# Latest **URL:** https://discuss.elastic.co/latest.md?page=1286 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1287 --- ## [Wildcard for source.ip field](https://discuss.elastic.co/t/wildcard-for-source-ip-field/295613)
**Author:** [@francescouk](https://discuss.elastic.co/u/francescouk)\ **Replies:** 4\ **Last updated:** [January 28, 2022, 7:04pm UTC](https://discuss.elastic.co/t/wildcard-for-source-ip-field/295613 "2022-01-28T19:04:51Z")
Hi there, I would like to know how to fix this search (if is possible of course): (winlog.channel:"Security" AND (winlog.event\_id:"4624" AND winlog.event\_data.LogonType:"10") AND (NOT (source.ip:(10.\* OR 192.168.\* OR 1… --- ## [Implémentation de Sigma](https://discuss.elastic.co/t/implementation-de-sigma/295454)
**Author:** [@Lynow](https://discuss.elastic.co/u/Lynow)\ **Replies:** 1\ **Last updated:** [January 28, 2022, 6:43pm UTC](https://discuss.elastic.co/t/implementation-de-sigma/295454 "2022-01-28T18:43:03Z")
Bonjour, J'ai récemment configuré une architecture de surveillance, veille, réponse à incident via MISP, TheHive, Cortex, Wazuh, Elasticsearch et j'en passe. Je souhaite que les adresses IP malveillantes notées dans El… --- ## [FS Crawler 2.4 on Apache Log4j2 Remote Code Execution (RCE) Vulnerability](https://discuss.elastic.co/t/fs-crawler-2-4-on-apache-log4j2-remote-code-execution-rce-vulnerability/291649)
**Author:** [@joseph-l.amalraj](https://discuss.elastic.co/u/joseph-l.amalraj)\ **Replies:** 16\ **Last updated:** [January 28, 2022, 6:14pm UTC](https://discuss.elastic.co/t/fs-crawler-2-4-on-apache-log4j2-remote-code-execution-rce-vulnerability/291649 "2022-01-28T18:14:21Z")
Hi David, recently we have received about Apache Log4j2 Remote Code Execution (RCE) Vulnerability. I am using FS Crawler 2.4 version along with ELK 6.8.14, we planned to do remediation plan for log4j in ELK. We would l… --- ## [Unified highlighter snippet fragmenter issues](https://discuss.elastic.co/t/unified-highlighter-snippet-fragmenter-issues/295603)
**Author:** [@fsouptes](https://discuss.elastic.co/u/fsouptes)\ **Replies:** 3\ **Last updated:** [January 28, 2022, 6:12pm UTC](https://discuss.elastic.co/t/unified-highlighter-snippet-fragmenter-issues/295603 "2022-01-28T18:12:52Z")
Hello, We are knowing some issues with how snippets are splitted with unified highlighter. We use Elasticsearch in 7.16 Some snippets are very shorts, sometimes the snippet is inconsistent or is only a repetition of u… --- ## [How to list all index patterns using DevTools](https://discuss.elastic.co/t/how-to-list-all-index-patterns-using-devtools/295725)
**Author:** [@mohsin106](https://discuss.elastic.co/u/mohsin106)\ **Replies:** 1\ **Last updated:** [January 28, 2022, 5:15pm UTC](https://discuss.elastic.co/t/how-to-list-all-index-patterns-using-devtools/295725 "2022-01-28T17:15:36Z")
Hi, Is there a GET command that I can run in Kibana's dev tools console that will list all my index patterns and their IDs? I'm trying to delete some index patterns but I believe I need to delete them by ID. I'm trying… --- ## [\[Winlogbeat\] won't exit; winlogbeat JSON output size is different for same file](https://discuss.elastic.co/t/winlogbeat-wont-exit-winlogbeat-json-output-size-is-different-for-same-file/295706)
**Author:** [@ashimmahara](https://discuss.elastic.co/u/ashimmahara)\ **Replies:** 2\ **Last updated:** [January 28, 2022, 5:03pm UTC](https://discuss.elastic.co/t/winlogbeat-wont-exit-winlogbeat-json-output-size-is-different-for-same-file/295706 "2022-01-28T17:03:17Z")
Program: Winlogbeat Version: 7.16.3 Operating System: Windows 11 Pro Version 21H2 Build 22000.438 I am trying to convert some archived evtx files to JSON using winlogbeat, however, winlogbeat isn't exiting after proce… --- ## [Create dashboard mixing data from indexes](https://discuss.elastic.co/t/create-dashboard-mixing-data-from-indexes/295716)
