# Latest **URL:** https://discuss.elastic.co/latest.md?page=1867 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1868 --- ## [MISP and Elastic Security](https://discuss.elastic.co/t/misp-and-elastic-security/257644)
**Author:** [@Ameer\_Mukadam](https://discuss.elastic.co/u/Ameer_Mukadam)\ **Replies:** 15\ **Last updated:** [January 30, 2021, 8:45am UTC](https://discuss.elastic.co/t/misp-and-elastic-security/257644 "2021-01-30T08:45:20Z")
I have a use case where I want to index attributes from MISP to Elasticsearch for using the new Threat Matching rule in Elastic Security 7.10. Everything is working fine but the issue is when I try to ingest more attrib… --- ## [Problem in deploying an Elasticsearch cluster](https://discuss.elastic.co/t/problem-in-deploying-an-elasticsearch-cluster/262703)
**Author:** [@AayushPatel](https://discuss.elastic.co/u/AayushPatel)\ **Replies:** 1\ **Last updated:** [January 30, 2021, 8:02am UTC](https://discuss.elastic.co/t/problem-in-deploying-an-elasticsearch-cluster/262703 "2021-01-30T08:02:30Z")
Hi I tried to deploy an ELasticsearch cluster by first installing 3 master nodes (stacks 7.9) everything is fine but when I try to connect the nodes to each other some weird situation occurs. at first all the nodes wo… --- ## [Boundary Search x miles from original Boundary](https://discuss.elastic.co/t/boundary-search-x-miles-from-original-boundary/256239)
**Author:** [@mecham](https://discuss.elastic.co/u/mecham)\ **Replies:** 1\ **Last updated:** [January 30, 2021, 7:15am UTC](https://discuss.elastic.co/t/boundary-search-x-miles-from-original-boundary/256239 "2021-01-30T07:15:38Z")
I can across this article and found it very useful: I am trying to achieve something a little different and I thought you might be able to advise. On Rightmove.co.uk you can perform a radius search: https://www.righ… --- ## [App Search indices not accessible through Kibana?](https://discuss.elastic.co/t/app-search-indices-not-accessible-through-kibana/262435)
**Author:** [@sabetali](https://discuss.elastic.co/u/sabetali)\ **Replies:** 10\ **Last updated:** [January 30, 2021, 4:27am UTC](https://discuss.elastic.co/t/app-search-indices-not-accessible-through-kibana/262435 "2021-01-30T04:27:28Z")
When I navigate to Index Management on the Kibana console, my App Search indices don't show up. Why is this the case? Can I create an index through my elasticsearch endpoint and have it be accessible through my App Searc… --- ## [Log source "unknown" in Observability Overview](https://discuss.elastic.co/t/log-source-unknown-in-observability-overview/262568)
**Author:** [@strophy](https://discuss.elastic.co/u/strophy)\ **Replies:** 3\ **Last updated:** [January 30, 2021, 4:20am UTC](https://discuss.elastic.co/t/log-source-unknown-in-observability-overview/262568 "2021-01-30T04:20:38Z")
I'm new to Elastic Stack and have successfully set up a pipeline with Filebeat, Elasticsearch and Kibana to ingest data from log files. I have set up the display fields in Observability settings, which works for the Logs… --- ## [Return the top k hits from each bucket after aggregation?](https://discuss.elastic.co/t/return-the-top-k-hits-from-each-bucket-after-aggregation/262687)
