# Latest **URL:** https://discuss.elastic.co/latest.md?page=1277 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1278 --- ## [Custom logs multiline](https://discuss.elastic.co/t/custom-logs-multiline/295280)
**Author:** [@Requium](https://discuss.elastic.co/u/Requium)\ **Replies:** 1\ **Last updated:** [February 4, 2022, 9:10am UTC](https://discuss.elastic.co/t/custom-logs-multiline/295280 "2022-02-04T09:10:19Z")
Im trying to add multiline to the custom log integration configuration for elastic agent, i tryied the following way: multiline.type: pattern multiline.pattern: '\[0-9\]{4}-\[0-9\]{2}-\[0-9\]{2}' multiline.negate: true multi… --- ## [Module/apmzap](https://discuss.elastic.co/t/module-apmzap/296154)
**Author:** [@MerNat](https://discuss.elastic.co/u/MerNat)\ **Replies:** 2\ **Last updated:** [February 4, 2022, 9:08am UTC](https://discuss.elastic.co/t/module-apmzap/296154 "2022-02-04T09:08:17Z")
I'm trying to send logs to the APM server and thus can see it in transactions associated logs. I've simply followed the simple doc Built-in instrumentation modules | APM Go Agent Reference \[1.x\] | Elastic. Kibana versio… --- ## [Logstash elasticsearch input error](https://discuss.elastic.co/t/logstash-elasticsearch-input-error/296172)
**Author:** [@rodri.gz](https://discuss.elastic.co/u/rodri.gz)\ **Replies:** 14\ **Last updated:** [February 4, 2022, 9:06am UTC](https://discuss.elastic.co/t/logstash-elasticsearch-input-error/296172 "2022-02-04T09:06:31Z")
Hello I am extracting data from an http server through the apace pipeline, indicating the pipeline to use in the logstash output and it indexes correctly. On the other hand, I want to enrich the data already obtained an… --- ## [Kibana Infrastructure UI shows no metrics for hosts](https://discuss.elastic.co/t/kibana-infrastructure-ui-shows-no-metrics-for-hosts/296268)
**Author:** [@\_manukm](https://discuss.elastic.co/u/_manukm)\ **Replies:** 0\ **Last updated:** [February 4, 2022, 9:00am UTC](https://discuss.elastic.co/t/kibana-infrastructure-ui-shows-no-metrics-for-hosts/296268 "2022-02-04T09:00:29Z")
Continuing the discussion from Kibana Infrastructure UI shows no metrics for hosts or kubernetes pods: I am facing the exact same issue. @zx10r did you resolve this? --- ## [Kibana KQL search common value on single column](https://discuss.elastic.co/t/kibana-kql-search-common-value-on-single-column/296077)
**Author:** [@Mercurochrome](https://discuss.elastic.co/u/Mercurochrome)\ **Replies:** 7\ **Last updated:** [February 4, 2022, 8:50am UTC](https://discuss.elastic.co/t/kibana-kql-search-common-value-on-single-column/296077 "2022-02-04T08:50:48Z")
Hello, I'm new on Kibana and I can't find answers to my problem, hopefully someone can help :slight\_smile: . Here is my problem : I have a table with some value like (Column A = Port number, Column B = IP Address, Colu… --- ## [Alternative for Template Query in ES 7.x (Search template call/pass to another template)](https://discuss.elastic.co/t/alternative-for-template-query-in-es-7-x-search-template-call-pass-to-another-template/296265)
**Author:** [@mjwahyudi](https://discuss.elastic.co/u/mjwahyudi)\ **Replies:** 0\ **Last updated:** [February 4, 2022, 8:23am UTC](https://discuss.elastic.co/t/alternative-for-template-query-in-es-7-x-search-template-call-pass-to-another-template/296265 "2022-02-04T08:23:06Z")
Hi All, I have task to migrate old query from ES 5.x that built/migrated from ES 2.x (it is so old). In the query, it is using template query (Template Query | Elasticsearch Reference \[5.6\] | Elastic). When I try to us… --- ## [Copying Dashboard from kibana](https://discuss.elastic.co/t/copying-dashboard-from-kibana/296142)
