# Latest **URL:** https://discuss.elastic.co/latest.md?page=1290 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1291 --- ## [Fleet and Suricata for Elastic Security](https://discuss.elastic.co/t/fleet-and-suricata-for-elastic-security/295455)
**Author:** [@Limoelou](https://discuss.elastic.co/u/Limoelou)\ **Replies:** 1\ **Last updated:** [January 26, 2022, 5:16pm UTC](https://discuss.elastic.co/t/fleet-and-suricata-for-elastic-security/295455 "2022-01-26T17:16:26Z")
Hello, I am a junior Cybersecurity Engineer and I have to build from scratch a SIEM that needs to monitor many hosts. Until now, I had several agents (filebeat, auditbeat, winlogbeat, suricata) installed on several ho… --- ## [Elastic Agent installed on Elastic Servers](https://discuss.elastic.co/t/elastic-agent-installed-on-elastic-servers/295489)
**Author:** [@bob.newell](https://discuss.elastic.co/u/bob.newell)\ **Replies:** 0\ **Last updated:** [January 26, 2022, 4:43pm UTC](https://discuss.elastic.co/t/elastic-agent-installed-on-elastic-servers/295489 "2022-01-26T16:43:41Z")
Is it possible to install the elastic agent on the elastic servers so that they can be included in the log data? --- ## [Importing existing index from one server to other](https://discuss.elastic.co/t/importing-existing-index-from-one-server-to-other/295487)
**Author:** [@ac123](https://discuss.elastic.co/u/ac123)\ **Replies:** 1\ **Last updated:** [January 26, 2022, 4:38pm UTC](https://discuss.elastic.co/t/importing-existing-index-from-one-server-to-other/295487 "2022-01-26T16:38:47Z")
Hello all, I was wondering the method of importing a single index from one server to another. Currently using restore from backup but one of the indexes are not populating on the main server but is working fine on our d… --- ## [CentOS Yum Repo Issues](https://discuss.elastic.co/t/centos-yum-repo-issues/294619)
**Author:** [@dgoldsmith](https://discuss.elastic.co/u/dgoldsmith)\ **Replies:** 2\ **Last updated:** [January 26, 2022, 4:34pm UTC](https://discuss.elastic.co/t/centos-yum-repo-issues/294619 "2022-01-26T16:34:58Z")
If I simply point a server to the Elastic Yum repo at https://artifacts.elastic.co/packages/7.x/yum/ using a copy of the Yum repo config file provided from the elastic web site, it is able to reach out and retrieve the Y… --- ## [Creating a new pipeline in Logstash](https://discuss.elastic.co/t/creating-a-new-pipeline-in-logstash/295478)
**Author:** [@goncalobsantos](https://discuss.elastic.co/u/goncalobsantos)\ **Replies:** 1\ **Last updated:** [January 26, 2022, 4:16pm UTC](https://discuss.elastic.co/t/creating-a-new-pipeline-in-logstash/295478 "2022-01-26T16:16:58Z")
Step 1. I have edited the pipelines.yml file, adding a third pipeline to the two already existing. Step 2. The corresponding configuration file is placed in the /conf.d folder. Step 3. I stoped and started logstash, ex… --- ## [Logstash with many config files vs one config with many files](https://discuss.elastic.co/t/logstash-with-many-config-files-vs-one-config-with-many-files/295473)
**Author:** [@nikssssss](https://discuss.elastic.co/u/nikssssss)\ **Replies:** 2\ **Last updated:** [January 26, 2022, 3:44pm UTC](https://discuss.elastic.co/t/logstash-with-many-config-files-vs-one-config-with-many-files/295473 "2022-01-26T15:44:46Z")
hello everybody, i have not understand what is the best solution if you have many input files. Should you use one config file with the configuration of input files or create one config file per input file. (ex. 5-10 fil… --- ## [Metricbeat Index pattern](https://discuss.elastic.co/t/metricbeat-index-pattern/295340)