**Author:** [@sabetai](https://discuss.elastic.co/u/sabetai)\ **Replies:** 2\ **Last updated:** [January 30, 2021, 12:25am UTC](https://discuss.elastic.co/t/return-the-top-k-hits-from-each-bucket-after-aggregation/262687 "2021-01-30T00:25:17Z")
I'd like the top k hits from each index to be returned, I'm using the following query: GET /index-\*/\_search { "query": { "multi\_match": { "query": "word1 word2", "type": "phrase", "fields": \["fie… --- ## [Logstash 7.2.0 install error](https://discuss.elastic.co/t/logstash-7-2-0-install-error/188356)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 7\ **Last updated:** [January 29, 2021, 11:33pm UTC](https://discuss.elastic.co/t/logstash-7-2-0-install-error/188356 "2021-01-29T23:33:41Z")
I was upgrading whole stack to 7.2.0 and got following error Updating / installing... 1:logstash-1:7.2.0-1 ################################# \[ 17%\] Using provided startup.options file: /etc/logstash/star… --- ## [JSON Parsing Of Filtered Syslog JSON Objects Fails](https://discuss.elastic.co/t/json-parsing-of-filtered-syslog-json-objects-fails/261959)
**Author:** [@InfosecAtom](https://discuss.elastic.co/u/InfosecAtom)\ **Replies:** 2\ **Last updated:** [January 29, 2021, 10:42pm UTC](https://discuss.elastic.co/t/json-parsing-of-filtered-syslog-json-objects-fails/261959 "2021-01-29T22:42:45Z")
I am using the following config and seeing no output. Non-JSON object containing Syslog entries, as well as JSON object containing Syslog entries, are both being dropped. If I comment out the JSON parse then the JSON obj… --- ## [vSphere module fields](https://discuss.elastic.co/t/vsphere-module-fields/262692)
**Author:** [@Ishaan](https://discuss.elastic.co/u/Ishaan)\ **Replies:** 2\ **Last updated:** [January 29, 2021, 10:34pm UTC](https://discuss.elastic.co/t/vsphere-module-fields/262692 "2021-01-29T22:34:34Z")
I read somewhere that the vSphere module is in beta version. Is that true? Is there a plan to collect more metrics in vSphere module as the current fields are very limited? --- ## [Enable readonly mode Elastic workplace search on docker desktop](https://discuss.elastic.co/t/enable-readonly-mode-elastic-workplace-search-on-docker-desktop/262545)
**Author:** [@Prasanna\_K](https://discuss.elastic.co/u/Prasanna_K)\ **Replies:** 13\ **Last updated:** [January 29, 2021, 10:14pm UTC](https://discuss.elastic.co/t/enable-readonly-mode-elastic-workplace-search-on-docker-desktop/262545 "2021-01-29T22:14:28Z")
Hi, I am trying to setup a POC of elastic enterprise workplace search on my docker desktop. I am able to successfully setup the Elasticsearch. The workplace search container is able to connect. However, it says there is… --- ## [Bulk indexing of signals failed in Kibana 7.10.2](https://discuss.elastic.co/t/bulk-indexing-of-signals-failed-in-kibana-7-10-2/262373)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 7\ **Last updated:** [January 29, 2021, 9:29pm UTC](https://discuss.elastic.co/t/bulk-indexing-of-signals-failed-in-kibana-7-10-2/262373 "2021-01-29T21:29:30Z")
Hello, Just noticed our custom SIEM rules seem to throw errors, such as: Bulk Indexing of signals failed: reason: "No mapping found for \[@timestamp\] in order to sort on" type: "query\_shard\_exception" name: "Elastic Aud… --- ## [Is it possible to add to @metadata in Filebeat?](https://discuss.elastic.co/t/is-it-possible-to-add-to-metadata-in-filebeat/262561)
**Author:** [@Alex\_Nelson](https://discuss.elastic.co/u/Alex_Nelson)\ **Replies:** 6\ **Last updated:** [January 29, 2021, 9:21pm UTC](https://discuss.elastic.co/t/is-it-possible-to-add-to-metadata-in-filebeat/262561 "2021-01-29T21:21:05Z")
I have the following processors: - add\_fields: target: '@metadata' fields: index\_prefix: 'flow\_metadata\_event' which gives me the following using output.console (note there are 2 object … --- ## [Logstash is not ingesting data in real time](https://discuss.elastic.co/t/logstash-is-not-ingesting-data-in-real-time/262642)
