# Latest **URL:** https://discuss.elastic.co/latest.md?page=1228 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1229 --- ## [Functionbeat Cannot index event - security\_exception](https://discuss.elastic.co/t/functionbeat-cannot-index-event-security-exception/299016)
**Author:** [@carl0s](https://discuss.elastic.co/u/carl0s)\ **Replies:** 0\ **Last updated:** [March 7, 2022, 11:05pm UTC](https://discuss.elastic.co/t/functionbeat-cannot-index-event-security-exception/299016 "2022-03-07T23:05:40Z")
After upgrading to 7.17 none of my logs are being processed, lots of 403 errors: { "type": "security\_exception", "reason": "action \[indices:data/write/bulk\[s\]\] is unauthorized for API key id \[\\] of user … --- ## [Cannot convert created field to integer](https://discuss.elastic.co/t/cannot-convert-created-field-to-integer/299005)
**Author:** [@aerodynamic](https://discuss.elastic.co/u/aerodynamic)\ **Replies:** 6\ **Last updated:** [March 7, 2022, 10:00pm UTC](https://discuss.elastic.co/t/cannot-convert-created-field-to-integer/299005 "2022-03-07T22:00:25Z")
Currently I'm dealing with a situation where a field name is dynamically created and needs to be set to an integer like so mutate { add\_field =\> { "%{fieldName}" =\> "%{dataInteger}" } convert … --- ## [Logstash pipeline processing](https://discuss.elastic.co/t/logstash-pipeline-processing/298921)
**Author:** [@KarlWolf](https://discuss.elastic.co/u/KarlWolf)\ **Replies:** 5\ **Last updated:** [March 7, 2022, 9:52pm UTC](https://discuss.elastic.co/t/logstash-pipeline-processing/298921 "2022-03-07T21:52:43Z")
Hello, I am having a problem with Logstash configuration. I can't get rid with pipelines configuraton. My scenario: logstash.yml - only lines which are uncommented/changed path.data: /usr/share/logstash pipeline.worke… --- ## [ML datafeed bucket aggregation/script challenge](https://discuss.elastic.co/t/ml-datafeed-bucket-aggregation-script-challenge/297552)
**Author:** [@rcowart](https://discuss.elastic.co/u/rcowart)\ **Replies:** 6\ **Last updated:** [March 7, 2022, 9:35pm UTC](https://discuss.elastic.co/t/ml-datafeed-bucket-aggregation-script-challenge/297552 "2022-03-07T21:35:41Z")
I would like to create an anomaly detection job for the ratio of two counts. The logic is as follows... A = count filtered by condition X B = count filtered by condition Y C = A/B The datafeed would need to produce C… --- ## [Issue with installing metric beat & collecting data](https://discuss.elastic.co/t/issue-with-installing-metric-beat-collecting-data/298855)
**Author:** [@Vinay\_Menon1](https://discuss.elastic.co/u/Vinay_Menon1)\ **Replies:** 4\ **Last updated:** [March 7, 2022, 9:08pm UTC](https://discuss.elastic.co/t/issue-with-installing-metric-beat-collecting-data/298855 "2022-03-07T21:08:07Z")
Hi, Please help I am trying to execute this PowerShell script in my windows system to get Metricbeat data to elastic but it does not work as intended , The script runs properly by downloading the metric beat file to c:\\… --- ## [Multiline grok filter not working with specific log](https://discuss.elastic.co/t/multiline-grok-filter-not-working-with-specific-log/298923)
**Author:** [@Mihailo\_Stanarevic](https://discuss.elastic.co/u/Mihailo_Stanarevic)\ **Replies:** 2\ **Last updated:** [March 7, 2022, 8:42pm UTC](https://discuss.elastic.co/t/multiline-grok-filter-not-working-with-specific-log/298923 "2022-03-07T20:42:49Z")
Hello, I have logs that i have to process that look something like this As far as my knowledge goes I have to set up logstash to support multiline logs so I created the following configuration input { file { pat… --- ## [Best practices for Elastic DB deployment for 100TB data](https://discuss.elastic.co/t/best-practices-for-elastic-db-deployment-for-100tb-data/298918)
