# Latest **URL:** https://discuss.elastic.co/latest.md?page=1354 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1355 --- ## [Unable to perform a Regex Search for Asterisk](https://discuss.elastic.co/t/unable-to-perform-a-regex-search-for-asterisk/291036)
**Author:** [@GreenBlueSkys](https://discuss.elastic.co/u/GreenBlueSkys)\ **Replies:** 1\ **Last updated:** [December 9, 2021, 4:44pm UTC](https://discuss.elastic.co/t/unable-to-perform-a-regex-search-for-asterisk/291036 "2021-12-09T16:44:18Z")
\[Edit: Elastic parsed out the Asterisk, the proper log is now visible\] I am trying to perform a search against an AWS CloudTrail log identifying different instances of the asterisk (or escaped wildcard). To do this I a… --- ## [Logstash Can't read the elasticsearch username and password from Keystore!](https://discuss.elastic.co/t/logstash-cant-read-the-elasticsearch-username-and-password-from-keystore/291350)
**Author:** [@Maryam2021](https://discuss.elastic.co/u/Maryam2021)\ **Replies:** 0\ **Last updated:** [December 9, 2021, 4:39pm UTC](https://discuss.elastic.co/t/logstash-cant-read-the-elasticsearch-username-and-password-from-keystore/291350 "2021-12-09T16:39:32Z")
Hello All, I'm trying to build ELK stack on EC2 instances. I have built the ES cluster, Kibana and Logstash. The cluster and Kibana are happy and talking to each other fine but can't figure out the keystore issue with L… --- ## [Error activating rule (api key name is required)](https://discuss.elastic.co/t/error-activating-rule-api-key-name-is-required/291237)
**Author:** [@volundr](https://discuss.elastic.co/u/volundr)\ **Replies:** 8\ **Last updated:** [December 9, 2021, 4:22pm UTC](https://discuss.elastic.co/t/error-activating-rule-api-key-name-is-required/291237 "2021-12-09T16:22:56Z")
Hi, after following the official tutorial for enabling detection rules (Detections (beta) | SIEM Guide \[7.8\] | Elastic), I get the following error: \* \*\[action\_request\_validation\_exception\] Validation Failed: 1: api key … --- ## [Filebeat keystore for basic security](https://discuss.elastic.co/t/filebeat-keystore-for-basic-security/291257)
**Author:** [@bbangerter](https://discuss.elastic.co/u/bbangerter)\ **Replies:** 2\ **Last updated:** [December 9, 2021, 4:13pm UTC](https://discuss.elastic.co/t/filebeat-keystore-for-basic-security/291257 "2021-12-09T16:13:44Z")
I am running Elasticsearch 7.15.2 on CentOS 8 and have it successfully taking in logs from filebeat with a clear password in the yml file. I'm trying to get it running with a keystore, but am running into issues. My ou… --- ## [Parse Substring to JSON](https://discuss.elastic.co/t/parse-substring-to-json/291333)
**Author:** [@hami2608](https://discuss.elastic.co/u/hami2608)\ **Replies:** 1\ **Last updated:** [December 9, 2021, 4:09pm UTC](https://discuss.elastic.co/t/parse-substring-to-json/291333 "2021-12-09T16:09:05Z")
Hi, i have a Droptailer Pod in my Kubernetes Cluster with the following log example: 2021-12-09 13:46:32 +0000 UTC {"DPT":"161","DST":"XXX.XXX.XXX.XXX","ID":"54321","IN":"vrf104009","LEN":"48","MAC":"XX:XX:XX:XX:XX:XX… --- ## [Conditional indexing in metricbeat using Ingest node pipeline creates a datastream](https://discuss.elastic.co/t/conditional-indexing-in-metricbeat-using-ingest-node-pipeline-creates-a-datastream/291344)
**Author:** [@sidharth\_vijayakumar](https://discuss.elastic.co/u/sidharth_vijayakumar)\ **Replies:** 0\ **Last updated:** [December 9, 2021, 4:08pm UTC](https://discuss.elastic.co/t/conditional-indexing-in-metricbeat-using-ingest-node-pipeline-creates-a-datastream/291344 "2021-12-09T16:08:21Z")
I am trying to achieve conditional indexing for namespaces in elastic using ingest node pipelines. I used the below pipeline but the index getting created when I add the pipeline in metricbeat.yml is in form of datastrea… --- ## [ML job behavior changed](https://discuss.elastic.co/t/ml-job-behavior-changed/291109)
