# Latest **URL:** https://discuss.elastic.co/latest.md?page=1478 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1479 --- ## [Is changing the jvm heap size a problem?](https://discuss.elastic.co/t/is-changing-the-jvm-heap-size-a-problem/284172)
**Author:** [@RusseL](https://discuss.elastic.co/u/RusseL)\ **Replies:** 3\ **Last updated:** [September 14, 2021, 9:50pm UTC](https://discuss.elastic.co/t/is-changing-the-jvm-heap-size-a-problem/284172 "2021-09-14T21:50:58Z")
Hello, there are a total of 16 nodes in the cluster, including 13 data nodes and 3 master nodes. Master nodes have 64 gb ram. But jvm heap is set to 16gb. Data nodes have 64 GB ram. But jvm heap is set to 30gb. Does t… --- ## [Filebeat mssql](https://discuss.elastic.co/t/filebeat-mssql/284175)
**Author:** [@Marcel\_Palme](https://discuss.elastic.co/u/Marcel_Palme)\ **Replies:** 3\ **Last updated:** [September 14, 2021, 9:49pm UTC](https://discuss.elastic.co/t/filebeat-mssql/284175 "2021-09-14T21:49:50Z")
I'm trying to transfer the mssql log to elastic. This also works so far, but I get the errors all in text fields How can I split this field into individual fields or how can I search for certain keywords in this fiel… --- ## [Latest Winlogbeat for windows Url](https://discuss.elastic.co/t/latest-winlogbeat-for-windows-url/284191)
**Author:** [@operat0r](https://discuss.elastic.co/u/operat0r)\ **Replies:** 1\ **Last updated:** [September 14, 2021, 9:45pm UTC](https://discuss.elastic.co/t/latest-winlogbeat-for-windows-url/284191 "2021-09-14T21:45:32Z")
Even using wget I can't auto download the latest ZIP for winlogbeat ... I looked on github and all the scripts are doing the same thing with static paths ... is there any way I can have a "latest winlogbeat for winows" U… --- ## [Scripting a Field with multiple fields with Null values](https://discuss.elastic.co/t/scripting-a-field-with-multiple-fields-with-null-values/284207)
**Author:** [@pkward](https://discuss.elastic.co/u/pkward)\ **Replies:** 0\ **Last updated:** [September 14, 2021, 5:05pm UTC](https://discuss.elastic.co/t/scripting-a-field-with-multiple-fields-with-null-values/284207 "2021-09-14T17:05:38Z")
Hi, I'm attempting to use a script processor to add the sum of other fields into a total field, but some of the values are null. I know that I can use a "gsub" or "set" processors to set null values to 0, but the "gsub… --- ## [Elasticsearch 7.13.4 Security Update](https://discuss.elastic.co/t/elasticsearch-7-13-4-security-update/279177)
**Author:** [@douglasday](https://discuss.elastic.co/u/douglasday)\ **Replies:** 0\ **Last updated:** [July 20, 2021, 3:14pm UTC](https://discuss.elastic.co/t/elasticsearch-7-13-4-security-update/279177 "2021-07-20T15:14:29Z")
Elasticsearch memory disclosure issue (ESA-2021-16) A memory disclosure vulnerability was identified in Elasticsearch’s error reporting. A user with the ability to submit arbitrary queries to Elasticsearch could submit … --- ## [Enable private IP address crawls](https://discuss.elastic.co/t/enable-private-ip-address-crawls/284206)
**Author:** [@lgoolsby](https://discuss.elastic.co/u/lgoolsby)\ **Replies:** 1\ **Last updated:** [September 14, 2021, 4:57pm UTC](https://discuss.elastic.co/t/enable-private-ip-address-crawls/284206 "2021-09-14T16:57:27Z")
I am setting up App Search and need to crawl some internal content. I found this post that says the feature is coming in the next minor patch, but it wasn't clear which version that will be. Will it be a patch based off … --- ## [Possible to run a remote Kibana instance that communicates with managed Elastic Stack?](https://discuss.elastic.co/t/possible-to-run-a-remote-kibana-instance-that-communicates-with-managed-elastic-stack/284087)