**Author:** [@Aniketvk008](https://discuss.elastic.co/u/Aniketvk008)\ **Replies:** 7\ **Last updated:** [February 4, 2022, 8:08am UTC](https://discuss.elastic.co/t/copying-dashboard-from-kibana/296142 "2022-02-04T08:08:15Z")
Hi how to copy dashboard from kibana without overwriting the existing object(dashboard) in same machine --- ## [Elastic-agent -- Sent logs to external SIEM](https://discuss.elastic.co/t/elastic-agent-sent-logs-to-external-siem/296045)
**Author:** [@fselim](https://discuss.elastic.co/u/fselim)\ **Replies:** 8\ **Last updated:** [February 4, 2022, 8:07am UTC](https://discuss.elastic.co/t/elastic-agent-sent-logs-to-external-siem/296045 "2022-02-04T08:07:47Z")
Goodmorning, We have installed elastic-agents throughout our environment with everything setup for filebeat and metricbeat monitoring. Though now I'm trying to figure out how to forward logs to an external SIEM when the… --- ## [Custom sort sequence is not working when using in vega-lite](https://discuss.elastic.co/t/custom-sort-sequence-is-not-working-when-using-in-vega-lite/296165)
**Author:** [@Supriya1](https://discuss.elastic.co/u/Supriya1)\ **Replies:** 0\ **Last updated:** [February 3, 2022, 9:36am UTC](https://discuss.elastic.co/t/custom-sort-sequence-is-not-working-when-using-in-vega-lite/296165 "2022-02-03T09:36:56Z")
Hi Team , If any body can guide what could be the issue Case-We are trying to extract data from kibana index and plotting a vega-lite bar chart. When we try to apply sort as ascending or descending, the sort works. How… --- ## [Elastic user works for ES API but not Kibana](https://discuss.elastic.co/t/elastic-user-works-for-es-api-but-not-kibana/295792)
**Author:** [@shlant](https://discuss.elastic.co/u/shlant)\ **Replies:** 5\ **Last updated:** [February 4, 2022, 5:18am UTC](https://discuss.elastic.co/t/elastic-user-works-for-es-api-but-not-kibana/295792 "2022-02-04T05:18:39Z")
I have set up ES and Kibana as per Secure Elasticsearch with TLS encryption and role-based access control | Elastic Blog I can hit /\_cluster/health with both elastic and kibana users. When I try and log in on the kiban… --- ## [Elastic ML job errors](https://discuss.elastic.co/t/elastic-ml-job-errors/295244)
**Author:** [@stefan.elser](https://discuss.elastic.co/u/stefan.elser)\ **Replies:** 9\ **Last updated:** [February 3, 2022, 11:10pm UTC](https://discuss.elastic.co/t/elastic-ml-job-errors/295244 "2022-02-03T23:10:38Z")
Hi! I'm new here - working with my team to explore the ML offerings in a trial license and I'm running into some errors and questions. Can Anomaly Detection model output be viewed and used in Kibana visualizations? I … --- ## [Kibana 7.16.3 Pie Chart Hole Size](https://discuss.elastic.co/t/kibana-7-16-3-pie-chart-hole-size/296232)
**Author:** [@John\_Collins](https://discuss.elastic.co/u/John_Collins)\ **Replies:** 2\ **Last updated:** [February 3, 2022, 10:57pm UTC](https://discuss.elastic.co/t/kibana-7-16-3-pie-chart-hole-size/296232 "2022-02-03T22:57:18Z")
I just upgraded from Kibana 7.11 to 7.16.3 and something just doesn't look right to me when I look at my dashboards. The size of the hole in the middle of my pie charts are causing me a ridiculous amount of unnatural st… --- ## [Kibana 7.16.2 - fields array empty for saved\_object api call](https://discuss.elastic.co/t/kibana-7-16-2-fields-array-empty-for-saved-object-api-call/295768)
