# Latest **URL:** https://discuss.elastic.co/latest.md?page=1194 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1195 --- ## [Elastic Agent for syslog](https://discuss.elastic.co/t/elastic-agent-for-syslog/301104)
**Author:** [@hebph001](https://discuss.elastic.co/u/hebph001)\ **Replies:** 0\ **Last updated:** [March 30, 2022, 2:27pm UTC](https://discuss.elastic.co/t/elastic-agent-for-syslog/301104 "2022-03-30T14:27:12Z")
Hi Elastic community, I am trying to determine what would be the best and easiest way to gather logs and metrics from 35 SLES 12 servers because Elastic Agent is not supported on that version. I am currently collecting … --- ## [ESRally issue when running EventData track](https://discuss.elastic.co/t/esrally-issue-when-running-eventdata-track/300858)
**Author:** [@Kailas](https://discuss.elastic.co/u/Kailas)\ **Replies:** 7\ **Last updated:** [March 30, 2022, 1:56pm UTC](https://discuss.elastic.co/t/esrally-issue-when-running-eventdata-track/300858 "2022-03-30T13:56:29Z")
There were some network changes and the Rally process stopped in between and the state of ES was in “yellow/red”. Hence I deleted to index from the ES cluster. Now, when I run the below Rally command esrally race --kil… --- ## [Metricset system: users and service](https://discuss.elastic.co/t/metricset-system-users-and-service/301093)
**Author:** [@rdinis](https://discuss.elastic.co/u/rdinis)\ **Replies:** 0\ **Last updated:** [March 30, 2022, 1:14pm UTC](https://discuss.elastic.co/t/metricset-system-users-and-service/301093 "2022-03-30T13:14:53Z")
Hi, I'm running metricbeat on container and i have found this error: {"level":"error","timestamp":"2022-03-27T16:12:45.481Z","logger":"reload","caller":"cfgfile/list.go:99","message":"Error creating runner from config:… --- ## [Accidentally deleted .security index for x-pack](https://discuss.elastic.co/t/accidentally-deleted-security-index-for-x-pack/69844)
**Author:** [@Johntdyer](https://discuss.elastic.co/u/Johntdyer)\ **Replies:** 3\ **Last updated:** [March 30, 2022, 12:29pm UTC](https://discuss.elastic.co/t/accidentally-deleted-security-index-for-x-pack/69844 "2022-03-30T12:29:45Z")
So by some horrible error we deleted the .security index for x-pack. How do we get that back? We tried reinstalling in a lab deployment and it didnt seem to recover that index. --- ## [Filebeat with AWS ELB logs = newbie problems](https://discuss.elastic.co/t/filebeat-with-aws-elb-logs-newbie-problems/301077)
**Author:** [@Bartosz\_Bubak](https://discuss.elastic.co/u/Bartosz_Bubak)\ **Replies:** 0\ **Last updated:** [March 30, 2022, 11:19am UTC](https://discuss.elastic.co/t/filebeat-with-aws-elb-logs-newbie-problems/301077 "2022-03-30T11:19:59Z")
Hi, I am relatively "new" to ELK, I have some basics in administration and use, but I don't feel like a specialist in any way. I will briefly describe the problem I am struggling with. On one of our services (hosted on… --- ## [Can I use Vega Lite with multiple indexes?](https://discuss.elastic.co/t/can-i-use-vega-lite-with-multiple-indexes/300960)
**Author:** [@ivanhoe-dev](https://discuss.elastic.co/u/ivanhoe-dev)\ **Replies:** 1\ **Last updated:** [March 30, 2022, 11:13am UTC](https://discuss.elastic.co/t/can-i-use-vega-lite-with-multiple-indexes/300960 "2022-03-30T11:13:08Z")
I have a use case which data sources are from two separated indexes, is it possible to plot a single chart from two indexes by vega? Thanks --- ## [Unable to search double quotes](https://discuss.elastic.co/t/unable-to-search-double-quotes/301024)
