# Latest **URL:** https://discuss.elastic.co/latest.md?page=1207 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1208 --- ## [Can't use exception lists](https://discuss.elastic.co/t/cant-use-exception-lists/299635)
**Author:** [@bolemebrige](https://discuss.elastic.co/u/bolemebrige)\ **Replies:** 4\ **Last updated:** [March 22, 2022, 10:13am UTC](https://discuss.elastic.co/t/cant-use-exception-lists/299635 "2022-03-22T10:13:54Z")
After adding value lists through API or kibana interface they are not shown in Kibana and can't be added as exception to rules. If I update rule with exception list using API, it is shown in rule exceptions (but doesn't… --- ## [Auto-configuration of ssl certificate](https://discuss.elastic.co/t/auto-configuration-of-ssl-certificate/300306)
**Author:** [@itsecworks](https://discuss.elastic.co/u/itsecworks)\ **Replies:** 1\ **Last updated:** [March 22, 2022, 10:05am UTC](https://discuss.elastic.co/t/auto-configuration-of-ssl-certificate/300306 "2022-03-22T10:05:30Z")
I dont find the CA private key of the transport layer that has been generated by Elasticsearch at first start. I can find the CA private key of the http layer its in the generated http.p12 file, I would expect the simil… --- ## [Logstash working from cli, but not whilst running as a service](https://discuss.elastic.co/t/logstash-working-from-cli-but-not-whilst-running-as-a-service/300309)
**Author:** [@conor\_c](https://discuss.elastic.co/u/conor_c)\ **Replies:** 0\ **Last updated:** [March 22, 2022, 10:02am UTC](https://discuss.elastic.co/t/logstash-working-from-cli-but-not-whilst-running-as-a-service/300309 "2022-03-22T10:02:45Z")
Hi, I'm running Logstash and Filebeat with what I believe to be simple configurations. I have two syslog listeners, one on UDP 9001 and one on UDP 9002. When running Logstash as a service and when sending logs to 9001,… --- ## [Huge indexing (refresh) performance drop when upgrading from ES 2.4 to ES 7.16](https://discuss.elastic.co/t/huge-indexing-refresh-performance-drop-when-upgrading-from-es-2-4-to-es-7-16/299479)
**Author:** [@daniel-kr](https://discuss.elastic.co/u/daniel-kr)\ **Replies:** 1\ **Last updated:** [March 22, 2022, 9:31am UTC](https://discuss.elastic.co/t/huge-indexing-refresh-performance-drop-when-upgrading-from-es-2-4-to-es-7-16/299479 "2022-03-22T09:31:25Z")
Hello, we updated our system from ES 2.4 to ES 7.16 some time ago. Now we recognized that there is a huge indexing performance drop when it comes to a very special use case that we have. The use case is as follows: We … --- ## [Discoverにおけるハイフンを含む文字列の検索について](https://discuss.elastic.co/t/discover/299817)
**Author:** [@t-nakata](https://discuss.elastic.co/u/t-nakata)\ **Replies:** 1\ **Last updated:** [March 22, 2022, 9:13am UTC](https://discuss.elastic.co/t/discover/299817 "2022-03-22T09:13:23Z")
ドキュメント内のあるフィールドに、ハイフンを含む文字列があります。 フィールド名：fieldA 値：su su-l su-a Discover画面にて前方一致で「su-」から始まるものを検索したいのですが、想定通りの検索が出来ませんでした。 下記、Discoverでの指定条件と結果になります。 fieldA:"su-l" →su-lのフィールドのみマッチ fieldA:"su\*" →su、su-l、su-aがマッチ f… --- ## [Logstash to process multiple files of large size?](https://discuss.elastic.co/t/logstash-to-process-multiple-files-of-large-size/300299)
**Author:** [@Shreesh\_Narayanan](https://discuss.elastic.co/u/Shreesh_Narayanan)\ **Replies:** 0\ **Last updated:** [March 22, 2022, 8:43am UTC](https://discuss.elastic.co/t/logstash-to-process-multiple-files-of-large-size/300299 "2022-03-22T08:43:14Z")
Hello, To give a little bit of context, i have 3 VMs , each of 16 CPU cores out of which 2 are of 16GB RAM (they host Elasticsearch and kibana + a flask app, that provides a front end for the user to input the machineip… --- ## [Getting error : jdk-17.0.2 was unexpected at this time](https://discuss.elastic.co/t/getting-error-jdk-17-0-2-was-unexpected-at-this-time/300300)
