# Latest **URL:** https://discuss.elastic.co/latest.md?page=1462 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1463 --- ## [Match\_bool\_prefix query acts different than Prefix query when searching on a single token](https://discuss.elastic.co/t/match-bool-prefix-query-acts-different-than-prefix-query-when-searching-on-a-single-token/285105)
**Author:** [@Mike\_M1](https://discuss.elastic.co/u/Mike_M1)\ **Replies:** 0\ **Last updated:** [September 24, 2021, 5:45pm UTC](https://discuss.elastic.co/t/match-bool-prefix-query-acts-different-than-prefix-query-when-searching-on-a-single-token/285105 "2021-09-24T17:45:31Z")
Having an issue with match\_bool\_prefix behaving weirdly when having an ampersand at the end of a one token query. According to docs, it should build out a term query with a prefix at the end. However, it does that fine e… --- ## [Input Watcher problem with https](https://discuss.elastic.co/t/input-watcher-problem-with-https/284029)
**Author:** [@vaclav1](https://discuss.elastic.co/u/vaclav1)\ **Replies:** 1\ **Last updated:** [September 24, 2021, 5:40pm UTC](https://discuss.elastic.co/t/input-watcher-problem-with-https/284029 "2021-09-24T17:40:04Z")
Dear team, we have defined a http input watcher to query status of cluster. ELS cluster is secured with node certificates and https communication. When watcher is executed we got this: \[2021-09-12T11:16:48,633\]\[ERROR… --- ## [ELK sentiment classification](https://discuss.elastic.co/t/elk-sentiment-classification/285099)
**Author:** [@byul](https://discuss.elastic.co/u/byul)\ **Replies:** 0\ **Last updated:** [September 24, 2021, 4:15pm UTC](https://discuss.elastic.co/t/elk-sentiment-classification/285099 "2021-09-24T16:15:54Z")
Hello everybody, I got this technical test from an employer, it is about using ELK an integrate a sentiment classification service in it. Here are the questions: install ELK (I have already done it in a virtual machine… --- ## [Creating separate elasticsearch docs with batched log messages](https://discuss.elastic.co/t/creating-separate-elasticsearch-docs-with-batched-log-messages/284902)
**Author:** [@sdndude](https://discuss.elastic.co/u/sdndude)\ **Replies:** 2\ **Last updated:** [September 24, 2021, 3:44pm UTC](https://discuss.elastic.co/t/creating-separate-elasticsearch-docs-with-batched-log-messages/284902 "2021-09-24T15:44:22Z")
I have searched for this and have found a few forum entries that can help me figure out how to get the batch msgs (below) separated but I have no idea what to do with them after they are separated. As an example, here i… --- ## [Failed reading CA certificate permission denied](https://discuss.elastic.co/t/failed-reading-ca-certificate-permission-denied/285095)
**Author:** [@ggio](https://discuss.elastic.co/u/ggio)\ **Replies:** 0\ **Last updated:** [September 24, 2021, 3:41pm UTC](https://discuss.elastic.co/t/failed-reading-ca-certificate-permission-denied/285095 "2021-09-24T15:41:35Z")
Kibana version: 7.10.2 Elasticsearch version: 7.10.2 APM Server version: 7.10.2 Original install method (e.g. download page, yum, deb, from source, etc.) and version: RPM from official repository Fresh install or up… --- ## [Using multiple hosts in env var / Elasticsearch filter](https://discuss.elastic.co/t/using-multiple-hosts-in-env-var-elasticsearch-filter/285090)
**Author:** [@whatgeorgemade](https://discuss.elastic.co/u/whatgeorgemade)\ **Replies:** 1\ **Last updated:** [September 24, 2021, 2:56pm UTC](https://discuss.elastic.co/t/using-multiple-hosts-in-env-var-elasticsearch-filter/285090 "2021-09-24T14:56:07Z")
Hi all, I have a three node Elasticsearch cluster. I'm using Logstash to do some enrichment by pulling un-enriched documents from an index, using the elasticsearch filter to look up values, then output again to Elastics… --- ## [FSCrawler - Best approach to load massive amount of document](https://discuss.elastic.co/t/fscrawler-best-approach-to-load-massive-amount-of-document/284900)
