# Latest **URL:** https://discuss.elastic.co/latest.md?page=1674 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1675 --- ## [Easiest Way To Install Elastic... apt-get install or wget](https://discuss.elastic.co/t/easiest-way-to-install-elastic-apt-get-install-or-wget/272879)
**Author:** [@cis4life](https://discuss.elastic.co/u/cis4life)\ **Replies:** 13\ **Last updated:** [May 18, 2021, 12:13am UTC](https://discuss.elastic.co/t/easiest-way-to-install-elastic-apt-get-install-or-wget/272879 "2021-05-18T00:13:16Z")
Good Day, In your opinion, what is the easiest way to get Elasticsearch 6.18.5 onto Ubuntu 18.04 servers. I'm looking at this ES guide here... Install Elasticsearch with Debian Package | Elasticsearch Guide \[6.8\] | Ela… --- ## [Threat hunting with suricata, ElasticSecurity](https://discuss.elastic.co/t/threat-hunting-with-suricata-elasticsecurity/273148)
**Author:** [@111387](https://discuss.elastic.co/u/111387)\ **Replies:** 1\ **Last updated:** [May 17, 2021, 11:51pm UTC](https://discuss.elastic.co/t/threat-hunting-with-suricata-elasticsecurity/273148 "2021-05-17T23:51:07Z")
Good morning. I have built a suricata, and I am delivering events to elasticsearch with filebeat. There are various detection rules in elasticsecurity, but among them, detection rules for suricata (ET Rule) do not exis… --- ## [How to avoid jvm error in python elasticsearch rest client](https://discuss.elastic.co/t/how-to-avoid-jvm-error-in-python-elasticsearch-rest-client/273161)
**Author:** [@rknd](https://discuss.elastic.co/u/rknd)\ **Replies:** 5\ **Last updated:** [May 17, 2021, 11:13pm UTC](https://discuss.elastic.co/t/how-to-avoid-jvm-error-in-python-elasticsearch-rest-client/273161 "2021-05-17T23:13:28Z")
I have 10 elasticsearch nodes in one server(cluster), all nodes have 2gb jvm heap size. I have a python rest client for elasticsearch. With that client I fetch datas from elasticsearch and re-indexing with new datas. I… --- ## [Possible to only find new entries since last search?](https://discuss.elastic.co/t/possible-to-only-find-new-entries-since-last-search/273173)
**Author:** [@Sandra\_Schlichting](https://discuss.elastic.co/u/Sandra_Schlichting)\ **Replies:** 1\ **Last updated:** [May 17, 2021, 11:12pm UTC](https://discuss.elastic.co/t/possible-to-only-find-new-entries-since-last-search/273173 "2021-05-17T23:12:11Z")
Dear all =) Does anyone know if it is possible to make a query that searched for error\_event:1 and the next time I run it, it only shows the new entries since last search? Hugs, Sandra =) --- ## [Create daily index with ILM](https://discuss.elastic.co/t/create-daily-index-with-ilm/273199)
**Author:** [@Matteo\_Rainieri](https://discuss.elastic.co/u/Matteo_Rainieri)\ **Replies:** 1\ **Last updated:** [May 17, 2021, 10:59pm UTC](https://discuss.elastic.co/t/create-daily-index-with-ilm/273199 "2021-05-17T22:59:21Z")
Hello there. I got a simple question: When i'm using filebeat, i would like to create a daily index and use index lifecycle policies. Im currently using ilm with this settings in filebeat.yml: setup.ilm.enabled: auto… --- ## [Combine daily indices into monthly with ILM](https://discuss.elastic.co/t/combine-daily-indices-into-monthly-with-ilm/273185)
**Author:** [@vkatsikaros](https://discuss.elastic.co/u/vkatsikaros)\ **Replies:** 2\ **Last updated:** [May 17, 2021, 10:58pm UTC](https://discuss.elastic.co/t/combine-daily-indices-into-monthly-with-ilm/273185 "2021-05-17T22:58:22Z")
Hi I would like to combine daily indices into monthly. I'd like to ask if this can be performed with Index Lifecycle Management in 7.12. There are reindex related questions, but should be old to include an ILM solution: … --- ## [Authentication to realm default\_file failed](https://discuss.elastic.co/t/authentication-to-realm-default-file-failed/205237)
