# Latest **URL:** https://discuss.elastic.co/latest.md?page=1782 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1783 --- ## [Parsing repeated tags in XML](https://discuss.elastic.co/t/parsing-repeated-tags-in-xml/267405)
**Author:** [@adityaPsl](https://discuss.elastic.co/u/adityaPsl)\ **Replies:** 1\ **Last updated:** [March 16, 2021, 6:13pm UTC](https://discuss.elastic.co/t/parsing-repeated-tags-in-xml/267405 "2021-03-16T18:13:58Z")
Hello Team, I have XML data where there are repeated tags, as per the documentation it is converting it to an array, but I want to implement it like break on first match or convert array to single value. Could you plea… --- ## [Kibana 7.11.2 fails to start post upgrade](https://discuss.elastic.co/t/kibana-7-11-2-fails-to-start-post-upgrade/266926)
**Author:** [@parthmaniar](https://discuss.elastic.co/u/parthmaniar)\ **Replies:** 6\ **Last updated:** [March 16, 2021, 5:55pm UTC](https://discuss.elastic.co/t/kibana-7-11-2-fails-to-start-post-upgrade/266926 "2021-03-16T17:55:11Z")
I just upgraded my stack to 7.11.2 and kibana is not starting. My elasticsearch status is green. I have rebooted the host and the problem persists. Mar 11 09:59:01 hostname systemd\[1\]: kibana.service: State 'stop-sigter… --- ## [Analyse events under detection is not working](https://discuss.elastic.co/t/analyse-events-under-detection-is-not-working/266444)
**Author:** [@parthmaniar](https://discuss.elastic.co/u/parthmaniar)\ **Replies:** 3\ **Last updated:** [March 16, 2021, 5:53pm UTC](https://discuss.elastic.co/t/analyse-events-under-detection-is-not-working/266444 "2021-03-16T17:53:22Z")
Hello, Prior to updating to 7.11.1, analyse events as part of detection alerts was showing chain of events and allowing for quick analysis. However, post the upgrade; I see an "error loading data" whenever I click on an… --- ## [How can I bulk insert data?](https://discuss.elastic.co/t/how-can-i-bulk-insert-data/267311)
**Author:** [@jay2021](https://discuss.elastic.co/u/jay2021)\ **Replies:** 3\ **Last updated:** [March 16, 2021, 5:50pm UTC](https://discuss.elastic.co/t/how-can-i-bulk-insert-data/267311 "2021-03-16T17:50:18Z")
Hello, I have the following json data that I like to post to the server using the \_bulk API. { "price": 274000.00, "original\_price": 277900.00, "summary": "WHAT A FANTASTIC PROPERTY!! GREAT LOCATION IN DESE… --- ## [SIEM Network Map Errors](https://discuss.elastic.co/t/siem-network-map-errors/266386)
**Author:** [@Lin2020](https://discuss.elastic.co/u/Lin2020)\ **Replies:** 1\ **Last updated:** [March 16, 2021, 5:49pm UTC](https://discuss.elastic.co/t/siem-network-map-errors/266386 "2021-03-16T17:49:42Z")
The error on the map is "The Source Point and Destination Point no results found" and SIEM-Network-Flows: Autonomous system, Bytes in, Bytes out....no items displayed Discover error-firewall logs --- ## [Logstash configuration for multiple json (nested) files in a directory](https://discuss.elastic.co/t/logstash-configuration-for-multiple-json-nested-files-in-a-directory/267333)
**Author:** [@Razeen](https://discuss.elastic.co/u/Razeen)\ **Replies:** 3\ **Last updated:** [March 16, 2021, 4:54pm UTC](https://discuss.elastic.co/t/logstash-configuration-for-multiple-json-nested-files-in-a-directory/267333 "2021-03-16T16:54:11Z")
Hi, My logstash configuration is as follows, input { file { start\_position =\> "beginning" path =\> "/path/to/json/files\*.json" sincedb\_path =\> "/dev/null" codec =\> json } … --- ## [How to disable capturing of specific headers only](https://discuss.elastic.co/t/how-to-disable-capturing-of-specific-headers-only/267282)
