# Latest **URL:** https://discuss.elastic.co/latest.md?page=1868 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1869 --- ## [Masking logic is not working](https://discuss.elastic.co/t/masking-logic-is-not-working/261827)
**Author:** [@shree2](https://discuss.elastic.co/u/shree2)\ **Replies:** 10\ **Last updated:** [January 29, 2021, 3:31pm UTC](https://discuss.elastic.co/t/masking-logic-is-not-working/261827 "2021-01-29T15:31:49Z")
Hi, I want to mask the few fields input is coming from json . Please find the configuration below. input { file { path =\> "xxx/sample.log" } } filter { mutate { gsub =\> \["message", "PASSWORD:((?=.\[a-z\])(?=.\[… --- ## [Persistent queue and kafka](https://discuss.elastic.co/t/persistent-queue-and-kafka/262662)
**Author:** [@bovy89](https://discuss.elastic.co/u/bovy89)\ **Replies:** 0\ **Last updated:** [January 29, 2021, 3:31pm UTC](https://discuss.elastic.co/t/persistent-queue-and-kafka/262662 "2021-01-29T15:31:35Z")
Hi, we are using logstash with persistent queue feature enabled and the following setup: filebeat ---\> logstash (with PQ) ---\> elasticsearch Now we are moving to a kafka based setup like that: filebeat ---\> kafka ---… --- ## [Get current active users in the application using Elastic/Kibana Visualization](https://discuss.elastic.co/t/get-current-active-users-in-the-application-using-elastic-kibana-visualization/262030)
**Author:** [@SAKA\_RAM\_DEWASI](https://discuss.elastic.co/u/SAKA_RAM_DEWASI)\ **Replies:** 3\ **Last updated:** [January 29, 2021, 3:27pm UTC](https://discuss.elastic.co/t/get-current-active-users-in-the-application-using-elastic-kibana-visualization/262030 "2021-01-29T15:27:03Z")
Hi all, I am new to elastic and kibana. I want to get current active users in web application using audit logs stored in elastic index. We capture login and logout event of user in audit log and stored as document in el… --- ## [Not parsing apache access and error logs](https://discuss.elastic.co/t/not-parsing-apache-access-and-error-logs/262535)
**Author:** [@kevintts](https://discuss.elastic.co/u/kevintts)\ **Replies:** 2\ **Last updated:** [January 29, 2021, 2:58pm UTC](https://discuss.elastic.co/t/not-parsing-apache-access-and-error-logs/262535 "2021-01-29T14:58:49Z")
I am using filebeat to send apache logs to logstash on my elastic server. I can see the log entries with event.dataset set to apache.access , but they aren't being parsed, so no info in dashboard apache screens. Also, wh… --- ## [Kibana Error Alerting - Filter Similiar Error Messages | Similarity Query \[Elastalert\]](https://discuss.elastic.co/t/kibana-error-alerting-filter-similiar-error-messages-similarity-query-elastalert/262517)
**Author:** [@MartinJaskulla](https://discuss.elastic.co/u/MartinJaskulla)\ **Replies:** 2\ **Last updated:** [January 29, 2021, 2:02pm UTC](https://discuss.elastic.co/t/kibana-error-alerting-filter-similiar-error-messages-similarity-query-elastalert/262517 "2021-01-29T14:02:09Z")
My goal is to be alerted for unique error types only (Elasticsearch 6.8 + Elastalert). Example error logs (5 documents, same index, same field): Error 9837 in Component X trying to reconnect in 9.3 seconds Error 9837 … --- ## [Kibana Timezone incompatiblities](https://discuss.elastic.co/t/kibana-timezone-incompatiblities/262649)
