# Latest **URL:** https://discuss.elastic.co/latest.md?page=1226 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1227 --- ## [Mutate gsub pattern help for filter](https://discuss.elastic.co/t/mutate-gsub-pattern-help-for-filter/299020)
**Author:** [@itschobot](https://discuss.elastic.co/u/itschobot)\ **Replies:** 6\ **Last updated:** [March 8, 2022, 10:54pm UTC](https://discuss.elastic.co/t/mutate-gsub-pattern-help-for-filter/299020 "2022-03-08T22:54:13Z")
Hello, still new using regular expressions I currently am working on this to parse in my "message": {"groupByActivity":false,"exampleDevices":\[{"ip":"1.2.3.4","hostname":"example.hostname.com","sid":123456,"subnet":"som… --- ## [How to increase disk capacity of elasticsearch nodes?](https://discuss.elastic.co/t/how-to-increase-disk-capacity-of-elasticsearch-nodes/298951)
**Author:** [@RusseL](https://discuss.elastic.co/u/RusseL)\ **Replies:** 1\ **Last updated:** [March 8, 2022, 10:44pm UTC](https://discuss.elastic.co/t/how-to-increase-disk-capacity-of-elasticsearch-nodes/298951 "2022-03-08T22:44:03Z")
Hello everyone, I want to increase the disk capacity of Elasticsearch data nodes. For this, I expect it to forward the shards on the node to other nodes using "cluster.routing.allocation.exclude.\_ip":"192.168.x.x" first.… --- ## [Elastic agent enrolled but not sending any data](https://discuss.elastic.co/t/elastic-agent-enrolled-but-not-sending-any-data/298957)
**Author:** [@Youssef\_Kaak](https://discuss.elastic.co/u/Youssef_Kaak)\ **Replies:** 0\ **Last updated:** [March 7, 2022, 11:07am UTC](https://discuss.elastic.co/t/elastic-agent-enrolled-but-not-sending-any-data/298957 "2022-03-07T11:07:21Z")
Hey everyone, I have recently started to work ELK and my mission is to mainly deploy the stack and use it as a SIEM. I am using agents for data collection instead of Beats. I have enrolled one agent on a remote machine… --- ## [Snapshot retention policy](https://discuss.elastic.co/t/snapshot-retention-policy/299059)
**Author:** [@Nicole\_Hirshler](https://discuss.elastic.co/u/Nicole_Hirshler)\ **Replies:** 0\ **Last updated:** [March 8, 2022, 8:57am UTC](https://discuss.elastic.co/t/snapshot-retention-policy/299059 "2022-03-08T08:57:05Z")
I'm not sure I understand how snapshots are working. I see that all snapshots are taken without errors according to the policy I have defined, but I do not see that old snapshots are ever deleted. You can see in the att… --- ## [Two Kibana instance on one single Elasticsearch cluster pointing at different Indexes](https://discuss.elastic.co/t/two-kibana-instance-on-one-single-elasticsearch-cluster-pointing-at-different-indexes/299002)
**Author:** [@siemdude](https://discuss.elastic.co/u/siemdude)\ **Replies:** 3\ **Last updated:** [March 8, 2022, 10:11pm UTC](https://discuss.elastic.co/t/two-kibana-instance-on-one-single-elasticsearch-cluster-pointing-at-different-indexes/299002 "2022-03-08T22:11:09Z")
I am trying to create two Kibana on top of a single Elasticsearch cluster. I want to separate data at Kibana level instead of Spaces. Is it possible with Kibana Cloud? Which fields to configure to separate specific indic… --- ## [No output from json line delimited file](https://discuss.elastic.co/t/no-output-from-json-line-delimited-file/299092)
**Author:** [@theflakes](https://discuss.elastic.co/u/theflakes)\ **Replies:** 2\ **Last updated:** [March 8, 2022, 9:33pm UTC](https://discuss.elastic.co/t/no-output-from-json-line-delimited-file/299092 "2022-03-08T21:33:10Z")
I'm trying to get Logstash 8 working with a config that works in Logstash 7. I'm not getting any output even though it works fine in v7. If I remove all the filters, I still do not get any output. When I run LS in debut … --- ## [🎉 Elastic Stack 8.1 released](https://discuss.elastic.co/t/elastic-stack-8-1-released/299146)