**Author:** [@yahire](https://discuss.elastic.co/u/yahire)\ **Replies:** 0\ **Last updated:** [March 22, 2022, 8:45am UTC](https://discuss.elastic.co/t/getting-error-jdk-17-0-2-was-unexpected-at-this-time/300300 "2022-03-22T08:45:30Z")
While starting Elasticsearch.bat in my windows system, i am getting following error : D:\\Elastic APM\\Elasticsearch-8.1.0\\Elasticsearch-8.1.0\\bin\>Elasticsearch.bat \\jdk-17.0.2 was unexpected at this time. I am having J… --- ## [Send logs from remote server on the same network](https://discuss.elastic.co/t/send-logs-from-remote-server-on-the-same-network/300052)
**Author:** [@Arraso26](https://discuss.elastic.co/u/Arraso26)\ **Replies:** 1\ **Last updated:** [March 22, 2022, 8:35am UTC](https://discuss.elastic.co/t/send-logs-from-remote-server-on-the-same-network/300052 "2022-03-22T08:35:22Z")
Good, I want to send the logs from a server to this one but the logs don't arrive, I show you the files to see if you can help me. sudo cat /etc/logstash/conf.d/30-Elasticsearch-output.conf \> output { \> elasticsearch… --- ## [Visualization of requirement fulfillment during release tests](https://discuss.elastic.co/t/visualization-of-requirement-fulfillment-during-release-tests/300296)
**Author:** [@nikaes](https://discuss.elastic.co/u/nikaes)\ **Replies:** 0\ **Last updated:** [March 22, 2022, 8:26am UTC](https://discuss.elastic.co/t/visualization-of-requirement-fulfillment-during-release-tests/300296 "2022-03-22T08:26:58Z")
Hi All, I am quite new to Kibana and having some trouble in visualization of a use case. I would like to show a percentage how much of a Requirement is currently covered by tests. Simply I am feeding Elastic with fol… --- ## [Help: Only winlogbeat index with date being created](https://discuss.elastic.co/t/help-only-winlogbeat-index-with-date-being-created/300284)
**Author:** [@roman-tasi](https://discuss.elastic.co/u/roman-tasi)\ **Replies:** 2\ **Last updated:** [March 22, 2022, 8:17am UTC](https://discuss.elastic.co/t/help-only-winlogbeat-index-with-date-being-created/300284 "2022-03-22T08:17:26Z")
This is my current output: output { if \[type\]=="syslog" { elasticsearch { hosts =\> \["localhost:9200"\] index =\> "logstash-%{+yyyy.MM.dd}" } … --- ## [Data extraction, Watcher - CSV export with relative time period](https://discuss.elastic.co/t/data-extraction-watcher-csv-export-with-relative-time-period/300287)
**Author:** [@AQ\_Amra](https://discuss.elastic.co/u/AQ_Amra)\ **Replies:** 0\ **Last updated:** [March 22, 2022, 7:54am UTC](https://discuss.elastic.co/t/data-extraction-watcher-csv-export-with-relative-time-period/300287 "2022-03-22T07:54:42Z")
Hi, I am attempting to extract a CSV of data from ES/Kibana every hour. I've configured a watcher task which runs hourly, and emails a CSV file (based on the discover POST URL form here Automatically generate reports |… --- ## [It was found that users could not generate a report CSV or download logs from the dashboard](https://discuss.elastic.co/t/it-was-found-that-users-could-not-generate-a-report-csv-or-download-logs-from-the-dashboard/298174)
**Author:** [@Bhanuji\_paluri](https://discuss.elastic.co/u/Bhanuji_paluri)\ **Replies:** 2\ **Last updated:** [March 22, 2022, 7:53am UTC](https://discuss.elastic.co/t/it-was-found-that-users-could-not-generate-a-report-csv-or-download-logs-from-the-dashboard/298174 "2022-03-22T07:53:25Z")
HI Team, It was found that users could not generate a report CSV or download logs from the dashboard, teps to Reproduce Search for logs in Kibana Discover dashboard Attempt to download those logs: Click 'Save' to s… --- ## [Kibana start fail with the error \[ERROR\]\[savedobjects-service\] \[.kibana\_task\_manager\] Action failed with 'security\_exception](https://discuss.elastic.co/t/kibana-start-fail-with-the-error-error-savedobjects-service-kibana-task-manager-action-failed-with-security-exception/300286)
