# Latest **URL:** https://discuss.elastic.co/latest.md?page=1344 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1345 --- ## [Warning \[org.logstash.instrument.metrics.gauge.LazyDelegatingGauge\] after updating to 7.16.1](https://discuss.elastic.co/t/warning-org-logstash-instrument-metrics-gauge-lazydelegatinggauge-after-updating-to-7-16-1/292049)
**Author:** [@d71247](https://discuss.elastic.co/u/d71247)\ **Replies:** 1\ **Last updated:** [December 15, 2021, 9:07pm UTC](https://discuss.elastic.co/t/warning-org-logstash-instrument-metrics-gauge-lazydelegatinggauge-after-updating-to-7-16-1/292049 "2021-12-15T21:07:37Z")
Hello, I just updated my Logstash to 7.16.1... but I noticed warning in my conf when starting Logstash. the same conf of Logstash works well in version 7.9.1 How do to fix this warning ? I am using a Logstash docker … --- ## [Is it possible to update an index by importing an updated .csv file?](https://discuss.elastic.co/t/is-it-possible-to-update-an-index-by-importing-an-updated-csv-file/292029)
**Author:** [@kibanauser4](https://discuss.elastic.co/u/kibanauser4)\ **Replies:** 1\ **Last updated:** [December 15, 2021, 8:35pm UTC](https://discuss.elastic.co/t/is-it-possible-to-update-an-index-by-importing-an-updated-csv-file/292029 "2021-12-15T20:35:24Z")
I want to update my index by importing a .csv file via Logstash. Currently, the plan is to delete all the records from the index and then reimport the new .csv file from scratch. But I was wondering if it's possible to j… --- ## [Found " Nettle Cryptographics Library Vulnerability" in docker.elastic.co/elasticsearch/elasticsearch:7.12.1 image](https://discuss.elastic.co/t/found-nettle-cryptographics-library-vulnerability-in-docker-elastic-co-elasticsearch-elasticsearch-7-12-1-image/292038)
**Author:** [@Ajinkya\_Shinde1](https://discuss.elastic.co/u/Ajinkya_Shinde1)\ **Replies:** 0\ **Last updated:** [December 15, 2021, 6:38pm UTC](https://discuss.elastic.co/t/found-nettle-cryptographics-library-vulnerability-in-docker-elastic-co-elasticsearch-elasticsearch-7-12-1-image/292038 "2021-12-15T18:38:01Z")
We are using Elasticsearch as a log server for Liferay application 7.3-ga1. The recommended version of ELS is 7.12 as per Liferay documentation. Recently I have scanned the docker image with Azure Defender and observed… --- ## [Cannot consume elasticsearch client in angular application](https://discuss.elastic.co/t/cannot-consume-elasticsearch-client-in-angular-application/291029)
**Author:** [@Ola\_Aboamer](https://discuss.elastic.co/u/Ola_Aboamer)\ **Replies:** 1\ **Last updated:** [December 15, 2021, 8:00pm UTC](https://discuss.elastic.co/t/cannot-consume-elasticsearch-client-in-angular-application/291029 "2021-12-15T20:00:39Z")
Hi There I am using Angular10 and "@elastic/Elasticsearch": "^7.15.0", and getting the following dependency errors, ERROR in ./node\_modules/@elastic/elasticsearch/lib/Connection.js Module not found: Error: Can't re… --- ## [CVE-2021-44228 Alternative Mitigation](https://discuss.elastic.co/t/cve-2021-44228-alternative-mitigation/291877)
**Author:** [@boris111](https://discuss.elastic.co/u/boris111)\ **Replies:** 2\ **Last updated:** [December 15, 2021, 7:55pm UTC](https://discuss.elastic.co/t/cve-2021-44228-alternative-mitigation/291877 "2021-12-15T19:55:02Z")
Is it possible to drop the new log4j-core-2.15.0.jar for logstash as an alternative mitigation for the 5.x logstash version? The recommended mitigation step to remove the JndiLookup.class would not be desirable for dep… --- ## [Need to split comma delimited string where one of the fields contains a backslash](https://discuss.elastic.co/t/need-to-split-comma-delimited-string-where-one-of-the-fields-contains-a-backslash/289962)
