# Latest **URL:** https://discuss.elastic.co/latest.md?page=1422 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1423 --- ## [Data path configuration in source code (7.15) running in local machine](https://discuss.elastic.co/t/data-path-configuration-in-source-code-7-15-running-in-local-machine/287397)
**Author:** [@vnaveed](https://discuss.elastic.co/u/vnaveed)\ **Replies:** 0\ **Last updated:** [October 22, 2021, 5:45am UTC](https://discuss.elastic.co/t/data-path-configuration-in-source-code-7-15-running-in-local-machine/287397 "2021-10-22T05:45:44Z")
Hi.. Am running the Elasticsearch source code (7.15) in my window machine, May I know in which file I have to change the path to store my data permanently Since each time I restart the machine build folder gets reset. I… --- ## [Clearing the concept of Translog](https://discuss.elastic.co/t/clearing-the-concept-of-translog/287374)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 4\ **Last updated:** [October 22, 2021, 5:32am UTC](https://discuss.elastic.co/t/clearing-the-concept-of-translog/287374 "2021-10-22T05:32:24Z")
In translog documentation it is said that All index and delete operations are written to the translog after being processed by the internal Lucene index but before they are acknowledged So i am not understanding what… --- ## [How to push log from Filebeat to Logstash/Elasticsearch affer setting secure TSL?](https://discuss.elastic.co/t/how-to-push-log-from-filebeat-to-logstash-elasticsearch-affer-setting-secure-tsl/287386)
**Author:** [@nhattanmai](https://discuss.elastic.co/u/nhattanmai)\ **Replies:** 0\ **Last updated:** [October 22, 2021, 4:34am UTC](https://discuss.elastic.co/t/how-to-push-log-from-filebeat-to-logstash-elasticsearch-affer-setting-secure-tsl/287386 "2021-10-22T04:34:28Z")
Dear all, I configured Encrypt traffic between Kibana and Elasticsearch successfully and now I can start Kibana (not yet https) and connected Elasticsearch Here is Elasticsearch's setting: network.host: 0.0.0.0 disco… --- ## [Save all message event to array in ruby filter](https://discuss.elastic.co/t/save-all-message-event-to-array-in-ruby-filter/287381)
**Author:** [@Hertz\_Drive](https://discuss.elastic.co/u/Hertz_Drive)\ **Replies:** 0\ **Last updated:** [October 22, 2021, 3:51am UTC](https://discuss.elastic.co/t/save-all-message-event-to-array-in-ruby-filter/287381 "2021-10-22T03:51:44Z")
I need save event to array. print (event) %{host} %{message} I need print message in event. Thank you. --- ## [Rules failing due to field mapping errors](https://discuss.elastic.co/t/rules-failing-due-to-field-mapping-errors/286981)
**Author:** [@PD98](https://discuss.elastic.co/u/PD98)\ **Replies:** 1\ **Last updated:** [October 22, 2021, 3:49am UTC](https://discuss.elastic.co/t/rules-failing-due-to-field-mapping-errors/286981 "2021-10-22T03:49:17Z")
Hi, I have enabled elastic security and activated the rules. I am using auditbeat to collect audit data and send it to logstash which then indexes it in elasticsearch. I am not performing any mutation on the logs via lo… --- ## [Add a new field with a specifically formatted timestamp from @timestamp](https://discuss.elastic.co/t/add-a-new-field-with-a-specifically-formatted-timestamp-from-timestamp/287373)
**Author:** [@trwillis](https://discuss.elastic.co/u/trwillis)\ **Replies:** 1\ **Last updated:** [October 22, 2021, 12:25am UTC](https://discuss.elastic.co/t/add-a-new-field-with-a-specifically-formatted-timestamp-from-timestamp/287373 "2021-10-22T00:25:17Z")
I want to take the value from @timestamp, format it like "yyyy MM dd HH:mm:ss" and prepend it to the message field. Input data is syslog in json format. --- ## [Conditional Sort Using Two Fields](https://discuss.elastic.co/t/conditional-sort-using-two-fields/287352)