**Author:** [@Christer\_Palmen](https://discuss.elastic.co/u/Christer_Palmen)\ **Replies:** 2\ **Last updated:** [January 26, 2022, 3:41pm UTC](https://discuss.elastic.co/t/metricbeat-index-pattern/295340 "2022-01-26T15:41:32Z")
Hello. I have noticed some issues with my metricbeat dashboard. I installed metricbeat 7.14 in 57 hosts before Christmas and the dashboard worked fine. Went to Christmas holidays and came back with noticing an error m… --- ## [The logstash container crashes the network of the host machine and then exit with OOM killer](https://discuss.elastic.co/t/the-logstash-container-crashes-the-network-of-the-host-machine-and-then-exit-with-oom-killer/295477)
**Author:** [@Ahmad\_BenMaallem](https://discuss.elastic.co/u/Ahmad_BenMaallem)\ **Replies:** 0\ **Last updated:** [January 26, 2022, 3:36pm UTC](https://discuss.elastic.co/t/the-logstash-container-crashes-the-network-of-the-host-machine-and-then-exit-with-oom-killer/295477 "2022-01-26T15:36:51Z")
Hello, I am trying to run a logstash 7.14.1 with docker-compose to collect logs from multiple files and write them to a remote Elasticsearch. After starting, logstash manages to send my logs to Elasticsearch without pr… --- ## [ElasticSearch Read/Write performance issue on Peak Load](https://discuss.elastic.co/t/elasticsearch-read-write-performance-issue-on-peak-load/295216)
**Author:** [@sahil441](https://discuss.elastic.co/u/sahil441)\ **Replies:** 3\ **Last updated:** [January 26, 2022, 3:26pm UTC](https://discuss.elastic.co/t/elasticsearch-read-write-performance-issue-on-peak-load/295216 "2022-01-26T15:26:21Z")
Context: We are running ES Cluster (ES Version - "7.9.1") with 3 Master-Nodes & 8 data-nodes (AWS-"r5.2xlarge") We are using the default ES thread pool configuration There are 2 indices having 5 shards each (used by th… --- ## [Unclear error/warning - Resource plans are inconsistent](https://discuss.elastic.co/t/unclear-error-warning-resource-plans-are-inconsistent/295450)
**Author:** [@SanderP](https://discuss.elastic.co/u/SanderP)\ **Replies:** 2\ **Last updated:** [January 26, 2022, 3:24pm UTC](https://discuss.elastic.co/t/unclear-error-warning-resource-plans-are-inconsistent/295450 "2022-01-26T15:24:45Z")
Hi, I'm seeing this error "Resource plans are inconsistent with deployment logging and metrics settings. Please reapply desired settings" at Logs and metrics in the Elastic Cloud. Several deployments on the same account… --- ## [Where do I find the indices created by appsearch in elasticsearch?](https://discuss.elastic.co/t/where-do-i-find-the-indices-created-by-appsearch-in-elasticsearch/293480)
**Author:** [@Rouabah\_Oussama](https://discuss.elastic.co/u/Rouabah_Oussama)\ **Replies:** 2\ **Last updated:** [January 26, 2022, 3:13pm UTC](https://discuss.elastic.co/t/where-do-i-find-the-indices-created-by-appsearch-in-elasticsearch/293480 "2022-01-26T15:13:48Z")
I am working on a project using appsearch as a search engine, but I need to make a "more like this" query which is not available in appsearch so I need to write the query directly to elasticsearch. Is there a way to do … --- ## [Logs are not received on the Fleet server](https://discuss.elastic.co/t/logs-are-not-received-on-the-fleet-server/295345)
**Author:** [@b.kaliuzhnyi](https://discuss.elastic.co/u/b.kaliuzhnyi)\ **Replies:** 4\ **Last updated:** [January 26, 2022, 3:02pm UTC](https://discuss.elastic.co/t/logs-are-not-received-on-the-fleet-server/295345 "2022-01-26T15:02:53Z")
The situation is similar to that of the link: https://discuss.elastic.co/t/elastic-agent-error/282706 I have installed two Elastic Agents, one of them as a Fleet server. Their status is Healthy. The fleet server policy… --- ## [Pipe to pipe with multiline codec on the second pipe](https://discuss.elastic.co/t/pipe-to-pipe-with-multiline-codec-on-the-second-pipe/295456)