**Author:** [@d3v3lop3r](https://discuss.elastic.co/u/d3v3lop3r)\ **Replies:** 4\ **Last updated:** [January 29, 2021, 1:21pm UTC](https://discuss.elastic.co/t/kibana-timezone-incompatiblities/262649 "2021-01-29T13:21:24Z")
Hello there, Iam trying to make my Data visible in the Discover Tab of Kibana and it's just not working out for me. Iam sitting on a project for my studies and built a weather station. The station submits its data once… --- ## [Many or single pipeline performance with querys](https://discuss.elastic.co/t/many-or-single-pipeline-performance-with-querys/262650)
**Author:** [@pereyrdi](https://discuss.elastic.co/u/pereyrdi)\ **Replies:** 0\ **Last updated:** [January 29, 2021, 1:18pm UTC](https://discuss.elastic.co/t/many-or-single-pipeline-performance-with-querys/262650 "2021-01-29T13:18:21Z")
Hello everyone, Im working updating configurations of logstash and Im wondering with method is more performance. For example Multiple pipelines going to a single pipepile to do some checks (sql querys) before ingest i… --- ## [ElasticSearch delete\_by\_query: Trying to create too many scroll contexts](https://discuss.elastic.co/t/elasticsearch-delete-by-query-trying-to-create-too-many-scroll-contexts/262627)
**Author:** [@lankin1](https://discuss.elastic.co/u/lankin1)\ **Replies:** 2\ **Last updated:** [January 29, 2021, 1:14pm UTC](https://discuss.elastic.co/t/elasticsearch-delete-by-query-trying-to-create-too-many-scroll-contexts/262627 "2021-01-29T13:14:14Z")
Hi, I am trying to fix this error while running delete\_by\_query API on AWS ElasticSearch: Trying to create too many scroll contexts. Must be less than or equal to: \[500\]. This limit can be set by changing the \[search.m… --- ## [Kibana alert condition](https://discuss.elastic.co/t/kibana-alert-condition/262645)
**Author:** [@Guy\_Assaf](https://discuss.elastic.co/u/Guy_Assaf)\ **Replies:** 1\ **Last updated:** [January 29, 2021, 1:13pm UTC](https://discuss.elastic.co/t/kibana-alert-condition/262645 "2021-01-29T13:13:10Z")
See the image, I'm trying to define an alert such that a certain percentage will trigger the alert. Two issues: how to take the ERROR/SUCCESS doc from the list, I tried with (buckets{key:SUCCESS} which does not work) t… --- ## [New password or recover password](https://discuss.elastic.co/t/new-password-or-recover-password/262510)
**Author:** [@Gustavo](https://discuss.elastic.co/u/Gustavo)\ **Replies:** 3\ **Last updated:** [January 29, 2021, 12:59pm UTC](https://discuss.elastic.co/t/new-password-or-recover-password/262510 "2021-01-29T12:59:58Z")
How to set a new default password for enterprise search access; because the password I had generated is no longer working. I tried the command ENT\_SEARCH\_DEFAULT\_PASSWORD = 5eqbxcqczhxx1mgw bin/enterprise-search and I… --- ## [Stats endpoint fails after creating an index](https://discuss.elastic.co/t/stats-endpoint-fails-after-creating-an-index/262562)
**Author:** [@tommyzli](https://discuss.elastic.co/u/tommyzli)\ **Replies:** 1\ **Last updated:** [January 29, 2021, 12:58pm UTC](https://discuss.elastic.co/t/stats-endpoint-fails-after-creating-an-index/262562 "2021-01-29T12:58:48Z")
Hi Elasticsearch version 7.6 I have a cluster with 3 master only nodes, 20 data nodes, and one index with 10 shards and 10 replicas. After I create a new index called profiles\_v1 with 10 shards and 0 replicas, the stat… --- ## [Timeout for snapshot process](https://discuss.elastic.co/t/timeout-for-snapshot-process/262640)
