# Latest

**URL:** https://discuss.elastic.co/latest.md?page=1528

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1529

---

## [Metricbeat Perfmon configuration help](https://discuss.elastic.co/t/metricbeat-perfmon-configuration-help/280526)

<div class="topic-metadata">

**Author:** [@JP00](https://discuss.elastic.co/u/JP00)\
**Replies:** 1\
**Last updated:** [August 13, 2021, 12:00am UTC](https://discuss.elastic.co/t/metricbeat-perfmon-configuration-help/280526 "2021-08-13T00:00:00Z")

</div>

Hi, I'm new to the ELK stack and I'm currently trying to configure an environment that sends basic Windows server performance metrics (CPU/RAM usage, HDD space remaining, etc.) to a remote Kibana server. Currently I hav…

---

## [Problem with filebeat configuration \[windows\]](https://discuss.elastic.co/t/problem-with-filebeat-configuration-windows/281069)

<div class="topic-metadata">

**Author:** [@KarolinaSii](https://discuss.elastic.co/u/KarolinaSii)\
**Replies:** 1\
**Last updated:** [August 12, 2021, 10:56pm UTC](https://discuss.elastic.co/t/problem-with-filebeat-configuration-windows/281069 "2021-08-12T22:56:10Z")

</div>

Hi, I have problem with filebeat in Windows 10. I've got an error 2021-08-11T15:09:17.139+0200 ERROR instance/beat.go:989 Exiting: setup.template.name and setup.template.pattern have to be set if index name is…

---

## [Using rsyslog server & reporting agent name](https://discuss.elastic.co/t/using-rsyslog-server-reporting-agent-name/281270)

<div class="topic-metadata">

**Author:** [@droidus](https://discuss.elastic.co/u/droidus)\
**Replies:** 1\
**Last updated:** [August 12, 2021, 10:34pm UTC](https://discuss.elastic.co/t/using-rsyslog-server-reporting-agent-name/281270 "2021-08-12T22:34:44Z")

</div>

I am using a rsyslog server. I have several of my machines forwardring their logs there, then elastic picks them up. I am going through one of the records, and notice that the hostname is rsyslog, but then when I look …

---

## [Embedded iframe Kibana Login Loop on Mobile Browsers](https://discuss.elastic.co/t/embedded-iframe-kibana-login-loop-on-mobile-browsers/280859)

<div class="topic-metadata">

**Author:** [@lifeowl](https://discuss.elastic.co/u/lifeowl)\
**Replies:** 4\
**Last updated:** [August 12, 2021, 10:04pm UTC](https://discuss.elastic.co/t/embedded-iframe-kibana-login-loop-on-mobile-browsers/280859 "2021-08-12T22:04:31Z")

</div>

Hi there, As described in Kibana stuck in login loop, Google Chrome will no longer store non-secure cookies as of Release 84, which results in an authentication loop if Kibana is embedded in an iframe on an HTTP website…

---

## [Mapping Tenable (Nessus) scan reportitems to ECS vulnerability field set](https://discuss.elastic.co/t/mapping-tenable-nessus-scan-reportitems-to-ecs-vulnerability-field-set/280543)

<div class="topic-metadata">

**Author:** [@Gerry7](https://discuss.elastic.co/u/Gerry7)\
**Replies:** 3\
**Last updated:** [August 12, 2021, 9:54pm UTC](https://discuss.elastic.co/t/mapping-tenable-nessus-scan-reportitems-to-ecs-vulnerability-field-set/280543 "2021-08-12T21:54:41Z")

</div>

We are attempting to map Tenable (Nessus) scan report items to the ECS vulnerability field set. The Tenable scan report may include multiple vulnerability identifiers related to the detected vulnerability where each vuln…

---

## [Questions About Elasticsearch](https://discuss.elastic.co/t/questions-about-elasticsearch/281266)

<div class="topic-metadata">

**Author:** [@Jared9922](https://discuss.elastic.co/u/Jared9922)\
**Replies:** 2\
**Last updated:** [August 12, 2021, 9:45pm UTC](https://discuss.elastic.co/t/questions-about-elasticsearch/281266 "2021-08-12T21:45:21Z")

</div>

Hello I just had some quick questions on Elasticsearch that have to do with network configuration. My first question is this, can you send data to Elasticsearch using the default .yml settings? For example if Elasticse…

---

## [How to create a rule that compares two dynamic numbers](https://discuss.elastic.co/t/how-to-create-a-rule-that-compares-two-dynamic-numbers/281269)