**Author:** [@pabloborh](https://discuss.elastic.co/u/pabloborh)\ **Replies:** 4\ **Last updated:** [May 17, 2021, 10:29pm UTC](https://discuss.elastic.co/t/authentication-to-realm-default-file-failed/205237 "2021-05-17T22:29:13Z")
Hi! I have a elasticsearch cluster deployed with ECK. The pods are logging: level": "WARN", "component": "o.e.x.s.a.AuthenticationService", "cluster.name": "elasticsearch", "node.name": "elasticsearch-es-data-6ff4cgt49… --- ## [Endpoint inconsistency in different regions of Elastic Cloud](https://discuss.elastic.co/t/endpoint-inconsistency-in-different-regions-of-elastic-cloud/273202)
**Author:** [@Mkian](https://discuss.elastic.co/u/Mkian)\ **Replies:** 4\ **Last updated:** [May 17, 2021, 9:58pm UTC](https://discuss.elastic.co/t/endpoint-inconsistency-in-different-regions-of-elastic-cloud/273202 "2021-05-17T21:58:43Z")
In Elastic Cloud a custom endpoint alias is recently added which is good and it helps in some automations BUT I see an inconsistency in different regions when I get the endpoints which makes the automation unnecessarily … --- ## [Kql wildcard doesn't seem to work](https://discuss.elastic.co/t/kql-wildcard-doesnt-seem-to-work/273216)
**Author:** [@k1ng87](https://discuss.elastic.co/u/k1ng87)\ **Replies:** 1\ **Last updated:** [May 17, 2021, 9:06pm UTC](https://discuss.elastic.co/t/kql-wildcard-doesnt-seem-to-work/273216 "2021-05-17T21:06:22Z")
I'm trying to use a wildcard for the message field but it doesn't seem to work. I'm trying to look for anything that starts with async and filter them out. In the message field, it can look like this: async.channel.pool… --- ## [FSCrawler Ingest pdf error Exceeds maximum allowed document size of 102400 bytes](https://discuss.elastic.co/t/fscrawler-ingest-pdf-error-exceeds-maximum-allowed-document-size-of-102400-bytes/273054)
**Author:** [@jeje232](https://discuss.elastic.co/u/jeje232)\ **Replies:** 10\ **Last updated:** [May 17, 2021, 9:40pm UTC](https://discuss.elastic.co/t/fscrawler-ingest-pdf-error-exceeds-maximum-allowed-document-size-of-102400-bytes/273054 "2021-05-17T21:40:29Z")
Hello, I want to use FSCrawler to push my pdf books on Workplace Search. I tried with different bulk\_size and flush\_interval but no way. I have the same maximum allowed document size error. My traces logs are: 18:51:… --- ## [Search plugin with custom query getting IllegalAccessError](https://discuss.elastic.co/t/search-plugin-with-custom-query-getting-illegalaccesserror/273221)
**Author:** [@elelliot](https://discuss.elastic.co/u/elelliot)\ **Replies:** 0\ **Last updated:** [May 17, 2021, 8:55pm UTC](https://discuss.elastic.co/t/search-plugin-with-custom-query-getting-illegalaccesserror/273221 "2021-05-17T20:55:00Z")
I'm having an issue with installing a custom query in my elasticsearch plugin. For my use case, I have a custom query PayloadPhraseQuery that uses many of the other existing Lucene phrase query code. However when I run … --- ## [Logstash install and startup error](https://discuss.elastic.co/t/logstash-install-and-startup-error/273208)
