# Latest **URL:** https://discuss.elastic.co/latest.md?page=1671 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1672 --- ## [Java agent in IBM Websphere 8.5.5 not send events](https://discuss.elastic.co/t/java-agent-in-ibm-websphere-8-5-5-not-send-events/272688)
**Author:** [@fernandezsjanto](https://discuss.elastic.co/u/fernandezsjanto)\ **Replies:** 7\ **Last updated:** [May 19, 2021, 11:57am UTC](https://discuss.elastic.co/t/java-agent-in-ibm-websphere-8-5-5-not-send-events/272688 "2021-05-19T11:57:04Z")
Kibana version: 7.10.1 Elasticsearch version: 7.10.1 APM Server version: 7.10.2 APM Agent language and version: java 1.23.0 Browser version: Original install method (e.g. download page, yum, deb, from source, et… --- ## [Copy dashboards](https://discuss.elastic.co/t/copy-dashboards/272818)
**Author:** [@capitalism.exe](https://discuss.elastic.co/u/capitalism.exe)\ **Replies:** 2\ **Last updated:** [May 19, 2021, 11:56am UTC](https://discuss.elastic.co/t/copy-dashboards/272818 "2021-05-19T11:56:57Z")
Hello folks, we are currently developing a monitoring platform for a large transportation company. This platform monitors environments like development, integration, testing. You get the idea. We maintain a large num… --- ## [Encrypt HTTP Client](https://discuss.elastic.co/t/encrypt-http-client/273245)
**Author:** [@NareshReddy](https://discuss.elastic.co/u/NareshReddy)\ **Replies:** 3\ **Last updated:** [May 19, 2021, 11:54am UTC](https://discuss.elastic.co/t/encrypt-http-client/273245 "2021-05-19T11:54:40Z")
When updating the certificate using the following commands "elasticsearch-certutil http". At end it is showing the error. Exception in thread "main" java.lang.IllegalArgumentException: ca certificate is not a CA! at o… --- ## [Index not moving to next phase](https://discuss.elastic.co/t/index-not-moving-to-next-phase/273376)
**Author:** [@Dzious](https://discuss.elastic.co/u/Dzious)\ **Replies:** 3\ **Last updated:** [May 19, 2021, 11:49am UTC](https://discuss.elastic.co/t/index-not-moving-to-next-phase/273376 "2021-05-19T11:49:25Z")
Hi, I'm struggleling with ILM. Using Kibana, I've setup a policy where after a day index should be moved to a warm phase and after 3 days they should be moved to a cold phase. Unfortunately, even with this policy enab… --- ## [Apache2 User Agent not avalaible in the Visualize menu](https://discuss.elastic.co/t/apache2-user-agent-not-avalaible-in-the-visualize-menu/273031)
**Author:** [@dkdlv38](https://discuss.elastic.co/u/dkdlv38)\ **Replies:** 6\ **Last updated:** [May 19, 2021, 11:48am UTC](https://discuss.elastic.co/t/apache2-user-agent-not-avalaible-in-the-visualize-menu/273031 "2021-05-19T11:48:29Z")
Hello all! I'm trying to create a visualisation to track the user agent of the Apache clients connecting to my website, I have this information in the "Discover" menu, but it doesn't appear in the "Visualize" menu... … --- ## [Not seeing data in APM Kibana App](https://discuss.elastic.co/t/not-seeing-data-in-apm-kibana-app/273224)
**Author:** [@valleram](https://discuss.elastic.co/u/valleram)\ **Replies:** 3\ **Last updated:** [May 19, 2021, 11:23am UTC](https://discuss.elastic.co/t/not-seeing-data-in-apm-kibana-app/273224 "2021-05-19T11:23:55Z")
Kibana version: 7.11.1 Elasticsearch version: 7.11.1 APM Server version: 7.10.0 APM Agent language and version: Python 6.1.3 Browser version: Original install method (e.g. download page, yum, deb, from source, etc.)… --- ## [Nested query with must clause and second nested query](https://discuss.elastic.co/t/nested-query-with-must-clause-and-second-nested-query/273380)
