# Latest **URL:** https://discuss.elastic.co/latest.md?page=1355 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1356 --- ## [Winlogbeat not reading event id](https://discuss.elastic.co/t/winlogbeat-not-reading-event-id/291308)
**Author:** [@aditi\_salunke](https://discuss.elastic.co/u/aditi_salunke)\ **Replies:** 0\ **Last updated:** [December 9, 2021, 9:15am UTC](https://discuss.elastic.co/t/winlogbeat-not-reading-event-id/291308 "2021-12-09T09:15:18Z")
Hello, Will winlogbeat forward the log to Elasticsearch if it is installed on AD and when someone lockout from the system and if the account lockout log is dropping on AD? eg.: if 10 users are getting locked out on the… --- ## [Ignore\_throttled parameter is deprecated](https://discuss.elastic.co/t/ignore-throttled-parameter-is-deprecated/291224)
**Author:** [@SirConius](https://discuss.elastic.co/u/SirConius)\ **Replies:** 2\ **Last updated:** [December 9, 2021, 9:00am UTC](https://discuss.elastic.co/t/ignore-throttled-parameter-is-deprecated/291224 "2021-12-09T09:00:43Z")
I've updated my Elasticsearch installation from 7.15.2 to 7.16, but when I open a dashboard I'm greeted with the following Warning: I looked in the deprecated log file before updating and this wasn't in there and I ha… --- ## [Unable to send email with watcher](https://discuss.elastic.co/t/unable-to-send-email-with-watcher/290661)
**Author:** [@Alejandro\_Chaves](https://discuss.elastic.co/u/Alejandro_Chaves)\ **Replies:** 2\ **Last updated:** [December 9, 2021, 8:24am UTC](https://discuss.elastic.co/t/unable-to-send-email-with-watcher/290661 "2021-12-09T08:24:11Z")
{ "id" : "send\_email", "type" : "email", "status" : "failure", "error" : { "root\_cause" : \[ { "type" : "messaging\_exception", "reason" : "failed to send email with subject \[Watcher Notification\] via account \[gmai… --- ## [Is posible to set a text as optional in RegularExpresions?](https://discuss.elastic.co/t/is-posible-to-set-a-text-as-optional-in-regularexpresions/291114)
**Author:** [@rodri.gz](https://discuss.elastic.co/u/rodri.gz)\ **Replies:** 2\ **Last updated:** [December 9, 2021, 8:22am UTC](https://discuss.elastic.co/t/is-posible-to-set-a-text-as-optional-in-regularexpresions/291114 "2021-12-09T08:22:43Z")
Hola! Se puede poner textos como opcionales en regex? these days im reciving some logs with this format: \[07/12/2021 09:59:33 \[Id XXXXXXXXXXXXXXXX\] Parameters send to YYYYYY: action1: AAAAAAAAAAAA action2: BBBBBBBBB… --- ## [Is posible to have iptional field with regex as grok optionals fields?](https://discuss.elastic.co/t/is-posible-to-have-iptional-field-with-regex-as-grok-optionals-fields/290645)
**Author:** [@rodri.gz](https://discuss.elastic.co/u/rodri.gz)\ **Replies:** 5\ **Last updated:** [December 9, 2021, 8:18am UTC](https://discuss.elastic.co/t/is-posible-to-have-iptional-field-with-regex-as-grok-optionals-fields/290645 "2021-12-09T08:18:25Z")
Hello! i want to know if a could set a field as optional in regular expresions as i do with grok for example: (%{DATA:Message})? Thank you! --- ## [Dec 9th, 2021: \[en\] Getting started with security enabled by default in three easy steps](https://discuss.elastic.co/t/dec-9th-2021-en-getting-started-with-security-enabled-by-default-in-three-easy-steps/289280)
