# Latest **URL:** https://discuss.elastic.co/latest.md?page=1352 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1353 --- ## [Sequence number for ECS Events received by TCP?](https://discuss.elastic.co/t/sequence-number-for-ecs-events-received-by-tcp/291348)
**Author:** [@Matthias\_W](https://discuss.elastic.co/u/Matthias_W)\ **Replies:** 4\ **Last updated:** [December 10, 2021, 2:27pm UTC](https://discuss.elastic.co/t/sequence-number-for-ecs-events-received-by-tcp/291348 "2021-12-10T14:27:58Z")
Hi, I have configured my application server (JBoss) to format log messages using the ECS formatter and directly send them to Filebeat via TCP. This works mostly fine - however, there is one issue: Log entries having th… --- ## [Error while sniffing nodes](https://discuss.elastic.co/t/error-while-sniffing-nodes/291186)
**Author:** [@Hayk\_Hovhanisyan](https://discuss.elastic.co/u/Hayk_Hovhanisyan)\ **Replies:** 2\ **Last updated:** [December 10, 2021, 2:04pm UTC](https://discuss.elastic.co/t/error-while-sniffing-nodes/291186 "2021-12-10T14:04:00Z")
Environment: JDK 1.8.0\_301 Grails 5.0.2 Spring Boot 2.5.7 Groovy 3.0.7 Elasticsearch 7.10.2 (also tried 7.12.1) Situation: Hi dear colleagues, could you please clarify the error while sniffing nodes. Task: Running … --- ## [Doubts about how exclude events by the process name with filebeat](https://discuss.elastic.co/t/doubts-about-how-exclude-events-by-the-process-name-with-filebeat/290988)
**Author:** [@rdinis](https://discuss.elastic.co/u/rdinis)\ **Replies:** 2\ **Last updated:** [December 10, 2021, 2:00pm UTC](https://discuss.elastic.co/t/doubts-about-how-exclude-events-by-the-process-name-with-filebeat/290988 "2021-12-10T14:00:22Z")
Hi, I'm trying to send logs to elastic from the file /var/logs/messages\* and i have a lot of logs from another agents of elastic. The file messages\* looks like this: Dec 1 16:50:03 machine\_name heartbeat: "status": "u… --- ## [Using a bucket key for filtering in the according aggregation](https://discuss.elastic.co/t/using-a-bucket-key-for-filtering-in-the-according-aggregation/291423)
**Author:** [@Marc\_Zahn](https://discuss.elastic.co/u/Marc_Zahn)\ **Replies:** 0\ **Last updated:** [December 10, 2021, 12:27pm UTC](https://discuss.elastic.co/t/using-a-bucket-key-for-filtering-in-the-according-aggregation/291423 "2021-12-10T12:27:10Z")
Hello, maybe I searched for the wrong things, but I have a problem and don't know if it is possible to solve it: I have a terms aggregation where I need to filter the documents by matching the bucket keys against an inp… --- ## [Prune filter - Whitelist JSON subfields & per-pipeline log file](https://discuss.elastic.co/t/prune-filter-whitelist-json-subfields-per-pipeline-log-file/291298)
**Author:** [@stillfreem](https://discuss.elastic.co/u/stillfreem)\ **Replies:** 2\ **Last updated:** [December 10, 2021, 11:49am UTC](https://discuss.elastic.co/t/prune-filter-whitelist-json-subfields-per-pipeline-log-file/291298 "2021-12-10T11:49:06Z")
Hi All, I've got a couple of questions! Can I whitelist only certain field from JSON using Prune? I saw similar topics suggesting ruby but wanted to avoid this as its a bit too complicated for me. For instance I'd li… --- ## [Not able to save Visualize or Query](https://discuss.elastic.co/t/not-able-to-save-visualize-or-query/291358)
**Author:** [@Luiz](https://discuss.elastic.co/u/Luiz)\ **Replies:** 2\ **Last updated:** [December 10, 2021, 10:52am UTC](https://discuss.elastic.co/t/not-able-to-save-visualize-or-query/291358 "2021-12-10T10:52:09Z")
Hi all, I am not able to save new query or visualize in Kibana, I am getting message "An error occurred while saving. Error: Forbidden" I am using version 7.11.0. I have search about the error here and other forums all… --- ## [OutOfMemoryError after PDTrueTypeFont Using fallback font warnings](https://discuss.elastic.co/t/outofmemoryerror-after-pdtruetypefont-using-fallback-font-warnings/290322)