**Author:** [@cruzmoan](https://discuss.elastic.co/u/cruzmoan)\ **Replies:** 0\ **Last updated:** [October 21, 2021, 6:40pm UTC](https://discuss.elastic.co/t/conditional-sort-using-two-fields/287352 "2021-10-21T18:40:11Z")
We have a document that has the following fields: field1 field2 valueType We want to include both fields in the sort. We do NOT want to sort field1, then field2. We want the sort to use both fields at the same sort… --- ## [Локализация Kibana](https://discuss.elastic.co/t/kibana/287369)
**Author:** [@Vladislavpomililo](https://discuss.elastic.co/u/Vladislavpomililo)\ **Replies:** 0\ **Last updated:** [October 21, 2021, 9:15pm UTC](https://discuss.elastic.co/t/kibana/287369 "2021-10-21T21:15:51Z")
Подскажите, пожалуйста, есть ли возможность локализовать плагин kibana wazuh? --- ## [How to get kubernetes namespace in webhook alert payload?](https://discuss.elastic.co/t/how-to-get-kubernetes-namespace-in-webhook-alert-payload/286877)
**Author:** [@AndyLibrian](https://discuss.elastic.co/u/AndyLibrian)\ **Replies:** 1\ **Last updated:** [October 21, 2021, 9:01pm UTC](https://discuss.elastic.co/t/how-to-get-kubernetes-namespace-in-webhook-alert-payload/286877 "2021-10-21T21:01:05Z")
Hi. Does anyone know how to get kubernetes namespace in webhook alert payload from metricbeat k8s module? Or more generically, how to access the event data to include in the payload? I installed metricbeat on kubernetes… --- ## [Clone engine feature](https://discuss.elastic.co/t/clone-engine-feature/286971)
**Author:** [@mariobg](https://discuss.elastic.co/u/mariobg)\ **Replies:** 1\ **Last updated:** [October 21, 2021, 9:00pm UTC](https://discuss.elastic.co/t/clone-engine-feature/286971 "2021-10-21T21:00:00Z")
Is any way to clone engines in appsearch not using api? It is very difficult to test new things when an engine is used in production and also it takes too much time doing this with API. --- ## [How we can implent this on angular, Any documention for that?](https://discuss.elastic.co/t/how-we-can-implent-this-on-angular-any-documention-for-that/285779)
**Author:** [@Gopa](https://discuss.elastic.co/u/Gopa)\ **Replies:** 1\ **Last updated:** [October 21, 2021, 7:52pm UTC](https://discuss.elastic.co/t/how-we-can-implent-this-on-angular-any-documention-for-that/285779 "2021-10-21T19:52:00Z")
It is hard for me to find proper documentation on search-ui on angular framwork. please guide me for further steps. --- ## [(How) may I add the querqy plugin to the ES+K+Enterprise-Search docker installation?](https://discuss.elastic.co/t/how-may-i-add-the-querqy-plugin-to-the-es-k-enterprise-search-docker-installation/286670)
**Author:** [@neergttocsdivad](https://discuss.elastic.co/u/neergttocsdivad)\ **Replies:** 1\ **Last updated:** [October 21, 2021, 7:47pm UTC](https://discuss.elastic.co/t/how-may-i-add-the-querqy-plugin-to-the-es-k-enterprise-search-docker-installation/286670 "2021-10-21T19:47:43Z")
Recognising that the choice of version will be determined by the available version(s) of plugin(s). Ref.: Running Enterprise Search Using Docker | Elastic Enterprise Search Documentation \[7.15\] | Elastic https://querqy… --- ## [Do I need to generate a cert?](https://discuss.elastic.co/t/do-i-need-to-generate-a-cert/286773)