<div class="topic-metadata">

**Author:** [@Carrie](https://discuss.elastic.co/u/Carrie)\
**Replies:** 0\
**Last updated:** [August 12, 2021, 9:40pm UTC](https://discuss.elastic.co/t/how-to-create-a-rule-that-compares-two-dynamic-numbers/281269 "2021-08-12T21:40:03Z")

</div>

Hi there, I am new to ELK. Currently I have 3 applications talking with each other. I want to check if the message actually gets sent. When the message gets sent or received, it will print out some logging For instance…

---

## [ILM Create indices with a date pattern in their name](https://discuss.elastic.co/t/ilm-create-indices-with-a-date-pattern-in-their-name/281256)

<div class="topic-metadata">

**Author:** [@robertknutzen](https://discuss.elastic.co/u/robertknutzen)\
**Replies:** 0\
**Last updated:** [August 12, 2021, 7:59pm UTC](https://discuss.elastic.co/t/ilm-create-indices-with-a-date-pattern-in-their-name/281256 "2021-08-12T19:59:39Z")

</div>

I am attempting to migrate a logstash cluster that has been running since dinosaurs roamed the earth to use ILM. We use curator to manage our hot/warm indices and only delete data manually with human approval. I only r…

---

## [Probem with file imput](https://discuss.elastic.co/t/probem-with-file-imput/281261)

<div class="topic-metadata">

**Author:** [@KarlWolf](https://discuss.elastic.co/u/KarlWolf)\
**Replies:** 1\
**Last updated:** [August 12, 2021, 8:46pm UTC](https://discuss.elastic.co/t/probem-with-file-imput/281261 "2021-08-12T20:46:29Z")

</div>

Hello everyone, I'm having a strange behaviour with my Logstash. I'm stucked on the following problem: I had a one flow configured where I had file input and that worked brilliant. Then I added to my flow udp input...…

---

## [Is it possible to set default number of replicas in elasticsearch](https://discuss.elastic.co/t/is-it-possible-to-set-default-number-of-replicas-in-elasticsearch/281215)

<div class="topic-metadata">

**Author:** [@Shreesh\_Narayanan](https://discuss.elastic.co/u/Shreesh_Narayanan)\
**Replies:** 1\
**Last updated:** [August 12, 2021, 8:44pm UTC](https://discuss.elastic.co/t/is-it-possible-to-set-default-number-of-replicas-in-elasticsearch/281215 "2021-08-12T20:44:19Z")

</div>

hello, Mine is a single node set up , and hence no replicas are assigned (i think ?) . Is it possible to set default replica number as 0 in elasticsearch.yml ? GET /\_cat/allocation?v shards disk.indices disk.used d…

---

## [Logstash.bat immediately errors out with \\Java\\jdk-11.0.12 was unexpected at this time](https://discuss.elastic.co/t/logstash-bat-immediately-errors-out-with-java-jdk-11-0-12-was-unexpected-at-this-time/281264)

<div class="topic-metadata">

**Author:** [@rjcpayne699](https://discuss.elastic.co/u/rjcpayne699)\
**Replies:** 1\
**Last updated:** [August 12, 2021, 8:41pm UTC](https://discuss.elastic.co/t/logstash-bat-immediately-errors-out-with-java-jdk-11-0-12-was-unexpected-at-this-time/281264 "2021-08-12T20:41:55Z")

</div>

Just trying my first local run of logstash after installation on windows 10. I performed the first steps to validate jvm: PS C:\\logstash-7.14.0\> Write-Host $env:JAVA\_HOME C:\\Program Files (x86)\\Java\\jdk-11.0.12 PS C:\\…

---

## [Boolean Query causing server to crash without error message](https://discuss.elastic.co/t/boolean-query-causing-server-to-crash-without-error-message/281260)

<div class="topic-metadata">

**Author:** [@cstone1492](https://discuss.elastic.co/u/cstone1492)\
**Replies:** 0\
**Last updated:** [August 12, 2021, 8:11pm UTC](https://discuss.elastic.co/t/boolean-query-causing-server-to-crash-without-error-message/281260 "2021-08-12T20:11:06Z")

</div>

Hi, I am using version 7.3. A boolean query I'm running (see code below) in a python script is causing the server script to crash without producing any form of error message. The query is within a for-loop, and the crash…