**Author:** [@MKirby](https://discuss.elastic.co/u/MKirby)\ **Replies:** 7\ **Last updated:** [May 17, 2021, 7:46pm UTC](https://discuss.elastic.co/t/logstash-install-and-startup-error/273208 "2021-05-17T19:46:19Z")
Good Afternoon; I am new to the ELK tools and am in the midst of a proof of concept using them. I am testing on a Windows 10 Professional box and have been able to install and get running both ElasticSearch and Kibana… --- ## [Analyzing profiling results](https://discuss.elastic.co/t/analyzing-profiling-results/273071)
**Author:** [@alexs1](https://discuss.elastic.co/u/alexs1)\ **Replies:** 4\ **Last updated:** [May 17, 2021, 4:51pm UTC](https://discuss.elastic.co/t/analyzing-profiling-results/273071 "2021-05-17T16:51:26Z")
Hello, I'm migrating a cluster from an old one, and for some reason, after reindexing by best practices (than I know), performance are slower in the new cluster. the first has 500GB- 5 shards and 1 replica the new clu… --- ## [Mapping Winlogbeat old version to newest ECS](https://discuss.elastic.co/t/mapping-winlogbeat-old-version-to-newest-ecs/272625)
**Author:** [@Kambing](https://discuss.elastic.co/u/Kambing)\ **Replies:** 2\ **Last updated:** [May 17, 2021, 7:32pm UTC](https://discuss.elastic.co/t/mapping-winlogbeat-old-version-to-newest-ecs/272625 "2021-05-17T19:32:34Z")
Hi, I have hundreds windows server in production with variety of windows version from windows server 2003 to the windows server 2019 I had tried to install winlogbeat 7.12.1 for windows server 2003 but there's always an… --- ## [How do I disable enterprise search in Kibana 7.10.2?](https://discuss.elastic.co/t/how-do-i-disable-enterprise-search-in-kibana-7-10-2/273147)
**Author:** [@ravi\_yadav2](https://discuss.elastic.co/u/ravi_yadav2)\ **Replies:** 2\ **Last updated:** [May 17, 2021, 5:44pm UTC](https://discuss.elastic.co/t/how-do-i-disable-enterprise-search-in-kibana-7-10-2/273147 "2021-05-17T17:44:49Z")
Are there configuration settings for kibana.yml that we can use to disable this feature? If Not how can I disable it? --- ## [Log4j socket appender - filebeat](https://discuss.elastic.co/t/log4j-socket-appender-filebeat/273205)
**Author:** [@Akhil2](https://discuss.elastic.co/u/Akhil2)\ **Replies:** 0\ **Last updated:** [May 17, 2021, 5:25pm UTC](https://discuss.elastic.co/t/log4j-socket-appender-filebeat/273205 "2021-05-17T17:25:05Z")
Hello there, I want to use filebeat to collect log4j logs and send directly to Elasticsearch. I tried to find some relevant information but mostly it is about Logstash. can anyone please give me more information on thi… --- ## [Combo box UI not rendering properly](https://discuss.elastic.co/t/combo-box-ui-not-rendering-properly/273204)
**Author:** [@praveer](https://discuss.elastic.co/u/praveer)\ **Replies:** 1\ **Last updated:** [May 17, 2021, 5:14pm UTC](https://discuss.elastic.co/t/combo-box-ui-not-rendering-properly/273204 "2021-05-17T17:14:35Z")
Hi Team, In my application I am using elastic UI. I have used EuiComboBox. When i click on combo box it shows options but there is a gap in between as shown below. When I inspected I found that 'top' css is getting… --- ## [Master nodes history](https://discuss.elastic.co/t/master-nodes-history/273189)
**Author:** [@nuzolx](https://discuss.elastic.co/u/nuzolx)\ **Replies:** 2\ **Last updated:** [May 17, 2021, 5:08pm UTC](https://discuss.elastic.co/t/master-nodes-history/273189 "2021-05-17T17:08:51Z")
Hi, Is it possible to know the history of master nodes? which node was master when ... By an API call not in logs. --- ## [Measure network jitter and packet retransmits/drops](https://discuss.elastic.co/t/measure-network-jitter-and-packet-retransmits-drops/272946)
