# Latest **URL:** https://discuss.elastic.co/latest.md?page=1319 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1320 --- ## [Continuously read from .evtx logfile?](https://discuss.elastic.co/t/continuously-read-from-evtx-logfile/293658)
**Author:** [@Andreas\_Falk](https://discuss.elastic.co/u/Andreas_Falk)\ **Replies:** 3\ **Last updated:** [January 7, 2022, 3:06am UTC](https://discuss.elastic.co/t/continuously-read-from-evtx-logfile/293658 "2022-01-07T03:06:38Z")
(crosspost from slack) Hi, We are trying to get the logs from our netapp cifs shares. Netapp exports their logs to a smb share and writes .evtx files there. And with the help of mounting and pointing winlogbeat to th… --- ## [Calculating percent](https://discuss.elastic.co/t/calculating-percent/293688)
**Author:** [@nabil86](https://discuss.elastic.co/u/nabil86)\ **Replies:** 1\ **Last updated:** [January 7, 2022, 2:20am UTC](https://discuss.elastic.co/t/calculating-percent/293688 "2022-01-07T02:20:57Z")
Hello, I want to calculte the percent of a given type on my index: Ok\_Count/total , I wrote this query But it doesn't work as i excepted , could you help me to correct it { "aggs": { "total":{ "filter":… --- ## [Can't connect to Enterprise search](https://discuss.elastic.co/t/cant-connect-to-enterprise-search/292762)
**Author:** [@Frank\_Kuo](https://discuss.elastic.co/u/Frank_Kuo)\ **Replies:** 3\ **Last updated:** [January 7, 2022, 1:06am UTC](https://discuss.elastic.co/t/cant-connect-to-enterprise-search/292762 "2022-01-07T01:06:43Z")
Hello everyone, I installed the enterprise-search plugin @7.16.1. The enterprise-search service is started without error. But my Kibana still show " Unable to connect ". I have no idea. Anybody can help? {ELKM3}elas… --- ## [How to split sometimes?](https://discuss.elastic.co/t/how-to-split-sometimes/293484)
**Author:** [@4art4](https://discuss.elastic.co/u/4art4)\ **Replies:** 7\ **Last updated:** [January 6, 2022, 6:00pm UTC](https://discuss.elastic.co/t/how-to-split-sometimes/293484 "2022-01-06T18:00:47Z")
So I have to deal with ingesting logs that a team member is generating. I'm getting json logs, and I think I am very close to getting the data. (So close.) The error I am getting now looks like this: \[2022-01-04T18:0… --- ## [Filters not working when used in actions yaml file, but it works when using the command line filters options](https://discuss.elastic.co/t/filters-not-working-when-used-in-actions-yaml-file-but-it-works-when-using-the-command-line-filters-options/293692)
**Author:** [@pedroplopez](https://discuss.elastic.co/u/pedroplopez)\ **Replies:** 0\ **Last updated:** [January 6, 2022, 9:43pm UTC](https://discuss.elastic.co/t/filters-not-working-when-used-in-actions-yaml-file-but-it-works-when-using-the-command-line-filters-options/293692 "2022-01-06T21:43:32Z")
Elasticsearch: Kibana Version: 7.15 Curator Version: 5.8.4 Hi, I'm working on creating an action file I can use with curator to delete Kibana indices older than 30 days from creation date. I wrote the following action … --- ## [Choosing hot/warm or keep only hot nodes](https://discuss.elastic.co/t/choosing-hot-warm-or-keep-only-hot-nodes/293689)
**Author:** [@nabil86](https://discuss.elastic.co/u/nabil86)\ **Replies:** 0\ **Last updated:** [January 6, 2022, 8:13pm UTC](https://discuss.elastic.co/t/choosing-hot-warm-or-keep-only-hot-nodes/293689 "2022-01-06T20:13:51Z")
Hello, Currently, i want to implement a cluster which can index 650GB of application logs /day with 2 weeks of retention data. I want to decide about cluster typology: Is Hot/wam architecture ⇒ Hot keep data for 2 da… --- ## [Painless Script in Ingest - Rename Field](https://discuss.elastic.co/t/painless-script-in-ingest-rename-field/292587)