---

## [Painless Access array object](https://discuss.elastic.co/t/painless-access-array-object/281253)

<div class="topic-metadata">

**Author:** [@Aaish\_Sindwani](https://discuss.elastic.co/u/Aaish_Sindwani)\
**Replies:** 0\
**Last updated:** [August 12, 2021, 7:28pm UTC](https://discuss.elastic.co/t/painless-access-array-object/281253 "2021-08-12T19:28:28Z")

</div>

HI Team, I am trying to access an array object within the source in the painless script but I am not able to with the error "failed\_shards" : \[ { "shard" : 0, "index" : "boxIndex", "node" …

---

## [Dashboards and Searches not importing using the Saved Objects API](https://discuss.elastic.co/t/dashboards-and-searches-not-importing-using-the-saved-objects-api/280690)

<div class="topic-metadata">

**Author:** [@mhare](https://discuss.elastic.co/u/mhare)\
**Replies:** 2\
**Last updated:** [August 12, 2021, 7:21pm UTC](https://discuss.elastic.co/t/dashboards-and-searches-not-importing-using-the-saved-objects-api/280690 "2021-08-12T19:21:22Z")

</div>

I am using stack version 7.13.4 on Windows I created a system including Queries, Searches, Dashboards, Visualizations, Index Patterns. I exported these using the Kibana UI creating ndjson files for each category. I can …

---

## [Grok works on Grok debugger but got Grokparsefailure in logstash](https://discuss.elastic.co/t/grok-works-on-grok-debugger-but-got-grokparsefailure-in-logstash/281227)

<div class="topic-metadata">

**Author:** [@syunusic](https://discuss.elastic.co/u/syunusic)\
**Replies:** 5\
**Last updated:** [August 12, 2021, 6:55pm UTC](https://discuss.elastic.co/t/grok-works-on-grok-debugger-but-got-grokparsefailure-in-logstash/281227 "2021-08-12T18:55:34Z")

</div>

If I go to http://grokdebug.herokuapp.com/ or the GROK debugger in Kibana and use this sample and this grok, works fine.. but if I run it in logstash, I get a grokfailure tag: Sample: NSX 2281528 - \[nsx@6876 comp=\\"nsx…

---

## [Openness in Elastic Security's Agent artifacts](https://discuss.elastic.co/t/openness-in-elastic-securitys-agent-artifacts/281121)

<div class="topic-metadata">

**Author:** [@mark.dufresne](https://discuss.elastic.co/u/mark.dufresne)\
**Replies:** 1\
**Last updated:** [August 12, 2021, 6:51pm UTC](https://discuss.elastic.co/t/openness-in-elastic-securitys-agent-artifacts/281121 "2021-08-12T18:51:21Z")

</div>

You may have seen the twitter thread regarding a security researcher decrypting our endpoint protection artifacts in Elastic Agent. Our vision at Elastic Security is to protect the world’s data from attack by making secu…

---

## [How to use the iframe on an external page already authenticated](https://discuss.elastic.co/t/how-to-use-the-iframe-on-an-external-page-already-authenticated/280598)

<div class="topic-metadata">

**Author:** [@francieliton\_araujo](https://discuss.elastic.co/u/francieliton_araujo)\
**Replies:** 1\
**Last updated:** [August 12, 2021, 6:33pm UTC](https://discuss.elastic.co/t/how-to-use-the-iframe-on-an-external-page-already-authenticated/280598 "2021-08-12T18:33:26Z")

</div>

It would be possible, for example, from the tooth of another web tool, like: zabbix, to access a kibana dash. My intention is to get from within zabbix, create a page that opens a graphic of the kibana, without the pe…

---

## [Is it possible to use Angular Navbar Component in Kibana?](https://discuss.elastic.co/t/is-it-possible-to-use-angular-navbar-component-in-kibana/280587)

<div class="topic-metadata">

**Author:** [@raghosh](https://discuss.elastic.co/u/raghosh)\
**Replies:** 1\
**Last updated:** [August 12, 2021, 6:22pm UTC](https://discuss.elastic.co/t/is-it-possible-to-use-angular-navbar-component-in-kibana/280587 "2021-08-12T18:22:41Z")

</div>

Basically we have common Navbar across all application which is built in angular and adapt , all forntend Microservices uses that. WE have Kibana as UI service but currently it doesnt have the navbar integrated . Is ther…

---

## [Error to send test email fron kibana connector](https://discuss.elastic.co/t/error-to-send-test-email-fron-kibana-connector/280567)