**Author:** [@GavinAnderegg](https://discuss.elastic.co/u/GavinAnderegg)\ **Replies:** 5\ **Last updated:** [September 14, 2021, 2:41pm UTC](https://discuss.elastic.co/t/possible-to-run-a-remote-kibana-instance-that-communicates-with-managed-elastic-stack/284087 "2021-09-14T14:41:17Z")
I might be missing something, but I'm having a hard time trying to connect an externally hosted Kibana instance to an Elasticsearch instance hosted on Elastic.co's managed Elastic Stack product (Elasticsearch Service: Ma… --- ## [How to use Elasticseach API client.security.authenticate() in kibana custom plugin?](https://discuss.elastic.co/t/how-to-use-elasticseach-api-client-security-authenticate-in-kibana-custom-plugin/283872)
**Author:** [@Disha\_Bodade](https://discuss.elastic.co/u/Disha_Bodade)\ **Replies:** 3\ **Last updated:** [September 14, 2021, 3:00pm UTC](https://discuss.elastic.co/t/how-to-use-elasticseach-api-client-security-authenticate-in-kibana-custom-plugin/283872 "2021-09-14T15:00:32Z")
I have a custom plugin created, I want to get current user login details to check whether the user is admin or not. I found out Elasticseach API client.security.authenticate() this can be used to do so, but I did not ge… --- ## [Logging not working with Kibana 7.14.1](https://discuss.elastic.co/t/logging-not-working-with-kibana-7-14-1/283624)
**Author:** [@Zeeshan\_Alam](https://discuss.elastic.co/u/Zeeshan_Alam)\ **Replies:** 1\ **Last updated:** [September 14, 2021, 2:43pm UTC](https://discuss.elastic.co/t/logging-not-working-with-kibana-7-14-1/283624 "2021-09-14T14:43:05Z")
In my kibana.yml I have given the following. But I don't see kibana logs being written to the path I defined logging: root: level: all appenders: rolling-file: type: rolling-file fileName: /apps… --- ## [Can't select Agent Policy when trying to add agent](https://discuss.elastic.co/t/cant-select-agent-policy-when-trying-to-add-agent/284195)
**Author:** [@buzzdeee](https://discuss.elastic.co/u/buzzdeee)\ **Replies:** 0\ **Last updated:** [September 14, 2021, 2:25pm UTC](https://discuss.elastic.co/t/cant-select-agent-policy-when-trying-to-add-agent/284195 "2021-09-14T14:25:58Z")
I restored a backup on my test cluster with ELK stack version 7.13.3, then directly upgraded everything to 7.14.1. Now when looking at fleet, I'm at the stage of adding a fleet server, the second point: Select an Agent … --- ## [Migration failed, dumping execution log](https://discuss.elastic.co/t/migration-failed-dumping-execution-log/283937)
**Author:** [@LombardoAndrea195](https://discuss.elastic.co/u/LombardoAndrea195)\ **Replies:** 1\ **Last updated:** [September 14, 2021, 2:21pm UTC](https://discuss.elastic.co/t/migration-failed-dumping-execution-log/283937 "2021-09-14T14:21:16Z")
Error generated in kibana log: {"type":"log","@timestamp":"2021-09-11T11:08:43+00:00","tags":\["info","savedobjects-service"\],"pid":1214,"message":"\[.kibana\_task\_manager\] OUTDATED\_DOCUMENTS\_SEARCH\_CLOSE\_PIT -\> UPDATE\_TAR… --- ## [How to disable geoip usage in 7.14.0](https://discuss.elastic.co/t/how-to-disable-geoip-usage-in-7-14-0/281076)
**Author:** [@Alex\_Batt](https://discuss.elastic.co/u/Alex_Batt)\ **Replies:** 21\ **Last updated:** [September 14, 2021, 2:18pm UTC](https://discuss.elastic.co/t/how-to-disable-geoip-usage-in-7-14-0/281076 "2021-09-14T14:18:55Z")
hi, I want to disable the usage of geoip functionality because of licensing and no usage . I have a single node cluster, which works fine. I've tried to disable the geoip on a cluster level using the following param: ing… --- ## ["type": "parsing\_exception","reason":"unknown query \[aggs\] - Elasticsearch node js client](https://discuss.elastic.co/t/type-parsing-exception-reason-unknown-query-aggs-elasticsearch-node-js-client/281402)
