# Latest **URL:** https://discuss.elastic.co/latest.md?page=1343 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1344 --- ## [After restart, logstash doesn't read only new files](https://discuss.elastic.co/t/after-restart-logstash-doesnt-read-only-new-files/292012)
**Author:** [@khouloud](https://discuss.elastic.co/u/khouloud)\ **Replies:** 6\ **Last updated:** [December 16, 2021, 1:12pm UTC](https://discuss.elastic.co/t/after-restart-logstash-doesnt-read-only-new-files/292012 "2021-12-16T13:12:12Z")
Hello, is it possible when we stop and restart logstash doesn't read all the files that match the path from the beginning and read only new files appended? --- ## [Determine when clone index has completed](https://discuss.elastic.co/t/determine-when-clone-index-has-completed/291675)
**Author:** [@madshov](https://discuss.elastic.co/u/madshov)\ **Replies:** 4\ **Last updated:** [December 16, 2021, 11:52am UTC](https://discuss.elastic.co/t/determine-when-clone-index-has-completed/291675 "2021-12-16T11:52:03Z")
Hi, I'm writing some functionality where step 1 would be to backup the current ES index. For this I'm using the \_cloneIndex request. This seems like the most appropriate choice. But how would I know for sure when that h… --- ## [Detecting Exploitation of CVE-2021-44228 (log4j2) with Elastic Security](https://discuss.elastic.co/t/detecting-exploitation-of-cve-2021-44228-log4j2-with-elastic-security/292138)
**Author:** [@jbal24](https://discuss.elastic.co/u/jbal24)\ **Replies:** 0\ **Last updated:** [December 16, 2021, 10:56am UTC](https://discuss.elastic.co/t/detecting-exploitation-of-cve-2021-44228-log4j2-with-elastic-security/292138 "2021-12-16T10:56:35Z")
Hi everyone, I would like to check with you one thing, we use our corporate Elastic as a SIEM using the security feature. We have seen this blog about: Detecting Exploitation of CVE-2021-44228 (log4j2) with Elastic Sec… --- ## [Getting less hits in elasticsearch](https://discuss.elastic.co/t/getting-less-hits-in-elasticsearch/292095)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 1\ **Last updated:** [December 16, 2021, 10:39am UTC](https://discuss.elastic.co/t/getting-less-hits-in-elasticsearch/292095 "2021-12-16T10:39:10Z")
I have 1000 records but i am just getting 997 records. csv-input.conf input { file { path =\> "/usr/share/logstash/user\_details.csv" start\_position =\> "beginning" #sincedb\_path =\> "/usr/share/logstash/dbteste" } } f… --- ## [Add units to metric visualization in kibana](https://discuss.elastic.co/t/add-units-to-metric-visualization-in-kibana/292098)
**Author:** [@Anton\_Schleenvoigt](https://discuss.elastic.co/u/Anton_Schleenvoigt)\ **Replies:** 1\ **Last updated:** [December 16, 2021, 10:35am UTC](https://discuss.elastic.co/t/add-units-to-metric-visualization-in-kibana/292098 "2021-12-16T10:35:03Z")
Right now I have created a metric that shows maximum value of an power meter value X and after this value i would like to add the measure unit sent i within the same msg. I have a modbus that sends different values and … --- ## [Nested ElasticSeach Aggregation term query help needed different levels](https://discuss.elastic.co/t/nested-elasticseach-aggregation-term-query-help-needed-different-levels/292129)
**Author:** [@Arti\_Sayani](https://discuss.elastic.co/u/Arti_Sayani)\ **Replies:** 0\ **Last updated:** [December 16, 2021, 10:01am UTC](https://discuss.elastic.co/t/nested-elasticseach-aggregation-term-query-help-needed-different-levels/292129 "2021-12-16T10:01:44Z")
If someone can answer this. I need urgent help with this query on raw data for multiple nested aggregations --- ## [Kibana dropdown filter doesn't handle results containing a dash (-)](https://discuss.elastic.co/t/kibana-dropdown-filter-doesnt-handle-results-containing-a-dash/291994)
