# Latest **URL:** https://discuss.elastic.co/latest.md?page=1328 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1329 --- ## [Melange d'indice Logstash (input twitter et rss) - Kibana](https://discuss.elastic.co/t/melange-dindice-logstash-input-twitter-et-rss-kibana/292359)
**Author:** [@Phildefer](https://discuss.elastic.co/u/Phildefer)\ **Replies:** 4\ **Last updated:** [December 29, 2021, 2:12pm UTC](https://discuss.elastic.co/t/melange-dindice-logstash-input-twitter-et-rss-kibana/292359 "2021-12-29T14:12:26Z")
Bonjour, J'ai mis en place deux pipelines logstach via deux fichiers conf. L'un va chercher un flux rss l'autre des tweets. Dans les deux, j'ai une variable de type index différentes pour différencier évidement les donné… --- ## [Dealing with False Positives](https://discuss.elastic.co/t/dealing-with-false-positives/292941)
**Author:** [@nemhods](https://discuss.elastic.co/u/nemhods)\ **Replies:** 1\ **Last updated:** [December 29, 2021, 1:50pm UTC](https://discuss.elastic.co/t/dealing-with-false-positives/292941 "2021-12-29T13:50:59Z")
Hey, I've discovered a false positive in the rule Suspicious JAVA Child Process (which is quite scary at this time of the year...) with the meeting-software Jitsi that should affect some other people. Is there currently… --- ## [Installing elastic agent on oracle linux](https://discuss.elastic.co/t/installing-elastic-agent-on-oracle-linux/292975)
**Author:** [@Blason](https://discuss.elastic.co/u/Blason)\ **Replies:** 0\ **Last updated:** [December 27, 2021, 1:34pm UTC](https://discuss.elastic.co/t/installing-elastic-agent-on-oracle-linux/292975 "2021-12-27T13:34:11Z")
Hi, I need to install elastic-agent on Oracle Linux and being a Redhat linux I believe it should not be any problem. However any idea how to install ca.crt file in Red hat or Oracle linux so that while running fleet age… --- ## [How to parse additional kubernetes pods with json fomat logs?](https://discuss.elastic.co/t/how-to-parse-additional-kubernetes-pods-with-json-fomat-logs/293124)
**Author:** [@tarabhavi](https://discuss.elastic.co/u/tarabhavi)\ **Replies:** 0\ **Last updated:** [December 29, 2021, 1:45pm UTC](https://discuss.elastic.co/t/how-to-parse-additional-kubernetes-pods-with-json-fomat-logs/293124 "2021-12-29T13:45:11Z")
I have a ELK stack with Filebeat as an agent. Works great for collecting logs of existing pods. Here is the helm values for filebeat filebeatConfig: filebeat.yml: | logging.level: error filebeat.autodiscover:… --- ## [Logstash pipeline error](https://discuss.elastic.co/t/logstash-pipeline-error/293118)
**Author:** [@mangeshmj1992](https://discuss.elastic.co/u/mangeshmj1992)\ **Replies:** 0\ **Last updated:** [December 29, 2021, 1:18pm UTC](https://discuss.elastic.co/t/logstash-pipeline-error/293118 "2021-12-29T13:18:54Z")
Hello team, I am getting following issuw on logstash side. can anyone help me. Error: \[2021-12-29T16:50:48,240\]\[ERROR\]\[logstash.agent \] Failed to execute action {:action=\>LogStash::PipelineAction::Create/pip… --- ## [After installing a filter plugin with BouncyCastleFipsProvider, Logstash fails to start](https://discuss.elastic.co/t/after-installing-a-filter-plugin-with-bouncycastlefipsprovider-logstash-fails-to-start/293115)
**Author:** [@yon\_y](https://discuss.elastic.co/u/yon_y)\ **Replies:** 0\ **Last updated:** [December 29, 2021, 12:41pm UTC](https://discuss.elastic.co/t/after-installing-a-filter-plugin-with-bouncycastlefipsprovider-logstash-fails-to-start/293115 "2021-12-29T12:41:46Z")
I wrote a Java filter plugin, compiled it into a gem (after successfully unit-tests), installed it successfully to Logstash, but then Logstash fails to start. The problem is caused by a single line (when the line is remo… --- ## [Log4j auditbeat detection rule](https://discuss.elastic.co/t/log4j-auditbeat-detection-rule/292332)