**Author:** [@Cordobel](https://discuss.elastic.co/u/Cordobel)\ **Replies:** 7\ **Last updated:** [December 10, 2021, 10:04am UTC](https://discuss.elastic.co/t/outofmemoryerror-after-pdtruetypefont-using-fallback-font-warnings/290322 "2021-12-10T10:04:34Z")
I noticed twice that Elasticsearch crashed after some warnings about PDTrueTypeFont Using fallback font. After these warnings, the garbage collector starts to alert about the overload. Then a fatal error - lambda $MaybeD… --- ## [Best way to enrich by IP subnets](https://discuss.elastic.co/t/best-way-to-enrich-by-ip-subnets/232771)
**Author:** [@nemhods](https://discuss.elastic.co/u/nemhods)\ **Replies:** 3\ **Last updated:** [December 10, 2021, 9:34am UTC](https://discuss.elastic.co/t/best-way-to-enrich-by-ip-subnets/232771 "2021-12-10T09:34:40Z")
I want to enrich incoming ECS-compatible documents with a tag if they come from VPN IPs. From my testing, the enrich processor cannot deal with IP-ranges. However, i want to use IP-ranges and not manually (or by a scrip… --- ## [Bulksearch with multiple terms and multiple values](https://discuss.elastic.co/t/bulksearch-with-multiple-terms-and-multiple-values/291407)
**Author:** [@GopiSumanth](https://discuss.elastic.co/u/GopiSumanth)\ **Replies:** 0\ **Last updated:** [December 10, 2021, 9:33am UTC](https://discuss.elastic.co/t/bulksearch-with-multiple-terms-and-multiple-values/291407 "2021-12-10T09:33:22Z")
Hi, Currently, we are using the below JSON for search in the repository index. Here we are using one term with multiple values(list of values). Can we change the JSON to search using multiple terms by passing multiple v… --- ## [Kibana rule auditlogs overwhelm audit logs](https://discuss.elastic.co/t/kibana-rule-auditlogs-overwhelm-audit-logs/291301)
**Author:** [@can.ozdemir](https://discuss.elastic.co/u/can.ozdemir)\ **Replies:** 2\ **Last updated:** [December 10, 2021, 8:26am UTC](https://discuss.elastic.co/t/kibana-rule-auditlogs-overwhelm-audit-logs/291301 "2021-12-10T08:26:49Z")
Hello There, We are trying to single out user actions, which contains update create or delete actions under audit\_logs. Our unix administration trying to catch these logs and produce mail alerts, but since we have rules… --- ## [How could I compare these two time values using painless script?](https://discuss.elastic.co/t/how-could-i-compare-these-two-time-values-using-painless-script/291034)
**Author:** [@Peilin](https://discuss.elastic.co/u/Peilin)\ **Replies:** 6\ **Last updated:** [December 10, 2021, 8:25am UTC](https://discuss.elastic.co/t/how-could-i-compare-these-two-time-values-using-painless-script/291034 "2021-12-10T08:25:59Z")
I am using ES to analysis medical data. how can i using painless script compare these two time values(beginDateTime, endDateTime).deep values. if it's not deep value, i found a solution like this { "query": { … --- ## [Dec 10th, 2021: \[en\] 5 Useful Tips to Get the Most Out of Fleet](https://discuss.elastic.co/t/dec-10th-2021-en-5-useful-tips-to-get-the-most-out-of-fleet/290491)
