# Latest **URL:** https://discuss.elastic.co/latest.md?page=1588 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1589 --- ## [Enrich policy match using wildcard or fuzzy search](https://discuss.elastic.co/t/enrich-policy-match-using-wildcard-or-fuzzy-search/277374)
**Author:** [@sam3546](https://discuss.elastic.co/u/sam3546)\ **Replies:** 1\ **Last updated:** [July 5, 2021, 11:45am UTC](https://discuss.elastic.co/t/enrich-policy-match-using-wildcard-or-fuzzy-search/277374 "2021-07-05T11:45:58Z")
I have an ingest pipeline with an enrich policy and separate index (index B) Index B has entries that have a url and a number For each document i ingest via the pipeline i want to match with an entry in index B and ret… --- ## [Microsoft DNS - parsing different length of domain name](https://discuss.elastic.co/t/microsoft-dns-parsing-different-length-of-domain-name/277430)
**Author:** [@gmaimbourg](https://discuss.elastic.co/u/gmaimbourg)\ **Replies:** 4\ **Last updated:** [July 5, 2021, 11:45am UTC](https://discuss.elastic.co/t/microsoft-dns-parsing-different-length-of-domain-name/277430 "2021-07-05T11:45:32Z")
Hello, I'am working on Microsoft DNS log parsing and i don't know how can i parse different lengh of domain name. Here is different examples of what i want to get : (2)ui(12)powerreviews(3)com(0) into ui.powerreviews.… --- ## [Active Rule Delete Alert](https://discuss.elastic.co/t/active-rule-delete-alert/277823)
**Author:** [@ephemeric](https://discuss.elastic.co/u/ephemeric)\ **Replies:** 0\ **Last updated:** [July 5, 2021, 11:34am UTC](https://discuss.elastic.co/t/active-rule-delete-alert/277823 "2021-07-05T11:34:52Z")
Hi, I have a rule called "Website", type "Uptime monitor status" and with "Actions Email". I added a monitor of type "icmp" to ping the website in my heartbeat.conf. I forgot our website does not respond to ICMP and ha… --- ## [How bucket the count into per second](https://discuss.elastic.co/t/how-bucket-the-count-into-per-second/277774)
**Author:** [@missylearner](https://discuss.elastic.co/u/missylearner)\ **Replies:** 2\ **Last updated:** [July 5, 2021, 11:21am UTC](https://discuss.elastic.co/t/how-bucket-the-count-into-per-second/277774 "2021-07-05T11:21:43Z")
Anyone knows how to query in the script to bucket the counts into seconds. because in kibana if we filter timestamp of the count by seconds it will automatically scale to 5 seconds. --- ## [\[400\] Bad request - Parsing Error on /\_field\_caps](https://discuss.elastic.co/t/400-bad-request-parsing-error-on-field-caps/275303)
**Author:** [@bcros](https://discuss.elastic.co/u/bcros)\ **Replies:** 1\ **Last updated:** [July 5, 2021, 11:04am UTC](https://discuss.elastic.co/t/400-bad-request-parsing-error-on-field-caps/275303 "2021-07-05T11:04:50Z")
Hello, After \_reindex, i have the HTTP 400 error with response below, when trying to call /\_field\_caps?fields=\* or /target/\_field\_caps?fields=\*, whatever target is. Anyone have an idea how to fix this ? Did i miss so… --- ## [Transform stability](https://discuss.elastic.co/t/transform-stability/274870)
**Author:** [@alexs1](https://discuss.elastic.co/u/alexs1)\ **Replies:** 19\ **Last updated:** [July 5, 2021, 10:28am UTC](https://discuss.elastic.co/t/transform-stability/274870 "2021-07-05T10:28:40Z")
Hello I've started to use transforms, and they are great- saving lots of pain of using external tools. What concerns me, is the I had few times a load on the cluster, which caused a node to leave the cluster, and cause… --- ## [How far ACID properties are supported](https://discuss.elastic.co/t/how-far-acid-properties-are-supported/277802)
