# Latest **URL:** https://discuss.elastic.co/latest.md?page=1300 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1301 --- ## [Elastic search not starting](https://discuss.elastic.co/t/elastic-search-not-starting/294789)
**Author:** [@rohit45](https://discuss.elastic.co/u/rohit45)\ **Replies:** 12\ **Last updated:** [January 20, 2022, 9:49am UTC](https://discuss.elastic.co/t/elastic-search-not-starting/294789 "2022-01-20T09:49:53Z")
at org.elasticsearch.bootstrap.Bootstrap$5.\(Bootstrap.java:234) ~\[elasticsearch-7.16.3.jar:7.16.3\] at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:234) ~\[elasticsearch-7.16.3.jar:7.16… --- ## [Is there a list of files that get changes for account creation/disabling, login and connection attempts as well as api calls etc. for ELK?](https://discuss.elastic.co/t/is-there-a-list-of-files-that-get-changes-for-account-creation-disabling-login-and-connection-attempts-as-well-as-api-calls-etc-for-elk/294005)
**Author:** [@Huseyin\_Tunctepe](https://discuss.elastic.co/u/Huseyin_Tunctepe)\ **Replies:** 2\ **Last updated:** [January 20, 2022, 9:24am UTC](https://discuss.elastic.co/t/is-there-a-list-of-files-that-get-changes-for-account-creation-disabling-login-and-connection-attempts-as-well-as-api-calls-etc-for-elk/294005 "2022-01-20T09:24:42Z")
How are creating/disabling an Elasticsearch account, logging in to Elasticsearch, network connection to ELK or API calls are logged? Also, interested to know if there is a ELK specific audit logging. The purpose of thi… --- ## [Add time range filter in this prometheus.yml of metricbeat to get output for a particular time interval](https://discuss.elastic.co/t/add-time-range-filter-in-this-prometheus-yml-of-metricbeat-to-get-output-for-a-particular-time-interval/294822)
**Author:** [@tweet2santosh86](https://discuss.elastic.co/u/tweet2santosh86)\ **Replies:** 2\ **Last updated:** [January 20, 2022, 9:24am UTC](https://discuss.elastic.co/t/add-time-range-filter-in-this-prometheus-yml-of-metricbeat-to-get-output-for-a-particular-time-interval/294822 "2022-01-20T09:24:28Z")
Hello Team, For metricbeat prometheus module we need output for a particular time interval.. How can we add the filter in at modules.d/prometheus.yml to get the output for a particular time interval.. Request for your … --- ## [Irrelevant field search results](https://discuss.elastic.co/t/irrelevant-field-search-results/293188)
**Author:** [@ethical20](https://discuss.elastic.co/u/ethical20)\ **Replies:** 10\ **Last updated:** [January 20, 2022, 9:12am UTC](https://discuss.elastic.co/t/irrelevant-field-search-results/293188 "2022-01-20T09:12:58Z")
Hi, I've made this Lucene query in Kibana to search if Nginx access logs contain a URL with the word "malware": source.as.organization.name: (/.\*\[Mm\]\[Aa\]\[Ll\]\[Ww\]\[Aa\]\[Rr\]\[Ee\].\*/) But in Kibana I'm getting the results … --- ## [No cipher suites in common for tcp input](https://discuss.elastic.co/t/no-cipher-suites-in-common-for-tcp-input/52764)
**Author:** [@Jason\_Woodrich](https://discuss.elastic.co/u/Jason_Woodrich)\ **Replies:** 1\ **Last updated:** [January 20, 2022, 9:12am UTC](https://discuss.elastic.co/t/no-cipher-suites-in-common-for-tcp-input/52764 "2022-01-20T09:12:17Z")
I'm trying to configure a tcp syslog input with SSL support and running into some problems. I've installed logstash 2.3.2 using the RPM from the Elastic site. Below is my configuration: input { tcp { port =\> 54… --- ## [Can we Search only by one field (f.e. title, description etc.)?](https://discuss.elastic.co/t/can-we-search-only-by-one-field-f-e-title-description-etc/294681)