**Author:** [@MKirby](https://discuss.elastic.co/u/MKirby)\ **Replies:** 8\ **Last updated:** [October 21, 2021, 7:23pm UTC](https://discuss.elastic.co/t/do-i-need-to-generate-a-cert/286773 "2021-10-21T19:23:03Z")
I have successfully configured minimal security in my environment and am now moving on to Basic, so that I can use fleet and SIEM. Version of Elastic I am using is 7.13.4, on a RHEL 8.0 server. I only have 1 Elasticsea… --- ## [Quotes are not converted correctly](https://discuss.elastic.co/t/quotes-are-not-converted-correctly/286994)
**Author:** [@Sandra\_Schlichting](https://discuss.elastic.co/u/Sandra_Schlichting)\ **Replies:** 7\ **Last updated:** [October 21, 2021, 7:15pm UTC](https://discuss.elastic.co/t/quotes-are-not-converted-correctly/286994 "2021-10-21T19:15:53Z")
Dear all =) When creating Create Rule over the API, and want to search for host:"10.250.11.11", then I run into problems. This is invalid JSON: "esQuery": '{ "query": { "query\_string": { "query": "host:"10.250.11.11" … --- ## [Default username and password for Elasticsearch 7.15](https://discuss.elastic.co/t/default-username-and-password-for-elasticsearch-7-15/287235)
**Author:** [@harryco](https://discuss.elastic.co/u/harryco)\ **Replies:** 3\ **Last updated:** [October 21, 2021, 7:12pm UTC](https://discuss.elastic.co/t/default-username-and-password-for-elasticsearch-7-15/287235 "2021-10-21T19:12:44Z")
Hi, I just installed Elasticsearch 7.15.1 on macOS Catalina, and I set the following in Elasticsearch.yml in order to enable security: xpack.security.enabled: true Now, I'm prompted for a username and password, but I … --- ## [winlog.event\_data.Image.keyword not populated](https://discuss.elastic.co/t/winlog-event-data-image-keyword-not-populated/287342)
**Author:** [@mcreedjr](https://discuss.elastic.co/u/mcreedjr)\ **Replies:** 2\ **Last updated:** [October 21, 2021, 6:53pm UTC](https://discuss.elastic.co/t/winlog-event-data-image-keyword-not-populated/287342 "2021-10-21T18:53:12Z")
I am shipping logs from a Windows 10 machine with Process auditing enabled in the Windows using 7.15 version of winlogbeats to logstash, and then in turn Elasticsearch. As an example, I am trying to use a detection rule… --- ## [Add custom tag to zeek filebeat module](https://discuss.elastic.co/t/add-custom-tag-to-zeek-filebeat-module/287349)
**Author:** [@kcrawford19](https://discuss.elastic.co/u/kcrawford19)\ **Replies:** 0\ **Last updated:** [October 21, 2021, 6:33pm UTC](https://discuss.elastic.co/t/add-custom-tag-to-zeek-filebeat-module/287349 "2021-10-21T18:33:27Z")
Hello, I am configuring an ELK stack and would like to use filebeat to read in zeek logs. Below is a snippet of my filebeat module configuration: # cat /etc/filebeat/modules.d/zeek.yml - module: zeek capture\_loss: … --- ## [SQL indexes with dashes fail with high level java client (escaped with quotes)](https://discuss.elastic.co/t/sql-indexes-with-dashes-fail-with-high-level-java-client-escaped-with-quotes/287108)
**Author:** [@larryjag99](https://discuss.elastic.co/u/larryjag99)\ **Replies:** 2\ **Last updated:** [October 21, 2021, 6:21pm UTC](https://discuss.elastic.co/t/sql-indexes-with-dashes-fail-with-high-level-java-client-escaped-with-quotes/287108 "2021-10-21T18:21:29Z")
I am using the high-level java client to submit SQL requests to our elastic cluster. I'm seeing an issue where if the index name has a "dash" in it (while enclosed in quotes), the request cannot be parsed by the server.… --- ## [RSpec: Testing Aggregate Filters](https://discuss.elastic.co/t/rspec-testing-aggregate-filters/287345)