**Author:** [@kbalys](https://discuss.elastic.co/u/kbalys)\ **Replies:** 3\ **Last updated:** [March 16, 2021, 4:49pm UTC](https://discuss.elastic.co/t/how-to-disable-capturing-of-specific-headers-only/267282 "2021-03-16T16:49:33Z")
I would like to skip capturing of some of the request headers. I am aware of of the settings: \ But this disables capturing of all headers, after that I don't have for… --- ## [Metricbeat "Failed due to panic.{"panic": "runtime error: index out of range \[0\]"](https://discuss.elastic.co/t/metricbeat-failed-due-to-panic-panic-runtime-error-index-out-of-range-0/267047)
**Author:** [@ankitdevnalkar](https://discuss.elastic.co/u/ankitdevnalkar)\ **Replies:** 4\ **Last updated:** [March 16, 2021, 4:41pm UTC](https://discuss.elastic.co/t/metricbeat-failed-due-to-panic-panic-runtime-error-index-out-of-range-0/267047 "2021-03-16T16:41:18Z")
I am using the Metricbeat AWS module while starting Metricbeat, I am facing the following error. I went through Git issues but seems it's fixed in the version I am using. I am pasting my aws.yml as well for reference. E… --- ## [Cross-cluster search on-premise remote cluster from Elastic Cloud Deployment](https://discuss.elastic.co/t/cross-cluster-search-on-premise-remote-cluster-from-elastic-cloud-deployment/267273)
**Author:** [@cvanhalt](https://discuss.elastic.co/u/cvanhalt)\ **Replies:** 2\ **Last updated:** [March 16, 2021, 4:06pm UTC](https://discuss.elastic.co/t/cross-cluster-search-on-premise-remote-cluster-from-elastic-cloud-deployment/267273 "2021-03-16T16:06:06Z")
Is it possible to use the cross-cluster search feature to query a Elastic Cloud Deployment in Azure and an on-premise remote Cluster? Both with the Basic/Standard License. Connection should be made through a VPN. I'm … --- ## [Retry Logstash connection to a DB after failed attempt](https://discuss.elastic.co/t/retry-logstash-connection-to-a-db-after-failed-attempt/266441)
**Author:** [@d.malacrida](https://discuss.elastic.co/u/d.malacrida)\ **Replies:** 4\ **Last updated:** [March 16, 2021, 4:30pm UTC](https://discuss.elastic.co/t/retry-logstash-connection-to-a-db-after-failed-attempt/266441 "2021-03-16T16:30:09Z")
Hello everyone, We have set up a Logstash connector to gather data from a DB every day at a fixed time (7 a.m.). Now, we have included the following parameters in the input.conf file (some parameters are masked for obvi… --- ## [LOGSTASH : output pipe](https://discuss.elastic.co/t/logstash-output-pipe/267390)
**Author:** [@Alex\_Lum](https://discuss.elastic.co/u/Alex_Lum)\ **Replies:** 2\ **Last updated:** [March 16, 2021, 4:24pm UTC](https://discuss.elastic.co/t/logstash-output-pipe/267390 "2021-03-16T16:24:10Z")
Hello there, I have a winlogbeat which send datas on logstash. On logstash : input beat, some filters and output to elasticSearch. But i want to output SOME fields on a named pipe (mkfifo) to insert them on a MariaDB. … --- ## [Delete or update document without document\_id](https://discuss.elastic.co/t/delete-or-update-document-without-document-id/267375)
**Author:** [@lele15](https://discuss.elastic.co/u/lele15)\ **Replies:** 5\ **Last updated:** [March 16, 2021, 4:18pm UTC](https://discuss.elastic.co/t/delete-or-update-document-without-document-id/267375 "2021-03-16T16:18:25Z")
Hi, i'm new on ES, i'am using logstash and csv to update or delete values into ES. I want to delete or update document based on different field not only with document\_id like this: input { stdin{} } filter { csv … --- ## [How to create periodic check in logstash](https://discuss.elastic.co/t/how-to-create-periodic-check-in-logstash/267342)
