# Latest **URL:** https://discuss.elastic.co/latest.md?page=1683 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1684 --- ## [Conditional with regex failing](https://discuss.elastic.co/t/conditional-with-regex-failing/272743)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 5\ **Last updated:** [May 12, 2021, 2:22am UTC](https://discuss.elastic.co/t/conditional-with-regex-failing/272743 "2021-05-12T02:22:22Z")
Hi Im trying to replace a value whenever the the characters ":" are present in the category field, but I get an error, I tried to scape the colon, but I get an error too if \[category\] =~ /:\\\\/ { mutate { replace =\> \[ "… --- ## [Logstash not capturing SNMP traps from remote machine](https://discuss.elastic.co/t/logstash-not-capturing-snmp-traps-from-remote-machine/272754)
**Author:** [@ssunkara](https://discuss.elastic.co/u/ssunkara)\ **Replies:** 0\ **Last updated:** [May 12, 2021, 1:33am UTC](https://discuss.elastic.co/t/logstash-not-capturing-snmp-traps-from-remote-machine/272754 "2021-05-12T01:33:22Z")
Hi, I have logstash configured with snmptrap input plugin on a CentOS7 machine. Below is my .conf file that I have at /etc/logstash/conf.d input { snmptrap { community =\> "public" port =\> 10… --- ## [How to write a kibana rule with filename](https://discuss.elastic.co/t/how-to-write-a-kibana-rule-with-filename/272673)
**Author:** [@realtech2338](https://discuss.elastic.co/u/realtech2338)\ **Replies:** 1\ **Last updated:** [May 12, 2021, 1:14am UTC](https://discuss.elastic.co/t/how-to-write-a-kibana-rule-with-filename/272673 "2021-05-12T01:14:05Z")
I would like to write a rule to detect if the file name & path are matching for china chopper webshells from below list. for entire csv What is the best way to do please guide me with exact steps. I know we need creat… --- ## [How to recover cluster state red in K8s](https://discuss.elastic.co/t/how-to-recover-cluster-state-red-in-k8s/272420)
**Author:** [@dandelion](https://discuss.elastic.co/u/dandelion)\ **Replies:** 1\ **Last updated:** [May 12, 2021, 12:45am UTC](https://discuss.elastic.co/t/how-to-recover-cluster-state-red-in-k8s/272420 "2021-05-12T00:45:44Z")
We are using Elasticsearch along with Graylog. We have three replicas running. On the Graylog side I noticed that the Elasticsearch cluster status is red. Started to investigate, and noticed that we had run out of disk … --- ## [While creating the elastic synthetic monitoring via docker run unable to view monitoring details in Kibana dashboard](https://discuss.elastic.co/t/while-creating-the-elastic-synthetic-monitoring-via-docker-run-unable-to-view-monitoring-details-in-kibana-dashboard/272417)
**Author:** [@sadik](https://discuss.elastic.co/u/sadik)\ **Replies:** 0\ **Last updated:** [May 7, 2021, 12:19pm UTC](https://discuss.elastic.co/t/while-creating-the-elastic-synthetic-monitoring-via-docker-run-unable-to-view-monitoring-details-in-kibana-dashboard/272417 "2021-05-07T12:19:32Z")
Errors While creating the elastic synthetic monitoring via docker run unable to view monitoring details in Kibana dashboard. Getting the below errors while run the docker run command. So please help me solve this issues. … --- ## [Regarding XPack Metric Collection with Beats](https://discuss.elastic.co/t/regarding-xpack-metric-collection-with-beats/272650)