**Author:** [@John\_Smith1](https://discuss.elastic.co/u/John_Smith1)\ **Replies:** 4\ **Last updated:** [January 26, 2022, 2:51pm UTC](https://discuss.elastic.co/t/pipe-to-pipe-with-multiline-codec-on-the-second-pipe/295456 "2022-01-26T14:51:33Z")
It's seems impossible, but just in case want to ask, is there some way to apply multiline code plugin in the second pipe, that receive logs from first pipe. first pipe pipe\_01.conf output: pipeline { send\_to =\>… --- ## [Watcher - Use field data from input to condition script calc](https://discuss.elastic.co/t/watcher-use-field-data-from-input-to-condition-script-calc/295427)
**Author:** [@gerardgorrion](https://discuss.elastic.co/u/gerardgorrion)\ **Replies:** 1\ **Last updated:** [January 26, 2022, 2:49pm UTC](https://discuss.elastic.co/t/watcher-use-field-data-from-input-to-condition-script-calc/295427 "2022-01-26T14:49:55Z")
We are triying to deploy a watcher alert to compare values into a field of some logs The problem is: we need to compare 2 fields loaded in input: 1- metricbeat logs with some specific field 2- metricbeat logs with so… --- ## [Documentation issue for elastic version 8 breaking changes](https://discuss.elastic.co/t/documentation-issue-for-elastic-version-8-breaking-changes/294416)
**Author:** [@raulk89](https://discuss.elastic.co/u/raulk89)\ **Replies:** 1\ **Last updated:** [January 26, 2022, 2:48pm UTC](https://discuss.elastic.co/t/documentation-issue-for-elastic-version-8-breaking-changes/294416 "2022-01-26T14:48:53Z")
Hi https://www.elastic.co/guide/en/elasticsearch/reference/8.0/migrating-8.0.html#breaking-changes-8.0 How one should understand this, seems like contrary sentences..? Regards Raul --- ## [Logstash LogStash::Error: Don’t know how to handle \`Java::JavaLang::IllegalArgumentException\` for \`PipelineAction::Create\\`](https://discuss.elastic.co/t/logstash-logstash-don-t-know-how-to-handle-java-illegalargumentexception-for-pipelineaction-create-main/295468)
**Author:** [@Faisal\_Malik](https://discuss.elastic.co/u/Faisal_Malik)\ **Replies:** 0\ **Last updated:** [January 26, 2022, 2:44pm UTC](https://discuss.elastic.co/t/logstash-logstash-don-t-know-how-to-handle-java-illegalargumentexception-for-pipelineaction-create-main/295468 "2022-01-26T14:44:43Z")
My logstash was working fine through the Helm chart in Kubernetes stateful set. I updated the logstash version from 7.9 to 7.16.2 but its don't work so I revert to the previous version 7.9 After reverting it also gives … --- ## [Creating a Custom Beat](https://discuss.elastic.co/t/creating-a-custom-beat/295366)
**Author:** [@Markus\_Lindner](https://discuss.elastic.co/u/Markus_Lindner)\ **Replies:** 1\ **Last updated:** [January 26, 2022, 2:43pm UTC](https://discuss.elastic.co/t/creating-a-custom-beat/295366 "2022-01-26T14:43:36Z")
Hi, does someone have a current ( 2021 + ) documentation for creating a custom beat? Or an idea how I can deliver custom data to my elastic database? When i try to change a community beat, i cant make (make setup) it. … --- ## [Metricbeats can't recognize kubernetes dns](https://discuss.elastic.co/t/metricbeats-cant-recognize-kubernetes-dns/295389)
**Author:** [@Sebastian\_Randoll\_Le](https://discuss.elastic.co/u/Sebastian_Randoll_Le)\ **Replies:** 1\ **Last updated:** [January 26, 2022, 2:38pm UTC](https://discuss.elastic.co/t/metricbeats-cant-recognize-kubernetes-dns/295389 "2022-01-26T14:38:19Z")
Hello I'm using ECK 1.19 and I'm implementing monitoring with beat use the following: --- apiVersion: beat.k8s.elastic.co/v1beta1 kind: Beat metadata: name: metricbeat spec: type: metricbeat version: 7.16.2 ela… --- ## [\[PLEASE\_HELP\] Consistent searching with search\_after](https://discuss.elastic.co/t/please-help-consistent-searching-with-search-after/294033)