**Author:** [@roman.bliztsv](https://discuss.elastic.co/u/roman.bliztsv)\ **Replies:** 8\ **Last updated:** [January 20, 2022, 8:51am UTC](https://discuss.elastic.co/t/can-we-search-only-by-one-field-f-e-title-description-etc/294681 "2022-01-20T08:51:54Z")
I've created a config using your documentation. const config = { searchQuery: { result\_fields: { art\_title: { raw: {}}, cra\_url\_doc: { raw: {}}, art\_fulltext: { snippet: { size:… --- ## [ES 7.16.0 and 7.16.1 Upgrade single node health yellow](https://discuss.elastic.co/t/es-7-16-0-and-7-16-1-upgrade-single-node-health-yellow/291875)
**Author:** [@VamPikmin](https://discuss.elastic.co/u/VamPikmin)\ **Replies:** 1\ **Last updated:** [January 20, 2022, 8:26am UTC](https://discuss.elastic.co/t/es-7-16-0-and-7-16-1-upgrade-single-node-health-yellow/291875 "2022-01-20T08:26:01Z")
Hello boys and girls I have a single ES node which has one index turn yellow curl -XGET localhost:9200/\_cat/health 1639519203 22:00:03 ndelastic yellow 1 1 317 317 0 0 1 0 - 99.7% curl -XGET localhost:9200/\_cluster/a… --- ## [McAfee Enterprise Enterprise Security triggers on Auditbeat in /etc/passwd.xx](https://discuss.elastic.co/t/mcafee-enterprise-enterprise-security-triggers-on-auditbeat-in-etc-passwd-xx/294846)
**Author:** [@odehen](https://discuss.elastic.co/u/odehen)\ **Replies:** 2\ **Last updated:** [January 20, 2022, 7:46am UTC](https://discuss.elastic.co/t/mcafee-enterprise-enterprise-security-triggers-on-auditbeat-in-etc-passwd-xx/294846 "2022-01-20T07:46:54Z")
We are using Elasticsearch 7.16.2 on RHEL with McAfee Enterprise. Apparently an alarm has gone off, namely the PREVENT\_MODIFICATION\_PASSWORDFILES\_LINUX rule because of Auditbeat supposedly attempting to modify /etc/passw… --- ## [Elasticsearch CCR synchronization](https://discuss.elastic.co/t/elasticsearch-ccr-synchronization/294902)
**Author:** [@fabry](https://discuss.elastic.co/u/fabry)\ **Replies:** 0\ **Last updated:** [January 20, 2022, 7:43am UTC](https://discuss.elastic.co/t/elasticsearch-ccr-synchronization/294902 "2022-01-20T07:43:49Z")
I have a couple of questions about how the CCR works. Does it uses a polling strategy? or whenever there is a new log it will be pushed to the remote cluster? In case is a polling strategy how can reduce the polling de… --- ## [Installable plugin checkbox disabled in Elastic Cloud due to subscription level](https://discuss.elastic.co/t/installable-plugin-checkbox-disabled-in-elastic-cloud-due-to-subscription-level/294899)
**Author:** [@likejazz](https://discuss.elastic.co/u/likejazz)\ **Replies:** 1\ **Last updated:** [January 20, 2022, 7:36am UTC](https://discuss.elastic.co/t/installable-plugin-checkbox-disabled-in-elastic-cloud-due-to-subscription-level/294899 "2022-01-20T07:36:02Z")
Same question here: I have ENTERPRISE subscription level in Elastic Cloud and cannot install custom plugin due to disabled option as shown above. https://cloud.elastic.co/deployment-features/extensions/create The m… --- ## [Upgrade of elastic, name of indices and data streams](https://discuss.elastic.co/t/upgrade-of-elastic-name-of-indices-and-data-streams/294850)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 6\ **Last updated:** [January 20, 2022, 7:27am UTC](https://discuss.elastic.co/t/upgrade-of-elastic-name-of-indices-and-data-streams/294850 "2022-01-20T07:27:05Z")
Hi, we have installed version 7.5 of the stack and we want to upgrade to the latest version, but our custom indexes are already called: metrics-\ example : metrics-interfaces . what problems could ari… --- ## [Metricbeat for ActiveMQ](https://discuss.elastic.co/t/metricbeat-for-activemq/294359)