**Author:** [@anupts](https://discuss.elastic.co/u/anupts)\ **Replies:** 1\ **Last updated:** [March 16, 2021, 3:59pm UTC](https://discuss.elastic.co/t/how-to-create-periodic-check-in-logstash/267342 "2021-03-16T15:59:45Z")
Hello, We have requirement , where we need to monitor for user activity on periodic basis. We will have this information in our log file . FOr example: User has accessed some page in the application. This will be log… --- ## [Primary store size showing wrong info while using \_cat/indices](https://discuss.elastic.co/t/primary-store-size-showing-wrong-info-while-using-cat-indices/267361)
**Author:** [@Divit\_Sharma](https://discuss.elastic.co/u/Divit_Sharma)\ **Replies:** 6\ **Last updated:** [March 16, 2021, 3:41pm UTC](https://discuss.elastic.co/t/primary-store-size-showing-wrong-info-while-using-cat-indices/267361 "2021-03-16T15:41:02Z")
I somehow doubt \_cat/indices is showing me wrong information regarding store size. I have two indices - giitran\_with\_message and giitran\_without\_message. Now both have have almost the same document. Each one has 1000 … --- ## [Export and Import Index Patterns using elasticdump in ELK ver 7](https://discuss.elastic.co/t/export-and-import-index-patterns-using-elasticdump-in-elk-ver-7/267302)
**Author:** [@nguyenduyhung1979](https://discuss.elastic.co/u/nguyenduyhung1979)\ **Replies:** 13\ **Last updated:** [March 16, 2021, 3:16pm UTC](https://discuss.elastic.co/t/export-and-import-index-patterns-using-elasticdump-in-elk-ver-7/267302 "2021-03-16T15:16:26Z")
I try setup automation system which has the workflow: Have server where ELK stack has been installed and has basic configuration Import the index into ElasticSearch (ES), next Kibana can use that index for Visualize F… --- ## [ERROR reindex](https://discuss.elastic.co/t/error-reindex/267252)
**Author:** [@artem33region](https://discuss.elastic.co/u/artem33region)\ **Replies:** 13\ **Last updated:** [March 16, 2021, 3:08pm UTC](https://discuss.elastic.co/t/error-reindex/267252 "2021-03-16T15:08:36Z")
Всем привет! В Index template поменял mapping поля на integer, соответственно после этого у меня нарисовались конфликты по типу поля. Хотел сделать reindex, но в процессе отработки вылетает ошибка. POST запрос в Dev To… --- ## [How you deal with ILM for kubernetes cluster applications?](https://discuss.elastic.co/t/how-you-deal-with-ilm-for-kubernetes-cluster-applications/267391)
**Author:** [@Kosodrom](https://discuss.elastic.co/u/Kosodrom)\ **Replies:** 0\ **Last updated:** [March 16, 2021, 3:08pm UTC](https://discuss.elastic.co/t/how-you-deal-with-ilm-for-kubernetes-cluster-applications/267391 "2021-03-16T15:08:33Z")
Hi, I am collecting logs from kubernetes cluster using filebeat, which is deployed as daemonset I ship logs using logstash to my elasticsearch cluster in one index I am using ILM for controlling the retention time for … --- ## [Split/explode strings](https://discuss.elastic.co/t/split-explode-strings/267369)
**Author:** [@cibernicola](https://discuss.elastic.co/u/cibernicola)\ **Replies:** 2\ **Last updated:** [March 16, 2021, 2:56pm UTC](https://discuss.elastic.co/t/split-explode-strings/267369 "2021-03-16T14:56:03Z")
Hi, I have several text strings with separator patterns that I would like to be able to ingest as objects in elasticsearch, these strings are of the style: (a) text|text b) number text|number text c) mailto:text@text … --- ## [CCR between 2 Elastic clusters in different K8s clusters](https://discuss.elastic.co/t/ccr-between-2-elastic-clusters-in-different-k8s-clusters/267287)
