# Latest **URL:** https://discuss.elastic.co/latest.md?page=1320 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1321 --- ## [Blocked threads on read index calls](https://discuss.elastic.co/t/blocked-threads-on-read-index-calls/293241)
**Author:** [@Madhu\_Yadav](https://discuss.elastic.co/u/Madhu_Yadav)\ **Replies:** 10\ **Last updated:** [January 6, 2022, 8:56am UTC](https://discuss.elastic.co/t/blocked-threads-on-read-index-calls/293241 "2022-01-06T08:56:25Z")
Hi, A portal built using Liferay is using Elasticsearch as a search engine with below config: Elasticsearch 7.16.2 Single Node, Around 250MB sized indices Windows Server 2019 64Bit 8 vcpu, 32GB RAM, SSD Disk 100GB Op… --- ## [Elastic agent fail to connect fleet server](https://discuss.elastic.co/t/elastic-agent-fail-to-connect-fleet-server/293631)
**Author:** [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Replies:** 0\ **Last updated:** [January 6, 2022, 8:49am UTC](https://discuss.elastic.co/t/elastic-agent-fail-to-connect-fleet-server/293631 "2022-01-06T08:49:38Z")
Hi all I'm trying the enroll fleet server to manage the agent and to use elastic enpoint. But when i tried to start the fleet server, i see nothing happening in the kibana fleet enrolling interface. the log that agent… --- ## [TLS Certificate Check behind HAProxy](https://discuss.elastic.co/t/tls-certificate-check-behind-haproxy/293626)
**Author:** [@thleh](https://discuss.elastic.co/u/thleh)\ **Replies:** 0\ **Last updated:** [January 6, 2022, 8:07am UTC](https://discuss.elastic.co/t/tls-certificate-check-behind-haproxy/293626 "2022-01-06T08:07:05Z")
Hi, i'm running Elasticsearch stack 7.16 to monitor some linux servers and check tls certificates. Now i have an HAProxy with several backend servers hosting websites. I have configures ssl certificates at haproxy and … --- ## [JSON parse error](https://discuss.elastic.co/t/json-parse-error/293512)
**Author:** [@rusty\_cole](https://discuss.elastic.co/u/rusty_cole)\ **Replies:** 3\ **Last updated:** [January 6, 2022, 8:00am UTC](https://discuss.elastic.co/t/json-parse-error/293512 "2022-01-06T08:00:22Z")
Hi, I have the following error only for some of my json files, other files have no issue. I am guessing the root cause is the brackets in the json fields. I have seen some posts in the matter but no solution worked fo… --- ## [Installing Fleet agent on servers with existing winlogbeats/filebeats etc](https://discuss.elastic.co/t/installing-fleet-agent-on-servers-with-existing-winlogbeats-filebeats-etc/293547)
**Author:** [@Garry](https://discuss.elastic.co/u/Garry)\ **Replies:** 2\ **Last updated:** [January 6, 2022, 7:49am UTC](https://discuss.elastic.co/t/installing-fleet-agent-on-servers-with-existing-winlogbeats-filebeats-etc/293547 "2022-01-06T07:49:40Z")
I have a number of servers where i manually installed filebeat/winlogbeat/metricbeat etc. What impact does that have if i wish to now use the Fleet agent and policies to collect this data? Do i need to manually uninsta… --- ## [Why i can't search my text](https://discuss.elastic.co/t/why-i-cant-search-my-text/293618)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 1\ **Last updated:** [January 6, 2022, 6:01am UTC](https://discuss.elastic.co/t/why-i-cant-search-my-text/293618 "2022-01-06T06:01:18Z")
PUT my-index-000001 { "settings":{ "number\_of\_replicas": 0, "analysis":{ "analyzer":{ "my\_analyzer":{ "type":"custom", "tokenizer":"keyword", … --- ## [About details of Multi-Metric Anomaly Detection](https://discuss.elastic.co/t/about-details-of-multi-metric-anomaly-detection/293413)