**Author:** [@fgjensen](https://discuss.elastic.co/u/fgjensen)\ **Replies:** 1\ **Last updated:** [December 29, 2021, 12:45pm UTC](https://discuss.elastic.co/t/log4j-auditbeat-detection-rule/292332 "2021-12-29T12:45:13Z")
Hello Referring to this blog post I am trying to configure the auditbeat detection rule in Kibana 7.16.1 as a new event correlation rule. However when I past the rule into the EQL form this error is reported: verifica… --- ## [Change long field format](https://discuss.elastic.co/t/change-long-field-format/293049)
**Author:** [@mangeshs](https://discuss.elastic.co/u/mangeshs)\ **Replies:** 3\ **Last updated:** [December 29, 2021, 12:24pm UTC](https://discuss.elastic.co/t/change-long-field-format/293049 "2021-12-29T12:24:18Z")
I have field called # user\_id\_s: 14,960,923,573 long as above name, value and type I want it should look like 14960923573 I try to change its type to string by mutate convert but not worked. I tried creating new s… --- ## [Kibana Pie Chart Issue Version 7.16](https://discuss.elastic.co/t/kibana-pie-chart-issue-version-7-16/293013)
**Author:** [@tanvi.sehgal](https://discuss.elastic.co/u/tanvi.sehgal)\ **Replies:** 1\ **Last updated:** [December 29, 2021, 12:13pm UTC](https://discuss.elastic.co/t/kibana-pie-chart-issue-version-7-16/293013 "2021-12-29T12:13:35Z")
We have recently upgraded ELK from Version 7.5 to Version 7.16. After the version upgrade, facing some issue with the pie chart visualization. Earlier the pie chart's tooltip used to show the Custom Label defined for t… --- ## [How to process ResponseTimestamp-ClientIP-ReceivedTimestamp to show ReceivedTimestamp (23/Dec/2021:00:02:53 +0000) as @timestamp](https://discuss.elastic.co/t/how-to-process-responsetimestamp-clientip-receivedtimestamp-to-show-receivedtimestamp-23-dec-202102-53-0000-as-timestamp/293056)
**Author:** [@Melvin](https://discuss.elastic.co/u/Melvin)\ **Replies:** 4\ **Last updated:** [December 29, 2021, 10:36am UTC](https://discuss.elastic.co/t/how-to-process-responsetimestamp-clientip-receivedtimestamp-to-show-receivedtimestamp-23-dec-202102-53-0000-as-timestamp/293056 "2021-12-29T10:36:06Z")
Input example line in log: 2021-12-23T00:02:54.126Z 10.173.7.76 - - \[23/Dec/2021:00:02:53 +0000\] "POST /uri1/uri2?queryp=00-0A-12-34-56-78 HTTP/1.1" 403 2001 "-" "useragent" 0 \[500456\] Grok filter expression: filter {… --- ## [How to get an index rollover finished time](https://discuss.elastic.co/t/how-to-get-an-index-rollover-finished-time/292922)
**Author:** [@JohnPhilip](https://discuss.elastic.co/u/JohnPhilip)\ **Replies:** 5\ **Last updated:** [December 29, 2021, 10:28am UTC](https://discuss.elastic.co/t/how-to-get-an-index-rollover-finished-time/292922 "2021-12-29T10:28:53Z")
Hi, all, I want to know when does an index finished it's rollover action, is there any api to get this infomation? can \_ilm/explain show this info? --- ## [Elasticsearch 7.16.1 crashing randomly](https://discuss.elastic.co/t/elasticsearch-7-16-1-crashing-randomly/291827)
**Author:** [@ppuschmann](https://discuss.elastic.co/u/ppuschmann)\ **Replies:** 27\ **Last updated:** [December 29, 2021, 10:23am UTC](https://discuss.elastic.co/t/elasticsearch-7-16-1-crashing-randomly/291827 "2021-12-29T10:23:36Z")
Hi, after upgrading to Elasticsearch 7.16.1 (Debian-package from elastic.co), we're seeing some graver errors and crashes on some clusters: Instances are running with Debian Buster (10) \[2021-12-14T00:00:06,036\]\[ERRO… --- ## [Kibana server is not ready yet because upgrading elasticsearch](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet-because-upgrading-elasticsearch/292646)