**Author:** [@Tydorius](https://discuss.elastic.co/u/Tydorius)\ **Replies:** 8\ **Last updated:** [May 17, 2021, 5:08pm UTC](https://discuss.elastic.co/t/measure-network-jitter-and-packet-retransmits-drops/272946 "2021-05-17T17:08:28Z")
I am working on an Elastic Stack that will be used to measure network activity in a testbed for various pieces of equipment. My current hurdle is around measuring jitter and packet retransmits and drops. Has anyone use… --- ## [Some APM Transacion index fields are not searchable](https://discuss.elastic.co/t/some-apm-transacion-index-fields-are-not-searchable/272569)
**Author:** [@xacobecm](https://discuss.elastic.co/u/xacobecm)\ **Replies:** 2\ **Last updated:** [May 17, 2021, 5:02pm UTC](https://discuss.elastic.co/t/some-apm-transacion-index-fields-are-not-searchable/272569 "2021-05-17T17:02:58Z")
I'm using APM Server version 7.11.2. I've got some services sending data to APM. I have a login by certificate microservice and I'd like to filter some request parameters in order to know who and when logged in. When I s… --- ## [My kibana instance has randomly slow performace](https://discuss.elastic.co/t/my-kibana-instance-has-randomly-slow-performace/273191)
**Author:** [@nsimi](https://discuss.elastic.co/u/nsimi)\ **Replies:** 4\ **Last updated:** [May 17, 2021, 4:49pm UTC](https://discuss.elastic.co/t/my-kibana-instance-has-randomly-slow-performace/273191 "2021-05-17T16:49:34Z")
Hello All, I am having an issue where my Kibana instance randomly will take long times to carry out actions, sometimes even fetching the list of spaces can take 20s. I have a 3 node ES cluster, and a single node hosting… --- ## [DatabaseError: driver.new.connect returned nil \>\> Logstash doesn´t connect to Postgresql Database](https://discuss.elastic.co/t/databaseerror-driver-new-connect-returned-nil-logstash-doesn-t-connect-to-postgresql-database/271288)
**Author:** [@Eng.Lucy](https://discuss.elastic.co/u/Eng.Lucy)\ **Replies:** 3\ **Last updated:** [May 17, 2021, 4:39pm UTC](https://discuss.elastic.co/t/databaseerror-driver-new-connect-returned-nil-logstash-doesn-t-connect-to-postgresql-database/271288 "2021-05-17T16:39:02Z")
I try to connect Logstash to Postgresql. This database is located in a remote server and Logstash runs in a docker container. My logstash.conf is: # input{ jdbc{ jdbc\_connection\_string =\> "jdbc:postgresql://000.00.0… --- ## [Index name with binary chars - Elastic 6.8.12](https://discuss.elastic.co/t/index-name-with-binary-chars-elastic-6-8-12/273198)
**Author:** [@aayala](https://discuss.elastic.co/u/aayala)\ **Replies:** 2\ **Last updated:** [May 17, 2021, 4:38pm UTC](https://discuss.elastic.co/t/index-name-with-binary-chars-elastic-6-8-12/273198 "2021-05-17T16:38:57Z")
How I can remove an index with binary data in there name ? Example: k8s-^@^@^@^@^@-2021.05.14 --- ## [Partial/ Incorrect data displayed in tsvb](https://discuss.elastic.co/t/partial-incorrect-data-displayed-in-tsvb/272924)
**Author:** [@BitBucketUser\_user](https://discuss.elastic.co/u/BitBucketUser_user)\ **Replies:** 3\ **Last updated:** [May 17, 2021, 4:14pm UTC](https://discuss.elastic.co/t/partial-incorrect-data-displayed-in-tsvb/272924 "2021-05-17T16:14:24Z")
Hello! I'm trying to visualize metricbeat data using TSVB , for any time interval selected, I get incorrect or partial view with '-' (dashes) as shown below : My Current Configuration : Is there a specific rea… --- ## [Alerts how to add very long value as an attachment](https://discuss.elastic.co/t/alerts-how-to-add-very-long-value-as-an-attachment/273087)