**Author:** [@sarthaksahu](https://discuss.elastic.co/u/sarthaksahu)\ **Replies:** 3\ **Last updated:** [July 5, 2021, 10:08am UTC](https://discuss.elastic.co/t/how-far-acid-properties-are-supported/277802 "2021-07-05T10:08:57Z")
How far ACID properties are supported by Elastic Search. --- ## [Restore updated transform](https://discuss.elastic.co/t/restore-updated-transform/277781)
**Author:** [@alexs1](https://discuss.elastic.co/u/alexs1)\ **Replies:** 2\ **Last updated:** [July 5, 2021, 10:04am UTC](https://discuss.elastic.co/t/restore-updated-transform/277781 "2021-07-05T10:04:05Z")
Hello, Is there any option to restore an updated transform to previous definition before the update? (source/sync etc) thank you --- ## [Kibana not upgrading from 7.12.0 to 7.13.2](https://discuss.elastic.co/t/kibana-not-upgrading-from-7-12-0-to-7-13-2/277649)
**Author:** [@Kay\_Khan](https://discuss.elastic.co/u/Kay_Khan)\ **Replies:** 2\ **Last updated:** [July 5, 2021, 10:02am UTC](https://discuss.elastic.co/t/kibana-not-upgrading-from-7-12-0-to-7-13-2/277649 "2021-07-05T10:02:00Z")
What did you do? I tried upgrading from 7.12.0 to 7.13.2 What did you expect to see? I expected the version to go to 7.13.2 What did you see instead? Under which circumstances? There was no change running kubectl ge… --- ## [\_update\_by\_query can't fill subfields in some documents](https://discuss.elastic.co/t/update-by-query-cant-fill-subfields-in-some-documents/277804)
**Author:** [@\_anton](https://discuss.elastic.co/u/_anton)\ **Replies:** 0\ **Last updated:** [July 5, 2021, 9:46am UTC](https://discuss.elastic.co/t/update-by-query-cant-fill-subfields-in-some-documents/277804 "2021-07-05T09:46:19Z")
After dinamically updating index mapping (I added new subfield with a lowercase normaliizer), I ran an \_update\_by\_query task to fill subfield with normalized values. However the task doesn't create subfield for several d… --- ## [Kibana Monitoring with Metricbeat](https://discuss.elastic.co/t/kibana-monitoring-with-metricbeat/277660)
**Author:** [@spike83](https://discuss.elastic.co/u/spike83)\ **Replies:** 3\ **Last updated:** [July 5, 2021, 9:44am UTC](https://discuss.elastic.co/t/kibana-monitoring-with-metricbeat/277660 "2021-07-05T09:44:33Z")
Hi, I'm trying to monitor Kibana using metricbeat - pretty standard Im having an issue where Metricbeat is getting a forbidden response from the Kibana URL. I have tested using an curl with the same credentials and it … --- ## [Set up logging settings for filebeat as environment variables](https://discuss.elastic.co/t/set-up-logging-settings-for-filebeat-as-environment-variables/277648)
**Author:** [@vinci](https://discuss.elastic.co/u/vinci)\ **Replies:** 1\ **Last updated:** [July 5, 2021, 9:30am UTC](https://discuss.elastic.co/t/set-up-logging-settings-for-filebeat-as-environment-variables/277648 "2021-07-05T09:30:00Z")
I've been searching for documentation regarding passing environmental variables to filebeat in order to set up logging, but I wasn't able to find out. Can anyone help me in this respect? I've only been able to find thi… --- ## [How to regulate filebeat memory usages](https://discuss.elastic.co/t/how-to-regulate-filebeat-memory-usages/277653)