**Author:** [@trwillis](https://discuss.elastic.co/u/trwillis)\ **Replies:** 2\ **Last updated:** [November 23, 2021, 7:00pm UTC](https://discuss.elastic.co/t/need-to-split-comma-delimited-string-where-one-of-the-fields-contains-a-backslash/289962 "2021-11-23T19:00:48Z")
I have this message string: "foo,bar,domain\\name,blah I need to split it into fields so it looks like this: field\[0\]: foo field\[1\]: bar field\[2\]: domain\\user field\[3\]: blah but the split filter splits the message u… --- ## [Failing to load conf file](https://discuss.elastic.co/t/failing-to-load-conf-file/289811)
**Author:** [@kainan](https://discuss.elastic.co/u/kainan)\ **Replies:** 4\ **Last updated:** [November 23, 2021, 3:28pm UTC](https://discuss.elastic.co/t/failing-to-load-conf-file/289811 "2021-11-23T15:28:02Z")
Hey all, First time poster. I have been struggling for over a week to get the below conf file to compile. I have read through the forums and it always seems to be missing a } however that does not seem to be the case he… --- ## [Mutate rename using field value](https://discuss.elastic.co/t/mutate-rename-using-field-value/292014)
**Author:** [@sirReeall](https://discuss.elastic.co/u/sirReeall)\ **Replies:** 2\ **Last updated:** [December 15, 2021, 6:27pm UTC](https://discuss.elastic.co/t/mutate-rename-using-field-value/292014 "2021-12-15T18:27:13Z")
Hello, I'm trying to rename a field using the value of another metadata field, here is what I have tried: filter { grok { match =\> { "path" =\> "%{GREEDYDATA}/%{GREEDYDATA:\[@metadata\]\[metric\_name\]}\\.csv" … --- ## [7.16.1 - All beats docs in Discover had unknown field and value as json](https://discuss.elastic.co/t/7-16-1-all-beats-docs-in-discover-had-unknown-field-and-value-as-json/292017)
**Author:** [@Zabulon](https://discuss.elastic.co/u/Zabulon)\ **Replies:** 6\ **Last updated:** [December 15, 2021, 6:26pm UTC](https://discuss.elastic.co/t/7-16-1-all-beats-docs-in-discover-had-unknown-field-and-value-as-json/292017 "2021-12-15T18:26:46Z")
Hi, Yeserday, I upgraded one of our cluster from 7.13.4 to 7.16.1. When I'm going to discover pane and choose a beat index, almost all field show as 'unknown field' and the values are showing as JSON. The other clus… --- ## [Auditbeat, filebeat and journalbeat in kubernetes](https://discuss.elastic.co/t/auditbeat-filebeat-and-journalbeat-in-kubernetes/291805)
**Author:** [@Dmitriy\_Esin](https://discuss.elastic.co/u/Dmitriy_Esin)\ **Replies:** 1\ **Last updated:** [December 15, 2021, 6:24pm UTC](https://discuss.elastic.co/t/auditbeat-filebeat-and-journalbeat-in-kubernetes/291805 "2021-12-15T18:24:51Z")
Hi all! I want to get an assistant with filebeat and auditbeat deployed in the k8s cluster. Here are my yamls: Auditbeat: Filebeat: It runs successfully and has logs: Auditbeat: Fiebeat: But I can't see any d… --- ## [Elasticsearch js client version update when upgrading 6.x to 7.x for ES](https://discuss.elastic.co/t/elasticsearch-js-client-version-update-when-upgrading-6-x-to-7-x-for-es/292032)
**Author:** [@northwest](https://discuss.elastic.co/u/northwest)\ **Replies:** 0\ **Last updated:** [December 15, 2021, 6:06pm UTC](https://discuss.elastic.co/t/elasticsearch-js-client-version-update-when-upgrading-6-x-to-7-x-for-es/292032 "2021-12-15T18:06:31Z")
Planning on upgrading our ES cluster from 6.x to 7.x. With rolling update the cluster has 0 down time but I am wondering how to coordinate the js client version update since we have to use the same major version between … --- ## [Uptime and Elastic Agent ID links?](https://discuss.elastic.co/t/uptime-and-elastic-agent-id-links/288937)