**Author:** [@hastinc](https://discuss.elastic.co/u/hastinc)\ **Replies:** 0\ **Last updated:** [May 19, 2021, 9:52am UTC](https://discuss.elastic.co/t/nested-query-with-must-clause-and-second-nested-query/273380 "2021-05-19T09:52:11Z")
Hi All, First of all sorry for the long post. I'm wondering if somebody can confirm if the query I've constructed is correct. Basically, I have a User mapping that has Transaction nested within the user and I'm lookin… --- ## [Filebeat kubernetes reuse inode](https://discuss.elastic.co/t/filebeat-kubernetes-reuse-inode/273390)
**Author:** [@mafr](https://discuss.elastic.co/u/mafr)\ **Replies:** 0\ **Last updated:** [May 19, 2021, 10:55am UTC](https://discuss.elastic.co/t/filebeat-kubernetes-reuse-inode/273390 "2021-05-19T10:55:36Z")
Hello, i have got a kubernetes enviroment (v1.19.2) with some deployments. Filebeat autodiscover properly "detects" log files, but after first log collect , filebeat are not harvest log files again (maybe after some ti… --- ## [Logstash filtering drives me nuts](https://discuss.elastic.co/t/logstash-filtering-drives-me-nuts/273258)
**Author:** [@Tuckson](https://discuss.elastic.co/u/Tuckson)\ **Replies:** 7\ **Last updated:** [May 19, 2021, 10:44am UTC](https://discuss.elastic.co/t/logstash-filtering-drives-me-nuts/273258 "2021-05-19T10:44:25Z")
Hi, For some time now I have this stack, filbeats shipping logs of several application servers to elasticsearch via logstash. Logstash filtering is done in 4 pipelines. Now recently our supplier decided to change a fiel… --- ## [Elasticsearch & Kibana monitoring visualization only goes back 1 week](https://discuss.elastic.co/t/elasticsearch-kibana-monitoring-visualization-only-goes-back-1-week/273388)
**Author:** [@vkatsikaros](https://discuss.elastic.co/u/vkatsikaros)\ **Replies:** 0\ **Last updated:** [May 19, 2021, 10:33am UTC](https://discuss.elastic.co/t/elasticsearch-kibana-monitoring-visualization-only-goes-back-1-week/273388 "2021-05-19T10:33:42Z")
Hi I am not sure if this is the correct subforum/tags for the issue. If it's not please let me know where to post it. I monitor ES & Kibana with metricbeat (all 7.10.1). I see there are indices from the last 3 months b… --- ## [Filebeat and deleted files](https://discuss.elastic.co/t/filebeat-and-deleted-files/273386)
**Author:** [@flaco0](https://discuss.elastic.co/u/flaco0)\ **Replies:** 0\ **Last updated:** [May 19, 2021, 10:32am UTC](https://discuss.elastic.co/t/filebeat-and-deleted-files/273386 "2021-05-19T10:32:13Z")
Hi, I have a problem with filebeat and deleted files. I don't scrape /var/lib/docker/containers//.log path But when docker do rollup of file logs, the daemon delete file /var/lib/docker/containers//.log.9, then filebe… --- ## [Metricbeat dailing without root access](https://discuss.elastic.co/t/metricbeat-dailing-without-root-access/273302)
**Author:** [@rohitarorait82](https://discuss.elastic.co/u/rohitarorait82)\ **Replies:** 2\ **Last updated:** [May 19, 2021, 10:30am UTC](https://discuss.elastic.co/t/metricbeat-dailing-without-root-access/273302 "2021-05-19T10:30:51Z")
Hi All, I tried installing metricbeat to my server where IBM MQ is also running, now when I try to start metricbeat using command line . It throws below error \[user@host:/home/user/metricbeat-7.10.0-linux-x86\_64\]$ ./me… --- ## [Bulk Requests to HTTP Input](https://discuss.elastic.co/t/bulk-requests-to-http-input/273381)