**Author:** [@jack\_jack](https://discuss.elastic.co/u/jack_jack)\ **Replies:** 0\ **Last updated:** [March 22, 2022, 7:48am UTC](https://discuss.elastic.co/t/kibana-start-fail-with-the-error-error-savedobjects-service-kibana-task-manager-action-failed-with-security-exception/300286 "2022-03-22T07:48:09Z")
when i start kibana ,i get the error \[2022-03-22T07:38:57.371+00:00\]\[INFO \]\[savedobjects-service\] \[.kibana\] UPDATE\_TARGET\_MAPPINGS -\> UPDATE\_TARGET\_MAPPINGS. took: 32015ms. \[2022-03-22T07:38:57.372+00:00\]\[ERROR\]\[savedob… --- ## [Load balanced access to fleet servers](https://discuss.elastic.co/t/load-balanced-access-to-fleet-servers/300210)
**Author:** [@fuphil](https://discuss.elastic.co/u/fuphil)\ **Replies:** 2\ **Last updated:** [March 22, 2022, 7:10am UTC](https://discuss.elastic.co/t/load-balanced-access-to-fleet-servers/300210 "2022-03-22T07:10:41Z")
Hi, I have setup 2 fleet servers successfully and want all additional elastic agents to connect to them via loadbalanced IP (haproxy with "round robin" option). Whenever I configure the loadbalanced URL instead of the … --- ## [How to get Id of a dashboard to export?](https://discuss.elastic.co/t/how-to-get-id-of-a-dashboard-to-export/300266)
**Author:** [@gokulnath112](https://discuss.elastic.co/u/gokulnath112)\ **Replies:** 0\ **Last updated:** [March 22, 2022, 5:11am UTC](https://discuss.elastic.co/t/how-to-get-id-of-a-dashboard-to-export/300266 "2022-03-22T05:11:12Z")
Hi Team, Greetings, Hope everyone doing good. I want to make dashboard as part of build. So that I tried to export dashboard via CURL and trying to import via CURL. It was working fine in 6.8. But when I migrate to 7.17… --- ## [Logstash count events using ruby filter](https://discuss.elastic.co/t/logstash-count-events-using-ruby-filter/300256)
**Author:** [@gnam](https://discuss.elastic.co/u/gnam)\ **Replies:** 4\ **Last updated:** [March 22, 2022, 4:56am UTC](https://discuss.elastic.co/t/logstash-count-events-using-ruby-filter/300256 "2022-03-22T04:56:58Z")
I have following pipeline (example, not full pipeline) where I need count the number of events for EVERY file I am writing as output. For example, this pipleline creates new file every 30 seconds with the events processe… --- ## [Can't sum bucket after composite](https://discuss.elastic.co/t/cant-sum-bucket-after-composite/300184)
**Author:** [@Techinp](https://discuss.elastic.co/u/Techinp)\ **Replies:** 4\ **Last updated:** [March 22, 2022, 3:21am UTC](https://discuss.elastic.co/t/cant-sum-bucket-after-composite/300184 "2022-03-22T03:21:30Z")
Hi all, How can I sum data after composite stage? What did I do wrong? This is my query GET report-20220316/\_search { "query": { "bool": { "must": \[ { "match": { "parentId.ke… --- ## [How to Identify the Container Name When Collecting Container Logs?](https://discuss.elastic.co/t/how-to-identify-the-container-name-when-collecting-container-logs/300260)
**Author:** [@wajika](https://discuss.elastic.co/u/wajika)\ **Replies:** 1\ **Last updated:** [March 22, 2022, 2:46am UTC](https://discuss.elastic.co/t/how-to-identify-the-container-name-when-collecting-container-logs/300260 "2022-03-22T02:46:32Z")
Currently I use filebeat 7.16.3 and it runs on a kubernetes 1.20 cluster (docker runtime). I use the following configuration to collect container logs, but I found that FB does not recognize the container name correspond… --- ## [ElasticSearch Nest syntax for Script based sorting with SortDescriptor](https://discuss.elastic.co/t/elasticsearch-nest-syntax-for-script-based-sorting-with-sortdescriptor/300255)