**Author:** [@PublicName](https://discuss.elastic.co/u/PublicName)\ **Replies:** 4\ **Last updated:** [December 15, 2021, 5:08pm UTC](https://discuss.elastic.co/t/uptime-and-elastic-agent-id-links/288937 "2021-12-15T17:08:33Z")
Is is possible to link an existing monitor to a agent that is enrolled in fleet? When you go to Uptime then metrics explorer you get a nice overlay but clicking view in Uptime ends with the main Uptime page and not the … --- ## [Is Elasticsearch affected by CVE-2021-45046 - a second vulnerability in log4j?](https://discuss.elastic.co/t/is-elasticsearch-affected-by-cve-2021-45046-a-second-vulnerability-in-log4j/291885)
**Author:** [@smlx](https://discuss.elastic.co/u/smlx)\ **Replies:** 1\ **Last updated:** [December 15, 2021, 4:56pm UTC](https://discuss.elastic.co/t/is-elasticsearch-affected-by-cve-2021-45046-a-second-vulnerability-in-log4j/291885 "2021-12-15T16:56:32Z")
As per the title there is a newer vulnerability in log4j: CVE-2021-45046 https://logging.apache.org/log4j/2.x/security.html As the current log4j announcement doesn't specifically mention this CVE except in the context … --- ## [Multiline.pattern for my log](https://discuss.elastic.co/t/multiline-pattern-for-my-log/291973)
**Author:** [@bourak\_justbourak](https://discuss.elastic.co/u/bourak_justbourak)\ **Replies:** 0\ **Last updated:** [December 15, 2021, 12:53pm UTC](https://discuss.elastic.co/t/multiline-pattern-for-my-log/291973 "2021-12-15T12:53:45Z")
Hi please help me what multiline.pattern is good for my log? My log contains blank line in the middle. Thanks a lot. 2021-12-08 01:00:00.020 DEBUG --- \[TaskScheduler-1\] \[c.i.f.g.c.s.d.InputService :\] : … --- ## [How to filter log in kibana](https://discuss.elastic.co/t/how-to-filter-log-in-kibana/291981)
**Author:** [@Roccof97](https://discuss.elastic.co/u/Roccof97)\ **Replies:** 1\ **Last updated:** [December 15, 2021, 4:21pm UTC](https://discuss.elastic.co/t/how-to-filter-log-in-kibana/291981 "2021-12-15T16:21:32Z")
Hi everyone, my goal is to filter this string "sudo egrep -i -r '${jndi:(ldap\[s\]?|rmi|dns):/\[^\\n\]+' /var/log" in the message of my logs This is related to the log4j issue. Thanks in advance to those who help me. --- ## [Date math index name throwing error in Watcher input](https://discuss.elastic.co/t/date-math-index-name-throwing-error-in-watcher-input/290638)
**Author:** [@Munavir\_Chavody](https://discuss.elastic.co/u/Munavir_Chavody)\ **Replies:** 1\ **Last updated:** [December 15, 2021, 4:05pm UTC](https://discuss.elastic.co/t/date-math-index-name-throwing-error-in-watcher-input/290638 "2021-12-15T16:05:41Z")
I've the date math name in one of the watcher search input as below. "indices": \["\<.watcher-history-13-{now/d}\>"\] But the execution fails with below error. "result": { "execution\_time": "2021-12-01T07:57:46.049Z",… --- ## [Watcher, multiple web posts](https://discuss.elastic.co/t/watcher-multiple-web-posts/290643)
**Author:** [@runtman](https://discuss.elastic.co/u/runtman)\ **Replies:** 3\ **Last updated:** [December 15, 2021, 4:03pm UTC](https://discuss.elastic.co/t/watcher-multiple-web-posts/290643 "2021-12-15T16:03:49Z")
I've looked through the docs and can't really find an answer if this is possible. I want a watcher job to fire every 5 minutes to hit an API. First of all it must hit the API to gain an authorization token, then once i… --- ## [WebHook works with Alerting but doesnt with watcher](https://discuss.elastic.co/t/webhook-works-with-alerting-but-doesnt-with-watcher/291335)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 2\ **Last updated:** [December 15, 2021, 4:01pm UTC](https://discuss.elastic.co/t/webhook-works-with-alerting-but-doesnt-with-watcher/291335 "2021-12-15T16:01:27Z")
