# Latest **URL:** https://discuss.elastic.co/latest.md?page=1437 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1438 --- ## [Is Elastic search filter in log stash work in synchronous or asynchronous mode?](https://discuss.elastic.co/t/is-elastic-search-filter-in-log-stash-work-in-synchronous-or-asynchronous-mode/286472)
**Author:** [@Sandeep\_Thakur](https://discuss.elastic.co/u/Sandeep_Thakur)\ **Replies:** 1\ **Last updated:** [October 13, 2021, 12:49am UTC](https://discuss.elastic.co/t/is-elastic-search-filter-in-log-stash-work-in-synchronous-or-asynchronous-mode/286472 "2021-10-13T00:49:57Z")
I am facing one issue in ELK when I continuous log and tried to update some fields in log stash configuration file using Elasticsearch filter plugin its updating logs sometimes but sometimes not working, so is there and … --- ## [Kibana server is not ready](https://discuss.elastic.co/t/kibana-server-is-not-ready/286186)
**Author:** [@PELK](https://discuss.elastic.co/u/PELK)\ **Replies:** 2\ **Last updated:** [October 13, 2021, 12:30am UTC](https://discuss.elastic.co/t/kibana-server-is-not-ready/286186 "2021-10-13T00:30:43Z")
Salut a tous, après l'installation de Elasticsearch et de kibana tout fonctionne nickel mais après la mise en place d'HTTPS SSL et TLS plus rien ne marche je suis sur ubuntu 21.04 voila les fichier log de kibana {"type… --- ## [Automatic @timestamp in datastream](https://discuss.elastic.co/t/automatic-timestamp-in-datastream/286381)
**Author:** [@ggab31](https://discuss.elastic.co/u/ggab31)\ **Replies:** 2\ **Last updated:** [October 13, 2021, 12:21am UTC](https://discuss.elastic.co/t/automatic-timestamp-in-datastream/286381 "2021-10-13T00:21:04Z")
Hi The documentation says that documents must contain a @timestamp field in order to be accepted by a datastream. I'm trying to make it optional by declaring a default ingest\_pipeline in a datastream template that will… --- ## [Wazuh alerts not received in Kibana](https://discuss.elastic.co/t/wazuh-alerts-not-received-in-kibana/286524)
**Author:** [@Hocine\_Zaidi](https://discuss.elastic.co/u/Hocine_Zaidi)\ **Replies:** 1\ **Last updated:** [October 13, 2021, 12:19am UTC](https://discuss.elastic.co/t/wazuh-alerts-not-received-in-kibana/286524 "2021-10-13T00:19:46Z")
Gents, i receive Wazuh monitoring and statistics but not Alertes , i suspect certificates error if someone help me --- ## [How to get data into the beats specific index via logstash](https://discuss.elastic.co/t/how-to-get-data-into-the-beats-specific-index-via-logstash/286328)
**Author:** [@gwvandesteeg](https://discuss.elastic.co/u/gwvandesteeg)\ **Replies:** 19\ **Last updated:** [October 13, 2021, 12:15am UTC](https://discuss.elastic.co/t/how-to-get-data-into-the-beats-specific-index-via-logstash/286328 "2021-10-13T00:15:58Z")
The use case here is that we have: \*beats -\> logstash -\> elasticsearch cloud The following requirements are in place: The hosts running the beats do not have direct internet access and can only communicate via logsta… --- ## [Upgrade Error: Cannot write to a field alias \[host.hostname\]](https://discuss.elastic.co/t/upgrade-error-cannot-write-to-a-field-alias-host-hostname/286543)
**Author:** [@Karthik\_ek](https://discuss.elastic.co/u/Karthik_ek)\ **Replies:** 0\ **Last updated:** [October 12, 2021, 7:50pm UTC](https://discuss.elastic.co/t/upgrade-error-cannot-write-to-a-field-alias-host-hostname/286543 "2021-10-12T19:50:44Z")
Hi, Can you please help here. I'm getting error after upgrading from filebeat 6.8.6 to filebeat 7.9.2. I see the below error in the logs folder: Cannot write to a field alias \[host.hostname\] 2021-10-12T10:34:28.800-0… --- ## [Finding number of files in latest batch using aggregations](https://discuss.elastic.co/t/finding-number-of-files-in-latest-batch-using-aggregations/286553)