**Author:** [@Fabio\_Busatto](https://discuss.elastic.co/u/Fabio_Busatto)\ **Replies:** 0\ **Last updated:** [December 9, 2021, 8:00am UTC](https://discuss.elastic.co/t/dec-9th-2021-en-getting-started-with-security-enabled-by-default-in-three-easy-steps/289280 "2021-12-09T08:00:45Z")
Elasticsearch 8.0 will come with security features enabled by default. This is a huge step forward to ensure that deployments are not unintentionally exposed to the world. We already saw that too many times in the past.… --- ## [Elasticsearch nlpcn sql client getting eroor](https://discuss.elastic.co/t/elasticsearch-nlpcn-sql-client-getting-eroor/291299)
**Author:** [@SRIGURU\_VEL](https://discuss.elastic.co/u/SRIGURU_VEL)\ **Replies:** 0\ **Last updated:** [December 9, 2021, 7:56am UTC](https://discuss.elastic.co/t/elasticsearch-nlpcn-sql-client-getting-eroor/291299 "2021-12-09T07:56:09Z")
Hi Experts, I am Using ES 7.9.3 with NLPCN Sql client. SO I am getting Error when i try to GET index. {"error":{"root\_cause":\[{"type":"x\_content\_parse\_exception","reason":"\[1:1\] \[sql/query\] failed to parse object"}\],"… --- ## [Merging two fields in a visualization](https://discuss.elastic.co/t/merging-two-fields-in-a-visualization/291139)
**Author:** [@elasticfran](https://discuss.elastic.co/u/elasticfran)\ **Replies:** 4\ **Last updated:** [December 9, 2021, 7:53am UTC](https://discuss.elastic.co/t/merging-two-fields-in-a-visualization/291139 "2021-12-09T07:53:43Z")
Team! I need to merge two fields into one in a Kibana visualization. Does anyone know how to do that? Have a good one :slight\_smile: --- ## [Unable to create index on elasticsearch](https://discuss.elastic.co/t/unable-to-create-index-on-elasticsearch/290657)
**Author:** [@Somesh\_ng](https://discuss.elastic.co/u/Somesh_ng)\ **Replies:** 5\ **Last updated:** [December 9, 2021, 7:27am UTC](https://discuss.elastic.co/t/unable-to-create-index-on-elasticsearch/290657 "2021-12-09T07:27:47Z")
I'm trying to ingest the data into Elasticsearch using logstash http\_poller but the index is not getting created in Elasticsearch. Can someone help me on this input { http\_poller { urls =\> { "te… --- ## [Increase Kibana data table bucket size](https://discuss.elastic.co/t/increase-kibana-data-table-bucket-size/291284)
**Author:** [@cps598](https://discuss.elastic.co/u/cps598)\ **Replies:** 1\ **Last updated:** [December 9, 2021, 7:40am UTC](https://discuss.elastic.co/t/increase-kibana-data-table-bucket-size/291284 "2021-12-09T07:40:21Z")
Kibana v 7.15.1 I want to show some items in the Kibana data table. And I found that the size of the bucket restricts the showing results. For example, if I set the size to 20, some log data will not be displayed on the… --- ## [How to fix cluster is red, reason: no\_valid\_shard\_copy after stopping data nodes?](https://discuss.elastic.co/t/how-to-fix-cluster-is-red-reason-no-valid-shard-copy-after-stopping-data-nodes/291206)
**Author:** [@bugb](https://discuss.elastic.co/u/bugb)\ **Replies:** 6\ **Last updated:** [December 9, 2021, 7:39am UTC](https://discuss.elastic.co/t/how-to-fix-cluster-is-red-reason-no-valid-shard-copy-after-stopping-data-nodes/291206 "2021-12-09T07:39:33Z")
After stopping some data nodes, my cluster becomes red and the reason is: no\_valid\_shard\_copy after stopping data nodes? How can I fix this? Update: should I use reroute? POST \_cluster/reroute?retry\_failed --- ## [Hyphenation token filter seems to ignore minimum subword size](https://discuss.elastic.co/t/hyphenation-token-filter-seems-to-ignore-minimum-subword-size/291295)