**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 0\ **Last updated:** [May 19, 2021, 10:01am UTC](https://discuss.elastic.co/t/bulk-requests-to-http-input/273381 "2021-05-19T10:01:32Z")
Hi, I have an http input configured to receive http bulk requests in application/x-ndjson format. However, logs are not flowing. The input config looks like this: input { http { codec =\> "json" … --- ## [Load data from SQL server to Elasticsearch with document\_id on local](https://discuss.elastic.co/t/load-data-from-sql-server-to-elasticsearch-with-document-id-on-local/273373)
**Author:** [@Dai\_Thai\_Hoa\_Vo](https://discuss.elastic.co/u/Dai_Thai_Hoa_Vo)\ **Replies:** 6\ **Last updated:** [May 19, 2021, 10:08am UTC](https://discuss.elastic.co/t/load-data-from-sql-server-to-elasticsearch-with-document-id-on-local/273373 "2021-05-19T10:08:04Z")
Hi every one. My local table has 3000 rows. When I config logstash output with document\_id =\> "%{countyId}". Just only lastest row is inserted to ElasticSearch. But when I not use document\_id =\> "%{countyId}" so it wo… --- ## [SIEM created and closed cases report](https://discuss.elastic.co/t/siem-created-and-closed-cases-report/270931)
**Author:** [@bnk](https://discuss.elastic.co/u/bnk)\ **Replies:** 9\ **Last updated:** [May 19, 2021, 9:53am UTC](https://discuss.elastic.co/t/siem-created-and-closed-cases-report/270931 "2021-05-19T09:53:21Z")
Hello, I looked information if there is a possibility to export info about created and closed cases (also tags associated with cases and other related info) in ELK SIEM, but I coudn't find any information. Is there a way… --- ## [Version compatibility issue](https://discuss.elastic.co/t/version-compatibility-issue/273374)
**Author:** [@danushkalakmina](https://discuss.elastic.co/u/danushkalakmina)\ **Replies:** 3\ **Last updated:** [May 19, 2021, 9:52am UTC](https://discuss.elastic.co/t/version-compatibility-issue/273374 "2021-05-19T09:52:49Z")
Hi I have used Logstash version 6.2 ,(Elasticsearch version 6.2 and Kibana version 6.2)AWS EK previously. Previously with the above versions it was working perfectly.But i upgrade my Elastic search and Kibana 6.2 AWS ve… --- ## [Elasticsearch crashes with PEM certificate error when using pfx split into separate certificate and key](https://discuss.elastic.co/t/elasticsearch-crashes-with-pem-certificate-error-when-using-pfx-split-into-separate-certificate-and-key/273247)
**Author:** [@keacw](https://discuss.elastic.co/u/keacw)\ **Replies:** 4\ **Last updated:** [May 19, 2021, 9:49am UTC](https://discuss.elastic.co/t/elasticsearch-crashes-with-pem-certificate-error-when-using-pfx-split-into-separate-certificate-and-key/273247 "2021-05-19T09:49:08Z")
\[ERROR\]\[c.a.o.s.s.DefaultOpenDistroSecurityKeyStore\] \[example.com\] Your keystore or PEM does not contain a key. If you specified a key password, try removing it. If you did not specify a key password, perhaps you need t… --- ## [Cannot deploy functionbeat 7.12.1 to GCP Cloud function](https://discuss.elastic.co/t/cannot-deploy-functionbeat-7-12-1-to-gcp-cloud-function/272206)
**Author:** [@yerome](https://discuss.elastic.co/u/yerome)\ **Replies:** 1\ **Last updated:** [May 19, 2021, 9:38am UTC](https://discuss.elastic.co/t/cannot-deploy-functionbeat-7-12-1-to-gcp-cloud-function/272206 "2021-05-19T09:38:40Z")
I try to deploy functionbeat 7.12.1 on a cloud function using filebeat 7.12.1-linux-x86\_64. The deployment fail during installation : 2021-05-05T12:51:45.303Z DEBUG \[gcp.executor\] executor/executor.go:76 The executor i… --- ## [Monitor logstash missing data](https://discuss.elastic.co/t/monitor-logstash-missing-data/273277)