**Author:** [@javidr](https://discuss.elastic.co/u/javidr)\ **Replies:** 2\ **Last updated:** [January 28, 2022, 4:19pm UTC](https://discuss.elastic.co/t/create-dashboard-mixing-data-from-indexes/295716 "2022-01-28T16:19:44Z")
Hi I would like to know how i can mix data from different indexes in the same visualisation (if it is even possible). Imagine I have an index with some information, as name, dob, NI number etc, and another index with d… --- ## [LogStash::Json::ParserError: Unexpected end-of-input within/between Object entries for curly brace inside string](https://discuss.elastic.co/t/logstash-unexpected-end-of-input-within-between-object-entries-for-curly-brace-inside-string/295659)
**Author:** [@truptir](https://discuss.elastic.co/u/truptir)\ **Replies:** 1\ **Last updated:** [January 28, 2022, 4:05pm UTC](https://discuss.elastic.co/t/logstash-unexpected-end-of-input-within-between-object-entries-for-curly-brace-inside-string/295659 "2022-01-28T16:05:28Z")
When String contains opening curly braces '{' logstash failed to parse that JSON. As per JSON doc, we don't need to escape curly brace. then how can I parse this type of JSON through logstash? JSON file: { "DESCRIPTIO… --- ## [SQL - Perform ORDR BY SUM(col1\*col2)](https://discuss.elastic.co/t/sql-perform-ordr-by-sum-col1-col2/294300)
**Author:** [@yamaga](https://discuss.elastic.co/u/yamaga)\ **Replies:** 2\ **Last updated:** [January 28, 2022, 3:29pm UTC](https://discuss.elastic.co/t/sql-perform-ordr-by-sum-col1-col2/294300 "2022-01-28T15:29:18Z")
Hi I am willing to execute this query, retreive the top products with haghiest value: SELECT ID\_PROD, SUM(PRICE\*VOLUME) AS \*\*VALUE\*\* FROM sales group by ID\_PROD ORDER BY VALUE I receive this error: { "message": "Cl… --- ## [Elastic Agent RPM and Fleet](https://discuss.elastic.co/t/elastic-agent-rpm-and-fleet/294559)
**Author:** [@thleh](https://discuss.elastic.co/u/thleh)\ **Replies:** 1\ **Last updated:** [January 28, 2022, 3:08pm UTC](https://discuss.elastic.co/t/elastic-agent-rpm-and-fleet/294559 "2022-01-28T15:08:31Z")
Hi all, i have installed elastic agent on a couple of linux servers. I used the rpm package from repository as installation source and restired the agend afterwards in fleet management. The status of agents are Healthy… --- ## [Java Api Client RangeQueryBuilder has JsonData as an attribute for gte etc](https://discuss.elastic.co/t/java-api-client-rangequerybuilder-has-jsondata-as-an-attribute-for-gte-etc/293462)
**Author:** [@Piotr\_Idzikowski](https://discuss.elastic.co/u/Piotr_Idzikowski)\ **Replies:** 2\ **Last updated:** [January 28, 2022, 2:58pm UTC](https://discuss.elastic.co/t/java-api-client-rangequerybuilder-has-jsondata-as-an-attribute-for-gte-etc/293462 "2022-01-28T14:58:17Z")
Hello. I am trying to migrate my java application to use new java api client. Today I realized that RangeQUeryBuildar has these strange types for gte, lte, etc methods. Why is it JsonData type? I am using Elasticsear… --- ## [Filebeat - Multiple VPC logs from different S3 buckets not working](https://discuss.elastic.co/t/filebeat-multiple-vpc-logs-from-different-s3-buckets-not-working/292711)