<div class="topic-metadata">

**Author:** [@perea870724](https://discuss.elastic.co/u/perea870724)\
**Replies:** 1\
**Last updated:** [August 12, 2021, 6:17pm UTC](https://discuss.elastic.co/t/error-to-send-test-email-fron-kibana-connector/280567 "2021-08-12T18:17:58Z")

</div>

Hello, friends of the community, I am facing a problem when configuring the sending of email through connector, when I perform a test I get the following error: Action failed to run The following error was found: erro…

---

## [Elasticsearch и регулярные обновления данных](https://discuss.elastic.co/t/elasticsearch/281175)

<div class="topic-metadata">

**Author:** [@grserg](https://discuss.elastic.co/u/grserg)\
**Replies:** 1\
**Last updated:** [August 12, 2021, 6:15pm UTC](https://discuss.elastic.co/t/elasticsearch/281175 "2021-08-12T18:15:12Z")

</div>

Добрый день! Есть индекс, в котором хранятся тексты статей (заголовок, тело) и помимо этих данных есть некоторые целочисленные поля, которые необходимо ежедневно обновлять у всех документов (в индексе около 2.5 миллионо…

---

## [How to use the root of Spanish words for searches?](https://discuss.elastic.co/t/how-to-use-the-root-of-spanish-words-for-searches/280558)

<div class="topic-metadata">

**Author:** [@JavierArevalo](https://discuss.elastic.co/u/JavierArevalo)\
**Replies:** 1\
**Last updated:** [August 12, 2021, 6:13pm UTC](https://discuss.elastic.co/t/how-to-use-the-root-of-spanish-words-for-searches/280558 "2021-08-12T18:13:39Z")

</div>

I need to search my documents by words, I want to obtain all the documents related to a word and its derivations in Spanish, for example: if I search for "flor" I want to obtain all the documents related to the words: "f…

---

## [How to disable attempts to connect to the package registry?](https://discuss.elastic.co/t/how-to-disable-attempts-to-connect-to-the-package-registry/280516)

<div class="topic-metadata">

**Author:** [@fadenb](https://discuss.elastic.co/u/fadenb)\
**Replies:** 1\
**Last updated:** [August 12, 2021, 6:07pm UTC](https://discuss.elastic.co/t/how-to-disable-attempts-to-connect-to-the-package-registry/280516 "2021-08-12T18:07:04Z")

</div>

Hi, We are operating an Elastic stack in an environment that is intentionally unable to access the outside world/internet. When we browse to our Kibana dashboards, we see that our browsers are trying to fetch /api/flee…

---

## [Kibana canvas: how to add the values of 2 elements](https://discuss.elastic.co/t/kibana-canvas-how-to-add-the-values-of-2-elements/280166)

<div class="topic-metadata">

**Author:** [@gabor](https://discuss.elastic.co/u/gabor)\
**Replies:** 1\
**Last updated:** [August 12, 2021, 5:53pm UTC](https://discuss.elastic.co/t/kibana-canvas-how-to-add-the-values-of-2-elements/280166 "2021-08-12T17:53:03Z")

</div>

Hi, I have two markdown elements on canvas showing the results of the same essql query but for 2 different IP addresses. I need a 3rd, which should hold the sum of the values from these 2 elements. I tried to create a …

---

## [Unable to Start Logstash with Elasticsearch - "Attempted to resurrect connection to dead ES instance"](https://discuss.elastic.co/t/unable-to-start-logstash-with-elasticsearch-attempted-to-resurrect-connection-to-dead-es-instance/281241)

<div class="topic-metadata">

**Author:** [@jdurga](https://discuss.elastic.co/u/jdurga)\
**Replies:** 1\
**Last updated:** [August 12, 2021, 5:46pm UTC](https://discuss.elastic.co/t/unable-to-start-logstash-with-elasticsearch-attempted-to-resurrect-connection-to-dead-es-instance/281241 "2021-08-12T17:46:55Z")

</div>

I've followed these steps: https://github.com/virtualtechmeetup/0003\_howto\_elasticsearch\_kibana\_install\_ubuntu I would like to send Syslog traffic from Logstash to Datadog and Elasticsearch. Really just using Elasticse…

---

## [Logstash "if statement" not working for logs from winlogbeat 7.13.2 (works on older version)](https://discuss.elastic.co/t/logstash-if-statement-not-working-for-logs-from-winlogbeat-7-13-2-works-on-older-version/281179)