**Author:** [@UXabre](https://discuss.elastic.co/u/UXabre)\ **Replies:** 0\ **Last updated:** [October 21, 2021, 6:02pm UTC](https://discuss.elastic.co/t/rspec-testing-aggregate-filters/287345 "2021-10-21T18:02:56Z")
I'm trying to unittest a filter that utilizes aggregate filter. In my sample, I'm dropping all messages and wait for the timeout to occur instead. I'd like to retrieve this async message somehow and verify if the conten… --- ## [Round off a aggregated numeric value to few decimal places](https://discuss.elastic.co/t/round-off-a-aggregated-numeric-value-to-few-decimal-places/287316)
**Author:** [@venkatkumar229](https://discuss.elastic.co/u/venkatkumar229)\ **Replies:** 2\ **Last updated:** [October 21, 2021, 5:49pm UTC](https://discuss.elastic.co/t/round-off-a-aggregated-numeric-value-to-few-decimal-places/287316 "2021-10-21T17:49:31Z")
Hi Team, I am aggregating a numeric field which contains the response time data. When i try to find the avg value it is giving me a very long number(\>10 digitis after the decimal point). Could you please help in roundin… --- ## [Detection Alerts only show documents from .siem-signals-default index](https://discuss.elastic.co/t/detection-alerts-only-show-documents-from-siem-signals-default-index/287338)
**Author:** [@michel.beaudry](https://discuss.elastic.co/u/michel.beaudry)\ **Replies:** 0\ **Last updated:** [October 21, 2021, 4:54pm UTC](https://discuss.elastic.co/t/detection-alerts-only-show-documents-from-siem-signals-default-index/287338 "2021-10-21T16:54:32Z")
In Kibana-\>Security-\>Detections the Trend panel only show alerts from .siem-signals-default index. Upon clicking on Inspect it shows following: Furthermore, clicking on the (i) next to index pattern says that the pat… --- ## [Portainer - how can I create multi-app container?](https://discuss.elastic.co/t/portainer-how-can-i-create-multi-app-container/287335)
**Author:** [@neergttocsdivad](https://discuss.elastic.co/u/neergttocsdivad)\ **Replies:** 2\ **Last updated:** [October 21, 2021, 4:37pm UTC](https://discuss.elastic.co/t/portainer-how-can-i-create-multi-app-container/287335 "2021-10-21T16:37:37Z")
I have installed Docker on my Synology NAS so that I may install and experiment with elastic enterprise search. Docker was installed via the Synology Package Centre, and I've also installed docker-compose and Portainer … --- ## [Jdbc\_streaming and mutate](https://discuss.elastic.co/t/jdbc-streaming-and-mutate/287319)
**Author:** [@Roberto\_B](https://discuss.elastic.co/u/Roberto_B)\ **Replies:** 4\ **Last updated:** [October 21, 2021, 4:21pm UTC](https://discuss.elastic.co/t/jdbc-streaming-and-mutate/287319 "2021-10-21T16:21:24Z")
Hi Friends, I use a jdbc\_streaming filter in order to enrich data. This filter produces an array with only 1 document inside. How can I pop out this document in another field? I tried without success with ruby code. J… --- ## [SHA256 or MD5 in Logstash cipher filter plugin algorithm](https://discuss.elastic.co/t/sha256-or-md5-in-logstash-cipher-filter-plugin-algorithm/287328)
**Author:** [@Askia\_Mohamed\_Kadri](https://discuss.elastic.co/u/Askia_Mohamed_Kadri)\ **Replies:** 1\ **Last updated:** [October 21, 2021, 4:13pm UTC](https://discuss.elastic.co/t/sha256-or-md5-in-logstash-cipher-filter-plugin-algorithm/287328 "2021-10-21T16:13:27Z")
Hi! I'm using cipher filter plugin in my Logstash configuration and the only example I saw until now for the algorithm is aes-256-cbc and I'd like to use md5 or sha256. How is it possible? Here is my configuration belo… --- ## [Matching rule with indicator match error parsing date field](https://discuss.elastic.co/t/matching-rule-with-indicator-match-error-parsing-date-field/287171)