**Author:** [@jcobb48](https://discuss.elastic.co/u/jcobb48)\ **Replies:** 0\ **Last updated:** [March 15, 2021, 4:11pm UTC](https://discuss.elastic.co/t/ccr-between-2-elastic-clusters-in-different-k8s-clusters/267287 "2021-03-15T16:11:39Z")
Hi everyone, wanted to get some advice to implement cross-cluster replication between 2 Elasticsearch clusters that are deployed in different Kubernetes clusters. Both ES clusters are healthy and running with version 6.… --- ## [Configure Input and Modules at the same time for Filebeat](https://discuss.elastic.co/t/configure-input-and-modules-at-the-same-time-for-filebeat/266575)
**Author:** [@Kosodrom](https://discuss.elastic.co/u/Kosodrom)\ **Replies:** 4\ **Last updated:** [March 16, 2021, 2:37pm UTC](https://discuss.elastic.co/t/configure-input-and-modules-at-the-same-time-for-filebeat/266575 "2021-03-16T14:37:53Z")
Hi, I have following scenario: One filebeat installation to collect icinga logs. For this I am using icinga module On the same host I have another application's logs, which are located in different path and have d… --- ## [Data Reports not working without change](https://discuss.elastic.co/t/data-reports-not-working-without-change/265976)
**Author:** [@Atul\_Chadha](https://discuss.elastic.co/u/Atul_Chadha)\ **Replies:** 2\ **Last updated:** [March 16, 2021, 2:10pm UTC](https://discuss.elastic.co/t/data-reports-not-working-without-change/265976 "2021-03-16T14:10:46Z")
One of the environments on 7.6 has stopped reporting total number of hosts on a fixed pattern without any change. It was working fine before the weekend The data for the index pattern is coming in fine and i am able t… --- ## [Create keystore and keys with ansible](https://discuss.elastic.co/t/create-keystore-and-keys-with-ansible/267381)
**Author:** [@Soren\_vdc](https://discuss.elastic.co/u/Soren_vdc)\ **Replies:** 0\ **Last updated:** [March 16, 2021, 1:54pm UTC](https://discuss.elastic.co/t/create-keystore-and-keys-with-ansible/267381 "2021-03-16T13:54:58Z")
Hi, I want to create ansible code to secure the password of the logstash user to send data to Elasticsearch. I have checked with the procedure with the keystore and it works fine to create the keystore but to add the ke… --- ## [Plugin questions](https://discuss.elastic.co/t/plugin-questions/267378)
**Author:** [@nmalocic](https://discuss.elastic.co/u/nmalocic)\ **Replies:** 0\ **Last updated:** [March 16, 2021, 1:37pm UTC](https://discuss.elastic.co/t/plugin-questions/267378 "2021-03-16T13:37:01Z")
Hi everyone, I have few questions related to plugins. Is it possible to log actions inside my processor plugin? What is the best way to ensure all existing documents are processed with new plugin and processor that us… --- ## [How to check if the data is coming in last 30 min](https://discuss.elastic.co/t/how-to-check-if-the-data-is-coming-in-last-30-min/267341)
**Author:** [@jyothsna](https://discuss.elastic.co/u/jyothsna)\ **Replies:** 2\ **Last updated:** [March 16, 2021, 1:10pm UTC](https://discuss.elastic.co/t/how-to-check-if-the-data-is-coming-in-last-30-min/267341 "2021-03-16T13:10:26Z")
Hi, I am ingesting data from sql to elastic through logstash. Now I want to check whether the data is coming or not in last30 min .if not coming so that i can trap as missing data in elasticsearch. how to achieve this. … --- ## [Disable adding filter upon click on a bar chart](https://discuss.elastic.co/t/disable-adding-filter-upon-click-on-a-bar-chart/267350)