**Author:** [@elyssaemrich](https://discuss.elastic.co/u/elyssaemrich)\ **Replies:** 0\ **Last updated:** [March 8, 2022, 9:32pm UTC](https://discuss.elastic.co/t/elastic-stack-8-1-released/299146 "2022-03-08T21:32:12Z")
New in Elastic 8.1 Elastic 8.1 enables our customers and community to further accelerate software development lifecycles with deeper visibility into both serverless architectures and CI/CD pipelines. In addition, Elastic… --- ## [Problem overwriting field using json filter plugin](https://discuss.elastic.co/t/problem-overwriting-field-using-json-filter-plugin/299132)
**Author:** [@tstrul](https://discuss.elastic.co/u/tstrul)\ **Replies:** 3\ **Last updated:** [March 8, 2022, 9:17pm UTC](https://discuss.elastic.co/t/problem-overwriting-field-using-json-filter-plugin/299132 "2022-03-08T21:17:10Z")
Hey, I have a log that i want to parse as json. field is "log" I want to decode json but use the same field as the orig message. when i try: json { source =\> "log" target =\> "log" } Im ge… --- ## [Update doc only if doc changes? noop?](https://discuss.elastic.co/t/update-doc-only-if-doc-changes-noop/299040)
**Author:** [@andy4324](https://discuss.elastic.co/u/andy4324)\ **Replies:** 4\ **Last updated:** [March 8, 2022, 7:02pm UTC](https://discuss.elastic.co/t/update-doc-only-if-doc-changes-noop/299040 "2022-03-08T19:02:54Z")
Hi ES team, newbie ES user. We have a use case where we want to store signals from various hosts inside ES (as documents of course) and query them later based on a specific field value. Each event might have different fi… --- ## [Updating existing Beats deployment from 7.11.1.0 to 7.16.3](https://discuss.elastic.co/t/updating-existing-beats-deployment-from-7-11-1-0-to-7-16-3/299136)
**Author:** [@iamfrakk](https://discuss.elastic.co/u/iamfrakk)\ **Replies:** 0\ **Last updated:** [March 8, 2022, 6:58pm UTC](https://discuss.elastic.co/t/updating-existing-beats-deployment-from-7-11-1-0-to-7-16-3/299136 "2022-03-08T18:58:35Z")
Hello, I am trying to push out the "Beats" agents into a Windows environment (Servers & Client systems) I will be using SCCM to perform this deployment, and I have found the PowerShell script that Elastic has provided, … --- ## [Upgrade to 8.0.0 failed](https://discuss.elastic.co/t/upgrade-to-8-0-0-failed/298998)
**Author:** [@rp346](https://discuss.elastic.co/u/rp346)\ **Replies:** 2\ **Last updated:** [March 8, 2022, 6:57pm UTC](https://discuss.elastic.co/t/upgrade-to-8-0-0-failed/298998 "2022-03-08T18:57:36Z")
I am running Elasticsearch 7.17.0 in EKS. Under /app/management/stack/upgrade\_assistant/es\_deprecations I see following I updated config to kind: StatefulSet apiVersion: apps/v1 metadata: name: es-master namespa… --- ## [Can't get logstash to work with Elastic 8.01](https://discuss.elastic.co/t/cant-get-logstash-to-work-with-elastic-8-01/298838)
**Author:** [@kim\_frederiksen](https://discuss.elastic.co/u/kim_frederiksen)\ **Replies:** 3\ **Last updated:** [March 8, 2022, 6:37pm UTC](https://discuss.elastic.co/t/cant-get-logstash-to-work-with-elastic-8-01/298838 "2022-03-08T18:37:00Z")
Hi Everybody, I am extremely new to ELK and have yet to build the first real solution on the platform. We have had version 7.16.1 and we could see the logs from filebeat in kibana. But before we really begin building st… --- ## [Ensure a healthy Elasticsearch cluster is running at https://172.19.0.2:9200 for user elastic](https://discuss.elastic.co/t/ensure-a-healthy-elasticsearch-cluster-is-running-at-https-172-19-0-2-9200-for-user-elastic/299121)
