# Latest **URL:** https://discuss.elastic.co/latest.md?page=1353 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1354 --- ## [Replace string in elastic](https://discuss.elastic.co/t/replace-string-in-elastic/291320)
**Author:** [@idoweiss1](https://discuss.elastic.co/u/idoweiss1)\ **Replies:** 1\ **Last updated:** [December 9, 2021, 9:52pm UTC](https://discuss.elastic.co/t/replace-string-in-elastic/291320 "2021-12-09T21:52:07Z")
Hi , I have a string from the kibana and need to change the output : from "mdc.correlationId" to "correlation-id" --- ## [Can´t start Fleet server](https://discuss.elastic.co/t/can-t-start-fleet-server/291352)
**Author:** [@almedor](https://discuss.elastic.co/u/almedor)\ **Replies:** 0\ **Last updated:** [December 9, 2021, 4:51pm UTC](https://discuss.elastic.co/t/can-t-start-fleet-server/291352 "2021-12-09T16:51:50Z")
Hi, I´ve just deployed an ELK develop environment (windows msi) but i can´t (i don´t know) how to deploy the fleet server. I´ve followed these steps: but i always received the same error: What am i missing or doing wr… --- ## [Logstash arbitrarily hangs with SIGINT. Happens roughly every few days](https://discuss.elastic.co/t/logstash-arbitrarily-hangs-with-sigint-happens-roughly-every-few-days/291258)
**Author:** [@jtocher](https://discuss.elastic.co/u/jtocher)\ **Replies:** 1\ **Last updated:** [December 9, 2021, 8:51pm UTC](https://discuss.elastic.co/t/logstash-arbitrarily-hangs-with-sigint-happens-roughly-every-few-days/291258 "2021-12-09T20:51:43Z")
We have a Logstash server as part of our Elastic Stack on Windows. About once a week, logs stop ingesting and the culprit is always Logstash. Restarting the service on that VM fixes the issue, but I'd like to find the pr… --- ## [ES not found documents](https://discuss.elastic.co/t/es-not-found-documents/291227)
**Author:** [@xunterix](https://discuss.elastic.co/u/xunterix)\ **Replies:** 6\ **Last updated:** [December 9, 2021, 7:39pm UTC](https://discuss.elastic.co/t/es-not-found-documents/291227 "2021-12-09T19:39:47Z")
Hi, after resetting the index and re-indexing, the search stopped finding any documents. In the logs I see all shards failed. What could be the problem? { "cluster\_name" : "elasticsearch", "status" : "yellow", "ti… --- ## [Get status snapshot does not work for snapshots that are not currently running](https://discuss.elastic.co/t/get-status-snapshot-does-not-work-for-snapshots-that-are-not-currently-running/291271)
**Author:** [@Hannah\_Chung](https://discuss.elastic.co/u/Hannah_Chung)\ **Replies:** 0\ **Last updated:** [December 8, 2021, 11:57pm UTC](https://discuss.elastic.co/t/get-status-snapshot-does-not-work-for-snapshots-that-are-not-currently-running/291271 "2021-12-08T23:57:01Z")
Based on the documentation for Get snapshot status here, I expect to see the state of my snapshot even if it is not currently running. I confirmed I am making the call GET /\_snapshot/\/\/\_sta… --- ## [Multi-line Filebeat templates don't work with filebeat.inputs - type: filestream](https://discuss.elastic.co/t/multi-line-filebeat-templates-dont-work-with-filebeat-inputs-type-filestream/274510)
**Author:** [@cva](https://discuss.elastic.co/u/cva)\ **Replies:** 1\ **Last updated:** [December 9, 2021, 6:06pm UTC](https://discuss.elastic.co/t/multi-line-filebeat-templates-dont-work-with-filebeat-inputs-type-filestream/274510 "2021-12-09T18:06:07Z")
I ran into a multiline processing problem in Filebeat when the filebeat.inputs: parameters specify type: filestream - the logs of the file stream are not analyzed according to the requirements of multiline. pattern: '^\[\[… --- ## [APM Java Agent Security Update](https://discuss.elastic.co/t/apm-java-agent-security-update/291355)