**Author:** [@noamsh88](https://discuss.elastic.co/u/noamsh88)\ **Replies:** 4\ **Last updated:** [March 7, 2022, 8:35pm UTC](https://discuss.elastic.co/t/best-practices-for-elastic-db-deployment-for-100tb-data/298918 "2022-03-07T20:35:19Z")
Hello, We are designing new product that based on Elasticsearch that suppose to have around 100TB data Deployment will be on-prem (bare metal with Linux OS installed on it) and would like to ask: What is best practic… --- ## [Error while starting ES7.17.0](https://discuss.elastic.co/t/error-while-starting-es7-17-0/298989)
**Author:** [@nandatibco](https://discuss.elastic.co/u/nandatibco)\ **Replies:** 1\ **Last updated:** [March 7, 2022, 7:52pm UTC](https://discuss.elastic.co/t/error-while-starting-es7-17-0/298989 "2022-03-07T19:52:11Z")
Hello team, While starting Elasticsearch 7.17.0 with security enabled, getting below error. Please suggest where we need set the password and how. Thanks in advance. Error: \[o.e.b.ElasticsearchUncaughtExceptionHandl… --- ## [Filter Ratio in Maps](https://discuss.elastic.co/t/filter-ratio-in-maps/299004)
**Author:** [@sushmamagesh](https://discuss.elastic.co/u/sushmamagesh)\ **Replies:** 1\ **Last updated:** [March 7, 2022, 7:46pm UTC](https://discuss.elastic.co/t/filter-ratio-in-maps/299004 "2022-03-07T19:46:13Z")
Is it possible to use filter ratio with a numerator/value in maps (similar to average) Something similar to Filter Ratio within Kibana TSVB. --- ## [Missing index .siem-signals-default](https://discuss.elastic.co/t/missing-index-siem-signals-default/298452)
**Author:** [@slash24](https://discuss.elastic.co/u/slash24)\ **Replies:** 4\ **Last updated:** [March 7, 2022, 7:38pm UTC](https://discuss.elastic.co/t/missing-index-siem-signals-default/298452 "2022-03-07T19:38:50Z")
Having 7.16.3 properly licensed with Platinum, I cannot run some (tried five) ML-rules from Security due to: ".siem-signals-default" missing. I have Elastic Agent deployed with Security Endpoint activated and lots of d… --- ## [Infraestructure in Cloud](https://discuss.elastic.co/t/infraestructure-in-cloud/299007)
**Author:** [@WrongProvider](https://discuss.elastic.co/u/WrongProvider)\ **Replies:** 0\ **Last updated:** [March 7, 2022, 7:11pm UTC](https://discuss.elastic.co/t/infraestructure-in-cloud/299007 "2022-03-07T19:11:29Z")
Hi, people. My company and I wishes to use Elasticsearch for SIEM and possible XDR for our costumers -- we want to substitute Zabbix. But We can´t go on with the project because of the numerous questions about the infr… --- ## [Find all the saved objects for a given tag](https://discuss.elastic.co/t/find-all-the-saved-objects-for-a-given-tag/298486)
**Author:** [@dao](https://discuss.elastic.co/u/dao)\ **Replies:** 1\ **Last updated:** [March 7, 2022, 6:47pm UTC](https://discuss.elastic.co/t/find-all-the-saved-objects-for-a-given-tag/298486 "2022-03-07T18:47:38Z")
Hello, I try to call a REST request to get all the saved objects tagged with a given tag FS. I'd like to call something like GET api/kibana/management/saved\_objects/\_find?type=dashboard&search\_fields=tag&search=FS It … --- ## [How to transfer data from mongoDB to elasticsearch using mongodb-plugin-input](https://discuss.elastic.co/t/how-to-transfer-data-from-mongodb-to-elasticsearch-using-mongodb-plugin-input/299001)