**Author:** [@rp346](https://discuss.elastic.co/u/rp346)\ **Replies:** 1\ **Last updated:** [July 5, 2021, 9:24am UTC](https://discuss.elastic.co/t/how-to-regulate-filebeat-memory-usages/277653 "2021-07-05T09:24:41Z")
I have filebeat deployed in kubernetes with following configuration filebeat.ymlfilebeat.config: inputs: enabled: true path: inputs.d/\*.yml reload.enabled: true reload.period: 10s … --- ## [Metricbeat daemonset modules fails](https://discuss.elastic.co/t/metricbeat-daemonset-modules-fails/277683)
**Author:** [@rp346](https://discuss.elastic.co/u/rp346)\ **Replies:** 1\ **Last updated:** [July 5, 2021, 9:16am UTC](https://discuss.elastic.co/t/metricbeat-daemonset-modules-fails/277683 "2021-07-05T09:16:14Z")
I have configured following modules for metricbeat daemonset in AWS EKS modulessystem.yml: |- - module: system period: 10s metricsets: - cpu - load - memory - network … --- ## [Unable to start start fleet server](https://discuss.elastic.co/t/unable-to-start-start-fleet-server/277710)
**Author:** [@cheapsupps](https://discuss.elastic.co/u/cheapsupps)\ **Replies:** 1\ **Last updated:** [July 5, 2021, 8:45am UTC](https://discuss.elastic.co/t/unable-to-start-start-fleet-server/277710 "2021-07-05T08:45:54Z")
Hi, I am trying to start fleet server. However, I encounter the following error when starting it: Fleet Server - Error - info fail \[401 Unauthorized\] {"error":{"root\_cause":\[{"type":"security\_exception","reason":"faile… --- ## [Performance regression when using fast vector highlighting](https://discuss.elastic.co/t/performance-regression-when-using-fast-vector-highlighting/277788)
**Author:** [@rmchugh](https://discuss.elastic.co/u/rmchugh)\ **Replies:** 0\ **Last updated:** [July 5, 2021, 8:24am UTC](https://discuss.elastic.co/t/performance-regression-when-using-fast-vector-highlighting/277788 "2021-07-05T08:24:02Z")
Hiya, We are currently using the unified highlighter but have noticed some edge cases whereby the unified highlighter takes too long to return results in extremely large documents with lots of matches for a specific sea… --- ## [Error when trying to insert into the elastic index from java program](https://discuss.elastic.co/t/error-when-trying-to-insert-into-the-elastic-index-from-java-program/277787)
**Author:** [@karim.zahar](https://discuss.elastic.co/u/karim.zahar)\ **Replies:** 0\ **Last updated:** [July 5, 2021, 8:17am UTC](https://discuss.elastic.co/t/error-when-trying-to-insert-into-the-elastic-index-from-java-program/277787 "2021-07-05T08:17:50Z")
hello, I am getting the error bellow when trying to insert new rows into the elastic index, from a java program, the error is random: org.elasticsearch.client.transport.NoNodeAvailableException: None of the configured … --- ## [Error connecting to sql database](https://discuss.elastic.co/t/error-connecting-to-sql-database/277226)
**Author:** [@francieliton\_araujo](https://discuss.elastic.co/u/francieliton_araujo)\ **Replies:** 3\ **Last updated:** [July 5, 2021, 8:10am UTC](https://discuss.elastic.co/t/error-connecting-to-sql-database/277226 "2021-07-05T08:10:59Z")
I need help to connect to the sql server database. I downloaded a connector and already put n specific folder, but it's giving an error with the following. Note; I can already connect to mysql database but sql server w… --- ## [Elastic crash while import](https://discuss.elastic.co/t/elastic-crash-while-import/277593)