**Author:** [@classless\_oak](https://discuss.elastic.co/u/classless_oak)\ **Replies:** 2\ **Last updated:** [September 24, 2021, 2:25pm UTC](https://discuss.elastic.co/t/fscrawler-best-approach-to-load-massive-amount-of-document/284900 "2021-09-24T14:25:57Z")
Hello, I am trying to come up with a solution to load massive amount of documents (xlx, xlsx, doc, xml, txt, pdf, etd.) 30+ terabytes into Elastic. I have spun up the stack with the FSCrawler and have been adding docume… --- ## [\_search field added to mappings long before installing plugins](https://discuss.elastic.co/t/search-field-added-to-mappings-long-before-installing-plugins/284867)
**Author:** [@BogdanD](https://discuss.elastic.co/u/BogdanD)\ **Replies:** 2\ **Last updated:** [September 24, 2021, 2:25pm UTC](https://discuss.elastic.co/t/search-field-added-to-mappings-long-before-installing-plugins/284867 "2021-09-24T14:25:45Z")
Hi all, I'm having an issue with setting up the mapper-size plugin, specifically: I have an ES instance that I've been upgrading since 6.x, now at 7.14. My mappings for my indices have always included: "\_size": { "en… --- ## [Characters coming in non-readable format in ES after sending from filebeat\>logstash\>ES](https://discuss.elastic.co/t/characters-coming-in-non-readable-format-in-es-after-sending-from-filebeat-logstash-es/284645)
**Author:** [@Shaiju\_Sam](https://discuss.elastic.co/u/Shaiju_Sam)\ **Replies:** 1\ **Last updated:** [September 24, 2021, 12:51pm UTC](https://discuss.elastic.co/t/characters-coming-in-non-readable-format-in-es-after-sending-from-filebeat-logstash-es/284645 "2021-09-24T12:51:01Z")
Hi Team, Im tring to get .log files from linux servers to ES using filebeat, logstash and then to ES however when it reaches ES, below is the outcome Y\\xD9\\xE7IU\\xC8JC\\xD5\\u000FW\\x8EC'\\x95j\\x8A\\x86\\xC4kRm\\xABFݯ\\x87C\\u0… --- ## [Don't auto discard unsaved work to log back in](https://discuss.elastic.co/t/dont-auto-discard-unsaved-work-to-log-back-in/284281)
**Author:** [@nahoj](https://discuss.elastic.co/u/nahoj)\ **Replies:** 2\ **Last updated:** [September 24, 2021, 12:18pm UTC](https://discuss.elastic.co/t/dont-auto-discard-unsaved-work-to-log-back-in/284281 "2021-09-24T12:18:28Z")
Hi, I started to use Kibana 7.8.1 a few days ago and even though I think it's a great tool overall, I would like to report a misfeature I just ran in: Two hours ago I was working in several browser tabs on a visualizat… --- ## [Osquerybeat standalone without elastic-agent?](https://discuss.elastic.co/t/osquerybeat-standalone-without-elastic-agent/284872)
**Author:** [@buzzdeee](https://discuss.elastic.co/u/buzzdeee)\ **Replies:** 5\ **Last updated:** [September 24, 2021, 12:02pm UTC](https://discuss.elastic.co/t/osquerybeat-standalone-without-elastic-agent/284872 "2021-09-24T12:02:51Z")
Hi, I'm currently using various \*beats deployed to servers and clients. For a number of reasons, I have my beats output to logstash, before they are sent to Elasticsearch. I'm evaluating elastic-agent, to at least repla… --- ## [Alternative to SQS queue for AWS log ingest](https://discuss.elastic.co/t/alternative-to-sqs-queue-for-aws-log-ingest/284911)
**Author:** [@kbirhan](https://discuss.elastic.co/u/kbirhan)\ **Replies:** 3\ **Last updated:** [September 24, 2021, 11:56am UTC](https://discuss.elastic.co/t/alternative-to-sqs-queue-for-aws-log-ingest/284911 "2021-09-24T11:56:26Z")
The documentation for the AWS module states "It uses filebeat s3 input to get log files from AWS S3 buckets with SQS notification or directly polling list of S3 objects in an S3 bucket. The use of SQS notification is pre… --- ## [What is the best way to classify data?](https://discuss.elastic.co/t/what-is-the-best-way-to-classify-data/285076)
