# Latest **URL:** https://discuss.elastic.co/latest.md?page=1366 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1367 --- ## [SIEM custom rule to generate an alert if multiple users attempts with same source IP or same mac address](https://discuss.elastic.co/t/siem-custom-rule-to-generate-an-alert-if-multiple-users-attempts-with-same-source-ip-or-same-mac-address/289265)
**Author:** [@Priyanka\_chauhan](https://discuss.elastic.co/u/Priyanka_chauhan)\ **Replies:** 2\ **Last updated:** [December 2, 2021, 6:50am UTC](https://discuss.elastic.co/t/siem-custom-rule-to-generate-an-alert-if-multiple-users-attempts-with-same-source-ip-or-same-mac-address/289265 "2021-12-02T06:50:00Z")
I am trying to generate alerts using siem new rule if more than one user attempts with same source IP like vpn ip or vice versa ,so I want to know that It is possible or not via eql query or any kind of rule type If it i… --- ## [APM for .NET 6](https://discuss.elastic.co/t/apm-for-net-6/290725)
**Author:** [@WeslleyFelizardo](https://discuss.elastic.co/u/WeslleyFelizardo)\ **Replies:** 1\ **Last updated:** [December 2, 2021, 6:37am UTC](https://discuss.elastic.co/t/apm-for-net-6/290725 "2021-12-02T06:37:57Z")
When will be possible to use apm for .net 6 without the error “ Failed to detect whether the current .NET runtime is .NET Full Framework, Mono or .NET Core - \`N/A' will be used as the current .NET runtime name”? --- ## [How to update Index patterns?](https://discuss.elastic.co/t/how-to-update-index-patterns/290636)
**Author:** [@wajika](https://discuss.elastic.co/u/wajika)\ **Replies:** 4\ **Last updated:** [December 2, 2021, 2:22am UTC](https://discuss.elastic.co/t/how-to-update-index-patterns/290636 "2021-12-02T02:22:49Z")
I currently use Elastic stack 7.14. Recently, when I wanted to search for a certain field, I found that it couldn’t be searched. Kibana gave me a prompt "Unindexed fields can not be searched". I remember that index patte… --- ## [Clearing index pattern fields](https://discuss.elastic.co/t/clearing-index-pattern-fields/290716)
**Author:** [@hamzahda](https://discuss.elastic.co/u/hamzahda)\ **Replies:** 1\ **Last updated:** [December 2, 2021, 1:18am UTC](https://discuss.elastic.co/t/clearing-index-pattern-fields/290716 "2021-12-02T01:18:53Z")
I want to clear around 2000 unused fields in a kibana index pattern and I was wondering wich of the following two approaches should I take: deleting all of the fields and then only the used fields will be recreated by… --- ## [Elastic agent tries to download beats from Elastic artifacts directly without passing by fleet server](https://discuss.elastic.co/t/elastic-agent-tries-to-download-beats-from-elastic-artifacts-directly-without-passing-by-fleet-server/290676)
**Author:** [@djamel.lahouazi](https://discuss.elastic.co/u/djamel.lahouazi)\ **Replies:** 5\ **Last updated:** [December 2, 2021, 12:24am UTC](https://discuss.elastic.co/t/elastic-agent-tries-to-download-beats-from-elastic-artifacts-directly-without-passing-by-fleet-server/290676 "2021-12-02T00:24:09Z")
I installed fleet server & kibana in a machine that has access to internet and installed elasticagent in Windows server that does not have access to internet. But when I try to add integration (osquerybeat) i find in the… --- ## [How to delete multiple fields with the same name when Reindexing](https://discuss.elastic.co/t/how-to-delete-multiple-fields-with-the-same-name-when-reindexing/290691)