**Author:** [@Furkan](https://discuss.elastic.co/u/Furkan)\ **Replies:** 6\ **Last updated:** [January 6, 2022, 6:06am UTC](https://discuss.elastic.co/t/about-details-of-multi-metric-anomaly-detection/293413 "2022-01-06T06:06:43Z")
Hi, In the multi-metric job in anomaly detection, do the metrics affect each other to find the anomalies as multivariate anomaly detection or is the main point of multi-metric job creating a job for different metrics in… --- ## [Filebeat docker input type with different paths](https://discuss.elastic.co/t/filebeat-docker-input-type-with-different-paths/293495)
**Author:** [@sahinguler](https://discuss.elastic.co/u/sahinguler)\ **Replies:** 3\ **Last updated:** [January 6, 2022, 6:05am UTC](https://discuss.elastic.co/t/filebeat-docker-input-type-with-different-paths/293495 "2022-01-06T06:05:02Z")
Hi everyone, I use filebeat for storing docker logs. My docker containers logs path is /home/docker/containers/${data.docker.container.id}/\*.log. But filebeat scans /var/lib/docker/containers/${data.docker.container.id… --- ## [Osquery exported fields](https://discuss.elastic.co/t/osquery-exported-fields/293608)
**Author:** [@michaelv](https://discuss.elastic.co/u/michaelv)\ **Replies:** 1\ **Last updated:** [January 6, 2022, 4:07am UTC](https://discuss.elastic.co/t/osquery-exported-fields/293608 "2022-01-06T04:07:12Z")
I'm running 7.16.1 for everything. including elastic-agent-7.16.1-linux-x86\_64.tar.gz I have a question on osquery exported fields. From this URL: Osquery Manager | Elastic Docs It states that fields like interface\_… --- ## [Pie result is based on number of monitors down and up . What i want is to show on basis of monitors downtime and uptime duration not howm many were down and up monitorss . any idea](https://discuss.elastic.co/t/pie-result-is-based-on-number-of-monitors-down-and-up-what-i-want-is-to-show-on-basis-of-monitors-downtime-and-uptime-duration-not-howm-many-were-down-and-up-monitorss-any-idea/293500)
**Author:** [@Rajesh\_Rai](https://discuss.elastic.co/u/Rajesh_Rai)\ **Replies:** 1\ **Last updated:** [January 6, 2022, 3:30am UTC](https://discuss.elastic.co/t/pie-result-is-based-on-number-of-monitors-down-and-up-what-i-want-is-to-show-on-basis-of-monitors-downtime-and-uptime-duration-not-howm-many-were-down-and-up-monitorss-any-idea/293500 "2022-01-06T03:30:11Z")
--- ## [Logstash is affected by Apache Log4j2 2.17.0 Vulnerability CVE-2021-44832?](https://discuss.elastic.co/t/logstash-is-affected-by-apache-log4j2-2-17-0-vulnerability-cve-2021-44832/293162)
**Author:** [@swxEmily](https://discuss.elastic.co/u/swxEmily)\ **Replies:** 3\ **Last updated:** [January 6, 2022, 2:08am UTC](https://discuss.elastic.co/t/logstash-is-affected-by-apache-log4j2-2-17-0-vulnerability-cve-2021-44832/293162 "2022-01-06T02:08:51Z")
Apache Log4j2 2.17.0 report a new Vulnerability CVE-2021-44832, is Logstash affected or not? --- ## [Trying to restore snapshot](https://discuss.elastic.co/t/trying-to-restore-snapshot/293448)
**Author:** [@fribse](https://discuss.elastic.co/u/fribse)\ **Replies:** 8\ **Last updated:** [January 6, 2022, 1:09am UTC](https://discuss.elastic.co/t/trying-to-restore-snapshot/293448 "2022-01-06T01:09:07Z")
So I've been running my Elasticsearch in docker-compose. Now I have by accident lost all my data :cry:, it's not so much the data itself as that is only historic, but rather all the kibana work made. I'm now trying to … --- ## [Search one Csv Names into other csv](https://discuss.elastic.co/t/search-one-csv-names-into-other-csv/292954)