**Author:** [@Douglas\_Andrade](https://discuss.elastic.co/u/Douglas_Andrade)\ **Replies:** 1\ **Last updated:** [March 7, 2022, 6:42pm UTC](https://discuss.elastic.co/t/how-to-transfer-data-from-mongodb-to-elasticsearch-using-mongodb-plugin-input/299001 "2022-03-07T18:42:35Z")
I would like to know if it is possible to transfer a complete database from mongoDB to Elasticsearch, not just new data, using mongoDB-plugin-input --- ## [Over 110 detections crash SIEM application and Kibana plugins](https://discuss.elastic.co/t/over-110-detections-crash-siem-application-and-kibana-plugins/295830)
**Author:** [@alaine](https://discuss.elastic.co/u/alaine)\ **Replies:** 18\ **Last updated:** [March 7, 2022, 5:59pm UTC](https://discuss.elastic.co/t/over-110-detections-crash-siem-application-and-kibana-plugins/295830 "2022-03-07T17:59:03Z")
Hello, I am having an issue that I have not been able to fix, and have not even been able to understand the underlying issue. I am running a cluster with 6 hot data nodes (virtual, SSD, 16 cpus, 64gb ram and 8TB disks) … --- ## [Two Http\_poller inputs with access token](https://discuss.elastic.co/t/two-http-poller-inputs-with-access-token/298939)
**Author:** [@rodri.gz](https://discuss.elastic.co/u/rodri.gz)\ **Replies:** 7\ **Last updated:** [March 7, 2022, 5:51pm UTC](https://discuss.elastic.co/t/two-http-poller-inputs-with-access-token/298939 "2022-03-07T17:51:03Z")
Hello! I am trying to get data from an api that needs to be accessed using a token that we get from another api. How can I pass this access token to get the data from the other api? I had thought of doing something si… --- ## [Compare two time periods for same timeseries](https://discuss.elastic.co/t/compare-two-time-periods-for-same-timeseries/297196)
**Author:** [@achint](https://discuss.elastic.co/u/achint)\ **Replies:** 2\ **Last updated:** [March 7, 2022, 5:50pm UTC](https://discuss.elastic.co/t/compare-two-time-periods-for-same-timeseries/297196 "2022-03-07T17:50:35Z")
Hi, I run performance tests on different time periods and i get the application response time in ELK. I want to compare these time intervals so that i can compare the response time for different build. Response time dat… --- ## [SQL match function](https://discuss.elastic.co/t/sql-match-function/298922)
**Author:** [@avnere](https://discuss.elastic.co/u/avnere)\ **Replies:** 3\ **Last updated:** [March 7, 2022, 5:39pm UTC](https://discuss.elastic.co/t/sql-match-function/298922 "2022-03-07T17:39:23Z")
Hi, I am looking how to perform LIKE on text type. I found a way by MATCH. Is MATCH is Elasticsearch SQL unique function or native SQL? for example: MATCH(foo, 'bar') Are there more options to perform LIKE on text… --- ## [Elastic-Agent installed, but not viewable in Security Hosts tab or logs in Kibana](https://discuss.elastic.co/t/elastic-agent-installed-but-not-viewable-in-security-hosts-tab-or-logs-in-kibana/298524)
**Author:** [@nodes](https://discuss.elastic.co/u/nodes)\ **Replies:** 8\ **Last updated:** [March 7, 2022, 5:31pm UTC](https://discuss.elastic.co/t/elastic-agent-installed-but-not-viewable-in-security-hosts-tab-or-logs-in-kibana/298524 "2022-03-07T17:31:19Z")
Hi all - So I've recently got the Elastic Stack setup and running. Decided to go install the Fleet Server, and then install a handful of Elastic-Agents on Windows Server(s) to gather some logs and metrics. From the lo… --- ## [Metricbeat sql module fields query - change to date/time](https://discuss.elastic.co/t/metricbeat-sql-module-fields-query-change-to-date-time/296723)