**Author:** [@suminlim](https://discuss.elastic.co/u/suminlim)\ **Replies:** 1\ **Last updated:** [March 8, 2022, 5:46pm UTC](https://discuss.elastic.co/t/ensure-a-healthy-elasticsearch-cluster-is-running-at-https-172-19-0-2-9200-for-user-elastic/299121 "2022-03-08T17:46:29Z")
Ensure a healthy Elasticsearch cluster is running at https://172.19.0.2:9200 for user elastic. When I run docker of enterprise-search, it fails to run with this message when I entered on Kibana http://kibana-url:5601/… --- ## [Running ELK on docker, Kibana says: Unable to retrieve version information from Elasticsearch nodes](https://discuss.elastic.co/t/running-elk-on-docker-kibana-says-unable-to-retrieve-version-information-from-elasticsearch-nodes/298220)
**Author:** [@Rajesh\_Singh](https://discuss.elastic.co/u/Rajesh_Singh)\ **Replies:** 1\ **Last updated:** [March 8, 2022, 6:05pm UTC](https://discuss.elastic.co/t/running-elk-on-docker-kibana-says-unable-to-retrieve-version-information-from-elasticsearch-nodes/298220 "2022-03-08T18:05:57Z")
I was referring to example given in the Elasticsearch documentation for starting elastic stack (elastic and kibana) on docker using docker compose. It gives example of docker compose version 2.2 file. So, I tried to conv… --- ## [Lab contain Missing field](https://discuss.elastic.co/t/lab-contain-missing-field/299127)
**Author:** [@LuciusLin](https://discuss.elastic.co/u/LuciusLin)\ **Replies:** 0\ **Last updated:** [March 8, 2022, 5:58pm UTC](https://discuss.elastic.co/t/lab-contain-missing-field/299127 "2022-03-08T17:58:36Z")
Hi Hope any one can help to resolve an issue I have encountered. I am attempting the first Lab for Observability where I need to start my heartbeat.yml. Anyone can advise on the error message below? INFO instance/be… --- ## [Get Copy Post URL via API for automatic reports](https://discuss.elastic.co/t/get-copy-post-url-via-api-for-automatic-reports/299094)
**Author:** [@Agus\_Roca](https://discuss.elastic.co/u/Agus_Roca)\ **Replies:** 0\ **Last updated:** [March 8, 2022, 1:37pm UTC](https://discuss.elastic.co/t/get-copy-post-url-via-api-for-automatic-reports/299094 "2022-03-08T13:37:20Z")
Hi, i've been checking the docs and also the forum and seems like the only way to automate the generation of pdf is to first manually copy the Post URL and then, yes we have APIs to call. But I was wondering if it is pos… --- ## [Create fields from the objects that are a part of array in Logstash filter](https://discuss.elastic.co/t/create-fields-from-the-objects-that-are-a-part-of-array-in-logstash-filter/299088)
**Author:** [@Usman18](https://discuss.elastic.co/u/Usman18)\ **Replies:** 1\ **Last updated:** [March 8, 2022, 5:14pm UTC](https://discuss.elastic.co/t/create-fields-from-the-objects-that-are-a-part-of-array-in-logstash-filter/299088 "2022-03-08T17:14:43Z")
In Logstash, in my event object there is a field that is an array. This field contains objects. I have to create or add some new fields in the event object and these fields will be created on the basis of the objects tha… --- ## [Filebeat output kafka (processors)](https://discuss.elastic.co/t/filebeat-output-kafka-processors/299071)
**Author:** [@alex\_vermex](https://discuss.elastic.co/u/alex_vermex)\ **Replies:** 4\ **Last updated:** [March 8, 2022, 5:13pm UTC](https://discuss.elastic.co/t/filebeat-output-kafka-processors/299071 "2022-03-08T17:13:30Z")
Hi, I have a problem i think in "processors" , I use the output kafka so i created a topic and i send it to logstash so when i run it i just get the message when i want see path,tags,input type.... here my filebeat con… --- ## [\[Kibana\] Some plugins show yellow state in 7.16.3](https://discuss.elastic.co/t/kibana-some-plugins-show-yellow-state-in-7-16-3/297623)