**Author:** [@Abhi\_Abhishek](https://discuss.elastic.co/u/Abhi_Abhishek)\ **Replies:** 0\ **Last updated:** [March 30, 2022, 4:40am UTC](https://discuss.elastic.co/t/unable-to-search-double-quotes/301024 "2022-03-30T04:40:14Z")
I have a field unitDesignator = "" Even if I escape with backslash no output & field type is text. { "query":{ "match":{ "unitDesignator"="\\"\\"" } } } Can anyone help me please. --- ## [When to apply Stemmer, Stop Word and Synonym Filters](https://discuss.elastic.co/t/when-to-apply-stemmer-stop-word-and-synonym-filters/301076)
**Author:** [@duncRed](https://discuss.elastic.co/u/duncRed)\ **Replies:** 0\ **Last updated:** [March 30, 2022, 10:50am UTC](https://discuss.elastic.co/t/when-to-apply-stemmer-stop-word-and-synonym-filters/301076 "2022-03-30T10:50:05Z")
When creating an index we apply filters in the following order: Stop token filter Stemmer token filter Synonym filter - these are user defined and then included in the index We apply them in this order due to the fol… --- ## [Updating the kibana.yml to increate max size of CSV export](https://discuss.elastic.co/t/updating-the-kibana-yml-to-increate-max-size-of-csv-export/300906)
**Author:** [@Matt.Wash](https://discuss.elastic.co/u/Matt.Wash)\ **Replies:** 3\ **Last updated:** [March 30, 2022, 10:37am UTC](https://discuss.elastic.co/t/updating-the-kibana-yml-to-increate-max-size-of-csv-export/300906 "2022-03-30T10:37:32Z")
this might be a silly question, but if i am running the cloud instance of Kibana, where can i access the Kibana.yml from to adjust the limit on the max size when exporting to csv? the video tutorials show how to do it w… --- ## [Need to set alert which would trigger when API key expires in Elastic stack](https://discuss.elastic.co/t/need-to-set-alert-which-would-trigger-when-api-key-expires-in-elastic-stack/301073)
**Author:** [@sidharth\_vijayakumar](https://discuss.elastic.co/u/sidharth_vijayakumar)\ **Replies:** 0\ **Last updated:** [March 30, 2022, 10:31am UTC](https://discuss.elastic.co/t/need-to-set-alert-which-would-trigger-when-api-key-expires-in-elastic-stack/301073 "2022-03-30T10:31:36Z")
Need to set an alert that would trigger 10days before my API key expiry. So in elastic stack am trying to use API key for authentication in the Kubernetes cluster. The API key needs to have an expiry of 1 year but when i… --- ## [Count status but only for last events](https://discuss.elastic.co/t/count-status-but-only-for-last-events/300104)
**Author:** [@gueri](https://discuss.elastic.co/u/gueri)\ **Replies:** 3\ **Last updated:** [March 30, 2022, 10:24am UTC](https://discuss.elastic.co/t/count-status-but-only-for-last-events/300104 "2022-03-30T10:24:14Z")
Hello, I come here to ask you for help. Thank you in advance to those who will answer me :slight\_smile: I have a index with processing status by city. Status are : UP -\> DEGRADED -\> DOWN Here is an example of a collec… --- ## [Does initial interval work on start up for google workspace module?](https://discuss.elastic.co/t/does-initial-interval-work-on-start-up-for-google-workspace-module/300701)
**Author:** [@YuWatanabe](https://discuss.elastic.co/u/YuWatanabe)\ **Replies:** 2\ **Last updated:** [March 30, 2022, 10:11am UTC](https://discuss.elastic.co/t/does-initial-interval-work-on-start-up-for-google-workspace-module/300701 "2022-03-30T10:11:06Z")
Hello. I would like to ask question for google workspace module . Doc says , filebeat will poll up to var.initial\_interval when the filebeat starts. It will poll events up to this time period when the module starts. … --- ## [Elasticsearch crashes after a few minutes on VM](https://discuss.elastic.co/t/elasticsearch-crashes-after-a-few-minutes-on-vm/300487)