**Author:** [@vpy](https://discuss.elastic.co/u/vpy)\ **Replies:** 1\ **Last updated:** [December 16, 2021, 9:13am UTC](https://discuss.elastic.co/t/kibana-dropdown-filter-doesnt-handle-results-containing-a-dash/291994 "2021-12-16T09:13:00Z")
Hi I would like to report a this Kibana canvas issue. Let me first describe the test environment: The canvas contains a dropdown filter and a Data table. The kibana index is issued from syslog files. The main index f… --- ## [Dashboard setup fails: Unable to bulk\_create index-pattern](https://discuss.elastic.co/t/dashboard-setup-fails-unable-to-bulk-create-index-pattern/292007)
**Author:** [@Adriann](https://discuss.elastic.co/u/Adriann)\ **Replies:** 4\ **Last updated:** [December 16, 2021, 9:07am UTC](https://discuss.elastic.co/t/dashboard-setup-fails-unable-to-bulk-create-index-pattern/292007 "2021-12-16T09:07:46Z")
Hello, I have encountered the same problem as the user in this post. I configured metricbeat and filebeat with the kibana\_system user. Should I create a new user that runs as a kibana\_system user and add some rights? W… --- ## [Monitoring WIndows Server](https://discuss.elastic.co/t/monitoring-windows-server/292111)
**Author:** [@labate](https://discuss.elastic.co/u/labate)\ **Replies:** 0\ **Last updated:** [December 16, 2021, 8:44am UTC](https://discuss.elastic.co/t/monitoring-windows-server/292111 "2021-12-16T08:44:36Z")
HI everyone, I don't understand why I'm not able to view the monitoring of my Windows server on the Metric menu on Kibana. I see the metric when I go in "Discover" menu but not in the metric menu. After some research I … --- ## [Search response returns empty \_source](https://discuss.elastic.co/t/search-response-returns-empty-source/292108)
**Author:** [@Katgust](https://discuss.elastic.co/u/Katgust)\ **Replies:** 0\ **Last updated:** [December 16, 2021, 8:28am UTC](https://discuss.elastic.co/t/search-response-returns-empty-source/292108 "2021-12-16T08:28:12Z")
Similar or almost identical search querys in other files give the right response but now something isn't working. I stripped it down to the smallest query but I still have the same problem. var searchResponse = await Es… --- ## [Dec 16th, 2021: \[en\] Logging and monitoring HTTP requests reaching your Elasticsearch cluster](https://discuss.elastic.co/t/dec-16th-2021-en-logging-and-monitoring-http-requests-reaching-your-elasticsearch-cluster/290442)
**Author:** [@Luca\_Belluccini](https://discuss.elastic.co/u/Luca_Belluccini)\ **Replies:** 0\ **Last updated:** [December 16, 2021, 8:00am UTC](https://discuss.elastic.co/t/dec-16th-2021-en-logging-and-monitoring-http-requests-reaching-your-elasticsearch-cluster/290442 "2021-12-16T08:00:06Z")
Have you ever wanted to take a look at the HTTP requests served by your Elasticsearch nodes? This article is made for you! Except if you have a load balancer or reverse proxy in front of your Elasticsearch nodes, captu… --- ## [Log4j vulnerability and Elasticsearch 6.8.21](https://discuss.elastic.co/t/log4j-vulnerability-and-elasticsearch-6-8-21/292088)
**Author:** [@srikanth.puli](https://discuss.elastic.co/u/srikanth.puli)\ **Replies:** 0\ **Last updated:** [December 16, 2021, 6:59am UTC](https://discuss.elastic.co/t/log4j-vulnerability-and-elasticsearch-6-8-21/292088 "2021-12-16T06:59:21Z")
Hi, As per the release notes of Elasticserch 6.8.21, the vulnerability CVE-2021-44228 is addressed by removing the class file JndiLookup.class from the log4j jar. We have upgraded our application with Elasticsearch 6.8.… --- ## [Using pre-configured email connector instead of using configured email connector](https://discuss.elastic.co/t/using-pre-configured-email-connector-instead-of-using-configured-email-connector/291720)