**Author:** [@mariskaas](https://discuss.elastic.co/u/mariskaas)\ **Replies:** 0\ **Last updated:** [December 9, 2021, 7:28am UTC](https://discuss.elastic.co/t/hyphenation-token-filter-seems-to-ignore-minimum-subword-size/291295 "2021-12-09T07:28:45Z")
Hello, I was looking to use the hyphenation decompounder filter. However during testing I found out it seems to be ignoring the minimum subword size option. Here is an example analyze I tried (normally I use a text fil… --- ## [Filebeat push event in very slow rate](https://discuss.elastic.co/t/filebeat-push-event-in-very-slow-rate/291013)
**Author:** [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Replies:** 5\ **Last updated:** [December 9, 2021, 7:01am UTC](https://discuss.elastic.co/t/filebeat-push-event-in-very-slow-rate/291013 "2021-12-09T07:01:51Z")
Hi all I have a problems with one of my filebeat installed server. That server is config to get f5 log. then i install filebeat to get log from that server to Elasticsearch. But back before that setup working fine and… --- ## [How to list out all \*\*hidden\*\* indices in a cluster](https://discuss.elastic.co/t/how-to-list-out-all-hidden-indices-in-a-cluster/291291)
**Author:** [@Bruce\_Liu](https://discuss.elastic.co/u/Bruce_Liu)\ **Replies:** 1\ **Last updated:** [December 9, 2021, 5:59am UTC](https://discuss.elastic.co/t/how-to-list-out-all-hidden-indices-in-a-cluster/291291 "2021-12-09T05:59:15Z")
I'm trying to list out all hidden indices in a cluster. I tried GET \_cat/indices?expand\_wildcards=hidden,open&v, but even the status of the hidden index(index.hidden=true) is open, and the request lists out all open indi… --- ## [How to increase writing speed to an index using Spark ES](https://discuss.elastic.co/t/how-to-increase-writing-speed-to-an-index-using-spark-es/291165)
**Author:** [@ElasticQuestion\_1234](https://discuss.elastic.co/u/ElasticQuestion_1234)\ **Replies:** 11\ **Last updated:** [December 9, 2021, 5:43am UTC](https://discuss.elastic.co/t/how-to-increase-writing-speed-to-an-index-using-spark-es/291165 "2021-12-09T05:43:16Z")
Hi, I am trying to write a DataFrame with 10k rows and 31 columns into an Elasticsearch index using spark. I am using "JavaEsSparkSQL.saveToEs" function. There are 12 concurrent tasks. I used the default "es.batch.size.b… --- ## [Not able to connect elastic APM cloud](https://discuss.elastic.co/t/not-able-to-connect-elastic-apm-cloud/291238)
**Author:** [@vinay1](https://discuss.elastic.co/u/vinay1)\ **Replies:** 1\ **Last updated:** [December 9, 2021, 5:38am UTC](https://discuss.elastic.co/t/not-able-to-connect-elastic-apm-cloud/291238 "2021-12-09T05:38:37Z")
Working fine now --- ## [Shards management in ElasticSearch](https://discuss.elastic.co/t/shards-management-in-elasticsearch/291252)
**Author:** [@Akanksha\_Pandey](https://discuss.elastic.co/u/Akanksha_Pandey)\ **Replies:** 5\ **Last updated:** [December 9, 2021, 4:49am UTC](https://discuss.elastic.co/t/shards-management-in-elasticsearch/291252 "2021-12-09T04:49:41Z")
I'm using Elasticsearch version 7.9.2 as a single node docker cluster for my production as well as development environment. Every once in a while I'm getting these two errors frequently. Error1: ElasticsearchError erro… --- ## [Elastic stack can monitor app metric](https://discuss.elastic.co/t/elastic-stack-can-monitor-app-metric/291283)
**Author:** [@wanfenjia](https://discuss.elastic.co/u/wanfenjia)\ **Replies:** 1\ **Last updated:** [December 9, 2021, 4:37am UTC](https://discuss.elastic.co/t/elastic-stack-can-monitor-app-metric/291283 "2021-12-09T04:37:14Z")
Hi Elastic stack team, I need monitor server app(for example, http access number, http reposend time,etc), Could u pls help me to fix it, and have u some doucment to share for me ? many thanks! --- ## [Filebeat is not sending data to Elasticsearch](https://discuss.elastic.co/t/filebeat-is-not-sending-data-to-elasticsearch/291000)