**Author:** [@Mark\_Hopkin](https://discuss.elastic.co/u/Mark_Hopkin)\ **Replies:** 0\ **Last updated:** [December 10, 2021, 8:00am UTC](https://discuss.elastic.co/t/dec-10th-2021-en-5-useful-tips-to-get-the-most-out-of-fleet/290491 "2021-12-10T08:00:17Z")
As Fleet became generally available earlier in the year, the Fleet development team and I wanted to share a few tips and tricks for getting the most out of using the Fleet app in Kibana. If you aren't familiar with Flee… --- ## [Не работает multiline в Filebeat с filebeat.inputs: - type: filestream](https://discuss.elastic.co/t/multiline-filebeat-filebeat-inputs-type-filestream/290396)
**Author:** [@cva](https://discuss.elastic.co/u/cva)\ **Replies:** 1\ **Last updated:** [December 10, 2021, 7:56am UTC](https://discuss.elastic.co/t/multiline-filebeat-filebeat-inputs-type-filestream/290396 "2021-12-10T07:56:21Z")
Добрый день! Я столкнулся с проблемой многострочной обработки в Filebeat, когда в параметрах filebeat.inputs: указано type: filestream - журналы файлового потока не анализируются в соответствии с требованиями multiline.… --- ## [Работа filebeat завершилась ошибкой: ERROR \[logstash\] logstash/async.go:280](https://discuss.elastic.co/t/filebeat-error-logstash-logstash-async-go-280/291395)
**Author:** [@cva](https://discuss.elastic.co/u/cva)\ **Replies:** 0\ **Last updated:** [December 10, 2021, 7:34am UTC](https://discuss.elastic.co/t/filebeat-error-logstash-logstash-async-go-280/291395 "2021-12-10T07:34:09Z")
Failbeat перестал отдавать данные в logstash, в лога failbeat вижу ошибку: ERROR \[logstash\] logstash/async.go:280 Failed to publish events caused by: write tcp 10.0.10.5:53536-\>10.0.10.6:5044: wsasend: An existing conne… --- ## [Security Rules CPU load not balanced across hosts](https://discuss.elastic.co/t/security-rules-cpu-load-not-balanced-across-hosts/291393)
**Author:** [@heikis](https://discuss.elastic.co/u/heikis)\ **Replies:** 0\ **Last updated:** [December 10, 2021, 7:16am UTC](https://discuss.elastic.co/t/security-rules-cpu-load-not-balanced-across-hosts/291393 "2021-12-10T07:16:46Z")
Hello. I have an ES cluster consisting of 3 hosts and each host is running 8 datanodes + 1 master node, a total of 27 nodes (running as docker containers) plus one separate active master node as a VM in a separate networ… --- ## [Read containers log files using fleet](https://discuss.elastic.co/t/read-containers-log-files-using-fleet/288067)
**Author:** [@vovan13111](https://discuss.elastic.co/u/vovan13111)\ **Replies:** 3\ **Last updated:** [December 10, 2021, 4:50am UTC](https://discuss.elastic.co/t/read-containers-log-files-using-fleet/288067 "2021-12-10T04:50:46Z")
Good afternoon. When studying Fleet and apm agents, the question arose, is it possible to somehow collect logs from docker containers, as done in filebeat, or is there no such possibility yet? --- ## [Elastic search storage exception](https://discuss.elastic.co/t/elastic-search-storage-exception/290642)
**Author:** [@mehmood1](https://discuss.elastic.co/u/mehmood1)\ **Replies:** 8\ **Last updated:** [December 10, 2021, 4:03am UTC](https://discuss.elastic.co/t/elastic-search-storage-exception/290642 "2021-12-10T04:03:25Z")
Elasticsearch run in read only mode due to storage. i dont want to extend storage this time because it is only for testing purpose. below is Elasticsearch yml file # ======================== Elasticsearch Configuratio… --- ## [No audit log file in /usr/share/elasticsearch/logs directory when I opend the audit log configuration](https://discuss.elastic.co/t/no-audit-log-file-in-usr-share-elasticsearch-logs-directory-when-i-opend-the-audit-log-configuration/291387)