Hi, Im trying to send webhooks to logstash with watcher, and Im getting this error "type" : "client\_protocol\_exception", "reason" : null, "caused\_by" : { "type" : "proto… --- ## [Python Elasticsearch aggregated query](https://discuss.elastic.co/t/python-elasticsearch-aggregated-query/291998)
**Author:** [@Sederfo](https://discuss.elastic.co/u/Sederfo)\ **Replies:** 5\ **Last updated:** [December 15, 2021, 3:59pm UTC](https://discuss.elastic.co/t/python-elasticsearch-aggregated-query/291998 "2021-12-15T15:59:16Z")
I am struggling to get an aggregated response based on a query... for example, in Kibana visualization, after creating a table with the aggregations and query I need, I can view the request by going inside the visualizat… --- ## [Sharing a report from Kibana to Slack](https://discuss.elastic.co/t/sharing-a-report-from-kibana-to-slack/292013)
**Author:** [@Zarzaparro](https://discuss.elastic.co/u/Zarzaparro)\ **Replies:** 0\ **Last updated:** [December 15, 2021, 3:49pm UTC](https://discuss.elastic.co/t/sharing-a-report-from-kibana-to-slack/292013 "2021-12-15T15:49:42Z")
Good afternoon. I need to do something but I can't find how. I have an automated report in Kibana (from a Dashborad, so the report gives me a PDF). I need this report to be sent to a Slack channel on a daily basis. I c… --- ## [Create new records from old one](https://discuss.elastic.co/t/create-new-records-from-old-one/291989)
**Author:** [@ddoroshenko](https://discuss.elastic.co/u/ddoroshenko)\ **Replies:** 7\ **Last updated:** [December 15, 2021, 3:42pm UTC](https://discuss.elastic.co/t/create-new-records-from-old-one/291989 "2021-12-15T15:42:25Z")
Hello! I have JSON at input { "data:{ "id":"123" }, "message":\[ "event1", "event2", "event3" \], "source":"abc" } Is it possible to make three different events based on "event1", "event2" and "… --- ## [Metricbeat, http: server gave HTTP response to HTTPS client](https://discuss.elastic.co/t/metricbeat-http-server-gave-http-response-to-https-client/291835)
**Author:** [@sahere37](https://discuss.elastic.co/u/sahere37)\ **Replies:** 2\ **Last updated:** [December 15, 2021, 3:33pm UTC](https://discuss.elastic.co/t/metricbeat-http-server-gave-http-response-to-https-client/291835 "2021-12-15T15:33:25Z")
Hi all, I am trying to activate basic security http in my ELK stack. My Elasticsearch version is 7.16.1. I create Elasticsearch-ssl-http.zip and add related files to config folder of Elasticsearch and kibana. Also I add… --- ## [Parse XML nessus config to logstash](https://discuss.elastic.co/t/parse-xml-nessus-config-to-logstash/290887)
**Author:** [@k1mson13](https://discuss.elastic.co/u/k1mson13)\ **Replies:** 12\ **Last updated:** [December 15, 2021, 3:21pm UTC](https://discuss.elastic.co/t/parse-xml-nessus-config-to-logstash/290887 "2021-12-15T15:21:20Z")
I have a nessus file that looks like this : \\ \192.168.2.65\ \Wed Nov 10 12:48:53 2021\ \ **Author:** [@sahere37](https://discuss.elastic.co/u/sahere37)\ **Replies:** 0\ **Last updated:** [December 15, 2021, 3:18pm UTC](https://discuss.elastic.co/t/filebeat-failed-to-publish-events/292001 "2021-12-15T15:18:14Z") Hi all, I am using ELK version 7.12.1 to harvest data using filebeat and then send them logstash. I have two nodes of logstash (10.0.0.1:5044 and 10.0.0.2:5044) My filebeat output config is as following: output.logst… --- ## [Kibana issue with relative and absolute range combination](https://discuss.elastic.co/t/kibana-issue-with-relative-and-absolute-range-combination/291972)