**Author:** [@vikramdayma](https://discuss.elastic.co/u/vikramdayma)\ **Replies:** 6\ **Last updated:** [May 19, 2021, 9:32am UTC](https://discuss.elastic.co/t/monitor-logstash-missing-data/273277 "2021-05-19T09:32:23Z")
Hi, I setup a pipeline in logstash for getting data from sql db by jdbc connector and insert into elastic search index on daily basis. I setup cron time and sync pipeline with sql db on a date field. My problem is: H… --- ## [What is the propper way to create in logstash checkpoint filter](https://discuss.elastic.co/t/what-is-the-propper-way-to-create-in-logstash-checkpoint-filter/273309)
**Author:** [@Enrique\_Pedroza](https://discuss.elastic.co/u/Enrique_Pedroza)\ **Replies:** 4\ **Last updated:** [May 19, 2021, 8:55am UTC](https://discuss.elastic.co/t/what-is-the-propper-way-to-create-in-logstash-checkpoint-filter/273309 "2021-05-19T08:55:21Z")
I have a ELK stack in my server, in other pc i have filebeat listening for Checkpoint syslogs. I know i have to write the filters in a .conf file. This is mine : filter{ if "checkpoint-firewall" in \[tags\] { gro… --- ## [Convert cluster to single node](https://discuss.elastic.co/t/convert-cluster-to-single-node/273368)
**Author:** [@macho](https://discuss.elastic.co/u/macho)\ **Replies:** 5\ **Last updated:** [May 19, 2021, 8:44am UTC](https://discuss.elastic.co/t/convert-cluster-to-single-node/273368 "2021-05-19T08:44:29Z")
Sorry for probably a stupid question, but I am relatively new to elasticsearch. My Problem is, I have a running cluster on three different machines. As this machines were never on the limit we want to use (at least) on… --- ## [Using different Index names in Output logstash](https://discuss.elastic.co/t/using-different-index-names-in-output-logstash/273364)
**Author:** [@Saravana37](https://discuss.elastic.co/u/Saravana37)\ **Replies:** 4\ **Last updated:** [May 19, 2021, 8:21am UTC](https://discuss.elastic.co/t/using-different-index-names-in-output-logstash/273364 "2021-05-19T08:21:08Z")
Hello All , I want to re-use the config lines in output logstash as shown below. I am using if condition but is throwing some error. Please help me out. output { elasticsearch { hosts =\> \["https://… --- ## [ILM Policies Disappear](https://discuss.elastic.co/t/ilm-policies-disappear/273181)
**Author:** [@SKRYMr](https://discuss.elastic.co/u/SKRYMr)\ **Replies:** 4\ **Last updated:** [May 19, 2021, 8:04am UTC](https://discuss.elastic.co/t/ilm-policies-disappear/273181 "2021-05-19T08:04:24Z")
Hello, this is a weird one because there's no way for us to tie this to any specific event but it seems that a custom ILM policy and also the relative index template that we define for some of our indices disappear after… --- ## [Secure Elasticsearch with LDAP/Active Directory and built-in/internal users](https://discuss.elastic.co/t/secure-elasticsearch-with-ldap-active-directory-and-built-in-internal-users/273366)
**Author:** [@d.silwon](https://discuss.elastic.co/u/d.silwon)\ **Replies:** 2\ **Last updated:** [May 19, 2021, 8:04am UTC](https://discuss.elastic.co/t/secure-elasticsearch-with-ldap-active-directory-and-built-in-internal-users/273366 "2021-05-19T08:04:04Z")
Dears, We plan to connect the ELK cluster with LDAP / Active Directory for user authentication. What about built-in/internal accounts like logstash user? Will these accounts continue to work after establishing the conn… --- ## [Elasticsearch Create Wrong time based Index](https://discuss.elastic.co/t/elasticsearch-create-wrong-time-based-index/272785)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 6\ **Last updated:** [May 13, 2021, 4:51pm UTC](https://discuss.elastic.co/t/elasticsearch-create-wrong-time-based-index/272785 "2021-05-13T16:51:59Z")