**Author:** [@Hello-Linux](https://discuss.elastic.co/u/Hello-Linux)\ **Replies:** 0\ **Last updated:** [December 10, 2021, 3:43am UTC](https://discuss.elastic.co/t/no-audit-log-file-in-usr-share-elasticsearch-logs-directory-when-i-opend-the-audit-log-configuration/291387 "2021-12-10T03:43:38Z")
I have set the config xpack.security.audit.enabled: true,and restart Elasticsearch,but in the logs file I can't find the json file what name is \_audit.json,why? look at No audit log file in /usr/share/elasticsearch/logs … --- ## [Panw module - Another incorrect timestamp issue](https://discuss.elastic.co/t/panw-module-another-incorrect-timestamp-issue/290099)
**Author:** [@ddaloia](https://discuss.elastic.co/u/ddaloia)\ **Replies:** 2\ **Last updated:** [December 10, 2021, 2:33am UTC](https://discuss.elastic.co/t/panw-module-another-incorrect-timestamp-issue/290099 "2021-12-10T02:33:00Z")
Hi friends. I am really struggling on this one. I can not figure out why all my ingested logs are showing up at the wrong time. It appears that all my firewall logs for each day are being grouped into a 3 hour window for… --- ## [Nothing under Security will load all of a sudden](https://discuss.elastic.co/t/nothing-under-security-will-load-all-of-a-sudden/287948)
**Author:** [@plaroche0](https://discuss.elastic.co/u/plaroche0)\ **Replies:** 10\ **Last updated:** [December 10, 2021, 12:50am UTC](https://discuss.elastic.co/t/nothing-under-security-will-load-all-of-a-sudden/287948 "2021-12-10T00:50:02Z")
All of a sudden nothing will load under the Security section of our Elastic instance. Everything else works fine. If I try to use anything under Security I just get the elastic logo. I have no idea where to begin troub… --- ## [Detection tab is not loading](https://discuss.elastic.co/t/detection-tab-is-not-loading/289440)
**Author:** [@aditi\_salunke](https://discuss.elastic.co/u/aditi_salunke)\ **Replies:** 1\ **Last updated:** [November 19, 2021, 1:09pm UTC](https://discuss.elastic.co/t/detection-tab-is-not-loading/289440 "2021-11-19T13:09:46Z")
Hello, I am utilizing detection feature on kibana 7.13.2 But many times detection tab is blank. After restarting kibana service , i am able to view detection tab. how should i solve this issue ? It is happening fre… --- ## [Is any API to get request string of Kibana?](https://discuss.elastic.co/t/is-any-api-to-get-request-string-of-kibana/291281)
**Author:** [@Frank\_Kuo](https://discuss.elastic.co/u/Frank_Kuo)\ **Replies:** 2\ **Last updated:** [December 10, 2021, 12:44am UTC](https://discuss.elastic.co/t/is-any-api-to-get-request-string-of-kibana/291281 "2021-12-10T00:44:22Z")
Hello, I have many search objects at Kibana. Is any API to get request string? just set up server info/ object name, and output is request string. Is any API there? (to get discover-\>inspect-\>request string) --- ## [Make/deploy fail](https://discuss.elastic.co/t/make-deploy-fail/291372)
**Author:** [@Steph\_van\_Schalkwyk](https://discuss.elastic.co/u/Steph_van_Schalkwyk)\ **Replies:** 0\ **Last updated:** [December 9, 2021, 11:26pm UTC](https://discuss.elastic.co/t/make-deploy-fail/291372 "2021-12-09T23:26:31Z")
/dev-tools/deploy and $make clean fail with: make\[1\]: Leaving directory '/home/steph/go/src/github.com/elastic/beats/x-pack/packetbeat' make\[1\]: Entering directory '/home/steph/go/src/github.com/elastic/beats/x-pack/l… --- ## [APM missing SQL Span (NestJS/Typeorm/SQL Server)](https://discuss.elastic.co/t/apm-missing-sql-span-nestjs-typeorm-sql-server/291221)
**Author:** [@Tam2](https://discuss.elastic.co/u/Tam2)\ **Replies:** 5\ **Last updated:** [December 9, 2021, 11:58pm UTC](https://discuss.elastic.co/t/apm-missing-sql-span-nestjs-typeorm-sql-server/291221 "2021-12-09T23:58:16Z")
I've got a NestJS monorepo and i'm loading in the elastic-apm-node at the top of the main.ts file: require('elastic-apm-node').start({ // Override the service name from package.json // Allowed characters: a-z, A-Z, … --- ## [Case insensitive term query (case\_insensitive) performance penalty?](https://discuss.elastic.co/t/case-insensitive-term-query-case-insensitive-performance-penalty/291371)