**Author:** [@antondubek](https://discuss.elastic.co/u/antondubek)\ **Replies:** 14\ **Last updated:** [January 28, 2022, 2:54pm UTC](https://discuss.elastic.co/t/filebeat-multiple-vpc-logs-from-different-s3-buckets-not-working/292711 "2022-01-28T14:54:45Z")
HI All, Within our AWS account, we have 2 VPC's that output flow logs into individual separate S3 buckets. I have enabled event notifications and connected them to SQS which all works. I also have WAF and ALB logs which… --- ## [Capacidad de la leyenda en vega](https://discuss.elastic.co/t/capacidad-de-la-leyenda-en-vega/294298)
**Author:** [@EduardoM](https://discuss.elastic.co/u/EduardoM)\ **Replies:** 1\ **Last updated:** [January 28, 2022, 2:52pm UTC](https://discuss.elastic.co/t/capacidad-de-la-leyenda-en-vega/294298 "2022-01-28T14:52:56Z")
Buen dia tengan todos, tengo una visualización en vega y al parecer no soporta más de 29 datos diferentes para una leyenda que se llama Productos, se podrá de alguna forma extender la capacidad de una leyenda en vega? … --- ## [Font size and colors in Lens bar charts](https://discuss.elastic.co/t/font-size-and-colors-in-lens-bar-charts/295694)
**Author:** [@fgjensen](https://discuss.elastic.co/u/fgjensen)\ **Replies:** 2\ **Last updated:** [January 28, 2022, 2:32pm UTC](https://discuss.elastic.co/t/font-size-and-colors-in-lens-bar-charts/295694 "2022-01-28T14:32:54Z")
Hello, This is a pretty basic question, but I cannot find the answers in the Kibana documentation. I have a Lens bar charts visualization where I want to change the font size and colors of the bar legends and axis titl… --- ## [How can I find is ilm policy been applied to my index?](https://discuss.elastic.co/t/how-can-i-find-is-ilm-policy-been-applied-to-my-index/295708)
**Author:** [@baalchina](https://discuss.elastic.co/u/baalchina)\ **Replies:** 1\ **Last updated:** [January 28, 2022, 2:26pm UTC](https://discuss.elastic.co/t/how-can-i-find-is-ilm-policy-been-applied-to-my-index/295708 "2022-01-28T14:26:09Z")
Hi, I am trying to apply a ILM policy to my index, I created a new index template, all of them are empty except a index pattern(and this pattern has some index include). At last, I assigin the ILM policy to the new index… --- ## [Save Menu disappears from embedded iframe after create visualization click](https://discuss.elastic.co/t/save-menu-disappears-from-embedded-iframe-after-create-visualization-click/295713)
**Author:** [@Agus\_Roca](https://discuss.elastic.co/u/Agus_Roca)\ **Replies:** 0\ **Last updated:** [January 28, 2022, 2:07pm UTC](https://discuss.elastic.co/t/save-menu-disappears-from-embedded-iframe-after-create-visualization-click/295713 "2022-01-28T14:07:13Z")
Hi fellows! I shared a dashboard with the top menu enabled so that i can create visualizations and save them while embedded in my site.. This works ok on load, but when i hit create visualization, the Save Menu dissappe… --- ## [Set “ssl” parameter for jdbc input plugin for cassandra](https://discuss.elastic.co/t/set-ssl-parameter-for-jdbc-input-plugin-for-cassandra/295711)
**Author:** [@Akshay\_Kulkarni](https://discuss.elastic.co/u/Akshay_Kulkarni)\ **Replies:** 0\ **Last updated:** [January 28, 2022, 1:46pm UTC](https://discuss.elastic.co/t/set-ssl-parameter-for-jdbc-input-plugin-for-cassandra/295711 "2022-01-28T13:46:10Z")
Hi, Im trying to connect to ssl cassandra with dbschema jdbc drivers. but failing to connect. where as successful to connect to non ssl cassandra db. Also with cdata drivers im able to connect both ssl & non ssl cassa… --- ## [Using rally without GIT and S3 bucket](https://discuss.elastic.co/t/using-rally-without-git-and-s3-bucket/295681)