**Author:** [@dao](https://discuss.elastic.co/u/dao)\ **Replies:** 1\ **Last updated:** [December 9, 2021, 3:47pm UTC](https://discuss.elastic.co/t/ml-job-behavior-changed/291109 "2021-12-09T15:47:00Z")
Hello, J'ai un job de ML qui tourne depuis qq années, et je vois un changement (bug)? Explications: Voici ce que j'ai Il semble bien que le ML tourne, et qu'il détecte des anomalies. Par contre, quand je passe en … --- ## [Painless in Script Ingest Pipeline : Get fields name](https://discuss.elastic.co/t/painless-in-script-ingest-pipeline-get-fields-name/291341)
**Author:** [@GinkoLucas](https://discuss.elastic.co/u/GinkoLucas)\ **Replies:** 0\ **Last updated:** [December 9, 2021, 3:44pm UTC](https://discuss.elastic.co/t/painless-in-script-ingest-pipeline-get-fields-name/291341 "2021-12-09T15:44:29Z")
Hi, I need to know the names of the fields entering the pipeline. Because I would like to place in a different index the documents with an extra field, or an unknown field. Is there a solution with script processor ? --- ## [ML job behavior changed](https://discuss.elastic.co/t/ml-job-behavior-changed/291230)
**Author:** [@dao](https://discuss.elastic.co/u/dao)\ **Replies:** 6\ **Last updated:** [December 9, 2021, 3:30pm UTC](https://discuss.elastic.co/t/ml-job-behavior-changed/291230 "2021-12-09T15:30:46Z")
Hello, I have a ML jon that is started for a long time, but since a few monthes, there is a change (is it a bug?) Explanations: Here is what I have As you can see, It seems that the ML runs OK and detects some ano… --- ## [I want to set up the initial password without any environment variables after "xpack.security.enabled: true"](https://discuss.elastic.co/t/i-want-to-set-up-the-initial-password-without-any-environment-variables-after-xpack-security-enabled-true/291209)
**Author:** [@tadashi.oya](https://discuss.elastic.co/u/tadashi.oya)\ **Replies:** 1\ **Last updated:** [December 9, 2021, 3:02pm UTC](https://discuss.elastic.co/t/i-want-to-set-up-the-initial-password-without-any-environment-variables-after-xpack-security-enabled-true/291209 "2021-12-09T15:02:00Z")
Hi there. I'm trying to use T-Pot with "xpack.security.enabled: true". I want to set up passwords for Elasticsearch's built-in users (elastic, kibana\_system, and so on) as following conditions. Use as few interactive… --- ## [Metric data from csv](https://discuss.elastic.co/t/metric-data-from-csv/291314)
**Author:** [@sirReeall](https://discuss.elastic.co/u/sirReeall)\ **Replies:** 1\ **Last updated:** [December 9, 2021, 2:52pm UTC](https://discuss.elastic.co/t/metric-data-from-csv/291314 "2021-12-09T14:52:11Z")
Hello, I'm trying to import metrics data from a CSV file. Currently I'm using a csv filter like: filter { csv { autodetect\_column\_names =\> true } date { match =\> \["\[t\]","UNIX"\] } mutat… --- ## [Kibana not successfully filtering in Discover](https://discuss.elastic.co/t/kibana-not-successfully-filtering-in-discover/290918)
**Author:** [@agentw](https://discuss.elastic.co/u/agentw)\ **Replies:** 1\ **Last updated:** [December 9, 2021, 2:51pm UTC](https://discuss.elastic.co/t/kibana-not-successfully-filtering-in-discover/290918 "2021-12-09T14:51:44Z")
I recently updated our Elastic instances to 7.15.2. I am seeing mixed results when applying filters in Discover. For example, when filtering out a host on the agent.hostname field (i.e. 'NOT agent.hostname: example\_host)… --- ## [SSO and Subscription](https://discuss.elastic.co/t/sso-and-subscription/291275)