<div class="topic-metadata">

**Author:** [@heikis](https://discuss.elastic.co/u/heikis)\
**Replies:** 0\
**Last updated:** [August 12, 2021, 9:57am UTC](https://discuss.elastic.co/t/logstash-if-statement-not-working-for-logs-from-winlogbeat-7-13-2-works-on-older-version/281179 "2021-08-12T09:57:05Z")

</div>

Hello. I have a weird problem with Logstash filtering. I am sending logs from several different winlogbeat agents to logstash for processing. I have winlogbeats agents with different versions- 7.9.1 and 7.13.2. Logsta…

---

## [Elasticsearch regexp for all fields](https://discuss.elastic.co/t/elasticsearch-regexp-for-all-fields/281237)

<div class="topic-metadata">

**Author:** [@ChinigamiHunter](https://discuss.elastic.co/u/ChinigamiHunter)\
**Replies:** 0\
**Last updated:** [August 12, 2021, 5:26pm UTC](https://discuss.elastic.co/t/elasticsearch-regexp-for-all-fields/281237 "2021-08-12T17:26:02Z")

</div>

I need to write query to find regexp match any fields. i write a regexp match one field (laravel). $params = \[ 'index' =\> 'index', 'type' =\> '\_doc', 'body' =\> \[ …

---

## [Match phrase any query in elastic search](https://discuss.elastic.co/t/match-phrase-any-query-in-elastic-search/281236)

<div class="topic-metadata">

**Author:** [@vradder](https://discuss.elastic.co/u/vradder)\
**Replies:** 0\
**Last updated:** [August 12, 2021, 5:25pm UTC](https://discuss.elastic.co/t/match-phrase-any-query-in-elastic-search/281236 "2021-08-12T17:25:05Z")

</div>

match phrase query will match full phrase. match phrase prefix query will match phrase as prefix. ex: "my\_field": "confidence ab" will match "confidence above" and "confidence about". is there query for "match phrase…

---

## [Logstash setup with Docker - \[exits after ~25s\]\[not able to find the problem\]](https://discuss.elastic.co/t/logstash-setup-with-docker-exits-after-25s-not-able-to-find-the-problem/281211)

<div class="topic-metadata">

**Author:** [@Jno\_Zrc](https://discuss.elastic.co/u/Jno_Zrc)\
**Replies:** 2\
**Last updated:** [August 12, 2021, 5:01pm UTC](https://discuss.elastic.co/t/logstash-setup-with-docker-exits-after-25s-not-able-to-find-the-problem/281211 "2021-08-12T17:01:09Z")

</div>

Hi all, I'm trying to insert a large csv file in Elasticsearch using Logstash. I manage to make it work, but after a while testing some different mutate transformations it stopped working. I even tried a minimal confi…

---

## [Transport Error Unauthorized](https://discuss.elastic.co/t/transport-error-unauthorized/280476)

<div class="topic-metadata">

**Author:** [@agentw](https://discuss.elastic.co/u/agentw)\
**Replies:** 11\
**Last updated:** [August 12, 2021, 4:33pm UTC](https://discuss.elastic.co/t/transport-error-unauthorized/280476 "2021-08-12T16:33:31Z")

</div>

I upgraded our cluster to 7.14, and after the update for Logstash I received "Pipeline error {:pipeline\_id=\>"main", :exception=\>#\<Elasticsearch::Transport::Transport::Errors::Unauthorized: \[401\]". I was able to isolate i…

---

## [Store.size is not equal to (primary count + replica count) \* pri.store.size](https://discuss.elastic.co/t/store-size-is-not-equal-to-primary-count-replica-count-pri-store-size/281190)

<div class="topic-metadata">

**Author:** [@Stanislav\_Livotov](https://discuss.elastic.co/u/Stanislav_Livotov)\
**Replies:** 3\
**Last updated:** [August 12, 2021, 4:15pm UTC](https://discuss.elastic.co/t/store-size-is-not-equal-to-primary-count-replica-count-pri-store-size/281190 "2021-08-12T16:15:15Z")

</div>

Hi all, I have index configuration, with just 1 shard, 1 primary and 1 replica. When I’m invoking \_cat/indices I’m expecting to see that my store.size will be equal to 2 \*pri.store.size, however it is not so. health s…

[Previous page](https://discuss.elastic.co/latest.md?page=1527)

[Next page](https://discuss.elastic.co/latest.md?page=1529)