**Author:** [@marek\_duciuc](https://discuss.elastic.co/u/marek_duciuc)\ **Replies:** 2\ **Last updated:** [January 28, 2022, 1:20pm UTC](https://discuss.elastic.co/t/using-rally-without-git-and-s3-bucket/295681 "2022-01-28T13:20:17Z")
Is there a way to use rally without setting up git and S3? What I mean during track development I do not want it to be committed to git and also I just want to have data locally into in s3 for now. How do I do it? At l… --- ## [Filter to send only system shortnames](https://discuss.elastic.co/t/filter-to-send-only-system-shortnames/295704)
**Author:** [@StuWhitby](https://discuss.elastic.co/u/StuWhitby)\ **Replies:** 1\ **Last updated:** [January 28, 2022, 1:17pm UTC](https://discuss.elastic.co/t/filter-to-send-only-system-shortnames/295704 "2022-01-28T13:17:27Z")
Hi, I'm new to Logstash, and attempting to update our company's configuration which currently sends syslog data to Splunk. I've searched on how to standardise the system naming, which may have the shortname or the long… --- ## [Auditbeat Conditional Processing if then else](https://discuss.elastic.co/t/auditbeat-conditional-processing-if-then-else/295697)
**Author:** [@mgotechlock](https://discuss.elastic.co/u/mgotechlock)\ **Replies:** 0\ **Last updated:** [January 28, 2022, 11:49am UTC](https://discuss.elastic.co/t/auditbeat-conditional-processing-if-then-else/295697 "2022-01-28T11:49:31Z")
For reference on what works and what doesn't in processors in auditbeat. Adding multiple conditions(like an OR condition) works fine like this: processors: - if: equals: process.executable: "/home/… --- ## [Sharing Dashboard via iFrame fails to login](https://discuss.elastic.co/t/sharing-dashboard-via-iframe-fails-to-login/295639)
**Author:** [@nsimi](https://discuss.elastic.co/u/nsimi)\ **Replies:** 4\ **Last updated:** [January 28, 2022, 1:03pm UTC](https://discuss.elastic.co/t/sharing-dashboard-via-iframe-fails-to-login/295639 "2022-01-28T13:03:35Z")
Hello All, I was looking at trying to share access to my Dashboard via the provided iFrame code, and when I place the iFrame into my html page it its my kibana instance but... it fails to let me log in and see my dashbo… --- ## [Kibana export CSV from discovery - err:Unsupported content-type of false specified by job output](https://discuss.elastic.co/t/kibana-export-csv-from-discovery-err-unsupported-content-type-of-false-specified-by-job-output/295705)
**Author:** [@Petr.Simik](https://discuss.elastic.co/u/Petr.Simik)\ **Replies:** 0\ **Last updated:** [January 28, 2022, 12:59pm UTC](https://discuss.elastic.co/t/kibana-export-csv-from-discovery-err-unsupported-content-type-of-false-specified-by-job-output/295705 "2022-01-28T12:59:19Z")
Elastic/Kibana version 7.13.3 I am trying to export data from Elasticsearch using discover-\>save as-\>share-\>csv reports -\> generate CSV But I receive messge report generated and when I try to download it it provides … --- ## [Pie Chart - Field name is not Visible](https://discuss.elastic.co/t/pie-chart-field-name-is-not-visible/295691)
**Author:** [@Susendiran](https://discuss.elastic.co/u/Susendiran)\ **Replies:** 4\ **Last updated:** [January 28, 2022, 12:47pm UTC](https://discuss.elastic.co/t/pie-chart-field-name-is-not-visible/295691 "2022-01-28T12:47:14Z")
Hello Team, We are facing one issue in Pie-chart visualization which is not showing a field named - "Hospitality". The amount/quantity is visible in pie-chart view but the field name alone not visible while viewing(not … --- ## [Настройка winlogbeat для контроллеров домена](https://discuss.elastic.co/t/winlogbeat/294112)
