC](https://discuss.elastic.co/t/bulk-import-of-data-for-different-indices-in-presence-of-enrich-ingest-pipeline/301689 "2022-04-07T03:21:12Z")
Context: I have two indices: devices and events devices has an enrich policy associated with it and a pipeline was created to enable this data enrichment. This pipeline works fine. i want to bulk import JSON objects fo… --- ## [Best ElasticSearch configuration mode](https://discuss.elastic.co/t/best-elasticsearch-configuration-mode/301566)
**Author:** [@TomTom](https://discuss.elastic.co/u/TomTom)\ **Replies:** 9\ **Last updated:** [April 7, 2022, 2:28am UTC](https://discuss.elastic.co/t/best-elasticsearch-configuration-mode/301566 "2022-04-07T02:28:32Z")
Years ago I configured a server\* with Elasticsearch, however, until today my knowledge to configure, manage, define nodes, is totally 0. I don't have nodes for ingest, digest, etc, as I have no idea what they do. Even m… --- ## [Close/flush/reset syslog input connection on logstash](https://discuss.elastic.co/t/close-flush-reset-syslog-input-connection-on-logstash/301813)
**Author:** [@alfianaf](https://discuss.elastic.co/u/alfianaf)\ **Replies:** 2\ **Last updated:** [April 7, 2022, 2:07am UTC](https://discuss.elastic.co/t/close-flush-reset-syslog-input-connection-on-logstash/301813 "2022-04-07T02:07:42Z")
Hello, I'm handling logstash syslog input from pcf, the log can be ingested, and there is no problem with that, but when I check the file descriptor and open connection on the specific port, they kept increasing is th… --- ## [Filebeat - Kubernetes Autodiscovery with ElasticSearch Module](https://discuss.elastic.co/t/filebeat-kubernetes-autodiscovery-with-elasticsearch-module/301815)
**Author:** [@Jonathan\_Mabrito](https://discuss.elastic.co/u/Jonathan_Mabrito)\ **Replies:** 0\ **Last updated:** [April 7, 2022, 1:50am UTC](https://discuss.elastic.co/t/filebeat-kubernetes-autodiscovery-with-elasticsearch-module/301815 "2022-04-07T01:50:45Z")
Hi There, Hoping someone might be able to help with getting Filebeats Autodiscovery up. I am trying to detect my Elasticsearch containers in my Kubernetes Cluster (using vanilla K8's). Here is my proposed K8's file: a… --- ## [Elastic Search Logstash how to query all fields and get all fields into pipeline?](https://discuss.elastic.co/t/elastic-search-logstash-how-to-query-all-fields-and-get-all-fields-into-pipeline/301810)
**Author:** [@MLsuper](https://discuss.elastic.co/u/MLsuper)\ **Replies:** 0\ **Last updated:** [April 7, 2022, 12:19am UTC](https://discuss.elastic.co/t/elastic-search-logstash-how-to-query-all-fields-and-get-all-fields-into-pipeline/301810 "2022-04-07T00:19:22Z")
So I have a logstash pipeline that is currently setup with this: for a query input { hosts =\> ... query =\> '{ "query": { "match\_all": {} }}' target =\> "\[@metasource\]\[\_source\]" index… --- ## [Autoresolve with watcher and PagerDuty - One trigger when an error condition arises and one when it clears](https://discuss.elastic.co/t/autoresolve-with-watcher-and-pagerduty-one-trigger-when-an-error-condition-arises-and-one-when-it-clears/301811)
**Author:** [@rasmustorkel](https://discuss.elastic.co/u/rasmustorkel)\ **Replies:** 0\ **Last updated:** [April 7, 2022, 12:42am UTC](https://discuss.elastic.co/t/autoresolve-with-watcher-and-pagerduty-one-trigger-when-an-error-condition-arises-and-one-when-it-clears/301811 "2022-04-07T00:42:30Z")
I have created a watcher, integrated it with PagerDuty and it works nicely. But is has two problems: Every time the watcher comes alive to watch, if the error condition is still present, it sends another trigger to Pa… --- ## [Is default dynamic mapping of documents okay?](https://discuss.elastic.co/t/is-default-dynamic-mapping-of-documents-okay/301784)
**Author:** [@ksuren](https://discuss.elastic.co/u/ksuren)\ **Replies:** 2\ **Last updated:** [April 6, 2022, 11:39pm UTC](https://discuss.elastic.co/t/is-default-dynamic-mapping-of-documents-okay/301784 "2022-04-06T23:39:12Z")
While creating a business listing data store, so far added Business and Categories to an index. The mappings show as: Q1: Is this okay? And/or referring to Mapping | Elasticsearch Guide \[8.1\] | Elastic should I crea… --- ## [Does elastic master node really delete or create an index?](https://discuss.elastic.co/t/does-elastic-master-node-really-delete-or-create-an-index/301661)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 3\ **Last updated:** [April 6, 2022, 10:49pm UTC](https://discuss.elastic.co/t/does-elastic-master-node-really-delete-or-create-an-index/301661 "2022-04-06T22:49:35Z")