**Author:** [@manojkrishna561994](https://discuss.elastic.co/u/manojkrishna561994)\ **Replies:** 4\ **Last updated:** [September 14, 2021, 2:11pm UTC](https://discuss.elastic.co/t/type-parsing-exception-reason-unknown-query-aggs-elasticsearch-node-js-client/281402 "2021-09-14T14:11:42Z")
Hi, I want to connect to elasticsearch through elasticsearch node js client. I'm using search api and want to run few aggregation to calculate the total count of docs which passes the given condition. However, im gettin… --- ## [Installed Elasticsearch docker does not have a password](https://discuss.elastic.co/t/installed-elasticsearch-docker-does-not-have-a-password/281805)
**Author:** [@evo](https://discuss.elastic.co/u/evo)\ **Replies:** 6\ **Last updated:** [September 14, 2021, 2:10pm UTC](https://discuss.elastic.co/t/installed-elasticsearch-docker-does-not-have-a-password/281805 "2021-09-14T14:10:55Z")
I have just following the docker installation guide and have got ES up and running but anyone can add documents to it. I am confused on how to secure it. Is the authentication only pre-configured in the paid version? W… --- ## [Logstash refuses to bind to port 9600](https://discuss.elastic.co/t/logstash-refuses-to-bind-to-port-9600/284183)
**Author:** [@Dan\_Sputnikk](https://discuss.elastic.co/u/Dan_Sputnikk)\ **Replies:** 3\ **Last updated:** [September 14, 2021, 2:04pm UTC](https://discuss.elastic.co/t/logstash-refuses-to-bind-to-port-9600/284183 "2021-09-14T14:04:20Z")
Hi all, Using Logstash 6. I have: http.host: "0.0.0.0" http.port: 9600-9700 xpack.monitoring.enabled: true xpack.monitoring.elasticsearch.hosts: \["http://10.1.96.89:9200", "http://10.1.96.90:9200", "http://10.1.96.9… --- ## [Geo\_shape size and elastic performance](https://discuss.elastic.co/t/geo-shape-size-and-elastic-performance/283920)
**Author:** [@rgwozdz](https://discuss.elastic.co/u/rgwozdz)\ **Replies:** 4\ **Last updated:** [September 14, 2021, 1:30pm UTC](https://discuss.elastic.co/t/geo-shape-size-and-elastic-performance/283920 "2021-09-14T13:30:44Z")
We have an index that contains about 5 million documents. About 20% will have a geo\_shape field that contains polygon data. I need to support intersect queries on these geo\_shapes. Some of these polygons are very comp… --- ## [Need help with conditional only if field contains a period](https://discuss.elastic.co/t/need-help-with-conditional-only-if-field-contains-a-period/284126)
**Author:** [@pcharles1](https://discuss.elastic.co/u/pcharles1)\ **Replies:** 2\ **Last updated:** [September 14, 2021, 1:04pm UTC](https://discuss.elastic.co/t/need-help-with-conditional-only-if-field-contains-a-period/284126 "2021-09-14T13:04:44Z")
I'm trying to grok the host name field only if it contains a period using the conditional below: if (\[host\]\[name\] =~ ".") { grok host.name field } For some reason, when the host name field doesn't contain a period, I g… --- ## [Stop token filter how to set whitespace char as stop word in stopwords\_path config file](https://discuss.elastic.co/t/stop-token-filter-how-to-set-whitespace-char-as-stop-word-in-stopwords-path-config-file/282429)
**Author:** [@chenchuangc](https://discuss.elastic.co/u/chenchuangc)\ **Replies:** 2\ **Last updated:** [September 14, 2021, 1:02pm UTC](https://discuss.elastic.co/t/stop-token-filter-how-to-set-whitespace-char-as-stop-word-in-stopwords-path-config-file/282429 "2021-09-14T13:02:52Z")
Elasticsearch 7.5 thank you for help me ! i want to set the stop word by the stopwords\_path , i set a lot word in the stopwords.txt file , most of the word in the file is effective but only the whitespace char is not e… --- ## [Pagerduty - Set Urgency - Feature Request](https://discuss.elastic.co/t/pagerduty-set-urgency-feature-request/283717)