**Author:** [@holpa](https://discuss.elastic.co/u/holpa)\ **Replies:** 1\ **Last updated:** [January 28, 2022, 12:16pm UTC](https://discuss.elastic.co/t/winlogbeat/294112 "2022-01-28T12:16:55Z")
Привет. Подскажите как правильно настроить. Есть сервер srvlog, он собирает все логи с контроллеров домена (forward event). Как настроить WinLogbeat для отправки логов, полученных этим сервером? Моя конфигурация сейчас… --- ## [Get documents based on some filter conditions](https://discuss.elastic.co/t/get-documents-based-on-some-filter-conditions/295431)
**Author:** [@Khushboo\_Kaul](https://discuss.elastic.co/u/Khushboo_Kaul)\ **Replies:** 1\ **Last updated:** [January 26, 2022, 11:50pm UTC](https://discuss.elastic.co/t/get-documents-based-on-some-filter-conditions/295431 "2022-01-26T23:50:26Z")
Hi, I am trying to use spark ( pyspark) and my goal is to query from the huge Elasticsearch index a subset of data that matches a particular condition of column. For example, if my columns are - name, age, timestamp I… --- ## [Using CoOrdinated nodes in ES cluster](https://discuss.elastic.co/t/using-coordinated-nodes-in-es-cluster/295608)
**Author:** [@sreekanth](https://discuss.elastic.co/u/sreekanth)\ **Replies:** 4\ **Last updated:** [January 28, 2022, 11:42am UTC](https://discuss.elastic.co/t/using-coordinated-nodes-in-es-cluster/295608 "2022-01-28T11:42:12Z")
I have 6 nodes cluster where all nodes marked with "mdi". Now I added 3 more Co-Ordinated nodes and configured with master=false, data=false, ingest=false. Now those nodes shows role as "-". As per doc this indicates th… --- ## [Error registering plugin Beats input](https://discuss.elastic.co/t/error-registering-plugin-beats-input/295596)
**Author:** [@florinb](https://discuss.elastic.co/u/florinb)\ **Replies:** 2\ **Last updated:** [January 28, 2022, 11:04am UTC](https://discuss.elastic.co/t/error-registering-plugin-beats-input/295596 "2022-01-28T11:04:28Z")
i'm running a dockerised Logstash 6.8.23 on java 1.8 image with all dependencies fulfilled: $ java -version openjdk version "1.8.0\_312" OpenJDK Runtime Environment (build 1.8.0\_312-b07) OpenJDK 64-Bit Server VM (build 2… --- ## [Journalbeat is being stuck](https://discuss.elastic.co/t/journalbeat-is-being-stuck/295312)
**Author:** [@qwinkler](https://discuss.elastic.co/u/qwinkler)\ **Replies:** 2\ **Last updated:** [January 28, 2022, 10:33am UTC](https://discuss.elastic.co/t/journalbeat-is-being-stuck/295312 "2022-01-28T10:33:36Z")
Journalbeat stuck for an unknown reason. Also, this only happens on the nodes with more logs than on the other ones. There are around 5 logs per second (which I don't think is a big load), but still. Here is an actual b… --- ## [About Synonym toke filter](https://discuss.elastic.co/t/about-synonym-toke-filter/294501)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 2\ **Last updated:** [January 28, 2022, 10:32am UTC](https://discuss.elastic.co/t/about-synonym-toke-filter/294501 "2022-01-28T10:32:49Z")
I am using synonym token filter in my mapping but it has a property called synonyms\_path. PUT /\_template/ise { "index\_patterns" : \["log-ise-\*"\], "settings": { "index.lifecycle.name":"ise\_policy", "ind… --- ## [Winlogbeat output config problems](https://discuss.elastic.co/t/winlogbeat-output-config-problems/295628)
**Author:** [@jlareos](https://discuss.elastic.co/u/jlareos)\ **Replies:** 5\ **Last updated:** [January 28, 2022, 10:21am UTC](https://discuss.elastic.co/t/winlogbeat-output-config-problems/295628 "2022-01-28T10:21:01Z")
Hi everyone! I have installed in a VMWare machine the Security Onion OS. On the same machine i have installed winlogbeat and i'm having problems with the yml file. When i execute this command ./winlogbeat test config … [Previous page](https://discuss.elastic.co/latest.md?page=1285) [Next page](https://discuss.elastic.co/latest.md?page=1287)