**Author:** [@Juan\_Longo](https://discuss.elastic.co/u/Juan_Longo)\ **Replies:** 2\ **Last updated:** [January 26, 2022, 2:13pm UTC](https://discuss.elastic.co/t/please-help-consistent-searching-with-search-after/294033 "2022-01-26T14:13:50Z")
Hello, I need help making one of our queries consistent. We currently make a query that handles a big amount of documents. The problem I'm having is with an index that have documents that literally have the same properti… --- ## [Broken Grok filter since V7.10.0](https://discuss.elastic.co/t/broken-grok-filter-since-v7-10-0/295379)
**Author:** [@Landong.Zuo](https://discuss.elastic.co/u/Landong.Zuo)\ **Replies:** 2\ **Last updated:** [January 26, 2022, 2:09pm UTC](https://discuss.elastic.co/t/broken-grok-filter-since-v7-10-0/295379 "2022-01-26T14:09:22Z")
Hi , I've recently upgraded logstash from V7.6.0 to V7.16.3. and have seen some odd behaviors of Grok filter since then. filter { grok { patterns\_dir =\> "C:\\software\\ELK\\config\\patterns" … --- ## [Painless error](https://discuss.elastic.co/t/painless-error/295335)
**Author:** [@Tuckson](https://discuss.elastic.co/u/Tuckson)\ **Replies:** 3\ **Last updated:** [January 25, 2022, 4:24pm UTC](https://discuss.elastic.co/t/painless-error/295335 "2022-01-25T16:24:54Z")
Question is easy (and yes I am new to this painfull stuff), what am I doing wrong? { "docs": \[ { "error": { "root\_cause": \[ { "type": "script\_exception", "reason": "… --- ## [All beats have missing documents or timestamp not accurate](https://discuss.elastic.co/t/all-beats-have-missing-documents-or-timestamp-not-accurate/295065)
**Author:** [@cctk](https://discuss.elastic.co/u/cctk)\ **Replies:** 6\ **Last updated:** [January 26, 2022, 1:38pm UTC](https://discuss.elastic.co/t/all-beats-have-missing-documents-or-timestamp-not-accurate/295065 "2022-01-26T13:38:51Z")
I am experiencing several documents missing after the upgrade to 7.0. Metricbeat dashboard used to show a regular update of the cpu and memory , however now it now shows a dash (-) for 1m before showing update. this make… --- ## [Extracting key pair Values using nested Json Paths](https://discuss.elastic.co/t/extracting-key-pair-values-using-nested-json-paths/295419)
**Author:** [@vaseemQA](https://discuss.elastic.co/u/vaseemQA)\ **Replies:** 4\ **Last updated:** [January 26, 2022, 1:35pm UTC](https://discuss.elastic.co/t/extracting-key-pair-values-using-nested-json-paths/295419 "2022-01-26T13:35:26Z")
Hi Guys, I'm Using Json plugin in filter and trying to fetch a value which resides in below json path. parsedJson.query.bool.filter\[0\].bool.must\[0\].bool.must\[2\].term\["list\_attributes.orderId.long"\].value and actually … --- ## [Systemd services' settings in deb packages](https://discuss.elastic.co/t/systemd-services-settings-in-deb-packages/295452)
**Author:** [@alexandrpaliy](https://discuss.elastic.co/u/alexandrpaliy)\ **Replies:** 0\ **Last updated:** [January 26, 2022, 12:52pm UTC](https://discuss.elastic.co/t/systemd-services-settings-in-deb-packages/295452 "2022-01-26T12:52:15Z")
Hi all. Just figured out that in deb packages, provided by your repo, systemd.service's 'Restart=' option is... inconsistent? $ systemctl cat elasticsearch | grep ^Restart \ $ systemctl cat logstash | grep ^Rest… --- ## [Engineer Lab + Instrutions](https://discuss.elastic.co/t/engineer-lab-instrutions/295154)
**Author:** [@HJE](https://discuss.elastic.co/u/HJE)\ **Replies:** 3\ **Last updated:** [January 26, 2022, 12:03pm UTC](https://discuss.elastic.co/t/engineer-lab-instrutions/295154 "2022-01-26T12:03:27Z")
Hi I have started the Elasticsearch Engineer on-demand, but my strigo access for that caorse have expired (i guess i where to slow to get the course done) So i wanted to set up my own lab, but i cant find the download l… --- ## [org.elasticsearch.ElasticsearchException: Failed to parse info response. Check logs for detailed information - Unsupported Content-Type: text/html](https://discuss.elastic.co/t/org-elasticsearch-elasticsearchexception-failed-to-parse-info-response-check-logs-for-detailed-information-unsupported-content-type-text-html/295417)