**Author:** [@wifi](https://discuss.elastic.co/u/wifi)\ **Replies:** 0\ **Last updated:** [September 24, 2021, 11:44am UTC](https://discuss.elastic.co/t/what-is-the-best-way-to-classify-data/285076 "2021-09-24T11:44:25Z")
I have data that originates from three sources and thus saved in a separate index each. metricbeat manual data: manually ingested data app data: data ingested by an app The documents in each index have different field… --- ## [Getting Error while installing checkstyle on IntelliJ](https://discuss.elastic.co/t/getting-error-while-installing-checkstyle-on-intellij/285074)
**Author:** [@Ankur\_Jain](https://discuss.elastic.co/u/Ankur_Jain)\ **Replies:** 0\ **Last updated:** [September 24, 2021, 11:16am UTC](https://discuss.elastic.co/t/getting-error-while-installing-checkstyle-on-intellij/285074 "2021-09-24T11:16:49Z")
Hi Team, I have cloned elasticsearch project on my local and getting below error while installing checkstyle. Could not determine the dependencies of task ':buildDependencyArtifacts'. Task with path ':plugins:reposit… --- ## [Logstash-output-syslog plugin fix message and structured data](https://discuss.elastic.co/t/logstash-output-syslog-plugin-fix-message-and-structured-data/285071)
**Author:** [@ZuperZero](https://discuss.elastic.co/u/ZuperZero)\ **Replies:** 0\ **Last updated:** [September 24, 2021, 10:58am UTC](https://discuss.elastic.co/t/logstash-output-syslog-plugin-fix-message-and-structured-data/285071 "2021-09-24T10:58:53Z")
So I tried to use the logstash-output-syslog plugin to send information to a syslog server. I had multiple issues with messages containing all sorts of garbage (duplicate timestamp, duplicate message ID and host field??… --- ## [My bucket-script-based Transform is not showing the aggregation fields in the destination index](https://discuss.elastic.co/t/my-bucket-script-based-transform-is-not-showing-the-aggregation-fields-in-the-destination-index/284992)
**Author:** [@nsouth](https://discuss.elastic.co/u/nsouth)\ **Replies:** 2\ **Last updated:** [September 24, 2021, 10:33am UTC](https://discuss.elastic.co/t/my-bucket-script-based-transform-is-not-showing-the-aggregation-fields-in-the-destination-index/284992 "2021-09-24T10:33:12Z")
Hi, I'm trying to make my first transform and I'm not getting the results I expect. My source has multiple events correlated by a command\_unique\_id and I want to find the duration of these events by getting the timestam… --- ## [Elastic search 7.13 found vulnerable in Twistlock report](https://discuss.elastic.co/t/elastic-search-7-13-found-vulnerable-in-twistlock-report/285050)
**Author:** [@Shraddha2](https://discuss.elastic.co/u/Shraddha2)\ **Replies:** 3\ **Last updated:** [September 24, 2021, 10:14am UTC](https://discuss.elastic.co/t/elastic-search-7-13-found-vulnerable-in-twistlock-report/285050 "2021-09-24T10:14:51Z")
We are using Elastic search 7.13 version and in recent twist lock vulnerability scan this jar reported for 2 High vulnerabilities. CVE-2020-25649 CVE-2020-28491 com.fasterxml.jackson.core\_jackson-databind - 2.10.4 A … --- ## [Logstash metricbeat monitoring issue](https://discuss.elastic.co/t/logstash-metricbeat-monitoring-issue/285064)
**Author:** [@jalaine](https://discuss.elastic.co/u/jalaine)\ **Replies:** 0\ **Last updated:** [September 24, 2021, 9:27am UTC](https://discuss.elastic.co/t/logstash-metricbeat-monitoring-issue/285064 "2021-09-24T09:27:03Z")
Good Morning, I have kind of a strange use case, and am hoping someone might be able to help me out. I have a monitoring cluster and a production cluster. It is a strange contractual issue, but we want the customer to h… --- ## [Radar Chart with Dynamic Data](https://discuss.elastic.co/t/radar-chart-with-dynamic-data/285002)