**Author:** [@DefensiveDepth](https://discuss.elastic.co/u/DefensiveDepth)\ **Replies:** 3\ **Last updated:** [January 6, 2022, 7:55pm UTC](https://discuss.elastic.co/t/painless-script-in-ingest-rename-field/292587 "2022-01-06T19:55:11Z")
Hello there, Using an ingest pipeline, I am trying to uppercase the first char in a fieldname, for all fields under winlog.event\_data: { "script": { "lang": "painless", "source": "ctx.\_source.winlog.e… --- ## [One logstash pipeline listening multiple formats (same input)](https://discuss.elastic.co/t/one-logstash-pipeline-listening-multiple-formats-same-input/293381)
**Author:** [@vee](https://discuss.elastic.co/u/vee)\ **Replies:** 16\ **Last updated:** [January 6, 2022, 7:33pm UTC](https://discuss.elastic.co/t/one-logstash-pipeline-listening-multiple-formats-same-input/293381 "2022-01-06T19:33:16Z")
Hi - Working on a new requirement to parse through one file containing two different formatted messages and send to different indices on elastic. Filebeat (same file with two different formatted messages) -\> Logstash (… --- ## [Failed to parse field \[\[observer.hostname\]\]](https://discuss.elastic.co/t/failed-to-parse-field-observer-hostname/293676)
**Author:** [@eO2H\_LG](https://discuss.elastic.co/u/eO2H_LG)\ **Replies:** 3\ **Last updated:** [January 6, 2022, 6:48pm UTC](https://discuss.elastic.co/t/failed-to-parse-field-observer-hostname/293676 "2022-01-06T18:48:07Z")
Hello All, Hoping somebody can assist me with the following error. It seems some of my DHCP data is failing to ingest due to a parsing issue with the observer.hostname field. Below is the error output from logstash-pla… --- ## [ECK Cluster in yellow state but cluster is green](https://discuss.elastic.co/t/eck-cluster-in-yellow-state-but-cluster-is-green/293185)
**Author:** [@julien.couturier](https://discuss.elastic.co/u/julien.couturier)\ **Replies:** 2\ **Last updated:** [January 6, 2022, 5:00pm UTC](https://discuss.elastic.co/t/eck-cluster-in-yellow-state-but-cluster-is-green/293185 "2022-01-06T17:00:13Z")
Hi, My Elastic stack is working well but I discovered that the ECK status was "Yellow" when I tried to upgrade to 7.16.2. kubectl get es NAME HEALTH NODES VERSION PHASE AGE tbb-es yellow 3 7.11.… --- ## [Does PKI integration work with Basic/Free license?](https://discuss.elastic.co/t/does-pki-integration-work-with-basic-free-license/293671)
**Author:** [@Maryam2021](https://discuss.elastic.co/u/Maryam2021)\ **Replies:** 1\ **Last updated:** [January 6, 2022, 4:52pm UTC](https://discuss.elastic.co/t/does-pki-integration-work-with-basic-free-license/293671 "2022-01-06T16:52:51Z")
Hello All, Can we configure PKI for ELK stack on free tier? --- ## [Elastic APM Server and openshift](https://discuss.elastic.co/t/elastic-apm-server-and-openshift/293602)
**Author:** [@mortya](https://discuss.elastic.co/u/mortya)\ **Replies:** 2\ **Last updated:** [January 6, 2022, 4:47pm UTC](https://discuss.elastic.co/t/elastic-apm-server-and-openshift/293602 "2022-01-06T16:47:38Z")
Kibana version: n/a Elasticsearch version: openshift operator 4.6.0-202112140939 APM Server version: 7.16.2 APM Agent language and version: n/a Browser version: n/a Original install method (e.g. download page, … --- ## [7.16.2 Lens no showing value in dark mode](https://discuss.elastic.co/t/7-16-2-lens-no-showing-value-in-dark-mode/293665)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 1\ **Last updated:** [January 6, 2022, 4:44pm UTC](https://discuss.elastic.co/t/7-16-2-lens-no-showing-value-in-dark-mode/293665 "2022-01-06T16:44:26Z")