**Author:** [@suren\_es](https://discuss.elastic.co/u/suren_es)\ **Replies:** 7\ **Last updated:** [December 9, 2021, 2:13pm UTC](https://discuss.elastic.co/t/sso-and-subscription/291275 "2021-12-09T14:13:36Z")
I did download ELK stack tarballs, installed, configured. All is working fine. But when I started enabling SSO (via parameter xpack.security.authc.realms.oidc.oidc1 in config file), it says that this is not possible wit… --- ## [Kibana Logs Stream as Dashboard Visualization are not streaming live](https://discuss.elastic.co/t/kibana-logs-stream-as-dashboard-visualization-are-not-streaming-live/290758)
**Author:** [@kshepitzki1](https://discuss.elastic.co/u/kshepitzki1)\ **Replies:** 5\ **Last updated:** [December 9, 2021, 2:36pm UTC](https://discuss.elastic.co/t/kibana-logs-stream-as-dashboard-visualization-are-not-streaming-live/290758 "2021-12-09T14:36:39Z")
When I save a Kibana Live Log Stream as a visualization in the Visualization Library and then import it into a Dashboard, the Live Streaming feature is gone and I have to manually refresh it. I need it in a dashboard so… --- ## [Is there a reason you cannot use \[runtime\_mappings\] in a \_count request?](https://discuss.elastic.co/t/is-there-a-reason-you-cannot-use-runtime-mappings-in-a-count-request/291334)
**Author:** [@sz\_bb](https://discuss.elastic.co/u/sz_bb)\ **Replies:** 0\ **Last updated:** [December 9, 2021, 1:54pm UTC](https://discuss.elastic.co/t/is-there-a-reason-you-cannot-use-runtime-mappings-in-a-count-request/291334 "2021-12-09T13:54:55Z")
I'd like to take advantage of \[runtime\_mappings\] in a search request, specifically leveraging that runtime\_field as a filter. In that scenario, while I may only have a size of 50 to return the top 50 docs, I also request… --- ## [Flood-stage watermark?](https://discuss.elastic.co/t/flood-stage-watermark/291217)
**Author:** [@maltewhiite](https://discuss.elastic.co/u/maltewhiite)\ **Replies:** 3\ **Last updated:** [December 9, 2021, 1:50pm UTC](https://discuss.elastic.co/t/flood-stage-watermark/291217 "2021-12-09T13:50:19Z")
Hello. English isn't my first language. How do I troubleshoot this error-message? What does it mean? What is the solution? We never got this error when we used the old daily indices. Now we get them after transitionin… --- ## [ECE availability zone for tiebreaker only](https://discuss.elastic.co/t/ece-availability-zone-for-tiebreaker-only/291332)
**Author:** [@Zerobot](https://discuss.elastic.co/u/Zerobot)\ **Replies:** 0\ **Last updated:** [December 9, 2021, 1:21pm UTC](https://discuss.elastic.co/t/ece-availability-zone-for-tiebreaker-only/291332 "2021-12-09T13:21:04Z")
Hello! Due to upcoming changes in my company's DC structure we will have 2 separate "big" sites, and 1 "smaller" site, mainly for all the quorum things. It would be easiest for us to delegate quorum / tiebreaker nodes t… --- ## [Apply ingest node pipeline to an index/data stream](https://discuss.elastic.co/t/apply-ingest-node-pipeline-to-an-index-data-stream/291328)
**Author:** [@girija](https://discuss.elastic.co/u/girija)\ **Replies:** 1\ **Last updated:** [December 9, 2021, 1:07pm UTC](https://discuss.elastic.co/t/apply-ingest-node-pipeline-to-an-index-data-stream/291328 "2021-12-09T13:07:40Z")
Hello, I have created a ingest node pipeline to transform data received via elastic. Now I need to apply this pipeline to my index so that I can see the transformed fields under discover, and also create charts usin… --- ## [Nested mapping or comparing fields from different indices \[SQL\]](https://discuss.elastic.co/t/nested-mapping-or-comparing-fields-from-different-indices-sql/291327)