**Author:** [@hNiven](https://discuss.elastic.co/u/hNiven)\ **Replies:** 1\ **Last updated:** [December 2, 2021, 12:02am UTC](https://discuss.elastic.co/t/how-to-delete-multiple-fields-with-the-same-name-when-reindexing/290691 "2021-12-02T00:02:37Z")
Hi, We have reached the maximum fields limit on an index and after doing some research it looks like the best way to get rid of the unneeded fields we need to reindex. Specifically we have many fields called activity.i… --- ## [Advanced Watcher Alternative input](https://discuss.elastic.co/t/advanced-watcher-alternative-input/290455)
**Author:** [@zangero98](https://discuss.elastic.co/u/zangero98)\ **Replies:** 1\ **Last updated:** [December 1, 2021, 11:43pm UTC](https://discuss.elastic.co/t/advanced-watcher-alternative-input/290455 "2021-12-01T23:43:57Z")
Hi, I want to specify an advanced watch with an alternative input. Right now I am matching all logs in the syntax, but i just want to match fileset.name = firewall I'm an elastic beginner and so I'm not very familiar w… --- ## [GET /\_security/api\_key?name=any\_key returns 200 when no key present](https://discuss.elastic.co/t/get-security-api-key-name-any-key-returns-200-when-no-key-present/290682)
**Author:** [@JGreene](https://discuss.elastic.co/u/JGreene)\ **Replies:** 0\ **Last updated:** [December 1, 2021, 2:48pm UTC](https://discuss.elastic.co/t/get-security-api-key-name-any-key-returns-200-when-no-key-present/290682 "2021-12-01T14:48:19Z")
ES Version: 7.15.2 and prior The /\_security/api\_key api returns a 200 response code even when the requested key does not exists. Example: curl -X GET "https://172.19.18.17:9200/\_security/api\_key?name=bobs\_key" -u elas… --- ## [Custom event parsing](https://discuss.elastic.co/t/custom-event-parsing/290568)
**Author:** [@ohliuw](https://discuss.elastic.co/u/ohliuw)\ **Replies:** 7\ **Last updated:** [December 1, 2021, 9:52pm UTC](https://discuss.elastic.co/t/custom-event-parsing/290568 "2021-12-01T21:52:04Z")
I am relatively new to SO. I am trying to understand how to ingest and parse customs logs in ELS. I currently use the NXLog agent to send json formatted data (coming from the SYSMON windows eventlog) from a host to the … --- ## [Kibana watcher rule Elasticsearch query bug](https://discuss.elastic.co/t/kibana-watcher-rule-elasticsearch-query-bug/290664)
**Author:** [@can.ozdemir](https://discuss.elastic.co/u/can.ozdemir)\ **Replies:** 1\ **Last updated:** [December 1, 2021, 9:44pm UTC](https://discuss.elastic.co/t/kibana-watcher-rule-elasticsearch-query-bug/290664 "2021-12-01T21:44:45Z")
Hello there, On our cluster we are indexing logs from machine pairs i.e. machine01 and machine02 is a pair, thus I have created an Elasticsearch query Alert when my query which returns log amount containing hostname mac… --- ## [DSL query for indices not receiving any documents for the past 5 mins](https://discuss.elastic.co/t/dsl-query-for-indices-not-receiving-any-documents-for-the-past-5-mins/290710)
**Author:** [@antonisnyc94](https://discuss.elastic.co/u/antonisnyc94)\ **Replies:** 0\ **Last updated:** [December 1, 2021, 8:55pm UTC](https://discuss.elastic.co/t/dsl-query-for-indices-not-receiving-any-documents-for-the-past-5-mins/290710 "2021-12-01T20:55:10Z")
Hello, We want to set up an alert using opendistro for indices not receiving any docs for the past 5 mins. I used the must\_not exist field "@timestamp" since it always exists in all documents but i get no results.. Does… --- ## [Logstash beats: 69/71 error](https://discuss.elastic.co/t/logstash-beats-69-71-error/290708)
**Author:** [@userR](https://discuss.elastic.co/u/userR)\ **Replies:** 3\ **Last updated:** [December 1, 2021, 8:55pm UTC](https://discuss.elastic.co/t/logstash-beats-69-71-error/290708 "2021-12-01T20:55:04Z")
Logstash configuration: input { beats { port =\> 9443 host =\> "0.0.0.0" ssl =\> false } } filter { ... } output { ... } stdout{} } It looks like logstash is having an issue with the beats tag as I… --- ## [IAM role issue in s3 output plugin](https://discuss.elastic.co/t/iam-role-issue-in-s3-output-plugin/290702)