**Author:** [@bodach](https://discuss.elastic.co/u/bodach)\ **Replies:** 4\ **Last updated:** [September 24, 2021, 9:21am UTC](https://discuss.elastic.co/t/radar-chart-with-dynamic-data/285002 "2021-09-24T09:21:29Z")
Hello, I am a beginner with Kibana and Vega. I m trying to create a radar chart with an index. I managed to create a chart with static values. See below: vega code However, when I try to do the same with my index, I … --- ## [Logstash pipeline, разделение логов в различные индексы](https://discuss.elastic.co/t/logstash-pipeline/285004)
**Author:** [@Savai](https://discuss.elastic.co/u/Savai)\ **Replies:** 1\ **Last updated:** [September 24, 2021, 9:12am UTC](https://discuss.elastic.co/t/logstash-pipeline/285004 "2021-09-24T09:12:40Z")
Подскажите пожалуйста В сети есть компьютеры с установлеными winlogbeat(установлены на ОС Windows) и filebeat- они могут быть установлены как на ОС Linux так и на Windows, как в pipeline logstash правильно организовать… --- ## [Auditbeat on docker fails to run auditd module](https://discuss.elastic.co/t/auditbeat-on-docker-fails-to-run-auditd-module/284399)
**Author:** [@MarshalHex](https://discuss.elastic.co/u/MarshalHex)\ **Replies:** 16\ **Last updated:** [September 24, 2021, 8:58am UTC](https://discuss.elastic.co/t/auditbeat-on-docker-fails-to-run-auditd-module/284399 "2021-09-24T08:58:20Z")
Hi! I'm setting up Auditbeat to run on amazon linux EC2 instance. When I run the default install and config for auditbeat, everything works fine for auditbeat auditd module and I can configure my rules to be implemente… --- ## [How to create a segment/line chart visualization with well-defined time intervals in a dashboard?](https://discuss.elastic.co/t/how-to-create-a-segment-line-chart-visualization-with-well-defined-time-intervals-in-a-dashboard/283881)
**Author:** [@Mario\_Sabetta](https://discuss.elastic.co/u/Mario_Sabetta)\ **Replies:** 2\ **Last updated:** [September 24, 2021, 8:49am UTC](https://discuss.elastic.co/t/how-to-create-a-segment-line-chart-visualization-with-well-defined-time-intervals-in-a-dashboard/283881 "2021-09-24T08:49:10Z")
Hello everyone, I have to make a segment chart with the time intervals as shown in the figure (first picture below). I started doing something similar by doing a simple trapezoidal function with integers on the abscissa… --- ## [Exiting: Failed to create Beat meta file: open /usr/share/heartbeat/data/meta.json.new: permission denied](https://discuss.elastic.co/t/exiting-failed-to-create-beat-meta-file-open-usr-share-heartbeat-data-meta-json-new-permission-denied/284717)
**Author:** [@WookWook](https://discuss.elastic.co/u/WookWook)\ **Replies:** 3\ **Last updated:** [September 24, 2021, 7:57am UTC](https://discuss.elastic.co/t/exiting-failed-to-create-beat-meta-file-open-usr-share-heartbeat-data-meta-json-new-permission-denied/284717 "2021-09-24T07:57:15Z")
I setup Elastic Cloud on Kubernetes on Openshift 4.6. Right now with the following services (Elasticsearch/Kibana/Filebeat) I am now failing to get Heartbeat running. I had it running on another Testcluster without any … --- ## [How to run elasticsearch when installed from source?](https://discuss.elastic.co/t/how-to-run-elasticsearch-when-installed-from-source/285047)
**Author:** [@Rahmat\_Agung\_W](https://discuss.elastic.co/u/Rahmat_Agung_W)\ **Replies:** 3\ **Last updated:** [September 24, 2021, 7:19am UTC](https://discuss.elastic.co/t/how-to-run-elasticsearch-when-installed-from-source/285047 "2021-09-24T07:19:04Z")
Hi, so I want to install Elasticsearch from archieve (Install Elasticsearch from archive on Linux or MacOS | Elasticsearch Guide \[7.15\] | Elastic). Why? Because I need to install them on custom path (by default Elasticse… --- ## [Unable to retrieve more 10k records from elastic search using rest api](https://discuss.elastic.co/t/unable-to-retrieve-more-10k-records-from-elastic-search-using-rest-api/285051)