**Author:** [@bevano](https://discuss.elastic.co/u/bevano)\ **Replies:** 1\ **Last updated:** [September 14, 2021, 12:58pm UTC](https://discuss.elastic.co/t/pagerduty-set-urgency-feature-request/283717 "2021-09-14T12:58:11Z")
Within Pagerduty there is a concept of 'urgency' for incidents. Based on the level of urgency different rules get applied. This should be configurable within Kibana to set the Urgency. I see this was previously raised f… --- ## [Change event name based on type](https://discuss.elastic.co/t/change-event-name-based-on-type/284129)
**Author:** [@antonisnyc94](https://discuss.elastic.co/u/antonisnyc94)\ **Replies:** 1\ **Last updated:** [September 14, 2021, 12:48pm UTC](https://discuss.elastic.co/t/change-event-name-based-on-type/284129 "2021-09-14T12:48:30Z")
Hello, I am having a field which is an object but sometimes it's a string. I'm using the below ruby code but for some reason im still getting an error.. Does anyone know why? if event.get("\[data\]\[aws\]\[configuration\]\[s… --- ## [Is it possible to make the custom dashboard links use current dashboard time along with the applied filters?](https://discuss.elastic.co/t/is-it-possible-to-make-the-custom-dashboard-links-use-current-dashboard-time-along-with-the-applied-filters/283203)
**Author:** [@BitBucketUser\_user](https://discuss.elastic.co/u/BitBucketUser_user)\ **Replies:** 2\ **Last updated:** [September 14, 2021, 12:40pm UTC](https://discuss.elastic.co/t/is-it-possible-to-make-the-custom-dashboard-links-use-current-dashboard-time-along-with-the-applied-filters/283203 "2021-09-14T12:40:25Z")
Hello, I used URL formatting option on some of my index pattern fields. These URLs basically redirect me to a different dedicated dashboard when clicked. The dashboard redirection is working very well where the clicked… --- ## [Setting xpack.enabled via Metricbeat Docker hints](https://discuss.elastic.co/t/setting-xpack-enabled-via-metricbeat-docker-hints/284161)
**Author:** [@thilog](https://discuss.elastic.co/u/thilog)\ **Replies:** 1\ **Last updated:** [September 14, 2021, 11:40am UTC](https://discuss.elastic.co/t/setting-xpack-enabled-via-metricbeat-docker-hints/284161 "2021-09-14T11:40:11Z")
Hi there, is there a way to set the xpack.enabled flag for via Metricbeat Docker hints? I tried using the co.elastic.metrics/xpack.enabled label (on the monitored container), but it does not seem to have an effect. Alt… --- ## [Winlogbeat parse CAPI2 Log](https://discuss.elastic.co/t/winlogbeat-parse-capi2-log/282637)
**Author:** [@Marcel\_Palme](https://discuss.elastic.co/u/Marcel_Palme)\ **Replies:** 2\ **Last updated:** [September 14, 2021, 11:20am UTC](https://discuss.elastic.co/t/winlogbeat-parse-capi2-log/282637 "2021-09-14T11:20:27Z")
I check the capi2 log in windows. The transmission to Elastic also works partially. Only that not all fields are transferred. Specifically, I need the field under Userdata | certverifyCertificateChainPolicy | certificat… --- ## [How to calculate the time a request remains in the queue](https://discuss.elastic.co/t/how-to-calculate-the-time-a-request-remains-in-the-queue/284128)
**Author:** [@Higor](https://discuss.elastic.co/u/Higor)\ **Replies:** 2\ **Last updated:** [September 14, 2021, 11:18am UTC](https://discuss.elastic.co/t/how-to-calculate-the-time-a-request-remains-in-the-queue/284128 "2021-09-14T11:18:51Z")
I need to find some way to calculate how long a request remains in the queue. --- ## [Logstash kafka input plugin mutate problem](https://discuss.elastic.co/t/logstash-kafka-input-plugin-mutate-problem/284156)