**Author:** [@keyu](https://discuss.elastic.co/u/keyu)\ **Replies:** 4\ **Last updated:** [December 16, 2021, 7:24am UTC](https://discuss.elastic.co/t/using-pre-configured-email-connector-instead-of-using-configured-email-connector/291720 "2021-12-16T07:24:58Z")
Hi, I am working on watcher emails. Configured a connector in "Rules and Connectors" I have validated the connector validation by test email. I am able to receive the email from the Test tab by clicking on the "Run" bu… --- ## [Extract Hashtags and Mentions into separate fields](https://discuss.elastic.co/t/extract-hashtags-and-mentions-into-separate-fields/291656)
**Author:** [@prakhar\_nigam](https://discuss.elastic.co/u/prakhar_nigam)\ **Replies:** 2\ **Last updated:** [December 16, 2021, 6:48am UTC](https://discuss.elastic.co/t/extract-hashtags-and-mentions-into-separate-fields/291656 "2021-12-16T06:48:50Z")
I am doing a DIY Tweet Sentiment analyser, I have an index of tweets like these, "\_source" : { "id" : 26930655, "status" : 1, "title" : "Here’s 5 underrated #BTC and realistic crypto accounts that ever… --- ## [Unable to configure Elasticsearch following the Quickstart guide](https://discuss.elastic.co/t/unable-to-configure-elasticsearch-following-the-quickstart-guide/292076)
**Author:** [@abu.kalna](https://discuss.elastic.co/u/abu.kalna)\ **Replies:** 1\ **Last updated:** [December 16, 2021, 5:43am UTC](https://discuss.elastic.co/t/unable-to-configure-elasticsearch-following-the-quickstart-guide/292076 "2021-12-16T05:43:18Z")
Unable to configure Elasticsearch on Kubernetes 1.22 using the Quickstart guide (Deploy ECK in your Kubernetes cluster | Elastic Cloud on Kubernetes \[1.8\] | Elastic). It is in "ApplyingChanges" for the last 14 hours. $ … --- ## [MISP Configuration issue in Filebeat module](https://discuss.elastic.co/t/misp-configuration-issue-in-filebeat-module/292002)
**Author:** [@tejas.tech](https://discuss.elastic.co/u/tejas.tech)\ **Replies:** 1\ **Last updated:** [December 15, 2021, 3:22pm UTC](https://discuss.elastic.co/t/misp-configuration-issue-in-filebeat-module/292002 "2021-12-15T15:22:36Z")
Error while processing http request: failed to execute http client.Do: failed to execute http client.Do: Post "https://127.0.0.1/events/restSearch": POST https://127.0.0.1/events/restSearch giving up after 6 attempts … --- ## [Elasticsearch 7.10.0, x-pack-core and x-pack-security under which license](https://discuss.elastic.co/t/elasticsearch-7-10-0-x-pack-core-and-x-pack-security-under-which-license/290104)
**Author:** [@Sagarika\_Mahalik](https://discuss.elastic.co/u/Sagarika_Mahalik)\ **Replies:** 3\ **Last updated:** [December 16, 2021, 5:34am UTC](https://discuss.elastic.co/t/elasticsearch-7-10-0-x-pack-core-and-x-pack-security-under-which-license/290104 "2021-12-16T05:34:53Z")
Hi, I wanted to ask the Elasticsearch 7.10.0 is now under which license and the x-pack-core7.10.0 and x-pack-security7.10.0 which comes with Elasticsearch 7.10.0 is under which license. Thanks --- ## [Logstash and logical or](https://discuss.elastic.co/t/logstash-and-logical-or/291582)
**Author:** [@KaPBaJIOJI](https://discuss.elastic.co/u/KaPBaJIOJI)\ **Replies:** 3\ **Last updated:** [December 16, 2021, 3:43am UTC](https://discuss.elastic.co/t/logstash-and-logical-or/291582 "2021-12-16T03:43:29Z")
Hello everyone I try to started config logstash Work config filter { # grok log lines by program name (listed alpabetically) if \[program\] =~ /^postfix.\*\\/anvil$/ { grok { patterns\_dir =\> … --- ## [Logstash calls flush method multiple times per filter plugin](https://discuss.elastic.co/t/logstash-calls-flush-method-multiple-times-per-filter-plugin/292062)