**Author:** [@zozo6015](https://discuss.elastic.co/u/zozo6015)\ **Replies:** 3\ **Last updated:** [May 17, 2021, 4:04pm UTC](https://discuss.elastic.co/t/alerts-how-to-add-very-long-value-as-an-attachment/273087 "2021-05-17T16:04:55Z")
Hello, I am using alerts to send alerts on slack when there are some high severity messages in the logs. Usually these come with a very long message that spans over multiple slack messages. Is there a way I can tell ale… --- ## [Elasticsearch cannot start a service "Mount point not found"](https://discuss.elastic.co/t/elasticsearch-cannot-start-a-service-mount-point-not-found/270449)
**Author:** [@Jakub\_Skapski](https://discuss.elastic.co/u/Jakub_Skapski)\ **Replies:** 16\ **Last updated:** [May 17, 2021, 3:55pm UTC](https://discuss.elastic.co/t/elasticsearch-cannot-start-a-service-mount-point-not-found/270449 "2021-05-17T15:55:36Z")
Hello, I'm not able to start Elasticsearch on my PC. Same error pops up with docker, or installing it standalone on my Manjaro Linux. \[2021-04-17T16:16:21,296\]\[ERROR\]\[o.e.b.Bootstrap \] \[kuba-ms7b87\] Exceptio… --- ## [Kibana customisation - optimize error](https://discuss.elastic.co/t/kibana-customisation-optimize-error/273008)
**Author:** [@preetish\_P](https://discuss.elastic.co/u/preetish_P)\ **Replies:** 4\ **Last updated:** [May 17, 2021, 3:25pm UTC](https://discuss.elastic.co/t/kibana-customisation-optimize-error/273008 "2021-05-17T15:25:23Z")
Hi folks, I am currently working on customising the UI of Kibana v7.11.2. I am trying this locally on macOS. However I am not able to create the optimize folder automatically. After making changes to the required CSS f… --- ## [Is there a way to add label to both sampled and non sampled transaction?](https://discuss.elastic.co/t/is-there-a-way-to-add-label-to-both-sampled-and-non-sampled-transaction/273030)
**Author:** [@Nandu\_Bhai](https://discuss.elastic.co/u/Nandu_Bhai)\ **Replies:** 1\ **Last updated:** [May 17, 2021, 3:47pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-add-label-to-both-sampled-and-non-sampled-transaction/273030 "2021-05-17T15:47:46Z")
I just want a key with 5 types of values associated with each request transaction. I was using the labels to achieve the purpose. But after enabling the sampling, the labels are coming with only sampled requests. Is ther… --- ## [Adaptive Replica Selection - deeper details](https://discuss.elastic.co/t/adaptive-replica-selection-deeper-details/272963)
**Author:** [@Glen\_Smith](https://discuss.elastic.co/u/Glen_Smith)\ **Replies:** 2\ **Last updated:** [May 17, 2021, 3:24pm UTC](https://discuss.elastic.co/t/adaptive-replica-selection-deeper-details/272963 "2021-05-17T15:24:14Z")
Hello, If possible, I'd like to learn more specifically how shard ranking is calculated for a search. The current documentation for Adaptive Replica Selection says By default, Elasticsearch uses adaptive replica sele… --- ## [Implementing basic auth for basic license throwing error](https://discuss.elastic.co/t/implementing-basic-auth-for-basic-license-throwing-error/272797)
**Author:** [@rohitarorait82](https://discuss.elastic.co/u/rohitarorait82)\ **Replies:** 4\ **Last updated:** [May 17, 2021, 2:58pm UTC](https://discuss.elastic.co/t/implementing-basic-auth-for-basic-license-throwing-error/272797 "2021-05-17T14:58:41Z")
Hi All, Our cluster have 6 nodes(1 coordinating, 3 master+data, 2 data nodes). We have implemented basic auth in the coordinating node, as our kibana is calling only coordinating node and it is working fine. However , … [Previous page](https://discuss.elastic.co/latest.md?page=1673) [Next page](https://discuss.elastic.co/latest.md?page=1675)