**Author:** [@Vladimir](https://discuss.elastic.co/u/Vladimir)\ **Replies:** 2\ **Last updated:** [July 5, 2021, 8:10am UTC](https://discuss.elastic.co/t/elastic-crash-while-import/277593 "2021-07-05T08:10:03Z")
I have Elasticsearch installed so I am playing with it. I made a bash script which generates simple documents with name, title, perex and text fields (text is 100 sentences of lorem ipsum) and send it via \_bulk api to E… --- ## [Long search time with mget](https://discuss.elastic.co/t/long-search-time-with-mget/277062)
**Author:** [@TheWorkingDeveloper](https://discuss.elastic.co/u/TheWorkingDeveloper)\ **Replies:** 2\ **Last updated:** [July 5, 2021, 8:07am UTC](https://discuss.elastic.co/t/long-search-time-with-mget/277062 "2021-07-05T08:07:54Z")
I currently have a single node with SSD running an elastic cluster. 4B records split over 25 primary shards in a single index (no replication). The ID of every record has been manually set as it is unique and known bef… --- ## [What is @timestamp field exactly?](https://discuss.elastic.co/t/what-is-timestamp-field-exactly/277189)
**Author:** [@ebuildy](https://discuss.elastic.co/u/ebuildy)\ **Replies:** 4\ **Last updated:** [July 5, 2021, 8:06am UTC](https://discuss.elastic.co/t/what-is-timestamp-field-exactly/277189 "2021-07-05T08:06:24Z")
Kibana version: 7.13.2 Elasticsearch version: 7.13.2 APM Server version: 7.13.2 APM Agent language and version: nodeJS / RUM We run a very busy web site, with continuous traffic, but as you can see from the image bel… --- ## [Window event Log correlate with AD user info enquiry](https://discuss.elastic.co/t/window-event-log-correlate-with-ad-user-info-enquiry/277618)
**Author:** [@Peter\_Ch](https://discuss.elastic.co/u/Peter_Ch)\ **Replies:** 4\ **Last updated:** [July 5, 2021, 7:59am UTC](https://discuss.elastic.co/t/window-event-log-correlate-with-ad-user-info-enquiry/277618 "2021-07-05T07:59:56Z")
Dear All, I'm new to Elasticsearch. I am finding a solution that can help to perform log correlation. Here's my situation. I have a application using window event as log. In the window event log, it includes user name … --- ## [Oracle BLOB column with jdbc input to base64](https://discuss.elastic.co/t/oracle-blob-column-with-jdbc-input-to-base64/276830)
**Author:** [@alexanders](https://discuss.elastic.co/u/alexanders)\ **Replies:** 3\ **Last updated:** [July 5, 2021, 7:54am UTC](https://discuss.elastic.co/t/oracle-blob-column-with-jdbc-input-to-base64/276830 "2021-07-05T07:54:03Z")
When fetching an Oracle BLOB column with logstash's jdbc input, I try to convert it to base64 using the following filter: ruby { code =\> 'event.set("b64", Base64.strict\_encode64(event.get("blob\_column")))' } wh… --- ## [All in one on ubuntu64 OS Raspberry Pi 4 4G fails at elastic-operator](https://discuss.elastic.co/t/all-in-one-on-ubuntu64-os-raspberry-pi-4-4g-fails-at-elastic-operator/255733)
**Author:** [@fallenreaper](https://discuss.elastic.co/u/fallenreaper)\ **Replies:** 11\ **Last updated:** [July 5, 2021, 7:48am UTC](https://discuss.elastic.co/t/all-in-one-on-ubuntu64-os-raspberry-pi-4-4g-fails-at-elastic-operator/255733 "2021-07-05T07:48:41Z")
I have been looking into this for some time. I created ELK which worked quite well on my Macbook Pro. It was using the Docker for Desktop installed kubernetes instance. After I add the all-in-one yaml and launch my fi… --- ## [Elasticsearch and Fluentd optimisation for log cluster](https://discuss.elastic.co/t/elasticsearch-and-fluentd-optimisation-for-log-cluster/277674)