**Author:** [@vbohata](https://discuss.elastic.co/u/vbohata)\ **Replies:** 0\ **Last updated:** [December 16, 2021, 12:28am UTC](https://discuss.elastic.co/t/logstash-calls-flush-method-multiple-times-per-filter-plugin/292062 "2021-12-16T00:28:29Z")
I am writing some logstash filter plugin and found one weird behaviour. It seems the LS somehow calls flush method multiple times even if I use 1 worker and 1 pipeline called "def". I did some tests and here are parts of… --- ## [LogstashのKVフィルター設定について](https://discuss.elastic.co/t/logstash-kv/290528)
**Author:** [@na\_taka](https://discuss.elastic.co/u/na_taka)\ **Replies:** 6\ **Last updated:** [December 16, 2021, 2:20am UTC](https://discuss.elastic.co/t/logstash-kv/290528 "2021-12-16T02:20:17Z")
お世話になっております。 logstashのフィルター設定についてご質問です。 サンプルログ(valueにスペースが存在するデータ) key3=value3 key4=val ue4 key5=value5 key6=val ue6 以下のようにkvフィルターを使用しています。 filter { kv { source =\> "message" field\_split =\> " " value\_split =\> "=" … --- ## [Search for unused fields](https://discuss.elastic.co/t/search-for-unused-fields/292060)
**Author:** [@hamzahda](https://discuss.elastic.co/u/hamzahda)\ **Replies:** 3\ **Last updated:** [December 16, 2021, 2:04am UTC](https://discuss.elastic.co/t/search-for-unused-fields/292060 "2021-12-16T02:04:10Z")
I have an index pttern that has a huge number of fields and I want to clean it up by removing the unused fields. The way that I'm using to find out if a field is used or not is by searching for the field in the available… --- ## [Mitigation for Log4j2 vulnerability](https://discuss.elastic.co/t/mitigation-for-log4j2-vulnerability/291938)
**Author:** [@Programmer](https://discuss.elastic.co/u/Programmer)\ **Replies:** 4\ **Last updated:** [December 16, 2021, 1:21am UTC](https://discuss.elastic.co/t/mitigation-for-log4j2-vulnerability/291938 "2021-12-16T01:21:08Z")
Hi, I am using the below ELK stack versions. Might be old version. I would like to know whether these versions of ELK are vulnerable due to the log4j2 issue. Elasticsearch-2.3.3 logstash-2.3.1 kibana-4.5.1 I couldn'… --- ## [CVE-2021-44228 not using XPack, does exposure change?](https://discuss.elastic.co/t/cve-2021-44228-not-using-xpack-does-exposure-change/292022)
**Author:** [@falcon404](https://discuss.elastic.co/u/falcon404)\ **Replies:** 1\ **Last updated:** [December 16, 2021, 1:18am UTC](https://discuss.elastic.co/t/cve-2021-44228-not-using-xpack-does-exposure-change/292022 "2021-12-16T01:18:52Z")
Hi, We are running Elasticsearch and not enabling / installing X-Pack for reasons. With regard to the log4j2 vulnerability CVE-2021-44228, there has been mention of setting property or upgrading to a later version (I … --- ## [Dec 15th, 2021: \[en\] UFOs in Kibana Maps](https://discuss.elastic.co/t/dec-15th-2021-en-ufos-in-kibana-maps/290576)
**Author:** [@bhavyarm](https://discuss.elastic.co/u/bhavyarm)\ **Replies:** 0\ **Last updated:** [December 15, 2021, 8:00am UTC](https://discuss.elastic.co/t/dec-15th-2021-en-ufos-in-kibana-maps/290576 "2021-12-15T08:00:52Z")
When the call came for doing a post for the advent calendar, I signed up to write about our amazing maps capabilities in Kibana again. But, in my end-of-year escapism from real and scary things like covid and climate em… --- ## [Logstash json parse error](https://discuss.elastic.co/t/logstash-json-parse-error/291557)