**Author:** [@aashini](https://discuss.elastic.co/u/aashini)\ **Replies:** 0\ **Last updated:** [March 21, 2022, 11:55pm UTC](https://discuss.elastic.co/t/elasticsearch-nest-syntax-for-script-based-sorting-with-sortdescriptor/300255 "2022-03-21T23:55:05Z")
I am using Elasticsearch Nest client in .Net application and looking for a syntax to use script based sorting with Sort Descriptor. So what would be the sorting syntax to add Params and painless Language with SortDescri… --- ## [Kibana 7.5.2 to 7.17.0 Migration Failure - Migration of Saved Objects Failure](https://discuss.elastic.co/t/kibana-7-5-2-to-7-17-0-migration-failure-migration-of-saved-objects-failure/300126)
**Author:** [@anburethy](https://discuss.elastic.co/u/anburethy)\ **Replies:** 3\ **Last updated:** [March 21, 2022, 11:40pm UTC](https://discuss.elastic.co/t/kibana-7-5-2-to-7-17-0-migration-failure-migration-of-saved-objects-failure/300126 "2022-03-21T23:40:39Z")
Hi, I am migrating Kibana from 7.5.2 to 7.17.0 and getting the following error when doing so. Kibana isnt starting up due to this failure and hence migration fails. {"type":"log","@timestamp":"2022-03-20T12:32:03+00:00"… --- ## [Service Entry for TCP URL's](https://discuss.elastic.co/t/service-entry-for-tcp-urls/300253)
**Author:** [@Prabakar](https://discuss.elastic.co/u/Prabakar)\ **Replies:** 0\ **Last updated:** [March 21, 2022, 10:25pm UTC](https://discuss.elastic.co/t/service-entry-for-tcp-urls/300253 "2022-03-21T22:25:54Z")
We are using elastic enterprise edition. We are in the process of enabling the Cross Cluster Replication across different clusters. So we are adding service entries on gateway level (ISTION Gateway for example). Below on… --- ## [Ulimits for elasticsearch instances](https://discuss.elastic.co/t/ulimits-for-elasticsearch-instances/300189)
**Author:** [@INS](https://discuss.elastic.co/u/INS)\ **Replies:** 7\ **Last updated:** [March 21, 2022, 10:16pm UTC](https://discuss.elastic.co/t/ulimits-for-elasticsearch-instances/300189 "2022-03-21T22:16:54Z")
Hi I'm facing with issue related to configuration with resource limits. On the host I've 18 nodes with Elasticsearch (build over docker-compose) I have taken the following into consideration setting from elastic doc (… --- ## [Update field on all SIEM detection Rules in one go](https://discuss.elastic.co/t/update-field-on-all-siem-detection-rules-in-one-go/299862)
**Author:** [@mangeshmj1992](https://discuss.elastic.co/u/mangeshmj1992)\ **Replies:** 5\ **Last updated:** [March 21, 2022, 10:10pm UTC](https://discuss.elastic.co/t/update-field-on-all-siem-detection-rules-in-one-go/299862 "2022-03-21T22:10:29Z")
Hello all, We have created almost 400 + security rule under SIEM tab in Kibana. Now the new requirement come like they need to update one common field present in all the 400 rules. Can any one guide me how to achieve t… --- ## [Setting for node.roles](https://discuss.elastic.co/t/setting-for-node-roles/298709)
**Author:** [@INS](https://discuss.elastic.co/u/INS)\ **Replies:** 3\ **Last updated:** [March 21, 2022, 9:15pm UTC](https://discuss.elastic.co/t/setting-for-node-roles/298709 "2022-03-21T21:15:28Z")
Hi What the value should be set up for taking part for node as a coordinator ??? I saw an article about node.roles but it's not clear enough, (it should be empty field?) --- ## [Recommendation or best practice for monitoring SystemD service state](https://discuss.elastic.co/t/recommendation-or-best-practice-for-monitoring-systemd-service-state/296075)