**Author:** [@Magesh\_02](https://discuss.elastic.co/u/Magesh_02)\ **Replies:** 3\ **Last updated:** [September 24, 2021, 7:11am UTC](https://discuss.elastic.co/t/unable-to-retrieve-more-10k-records-from-elastic-search-using-rest-api/285051 "2021-09-24T07:11:50Z")
I'm trying to get more than 10k records from an Elasticsearch using the Rest api (http://localhost:9200/json-metrics/\_search), but all I have is the rest api link, which is the input to my BI tool. I need those records i… --- ## [\[Fleet Agent\] Cannot get kubernetes autodiscovery to work](https://discuss.elastic.co/t/fleet-agent-cannot-get-kubernetes-autodiscovery-to-work/284388)
**Author:** [@ZikPhil](https://discuss.elastic.co/u/ZikPhil)\ **Replies:** 1\ **Last updated:** [September 24, 2021, 6:39am UTC](https://discuss.elastic.co/t/fleet-agent-cannot-get-kubernetes-autodiscovery-to-work/284388 "2021-09-24T06:39:09Z")
Hello, So previously I was running metricbeat, filebeat & heartbeat separately using a different manifest for each. I want to migrate to a single agent instance that would do it all. Here is my config: apiVersion: agen… --- ## [Unable to parse multiline json data into logstash](https://discuss.elastic.co/t/unable-to-parse-multiline-json-data-into-logstash/284114)
**Author:** [@Magesh\_02](https://discuss.elastic.co/u/Magesh_02)\ **Replies:** 11\ **Last updated:** [September 24, 2021, 6:17am UTC](https://discuss.elastic.co/t/unable-to-parse-multiline-json-data-into-logstash/284114 "2021-09-24T06:17:09Z")
I have tried to parse my json data into logstash data with separate fields. But unable to parse my data, logstash console struck on pipeline starts line input : { "id": 1, "first\_name": "Frank", "las… --- ## [Slow response times query first couple of times](https://discuss.elastic.co/t/slow-response-times-query-first-couple-of-times/285018)
**Author:** [@Mark\_Schenk](https://discuss.elastic.co/u/Mark_Schenk)\ **Replies:** 2\ **Last updated:** [September 24, 2021, 4:37am UTC](https://discuss.elastic.co/t/slow-response-times-query-first-couple-of-times/285018 "2021-09-24T04:37:59Z")
We have a service which is using ES sporadically, (once every few hours). We noted that the first couple of times we query ES takes a lot longer than subsequent calls. For example if we perform the following query: { … --- ## [Metricbeat not getting the Logstash Containers](https://discuss.elastic.co/t/metricbeat-not-getting-the-logstash-containers/285045)
**Author:** [@ajcb](https://discuss.elastic.co/u/ajcb)\ **Replies:** 0\ **Last updated:** [September 24, 2021, 3:44am UTC](https://discuss.elastic.co/t/metricbeat-not-getting-the-logstash-containers/285045 "2021-09-24T03:44:14Z")
So I deployed metricbeat on an ECS cluster, in the "Number of Containers" visualization in the default Docker dashboard, it says 15 running. but in the "Docker Containers" visualization, the containers aren't 15, when I … --- ## [How to get ctx.payload from Visualize Data Table ( nested aggregations )](https://discuss.elastic.co/t/how-to-get-ctx-payload-from-visualize-data-table-nested-aggregations/283836)
**Author:** [@hanase](https://discuss.elastic.co/u/hanase)\ **Replies:** 5\ **Last updated:** [September 24, 2021, 3:41am UTC](https://discuss.elastic.co/t/how-to-get-ctx-payload-from-visualize-data-table-nested-aggregations/283836 "2021-09-24T03:41:36Z")
Hi elastic community, I create a Visualize Data Table to filter some data, and got response what I expect. then I try to use watcher send alert message when buckets doc\_count greater then a value. what is the correc… [Previous page](https://discuss.elastic.co/latest.md?page=1461) [Next page](https://discuss.elastic.co/latest.md?page=1463)