**Author:** [@ssimmons](https://discuss.elastic.co/u/ssimmons)\ **Replies:** 3\ **Last updated:** [February 3, 2022, 9:56pm UTC](https://discuss.elastic.co/t/kibana-7-16-2-fields-array-empty-for-saved-object-api-call/295768 "2022-02-03T21:56:48Z")
I've used the saved\_objects api in previous versions of Kibana to retrieve the array of fields associated with each index pattern. I use the following api call: /api/saved\_objects/\_find?type=index-pattern. This returns a… --- ## [Connection reset by peer when connecting to Elastic](https://discuss.elastic.co/t/connection-reset-by-peer-when-connecting-to-elastic/296065)
**Author:** [@brampurnot](https://discuss.elastic.co/u/brampurnot)\ **Replies:** 1\ **Last updated:** [February 3, 2022, 9:14pm UTC](https://discuss.elastic.co/t/connection-reset-by-peer-when-connecting-to-elastic/296065 "2022-02-03T21:14:58Z")
Hi all, I'm trying to setup Heartbeat without Logstash (directly integrated into Elastic ECK) on a kubernetes platform. When the pod is starting, I can see the following error message: Failed to connect to backoff(Ela… --- ## [Kibana Plugin Development in Offline Environment v7.14.0](https://discuss.elastic.co/t/kibana-plugin-development-in-offline-environment-v7-14-0/295483)
**Author:** [@alexram72](https://discuss.elastic.co/u/alexram72)\ **Replies:** 1\ **Last updated:** [February 3, 2022, 8:59pm UTC](https://discuss.elastic.co/t/kibana-plugin-development-in-offline-environment-v7-14-0/295483 "2022-02-03T20:59:09Z")
I am trying to develop a Kibana plugin in my environment that is completely offline and am running into issues in getting the helper scripts to run and the development instance of Kibana to come up. I do have access to … --- ## [Threat Intelligence Rule fails](https://discuss.elastic.co/t/threat-intelligence-rule-fails/293883)
**Author:** [@norgro2601](https://discuss.elastic.co/u/norgro2601)\ **Replies:** 2\ **Last updated:** [February 3, 2022, 8:45pm UTC](https://discuss.elastic.co/t/threat-intelligence-rule-fails/293883 "2022-02-03T20:45:06Z")
I want to use the rule "Threat Intel Filebeat Module (v7.x) Indicator Match", but it fails due to format of IPs in the records. The problem is the format in the fileset "abuseurl" in threatintel.indicator.ip, for example… --- ## [Event correlation rule that compares fields between the two events](https://discuss.elastic.co/t/event-correlation-rule-that-compares-fields-between-the-two-events/295633)
**Author:** [@kossde](https://discuss.elastic.co/u/kossde)\ **Replies:** 1\ **Last updated:** [February 3, 2022, 8:41pm UTC](https://discuss.elastic.co/t/event-correlation-rule-that-compares-fields-between-the-two-events/295633 "2022-02-03T20:41:47Z")
I am trying to create a rule that will determine if two VPN sessions were started for the same user from two different IP addresses without one session ending first. The problem I'm running into is that I can't figure … --- ## [500 error: "Could not create index for rollup job"](https://discuss.elastic.co/t/500-error-could-not-create-index-for-rollup-job/295946)
**Author:** [@dicko](https://discuss.elastic.co/u/dicko)\ **Replies:** 1\ **Last updated:** [February 3, 2022, 8:37pm UTC](https://discuss.elastic.co/t/500-error-could-not-create-index-for-rollup-job/295946 "2022-02-03T20:37:09Z")
v 7.14.1 I'm trying to create a roll-up job on v 7.14.1 Whatever I try, like: PUT \_rollup/job/logs\_job\_test { "id": "logs\_job\_test", "index\_pattern": "clientname\*-webaccess-\*", "rollup\_index": "rollup\_clientname… --- ## [What if the number of shards and replicas is different in CCR?](https://discuss.elastic.co/t/what-if-the-number-of-shards-and-replicas-is-different-in-ccr/296141)