**Author:** [@John\_snow](https://discuss.elastic.co/u/John_snow)\ **Replies:** 0\ **Last updated:** [December 1, 2021, 5:56pm UTC](https://discuss.elastic.co/t/iam-role-issue-in-s3-output-plugin/290702 "2021-12-01T17:56:51Z")
Trying to use iam role for cross account S3 Bucket but getting following error Pipeline error {:pipeline\_id=\>"main", :exception=\>#\ … --- ## [Is it possible to enable HTTPs only between the browser and kibana?](https://discuss.elastic.co/t/is-it-possible-to-enable-https-only-between-the-browser-and-kibana/290421)
**Author:** [@Shreesh\_Narayanan](https://discuss.elastic.co/u/Shreesh_Narayanan)\ **Replies:** 5\ **Last updated:** [December 1, 2021, 8:29pm UTC](https://discuss.elastic.co/t/is-it-possible-to-enable-https-only-between-the-browser-and-kibana/290421 "2021-12-01T20:29:29Z")
hello, I have a set up where an app developed via flask places the logs onto a Elasticsearch server the ingests and visualizes the logs . I want to know if i could enable HTTP only between the browser and kibana and no… --- ## [Elasticsearch Node Running on docker only shows Disk Available 50 GB](https://discuss.elastic.co/t/elasticsearch-node-running-on-docker-only-shows-disk-available-50-gb/290704)
**Author:** [@Mmatos](https://discuss.elastic.co/u/Mmatos)\ **Replies:** 2\ **Last updated:** [December 1, 2021, 8:22pm UTC](https://discuss.elastic.co/t/elasticsearch-node-running-on-docker-only-shows-disk-available-50-gb/290704 "2021-12-01T20:22:25Z")
Hi, I am running the Docker-Elk Stack 7.14.1 and noticed that in the Stack Monitoring Tab Elastic reports it only has a 50 GB disk. The host running the container has 700 GB free. How can I expand this container so it … --- ## [Is it possible to embed Kibana Visualizations on Google Slides or Docs?](https://discuss.elastic.co/t/is-it-possible-to-embed-kibana-visualizations-on-google-slides-or-docs/290427)
**Author:** [@Urbano\_Freitas](https://discuss.elastic.co/u/Urbano_Freitas)\ **Replies:** 4\ **Last updated:** [December 1, 2021, 8:13pm UTC](https://discuss.elastic.co/t/is-it-possible-to-embed-kibana-visualizations-on-google-slides-or-docs/290427 "2021-12-01T20:13:51Z")
Hi everyone, I do Load Tests frequently and I generally in the end share a report with Load Test results and with observations. I generally do this by creating some visualizations with Kibana and then snap(1) the visua… --- ## [Make a loop to read values in logstash](https://discuss.elastic.co/t/make-a-loop-to-read-values-in-logstash/290692)
**Author:** [@elpazo](https://discuss.elastic.co/u/elpazo)\ **Replies:** 1\ **Last updated:** [December 1, 2021, 8:04pm UTC](https://discuss.elastic.co/t/make-a-loop-to-read-values-in-logstash/290692 "2021-12-01T20:04:28Z")
Hello, I have a result like this ' values \[ \[0\] { X = 1 Y = 2 Z = 3 V = 4 } \[1\] { X = 5 Y = 6 Z = 7 V= 8 } ' How can i read this result and put every value in variable (example Var\_X = Values\[0\]\[0\] = 1… --- ## [Schedule csv](https://discuss.elastic.co/t/schedule-csv/290575)
**Author:** [@lnunez](https://discuss.elastic.co/u/lnunez)\ **Replies:** 1\ **Last updated:** [December 1, 2021, 7:43pm UTC](https://discuss.elastic.co/t/schedule-csv/290575 "2021-12-01T19:43:39Z")
It is not possible to schedule the csv using file as input, I've tried also the approach mentioned here: Cron job for CSV filter, which is using exec. But as is mentioned in the documentation: (Cron job for CSV filter) … --- ## [Multiple output sequence](https://discuss.elastic.co/t/multiple-output-sequence/290640)