**Author:** [@fidegnon](https://discuss.elastic.co/u/fidegnon)\ **Replies:** 10\ **Last updated:** [March 30, 2022, 9:31am UTC](https://discuss.elastic.co/t/elasticsearch-crashes-after-a-few-minutes-on-vm/300487 "2022-03-30T09:31:50Z")
I have two identical VM where ELK 6.6.2 is running, they are independent and not configured as a cluster. On one Elasticsearch is running fine, on the other Elasticsearch crashes a few minutes after starting. Here is t… --- ## [Kibana server is not ready yet](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet/301065)
**Author:** [@Mayuresh\_More](https://discuss.elastic.co/u/Mayuresh_More)\ **Replies:** 0\ **Last updated:** [March 30, 2022, 9:30am UTC](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet/301065 "2022-03-30T09:30:41Z")
Hi, I have installed the latest version of all Elasticsearch & Kibana I am able to connect elastic URL but unable to see dashboard (PFA) and give the error "Kibana server is not ready yet." in the browser. 1:) How C… --- ## [Can RUM be used with mobile apps](https://discuss.elastic.co/t/can-rum-be-used-with-mobile-apps/300801)
**Author:** [@hamdyahmed1984](https://discuss.elastic.co/u/hamdyahmed1984)\ **Replies:** 1\ **Last updated:** [March 30, 2022, 9:18am UTC](https://discuss.elastic.co/t/can-rum-be-used-with-mobile-apps/300801 "2022-03-30T09:18:08Z")
Can RUM be used with mobile apps (android and IOS)? If yes, how and if no, what is the alternative? --- ## [Using an element of an array as match\_field in enrich policy](https://discuss.elastic.co/t/using-an-element-of-an-array-as-match-field-in-enrich-policy/301059)
**Author:** [@mustafa\_savran](https://discuss.elastic.co/u/mustafa_savran)\ **Replies:** 0\ **Last updated:** [March 30, 2022, 8:56am UTC](https://discuss.elastic.co/t/using-an-element-of-an-array-as-match-field-in-enrich-policy/301059 "2022-03-30T08:56:40Z")
I have been trying to use the element of an array as match\_field in enrich policy but I didn't achieve this. I have an array contains a bbox, a multi polygon and geo point respectively and I mapped this array as geo\_sh… --- ## [Connection errors during indexing using goroutines](https://discuss.elastic.co/t/connection-errors-during-indexing-using-goroutines/301040)
**Author:** [@apo\_p9](https://discuss.elastic.co/u/apo_p9)\ **Replies:** 4\ **Last updated:** [March 30, 2022, 8:52am UTC](https://discuss.elastic.co/t/connection-errors-during-indexing-using-goroutines/301040 "2022-03-30T08:52:28Z")
I have a syncing utility in Go, that moves data from MongoDB to ES. Here is the gist of it. Create workgroup, launch a goroutine listening on a channel, pull results from Mongo and publish to a channel which will index i… --- ## [Logstash pipelines reduces the number of events sent](https://discuss.elastic.co/t/logstash-pipelines-reduces-the-number-of-events-sent/300000)
**Author:** [@zpltn](https://discuss.elastic.co/u/zpltn)\ **Replies:** 1\ **Last updated:** [March 30, 2022, 8:22am UTC](https://discuss.elastic.co/t/logstash-pipelines-reduces-the-number-of-events-sent/300000 "2022-03-30T08:22:28Z")
Hi there, we have Metricbeat, Filebeat, Logstash and Elasticsearch running on an OpenShift Cluster. We are using Logstash to configure multiples pipelines to filter the logs for some namespaces and Beats types. Our sta… --- ## [Advanced Watcher - If Failed % is greater than some defined threshold value](https://discuss.elastic.co/t/advanced-watcher-if-failed-is-greater-than-some-defined-threshold-value/300727)