**Author:** [@Garry](https://discuss.elastic.co/u/Garry)\ **Replies:** 1\ **Last updated:** [March 7, 2022, 5:17pm UTC](https://discuss.elastic.co/t/metricbeat-sql-module-fields-query-change-to-date-time/296723 "2022-03-07T17:17:28Z")
When I ingest metricbeat sql module fields they are stored as a string. How can I change some of the date/time fields returned from the sql query from string to date/time to be used in Kibana? --- ## [Is it possible to filter by agent policy?](https://discuss.elastic.co/t/is-it-possible-to-filter-by-agent-policy/297392)
**Author:** [@Teckinfor](https://discuss.elastic.co/u/Teckinfor)\ **Replies:** 1\ **Last updated:** [March 7, 2022, 5:12pm UTC](https://discuss.elastic.co/t/is-it-possible-to-filter-by-agent-policy/297392 "2022-03-07T17:12:56Z")
Hello, I would like to be able to monitor 2 infrastructures at the same time, I have created a space for each infrastructure as well as 2 agent policies linked to the agents of their own infrastructure. I was wondering… --- ## [Time zones in query string query not working](https://discuss.elastic.co/t/time-zones-in-query-string-query-not-working/298995)
**Author:** [@Bostjan\_Kovac](https://discuss.elastic.co/u/Bostjan_Kovac)\ **Replies:** 0\ **Last updated:** [March 7, 2022, 5:08pm UTC](https://discuss.elastic.co/t/time-zones-in-query-string-query-not-working/298995 "2022-03-07T17:08:36Z")
I believe that the query string queries are not acknowledging the time\_zone property in the query. I have tested with range query and they are working as expected. My test index: PUT test { "mappings": { "dynamic… --- ## [Kibana Security Timeline bad timestamp parsing](https://discuss.elastic.co/t/kibana-security-timeline-bad-timestamp-parsing/298991)
**Author:** [@Silver137](https://discuss.elastic.co/u/Silver137)\ **Replies:** 0\ **Last updated:** [March 7, 2022, 4:44pm UTC](https://discuss.elastic.co/t/kibana-security-timeline-bad-timestamp-parsing/298991 "2022-03-07T16:44:42Z")
I'm trying to investigate custom security events using Kibana timeline security features. My surprise when I see that the temporal searched works, but the timestamp is interpreted without adding the epoch offset, for ex… --- ## [Failed to connect to postgreslq via logsatash](https://discuss.elastic.co/t/failed-to-connect-to-postgreslq-via-logsatash/298772)
**Author:** [@francieliton\_araujo](https://discuss.elastic.co/u/francieliton_araujo)\ **Replies:** 1\ **Last updated:** [March 7, 2022, 4:37pm UTC](https://discuss.elastic.co/t/failed-to-connect-to-postgreslq-via-logsatash/298772 "2022-03-07T16:37:33Z")
it's the first time I'm trying to access a postgresql database through logstash. however there are dnado errors, can you help me. Below is conf and error. input{ jdbc{ jdbc\_driver\_library =\> "/usr/share/java/pos… --- ## [Graph in Kibana is empty](https://discuss.elastic.co/t/graph-in-kibana-is-empty/298204)
**Author:** [@Soumanou\_Karimou](https://discuss.elastic.co/u/Soumanou_Karimou)\ **Replies:** 1\ **Last updated:** [March 7, 2022, 4:20pm UTC](https://discuss.elastic.co/t/graph-in-kibana-is-empty/298204 "2022-03-07T16:20:54Z")
Hello, I've ingested two columns data in an elastic index. The values are related: spi,ip spi1,ip1 spi2,ip1 spi3,ip1 spi4,ip2 spi5,ip2 spi6,ip2 Nothing appears in the Kibana graph when choosing ip,sip as columns… --- ## [Pulling aggregations for use in watchers](https://discuss.elastic.co/t/pulling-aggregations-for-use-in-watchers/298977)