**Author:** [@alipujaistopo](https://discuss.elastic.co/u/alipujaistopo)\ **Replies:** 12\ **Last updated:** [December 29, 2021, 10:12am UTC](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet-because-upgrading-elasticsearch/292646 "2021-12-29T10:12:46Z")
hi everyone i have a problem after i upgrade from 7.15.2 to 7.16.2 my kibana server is not ready yet. here' s the log i get \[root@bdi-uat-els elasticsearch\]# tail elasticsearch.log at org.elasticsearch.xpack.mo… --- ## [Incorrect/increasing elasticsearch count query after re-indexing!](https://discuss.elastic.co/t/incorrect-increasing-elasticsearch-count-query-after-re-indexing/293096)
**Author:** [@Ilia](https://discuss.elastic.co/u/Ilia)\ **Replies:** 1\ **Last updated:** [December 29, 2021, 9:44am UTC](https://discuss.elastic.co/t/incorrect-increasing-elasticsearch-count-query-after-re-indexing/293096 "2021-12-29T09:44:06Z")
Some hours ago I've re-indexed one of my indices. The re-indexing process completed in about 2 hours and I've run the following query afterwards: GET myIndex/\_count { "query": { "bool": { "must": \[ {… --- ## [Self-managed Gold subscription infra required is 3-node with 64GB ram, 8 core cpu, 2TB ssd?](https://discuss.elastic.co/t/self-managed-gold-subscription-infra-required-is-3-node-with-64gb-ram-8-core-cpu-2tb-ssd/293090)
**Author:** [@Melvin](https://discuss.elastic.co/u/Melvin)\ **Replies:** 1\ **Last updated:** [December 29, 2021, 7:18am UTC](https://discuss.elastic.co/t/self-managed-gold-subscription-infra-required-is-3-node-with-64gb-ram-8-core-cpu-2tb-ssd/293090 "2021-12-29T07:18:22Z")
Hi, Wanted to check with the community if there was a mistake in my understanding. I was told that Gold subscription is provided to self-managed instances only if the infra we have confirms to the following specs: 3 n… --- ## [Error while restarting elastic service when I add xpack.security.enabled: true to the .yml file](https://discuss.elastic.co/t/error-while-restarting-elastic-service-when-i-add-xpack-security-enabled-true-to-the-yml-file/292938)
**Author:** [@Ayoub\_Mouloua](https://discuss.elastic.co/u/Ayoub_Mouloua)\ **Replies:** 2\ **Last updated:** [December 29, 2021, 6:56am UTC](https://discuss.elastic.co/t/error-while-restarting-elastic-service-when-i-add-xpack-security-enabled-true-to-the-yml-file/292938 "2021-12-29T06:56:50Z")
Hello ppl, when I add xpack.security.enabled: true rule to .yml file and I restart the service using : sudo systemctl restart elasticsearch.service I got this error: Job for elasticsearch.service failed because the con… --- ## [Filebeat - Module Elasticsearch 7.16](https://discuss.elastic.co/t/filebeat-module-elasticsearch-7-16/293087)
**Author:** [@cmmourinho](https://discuss.elastic.co/u/cmmourinho)\ **Replies:** 0\ **Last updated:** [December 29, 2021, 5:49am UTC](https://discuss.elastic.co/t/filebeat-module-elasticsearch-7-16/293087 "2021-12-29T05:49:31Z")
version Fliebeat, elasticsearch 7.16.2 I use filebeat collect elasticsearch log to another cluster. when i configure var.paths in modules.d/elasticsearch.yml var.paths: \["/var/log/elasticsearch/\*\_server.json"\] f… --- ## [Enable http encryption on cluster](https://discuss.elastic.co/t/enable-http-encryption-on-cluster/293005)
**Author:** [@eh2021-elastic](https://discuss.elastic.co/u/eh2021-elastic)\ **Replies:** 1\ **Last updated:** [December 29, 2021, 5:46am UTC](https://discuss.elastic.co/t/enable-http-encryption-on-cluster/293005 "2021-12-29T05:46:49Z")
I have an 8 node cluster running the basic license and is currently only configured with transport security. I am looking to enable http encryption on the cluster and the documentation mentions to shutdown all the nodes … --- ## [Setup elk 8 beta](https://discuss.elastic.co/t/setup-elk-8-beta/293022)