I am just confuse that what exactly does master node do in cluster According to my understanding it just maintain cluster state and each data node have cluster state information. From this documentation https://www.el… --- ## [Upgrade of elastic search version](https://discuss.elastic.co/t/upgrade-of-elastic-search-version/301620)
**Author:** [@aman123](https://discuss.elastic.co/u/aman123)\ **Replies:** 3\ **Last updated:** [April 6, 2022, 10:48pm UTC](https://discuss.elastic.co/t/upgrade-of-elastic-search-version/301620 "2022-04-06T22:48:11Z")
hi team, I have 10 node cluster, I upgraded from 10 nodes to 2 nodes now 1 node is master node . Do I need make master node to other node and then upgrade 1 st node or I can directly upgrade the master node. --- ## [Elastic GravityApps Sql Backup Transaction Logs](https://discuss.elastic.co/t/elastic-gravityapps-sql-backup-transaction-logs/301494)
**Author:** [@Techplay27](https://discuss.elastic.co/u/Techplay27)\ **Replies:** 3\ **Last updated:** [April 6, 2022, 10:44pm UTC](https://discuss.elastic.co/t/elastic-gravityapps-sql-backup-transaction-logs/301494 "2022-04-06T22:44:30Z")
I can see quite a few transaction logs dating back to last year June and this is really using a lot of disk space up. I have a scheduled a full backup of the server, so after this successfully completes I will delete all… --- ## [Define custom unique key](https://discuss.elastic.co/t/define-custom-unique-key/301642)
**Author:** [@nn14](https://discuss.elastic.co/u/nn14)\ **Replies:** 3\ **Last updated:** [April 6, 2022, 10:42pm UTC](https://discuss.elastic.co/t/define-custom-unique-key/301642 "2022-04-06T22:42:45Z")
Hi team, Is there a way to define our own custom unique key for the document which is similar to uniqueKey provided in Solr. For e.g I need to define employeeId or a combination of 2 fields as unique id. Any example w… --- ## [Filter Values in Different Streams and Group Them in Data Table](https://discuss.elastic.co/t/filter-values-in-different-streams-and-group-them-in-data-table/301742)
**Author:** [@\_PA](https://discuss.elastic.co/u/_PA)\ **Replies:** 0\ **Last updated:** [April 6, 2022, 10:59am UTC](https://discuss.elastic.co/t/filter-values-in-different-streams-and-group-them-in-data-table/301742 "2022-04-06T10:59:02Z")
I am running ELK 7 and I have the following scenario. I have data in one index that looks like this: |Time|ID|AAA| |Apr 6, 2022 @ 11:48:11.197|300965890|tar1| |Apr 6, 2022 @ 11:48:11.196|300965890|add3| |Apr 6, 2022… --- ## [Logstash input for oracle database](https://discuss.elastic.co/t/logstash-input-for-oracle-database/301683)
**Author:** [@altink](https://discuss.elastic.co/u/altink)\ **Replies:** 2\ **Last updated:** [April 6, 2022, 9:46pm UTC](https://discuss.elastic.co/t/logstash-input-for-oracle-database/301683 "2022-04-06T21:46:29Z")
I have an Bitnami virtual ova distribution, ELK 7.17 on Debian 10. Elastic, Kibana and Logstash run as services (daemons). I have put the logstash config file logstash-ora-01.conf under /opt/bitnami/logstash/config in… --- ## [Consulta no elastic](https://discuss.elastic.co/t/consulta-no-elastic/301792)
**Author:** [@Gabriel\_mec77](https://discuss.elastic.co/u/Gabriel_mec77)\ **Replies:** 4\ **Last updated:** [April 6, 2022, 8:43pm UTC](https://discuss.elastic.co/t/consulta-no-elastic/301792 "2022-04-06T20:43:50Z")
Como procurar apenas indices em vermelho no elastic --- ## [Calculate metric to raise alert in kibana](https://discuss.elastic.co/t/calculate-metric-to-raise-alert-in-kibana/301799)
**Author:** [@waelboss](https://discuss.elastic.co/u/waelboss)\ **Replies:** 0\ **Last updated:** [April 6, 2022, 8:21pm UTC](https://discuss.elastic.co/t/calculate-metric-to-raise-alert-in-kibana/301799 "2022-04-06T20:21:08Z")
i want to fire an alert with a query condition if min value = max value and current value \> 40 then fire alert the purpose is to fire the alert if the queue size doesn't decrease over a time interval of 5 minutes her… --- ## [Self-signed cert unable to import data to stream using fleet](https://discuss.elastic.co/t/self-signed-cert-unable-to-import-data-to-stream-using-fleet/301798)