**Author:** [@PEB](https://discuss.elastic.co/u/PEB)\ **Replies:** 2\ **Last updated:** [March 8, 2022, 4:36pm UTC](https://discuss.elastic.co/t/kibana-some-plugins-show-yellow-state-in-7-16-3/297623 "2022-03-08T16:36:02Z")
Similarly to https://discuss.elastic.co/t/kibana-state-become-yellow-after-upgrade-to-version-7-16-2 , we have yellow state for kibana with the same plugin list. I wonder if this is kind of a bug or is there something f… --- ## [Error in beats elastic agent container: open /hostfs/sys/fs/cgroup/io.pressure: no such file or directory](https://discuss.elastic.co/t/error-in-beats-elastic-agent-container-open-hostfs-sys-fs-cgroup-io-pressure-no-such-file-or-directory/299115)
**Author:** [@Josh-a-e](https://discuss.elastic.co/u/Josh-a-e)\ **Replies:** 0\ **Last updated:** [March 8, 2022, 4:20pm UTC](https://discuss.elastic.co/t/error-in-beats-elastic-agent-container-open-hostfs-sys-fs-cgroup-io-pressure-no-such-file-or-directory/299115 "2022-03-08T16:20:35Z")
On running an elastic agent container (docker.elastic.co/beats/elastic-agent:8.0.1) as a daemon set (configuration here - https://raw.githubusercontent.com/elastic/beats/8.0/deploy/kubernetes/elastic-agent-managed-kubern… --- ## [Logstash slow in bash script launch by cronjob](https://discuss.elastic.co/t/logstash-slow-in-bash-script-launch-by-cronjob/299103)
**Author:** [@Henri\_L](https://discuss.elastic.co/u/Henri_L)\ **Replies:** 5\ **Last updated:** [March 8, 2022, 4:18pm UTC](https://discuss.elastic.co/t/logstash-slow-in-bash-script-launch-by-cronjob/299103 "2022-03-08T16:18:58Z")
Hi I have a bash script like that: #!/bin/bash cat /home/xxx/public\_html/datas/zz/file.csv | /usr/share/logstash/bin/logstash -f /home/xxx/public\_html/datas/myconf.conf My conf file is basic like that: input { st… --- ## [Exact match for virtual product groups](https://discuss.elastic.co/t/exact-match-for-virtual-product-groups/299077)
**Author:** [@bw610](https://discuss.elastic.co/u/bw610)\ **Replies:** 1\ **Last updated:** [March 8, 2022, 4:07pm UTC](https://discuss.elastic.co/t/exact-match-for-virtual-product-groups/299077 "2022-03-08T16:07:12Z")
Hello :slight\_smile: we are using Elasticsearch for magento 2 . We also use exact match. When typing in a product number, you are directly redirected to the product group that the product is in. Now we want to create s… --- ## [Setup Fleet on Windows. I cannot get it to work at all](https://discuss.elastic.co/t/setup-fleet-on-windows-i-cannot-get-it-to-work-at-all/299095)
**Author:** [@Akon](https://discuss.elastic.co/u/Akon)\ **Replies:** 0\ **Last updated:** [March 8, 2022, 1:41pm UTC](https://discuss.elastic.co/t/setup-fleet-on-windows-i-cannot-get-it-to-work-at-all/299095 "2022-03-08T13:41:47Z")
Hello, I cant seem to get Elastic Fleet Server to run on Windows. I tried the official and this solution aswell. We have set up security with a certificate but every possible way does not seem to work. I used this co… --- ## [Composite Aggregation](https://discuss.elastic.co/t/composite-aggregation/299112)
**Author:** [@Alessio\_Creo](https://discuss.elastic.co/u/Alessio_Creo)\ **Replies:** 0\ **Last updated:** [March 8, 2022, 3:45pm UTC](https://discuss.elastic.co/t/composite-aggregation/299112 "2022-03-08T15:45:21Z")
Hi there, I would like to know how the composite aggregations works exactly. Do they open a context with a TTL taking a "snapshot" of the index just like scroll? If so, for the same number of buckets are the performan… --- ## [Indexing problems with GDAL/ogr2ogr for GEO\_POINT of geojson files](https://discuss.elastic.co/t/indexing-problems-with-gdal-ogr2ogr-for-geo-point-of-geojson-files/298856)