**Author:** [@zhanggengengen](https://discuss.elastic.co/u/zhanggengengen)\ **Replies:** 1\ **Last updated:** [December 1, 2021, 7:25pm UTC](https://discuss.elastic.co/t/multiple-output-sequence/290640 "2021-12-01T19:25:01Z")
I have two output,the first is http-output,and the second is elasticsearch-output. What i want to do is execute http-output before elasticsearch-output. How can i do that? The problem I have is this I need delete it be… --- ## [Unicode whitespace in configuration files](https://discuss.elastic.co/t/unicode-whitespace-in-configuration-files/290651)
**Author:** [@jmb](https://discuss.elastic.co/u/jmb)\ **Replies:** 2\ **Last updated:** [December 1, 2021, 7:21pm UTC](https://discuss.elastic.co/t/unicode-whitespace-in-configuration-files/290651 "2021-12-01T19:21:28Z")
Is Logstash expected to handle Unicode (UTF-8) in its configuration files? I found an issue today where a pipeline (actually, an Elasticsearch mapping template file) which looks perfectly good fails to load because some… --- ## [How to remove the fields](https://discuss.elastic.co/t/how-to-remove-the-fields/290663)
**Author:** [@rahul\_sirugudi](https://discuss.elastic.co/u/rahul_sirugudi)\ **Replies:** 3\ **Last updated:** [December 1, 2021, 7:19pm UTC](https://discuss.elastic.co/t/how-to-remove-the-fields/290663 "2021-12-01T19:19:28Z")
Hi, I am using filebeat to ship logs to logstash, and creating index. Now while visualising logs from kibana there are many unwanted fields i am seeing like agent.id, cloud.account.id. I want to remove all the fields. I… --- ## [Can I modify either Winlogbeat or Filebeat to collect and send Alert and Audit data from McAfee EPO](https://discuss.elastic.co/t/can-i-modify-either-winlogbeat-or-filebeat-to-collect-and-send-alert-and-audit-data-from-mcafee-epo/290703)
**Author:** [@MKirby](https://discuss.elastic.co/u/MKirby)\ **Replies:** 0\ **Last updated:** [December 1, 2021, 6:15pm UTC](https://discuss.elastic.co/t/can-i-modify-either-winlogbeat-or-filebeat-to-collect-and-send-alert-and-audit-data-from-mcafee-epo/290703 "2021-12-01T18:15:02Z")
I am looking for an efficient way to have my ELK stack SIEM pull Alert and Audit logs from my three ePO servers. Each ePO server will only be able to use UDP as the rest of the environment is locked down and they are in… --- ## [How do i fix Unassigned Replicas on cluster?](https://discuss.elastic.co/t/how-do-i-fix-unassigned-replicas-on-cluster/290699)
**Author:** [@Shreesh\_Narayanan](https://discuss.elastic.co/u/Shreesh_Narayanan)\ **Replies:** 5\ **Last updated:** [December 1, 2021, 6:12pm UTC](https://discuss.elastic.co/t/how-do-i-fix-unassigned-replicas-on-cluster/290699 "2021-12-01T18:12:45Z")
Hello, we recently created a cluster on 2 VMs , 1 with Elasticsearch as MASTER node and another with Elasticsearch as DATA node . How do i allocate the replicas ? it seems the primary is allocated but the replicas … --- ## [Metricbeat data not fully visible in elasticsearch](https://discuss.elastic.co/t/metricbeat-data-not-fully-visible-in-elasticsearch/290340)
**Author:** [@Atul\_Chadha](https://discuss.elastic.co/u/Atul_Chadha)\ **Replies:** 6\ **Last updated:** [December 1, 2021, 5:55pm UTC](https://discuss.elastic.co/t/metricbeat-data-not-fully-visible-in-elasticsearch/290340 "2021-12-01T17:55:43Z")
I am trying to use metricbeat v 7.10.2 ( ELS on same version ) and not able to see all the data for Elasticsearch module. I understand the data is dependent on master node for few metrics so i have configured it individu… --- ## [Create visualization with Lens Error](https://discuss.elastic.co/t/create-visualization-with-lens-error/290687)