**Author:** [@walshe06](https://discuss.elastic.co/u/walshe06)\ **Replies:** 0\ **Last updated:** [March 7, 2022, 2:31pm UTC](https://discuss.elastic.co/t/pulling-aggregations-for-use-in-watchers/298977 "2022-03-07T14:31:38Z")
Hi all In the below example, I have added terms to pull out the referer in the aggregation so I can use it in my watcher action. I can pull each referer individually with the following 'referer': e.per\_15m.buckets\[0\].re… --- ## [Master node role cannot be removed in 8.0.0](https://discuss.elastic.co/t/master-node-role-cannot-be-removed-in-8-0-0/298526)
**Author:** [@jean.bissonnette](https://discuss.elastic.co/u/jean.bissonnette)\ **Replies:** 28\ **Last updated:** [March 7, 2022, 2:24pm UTC](https://discuss.elastic.co/t/master-node-role-cannot-be-removed-in-8-0-0/298526 "2022-03-07T14:24:38Z")
I have 5 nodes, 3 of them are master. Running on podman on RHEL as systemD service. By error, I set the 2 others as master and ran the cluster but they should be data only. When I change their Elasticsearch.yml to rem… --- ## [Unbalanced shards](https://discuss.elastic.co/t/unbalanced-shards/298520)
**Author:** [@Sashi](https://discuss.elastic.co/u/Sashi)\ **Replies:** 6\ **Last updated:** [March 7, 2022, 2:17pm UTC](https://discuss.elastic.co/t/unbalanced-shards/298520 "2022-03-07T14:17:40Z")
Hello, I have a cluster of over 25 nodes and the indices are balanced on all the nodes except for one node. Let's call the node as problematic node. The problematic node has less indices and shards when compared to othe… --- ## [APM-agent-attach-cli-1.29.0 access denied ERROR bytebuddy](https://discuss.elastic.co/t/apm-agent-attach-cli-1-29-0-access-denied-error-bytebuddy/298959)
**Author:** [@attiliobroglio](https://discuss.elastic.co/u/attiliobroglio)\ **Replies:** 2\ **Last updated:** [March 7, 2022, 2:07pm UTC](https://discuss.elastic.co/t/apm-agent-attach-cli-1-29-0-access-denied-error-bytebuddy/298959 "2022-03-07T14:07:52Z")
Hi, I am using the apm-agent-attach-cli-1.29.0.jar in order to monitor a Java application (installed openjdk version "1.8.0\_292"). Log shows that the agent is not able to start: \[elastic-apm-agent\] ERROR Failed to sta… --- ## [Errors with High Level Rest Client After Upgrading to Elasticsearch 8.0.1](https://discuss.elastic.co/t/errors-with-high-level-rest-client-after-upgrading-to-elasticsearch-8-0-1/298972)
**Author:** [@chris.stack.bb](https://discuss.elastic.co/u/chris.stack.bb)\ **Replies:** 1\ **Last updated:** [March 7, 2022, 1:56pm UTC](https://discuss.elastic.co/t/errors-with-high-level-rest-client-after-upgrading-to-elasticsearch-8-0-1/298972 "2022-03-07T13:56:50Z")
Hello, After upgrading to Elasticsearch 8.0.1, I am having a variety of errors interfacing from my Java High Level Rest Client version 7.17.1 (originally tried with 7.15.2). The code now seems extremely sensitive to nul… --- ## [How to pass variable base parameter in http\_poller logstash input plugin](https://discuss.elastic.co/t/how-to-pass-variable-base-parameter-in-http-poller-logstash-input-plugin/298621)
**Author:** [@Purushottam22](https://discuss.elastic.co/u/Purushottam22)\ **Replies:** 1\ **Last updated:** [March 2, 2022, 8:16pm UTC](https://discuss.elastic.co/t/how-to-pass-variable-base-parameter-in-http-poller-logstash-input-plugin/298621 "2022-03-02T20:16:41Z")
Hi All, Can you please help me with below issue, I am trying to hit two rest api for below two conditions: First is used for providing the login credentials and it will give an response as session id. I have to use t… [Previous page](https://discuss.elastic.co/latest.md?page=1227) [Next page](https://discuss.elastic.co/latest.md?page=1229)