**Author:** [@shoaib\_akram](https://discuss.elastic.co/u/shoaib_akram)\ **Replies:** 1\ **Last updated:** [January 29, 2021, 8:23pm UTC](https://discuss.elastic.co/t/logstash-is-not-ingesting-data-in-real-time/262642 "2021-01-29T20:23:11Z")
Hi Everyone, I am ingesting data from thousands of file with logstash into elasticsearch and files are parallely updating and updating records are not ingesting in real time. Please help me out what i need to change se… --- ## [What is the proper design pattern for plugins that must submit multiple requests to Elasticsearch?](https://discuss.elastic.co/t/what-is-the-proper-design-pattern-for-plugins-that-must-submit-multiple-requests-to-elasticsearch/262190)
**Author:** [@davemoore](https://discuss.elastic.co/u/davemoore)\ **Replies:** 13\ **Last updated:** [January 29, 2021, 8:18pm UTC](https://discuss.elastic.co/t/what-is-the-proper-design-pattern-for-plugins-that-must-submit-multiple-requests-to-elasticsearch/262190 "2021-01-29T20:18:47Z")
Question for plugin authors What is the proper way to implement a REST handler in a custom ActionPlugin (a.k.a. API extension plugin) that must wait for the response of multiple Elasticsearch requests before returning a… --- ## [Kibana unable to authenticate](https://discuss.elastic.co/t/kibana-unable-to-authenticate/260830)
**Author:** [@Daniel\_J1996](https://discuss.elastic.co/u/Daniel_J1996)\ **Replies:** 9\ **Last updated:** [January 29, 2021, 8:08pm UTC](https://discuss.elastic.co/t/kibana-unable-to-authenticate/260830 "2021-01-29T20:08:29Z")
Hello, I have been running into an issue with my Kibana dashboard. Currently, it shows "Kibana server is not ready yet". When I use the journalctl -xe command, I see the following error for Kibana: \["warning","plugins"… --- ## [Redis in elk](https://discuss.elastic.co/t/redis-in-elk/262076)
**Author:** [@Tuckson](https://discuss.elastic.co/u/Tuckson)\ **Replies:** 7\ **Last updated:** [January 29, 2021, 3:22pm UTC](https://discuss.elastic.co/t/redis-in-elk/262076 "2021-01-29T15:22:21Z")
Hi, I have this elk stack running, 8 datanodes, 4 ingestnodes, 4 logstashes en a shitload of applications that send data from multiple servers via filebeat. The size of these applications vary from 4 servers to 24 on … --- ## [Filebeat Bug: exclude\_lines](https://discuss.elastic.co/t/filebeat-bug-exclude-lines/262611)
**Author:** [@Peter\_Boos](https://discuss.elastic.co/u/Peter_Boos)\ **Replies:** 2\ **Last updated:** [January 29, 2021, 7:39pm UTC](https://discuss.elastic.co/t/filebeat-bug-exclude-lines/262611 "2021-01-29T19:39:49Z")
BUG report filebeat version : filebeat-7.10.1-2021.01.13-000001 problem : The exclude\_lines option in filebeat.yml does not work. Example item to be filtered out : 2021-01-27T02:08:31.775-0500#011INFO#011log/harvest… --- ## [REST API for adding users](https://discuss.elastic.co/t/rest-api-for-adding-users/262570)
**Author:** [@umesh2020](https://discuss.elastic.co/u/umesh2020)\ **Replies:** 4\ **Last updated:** [January 29, 2021, 7:23pm UTC](https://discuss.elastic.co/t/rest-api-for-adding-users/262570 "2021-01-29T19:23:47Z")
Hi Is there a REST API for adding users provided by Kibana ? OR I can use the elasticsearch create user API to add users ? Thanks, Umesh --- ## [Enterprise Search SAML login Unauthorized](https://discuss.elastic.co/t/enterprise-search-saml-login-unauthorized/262406)