**Author:** [@Tim\_Estes](https://discuss.elastic.co/u/Tim_Estes)\ **Replies:** 0\ **Last updated:** [October 12, 2021, 10:35pm UTC](https://discuss.elastic.co/t/finding-number-of-files-in-latest-batch-using-aggregations/286553 "2021-10-12T22:35:58Z")
Hello, Here is the scenario: I have an index that contains documents representing files uploaded to a file store. These documents are uploaded in batches and each doc is tagged with a batch\_id field as well as the time… --- ## [Custom TopDocsCollector in plugin?](https://discuss.elastic.co/t/custom-topdocscollector-in-plugin/286546)
**Author:** [@larry\_benchling](https://discuss.elastic.co/u/larry_benchling)\ **Replies:** 2\ **Last updated:** [October 12, 2021, 10:18pm UTC](https://discuss.elastic.co/t/custom-topdocscollector-in-plugin/286546 "2021-10-12T22:18:50Z")
Hello! I'm working on a plugin to add some cheminformatics features to our Elasticsearch cluster. Several of these involve steps where there is an inverted index based screening stage (which fits well as a Lucene query)… --- ## [Turn on Anonymous access](https://discuss.elastic.co/t/turn-on-anonymous-access/285955)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 3\ **Last updated:** [October 12, 2021, 10:11pm UTC](https://discuss.elastic.co/t/turn-on-anonymous-access/285955 "2021-10-12T22:11:38Z")
I have been trying to turn on this anonymous access gone through many thread and list on how to do it. none of them seems working I have 7.14.1 basic license and user login is enable with just some role/spaces. I cre… --- ## [Subtract two numbers in different events but same index](https://discuss.elastic.co/t/subtract-two-numbers-in-different-events-but-same-index/286519)
**Author:** [@Adixon\_Diaz](https://discuss.elastic.co/u/Adixon_Diaz)\ **Replies:** 3\ **Last updated:** [October 12, 2021, 9:36pm UTC](https://discuss.elastic.co/t/subtract-two-numbers-in-different-events-but-same-index/286519 "2021-10-12T21:36:58Z")
Hi Comunity, I would like to Subtract two numbers in different events but same index. I tried by sql workbreanch, but there aren't a functions thats works for this. Do you have any another idea? Thank, reggards. --- ## [Understand ILM (shrink index)](https://discuss.elastic.co/t/understand-ilm-shrink-index/286407)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 4\ **Last updated:** [October 12, 2021, 9:00pm UTC](https://discuss.elastic.co/t/understand-ilm-shrink-index/286407 "2021-10-12T21:00:32Z")
I have used ILM policy on my metricbeat data and used shrink option. which worked and created new index called shrink-anre-metricbeat-7.15.0-2021.10.06-000010 but my index pattern is called "metricbeat-\*" how does it… --- ## [Failed to retrieve password hash for reserved user \[elastic\]](https://discuss.elastic.co/t/failed-to-retrieve-password-hash-for-reserved-user-elastic/286399)
**Author:** [@rachelyang](https://discuss.elastic.co/u/rachelyang)\ **Replies:** 6\ **Last updated:** [October 12, 2021, 8:51pm UTC](https://discuss.elastic.co/t/failed-to-retrieve-password-hash-for-reserved-user-elastic/286399 "2021-10-12T20:51:34Z")
I have verified the password of user elastic. curl -k -u elastic 'https://localhost:9200/\_xpack/security/\_authenticate?pretty' Enter host password for user 'elastic': { "username" : "elastic", "roles" : \[ "super… --- ## [Finding data with logstash 7.13.4](https://discuss.elastic.co/t/finding-data-with-logstash-7-13-4/286135)