**Author:** [@Freddy.Raj](https://discuss.elastic.co/u/Freddy.Raj)\ **Replies:** 6\ **Last updated:** [March 30, 2022, 8:18am UTC](https://discuss.elastic.co/t/advanced-watcher-if-failed-is-greater-than-some-defined-threshold-value/300727 "2022-03-30T08:18:26Z")
Hi All, I need some help to achieve below monitoring condition to enable watcher alert. We have a domain named "XYZ" as a value to one of the term field - "main.domain" Under this domain "XYZ", we see logs for several… --- ## [Problem accessing charts and artifacts from hetzner.de servers](https://discuss.elastic.co/t/problem-accessing-charts-and-artifacts-from-hetzner-de-servers/300840)
**Author:** [@nymous](https://discuss.elastic.co/u/nymous)\ **Replies:** 3\ **Last updated:** [March 30, 2022, 8:11am UTC](https://discuss.elastic.co/t/problem-accessing-charts-and-artifacts-from-hetzner-de-servers/300840 "2022-03-30T08:11:23Z")
Hi folks! I have a strange issue with getting artifacts (debs, helm charts) from elastic.co for my cloud at Hetzner.de. Some servers are downloading them fine, but others just get 403 error. Is there a reason for that, d… --- ## [Kibana drill down fields](https://discuss.elastic.co/t/kibana-drill-down-fields/300970)
**Author:** [@bianca6](https://discuss.elastic.co/u/bianca6)\ **Replies:** 5\ **Last updated:** [March 30, 2022, 8:09am UTC](https://discuss.elastic.co/t/kibana-drill-down-fields/300970 "2022-03-30T08:09:11Z")
Hi, I have some logs like this: country = France, city = Paris, value = 6 country = France, city = Marseille, value = 2 country = Italy, city = Roma, value = 8 In a Kibana dashboards, I can display the countries and s… --- ## [Not getting perfect results (Am using elasticsearch dsl for django ) and please help me](https://discuss.elastic.co/t/not-getting-perfect-results-am-using-elasticsearch-dsl-for-django-and-please-help-me/300994)
**Author:** [@RohitBR\_K](https://discuss.elastic.co/u/RohitBR_K)\ **Replies:** 1\ **Last updated:** [March 30, 2022, 7:57am UTC](https://discuss.elastic.co/t/not-getting-perfect-results-am-using-elasticsearch-dsl-for-django-and-please-help-me/300994 "2022-03-30T07:57:31Z")
Here am searching for juices and am getting the juice products but also am getting other products that includes letter j ,u, i, c, e. Here i used nGram with match query and i used min diff =1 and max diff = 20. kindly pl… --- ## [Elaticsearch Java client output dsl](https://discuss.elastic.co/t/elaticsearch-java-client-output-dsl/300952)
**Author:** [@supermario](https://discuss.elastic.co/u/supermario)\ **Replies:** 12\ **Last updated:** [March 30, 2022, 7:52am UTC](https://discuss.elastic.co/t/elaticsearch-java-client-output-dsl/300952 "2022-03-30T07:52:49Z")
I am using Elasticsearch java Client version 8.1. I want to output dsl by searchrequest, but i don't find any function. I look forward hearing your reply,thanks. --- ## [Watcher cannot be started after upgrading Elasticsearch 7.x to Elasticsearch 8.x](https://discuss.elastic.co/t/watcher-cannot-be-started-after-upgrading-elasticsearch-7-x-to-elasticsearch-8-x/301041)