**Author:** [@monika\_gire](https://discuss.elastic.co/u/monika_gire)\ **Replies:** 3\ **Last updated:** [January 5, 2022, 11:48pm UTC](https://discuss.elastic.co/t/search-one-csv-names-into-other-csv/292954 "2022-01-05T23:48:41Z")
Hello, I want to search words from csv into another csv. How I can fixed this problem? I have no idea. Anybody can help? --- ## [Click API and result ranking](https://discuss.elastic.co/t/click-api-and-result-ranking/292917)
**Author:** [@miki\_haiat](https://discuss.elastic.co/u/miki_haiat)\ **Replies:** 1\ **Last updated:** [January 5, 2022, 11:43pm UTC](https://discuss.elastic.co/t/click-api-and-result-ranking/292917 "2022-01-05T23:43:59Z")
I just wondered if Enterprise search is using some ranking system like tf/idf based on user clicks API , how dose analytics API influence the score of the document ? --- ## [Snapshot restore with basic license](https://discuss.elastic.co/t/snapshot-restore-with-basic-license/293555)
**Author:** [@eh2021-elastic](https://discuss.elastic.co/u/eh2021-elastic)\ **Replies:** 2\ **Last updated:** [January 5, 2022, 10:45pm UTC](https://discuss.elastic.co/t/snapshot-restore-with-basic-license/293555 "2022-01-05T22:45:37Z")
I am using the basic license but noticed on the subscription page (Subscriptions | Elastic Stack Products & Support | Elastic), it shows the basic license for snapshot/restore but further down under Recovery from snapsh… --- ## [Configure SSL on Heartbeat with certificates in the system store](https://discuss.elastic.co/t/configure-ssl-on-heartbeat-with-certificates-in-the-system-store/289499)
**Author:** [@fgjensen](https://discuss.elastic.co/u/fgjensen)\ **Replies:** 6\ **Last updated:** [January 5, 2022, 10:22pm UTC](https://discuss.elastic.co/t/configure-ssl-on-heartbeat-with-certificates-in-the-system-store/289499 "2022-01-05T22:22:14Z")
I deploy heartbeats on some Windows servers management by an external service provider. The beats collect the staus of service end points exposed by applications on several other hosts. The beats are configured with SSL. … --- ## [Add tags to Filebeat module configuration?](https://discuss.elastic.co/t/add-tags-to-filebeat-module-configuration/293571)
**Author:** [@fgjensen](https://discuss.elastic.co/u/fgjensen)\ **Replies:** 1\ **Last updated:** [January 5, 2022, 9:51pm UTC](https://discuss.elastic.co/t/add-tags-to-filebeat-module-configuration/293571 "2022-01-05T21:51:14Z")
Hello Community; This is a simple question, but I cannot find the answer in the filebeat documentation. The filebeat for some hosts is configured with specific input filestreams collecting various logs. In order to mak… --- ## [Watcher : Action Body's Text](https://discuss.elastic.co/t/watcher-action-bodys-text/293245)
**Author:** [@appleyin1](https://discuss.elastic.co/u/appleyin1)\ **Replies:** 2\ **Last updated:** [January 5, 2022, 9:47pm UTC](https://discuss.elastic.co/t/watcher-action-bodys-text/293245 "2022-01-05T21:47:01Z")
Hi there: I'm stuck at the Watch Action body text section, I have a payload below. Is that possible to only retrieve which service and host's doc\_count \< 5 ? in order to determine what are the services are unavailable … --- ## [Logstash not send data to Elasticsearch](https://discuss.elastic.co/t/logstash-not-send-data-to-elasticsearch/293554)