**Author:** [@douglasday](https://discuss.elastic.co/u/douglasday)\ **Replies:** 0\ **Last updated:** [December 9, 2021, 5:25pm UTC](https://discuss.elastic.co/t/apm-java-agent-security-update/291355 "2021-12-09T17:25:33Z")
APM Java Agent Local Privilege Escalation issue (ESA-2021-30) A local privilege escalation issue was found with the APM Java agent, where a user on the system could attach a malicious plugin to an application running th… --- ## [Can you search for a specific slide in powerpoint deck?](https://discuss.elastic.co/t/can-you-search-for-a-specific-slide-in-powerpoint-deck/291354)
**Author:** [@dwollerman](https://discuss.elastic.co/u/dwollerman)\ **Replies:** 1\ **Last updated:** [December 9, 2021, 5:24pm UTC](https://discuss.elastic.co/t/can-you-search-for-a-specific-slide-in-powerpoint-deck/291354 "2021-12-09T17:24:36Z")
scenario is if there are multiple powerpoints in my environment and i want to identify a specific slide in a deck i can programmatically export and import into my current deck. Issue is indexers grab all the content fro… --- ## [High CPU utilization on master node](https://discuss.elastic.co/t/high-cpu-utilization-on-master-node/290096)
**Author:** [@guptaparv-rlr](https://discuss.elastic.co/u/guptaparv-rlr)\ **Replies:** 26\ **Last updated:** [December 9, 2021, 5:01pm UTC](https://discuss.elastic.co/t/high-cpu-utilization-on-master-node/290096 "2021-12-09T17:01:58Z")
I'm operating a Elasticsearch cluster using ECK Operator. Recently, we have observed high CPU utilization on master nodes. Here is the topology of the cluster: 3 master nodes 3 data nodes On running the nodes hot thr… --- ## [Pie chart labels canvas](https://discuss.elastic.co/t/pie-chart-labels-canvas/291351)
**Author:** [@MTV](https://discuss.elastic.co/u/MTV)\ **Replies:** 0\ **Last updated:** [December 9, 2021, 4:48pm UTC](https://discuss.elastic.co/t/pie-chart-labels-canvas/291351 "2021-12-09T16:48:39Z")
Hi, I have a pie chart in canvas that I would like to only show the percentage in the pie, and next to it the legend. I tried to clink in inspect to try some CSS but with no avail, because I just don't know what I'm doi… --- ## [Unable to perform a Regex Search for Asterisk](https://discuss.elastic.co/t/unable-to-perform-a-regex-search-for-asterisk/291036)
**Author:** [@GreenBlueSkys](https://discuss.elastic.co/u/GreenBlueSkys)\ **Replies:** 1\ **Last updated:** [December 9, 2021, 4:44pm UTC](https://discuss.elastic.co/t/unable-to-perform-a-regex-search-for-asterisk/291036 "2021-12-09T16:44:18Z")
\[Edit: Elastic parsed out the Asterisk, the proper log is now visible\] I am trying to perform a search against an AWS CloudTrail log identifying different instances of the asterisk (or escaped wildcard). To do this I a… --- ## [Logstash Can't read the elasticsearch username and password from Keystore!](https://discuss.elastic.co/t/logstash-cant-read-the-elasticsearch-username-and-password-from-keystore/291350)
**Author:** [@Maryam2021](https://discuss.elastic.co/u/Maryam2021)\ **Replies:** 0\ **Last updated:** [December 9, 2021, 4:39pm UTC](https://discuss.elastic.co/t/logstash-cant-read-the-elasticsearch-username-and-password-from-keystore/291350 "2021-12-09T16:39:32Z")
Hello All, I'm trying to build ELK stack on EC2 instances. I have built the ES cluster, Kibana and Logstash. The cluster and Kibana are happy and talking to each other fine but can't figure out the keystore issue with L… --- ## [Error activating rule (api key name is required)](https://discuss.elastic.co/t/error-activating-rule-api-key-name-is-required/291237)