**Author:** [@yelloyonder](https://discuss.elastic.co/u/yelloyonder)\ **Replies:** 4\ **Last updated:** [March 21, 2022, 8:56pm UTC](https://discuss.elastic.co/t/recommendation-or-best-practice-for-monitoring-systemd-service-state/296075 "2022-03-21T20:56:02Z")
Hello, I would like to generate an alert if a service is not running, but I can't see a straight forward way to do this. I can monitor the process the service starts up, but I was curious if there was a good way to mon… --- ## [Logstash processing gz file and sending logs to Elasticsearch](https://discuss.elastic.co/t/logstash-processing-gz-file-and-sending-logs-to-elasticsearch/300112)
**Author:** [@wallace84](https://discuss.elastic.co/u/wallace84)\ **Replies:** 1\ **Last updated:** [March 21, 2022, 8:45pm UTC](https://discuss.elastic.co/t/logstash-processing-gz-file-and-sending-logs-to-elasticsearch/300112 "2022-03-21T20:45:23Z")
Hi, I am trying to do a test sending gz format logs from Logstash to Elasticsearch, do you know about a possible simple config file I could use to process the logs that use time stamps? The filter requires a bit of cus… --- ## [Filebeat keystore automation](https://discuss.elastic.co/t/filebeat-keystore-automation/300243)
**Author:** [@craign30](https://discuss.elastic.co/u/craign30)\ **Replies:** 0\ **Last updated:** [March 21, 2022, 7:10pm UTC](https://discuss.elastic.co/t/filebeat-keystore-automation/300243 "2022-03-21T19:10:03Z")
Is it possible to automate the password entry when creating a filebeat keystore via PowerShell? I'm running the command '.\\filebeat keystore add ES\_PWD', and when prompted to 'Enter value for ES\_PWD', I'd like this to a… --- ## [ElasticApmModule Auto Instrumentation does not check if Agent.IsConfigured](https://discuss.elastic.co/t/elasticapmmodule-auto-instrumentation-does-not-check-if-agent-isconfigured/300241)
**Author:** [@LeeJW1987](https://discuss.elastic.co/u/LeeJW1987)\ **Replies:** 0\ **Last updated:** [March 21, 2022, 6:34pm UTC](https://discuss.elastic.co/t/elasticapmmodule-auto-instrumentation-does-not-check-if-agent-isconfigured/300241 "2022-03-21T18:34:36Z")
APM Agent language and version: Elastic.Apm 1.12.1 Hi. I've been following the guide to setup Apm on .NET Framework 4.8: ASP.NET | APM .NET Agent Reference \[1.12\] | Elastic I'm using the auto instrumentation by adding… --- ## [Unable to convert a field from string to integer that is dynamically generated in Logstash filter](https://discuss.elastic.co/t/unable-to-convert-a-field-from-string-to-integer-that-is-dynamically-generated-in-logstash-filter/300224)
**Author:** [@Usman18](https://discuss.elastic.co/u/Usman18)\ **Replies:** 1\ **Last updated:** [March 21, 2022, 6:45pm UTC](https://discuss.elastic.co/t/unable-to-convert-a-field-from-string-to-integer-that-is-dynamically-generated-in-logstash-filter/300224 "2022-03-21T18:45:03Z")
I am adding a field in my event data point in Logstash filter. The name of the field is created dynamically based on the value of the other field. The code can be seen below which I am using to add this field mutate { … --- ## [Filebeat is not collecting logs from pods/kubernetes](https://discuss.elastic.co/t/filebeat-is-not-collecting-logs-from-pods-kubernetes/299980)
**Author:** [@marone](https://discuss.elastic.co/u/marone)\ **Replies:** 1\ **Last updated:** [March 21, 2022, 6:43pm UTC](https://discuss.elastic.co/t/filebeat-is-not-collecting-logs-from-pods-kubernetes/299980 "2022-03-21T18:43:01Z")
Hey, I am using Docker-desktop 4.6.0 (75818) on windows 10 \[version 10.0.19042.1526\], trying to set up Observability in a Kubernetes context, I have two application running (spring boot application + react app) I set up … [Previous page](https://discuss.elastic.co/latest.md?page=1206) [Next page](https://discuss.elastic.co/latest.md?page=1208)