**Author:** [@MKirby](https://discuss.elastic.co/u/MKirby)\ **Replies:** 6\ **Last updated:** [October 12, 2021, 8:44pm UTC](https://discuss.elastic.co/t/finding-data-with-logstash-7-13-4/286135 "2021-10-12T20:44:15Z")
I have my installation of the ELK stack up and running. All three aspects are running on separate servers but they all communicate and can talk to one another. I have not yet installed any Beats or Security on the inst… --- ## [What is best way for saving URL on Elasticsearch, only "keyword" type mapping?](https://discuss.elastic.co/t/what-is-best-way-for-saving-url-on-elasticsearch-only-keyword-type-mapping/286477)
**Author:** [@dan\_kim](https://discuss.elastic.co/u/dan_kim)\ **Replies:** 1\ **Last updated:** [October 12, 2021, 8:31pm UTC](https://discuss.elastic.co/t/what-is-best-way-for-saving-url-on-elasticsearch-only-keyword-type-mapping/286477 "2021-10-12T20:31:03Z")
Hello ~ Our team is going to save our product data in Elasticsearch and I got question when i type mapping schema. The url of "product image", or "product payment" is quite big compared to other attribute in Elasticse… --- ## [Comparing two fields between two different index and output result into a third index](https://discuss.elastic.co/t/comparing-two-fields-between-two-different-index-and-output-result-into-a-third-index/286535)
**Author:** [@test\_tester](https://discuss.elastic.co/u/test_tester)\ **Replies:** 1\ **Last updated:** [October 12, 2021, 7:10pm UTC](https://discuss.elastic.co/t/comparing-two-fields-between-two-different-index-and-output-result-into-a-third-index/286535 "2021-10-12T19:10:00Z")
Hello! I got a requirement whereby I am required to match two fields from two different files and output the result into a csv file. Prior to this train of thought, i did a simple python script to do the matching logic… --- ## [Filebeat negate regexp](https://discuss.elastic.co/t/filebeat-negate-regexp/286502)
**Author:** [@Marcus\_Juttner](https://discuss.elastic.co/u/Marcus_Juttner)\ **Replies:** 1\ **Last updated:** [October 12, 2021, 6:59pm UTC](https://discuss.elastic.co/t/filebeat-negate-regexp/286502 "2021-10-12T18:59:11Z")
Hello How can I negate this processors: - drop\_event: when: regexp: message: "^\[0-9\]" I want to read only lines beginning with a number and ignore all others. Thank you Marcus --- ## [Questions about handling delete operations on a latest-data-only index](https://discuss.elastic.co/t/questions-about-handling-delete-operations-on-a-latest-data-only-index/286227)
**Author:** [@nivo](https://discuss.elastic.co/u/nivo)\ **Replies:** 5\ **Last updated:** [October 12, 2021, 6:54pm UTC](https://discuss.elastic.co/t/questions-about-handling-delete-operations-on-a-latest-data-only-index/286227 "2021-10-12T18:54:46Z")
Hi everyone, I have a question regarding our use case following this topic - In our case we use a single index per customer (without rolling it) and keeping its data up to date by indexing or deleting documents when t… --- ## [Highlighting of not indexed text](https://discuss.elastic.co/t/highlighting-of-not-indexed-text/286530)
**Author:** [@Wonder\_Garance](https://discuss.elastic.co/u/Wonder_Garance)\ **Replies:** 0\ **Last updated:** [October 12, 2021, 5:50pm UTC](https://discuss.elastic.co/t/highlighting-of-not-indexed-text/286530 "2021-10-12T17:50:17Z")
Hello, I use Elasticsearch 7.9.3, is there any way to highlight a not indexed text, with expressions highlighted by a phrase query, and synonyms of these expressions? As our text are often updated, if we index them, th… --- ## [App Search not chasing HTTP 302s when validating URLs?](https://discuss.elastic.co/t/app-search-not-chasing-http-302s-when-validating-urls/284213)