**Author:** [@kbujold\_wr](https://discuss.elastic.co/u/kbujold_wr)\ **Replies:** 2\ **Last updated:** [December 1, 2021, 5:04pm UTC](https://discuss.elastic.co/t/create-visualization-with-lens-error/290687 "2021-12-01T17:04:29Z")
Hi, we are using elastic 7.9.3 After a fresh installation, if we navigate to the Visualize panel and select Create visualization / Lens we get can error saying "Unexpected token u in JSON at position 0" on the UI. If w… --- ## [Zoom in/out on custom picture](https://discuss.elastic.co/t/zoom-in-out-on-custom-picture/290536)
**Author:** [@Testeur](https://discuss.elastic.co/u/Testeur)\ **Replies:** 3\ **Last updated:** [December 1, 2021, 4:45pm UTC](https://discuss.elastic.co/t/zoom-in-out-on-custom-picture/290536 "2021-12-01T16:45:03Z")
Hello, I would like to know if with Kibana it is possible to create our own picture and be able to zoom in/out and put a circle when something has been found. The same as Map functionnalities but on a custom "map". This… --- ## [ES-SQL UNION alternative \[Was: Sql query canvas\]](https://discuss.elastic.co/t/es-sql-union-alternative-was-sql-query-canvas/290637)
**Author:** [@asmaalqasem4](https://discuss.elastic.co/u/asmaalqasem4)\ **Replies:** 7\ **Last updated:** [December 1, 2021, 4:44pm UTC](https://discuss.elastic.co/t/es-sql-union-alternative-was-sql-query-canvas/290637 "2021-12-01T16:44:04Z")
Hello,, I need to implement this query in the canvas but it is not working. is there another way to get the same result? SELECT SUM(amount) \*\* \*FROM (SELECT AMOUNT as amount FROM "payment-index "\* UNION \*\* \*SELECT P… --- ## [Logstash is not taking in account whitespaces at the end of lines ? (grok filter)](https://discuss.elastic.co/t/logstash-is-not-taking-in-account-whitespaces-at-the-end-of-lines-grok-filter/290449)
**Author:** [@duanra22](https://discuss.elastic.co/u/duanra22)\ **Replies:** 2\ **Last updated:** [December 1, 2021, 4:42pm UTC](https://discuss.elastic.co/t/logstash-is-not-taking-in-account-whitespaces-at-the-end-of-lines-grok-filter/290449 "2021-12-01T16:42:41Z")
Hello Elastic community, Sorry if this question has already been asked but I didn't find something that was close to what I'm looking for. I'm new to logstash and I'm trying to use Grok filter. I have a string of conc… --- ## [Dynamically passing to query](https://discuss.elastic.co/t/dynamically-passing-to-query/290471)
**Author:** [@cool999](https://discuss.elastic.co/u/cool999)\ **Replies:** 3\ **Last updated:** [December 1, 2021, 4:29pm UTC](https://discuss.elastic.co/t/dynamically-passing-to-query/290471 "2021-12-01T16:29:52Z")
Hi Team, I have below similar logs. I have created dummy index and created mapping like below, PUT new { "mappings": { "properties": { "@timestamp": { "type": "date", "format": "yyyy-MM-d… --- ## [Subheadings in Elasticsearch/clean up system logs](https://discuss.elastic.co/t/subheadings-in-elasticsearch-clean-up-system-logs/289943)
**Author:** [@eprop-marc](https://discuss.elastic.co/u/eprop-marc)\ **Replies:** 12\ **Last updated:** [December 1, 2021, 2:39pm UTC](https://discuss.elastic.co/t/subheadings-in-elasticsearch-clean-up-system-logs/289943 "2021-12-01T14:39:57Z")
Hi, I'm brand new to the whole ELK stack, I've setup one in my company. I just wanted to know how best to clean up the logs, I'm getting a lot of system logs from the server and I don't want them. I just want the logs fr… [Previous page](https://discuss.elastic.co/latest.md?page=1365) [Next page](https://discuss.elastic.co/latest.md?page=1367)