**Author:** [@Jordi\_Piqueras\_Bauti](https://discuss.elastic.co/u/Jordi_Piqueras_Bauti)\ **Replies:** 3\ **Last updated:** [March 8, 2022, 3:44pm UTC](https://discuss.elastic.co/t/indexing-problems-with-gdal-ogr2ogr-for-geo-point-of-geojson-files/298856 "2022-03-08T15:44:09Z")
I am having problem indexing Geojson files that have Point geometries using GDAL/ogr2ogr library. Points are not being indexed in the same way as if I am doing uploading geojson file with Kibana. With ogr2ogr I am havi… --- ## [Blocking call in new async Java API Client?](https://discuss.elastic.co/t/blocking-call-in-new-async-java-api-client/299021)
**Author:** [@CletusTSJY](https://discuss.elastic.co/u/CletusTSJY)\ **Replies:** 2\ **Last updated:** [March 8, 2022, 3:24pm UTC](https://discuss.elastic.co/t/blocking-call-in-new-async-java-api-client/299021 "2022-03-08T15:24:39Z")
I'm trying to migrate from the old RestHighLevelClient to the new Java API Client (v7.16.0) in a Spring Webflux project. With the old client I was able to convert the response to a Mono\<\> using the client's listener mech… --- ## [No Data displaying in the System Windows Security Dashboard from Fleet Data Stream](https://discuss.elastic.co/t/no-data-displaying-in-the-system-windows-security-dashboard-from-fleet-data-stream/298869)
**Author:** [@francescouk](https://discuss.elastic.co/u/francescouk)\ **Replies:** 0\ **Last updated:** [March 4, 2022, 5:27pm UTC](https://discuss.elastic.co/t/no-data-displaying-in-the-system-windows-security-dashboard-from-fleet-data-stream/298869 "2022-03-04T17:27:50Z")
Hello there, I configured the whole elk stack but for some reason I cannot see any data on dashboards provided by fleet data stream. That´s really strange coz I can see the logs coming throught: But when I click to … --- ## [Issue with index name](https://discuss.elastic.co/t/issue-with-index-name/299100)
**Author:** [@humartinez](https://discuss.elastic.co/u/humartinez)\ **Replies:** 1\ **Last updated:** [March 8, 2022, 3:18pm UTC](https://discuss.elastic.co/t/issue-with-index-name/299100 "2022-03-08T15:18:20Z")
Hi, I can't change my index name im using filebeat 7.14.1 and filebeat won't change my index name to the one that I have in my config The docs are idexed to filebeat-7.14.1, pleas what am I doing wrong in here output.… --- ## [Heartbeat: Populate monitor.name from field value](https://discuss.elastic.co/t/heartbeat-populate-monitor-name-from-field-value/299010)
**Author:** [@Jeff\_Morton](https://discuss.elastic.co/u/Jeff_Morton)\ **Replies:** 2\ **Last updated:** [March 8, 2022, 2:26pm UTC](https://discuss.elastic.co/t/heartbeat-populate-monitor-name-from-field-value/299010 "2022-03-08T14:26:31Z")
Greetings, I'm trying to dynamically populate the heartbeat monitor name (monitor.name field) dynamically from a predefined kubernetes label. I've attempted using the copy\_field processor, but this doesn't appear to wo… --- ## [Querying Elasticsearch Arrays with NEST and gRPC protos](https://discuss.elastic.co/t/querying-elasticsearch-arrays-with-nest-and-grpc-protos/299102)
**Author:** [@simobrusch](https://discuss.elastic.co/u/simobrusch)\ **Replies:** 0\ **Last updated:** [March 8, 2022, 2:13pm UTC](https://discuss.elastic.co/t/querying-elasticsearch-arrays-with-nest-and-grpc-protos/299102 "2022-03-08T14:13:20Z")
My goal is to return a result of a search query to the user. This is done by querying a list of objects in Elasticsearch with a custom search parameter in a dotnet 6 webapi project using gRPC proto files and NEST. My pr… [Previous page](https://discuss.elastic.co/latest.md?page=1225) [Next page](https://discuss.elastic.co/latest.md?page=1227)