**Author:** [@lgoolsby](https://discuss.elastic.co/u/lgoolsby)\ **Replies:** 2\ **Last updated:** [October 12, 2021, 5:46pm UTC](https://discuss.elastic.co/t/app-search-not-chasing-http-302s-when-validating-urls/284213 "2021-10-12T17:46:29Z")
When adding a new URL to the web crawler the validation fails with this error: When we fetched the web page at \[my domain\], it returned data that was not HTML. If I curl -I \[my domain\] from the pod's shell I see that t… --- ## [Values for alert variables are not coming in Uptime recovered email alert](https://discuss.elastic.co/t/values-for-alert-variables-are-not-coming-in-uptime-recovered-email-alert/285501)
**Author:** [@dyadav](https://discuss.elastic.co/u/dyadav)\ **Replies:** 2\ **Last updated:** [October 12, 2021, 4:32pm UTC](https://discuss.elastic.co/t/values-for-alert-variables-are-not-coming-in-uptime-recovered-email-alert/285501 "2021-10-12T16:32:07Z")
I have set up email alerts for uptime down and recover status. But with recovered status, values for alert variables like state.monitorName, state.monitorUrl are not coming. Version is 7.12.1 --- ## [Obtain doc\_count values from terms aggregation in bucket](https://discuss.elastic.co/t/obtain-doc-count-values-from-terms-aggregation-in-bucket/286527)
**Author:** [@Felipe\_Fuller](https://discuss.elastic.co/u/Felipe_Fuller)\ **Replies:** 0\ **Last updated:** [October 12, 2021, 4:30pm UTC](https://discuss.elastic.co/t/obtain-doc-count-values-from-terms-aggregation-in-bucket/286527 "2021-10-12T16:30:15Z")
Hello Community! I am having a problem formulating a query in Elasticseach. I want to create a watcher to alert me on slack, the top hits that exceed the 4% of all the documents in a time interval. So in the query of th… --- ## [CPU usage alert reason is incorrect](https://discuss.elastic.co/t/cpu-usage-alert-reason-is-incorrect/285964)
**Author:** [@dyadav](https://discuss.elastic.co/u/dyadav)\ **Replies:** 4\ **Last updated:** [October 12, 2021, 4:30pm UTC](https://discuss.elastic.co/t/cpu-usage-alert-reason-is-incorrect/285964 "2021-10-12T16:30:11Z")
I have configured email alerts if CPU usage is above or equals 80% for last 2 minutes. Below is the content configured in my alert: {{alertName}} - {{context.group}} is in a state of {{context.alertState}} Reason: {{c… --- ## [Implement APM RUM into Kibana](https://discuss.elastic.co/t/implement-apm-rum-into-kibana/286163)
**Author:** [@Ramon\_Sanchez\_Villan](https://discuss.elastic.co/u/Ramon_Sanchez_Villan)\ **Replies:** 1\ **Last updated:** [October 12, 2021, 3:28pm UTC](https://discuss.elastic.co/t/implement-apm-rum-into-kibana/286163 "2021-10-12T15:28:43Z")
If you are asking about a problem you are experiencing, please use the following template, as it will help us help you. If you have a different problem, please delete all of this text :slight\_smile: TIP 1: select at lea… --- ## [Elasticsearch Native Language Translation (NLP)](https://discuss.elastic.co/t/elasticsearch-native-language-translation-nlp/286521)
**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Replies:** 0\ **Last updated:** [October 12, 2021, 3:18pm UTC](https://discuss.elastic.co/t/elasticsearch-native-language-translation-nlp/286521 "2021-10-12T15:18:27Z")
Hi All, I recently watched the ElasticOn talk on Modern NLP in the Elastic Stack. It was very interesting to see how Elastic is looking to integrate NLP. On this topic, I noticed that recently Elastic had added language… --- ## [Canvas Elements No Longer Interactive](https://discuss.elastic.co/t/canvas-elements-no-longer-interactive/286384)