**Author:** [@Angelos](https://discuss.elastic.co/u/Angelos)\ **Replies:** 3\ **Last updated:** [December 15, 2021, 3:14pm UTC](https://discuss.elastic.co/t/kibana-issue-with-relative-and-absolute-range-combination/291972 "2021-12-15T15:14:12Z")
Elasticsearch Platinum: 7.16.1 Hi! We recently found out that when we use relative as start date and absolute as end date it doesn't work as intended. For example when I select relative start date "14 days ago" and ab… --- ## [Create Index Lifecycle Policies to existing index](https://discuss.elastic.co/t/create-index-lifecycle-policies-to-existing-index/290983)
**Author:** [@Aviel\_Bashari](https://discuss.elastic.co/u/Aviel_Bashari)\ **Replies:** 17\ **Last updated:** [December 15, 2021, 3:08pm UTC](https://discuss.elastic.co/t/create-index-lifecycle-policies-to-existing-index/290983 "2021-12-15T15:08:17Z")
Hi, im trying to add 'Index Lifecycle Policies' to my existing index. my steps: Index management --\> choose my index --\> add lifecycle policy --\> slect logs but i got 'Policy logs is configured for rollover, but ind… --- ## [Change navLinks with kibana 7.14](https://discuss.elastic.co/t/change-navlinks-with-kibana-7-14/291951)
**Author:** [@Osysh](https://discuss.elastic.co/u/Osysh)\ **Replies:** 3\ **Last updated:** [December 15, 2021, 2:40pm UTC](https://discuss.elastic.co/t/change-navlinks-with-kibana-7-14/291951 "2021-12-15T14:40:37Z")
Hi ! Is it possible to change the home navLink througth a custom plugin in Kibana 7.14 ? The final aim is to replace it with a plugin url. It seems that the chrome.navLinks.update() method is not available for this vers… --- ## [Drop some field when we restore](https://discuss.elastic.co/t/drop-some-field-when-we-restore/291915)
**Author:** [@kannan\_raj](https://discuss.elastic.co/u/kannan_raj)\ **Replies:** 1\ **Last updated:** [December 15, 2021, 2:37pm UTC](https://discuss.elastic.co/t/drop-some-field-when-we-restore/291915 "2021-12-15T14:37:38Z")
Hi Team, Is it possible to remove some fields while restoring indices from snapshots? Ex: let's assume the doc in the index and take the snapshot { "foo": "bar", "bar": "foo" } Here would like to remove the f… --- ## [Namespaces and EKS](https://discuss.elastic.co/t/namespaces-and-eks/291904)
**Author:** [@George\_Leonard](https://discuss.elastic.co/u/George_Leonard)\ **Replies:** 3\ **Last updated:** [December 15, 2021, 2:30pm UTC](https://discuss.elastic.co/t/namespaces-and-eks/291904 "2021-12-15T14:30:20Z")
Hi all So I see EKS creates a elastic-system namespace during the CRD creations. So question, would/should we deploy our own cluster bits into elastic-system ns... when you follow the quickstart they don't mention nam… --- ## [Beats are not vulnerable to Log4j2 RCE](https://discuss.elastic.co/t/beats-are-not-vulnerable-to-log4j2-rce/291992)
**Author:** [@dave101](https://discuss.elastic.co/u/dave101)\ **Replies:** 2\ **Last updated:** [December 15, 2021, 2:27pm UTC](https://discuss.elastic.co/t/beats-are-not-vulnerable-to-log4j2-rce/291992 "2021-12-15T14:27:46Z")
Hi there, maybe some can confirm the follow for us. A few days ago we read this article concerning the log4j vulnerability. Apache Log4j2 Remote Code Execution (RCE) Vulnerability - CVE-2021-44228 - ESA-2021-31 Here it … [Previous page](https://discuss.elastic.co/latest.md?page=1343) [Next page](https://discuss.elastic.co/latest.md?page=1345)