**Author:** [@nfarmer](https://discuss.elastic.co/u/nfarmer)\ **Replies:** 0\ **Last updated:** [April 6, 2022, 8:07pm UTC](https://discuss.elastic.co/t/self-signed-cert-unable-to-import-data-to-stream-using-fleet/301798 "2022-04-06T20:07:56Z")
Hello, I'm trying to deploy elastic agents using fleet with the certificate authorities enable in the advanced output settings, but when I go to install the agent, it still says unknown authority. So I enrolled the agen… --- ## [How to delete elasticsearch logs?](https://discuss.elastic.co/t/how-to-delete-elasticsearch-logs/301666)
**Author:** [@danielbsilva2](https://discuss.elastic.co/u/danielbsilva2)\ **Replies:** 16\ **Last updated:** [April 6, 2022, 8:02pm UTC](https://discuss.elastic.co/t/how-to-delete-elasticsearch-logs/301666 "2022-04-06T20:02:29Z")
good afternoon folks how do i delete my indexes in Elasticsearch? I need to delete the logs generated in Elasticsearch from an application I have here and leave the logs from the last 3 days, I've looked here on the fo… --- ## [Control Range Slider does not match Is Between Operator Filter](https://discuss.elastic.co/t/control-range-slider-does-not-match-is-between-operator-filter/301796)
**Author:** [@bsmith](https://discuss.elastic.co/u/bsmith)\ **Replies:** 0\ **Last updated:** [April 6, 2022, 7:39pm UTC](https://discuss.elastic.co/t/control-range-slider-does-not-match-is-between-operator-filter/301796 "2022-04-06T19:39:35Z")
Using ELK 7.10 When adding a filter via the Range Slider in Controls it uses gte/lte. You can also see a visual bug where the second value does not show in the filter. { "script": { "script": { "lang": "pai… --- ## [How do I put another related field below the columns?](https://discuss.elastic.co/t/how-do-i-put-another-related-field-below-the-columns/301564)
**Author:** [@Alejandra\_Mata1](https://discuss.elastic.co/u/Alejandra_Mata1)\ **Replies:** 7\ **Last updated:** [April 6, 2022, 7:30pm UTC](https://discuss.elastic.co/t/how-do-i-put-another-related-field-below-the-columns/301564 "2022-04-06T19:30:07Z")
I have an array of fields that I have already put in the form of columns, but my concern is that the count() appears as a metric at the bottom, but I need the date to appear, instead of count() but what I need, to ou… --- ## [How to get logstash to read/process multiple log files at the same time?](https://discuss.elastic.co/t/how-to-get-logstash-to-read-process-multiple-log-files-at-the-same-time/301710)
**Author:** [@Shreesh\_Narayanan](https://discuss.elastic.co/u/Shreesh_Narayanan)\ **Replies:** 2\ **Last updated:** [April 6, 2022, 7:34pm UTC](https://discuss.elastic.co/t/how-to-get-logstash-to-read-process-multiple-log-files-at-the-same-time/301710 "2022-04-06T19:34:33Z")
It seems that logstash doesnt read multiple files in the directory at the same time , what am i missing ? how do i get logstash to read all three files here ? root@dev-elk-app02:/app/input# lsof \* COMMAND PID USER FD… --- ## [Where User/Roles, Index and Saved objects are stored?](https://discuss.elastic.co/t/where-user-roles-index-and-saved-objects-are-stored/301686)
**Author:** [@Gabriel\_Mendez](https://discuss.elastic.co/u/Gabriel_Mendez)\ **Replies:** 2\ **Last updated:** [April 6, 2022, 6:30pm UTC](https://discuss.elastic.co/t/where-user-roles-index-and-saved-objects-are-stored/301686 "2022-04-06T18:30:47Z")
Hello!, I am using a docker version for Elasticsearch and Kibana, and I have deployed an AWS instance to have my App working, Now on every documentation for Elastic and Kibana with docker it says that to backup the data… --- ## [ElasticSearch 8.1 - Multinode Cluster Setup](https://discuss.elastic.co/t/elasticsearch-8-1-multinode-cluster-setup/301677)
**Author:** [@Aldo2](https://discuss.elastic.co/u/Aldo2)\ **Replies:** 2\ **Last updated:** [April 6, 2022, 5:40pm UTC](https://discuss.elastic.co/t/elasticsearch-8-1-multinode-cluster-setup/301677 "2022-04-06T17:40:21Z")
Hi Elastic Community, I have a question about the multi node version 8.1.1 cluster setup. When I need to add the 2nd node to the cluster according to the elastic support I must add: cluster.name: aiops node.name: elas… [Previous page](https://discuss.elastic.co/latest.md?page=1180) [Next page](https://discuss.elastic.co/latest.md?page=1182)