**Author:** [@mcoa](https://discuss.elastic.co/u/mcoa)\ **Replies:** 2\ **Last updated:** [January 5, 2022, 9:45pm UTC](https://discuss.elastic.co/t/logstash-not-send-data-to-elasticsearch/293554 "2022-01-05T21:45:00Z")
Hi, I've configured Logstash for send data to Elasticsearch but this not receive data and index not found (i dont have firewall/iptables/selinux.). My config logstash: Input input { file { path =\> "/var/log/zim… --- ## [Windows filebeat cluster privileges](https://discuss.elastic.co/t/windows-filebeat-cluster-privileges/293258)
**Author:** [@mcosta](https://discuss.elastic.co/u/mcosta)\ **Replies:** 2\ **Last updated:** [January 5, 2022, 9:18pm UTC](https://discuss.elastic.co/t/windows-filebeat-cluster-privileges/293258 "2022-01-05T21:18:33Z")
Hi, I installed Filebeat (7.16.2) on Windows Server, using default PowerShell script and started it as a service. It reads some custom log files and send them to Elasticsearch. It uses a custom index, ILM policy and te… --- ## [Filebeat Syslog RFC 5424 Input With Empty Timestamp](https://discuss.elastic.co/t/filebeat-syslog-rfc-5424-input-with-empty-timestamp/293595)
**Author:** [@jtveite](https://discuss.elastic.co/u/jtveite)\ **Replies:** 0\ **Last updated:** [January 5, 2022, 9:06pm UTC](https://discuss.elastic.co/t/filebeat-syslog-rfc-5424-input-with-empty-timestamp/293595 "2022-01-05T21:06:33Z")
RFC 5424 explicitly allows timestamp to be a nilvalue. I have a device which generates logs of this format that I am attempting to collect, but filebeat appears to only accept messages that have a timestamp specified. H… --- ## [Sending AWS S3 Data to AWS Cloud Watch](https://discuss.elastic.co/t/sending-aws-s3-data-to-aws-cloud-watch/293594)
**Author:** [@makimaki](https://discuss.elastic.co/u/makimaki)\ **Replies:** 1\ **Last updated:** [January 5, 2022, 9:04pm UTC](https://discuss.elastic.co/t/sending-aws-s3-data-to-aws-cloud-watch/293594 "2022-01-05T21:04:38Z")
Hi, I'm trying to send log data from AWS S3 to CloudWatch and nothing is happening This is log file {"docker": {"container\_id": "fe9802"},"kubernetes": {"container\_name": "pairwise-individual"}},"message": "2022-01-05… --- ## [Unable to take snapshot to 2gb index](https://discuss.elastic.co/t/unable-to-take-snapshot-to-2gb-index/293591)
**Author:** [@ima](https://discuss.elastic.co/u/ima)\ **Replies:** 1\ **Last updated:** [January 5, 2022, 9:01pm UTC](https://discuss.elastic.co/t/unable-to-take-snapshot-to-2gb-index/293591 "2022-01-05T21:01:34Z")
Hello team, I wanna backup the data of me cluster of 3 nodes master /hot/warm, when I try to take snapshot to a 2 gb or more index It gets stuck and I can no longer take another snapshot but after I restart the nodes, is… --- ## [Unable to Add Data Node to Elasticsearch Cluster](https://discuss.elastic.co/t/unable-to-add-data-node-to-elasticsearch-cluster/292232)
**Author:** [@Jeffrey\_Meurer](https://discuss.elastic.co/u/Jeffrey_Meurer)\ **Replies:** 6\ **Last updated:** [January 5, 2022, 8:41pm UTC](https://discuss.elastic.co/t/unable-to-add-data-node-to-elasticsearch-cluster/292232 "2022-01-05T20:41:00Z")
Hi, I'm having trouble adding another data node to my Master Elasticsearch. Running 7.16.1 Here's the Elasticsearch.yml from the Master: # ---------------------------------- Cluster ----------------------------------- … --- ## [Filebeat for OS Solaris?](https://discuss.elastic.co/t/filebeat-for-os-solaris/292037)