In lens (pie) value is not readable as it print in dark color in dark mode. And I can't find this setting anywhere. is this bug or some kind of setting that I have to do? here is example. --- ## [Subfield not showing on the left side field after 7.16 upgrade](https://discuss.elastic.co/t/subfield-not-showing-on-the-left-side-field-after-7-16-upgrade/292626)
**Author:** [@isaackuang](https://discuss.elastic.co/u/isaackuang)\ **Replies:** 4\ **Last updated:** [January 6, 2022, 4:24pm UTC](https://discuss.elastic.co/t/subfield-not-showing-on-the-left-side-field-after-7-16-upgrade/292626 "2022-01-06T16:24:26Z")
When Upgrading to 7.16.1 from 7.15.2 The subfields from kubernetes object cannot show and analyze. But it can still searchable. Anyone can tell me how can I do to enable subfield parsing on left field for new ve… --- ## [ECS fields for E-Commerce](https://discuss.elastic.co/t/ecs-fields-for-e-commerce/292987)
**Author:** [@Jannik\_Z](https://discuss.elastic.co/u/Jannik_Z)\ **Replies:** 1\ **Last updated:** [January 6, 2022, 4:23pm UTC](https://discuss.elastic.co/t/ecs-fields-for-e-commerce/292987 "2022-01-06T16:23:23Z")
Hi there, I would like to bring new "non-log" ECS fields to the table and would love to get some feedback from the community. We want to sponsor fields for e-commerce: orders payments products ... I think, the e-comm… --- ## [TCP Input "Too many files open" IOException](https://discuss.elastic.co/t/tcp-input-too-many-files-open-ioexception/293499)
**Author:** [@ddth\_2022](https://discuss.elastic.co/u/ddth_2022)\ **Replies:** 5\ **Last updated:** [January 6, 2022, 4:14pm UTC](https://discuss.elastic.co/t/tcp-input-too-many-files-open-ioexception/293499 "2022-01-06T16:14:58Z")
We're running Logstash 7.16.2. We're using a TCP input that opens up too many sockets without closing them and almost every 24 hours Logstash hangs up. \[2022-01-05T05:10:59,474\]\[WARN \]\[io.netty.channel.DefaultChannelPip… --- ## [Making elastic persistence on Kubernetes env](https://discuss.elastic.co/t/making-elastic-persistence-on-kubernetes-env/293666)
**Author:** [@bargb](https://discuss.elastic.co/u/bargb)\ **Replies:** 0\ **Last updated:** [January 6, 2022, 3:27pm UTC](https://discuss.elastic.co/t/making-elastic-persistence-on-kubernetes-env/293666 "2022-01-06T15:27:16Z")
Hi.. I am running elastic on kubernetes cluster. My Yaml is as below but this is not persisting the data after elastic restarts. What should i do to persist it kind: PersistentVolumeClaim apiVersion: v1 metadata: nam… --- ## [Curl query from json](https://discuss.elastic.co/t/curl-query-from-json/293650)
**Author:** [@rusty\_cole](https://discuss.elastic.co/u/rusty_cole)\ **Replies:** 4\ **Last updated:** [January 6, 2022, 2:48pm UTC](https://discuss.elastic.co/t/curl-query-from-json/293650 "2022-01-06T14:48:57Z")
Hi guys, I have some query(witch works fine in kibana debugger), my goal is to make this query work from curl command line(windows). i have other queries with no issues. I think the problem is with the """ in the "r… --- ## [Kibana UI shows "No records found" message and then data showing](https://discuss.elastic.co/t/kibana-ui-shows-no-records-found-message-and-then-data-showing/293366)