**Author:** [@Akanksha\_Pandey](https://discuss.elastic.co/u/Akanksha_Pandey)\ **Replies:** 9\ **Last updated:** [December 9, 2021, 4:06am UTC](https://discuss.elastic.co/t/filebeat-is-not-sending-data-to-elasticsearch/291000 "2021-12-09T04:06:05Z")
I'm using running Filebeat version 7.10.0 as container version to ship docker container logs as well as system logs directly to Elasticsearch. Docker logs are shipped fine but system logs are not getting shipped. When I … --- ## [No detailed errors in logstash](https://discuss.elastic.co/t/no-detailed-errors-in-logstash/291233)
**Author:** [@SSivaji](https://discuss.elastic.co/u/SSivaji)\ **Replies:** 2\ **Last updated:** [December 9, 2021, 3:05am UTC](https://discuss.elastic.co/t/no-detailed-errors-in-logstash/291233 "2021-12-09T03:05:58Z")
When I try to Index a specific text. Able to index a in devtools, but when the same text is provided via logstash it is not getting Indexed, enabled debug logs it just prints the text to console, but not getting Indexe… --- ## [Clone index failing](https://discuss.elastic.co/t/clone-index-failing/291249)
**Author:** [@madshov](https://discuss.elastic.co/u/madshov)\ **Replies:** 1\ **Last updated:** [December 8, 2021, 10:33pm UTC](https://discuss.elastic.co/t/clone-index-failing/291249 "2021-12-08T22:33:51Z")
Hi all, I'm getting an error when I try to clone my index called myindex into myindex\_clone. I have set up a 3 node cluster on my machine, and I'm using the (Go) SDK client to call the CloneIndex() function. However I'm… --- ## [Fleet Seperation of agents and policies](https://discuss.elastic.co/t/fleet-seperation-of-agents-and-policies/290292)
**Author:** [@Dea](https://discuss.elastic.co/u/Dea)\ **Replies:** 1\ **Last updated:** [December 8, 2021, 10:29pm UTC](https://discuss.elastic.co/t/fleet-seperation-of-agents-and-policies/290292 "2021-12-08T22:29:52Z")
Hi We would like to know how to separate agents and polices into different "Spaces/sites". At the moment we see all agents and policies in all spaces. Please advise Thank you --- ## [How to do join field/routing in bigquery to elasticsearch dataflow template?](https://discuss.elastic.co/t/how-to-do-join-field-routing-in-bigquery-to-elasticsearch-dataflow-template/291269)
**Author:** [@rickbenchsci](https://discuss.elastic.co/u/rickbenchsci)\ **Replies:** 0\ **Last updated:** [December 8, 2021, 10:27pm UTC](https://discuss.elastic.co/t/how-to-do-join-field-routing-in-bigquery-to-elasticsearch-dataflow-template/291269 "2021-12-08T22:27:29Z")
Hi, I am using the dataflow template provided by google for importing data from BigQuery to Elasticsearch. see here We managed to get the thing working (sans API key. adding basic auth overwrites the need for it), and … --- ## [SharePoint Online Connector](https://discuss.elastic.co/t/sharepoint-online-connector/226774)
**Author:** [@hoffman](https://discuss.elastic.co/u/hoffman)\ **Replies:** 2\ **Last updated:** [December 8, 2021, 10:13pm UTC](https://discuss.elastic.co/t/sharepoint-online-connector/226774 "2021-12-08T22:13:40Z")
Hi All - We are having difficulty connecting Workplace search and SharePoint Online. We have followed the docs, had multiple people verify the setup but we can not get the o365 authenticated. We get Message: AADSTS5… --- ## [TSVB metrics moving around/shaking on screen and strange refresh behaviour](https://discuss.elastic.co/t/tsvb-metrics-moving-around-shaking-on-screen-and-strange-refresh-behaviour/291167)