**Author:** [@swchandu](https://discuss.elastic.co/u/swchandu)\ **Replies:** 1\ **Last updated:** [December 29, 2021, 5:43am UTC](https://discuss.elastic.co/t/setup-elk-8-beta/293022 "2021-12-29T05:43:21Z")
Hi, I have been using docker 8 alpha till now and wanted to try beta 1. I am surprised to see more secured options enabled for kibana while connecting to elastic. Did any one tried 8 beta 1? / share me the procedure t… --- ## [Sort After Aggregation](https://discuss.elastic.co/t/sort-after-aggregation/293081)
**Author:** [@aosrc](https://discuss.elastic.co/u/aosrc)\ **Replies:** 1\ **Last updated:** [December 29, 2021, 5:02am UTC](https://discuss.elastic.co/t/sort-after-aggregation/293081 "2021-12-29T05:02:09Z")
I need to aggregate by multi fields : \[srcMac, dstMac, srcIp, dstIp, srcPort, dstPort, protocol\], so I add a field "groupKey" and then aggregate by it. the mappings is: { "mappings": { "\_doc": { … --- ## [After deleting an index, a new one is created with invalid naming scheme](https://discuss.elastic.co/t/after-deleting-an-index-a-new-one-is-created-with-invalid-naming-scheme/292747)
**Author:** [@mdebord](https://discuss.elastic.co/u/mdebord)\ **Replies:** 6\ **Last updated:** [December 28, 2021, 9:21pm UTC](https://discuss.elastic.co/t/after-deleting-an-index-a-new-one-is-created-with-invalid-naming-scheme/292747 "2021-12-28T21:21:39Z")
Logstash 7.16.2 Elasticsearch 7.16.2 Summary In a scenario that beat processors are sending to logstash, and logstash has ilm configured, if the working index is deleted, a new one is created (as expected), but the n… --- ## [Unable to choose Fleet Agent Policy](https://discuss.elastic.co/t/unable-to-choose-fleet-agent-policy/292051)
**Author:** [@thedanielmatt](https://discuss.elastic.co/u/thedanielmatt)\ **Replies:** 3\ **Last updated:** [December 29, 2021, 3:48am UTC](https://discuss.elastic.co/t/unable-to-choose-fleet-agent-policy/292051 "2021-12-29T03:48:37Z")
Hello everyone, I'm trying to get a Fleet server set up on my on-premise stack for the first time. Server and Agent are RPM installed with version 7.16.1. When setting up the Fleet server, I am unable to select an Age… --- ## [\[ERROR\] logstash.filters.ruby](https://discuss.elastic.co/t/error-logstash-filters-ruby/291841)
**Author:** [@kyk](https://discuss.elastic.co/u/kyk)\ **Replies:** 4\ **Last updated:** [December 29, 2021, 3:14am UTC](https://discuss.elastic.co/t/error-logstash-filters-ruby/291841 "2021-12-29T03:14:16Z")
I have the next ruby code ruby { code =\> ' m = event.get("ip\_port").scan(/(\\d+.\\d+.\\d+.\\d+):(\\d+)-\>(\\d+.\\d+.\\d+.\\d+):(\\d+)/) w = ; x = ; y = ; z = m.each { |a| w \<\< a\[0\].to\_fo x \<\< a\[1\].to\_fo y \<\< a\[2\].to\_fo z \<… --- ## [Upload documenet/image as data into Elasticsearch](https://discuss.elastic.co/t/upload-documenet-image-as-data-into-elasticsearch/293058)
**Author:** [@Amisha\_Thakkar](https://discuss.elastic.co/u/Amisha_Thakkar)\ **Replies:** 3\ **Last updated:** [December 28, 2021, 11:38pm UTC](https://discuss.elastic.co/t/upload-documenet-image-as-data-into-elasticsearch/293058 "2021-12-28T23:38:37Z")
Hi Team, We would like to know if we can upload document/image as a data into Elasticsearch. And will it index the text which is there in that document/image. So that we can search the text present on that document/imag… --- ## [ElasticSeach SSL Signed overrun error](https://discuss.elastic.co/t/elasticseach-ssl-signed-overrun-error/293071)