**Author:** [@chitender](https://discuss.elastic.co/u/chitender)\ **Replies:** 3\ **Last updated:** [July 5, 2021, 7:14am UTC](https://discuss.elastic.co/t/elasticsearch-and-fluentd-optimisation-for-log-cluster/277674 "2021-07-05T07:14:55Z")
we are using Elasticsearch and Fluentd for Central logging platform. below is our Config details: Elasticsearch Cluster: Master Nodes: 64Gb Ram, 8 CPU, 9 instances Data Nodes: 64Gb Ram, 8 CPU, 40 instances Coordinator N… --- ## [Recover data from Inactive Cluster](https://discuss.elastic.co/t/recover-data-from-inactive-cluster/277731)
**Author:** [@RAM\_NATHAN](https://discuss.elastic.co/u/RAM_NATHAN)\ **Replies:** 5\ **Last updated:** [July 5, 2021, 6:35am UTC](https://discuss.elastic.co/t/recover-data-from-inactive-cluster/277731 "2021-07-05T06:35:19Z")
All my nodes in cluster except one went down. If I run \_cat/nodes in active node , its showing master\_not\_discovered exception. Im not even able to take backup. Backup fails with same error. Can I recover the data someh… --- ## [Http\_poller - URL from another field](https://discuss.elastic.co/t/http-poller-url-from-another-field/277722)
**Author:** [@RoteEdition](https://discuss.elastic.co/u/RoteEdition)\ **Replies:** 2\ **Last updated:** [July 5, 2021, 6:33am UTC](https://discuss.elastic.co/t/http-poller-url-from-another-field/277722 "2021-07-05T06:33:48Z")
Hi there, I am trying to get some data (regarding incoming calls) from an API. I am using http\_poller and everything seems to work. The Problem: The URL has a date parameter in it. I dont want to update the URL everyda… --- ## [What are the built-in index templates for log-\* & metrics-\* indices?](https://discuss.elastic.co/t/what-are-the-built-in-index-templates-for-log-metrics-indices/277766)
**Author:** [@shivani\_aggarwal](https://discuss.elastic.co/u/shivani_aggarwal)\ **Replies:** 2\ **Last updated:** [July 5, 2021, 5:58am UTC](https://discuss.elastic.co/t/what-are-the-built-in-index-templates-for-log-metrics-indices/277766 "2021-07-05T05:58:55Z")
Hi, I use elasticsearch-oss:7.8.0 and planning to upgrade to v7.10.2. Going through the breaking changes in newer versions, found that in 7.9, elasticsearch added built-in index templates for the metrics-\*-\* and logs-\*… --- ## [Instaall filebeat on Oracle Solaris on SPARC (64-bit) OS](https://discuss.elastic.co/t/instaall-filebeat-on-oracle-solaris-on-sparc-64-bit-os/276882)
**Author:** [@Mar-g2021](https://discuss.elastic.co/u/Mar-g2021)\ **Replies:** 3\ **Last updated:** [July 5, 2021, 5:55am UTC](https://discuss.elastic.co/t/instaall-filebeat-on-oracle-solaris-on-sparc-64-bit-os/276882 "2021-07-05T05:55:38Z")
Filebeat can be installed or there is another beat that can be installed on Oracle Solaris on SPARC (64-bit) OS version 11.4 to send database logs? --- ## [Logstash config for nested log](https://discuss.elastic.co/t/logstash-config-for-nested-log/277680)
**Author:** [@kriss332](https://discuss.elastic.co/u/kriss332)\ **Replies:** 10\ **Last updated:** [July 4, 2021, 1:55pm UTC](https://discuss.elastic.co/t/logstash-config-for-nested-log/277680 "2021-07-04T13:55:45Z")
Hello everyone... I have multiple event logs from windows. Converted them to csv using EvtxEcmd.exe. I combined lots of event logs into one csv file. I need to upload it to ELK. below are the column names- RecordNumb… [Previous page](https://discuss.elastic.co/latest.md?page=1587) [Next page](https://discuss.elastic.co/latest.md?page=1589)