**Author:** [@volundr](https://discuss.elastic.co/u/volundr)\ **Replies:** 8\ **Last updated:** [December 9, 2021, 4:22pm UTC](https://discuss.elastic.co/t/error-activating-rule-api-key-name-is-required/291237 "2021-12-09T16:22:56Z")
Hi, after following the official tutorial for enabling detection rules (Detections (beta) | SIEM Guide \[7.8\] | Elastic), I get the following error: \* \*\[action\_request\_validation\_exception\] Validation Failed: 1: api key … --- ## [Filebeat keystore for basic security](https://discuss.elastic.co/t/filebeat-keystore-for-basic-security/291257)
**Author:** [@bbangerter](https://discuss.elastic.co/u/bbangerter)\ **Replies:** 2\ **Last updated:** [December 9, 2021, 4:13pm UTC](https://discuss.elastic.co/t/filebeat-keystore-for-basic-security/291257 "2021-12-09T16:13:44Z")
I am running Elasticsearch 7.15.2 on CentOS 8 and have it successfully taking in logs from filebeat with a clear password in the yml file. I'm trying to get it running with a keystore, but am running into issues. My ou… --- ## [Parse Substring to JSON](https://discuss.elastic.co/t/parse-substring-to-json/291333)
**Author:** [@hami2608](https://discuss.elastic.co/u/hami2608)\ **Replies:** 1\ **Last updated:** [December 9, 2021, 4:09pm UTC](https://discuss.elastic.co/t/parse-substring-to-json/291333 "2021-12-09T16:09:05Z")
Hi, i have a Droptailer Pod in my Kubernetes Cluster with the following log example: 2021-12-09 13:46:32 +0000 UTC {"DPT":"161","DST":"XXX.XXX.XXX.XXX","ID":"54321","IN":"vrf104009","LEN":"48","MAC":"XX:XX:XX:XX:XX:XX… --- ## [Conditional indexing in metricbeat using Ingest node pipeline creates a datastream](https://discuss.elastic.co/t/conditional-indexing-in-metricbeat-using-ingest-node-pipeline-creates-a-datastream/291344)
**Author:** [@sidharth\_vijayakumar](https://discuss.elastic.co/u/sidharth_vijayakumar)\ **Replies:** 0\ **Last updated:** [December 9, 2021, 4:08pm UTC](https://discuss.elastic.co/t/conditional-indexing-in-metricbeat-using-ingest-node-pipeline-creates-a-datastream/291344 "2021-12-09T16:08:21Z")
I am trying to achieve conditional indexing for namespaces in elastic using ingest node pipelines. I used the below pipeline but the index getting created when I add the pipeline in metricbeat.yml is in form of datastrea… --- ## [ML job behavior changed](https://discuss.elastic.co/t/ml-job-behavior-changed/291109)
**Author:** [@dao](https://discuss.elastic.co/u/dao)\ **Replies:** 1\ **Last updated:** [December 9, 2021, 3:47pm UTC](https://discuss.elastic.co/t/ml-job-behavior-changed/291109 "2021-12-09T15:47:00Z")
Hello, J'ai un job de ML qui tourne depuis qq années, et je vois un changement (bug)? Explications: Voici ce que j'ai Il semble bien que le ML tourne, et qu'il détecte des anomalies. Par contre, quand je passe en … --- ## [Painless in Script Ingest Pipeline : Get fields name](https://discuss.elastic.co/t/painless-in-script-ingest-pipeline-get-fields-name/291341)
**Author:** [@GinkoLucas](https://discuss.elastic.co/u/GinkoLucas)\ **Replies:** 0\ **Last updated:** [December 9, 2021, 3:44pm UTC](https://discuss.elastic.co/t/painless-in-script-ingest-pipeline-get-fields-name/291341 "2021-12-09T15:44:29Z")
Hi, I need to know the names of the fields entering the pipeline. Because I would like to place in a different index the documents with an extra field, or an unknown field. Is there a solution with script processor ? --- ## [ML job behavior changed](https://discuss.elastic.co/t/ml-job-behavior-changed/291230)