**Author:** [@Sumit\_Jha1](https://discuss.elastic.co/u/Sumit_Jha1)\ **Replies:** 5\ **Last updated:** [January 26, 2022, 11:22am UTC](https://discuss.elastic.co/t/org-elasticsearch-elasticsearchexception-failed-to-parse-info-response-check-logs-for-detailed-information-unsupported-content-type-text-html/295417 "2022-01-26T11:22:58Z")
I am using Elastic Search High Level REST API 7.15.0 (Java) and the version of ES deployed on elastic.co is 7.15.2 When making any request using the client, in the logs I can see, the client first makes call to cluster … --- ## [\[BUG\] APM data including Transactions, Spans, CPU and Memory metrics are not sent when CPU utilization over 60%](https://discuss.elastic.co/t/bug-apm-data-including-transactions-spans-cpu-and-memory-metrics-are-not-sent-when-cpu-utilization-over-60/295059)
**Author:** [@kbalys](https://discuss.elastic.co/u/kbalys)\ **Replies:** 1\ **Last updated:** [January 26, 2022, 10:58am UTC](https://discuss.elastic.co/t/bug-apm-data-including-transactions-spans-cpu-and-memory-metrics-are-not-sent-when-cpu-utilization-over-60/295059 "2022-01-26T10:58:17Z")
I created an issue for APM dotnet plugin here \[BUG\] APM data including Transactions, Spans, CPU and Memory metrics are not sent when CPU utilization over 60% · Issue #1571 · elastic/apm-agent-dotnet · GitHub Recently I… --- ## [For dotnet code, if a different DLL reports an error, the grabbed interface is incorrect](https://discuss.elastic.co/t/for-dotnet-code-if-a-different-dll-reports-an-error-the-grabbed-interface-is-incorrect/294538)
**Author:** [@wajika](https://discuss.elastic.co/u/wajika)\ **Replies:** 3\ **Last updated:** [January 26, 2022, 10:57am UTC](https://discuss.elastic.co/t/for-dotnet-code-if-a-different-dll-reports-an-error-the-grabbed-interface-is-incorrect/294538 "2022-01-26T10:57:51Z")
I tried to upgrade Elastic.Apm.NetCoreAll to 1.13.0, then started the service and debugged an interface, the service got an error (similar to Elastic.Apm.NetCoreAll compatibility issues), that's not the point. I am oper… --- ## [Indirect dependency on the framework assembly(System.Tuplevalue)](https://discuss.elastic.co/t/indirect-dependency-on-the-framework-assembly-system-tuplevalue/294987)
**Author:** [@sathish\_reddy](https://discuss.elastic.co/u/sathish_reddy)\ **Replies:** 3\ **Last updated:** [January 26, 2022, 10:42am UTC](https://discuss.elastic.co/t/indirect-dependency-on-the-framework-assembly-system-tuplevalue/294987 "2022-01-26T10:42:26Z")
The primary reference could not be resolved because it has an indirect dependency on the framework assembly "System.ValueTuple, Version=4.0.2.0, Culture=neutral, PublicKeyToken=cc7b13ffcd2ddd51" which could not be resolv… --- ## [Elastic Cloud APM not showing logs in Transactions Page](https://discuss.elastic.co/t/elastic-cloud-apm-not-showing-logs-in-transactions-page/293597)
**Author:** [@tsoeiro](https://discuss.elastic.co/u/tsoeiro)\ **Replies:** 2\ **Last updated:** [January 26, 2022, 10:22am UTC](https://discuss.elastic.co/t/elastic-cloud-apm-not-showing-logs-in-transactions-page/293597 "2022-01-26T10:22:30Z")
What makes Kibana to not show docker container logs in APM "Transactions" page under "Logs" tab. I verified the logs are successfully being generated with the "trace.id" associated for proper linking. I have the ex… [Previous page](https://discuss.elastic.co/latest.md?page=1289) [Next page](https://discuss.elastic.co/latest.md?page=1291)