**Author:** [@Kaviraj\_C](https://discuss.elastic.co/u/Kaviraj_C)\ **Replies:** 1\ **Last updated:** [January 6, 2022, 2:45pm UTC](https://discuss.elastic.co/t/kibana-ui-shows-no-records-found-message-and-then-data-showing/293366 "2022-01-06T14:45:06Z")
Hi All, While searching some text am getting initially No Results found msg and then the data showing. Can anyone help me to correct my issue. Elasticsearch version - 2.4.4. Kibana version- 4.6.7. --- ## [About the error "The quota has been exceeded error" from kibana](https://discuss.elastic.co/t/about-the-error-the-quota-has-been-exceeded-error-from-kibana/293490)
**Author:** [@lhoncorty](https://discuss.elastic.co/u/lhoncorty)\ **Replies:** 1\ **Last updated:** [January 6, 2022, 2:33pm UTC](https://discuss.elastic.co/t/about-the-error-the-quota-has-been-exceeded-error-from-kibana/293490 "2022-01-06T14:33:21Z")
original discussion is closed. I just want to say it is the browser display issue. The error disappeared after I duplicate the tab on my firefox. --- ## [Enable elasticsearch module from filebeat and trying to send data to elasticsearch but getting below error](https://discuss.elastic.co/t/enable-elasticsearch-module-from-filebeat-and-trying-to-send-data-to-elasticsearch-but-getting-below-error/293654)
**Author:** [@mangeshmj1992](https://discuss.elastic.co/u/mangeshmj1992)\ **Replies:** 0\ **Last updated:** [January 6, 2022, 2:30pm UTC](https://discuss.elastic.co/t/enable-elasticsearch-module-from-filebeat-and-trying-to-send-data-to-elasticsearch-but-getting-below-error/293654 "2022-01-06T14:30:42Z")
Hello team, I have enable Elasticsearch module from filebeat and trying to send data to Elasticsearch but getting below error. Can you please help me here. Username and password is correct. but still showing below erro… --- ## [Copy specific snapshot to another repository](https://discuss.elastic.co/t/copy-specific-snapshot-to-another-repository/293647)
**Author:** [@Bilanda](https://discuss.elastic.co/u/Bilanda)\ **Replies:** 2\ **Last updated:** [January 6, 2022, 2:27pm UTC](https://discuss.elastic.co/t/copy-specific-snapshot-to-another-repository/293647 "2022-01-06T14:27:37Z")
Hello, I have a specific need regarding Snapshots. Indeed I have hundreds of snapshot (we use snapshot for a daily back-up of our indices). We would like to copy a specific snapshot from our repository to another one.… --- ## [How to size Azure Kubernetes for Elastic deployment](https://discuss.elastic.co/t/how-to-size-azure-kubernetes-for-elastic-deployment/292842)
**Author:** [@jthoni](https://discuss.elastic.co/u/jthoni)\ **Replies:** 1\ **Last updated:** [January 6, 2022, 2:08pm UTC](https://discuss.elastic.co/t/how-to-size-azure-kubernetes-for-elastic-deployment/292842 "2022-01-06T14:08:37Z")
We are currently running a 50 node cluster (with 40 data nodes) on VMs in Azure. I am looking into converting to running in AKS. I am having trouble figuring out how to determine the resources I need in my AKS cluster to… --- ## [Elasticsearch cloud ignoring bucket permissions](https://discuss.elastic.co/t/elasticsearch-cloud-ignoring-bucket-permissions/293406)
**Author:** [@epfcgs](https://discuss.elastic.co/u/epfcgs)\ **Replies:** 1\ **Last updated:** [January 6, 2022, 1:54pm UTC](https://discuss.elastic.co/t/elasticsearch-cloud-ignoring-bucket-permissions/293406 "2022-01-06T13:54:15Z")
I have created an elasticsearch cluster according to: using the following yaml cat \<\< 'EOF' \> ~/eck.yaml apiVersion: elasticsearch.k8s.elastic.co/v1 kind: Elasticsearch metadata: name: quickstart spec: version: 7.6.… --- ## [How can I do a one-to-one search in the title field?](https://discuss.elastic.co/t/how-can-i-do-a-one-to-one-search-in-the-title-field/293523)