**Author:** [@dominbdg](https://discuss.elastic.co/u/dominbdg)\ **Replies:** 1\ **Last updated:** [December 15, 2021, 11:01pm UTC](https://discuss.elastic.co/t/logstash-json-parse-error/291557 "2021-12-15T23:01:31Z")
hello, Last time I'm receiving a log of logstash json parse errors, from the error logs I cannot read anything about to what files it is about to, \[ WARN \] 2021-12-12 13:28:20.845 \[\[main\]\>worker6\] json - Error parsing… --- ## [Nested must\_not query does not return expected results](https://discuss.elastic.co/t/nested-must-not-query-does-not-return-expected-results/291944)
**Author:** [@jsjs2](https://discuss.elastic.co/u/jsjs2)\ **Replies:** 1\ **Last updated:** [December 15, 2021, 10:44pm UTC](https://discuss.elastic.co/t/nested-must-not-query-does-not-return-expected-results/291944 "2021-12-15T22:44:54Z")
what is the expected behavior for a nested must\_not query? sample query: { "query": { "bool": { "filter": \[ { "nested": { "path": "par… --- ## [Elasticsearch 5.0.0-5.6.10 and 6.0.0-6.3.2: Log4j CVE-2021-44228, CVE-2021-45046 remediation](https://discuss.elastic.co/t/elasticsearch-5-0-0-5-6-10-and-6-0-0-6-3-2-log4j-cve-2021-44228-cve-2021-45046-remediation/292054)
**Author:** [@qhoxie](https://discuss.elastic.co/u/qhoxie)\ **Replies:** 0\ **Last updated:** [December 15, 2021, 10:21pm UTC](https://discuss.elastic.co/t/elasticsearch-5-0-0-5-6-10-and-6-0-0-6-3-2-log4j-cve-2021-44228-cve-2021-45046-remediation/292054 "2021-12-15T22:21:00Z")
Note — If you are not running Elasticsearch 5.0.0-5.6.10 or 6.0.0-6.3.2, these instructions do not apply. Please follow the guidance in the main announcement. Instructions for removing JndiLookup from the log4j-core JAR… --- ## [Logstash : Elasticsearch input plugin not working with a remote server](https://discuss.elastic.co/t/logstash-elasticsearch-input-plugin-not-working-with-a-remote-server/291685)
**Author:** [@Bassem\_Wadie](https://discuss.elastic.co/u/Bassem_Wadie)\ **Replies:** 1\ **Last updated:** [December 15, 2021, 9:37pm UTC](https://discuss.elastic.co/t/logstash-elasticsearch-input-plugin-not-working-with-a-remote-server/291685 "2021-12-15T21:37:03Z")
Hello, I have logstash installed on my PC and there is a Amazon Linux 2 AMI machine contains Kubernetes ( Elasticsearch and Ngnix) There is ssl installed on the server but i can make queries from postman on my pc usi… --- ## [Logstash.instrument.periodicpoller.jvm remove from log](https://discuss.elastic.co/t/logstash-instrument-periodicpoller-jvm-remove-from-log/291932)
**Author:** [@peledev](https://discuss.elastic.co/u/peledev)\ **Replies:** 1\ **Last updated:** [December 15, 2021, 9:20pm UTC](https://discuss.elastic.co/t/logstash-instrument-periodicpoller-jvm-remove-from-log/291932 "2021-12-15T21:20:11Z")
how do i disable all the logs debug of logstash.instrument.periodicpoller.jvm it is filling my log with junk please assist thanks claudia --- ## [Is it possible to send one email with several Dashboard PDF reports?](https://discuss.elastic.co/t/is-it-possible-to-send-one-email-with-several-dashboard-pdf-reports/291359)
**Author:** [@Luis\_P](https://discuss.elastic.co/u/Luis_P)\ **Replies:** 3\ **Last updated:** [December 15, 2021, 9:16pm UTC](https://discuss.elastic.co/t/is-it-possible-to-send-one-email-with-several-dashboard-pdf-reports/291359 "2021-12-15T21:16:30Z")
I've been building a watcher with the purpose of when the condition is met, it should send one email with several Dashboard PDF reports as attachments, one for each process. So far I've only been able to make it so it se… [Previous page](https://discuss.elastic.co/latest.md?page=1342) [Next page](https://discuss.elastic.co/latest.md?page=1344)