Using ELK 7.11 we have 11 index out of these we have one index called log-wlb-sysmon.It created its first index on 2021.04.06(log-wlb-sysmon-2021.04.06-000001) , we are using ILM policy for all the indexes It created t… --- ## [Index name doesn't reset every day](https://discuss.elastic.co/t/index-name-doesnt-reset-every-day/273315)
**Author:** [@Downer](https://discuss.elastic.co/u/Downer)\ **Replies:** 2\ **Last updated:** [May 19, 2021, 7:31am UTC](https://discuss.elastic.co/t/index-name-doesnt-reset-every-day/273315 "2021-05-19T07:31:44Z")
Hello, I have an index named "metricbeat-7.10.1-2021.04.18-000324" but tomorrow it will be "metricbeat-7.10.1-2021.04.19-000325". The date math working perfectly but the indice (325) keep growing and don't reset every d… --- ## [Exporting GCP stackdriver log to elasticsearch on premise](https://discuss.elastic.co/t/exporting-gcp-stackdriver-log-to-elasticsearch-on-premise/273343)
**Author:** [@soufiane\_adn](https://discuss.elastic.co/u/soufiane_adn)\ **Replies:** 5\ **Last updated:** [May 19, 2021, 7:45am UTC](https://discuss.elastic.co/t/exporting-gcp-stackdriver-log-to-elasticsearch-on-premise/273343 "2021-05-19T07:45:29Z")
Hello team, can we export logs from google cloud GCP (stackdriver) to an elasticsearch on premise? I found the link below, but they assume that elasticsearch is established on elastic cloud, on my case I have a local c… --- ## [Performance Issues in Multi-Level Terms Aggregation](https://discuss.elastic.co/t/performance-issues-in-multi-level-terms-aggregation/273369)
**Author:** [@Prasiddha](https://discuss.elastic.co/u/Prasiddha)\ **Replies:** 0\ **Last updated:** [May 19, 2021, 7:11am UTC](https://discuss.elastic.co/t/performance-issues-in-multi-level-terms-aggregation/273369 "2021-05-19T07:11:23Z")
For the introduction, we are running into a performance issues when multi-level terms aggregation is being applied. We’re trying to implement multi-level Terms aggregation, up-to 5 levels and running into performance is… --- ## [How to confirm audit logging is enabled](https://discuss.elastic.co/t/how-to-confirm-audit-logging-is-enabled/272888)
**Author:** [@knagasri](https://discuss.elastic.co/u/knagasri)\ **Replies:** 3\ **Last updated:** [May 19, 2021, 6:40am UTC](https://discuss.elastic.co/t/how-to-confirm-audit-logging-is-enabled/272888 "2021-05-19T06:40:56Z")
I had deployed elasticsearch-operator(1.3.0) with elasticsearch 7.9.0 in GKE. I have used below line in my elasticsearch.yaml to enable audit logging: xpack.security.audit.enabled: true As per the documentation(Enabli… --- ## [Error fetching fields for index pattern](https://discuss.elastic.co/t/error-fetching-fields-for-index-pattern/273193)
**Author:** [@tabo](https://discuss.elastic.co/u/tabo)\ **Replies:** 8\ **Last updated:** [May 19, 2021, 6:34am UTC](https://discuss.elastic.co/t/error-fetching-fields-for-index-pattern/273193 "2021-05-19T06:34:04Z")
I've just upgraded a k8s self managed installation of es with Kibana. When it was not secured, I created some indexes and dashboards. When I added xpack, In elasticasearch.yaml file: (xpack.security.enabled: true xp… [Previous page](https://discuss.elastic.co/latest.md?page=1670) [Next page](https://discuss.elastic.co/latest.md?page=1672)