**Author:** [@rodentskie](https://discuss.elastic.co/u/rodentskie)\ **Replies:** 10\ **Last updated:** [January 20, 2022, 7:18am UTC](https://discuss.elastic.co/t/metricbeat-for-activemq/294359 "2022-01-20T07:18:45Z")
Hi, I'm currently working on getting metrics from AWS activemq, but I can't get it on how to install jolokia module. Any idea? We are using a cloud Elasticsearch instance, and we apply our metricbeat using kubernetes ya… --- ## [How to get meassages and send them by email](https://discuss.elastic.co/t/how-to-get-meassages-and-send-them-by-email/294893)
**Author:** [@rrrr](https://discuss.elastic.co/u/rrrr)\ **Replies:** 3\ **Last updated:** [January 20, 2022, 7:09am UTC](https://discuss.elastic.co/t/how-to-get-meassages-and-send-them-by-email/294893 "2022-01-20T07:09:49Z")
In the watcher, how to get all messages and send them by email --- ## [Watcher index filed Type conversion](https://discuss.elastic.co/t/watcher-index-filed-type-conversion/294676)
**Author:** [@rrrr](https://discuss.elastic.co/u/rrrr)\ **Replies:** 2\ **Last updated:** [January 20, 2022, 6:11am UTC](https://discuss.elastic.co/t/watcher-index-filed-type-conversion/294676 "2022-01-20T06:11:31Z")
How to convert the type of a field to another type in the watcher? For example, if the type of age is text, you want to convert it to int --- ## [Max between two fields in last X days Kibana(lens)](https://discuss.elastic.co/t/max-between-two-fields-in-last-x-days-kibana-lens/294765)
**Author:** [@dash5000](https://discuss.elastic.co/u/dash5000)\ **Replies:** 16\ **Last updated:** [January 20, 2022, 4:05am UTC](https://discuss.elastic.co/t/max-between-two-fields-in-last-x-days-kibana-lens/294765 "2022-01-20T04:05:03Z")
Hello, I am stuck at a problem, where i have to get the maximum between two fields in a document in last X days. I am using the table format with lens. For example document has: name=test description=test description … --- ## [Execute yarn kbn bootstrap error](https://discuss.elastic.co/t/execute-yarn-kbn-bootstrap-error/294537)
**Author:** [@qixian](https://discuss.elastic.co/u/qixian)\ **Replies:** 2\ **Last updated:** [January 20, 2022, 1:44am UTC](https://discuss.elastic.co/t/execute-yarn-kbn-bootstrap-error/294537 "2022-01-20T01:44:40Z")
when i execut the command error,and I have configured the npm $PATH globally,who can ihelp me. --- ## [Need help to understand how standard tokenizer works](https://discuss.elastic.co/t/need-help-to-understand-how-standard-tokenizer-works/294860)
**Author:** [@jsjs2](https://discuss.elastic.co/u/jsjs2)\ **Replies:** 1\ **Last updated:** [January 20, 2022, 1:12am UTC](https://discuss.elastic.co/t/need-help-to-understand-how-standard-tokenizer-works/294860 "2022-01-20T01:12:42Z")
In the following two examples, I had hard time to understand why the outputs are different: POST \_analyze { "tokenizer": "standard", "text": "mark.cuban" } terms produced: \["mark.cuban"\] POST \_analyze { "tokeniz… --- ## [GROK | Problem ingest Pipeline | replace](https://discuss.elastic.co/t/grok-problem-ingest-pipeline-replace/294881)
**Author:** [@Walli](https://discuss.elastic.co/u/Walli)\ **Replies:** 1\ **Last updated:** [January 20, 2022, 12:59am UTC](https://discuss.elastic.co/t/grok-problem-ingest-pipeline-replace/294881 "2022-01-20T00:59:19Z")
Hello, I am new in the Commutiy and new in the topic GROK. I have a message where I want to replace a certain string. The problem the string contains the GROK meta character ^. The whole thing is supposed to happen in… --- ## [QueryCacheMemorySize increased to 9.2EB then dropped to 0. How to debug QueryCache issues?](https://discuss.elastic.co/t/querycachememorysize-increased-to-9-2eb-then-dropped-to-0-how-to-debug-querycache-issues/294885)