**Author:** [@a09hopper](https://discuss.elastic.co/u/a09hopper)\ **Replies:** 2\ **Last updated:** [December 28, 2021, 10:39pm UTC](https://discuss.elastic.co/t/elasticseach-ssl-signed-overrun-error/293071 "2021-12-28T22:39:31Z")
Searching around I have not seen anyone run into this error. I am using Elasticsearch 7.16.2 with a Windows CA, I request a CSR and then sign it with the Windows web enrolment under the web server setting, the followin… --- ## [Configuring auth with AD users](https://discuss.elastic.co/t/configuring-auth-with-ad-users/293007)
**Author:** [@Kirill\_Gofman](https://discuss.elastic.co/u/Kirill_Gofman)\ **Replies:** 1\ **Last updated:** [December 28, 2021, 9:34pm UTC](https://discuss.elastic.co/t/configuring-auth-with-ad-users/293007 "2021-12-28T21:34:14Z")
Hey, we are currently have elastic cloud with Elasticsearch and kibana on it. The login process atm is via deployments. We are looking to configure AD auth to kibana. I'm a little bit confused with all the guides. What … --- ## [Daily index vs hourly index, which is better for Search in period of month?](https://discuss.elastic.co/t/daily-index-vs-hourly-index-which-is-better-for-search-in-period-of-month/293026)
**Author:** [@jr2001](https://discuss.elastic.co/u/jr2001)\ **Replies:** 1\ **Last updated:** [December 28, 2021, 9:33pm UTC](https://discuss.elastic.co/t/daily-index-vs-hourly-index-which-is-better-for-search-in-period-of-month/293026 "2021-12-28T21:33:25Z")
Hi There, We have an indexing which is growing around 1.4 TB per day. this daily index have 4 million documents almost. each daily index has 6 primary shards and no replicas. we have 2 physical server (Ubuntu 20.04.2… --- ## [Issue securing Elasticsearch : elasticsearch-setup-passwords not installed](https://discuss.elastic.co/t/issue-securing-elasticsearch-elasticsearch-setup-passwords-not-installed/292821)
**Author:** [@dannymccaslin](https://discuss.elastic.co/u/dannymccaslin)\ **Replies:** 3\ **Last updated:** [December 28, 2021, 9:17pm UTC](https://discuss.elastic.co/t/issue-securing-elasticsearch-elasticsearch-setup-passwords-not-installed/292821 "2021-12-28T21:17:15Z")
I have a three-node Elasticsearch cluster running 6.8.22 and I'm trying to add passwords following the instructions here: https://www.elastic.co/guide/en/elasticsearch/reference/current/security-minimal-setup.html. Howev… --- ## [Help with my first elasticsearch mapping](https://discuss.elastic.co/t/help-with-my-first-elasticsearch-mapping/292358)
**Author:** [@4art4](https://discuss.elastic.co/u/4art4)\ **Replies:** 3\ **Last updated:** [December 28, 2021, 9:16pm UTC](https://discuss.elastic.co/t/help-with-my-first-elasticsearch-mapping/292358 "2021-12-28T21:16:25Z")
What I have is elasticserach ingesting something like: { "policy": { "name": "account-cloudtrail-enabled", "resource": "account" }, "metrics": \[{ "MetricName": "ResourceCount", "Timestamp": "2021-12-06T11:29:… --- ## [Need help to setup Data curation layer for Elastic stack](https://discuss.elastic.co/t/need-help-to-setup-data-curation-layer-for-elastic-stack/293037)
**Author:** [@aayu\_ssh](https://discuss.elastic.co/u/aayu_ssh)\ **Replies:** 1\ **Last updated:** [December 28, 2021, 8:58pm UTC](https://discuss.elastic.co/t/need-help-to-setup-data-curation-layer-for-elastic-stack/293037 "2021-12-28T20:58:31Z")
i am trying to setup a curation layer for my current existing elastic cloud cluster, but am not sure how to implement this, could nod find much help over the web. can someone help ? with curation layer, we are trying to… [Previous page](https://discuss.elastic.co/latest.md?page=1327) [Next page](https://discuss.elastic.co/latest.md?page=1329)