**Author:** [@dao](https://discuss.elastic.co/u/dao)\ **Replies:** 6\ **Last updated:** [December 9, 2021, 3:30pm UTC](https://discuss.elastic.co/t/ml-job-behavior-changed/291230 "2021-12-09T15:30:46Z")
Hello, I have a ML jon that is started for a long time, but since a few monthes, there is a change (is it a bug?) Explanations: Here is what I have As you can see, It seems that the ML runs OK and detects some ano… --- ## [I want to set up the initial password without any environment variables after "xpack.security.enabled: true"](https://discuss.elastic.co/t/i-want-to-set-up-the-initial-password-without-any-environment-variables-after-xpack-security-enabled-true/291209)
**Author:** [@tadashi.oya](https://discuss.elastic.co/u/tadashi.oya)\ **Replies:** 1\ **Last updated:** [December 9, 2021, 3:02pm UTC](https://discuss.elastic.co/t/i-want-to-set-up-the-initial-password-without-any-environment-variables-after-xpack-security-enabled-true/291209 "2021-12-09T15:02:00Z")
Hi there. I'm trying to use T-Pot with "xpack.security.enabled: true". I want to set up passwords for Elasticsearch's built-in users (elastic, kibana\_system, and so on) as following conditions. Use as few interactive… --- ## [Metric data from csv](https://discuss.elastic.co/t/metric-data-from-csv/291314)
**Author:** [@sirReeall](https://discuss.elastic.co/u/sirReeall)\ **Replies:** 1\ **Last updated:** [December 9, 2021, 2:52pm UTC](https://discuss.elastic.co/t/metric-data-from-csv/291314 "2021-12-09T14:52:11Z")
Hello, I'm trying to import metrics data from a CSV file. Currently I'm using a csv filter like: filter { csv { autodetect\_column\_names =\> true } date { match =\> \["\[t\]","UNIX"\] } mutat… --- ## [Kibana not successfully filtering in Discover](https://discuss.elastic.co/t/kibana-not-successfully-filtering-in-discover/290918)
**Author:** [@agentw](https://discuss.elastic.co/u/agentw)\ **Replies:** 1\ **Last updated:** [December 9, 2021, 2:51pm UTC](https://discuss.elastic.co/t/kibana-not-successfully-filtering-in-discover/290918 "2021-12-09T14:51:44Z")
I recently updated our Elastic instances to 7.15.2. I am seeing mixed results when applying filters in Discover. For example, when filtering out a host on the agent.hostname field (i.e. 'NOT agent.hostname: example\_host)… --- ## [SSO and Subscription](https://discuss.elastic.co/t/sso-and-subscription/291275)
**Author:** [@suren\_es](https://discuss.elastic.co/u/suren_es)\ **Replies:** 7\ **Last updated:** [December 9, 2021, 2:13pm UTC](https://discuss.elastic.co/t/sso-and-subscription/291275 "2021-12-09T14:13:36Z")
I did download ELK stack tarballs, installed, configured. All is working fine. But when I started enabling SSO (via parameter xpack.security.authc.realms.oidc.oidc1 in config file), it says that this is not possible wit… --- ## [Kibana Logs Stream as Dashboard Visualization are not streaming live](https://discuss.elastic.co/t/kibana-logs-stream-as-dashboard-visualization-are-not-streaming-live/290758)
**Author:** [@kshepitzki1](https://discuss.elastic.co/u/kshepitzki1)\ **Replies:** 5\ **Last updated:** [December 9, 2021, 2:36pm UTC](https://discuss.elastic.co/t/kibana-logs-stream-as-dashboard-visualization-are-not-streaming-live/290758 "2021-12-09T14:36:39Z")
When I save a Kibana Live Log Stream as a visualization in the Visualization Library and then import it into a Dashboard, the Live Streaming feature is gone and I have to manually refresh it. I need it in a dashboard so… --- ## [Is there a reason you cannot use \[runtime\_mappings\] in a \_count request?](https://discuss.elastic.co/t/is-there-a-reason-you-cannot-use-runtime-mappings-in-a-count-request/291334)