**Author:** [@d.silwon](https://discuss.elastic.co/u/d.silwon)\ **Replies:** 1\ **Last updated:** [September 14, 2021, 10:15am UTC](https://discuss.elastic.co/t/logstash-kafka-input-plugin-mutate-problem/284156 "2021-09-14T10:15:16Z")
Dears, I'm trying to load data from kafka topic but have some problem with if statement in filter. This part of the setup doesn't work and I don't know why: replace =\> { "\[@metadata\]\[index\_prefix\]" =\> "kafka-%{+YYYY.M… --- ## [Kibana Lens Visualization showing data as "other" where as I have values for that fields](https://discuss.elastic.co/t/kibana-lens-visualization-showing-data-as-other-where-as-i-have-values-for-that-fields/282659)
**Author:** [@sagar.pattnayak](https://discuss.elastic.co/u/sagar.pattnayak)\ **Replies:** 3\ **Last updated:** [September 14, 2021, 10:05am UTC](https://discuss.elastic.co/t/kibana-lens-visualization-showing-data-as-other-where-as-i-have-values-for-that-fields/282659 "2021-09-14T10:05:15Z")
Hi There, I have created a Kibana Lens visualization (Datatable) where I am showing some tabular data from my index. The problem I have is even if I have some values in one my field (documenttitle), it is showing as "ot… --- ## [Keyword seem to have disappeared](https://discuss.elastic.co/t/keyword-seem-to-have-disappeared/283685)
**Author:** [@Bibas](https://discuss.elastic.co/u/Bibas)\ **Replies:** 5\ **Last updated:** [September 14, 2021, 9:44am UTC](https://discuss.elastic.co/t/keyword-seem-to-have-disappeared/283685 "2021-09-14T09:44:04Z")
Hello I have logs coming from my application, in those logs, there is a "coType" field that used to be a text that contains a keyword subfield. For a reason that I ignore (I don't think I changed the conf file in month… --- ## [Detection and Response for CVE-2021-40444](https://discuss.elastic.co/t/detection-and-response-for-cve-2021-40444/283800)
**Author:** [@devonkerr](https://discuss.elastic.co/u/devonkerr)\ **Replies:** 1\ **Last updated:** [September 14, 2021, 9:46am UTC](https://discuss.elastic.co/t/detection-and-response-for-cve-2021-40444/283800 "2021-09-14T09:46:31Z")
Detection and Response for CVE-2021-40444 Executive summary Elastic Security Intelligence & Analytics has identified additional behaviors related to or inspired by the disclosure of CVE-2021-40444, a remote code executio… --- ## [Getting errors in web console log after loading Kibana dashboard](https://discuss.elastic.co/t/getting-errors-in-web-console-log-after-loading-kibana-dashboard/284154)
**Author:** [@pranay\_jain](https://discuss.elastic.co/u/pranay_jain)\ **Replies:** 1\ **Last updated:** [September 14, 2021, 9:42am UTC](https://discuss.elastic.co/t/getting-errors-in-web-console-log-after-loading-kibana-dashboard/284154 "2021-09-14T09:42:19Z")
I have Kibana version 7.14.1 installed. After loading the dashboard I noticed that few errors displayed are being on the web console. Refused to execute inline script because it violates the following Content Security P… --- ## [Not exists query](https://discuss.elastic.co/t/not-exists-query/284052)
**Author:** [@ilgrosso](https://discuss.elastic.co/u/ilgrosso)\ **Replies:** 3\ **Last updated:** [September 14, 2021, 9:40am UTC](https://discuss.elastic.co/t/not-exists-query/284052 "2021-09-14T09:40:50Z")
Negating the exists query as suggested by docs does not seem to work as I would intend it, at least with Elasticsearch 7.14. When I send GET to /master\_user/\_search with payload { "query": { "bool": { "must… [Previous page](https://discuss.elastic.co/latest.md?page=1477) [Next page](https://discuss.elastic.co/latest.md?page=1479)