**Author:** [@DKalin0789e](https://discuss.elastic.co/u/DKalin0789e)\ **Replies:** 3\ **Last updated:** [January 5, 2022, 8:31pm UTC](https://discuss.elastic.co/t/filebeat-for-os-solaris/292037 "2022-01-05T20:31:32Z")
Hello, can you recommend any officially supported tool/agent/alternative for OS Solaris, like Filebeat, Fluentd, FluentBit, etc. which allows parsing log files, please? We use "collectd" at the moment. It works fine, but… --- ## [Help: Pass in Parameters Dynamically in Watcher](https://discuss.elastic.co/t/help-pass-in-parameters-dynamically-in-watcher/292530)
**Author:** [@appleyin1](https://discuss.elastic.co/u/appleyin1)\ **Replies:** 2\ **Last updated:** [January 5, 2022, 7:41pm UTC](https://discuss.elastic.co/t/help-pass-in-parameters-dynamically-in-watcher/292530 "2022-01-05T19:41:33Z")
Hi there, Is that possible to pass in parameters dynamically in Watcher? Below "Search Input" only for static, Please advise, thanks. --- ## [Logs from AWS S3 does not go to AWS CoudWatch](https://discuss.elastic.co/t/logs-from-aws-s3-does-not-go-to-aws-coudwatch/293583)
**Author:** [@makimaki](https://discuss.elastic.co/u/makimaki)\ **Replies:** 0\ **Last updated:** [January 5, 2022, 7:31pm UTC](https://discuss.elastic.co/t/logs-from-aws-s3-does-not-go-to-aws-coudwatch/293583 "2022-01-05T19:31:56Z")
Hi, I'm trying to read logs from the S3 bucket and put them to CloudWatch. But nothing happens in the CloudWatch. Log file in S3 contain min 2 JSON strings {"docker":{"container\_id":"fe98027af6490c542e8d0321115f4c1e9… --- ## [Elasticsearch incorrect licensing](https://discuss.elastic.co/t/elasticsearch-incorrect-licensing/293557)
**Author:** [@Dede\_Pessu](https://discuss.elastic.co/u/Dede_Pessu)\ **Replies:** 4\ **Last updated:** [January 5, 2022, 7:00pm UTC](https://discuss.elastic.co/t/elasticsearch-incorrect-licensing/293557 "2022-01-05T19:00:18Z")
I have just pulled 7.16.1 rpms for Elasticsearch to do a fresh install, in my environment i have a platinum license but for some reason Elasticsearch is loading a random incorrect license that is basic which is causing i… --- ## [Elasticsearch: Custom Index pattern issue](https://discuss.elastic.co/t/elasticsearch-custom-index-pattern-issue/293570)
**Author:** [@Elie\_Sbat1](https://discuss.elastic.co/u/Elie_Sbat1)\ **Replies:** 0\ **Last updated:** [January 5, 2022, 5:35pm UTC](https://discuss.elastic.co/t/elasticsearch-custom-index-pattern-issue/293570 "2022-01-05T17:35:56Z")
Hello, I am unable to create kibana index (@timestamp) when a custom Elasticsearch index is being used. logs are being sent through filebeat, but they are not visible in discover page of kibana, Br, E --- ## [Metricbeat host not showing on kibana as well as not creating index](https://discuss.elastic.co/t/metricbeat-host-not-showing-on-kibana-as-well-as-not-creating-index/292567)
**Author:** [@jonoyo](https://discuss.elastic.co/u/jonoyo)\ **Replies:** 13\ **Last updated:** [January 5, 2022, 6:52pm UTC](https://discuss.elastic.co/t/metricbeat-host-not-showing-on-kibana-as-well-as-not-creating-index/292567 "2022-01-05T18:52:01Z")
After install the metricbeat on localhost elk server its showing on kibana dashboard but when metricbeat installing on another machine metricbeat host are not showing except elk localhost metricbeat host. metricbeat ver… [Previous page](https://discuss.elastic.co/latest.md?page=1319) [Next page](https://discuss.elastic.co/latest.md?page=1321)