**Author:** [@Sketchy](https://discuss.elastic.co/u/Sketchy)\ **Replies:** 2\ **Last updated:** [December 8, 2021, 9:59pm UTC](https://discuss.elastic.co/t/tsvb-metrics-moving-around-shaking-on-screen-and-strange-refresh-behaviour/291167 "2021-12-08T21:59:04Z")
Having issues, for a long time now with the TSVB metrics moving around on the screen, shaking about/moving side to side. It used to be much worse in previous versions and I have seen the issue happening again recently on… --- ## [Filebeat service is not stopping](https://discuss.elastic.co/t/filebeat-service-is-not-stopping/291266)
**Author:** [@molasses](https://discuss.elastic.co/u/molasses)\ **Replies:** 0\ **Last updated:** [December 8, 2021, 9:49pm UTC](https://discuss.elastic.co/t/filebeat-service-is-not-stopping/291266 "2021-12-08T21:49:55Z")
From time to time, attempts to stop filebeat are failing. version: 7.11.1 running as a windows service command to stop filebeat: sc stop filebeat filebeat windows service stops fine most of the time. From time to ti… --- ## [Processing Multiple Rows From JDBC Streaming](https://discuss.elastic.co/t/processing-multiple-rows-from-jdbc-streaming/291012)
**Author:** [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Replies:** 22\ **Last updated:** [December 8, 2021, 8:37pm UTC](https://discuss.elastic.co/t/processing-multiple-rows-from-jdbc-streaming/291012 "2021-12-08T20:37:51Z")
I'm querying a database to get questions asked in a ticket. The query asks for all questions asked by the ticket id. So a single query may return multiple rows. I'd like to be able to parse them all into separate fiel… --- ## [Sending no data point in registerMetric callback](https://discuss.elastic.co/t/sending-no-data-point-in-registermetric-callback/291175)
**Author:** [@apoco](https://discuss.elastic.co/u/apoco)\ **Replies:** 1\ **Last updated:** [December 8, 2021, 8:29pm UTC](https://discuss.elastic.co/t/sending-no-data-point-in-registermetric-callback/291175 "2021-12-08T20:29:21Z")
I'm migrating an app from New Relic, and I'm trying to use registerMetric to give me a custom metric. The metric I'm recording is a duration average, so I'm collecting durations and a count of durations so that when the … --- ## [CSV Illegal Quoting in Line 1](https://discuss.elastic.co/t/csv-illegal-quoting-in-line-1/289834)
**Author:** [@Micah\_Barsness](https://discuss.elastic.co/u/Micah_Barsness)\ **Replies:** 13\ **Last updated:** [December 8, 2021, 8:19pm UTC](https://discuss.elastic.co/t/csv-illegal-quoting-in-line-1/289834 "2021-12-08T20:19:33Z")
I'm receiving the following error & some of my incoming logs are being not being parsed and therefore dropped. \[2021-11-22T09:50:11,381\]\[WARN \]\[logstash.filters.csv \]\[MID-CUCM\]\[6a45eeb30e5ba587e03ab6fc5b123b705e6e76… --- ## [No data after CSV Export - Kibana](https://discuss.elastic.co/t/no-data-after-csv-export-kibana/288486)
**Author:** [@krish0608](https://discuss.elastic.co/u/krish0608)\ **Replies:** 5\ **Last updated:** [December 8, 2021, 7:24pm UTC](https://discuss.elastic.co/t/no-data-after-csv-export-kibana/288486 "2021-12-08T19:24:34Z")
Continuing the discussion from Reporting - CSV Export: contains partial data: Hi Team, currently we are facing two issues related to csv Export. If index is frozen then how to export data in csv as we are getting emp… [Previous page](https://discuss.elastic.co/latest.md?page=1354) [Next page](https://discuss.elastic.co/latest.md?page=1356)