**Author:** [@roytmana](https://discuss.elastic.co/u/roytmana)\ **Replies:** 0\ **Last updated:** [December 9, 2021, 11:20pm UTC](https://discuss.elastic.co/t/case-insensitive-term-query-case-insensitive-performance-penalty/291371 "2021-12-09T23:20:28Z")
Hello, Is there any significant performance penalty for using case\_insensitive: true in term queries? If I use keyword mapping with lowercase normalizer, highlighter would emit lowercased results which I would like to … --- ## [Duplicate events ingested by m365\_defender module](https://discuss.elastic.co/t/duplicate-events-ingested-by-m365-defender-module/290901)
**Author:** [@Foxboron](https://discuss.elastic.co/u/Foxboron)\ **Replies:** 1\ **Last updated:** [December 9, 2021, 11:19pm UTC](https://discuss.elastic.co/t/duplicate-events-ingested-by-m365-defender-module/290901 "2021-12-09T23:19:13Z")
It seems like m365\_defender creates duplicate events. This seems to be because of non-stable ordering of the document fields. In our data it seems like fields inside the alert object changes their order and some of the f… --- ## [Kibana.alert.reason in actions](https://discuss.elastic.co/t/kibana-alert-reason-in-actions/290081)
**Author:** [@probson](https://discuss.elastic.co/u/probson)\ **Replies:** 1\ **Last updated:** [December 9, 2021, 11:10pm UTC](https://discuss.elastic.co/t/kibana-alert-reason-in-actions/290081 "2021-12-09T23:10:50Z")
Is it possible to use kibana.alert.reason within the actions. I have tried {{#context.alerts}}{{kibana.alert.reason}}{{/context.alerts}} --- ## [Logstash not creating new index](https://discuss.elastic.co/t/logstash-not-creating-new-index/291265)
**Author:** [@will.nickisch](https://discuss.elastic.co/u/will.nickisch)\ **Replies:** 7\ **Last updated:** [December 9, 2021, 10:28pm UTC](https://discuss.elastic.co/t/logstash-not-creating-new-index/291265 "2021-12-09T22:28:02Z")
I am having an issue with multiple tcp inputs and logstash not pulling in messages from the second tcp input. The data received on port 6050 is going into the default index logstash-%{+YYYY.MM.dd} but the data sent from… --- ## [High system CPU usage with Elasticsearch on Kubernetes (using ECK) using ES v7.10.0+ (but not in v7.6.1)](https://discuss.elastic.co/t/high-system-cpu-usage-with-elasticsearch-on-kubernetes-using-eck-using-es-v7-10-0-but-not-in-v7-6-1/290904)
**Author:** [@YannV](https://discuss.elastic.co/u/YannV)\ **Replies:** 5\ **Last updated:** [December 9, 2021, 10:20pm UTC](https://discuss.elastic.co/t/high-system-cpu-usage-with-elasticsearch-on-kubernetes-using-eck-using-es-v7-10-0-but-not-in-v7-6-1/290904 "2021-12-09T22:20:19Z")
Elasticsearch version: 7.10.0 & 7.14.2 (but not reproduced in ES v7.6.1) Plugins installed: None JVM version: Bundled in official Elasticsearch docker image OS version: Reproduced on CentOS 7.9 with kernel 3.10.0 and … --- ## [Replace string in elastic](https://discuss.elastic.co/t/replace-string-in-elastic/291320)
**Author:** [@idoweiss1](https://discuss.elastic.co/u/idoweiss1)\ **Replies:** 1\ **Last updated:** [December 9, 2021, 9:52pm UTC](https://discuss.elastic.co/t/replace-string-in-elastic/291320 "2021-12-09T21:52:07Z")
Hi , I have a string from the kibana and need to change the output : from "mdc.correlationId" to "correlation-id" [Previous page](https://discuss.elastic.co/latest.md?page=1351) [Next page](https://discuss.elastic.co/latest.md?page=1353)