**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 0\ **Last updated:** [May 11, 2021, 8:38am UTC](https://discuss.elastic.co/t/regarding-xpack-metric-collection-with-beats/272650 "2021-05-11T08:38:28Z")
Hi, I have configured metricbeat on a logstash instance to send xpack metrics to a remote elasticsearch cluster. The metrics are being shipped and indexed and are accessible via the kibana monitoring view. However, they… --- ## [Does snapshot lifecycle management track the deletion](https://discuss.elastic.co/t/does-snapshot-lifecycle-management-track-the-deletion/272651)
**Author:** [@pk.241011](https://discuss.elastic.co/u/pk.241011)\ **Replies:** 1\ **Last updated:** [May 12, 2021, 12:23am UTC](https://discuss.elastic.co/t/does-snapshot-lifecycle-management-track-the-deletion/272651 "2021-05-12T00:23:52Z")
Hi, I just wanted to get this confirmed though I strongly feel that snapshot policy takes a backup only of an index. I have configured ILM to delete indices older than a week. Snapshot policy will be taking backups of … --- ## [Convert mapping in the table logstash](https://discuss.elastic.co/t/convert-mapping-in-the-table-logstash/272753)
**Author:** [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\ **Replies:** 7\ **Last updated:** [May 11, 2021, 11:50pm UTC](https://discuss.elastic.co/t/convert-mapping-in-the-table-logstash/272753 "2021-05-11T23:50:12Z")
good, I need help with the mapping in logstash, I need to change certain metrics to integer, but the metrics go together in a table so it does not let me change them. I attach the configuration in logstash. input { ht… --- ## [Modsecurity logs to kibana dashboard](https://discuss.elastic.co/t/modsecurity-logs-to-kibana-dashboard/272726)
**Author:** [@Kenny188](https://discuss.elastic.co/u/Kenny188)\ **Replies:** 1\ **Last updated:** [May 11, 2021, 11:08pm UTC](https://discuss.elastic.co/t/modsecurity-logs-to-kibana-dashboard/272726 "2021-05-11T23:08:33Z")
HI , I'm currently working on WAF (web application firewall) ModSecurity , and I'm trying to forward the logs files of modsec into kibana so it can be visualise from there and be more untestable . My first time worki… --- ## [Unable to access s3 bucket(snapshot and restore)](https://discuss.elastic.co/t/unable-to-access-s3-bucket-snapshot-and-restore/272676)
**Author:** [@Yash\_Shukla](https://discuss.elastic.co/u/Yash_Shukla)\ **Replies:** 1\ **Last updated:** [May 11, 2021, 11:07pm UTC](https://discuss.elastic.co/t/unable-to-access-s3-bucket-snapshot-and-restore/272676 "2021-05-11T23:07:31Z")
Hello everyone, I am setting up an EFK cluster(elasticsearch-kibana-fluentd) in the AWS eks cluster. currently i am facing a problem with the snapshot and backup option present in the kibana console - followed followin… --- ## [Encrypted Communications reloading certificate](https://discuss.elastic.co/t/encrypted-communications-reloading-certificate/272686)
**Author:** [@ewolfman](https://discuss.elastic.co/u/ewolfman)\ **Replies:** 0\ **Last updated:** [May 11, 2021, 11:23am UTC](https://discuss.elastic.co/t/encrypted-communications-reloading-certificate/272686 "2021-05-11T11:23:33Z")
Hi, ES client allows loading the certificate for trust as described here. But what happens if the certificate changes? Is there a way to reload the certificate (e.g. recreate the sslContext context?) without having to … --- ## [Cluster node roles changed after rolling upgrade](https://discuss.elastic.co/t/cluster-node-roles-changed-after-rolling-upgrade/272685)
**Author:** [@Pyppe](https://discuss.elastic.co/u/Pyppe)\ **Replies:** 1\ **Last updated:** [May 11, 2021, 11:05pm UTC](https://discuss.elastic.co/t/cluster-node-roles-changed-after-rolling-upgrade/272685 "2021-05-11T23:05:23Z")
Hi! We did a rolling upgrade from version 7.6.1 to 7.12.1 as documented in Rolling upgrades | Elasticsearch Guide \[7.12\] | Elastic. We have three nodes in our cluster. Before the upgrade each node had roles dilm, but af… --- ## [Unable to find valid certification path to requested target](https://discuss.elastic.co/t/unable-to-find-valid-certification-path-to-requested-target/272692)