**Author:** [@sz\_bb](https://discuss.elastic.co/u/sz_bb)\ **Replies:** 0\ **Last updated:** [December 9, 2021, 1:54pm UTC](https://discuss.elastic.co/t/is-there-a-reason-you-cannot-use-runtime-mappings-in-a-count-request/291334 "2021-12-09T13:54:55Z")
I'd like to take advantage of \[runtime\_mappings\] in a search request, specifically leveraging that runtime\_field as a filter. In that scenario, while I may only have a size of 50 to return the top 50 docs, I also request… --- ## [Flood-stage watermark?](https://discuss.elastic.co/t/flood-stage-watermark/291217)
**Author:** [@maltewhiite](https://discuss.elastic.co/u/maltewhiite)\ **Replies:** 3\ **Last updated:** [December 9, 2021, 1:50pm UTC](https://discuss.elastic.co/t/flood-stage-watermark/291217 "2021-12-09T13:50:19Z")
Hello. English isn't my first language. How do I troubleshoot this error-message? What does it mean? What is the solution? We never got this error when we used the old daily indices. Now we get them after transitionin… --- ## [ECE availability zone for tiebreaker only](https://discuss.elastic.co/t/ece-availability-zone-for-tiebreaker-only/291332)
**Author:** [@Zerobot](https://discuss.elastic.co/u/Zerobot)\ **Replies:** 0\ **Last updated:** [December 9, 2021, 1:21pm UTC](https://discuss.elastic.co/t/ece-availability-zone-for-tiebreaker-only/291332 "2021-12-09T13:21:04Z")
Hello! Due to upcoming changes in my company's DC structure we will have 2 separate "big" sites, and 1 "smaller" site, mainly for all the quorum things. It would be easiest for us to delegate quorum / tiebreaker nodes t… --- ## [Apply ingest node pipeline to an index/data stream](https://discuss.elastic.co/t/apply-ingest-node-pipeline-to-an-index-data-stream/291328)
**Author:** [@girija](https://discuss.elastic.co/u/girija)\ **Replies:** 1\ **Last updated:** [December 9, 2021, 1:07pm UTC](https://discuss.elastic.co/t/apply-ingest-node-pipeline-to-an-index-data-stream/291328 "2021-12-09T13:07:40Z")
Hello, I have created a ingest node pipeline to transform data received via elastic. Now I need to apply this pipeline to my index so that I can see the transformed fields under discover, and also create charts usin… --- ## [Nested mapping or comparing fields from different indices \[SQL\]](https://discuss.elastic.co/t/nested-mapping-or-comparing-fields-from-different-indices-sql/291327)
**Author:** [@Katgust](https://discuss.elastic.co/u/Katgust)\ **Replies:** 0\ **Last updated:** [December 9, 2021, 12:44pm UTC](https://discuss.elastic.co/t/nested-mapping-or-comparing-fields-from-different-indices-sql/291327 "2021-12-09T12:44:36Z")
I'm aiming to replace our existing search functionality with Elasticsearch and I'm taking small steps towards that goal. Right now I'm trying to update a specific method but I would like some guidance. We have in our sy… --- ## [Bucket aggregation - calculate my own metric inside bucket](https://discuss.elastic.co/t/bucket-aggregation-calculate-my-own-metric-inside-bucket/291326)
**Author:** [@Detlic\_Detlicko](https://discuss.elastic.co/u/Detlic_Detlicko)\ **Replies:** 0\ **Last updated:** [December 9, 2021, 12:42pm UTC](https://discuss.elastic.co/t/bucket-aggregation-calculate-my-own-metric-inside-bucket/291326 "2021-12-09T12:42:42Z")
Hello, i collect data from my router and store into Elasticsearch. My data mappings are in this form : \< {"interface\_name":"keyword", "value":"double", "timestamp":"integer"}. \> I need to measure flow for each inter… [Previous page](https://discuss.elastic.co/latest.md?page=1352) [Next page](https://discuss.elastic.co/latest.md?page=1354)