**Author:** [@ztesky](https://discuss.elastic.co/u/ztesky)\ **Replies:** 0\ **Last updated:** [January 19, 2022, 11:41pm UTC](https://discuss.elastic.co/t/querycachememorysize-increased-to-9-2eb-then-dropped-to-0-how-to-debug-querycache-issues/294885 "2022-01-19T23:41:57Z")
I'm using Elasticsearch version 6.3 in production. We have a shard with size \> 200GB in a data node. Recently, we did a "cluster reroute" wherein we moved this shard from node A (which had QueryCacheMemorySize = 3GB) to … --- ## [Configuring SSL over http](https://discuss.elastic.co/t/configuring-ssl-over-http/294883)
**Author:** [@jayjayp2](https://discuss.elastic.co/u/jayjayp2)\ **Replies:** 0\ **Last updated:** [January 19, 2022, 11:09pm UTC](https://discuss.elastic.co/t/configuring-ssl-over-http/294883 "2022-01-19T23:09:50Z")
Hi, I'm new to Elasticsearch. I couldn't find an existing post. I'm trying to setup ssl over http. I have a .p12 file that is trusted over our network. I set: xpack.security.http.ssl.enabled: true xpack.security.http.s… --- ## [Heartbeat (7.16.3) - missing required field accessing 'schedule'](https://discuss.elastic.co/t/heartbeat-7-16-3-missing-required-field-accessing-schedule/294782)
**Author:** [@jurgenhaas](https://discuss.elastic.co/u/jurgenhaas)\ **Replies:** 9\ **Last updated:** [January 19, 2022, 10:33pm UTC](https://discuss.elastic.co/t/heartbeat-7-16-3-missing-required-field-accessing-schedule/294782 "2022-01-19T22:33:27Z")
My heartbeat monitoring is working just fine, but syslog is flooded with error messages like this: Jan 19 08:51:38 bslog1 heartbeat\[32480\]: 2022-01-19T08:51:38.532+0100 ERROR \[reload\] cfgfile/list.go:99 Error creating r… --- ## [KQL from @timestamp until 7days offset](https://discuss.elastic.co/t/kql-from-timestamp-until-7days-offset/294819)
**Author:** [@Juliana\_Sabino](https://discuss.elastic.co/u/Juliana_Sabino)\ **Replies:** 4\ **Last updated:** [January 19, 2022, 9:55pm UTC](https://discuss.elastic.co/t/kql-from-timestamp-until-7days-offset/294819 "2022-01-19T21:55:35Z")
Hi team, I need a query that takes the @timestamp from the timepicker and then add an offset of 7 days. I don't know how to do it. I tried: (@timestamp \<= "now-1d/d+7d") but it's not working as I wanted. Could someone … --- ## [Control Visualization, metricbeat field , values not showing. v7.13](https://discuss.elastic.co/t/control-visualization-metricbeat-field-values-not-showing-v7-13/294876)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 0\ **Last updated:** [January 19, 2022, 9:53pm UTC](https://discuss.elastic.co/t/control-visualization-metricbeat-field-values-not-showing-v7-13/294876 "2022-01-19T21:53:57Z")
Hi, Im having problems to display values in the control visualization, the field that I need to use is created by metricbeat. in discovery I can see the values, and the field exist In index patterns there is a field… --- ## [Backend programming for kibana plugin development](https://discuss.elastic.co/t/backend-programming-for-kibana-plugin-development/294745)
**Author:** [@Ernesto\_Rodolfo\_Cast](https://discuss.elastic.co/u/Ernesto_Rodolfo_Cast)\ **Replies:** 2\ **Last updated:** [January 19, 2022, 9:49pm UTC](https://discuss.elastic.co/t/backend-programming-for-kibana-plugin-development/294745 "2022-01-19T21:49:57Z")
hello, is it possible to develop a plugin for kibana from the backend, how would this process work, what programming language can I use? --- ## [Match data from two arrays](https://discuss.elastic.co/t/match-data-from-two-arrays/294488)