**Author:** [@osher.l](https://discuss.elastic.co/u/osher.l)\ **Replies:** 0\ **Last updated:** [May 11, 2021, 12:06pm UTC](https://discuss.elastic.co/t/unable-to-find-valid-certification-path-to-requested-target/272692 "2021-05-11T12:06:38Z")
We have ELK stack on Kubernetes(version 7.0.0), Logstash is failing to interact with elasticsearch with the following warning and errors, all other components like filebeat and kibana are well functioning. \[2021-05-11T1… --- ## [Documents not showing Discover, show in queries and document counts](https://discuss.elastic.co/t/documents-not-showing-discover-show-in-queries-and-document-counts/272740)
**Author:** [@LoganS](https://discuss.elastic.co/u/LoganS)\ **Replies:** 2\ **Last updated:** [May 11, 2021, 8:35pm UTC](https://discuss.elastic.co/t/documents-not-showing-discover-show-in-queries-and-document-counts/272740 "2021-05-11T20:35:01Z")
I have some documents that were created via Elastic's REST API. When logged into Kibana to view these records, I am able to see them in the results using a GET or PUT request in Dev Tools and in the document count for t… --- ## [How the \_source field helps in snapshot](https://discuss.elastic.co/t/how-the-source-field-helps-in-snapshot/272725)
**Author:** [@Abhishek\_Shinde](https://discuss.elastic.co/u/Abhishek_Shinde)\ **Replies:** 3\ **Last updated:** [May 11, 2021, 8:19pm UTC](https://discuss.elastic.co/t/how-the-source-field-helps-in-snapshot/272725 "2021-05-11T20:19:51Z")
Hey Guys, I would need to know how the \_source field helps in the Snapshot and Restore scenario? --- ## [Automatically visualize data on kibana from input?](https://discuss.elastic.co/t/automatically-visualize-data-on-kibana-from-input/271613)
**Author:** [@Shreesh\_Narayanan](https://discuss.elastic.co/u/Shreesh_Narayanan)\ **Replies:** 14\ **Last updated:** [May 11, 2021, 7:41pm UTC](https://discuss.elastic.co/t/automatically-visualize-data-on-kibana-from-input/271613 "2021-05-11T19:41:03Z")
I'm wondering if there's a way to automatically visualize data on KIBANA. ? My logstash will receive frequent new inputs, and i need to know if there's way to automatically create dashboards ? may be a way to define in… --- ## [Metricbeat-\* vs metrics-\*](https://discuss.elastic.co/t/metricbeat-vs-metrics/272612)
**Author:** [@muhdiekuh](https://discuss.elastic.co/u/muhdiekuh)\ **Replies:** 3\ **Last updated:** [May 11, 2021, 7:06pm UTC](https://discuss.elastic.co/t/metricbeat-vs-metrics/272612 "2021-05-11T19:06:51Z")
I noticed that these days there are index patterns & dashboards for both metricbeat-\* and metrics-\*. What's that about? I'm using logstash to ingest the data into elasticsearch, so my data goes into the metricbeat-\* ind… --- ## [Add message\_length field](https://discuss.elastic.co/t/add-message-length-field/272737)
**Author:** [@lag](https://discuss.elastic.co/u/lag)\ **Replies:** 2\ **Last updated:** [May 11, 2021, 6:39pm UTC](https://discuss.elastic.co/t/add-message-length-field/272737 "2021-05-11T18:39:40Z")
I am trying to add calculated "message\_length" field that would be a representation on character count in "message" field. Info is coming in from winlogbeat/filebeat/syslog if that makes any difference. This is the code… --- ## [ES 7.12 - Different analyzers are getting used for indexing and searching](https://discuss.elastic.co/t/es-7-12-different-analyzers-are-getting-used-for-indexing-and-searching/272186)