**Author:** [@True](https://discuss.elastic.co/u/True)\ **Replies:** 1\ **Last updated:** [February 3, 2022, 8:35pm UTC](https://discuss.elastic.co/t/what-if-the-number-of-shards-and-replicas-is-different-in-ccr/296141 "2022-02-03T20:35:40Z")
Hello. When setting CCR, does it not have to be the same setting as the leader index and follower index? For example, what if the number of shards and replicas is different because the cluster size is different? I want … --- ## [DataBase Connection](https://discuss.elastic.co/t/database-connection/296167)
**Author:** [@Harsh1999](https://discuss.elastic.co/u/Harsh1999)\ **Replies:** 1\ **Last updated:** [February 3, 2022, 8:30pm UTC](https://discuss.elastic.co/t/database-connection/296167 "2022-02-03T20:30:00Z")
We want to connect Snowflake and PGSql Databases to Logstash/Elasticsearch. How do i go ahead with that? Is there any link to referral video or article? --- ## [Elastic search Nest (.Net) Total and Documents don't match](https://discuss.elastic.co/t/elastic-search-nest-net-total-and-documents-dont-match/296218)
**Author:** [@kqgcm](https://discuss.elastic.co/u/kqgcm)\ **Replies:** 1\ **Last updated:** [February 3, 2022, 7:59pm UTC](https://discuss.elastic.co/t/elastic-search-nest-net-total-and-documents-dont-match/296218 "2022-02-03T19:59:41Z")
I'm having the following situation: the Total from the Valid Nest Response is equals 2 and the Documents count equal 0. I'm not sure how that is possible. In the code, I track down the total hits: result = base.\_elasti… --- ## [Connecting Winlogbeat to Elasticsearch over Hibachi virtual lan](https://discuss.elastic.co/t/connecting-winlogbeat-to-elasticsearch-over-hibachi-virtual-lan/296224)
**Author:** [@gicetek](https://discuss.elastic.co/u/gicetek)\ **Replies:** 0\ **Last updated:** [February 3, 2022, 7:52pm UTC](https://discuss.elastic.co/t/connecting-winlogbeat-to-elasticsearch-over-hibachi-virtual-lan/296224 "2022-02-03T19:52:24Z")
Good day! I'm managing a number of Windows 10 consultant systems that are not domain connected. As part of my duties I needed to connect these hosts and I chose Hamachi as a way to provide for a nice virtual lan. I'm pl… --- ## [Getting error while creating scripted field](https://discuss.elastic.co/t/getting-error-while-creating-scripted-field/296221)
**Author:** [@Surya\_Raviraj](https://discuss.elastic.co/u/Surya_Raviraj)\ **Replies:** 2\ **Last updated:** [February 3, 2022, 6:54pm UTC](https://discuss.elastic.co/t/getting-error-while-creating-scripted-field/296221 "2022-02-03T18:54:40Z")
Hi all, I am creating a scripted field on an index that already has a bunch of scripted fields. After creating the scripted field I preview the results and see my desired results. For some reason, when I go back to the … --- ## [What's the difference between Kibana and ES roles?](https://discuss.elastic.co/t/whats-the-difference-between-kibana-and-es-roles/295646)
**Author:** [@Agus\_Roca](https://discuss.elastic.co/u/Agus_Roca)\ **Replies:** 1\ **Last updated:** [February 3, 2022, 6:50pm UTC](https://discuss.elastic.co/t/whats-the-difference-between-kibana-and-es-roles/295646 "2022-02-03T18:50:37Z")
Hi fellows, I am reading the docs and found in Kibana API for roles it states \> Do not use the Elasticsearch role management APIs to manage Kibana roles. I could not find the difference and where these are stored in … --- ## [Watcher by customer](https://discuss.elastic.co/t/watcher-by-customer/295566)