**Author:** [@Katgust](https://discuss.elastic.co/u/Katgust)\ **Replies:** 0\ **Last updated:** [December 9, 2021, 12:44pm UTC](https://discuss.elastic.co/t/nested-mapping-or-comparing-fields-from-different-indices-sql/291327 "2021-12-09T12:44:36Z")
I'm aiming to replace our existing search functionality with Elasticsearch and I'm taking small steps towards that goal. Right now I'm trying to update a specific method but I would like some guidance. We have in our sy… --- ## [Bucket aggregation - calculate my own metric inside bucket](https://discuss.elastic.co/t/bucket-aggregation-calculate-my-own-metric-inside-bucket/291326)
**Author:** [@Detlic\_Detlicko](https://discuss.elastic.co/u/Detlic_Detlicko)\ **Replies:** 0\ **Last updated:** [December 9, 2021, 12:42pm UTC](https://discuss.elastic.co/t/bucket-aggregation-calculate-my-own-metric-inside-bucket/291326 "2021-12-09T12:42:42Z")
Hello, i collect data from my router and store into Elasticsearch. My data mappings are in this form : \< {"interface\_name":"keyword", "value":"double", "timestamp":"integer"}. \> I need to measure flow for each inter… --- ## [How to find a large text from documents](https://discuss.elastic.co/t/how-to-find-a-large-text-from-documents/291324)
**Author:** [@RamyaE](https://discuss.elastic.co/u/RamyaE)\ **Replies:** 0\ **Last updated:** [December 9, 2021, 12:27pm UTC](https://discuss.elastic.co/t/how-to-find-a-large-text-from-documents/291324 "2021-12-09T12:27:45Z")
Hi All, I have a textfield with name textContent, where we insert all the contents. I wanted to find the large text from all the textContents. How can I find the large text from those documents, or anyway to know the w… --- ## [Parse json in Log field to get individual fields for visualization](https://discuss.elastic.co/t/parse-json-in-log-field-to-get-individual-fields-for-visualization/291244)
**Author:** [@girija](https://discuss.elastic.co/u/girija)\ **Replies:** 7\ **Last updated:** [December 9, 2021, 12:24pm UTC](https://discuss.elastic.co/t/parse-json-in-log-field-to-get-individual-fields-for-visualization/291244 "2021-12-09T12:24:05Z")
Hello I am new to Kibana and have difficulty reading the logs for visualization. I have pasted a sample of how my log field looks. I need to read the values inside the log for creating visualizations in Kibana, like w… --- ## [Logstash issues with certificate](https://discuss.elastic.co/t/logstash-issues-with-certificate/291124)
**Author:** [@dominbdg](https://discuss.elastic.co/u/dominbdg)\ **Replies:** 4\ **Last updated:** [December 9, 2021, 12:11pm UTC](https://discuss.elastic.co/t/logstash-issues-with-certificate/291124 "2021-12-09T12:11:10Z")
Hello, From a couple of days I'm fighting with certificates for logstash. Certificate was generated for logstash and filebeat clients but after couple of minutes I'm receiving below errors: in attach I don't know if t… --- ## [Recommendation for upgrading underlying kubernetes nodes](https://discuss.elastic.co/t/recommendation-for-upgrading-underlying-kubernetes-nodes/251298)
**Author:** [@estevez](https://discuss.elastic.co/u/estevez)\ **Replies:** 5\ **Last updated:** [December 9, 2021, 12:07pm UTC](https://discuss.elastic.co/t/recommendation-for-upgrading-underlying-kubernetes-nodes/251298 "2021-12-09T12:07:40Z")
ECK is great at updating Elasticsearch nodes in a rolling fashion but I was wondering if there's any recommendations for how to upgrade the underlying kubernetes worker nodes that Elasticsearch is running on. My thought… --- ## [Elastic Agent Consuming allot of resources on the Endpoint](https://discuss.elastic.co/t/elastic-agent-consuming-allot-of-resources-on-the-endpoint/290791)