**Author:** [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Replies:** 3\ **Last updated:** [October 21, 2021, 3:16pm UTC](https://discuss.elastic.co/t/matching-rule-with-indicator-match-error-parsing-date-field/287171 "2021-10-21T15:16:01Z")
I create a index that contain all domain that i want to query to according to ecs. Now i create a rule that will match any domain query from dns index but it give me this errror: An error occurred during rule execution… --- ## [Elastic operator not creating elasticsearch in Openshift 3.11](https://discuss.elastic.co/t/elastic-operator-not-creating-elasticsearch-in-openshift-3-11/286847)
**Author:** [@Jasper9041](https://discuss.elastic.co/u/Jasper9041)\ **Replies:** 3\ **Last updated:** [October 21, 2021, 3:12pm UTC](https://discuss.elastic.co/t/elastic-operator-not-creating-elasticsearch-in-openshift-3-11/286847 "2021-10-21T15:12:05Z")
Hi, I'm trying to use the Elastic operator to deploy an Elasticsearch instance in a Openshift 3.11 (minishift) cluster. It doesn't seem to work... The creation of Elasticsearch is failing. I see the following k8s events… --- ## [Uptime alert on HA heartbeat deployments](https://discuss.elastic.co/t/uptime-alert-on-ha-heartbeat-deployments/287138)
**Author:** [@mojohoho](https://discuss.elastic.co/u/mojohoho)\ **Replies:** 1\ **Last updated:** [October 21, 2021, 2:27pm UTC](https://discuss.elastic.co/t/uptime-alert-on-ha-heartbeat-deployments/287138 "2021-10-21T14:27:04Z")
Having Heartbeat deployed to multiple hosts, I would like to be alerted only when a monitor (e.g. ICMP probe on "example.org") fails on all of them. For example, on the /app/uptime page, the panel on the bottom ("Monito… --- ## [FSCrawler get a path error while running as a service](https://discuss.elastic.co/t/fscrawler-get-a-path-error-while-running-as-a-service/287320)
**Author:** [@Denn](https://discuss.elastic.co/u/Denn)\ **Replies:** 2\ **Last updated:** [October 21, 2021, 2:26pm UTC](https://discuss.elastic.co/t/fscrawler-get-a-path-error-while-running-as-a-service/287320 "2021-10-21T14:26:53Z")
I have a working implementation of fscrawler. However, it is running on command prompt. I have tried to implement it as a service but i keep getting an error. my url looks like this url: "\\\\\\\\data-backup\\\\2020" The er… --- ## [RSS feed into ELK. Can we do it with Filebeat?](https://discuss.elastic.co/t/rss-feed-into-elk-can-we-do-it-with-filebeat/287310)
**Author:** [@elasticfran](https://discuss.elastic.co/u/elasticfran)\ **Replies:** 1\ **Last updated:** [October 21, 2021, 2:12pm UTC](https://discuss.elastic.co/t/rss-feed-into-elk-can-we-do-it-with-filebeat/287310 "2021-10-21T14:12:02Z")
Hey there! Can we ingest RSS feeds into Filebeat? I found a module for Logstash but given my environment would be better doing it with Filebeat. Any experience? Much appreciated! --- ## [Elastalert change timezone](https://discuss.elastic.co/t/elastalert-change-timezone/287317)
**Author:** [@josh12](https://discuss.elastic.co/u/josh12)\ **Replies:** 5\ **Last updated:** [October 21, 2021, 2:07pm UTC](https://discuss.elastic.co/t/elastalert-change-timezone/287317 "2021-10-21T14:07:17Z")
Hi i running my el;asticsearch and elastalert in docker. Data pass from beat to Elasticsearch. In Elasticsearch the time is stored local time but in elastalert is in UTC time. so when i test rule, i am hitting 0 hit sicn… [Previous page](https://discuss.elastic.co/latest.md?page=1421) [Next page](https://discuss.elastic.co/latest.md?page=1423)