**Author:** [@justramesh2000](https://discuss.elastic.co/u/justramesh2000)\ **Replies:** 3\ **Last updated:** [May 11, 2021, 6:23pm UTC](https://discuss.elastic.co/t/es-7-12-different-analyzers-are-getting-used-for-indexing-and-searching/272186 "2021-05-11T18:23:25Z")
Hello, I have an interesting issue to report for ES 7.12. For one of the dynamically indexed field the analyzer used for indexing is "ngram" but for searching its "standard". I am not sure if this is a bug or an intended… --- ## [Induced CPU load by APM nodejs agent if elastic server saturates](https://discuss.elastic.co/t/induced-cpu-load-by-apm-nodejs-agent-if-elastic-server-saturates/272729)
**Author:** [@Javier\_Aracil](https://discuss.elastic.co/u/Javier_Aracil)\ **Replies:** 2\ **Last updated:** [May 11, 2021, 5:53pm UTC](https://discuss.elastic.co/t/induced-cpu-load-by-apm-nodejs-agent-if-elastic-server-saturates/272729 "2021-05-11T17:53:23Z")
Hi All, We are instrumenting a nodejs backend with Elastic APM agent. At some point, the elastic server cannot cope with the incoming messages from the agent. I wonder what happens in that case. I understand that such i… --- ## [Transaction table breakdown granularity](https://discuss.elastic.co/t/transaction-table-breakdown-granularity/270178)
**Author:** [@Javier\_Aracil](https://discuss.elastic.co/u/Javier_Aracil)\ **Replies:** 8\ **Last updated:** [May 11, 2021, 5:52pm UTC](https://discuss.elastic.co/t/transaction-table-breakdown-granularity/270178 "2021-05-11T17:52:57Z")
Hello everyone, I am a newbie to Elastic APM, I am currently trying to instrument a great banking application (javascript). In the transaction table I get many URLs of the type POST http: //\/method summariz… --- ## [Can we edit Kibana's own fancy dashboards or make similar?](https://discuss.elastic.co/t/can-we-edit-kibanas-own-fancy-dashboards-or-make-similar/272718)
**Author:** [@Mark\_Duncan](https://discuss.elastic.co/u/Mark_Duncan)\ **Replies:** 2\ **Last updated:** [May 11, 2021, 5:39pm UTC](https://discuss.elastic.co/t/can-we-edit-kibanas-own-fancy-dashboards-or-make-similar/272718 "2021-05-11T17:39:12Z")
Is it possible to make pages like these ourselves in Kibana, i.e. these layouts, and the nice min/max/current views? thanks in advance! Mark --- ## [Custom message filter with logstash](https://discuss.elastic.co/t/custom-message-filter-with-logstash/272626)
**Author:** [@cuongnp](https://discuss.elastic.co/u/cuongnp)\ **Replies:** 6\ **Last updated:** [May 11, 2021, 5:31pm UTC](https://discuss.elastic.co/t/custom-message-filter-with-logstash/272626 "2021-05-11T17:31:47Z")
Hi all, I have a message log below: \<85\>1 2021-05-11T09:25:02+07:00 172.19.16.241 CP-GW - Log \[Fields@1.3.6.1.4.1.2620 Log delay="1620699902" src="172.19.9.18" dst="172.19.11.13" proto="6" UP\_match\_table="TABLE\_START" … --- ## [Logstash to output syslog in Snare format](https://discuss.elastic.co/t/logstash-to-output-syslog-in-snare-format/271405)
**Author:** [@Ravi342883](https://discuss.elastic.co/u/Ravi342883)\ **Replies:** 4\ **Last updated:** [May 11, 2021, 5:10pm UTC](https://discuss.elastic.co/t/logstash-to-output-syslog-in-snare-format/271405 "2021-05-11T17:10:58Z")
Hi All, For a PoC portion, I would like to know whether logstash can output the syslogs in Snare format. Any reference? If anyone has got insights around this, please shed some light here. Thanks, Ravi --- ## [Standalone cluster appears when monitoring logstash with 27 pipeines ELK 7.12](https://discuss.elastic.co/t/standalone-cluster-appears-when-monitoring-logstash-with-27-pipeines-elk-7-12/272730)