**Author:** [@yohanwongso](https://discuss.elastic.co/u/yohanwongso)\ **Replies:** 1\ **Last updated:** [March 30, 2022, 7:52am UTC](https://discuss.elastic.co/t/watcher-cannot-be-started-after-upgrading-elasticsearch-7-x-to-elasticsearch-8-x/301041 "2022-03-30T07:52:27Z")
The watcher is stop working just after the Elasticsearch has been upgraded to version 8.x. At the Kibana's Stack Management -\> Watcher, the state of all active watchers are OK, but the watchers haven't been triggered ev… --- ## [Kibana Sharepoint Connector | ingest pipeline question](https://discuss.elastic.co/t/kibana-sharepoint-connector-ingest-pipeline-question/301046)
**Author:** [@msanz-acclaro](https://discuss.elastic.co/u/msanz-acclaro)\ **Replies:** 0\ **Last updated:** [March 30, 2022, 7:40am UTC](https://discuss.elastic.co/t/kibana-sharepoint-connector-ingest-pipeline-question/301046 "2022-03-30T07:40:28Z")
Hi everyone, I am implementing the ELK stack in our company, which so far has gone pretty well. I have a question regarding the Sharepoint connector, I read the doc but have not found (googling) anyone with a similar u… --- ## [Not able to start elasticsearch-2.0](https://discuss.elastic.co/t/not-able-to-start-elasticsearch-2-0/300339)
**Author:** [@siddarthhegde](https://discuss.elastic.co/u/siddarthhegde)\ **Replies:** 2\ **Last updated:** [March 30, 2022, 7:24am UTC](https://discuss.elastic.co/t/not-able-to-start-elasticsearch-2-0/300339 "2022-03-30T07:24:17Z")
Elasticsearch version 2.0 OS: Linux I am not able to start Elasticsearch and I am getting the following error: \[ERROR\]\[gateway \] \[Node\] failed to read local state, exiting... ElasticsearchException\[mu… --- ## [Use ^ for absolute input paths?](https://discuss.elastic.co/t/use-for-absolute-input-paths/301034)
**Author:** [@anon90868141](https://discuss.elastic.co/u/anon90868141)\ **Replies:** 0\ **Last updated:** [March 30, 2022, 6:53am UTC](https://discuss.elastic.co/t/use-for-absolute-input-paths/301034 "2022-03-30T06:53:54Z")
Hello, I recently read about the filebeat filestream input. On prospector.scanner.include\_files, there is an example saying you should use ^ in patterns if they're an absolute path. Does this transfer to the input paths… --- ## [Am I losing data?](https://discuss.elastic.co/t/am-i-losing-data/300819)
**Author:** [@anon90868141](https://discuss.elastic.co/u/anon90868141)\ **Replies:** 4\ **Last updated:** [March 30, 2022, 6:48am UTC](https://discuss.elastic.co/t/am-i-losing-data/300819 "2022-03-30T06:48:54Z")
Hi guys, I'm currently not sure if I'm losing data. Last monday, I restarted the Elasticsearch cluster. Sadly, I restarted the master nodes all at the same time and didn't deactivate the shard allocation. I changed the… --- ## [How filter range date in CreateDate](https://discuss.elastic.co/t/how-filter-range-date-in-createdate/300844)
**Author:** [@Damas\_Mahardi](https://discuss.elastic.co/u/Damas_Mahardi)\ **Replies:** 3\ **Last updated:** [March 30, 2022, 6:48am UTC](https://discuss.elastic.co/t/how-filter-range-date-in-createdate/300844 "2022-03-30T06:48:06Z")
--- ## [Elasticsearch filter plugin "hosts" does not fail over](https://discuss.elastic.co/t/elasticsearch-filter-plugin-hosts-does-not-fail-over/299048)
**Author:** [@Zhang\_Jun\_Wu](https://discuss.elastic.co/u/Zhang_Jun_Wu)\ **Replies:** 1\ **Last updated:** [March 30, 2022, 6:37am UTC](https://discuss.elastic.co/t/elasticsearch-filter-plugin-hosts-does-not-fail-over/299048 "2022-03-30T06:37:53Z")
Hi, I am trying logstash 7.17.1 with a two-node es cluster (es 7.17.0), which are running on localhost:9200 and localhost:9201. Both logstash and Elasticsearch are running on same windows machine. I have written a simpl… [Previous page](https://discuss.elastic.co/latest.md?page=1193) [Next page](https://discuss.elastic.co/latest.md?page=1195)