**Author:** [@geekzy](https://discuss.elastic.co/u/geekzy)\ **Replies:** 1\ **Last updated:** [December 9, 2021, 11:42am UTC](https://discuss.elastic.co/t/elastic-agent-consuming-allot-of-resources-on-the-endpoint/290791 "2021-12-09T11:42:24Z")
Hi All, We have been testing the elastic-agent for a while across multiple endpoints on our environment and started noticing a few issues. Initially we noticed on several of our higher spec laptops that Endpoint securit… --- ## [Possible to have Kibana rules check at fixed times?](https://discuss.elastic.co/t/possible-to-have-kibana-rules-check-at-fixed-times/291316)
**Author:** [@Sandra\_Schlichting](https://discuss.elastic.co/u/Sandra_Schlichting)\ **Replies:** 0\ **Last updated:** [December 9, 2021, 11:31am UTC](https://discuss.elastic.co/t/possible-to-have-kibana-rules-check-at-fixed-times/291316 "2021-12-09T11:31:53Z")
Dear all =) When creating a Elasticsearch query to check every 24 hours, it will check every day at the same time it was created. Is it possible to have it check at a specific time? E.g. I create it at 14:00, but it sh… --- ## [How can we restrict to show data on kibana from different users?](https://discuss.elastic.co/t/how-can-we-restrict-to-show-data-on-kibana-from-different-users/291214)
**Author:** [@sajesh\_sb](https://discuss.elastic.co/u/sajesh_sb)\ **Replies:** 5\ **Last updated:** [December 9, 2021, 11:19am UTC](https://discuss.elastic.co/t/how-can-we-restrict-to-show-data-on-kibana-from-different-users/291214 "2021-12-09T11:19:52Z")
There are two dashboards created which are having independent data. I need to create three users - Admin, user-1, and user-2. Admin can see both the dashboards, user-1 should be able to see dashboard-1 and user-2 should … --- ## [Añadir valor mediante scripted field a otro campo](https://discuss.elastic.co/t/anadir-valor-mediante-scripted-field-a-otro-campo/291312)
**Author:** [@Javier\_Garcia\_Alvare](https://discuss.elastic.co/u/Javier_Garcia_Alvare)\ **Replies:** 0\ **Last updated:** [December 9, 2021, 10:47am UTC](https://discuss.elastic.co/t/anadir-valor-mediante-scripted-field-a-otro-campo/291312 "2021-12-09T10:47:44Z")
Hola, alguien me puede ayudar. Necesito mediante scripted fields copiar una dato de un campo a otro campo existente. Es decir: el nombre del scripted filed es: vMEDIO if (doc\['CANAL'\].value.toString().length() \>= 5 &&… --- ## [ELK stack setup](https://discuss.elastic.co/t/elk-stack-setup/291292)
**Author:** [@girija](https://discuss.elastic.co/u/girija)\ **Replies:** 2\ **Last updated:** [December 9, 2021, 9:20am UTC](https://discuss.elastic.co/t/elk-stack-setup/291292 "2021-12-09T09:20:29Z")
Hello I am new to the ELK world and find myself confused. Although my stack is working fine and I am able to get the logs I want, I am not sure about what all is really required for correct setup and if I have anything … --- ## [Is this a right filter?](https://discuss.elastic.co/t/is-this-a-right-filter/291118)
**Author:** [@smam](https://discuss.elastic.co/u/smam)\ **Replies:** 4\ **Last updated:** [December 9, 2021, 9:18am UTC](https://discuss.elastic.co/t/is-this-a-right-filter/291118 "2021-12-09T09:18:03Z")
filter { if "warning" in "message" { mutate { add\_field =\> { "error-field" =\> "An error occured" } } } } Is this right? Because it seems to not be working. If I open Elasticsearch and… [Previous page](https://discuss.elastic.co/latest.md?page=1353) [Next page](https://discuss.elastic.co/latest.md?page=1355)