**Author:** [@INS](https://discuss.elastic.co/u/INS)\ **Replies:** 11\ **Last updated:** [January 19, 2022, 9:33pm UTC](https://discuss.elastic.co/t/match-data-from-two-arrays/294488 "2022-01-19T21:33:45Z")
Hi Can You help me for make a method for merge data between two arrays and match this into one document. pattern- \> name of fields \[a-b-c-d-e\] //we have a 3 events separated by the | value\_field = 5-7-10-12-9|5-7-9… --- ## [Mget too slow for large amount of documents](https://discuss.elastic.co/t/mget-too-slow-for-large-amount-of-documents/294586)
**Author:** [@Benjamin\_Elkrieff](https://discuss.elastic.co/u/Benjamin_Elkrieff)\ **Replies:** 8\ **Last updated:** [January 19, 2022, 9:26pm UTC](https://discuss.elastic.co/t/mget-too-slow-for-large-amount-of-documents/294586 "2022-01-19T21:26:16Z")
Hello There. I use opensearch on AWS to store embeddings generated by a ML model. We need to use it for similarity search. I use 5 nodes of 4 CPU, 8 GB Ram, 1 shard per index, 5 replicas. The data we currently have in … --- ## [Move elasticsearch data from frozen tier back to cold or warm tier](https://discuss.elastic.co/t/move-elasticsearch-data-from-frozen-tier-back-to-cold-or-warm-tier/294874)
**Author:** [@dimitris\_sb](https://discuss.elastic.co/u/dimitris_sb)\ **Replies:** 0\ **Last updated:** [January 19, 2022, 8:38pm UTC](https://discuss.elastic.co/t/move-elasticsearch-data-from-frozen-tier-back-to-cold-or-warm-tier/294874 "2022-01-19T20:38:06Z")
Hi All, How do you handle cases that you have already applied ILM policy to a set of indices (by its legacy index template) and you revise your strategy and you want to move data which are in the frozen tier back to co… --- ## [Kibana dashboard Visualisation into Angular 10 Webapp](https://discuss.elastic.co/t/kibana-dashboard-visualisation-into-angular-10-webapp/294784)
**Author:** [@Abhishek\_Gautam](https://discuss.elastic.co/u/Abhishek_Gautam)\ **Replies:** 1\ **Last updated:** [January 19, 2022, 8:13pm UTC](https://discuss.elastic.co/t/kibana-dashboard-visualisation-into-angular-10-webapp/294784 "2022-01-19T20:13:39Z")
Hi Team, Can someone suggest any way to embed kibana dashboard visulizations with our Angular 10 web App, so that from the application itself he can change the type of graph he wishes to have. --- ## [Error index management Filebeat to Logstash](https://discuss.elastic.co/t/error-index-management-filebeat-to-logstash/294872)
**Author:** [@Adrpan83](https://discuss.elastic.co/u/Adrpan83)\ **Replies:** 0\ **Last updated:** [January 19, 2022, 7:32pm UTC](https://discuss.elastic.co/t/error-index-management-filebeat-to-logstash/294872 "2022-01-19T19:32:16Z")
Hi, I have the following configuration: Filebeat 7.10.1 and Logstash 7.10.1. ERROR instance/beat.go:956 Exiting: Index management requested but the Elasticsearch output is not configured/enabled Exiting: Index man… --- ## [Obtain Jenkins pipelines and parameters from Kibana](https://discuss.elastic.co/t/obtain-jenkins-pipelines-and-parameters-from-kibana/294871)
**Author:** [@Brian\_Fernandez](https://discuss.elastic.co/u/Brian_Fernandez)\ **Replies:** 0\ **Last updated:** [January 19, 2022, 7:20pm UTC](https://discuss.elastic.co/t/obtain-jenkins-pipelines-and-parameters-from-kibana/294871 "2022-01-19T19:20:40Z")
Good afternoon. How can I show in Kibana, the total list of Jenkins pipelines and the parameters that each one has configured? Thanks! [Previous page](https://discuss.elastic.co/latest.md?page=1299) [Next page](https://discuss.elastic.co/latest.md?page=1301)