**Author:** [@Philip\_Thomson1](https://discuss.elastic.co/u/Philip_Thomson1)\ **Replies:** 0\ **Last updated:** [May 11, 2021, 4:57pm UTC](https://discuss.elastic.co/t/standalone-cluster-appears-when-monitoring-logstash-with-27-pipeines-elk-7-12/272730 "2021-05-11T16:57:29Z")
I have upgraded to 7.12, and then dutifully setup metricbeats for monitoring ES, Kibana and logstash Its a simple setup, with one instance of logstash, however in the monitoring page I see my cluster and a "standalone c… --- ## [Logstash JSON parse error](https://discuss.elastic.co/t/logstash-json-parse-error/272533)
**Author:** [@Richard\_Phillips\_Roy](https://discuss.elastic.co/u/Richard_Phillips_Roy)\ **Replies:** 3\ **Last updated:** [May 11, 2021, 4:59pm UTC](https://discuss.elastic.co/t/logstash-json-parse-error/272533 "2021-05-11T16:59:49Z")
Hi, how do i fix this parsing error in logstash \[ERROR\] 2021-05-08 15:30:46.678 \[\[main\]\#\ **Author:** [@marone](https://discuss.elastic.co/u/marone)\ **Replies:** 4\ **Last updated:** [May 11, 2021, 4:58pm UTC](https://discuss.elastic.co/t/unable-to-connect-logstash-with-a-secured-cluster/272218 "2021-05-11T16:58:10Z") Hi I'm using ELK 7.12.0 and I'm struggling to connect my logstash with my secured cluster, without xpack logstash send data to elasticsearch using twitter plugin, but when I enable xpack for elasticsearch and try to conf… --- ## [How the APM agent for Node.js works?](https://discuss.elastic.co/t/how-the-apm-agent-for-node-js-works/272697)
**Author:** [@m-s-santos](https://discuss.elastic.co/u/m-s-santos)\ **Replies:** 1\ **Last updated:** [May 11, 2021, 4:30pm UTC](https://discuss.elastic.co/t/how-the-apm-agent-for-node-js-works/272697 "2021-05-11T16:30:28Z")
Hello, I'm trying to add APM to a Ruby application running with Eventmachine. However, since the Ruby agent doesn't support Eventmachine, I'm trying to see what I can do to make it work. The problem is that since it wor… --- ## [Recalculate times?](https://discuss.elastic.co/t/recalculate-times/272680)
**Author:** [@Tuckson](https://discuss.elastic.co/u/Tuckson)\ **Replies:** 2\ **Last updated:** [May 11, 2021, 4:03pm UTC](https://discuss.elastic.co/t/recalculate-times/272680 "2021-05-11T16:03:00Z")
Hi, Due to a number of reasons we have servers logging with UTC en servers logging with timestamps in CEST. In kibana/es I would like to see everything in CESt to easily connect the dots with events in clientdevices. Is… --- ## [Error: Failed to decrypt report job data. Please ensure that xpack.reporting.encryptionKey is set and re-generate this report. Error: Unsupported state or unable to authenticate data](https://discuss.elastic.co/t/error-failed-to-decrypt-report-job-data-please-ensure-that-xpack-reporting-encryptionkey-is-set-and-re-generate-this-report-error-unsupported-state-or-unable-to-authenticate-data/272713)
**Author:** [@testsemd\_email](https://discuss.elastic.co/u/testsemd_email)\ **Replies:** 1\ **Last updated:** [May 11, 2021, 4:02pm UTC](https://discuss.elastic.co/t/error-failed-to-decrypt-report-job-data-please-ensure-that-xpack-reporting-encryptionkey-is-set-and-re-generate-this-report-error-unsupported-state-or-unable-to-authenticate-data/272713 "2021-05-11T16:02:59Z")
Hi, I'm using elastic open source version 7.10.1 in my elastic cluster. xpack.reporting.encryptionKey has configured in kibana.yml I got this error while generating a CSV file using kibana. Also it occurs randomly. … [Previous page](https://discuss.elastic.co/latest.md?page=1682) [Next page](https://discuss.elastic.co/latest.md?page=1684)