**Author:** [@hbs128](https://discuss.elastic.co/u/hbs128)\ **Replies:** 1\ **Last updated:** [October 12, 2021, 3:16pm UTC](https://discuss.elastic.co/t/canvas-elements-no-longer-interactive/286384 "2021-10-12T15:16:20Z")
Having some issues with elements in Canvas. Drop down filters that were once working, are no longer interactive (when you click on them, they no longer drop down or react). In addition, maps added to canvas are doing the… --- ## [Sum-up subprocesses](https://discuss.elastic.co/t/sum-up-subprocesses/286097)
**Author:** [@franknord](https://discuss.elastic.co/u/franknord)\ **Replies:** 1\ **Last updated:** [October 12, 2021, 3:11pm UTC](https://discuss.elastic.co/t/sum-up-subprocesses/286097 "2021-10-12T15:11:41Z")
Hi all, On my system I have a parent process spawning several sub-processes: root 84046 0.0 0.2 392688 36420 ? Ss Sep30 2:47 /usr/sbin/httpd -DFOREGROUND apache 121160 3.3 0.1 395720 27616 ? … --- ## [Logstash Converting Base64 IP to Decimal IP](https://discuss.elastic.co/t/logstash-converting-base64-ip-to-decimal-ip/286153)
**Author:** [@pkward](https://discuss.elastic.co/u/pkward)\ **Replies:** 19\ **Last updated:** [October 12, 2021, 3:07pm UTC](https://discuss.elastic.co/t/logstash-converting-base64-ip-to-decimal-ip/286153 "2021-10-12T15:07:49Z")
Hello, I'm trying to convert a base64 IP into a decimal IP. I saw that Logstash Ruby filter plugin can assist with this by parsing the message field, but is there a way to do this for just an IP field? --- ## [Envío archivo .file a logstash](https://discuss.elastic.co/t/envio-archivo-file-a-logstash/286512)
**Author:** [@Mauricio\_Salas](https://discuss.elastic.co/u/Mauricio_Salas)\ **Replies:** 1\ **Last updated:** [October 12, 2021, 2:57pm UTC](https://discuss.elastic.co/t/envio-archivo-file-a-logstash/286512 "2021-10-12T14:57:16Z")
Buenas compañeros, tengo que realizar un SIEM con un cliente que el cual, un servidor envíe logs hacia un ambiente ELK, pero aquí tenemos dos problemas. El archivo que necesitamos enviar está con extensión .file, o sea… --- ## [Running logstash in background in linux](https://discuss.elastic.co/t/running-logstash-in-background-in-linux/286517)
**Author:** [@mangeshs](https://discuss.elastic.co/u/mangeshs)\ **Replies:** 1\ **Last updated:** [October 12, 2021, 2:25pm UTC](https://discuss.elastic.co/t/running-logstash-in-background-in-linux/286517 "2021-10-12T14:25:53Z")
I want to run logstash in background on linux server i am using command like this on bin path nohup ./logstash -f sample.conf& is it correct way to run the logstash or anything else but then I need to read nohup.out … --- ## [Elasticsearch 7.14.1 and unassigned shards](https://discuss.elastic.co/t/elasticsearch-7-14-1-and-unassigned-shards/286510)
**Author:** [@Marcello\_A](https://discuss.elastic.co/u/Marcello_A)\ **Replies:** 1\ **Last updated:** [October 12, 2021, 2:04pm UTC](https://discuss.elastic.co/t/elasticsearch-7-14-1-and-unassigned-shards/286510 "2021-10-12T14:04:43Z")
Hi All, we installed a 3 nodes cluster shipped with Elasticsearch 7.14.1. All indices are configured with 2 shards and 1 replica per shard and all works fine. We stop one node and the cluster becomes yellow and some sh… [Previous page](https://discuss.elastic.co/latest.md?page=1436) [Next page](https://discuss.elastic.co/latest.md?page=1438)