**Author:** [@jvo](https://discuss.elastic.co/u/jvo)\ **Replies:** 1\ **Last updated:** [January 29, 2021, 7:15pm UTC](https://discuss.elastic.co/t/enterprise-search-saml-login-unauthorized/262406 "2021-01-29T19:15:45Z")
I followed the above documentation on configuring the SAML with a Google SAML app. Logging into Kibana with SAML works now, but I'm having issues with the SAML authentication for Enterprise Search. This is the response… --- ## [Filter visualisation not providing full terms list, autocomplete settings are not making any differences](https://discuss.elastic.co/t/filter-visualisation-not-providing-full-terms-list-autocomplete-settings-are-not-making-any-differences/262618)
**Author:** [@Luukv](https://discuss.elastic.co/u/Luukv)\ **Replies:** 3\ **Last updated:** [January 29, 2021, 6:29pm UTC](https://discuss.elastic.co/t/filter-visualisation-not-providing-full-terms-list-autocomplete-settings-are-not-making-any-differences/262618 "2021-01-29T18:29:42Z")
Hello, In the past months I have made several filter/control panel visualisations for multiple dashboards. These have all worked well, but with the most recent one I've ran into some problems. We were experiencing some… --- ## [Kibana scripted fields](https://discuss.elastic.co/t/kibana-scripted-fields/262675)
**Author:** [@Gokul6](https://discuss.elastic.co/u/Gokul6)\ **Replies:** 1\ **Last updated:** [January 29, 2021, 6:20pm UTC](https://discuss.elastic.co/t/kibana-scripted-fields/262675 "2021-01-29T18:20:53Z")
i have several boolean fields like weekDays.friday.is24HourService, weekDays.saturday.is24HourService in my index. i am getting the day of week using \[doc\['@timestamp'\].value.dayOfWeek\] which returns a numeric value, fo… --- ## [Elastic APM in ASP.NET Framework Configuration](https://discuss.elastic.co/t/elastic-apm-in-asp-net-framework-configuration/262674)
**Author:** [@KonfuPanda](https://discuss.elastic.co/u/KonfuPanda)\ **Replies:** 0\ **Last updated:** [January 29, 2021, 5:24pm UTC](https://discuss.elastic.co/t/elastic-apm-in-asp-net-framework-configuration/262674 "2021-01-29T17:24:21Z")
How can I change the configuration values programmtically/change them at runtime, e.g.: Instead of setting in the Web.config in node the environment like this: \ I wan… --- ## [Cannot search the documentation with Chromium](https://discuss.elastic.co/t/cannot-search-the-documentation-with-chromium/262575)
**Author:** [@Karel\_Cech](https://discuss.elastic.co/u/Karel_Cech)\ **Replies:** 3\ **Last updated:** [January 29, 2021, 5:17pm UTC](https://discuss.elastic.co/t/cannot-search-the-documentation-with-chromium/262575 "2021-01-29T17:17:23Z")
Hi, I just can't search the docs lately with Chromium on Ubuntu 20.04. Firefox does work. When typing a keyword in the search box, Swifttype basic auth login dialog appears. From there it only leads to a 401. Chr… --- ## [Split field and add new fields](https://discuss.elastic.co/t/split-field-and-add-new-fields/262571)
**Author:** [@jtillman2020](https://discuss.elastic.co/u/jtillman2020)\ **Replies:** 3\ **Last updated:** [January 29, 2021, 5:01pm UTC](https://discuss.elastic.co/t/split-field-and-add-new-fields/262571 "2021-01-29T17:01:51Z")
I have a string field named "One". \<165\>Original Address=1.1.1.1 1 2021-01-28T15:08:03.136-05:00 DeviceName - - - - fpc3 DHCP Packet Drop: Packet src ip/mac 192.168.123.1/54:48:10:db:86:b6 I use mutate { split =\> … --- ## [Delete old indexes via Index lifecycle policy doesn't work because of shards error](https://discuss.elastic.co/t/delete-old-indexes-via-index-lifecycle-policy-doesnt-work-because-of-shards-error/262619)