**Author:** [@Busra\_Duygu](https://discuss.elastic.co/u/Busra_Duygu)\ **Replies:** 9\ **Last updated:** [January 6, 2022, 1:10pm UTC](https://discuss.elastic.co/t/how-can-i-do-a-one-to-one-search-in-the-title-field/293523 "2022-01-06T13:10:58Z")
Hello friends, I have a problem, I would be very happy if you could help. I want it to return exactly the string I want in a query using Wilcard, but it doesn't work. I have a document and document's title: "Title" : "… --- ## [How to delete old indices automatically in elasticsearch](https://discuss.elastic.co/t/how-to-delete-old-indices-automatically-in-elasticsearch/293643)
**Author:** [@tharunkumar](https://discuss.elastic.co/u/tharunkumar)\ **Replies:** 2\ **Last updated:** [January 6, 2022, 1:10pm UTC](https://discuss.elastic.co/t/how-to-delete-old-indices-automatically-in-elasticsearch/293643 "2022-01-06T13:10:34Z")
Hi i need clear solution how can i delete the old indices data automatically after a period of time.thank you --- ## [Vega Infinite extent for field error](https://discuss.elastic.co/t/vega-infinite-extent-for-field-error/293633)
**Author:** [@Michael\_Ubry](https://discuss.elastic.co/u/Michael_Ubry)\ **Replies:** 0\ **Last updated:** [January 6, 2022, 10:05am UTC](https://discuss.elastic.co/t/vega-infinite-extent-for-field-error/293633 "2022-01-06T10:05:31Z")
Hi, I am creating scatter plot and its working fine until I choose time range from calendar which does not contain data. I have data until May 2021 so when I go for 1 Year its fine, but when I choose last 4 months, it g… --- ## [Linux\_anomalous\_process\_all\_hosts\_ecs apparently not only covering Linux, but full auditbeat](https://discuss.elastic.co/t/linux-anomalous-process-all-hosts-ecs-apparently-not-only-covering-linux-but-full-auditbeat/293519)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 2\ **Last updated:** [January 6, 2022, 8:35am UTC](https://discuss.elastic.co/t/linux-anomalous-process-all-hosts-ecs-apparently-not-only-covering-linux-but-full-auditbeat/293519 "2022-01-06T08:35:45Z")
Hello, I was a bit surprised to see the "Anomalous Process For a Linux Population" SIEM rule trigger for Windows hosts. After some investigation, I noticed there is no filter for host.os.type or host.os.family or sth s… --- ## [Failed to start elasticsearch node on K8S with this error: failed to download database \[GeoLite2-ASN.mmdb\]](https://discuss.elastic.co/t/failed-to-start-elasticsearch-node-on-k8s-with-this-error-failed-to-download-database-geolite2-asn-mmdb/292963)
**Author:** [@zhaoyi0113](https://discuss.elastic.co/u/zhaoyi0113)\ **Replies:** 1\ **Last updated:** [January 6, 2022, 9:09am UTC](https://discuss.elastic.co/t/failed-to-start-elasticsearch-node-on-k8s-with-this-error-failed-to-download-database-geolite2-asn-mmdb/292963 "2022-01-06T09:09:08Z")
I deployed an Elasticsearch cluster in AWS EKS with 3 nodes. After launching the cluster, I can see 3 pods are running but 2 of them running fine, one of them keep failing and terminating and restarting. Below is the er… --- ## [Replace Log4j from 2.11.0 to 2.15.0](https://discuss.elastic.co/t/replace-log4j-from-2-11-0-to-2-15-0/291901)
**Author:** [@njain213](https://discuss.elastic.co/u/njain213)\ **Replies:** 9\ **Last updated:** [January 6, 2022, 9:01am UTC](https://discuss.elastic.co/t/replace-log4j-from-2-11-0-to-2-15-0/291901 "2022-01-06T09:01:31Z")
Hello Team, I am using logstash 7.5.1 and having log4j jar as 2.11.1. Now as per doc https://discuss.elastic.co/ it is mentioned to remove JNDI class if we don't want to upgrade logstash. Is it possible if I can upgrade… [Previous page](https://discuss.elastic.co/latest.md?page=1318) [Next page](https://discuss.elastic.co/latest.md?page=1320)