**Author:** [@EduardoM](https://discuss.elastic.co/u/EduardoM)\ **Replies:** 1\ **Last updated:** [February 3, 2022, 6:49pm UTC](https://discuss.elastic.co/t/watcher-by-customer/295566 "2022-02-03T18:49:17Z")
I want to send an email to 5 customers in a single email but without making 5 watchers, only with one, and each customer receives their individual information, since in the future I will have 100 customers and modifying … --- ## [Watch setup on ELK stack 7.5.3](https://discuss.elastic.co/t/watch-setup-on-elk-stack-7-5-3/295569)
**Author:** [@pythonic](https://discuss.elastic.co/u/pythonic)\ **Replies:** 1\ **Last updated:** [February 3, 2022, 6:29pm UTC](https://discuss.elastic.co/t/watch-setup-on-elk-stack-7-5-3/295569 "2022-02-03T18:29:58Z")
Hi, I am trying to setup a watch on my ELK stack but because of basic license it is giving me error. Can someone help me on this issue? --- ## [Geo\_shape query not returning any results in java api](https://discuss.elastic.co/t/geo-shape-query-not-returning-any-results-in-java-api/296213)
**Author:** [@jjc](https://discuss.elastic.co/u/jjc)\ **Replies:** 1\ **Last updated:** [February 3, 2022, 5:59pm UTC](https://discuss.elastic.co/t/geo-shape-query-not-returning-any-results-in-java-api/296213 "2022-02-03T17:59:41Z")
Hi guys, i'm trying to find if a point lies within a certain geographic boundary with the java api. i have a geo\_shape mapping for a field called citybounds (text below copied from kibana): { "mapping": { "prope… --- ## [Heartbeat TCP DNS Query](https://discuss.elastic.co/t/heartbeat-tcp-dns-query/296180)
**Author:** [@rhysh](https://discuss.elastic.co/u/rhysh)\ **Replies:** 1\ **Last updated:** [February 3, 2022, 5:59pm UTC](https://discuss.elastic.co/t/heartbeat-tcp-dns-query/296180 "2022-02-03T17:59:04Z")
Hi everyone, I am looking to monitor a DNS server (or multiple) through heartbeat. Now it appears this isn't supported out of the box but it is possible to submit TCP requests. Is it at all possible to set up the follow… --- ## [Failed to start Elasticsearch \[7.16.3\] \[Ubuntu 20.04\]](https://discuss.elastic.co/t/failed-to-start-elasticsearch-7-16-3-ubuntu-20-04/295991)
**Author:** [@Arkoos62](https://discuss.elastic.co/u/Arkoos62)\ **Replies:** 18\ **Last updated:** [February 3, 2022, 5:56pm UTC](https://discuss.elastic.co/t/failed-to-start-elasticsearch-7-16-3-ubuntu-20-04/295991 "2022-02-03T17:56:58Z")
Hello there, I have installed Elasticsearch trough the apt on my vps ubuntu 20.04, i just followed the installation guide from here : Install Elasticsearch with Debian Package | Elasticsearch Guide \[7.17\] | Elastic I c… --- ## [GROK Issue between Kibana Console and Pipeline](https://discuss.elastic.co/t/grok-issue-between-kibana-console-and-pipeline/296208)
**Author:** [@kamandohl](https://discuss.elastic.co/u/kamandohl)\ **Replies:** 0\ **Last updated:** [February 3, 2022, 2:47pm UTC](https://discuss.elastic.co/t/grok-issue-between-kibana-console-and-pipeline/296208 "2022-02-03T14:47:41Z")
Data Set 192.168.0.0 - - \[03/Feb/2022:11:14:38 +0000\] \\"/I/went/to/your/house.html HTTP/1.1\\" 200 109 \\"https://https://grokdebug.herokuapp.com//\\" \\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, … [Previous page](https://discuss.elastic.co/latest.md?page=1276) [Next page](https://discuss.elastic.co/latest.md?page=1278)