**Author:** [@mfa](https://discuss.elastic.co/u/mfa)\ **Replies:** 1\ **Last updated:** [January 29, 2021, 4:24pm UTC](https://discuss.elastic.co/t/delete-old-indexes-via-index-lifecycle-policy-doesnt-work-because-of-shards-error/262619 "2021-01-29T16:24:03Z")
I have read through the docs and some posts here, however my delete policy is not working as expected. Here is my policy: PUT \_ilm/policy/deleting\_policy { "policy": { "phases": { "hot": … --- ## [Grok not parsing any pattern](https://discuss.elastic.co/t/grok-not-parsing-any-pattern/262669)
**Author:** [@werther158](https://discuss.elastic.co/u/werther158)\ **Replies:** 0\ **Last updated:** [January 29, 2021, 4:14pm UTC](https://discuss.elastic.co/t/grok-not-parsing-any-pattern/262669 "2021-01-29T16:14:02Z")
Hi, I'm trying to parse some apache logs like this: 46.105.14.53 - - \[20/May/2015:21:05:15 +0000\] "GET /blog/tags/puppet?flav=rss20 HTTP/1.1" 200 14872 "-" "UniversalFeedParser/4.2-pre-314-svn +http://feedparser.org/" F… --- ## [Action export selected signals to csv](https://discuss.elastic.co/t/action-export-selected-signals-to-csv/262497)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 7\ **Last updated:** [January 29, 2021, 4:04pm UTC](https://discuss.elastic.co/t/action-export-selected-signals-to-csv/262497 "2021-01-29T16:04:29Z")
hello, Just a thought for a SIEM feature. We have colleagues with limited or no acces to Elastic / Kibana. But sometimes they do need to get a list of some signals. Imho it would be super handy to be able to quickly exp… --- ## [Is my data just not conforming to the pipeline? Filebeat not processing iptables](https://discuss.elastic.co/t/is-my-data-just-not-conforming-to-the-pipeline-filebeat-not-processing-iptables/262259)
**Author:** [@rfischman](https://discuss.elastic.co/u/rfischman)\ **Replies:** 2\ **Last updated:** [January 29, 2021, 3:54pm UTC](https://discuss.elastic.co/t/is-my-data-just-not-conforming-to-the-pipeline-filebeat-not-processing-iptables/262259 "2021-01-29T15:54:00Z")
Hopefully the group can help me out here... I've got my network infrastructure (coming out of a unifi controller) sending syslog to a filebeat over UDP/514. The messages are iptables logs. I'm not seeing any of the me… --- ## [Grok pattern to parse to multiple values](https://discuss.elastic.co/t/grok-pattern-to-parse-to-multiple-values/262651)
**Author:** [@Deny7](https://discuss.elastic.co/u/Deny7)\ **Replies:** 5\ **Last updated:** [January 29, 2021, 3:49pm UTC](https://discuss.elastic.co/t/grok-pattern-to-parse-to-multiple-values/262651 "2021-01-29T15:49:29Z")
Hi, I have log line like this: ",session":"kred06@gmail.com" Grok Pattern: (,"session":"(%{DATA:name}@%{DATA:company})?")? and I want to split the email to values name and company and also save email as whole to s… --- ## [Need to execute watcher alert based on each element of array](https://discuss.elastic.co/t/need-to-execute-watcher-alert-based-on-each-element-of-array/262592)
**Author:** [@Sumit\_Kumar1](https://discuss.elastic.co/u/Sumit_Kumar1)\ **Replies:** 1\ **Last updated:** [January 29, 2021, 3:39pm UTC](https://discuss.elastic.co/t/need-to-execute-watcher-alert-based-on-each-element-of-array/262592 "2021-01-29T15:39:34Z")
Need to execute watcher alert based on each element of array. I am using chain input . First search provides me list of array . So, for each element of the array i need to make a search on each iteration . My result of… [Previous page](https://discuss.elastic.co/latest.md?page=1866) [Next page](https://discuss.elastic.co/latest.md?page=1868)