**Author:** [@kasun](https://discuss.elastic.co/u/kasun)\ **Replies:** 3\ **Last updated:** [March 16, 2021, 12:47pm UTC](https://discuss.elastic.co/t/disable-adding-filter-upon-click-on-a-bar-chart/267350 "2021-03-16T12:47:40Z")
Hi all, In above chart when I click on bars it will automatically add a filter to the entire dashboard. As an example when I click on the first bar it will add a filter as in below. Is there a way to disable this … --- ## [Colors in Elastic Detections Alert Emails](https://discuss.elastic.co/t/colors-in-elastic-detections-alert-emails/267155)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 3\ **Last updated:** [March 16, 2021, 12:05pm UTC](https://discuss.elastic.co/t/colors-in-elastic-detections-alert-emails/267155 "2021-03-16T12:05:59Z")
Hello, Can we use colors in Elastic Detections Alert Emails? Willem --- ## [Bad dates in names after rolling with ILM](https://discuss.elastic.co/t/bad-dates-in-names-after-rolling-with-ilm/267270)
**Author:** [@Jiri\_Petak](https://discuss.elastic.co/u/Jiri_Petak)\ **Replies:** 1\ **Last updated:** [March 16, 2021, 11:55am UTC](https://discuss.elastic.co/t/bad-dates-in-names-after-rolling-with-ilm/267270 "2021-03-16T11:55:30Z")
Hi, i am working on Elasticsearch version 7.7.0 with logstash and creating indices with ILM and rolling index aliases. I have defined ILM like: { "weekly\_rollover-4w\_retention" : { "version" : 2, … --- ## [Recommendation for upgrading kubernetes nodes managed by node group](https://discuss.elastic.co/t/recommendation-for-upgrading-kubernetes-nodes-managed-by-node-group/267143)
**Author:** [@gerardgorrion](https://discuss.elastic.co/u/gerardgorrion)\ **Replies:** 1\ **Last updated:** [March 16, 2021, 11:51am UTC](https://discuss.elastic.co/t/recommendation-for-upgrading-kubernetes-nodes-managed-by-node-group/267143 "2021-03-16T11:51:48Z")
When the kubernetes ASG is manually managed, we manually stopping pods to draining nodes into nodes update. We want to use self managed node groups, but planning the migration, we think that the migration nodes data, an… --- ## [Configure SSL/TLS beats for Windows](https://discuss.elastic.co/t/configure-ssl-tls-beats-for-windows/267346)
**Author:** [@ravenmx](https://discuss.elastic.co/u/ravenmx)\ **Replies:** 1\ **Last updated:** [March 16, 2021, 11:45am UTC](https://discuss.elastic.co/t/configure-ssl-tls-beats-for-windows/267346 "2021-03-16T11:45:21Z")
Hello. I can not configure metricbeat for Windows. It is required to configure ssl / tsl connection before logstash. but the agent does not accept system paths (C: \\ path \\ to \\ beats \\ sslCA.pem). therefore I can not sp… --- ## [Using the heartbeat (6.8.3) keystore prevents heartbeat windows service starting](https://discuss.elastic.co/t/using-the-heartbeat-6-8-3-keystore-prevents-heartbeat-windows-service-starting/267353)
**Author:** [@halltony](https://discuss.elastic.co/u/halltony)\ **Replies:** 0\ **Last updated:** [March 16, 2021, 11:06am UTC](https://discuss.elastic.co/t/using-the-heartbeat-6-8-3-keystore-prevents-heartbeat-windows-service-starting/267353 "2021-03-16T11:06:45Z")
I am trying to use the heartbeat keystore to store credentials used to authenticate with my Elastic Search cluster. The configuration works fine when run from a command line but when I use it via a windows service the s… [Previous page](https://discuss.elastic.co/latest.md?page=1781) [Next page](https://discuss.elastic.co/latest.md?page=1783)