**Author:** [@sreekanth](https://discuss.elastic.co/u/sreekanth)\ **Replies:** 1\ **Last updated:** [January 29, 2021, 12:12pm UTC](https://discuss.elastic.co/t/timeout-for-snapshot-process/262640 "2021-01-29T12:12:47Z")
Hi, Anyway to set timeout for snapshot process? I am running with "?wait\_for\_completion=true" . Some times it gets stuck for a long time. I know that it should finish by 10min for the data i have. Anyway to set a timeou… --- ## [Elasticsearch-users added is not shown in Kibana UI](https://discuss.elastic.co/t/elasticsearch-users-added-is-not-shown-in-kibana-ui/262481)
**Author:** [@mchudinov](https://discuss.elastic.co/u/mchudinov)\ **Replies:** 4\ **Last updated:** [January 29, 2021, 10:29am UTC](https://discuss.elastic.co/t/elasticsearch-users-added-is-not-shown-in-kibana-ui/262481 "2021-01-29T10:29:47Z")
I have ECK Elasticsearch and Kibana running in k8s (Azure). One pod of each. I made a user with \*bin/elasticsearch-users useradd test123 -p 123456 -r superuser \* # elasticsearch-users useradd test123 -p 123456 -r super… --- ## [Streaming pipeline](https://discuss.elastic.co/t/streaming-pipeline/262628)
**Author:** [@vincent2mots](https://discuss.elastic.co/u/vincent2mots)\ **Replies:** 0\ **Last updated:** [January 29, 2021, 10:25am UTC](https://discuss.elastic.co/t/streaming-pipeline/262628 "2021-01-29T10:25:35Z")
Hi experts! I made a data pipeline using Filebeat and Logstash. I was expecting to see the data streamed from the log file into Elasticsearch but it's not the case. When new lines are inserted into the log file, I some… --- ## [Monitor APIC on kubernetes using metricbeat](https://discuss.elastic.co/t/monitor-apic-on-kubernetes-using-metricbeat/261465)
**Author:** [@Sagar\_Naik](https://discuss.elastic.co/u/Sagar_Naik)\ **Replies:** 2\ **Last updated:** [January 29, 2021, 9:10am UTC](https://discuss.elastic.co/t/monitor-apic-on-kubernetes-using-metricbeat/261465 "2021-01-29T09:10:49Z")
I am getting 400 bad request while trying to configure metricbeat for monitoring kubernetes cluster deployed along with IBM API Connect. System information is displaying , but no kubernetes info , We need to monitor tr… --- ## [Reg csv file import into Elasticsearch using Logstash](https://discuss.elastic.co/t/reg-csv-file-import-into-elasticsearch-using-logstash/261449)
**Author:** [@mohanss08](https://discuss.elastic.co/u/mohanss08)\ **Replies:** 12\ **Last updated:** [January 29, 2021, 9:06am UTC](https://discuss.elastic.co/t/reg-csv-file-import-into-elasticsearch-using-logstash/261449 "2021-01-29T09:06:04Z")
Hello Support team, I have query regarding csv file upload into elasticsearch using logstash. With this fourm https://www.bmc.com/blogs/elasticsearch-load-csv-logstash/ Able to import our csv files into elasticsearch … --- ## [How to specify subpath to logstash host in filebeat.yml](https://discuss.elastic.co/t/how-to-specify-subpath-to-logstash-host-in-filebeat-yml/262501)
**Author:** [@eeijlar](https://discuss.elastic.co/u/eeijlar)\ **Replies:** 2\ **Last updated:** [January 28, 2021, 4:24pm UTC](https://discuss.elastic.co/t/how-to-specify-subpath-to-logstash-host-in-filebeat-yml/262501 "2021-01-28T16:24:44Z")
I am trying to ship logs to logstash from filebeat. With reference to: In the filebeat.yml, it says to use this for the host: output.logstash: hosts: \["127.0.0.1:5044"\] My logstash URL has /logstash appending o… --- ## [How to load balance an ES-cluster with 70+nodes and 70+ replica shards?](https://discuss.elastic.co/t/how-to-load-balance-an-es-cluster-with-70-nodes-and-70-replica-shards/262608)
**Author:** [@niidy](https://discuss.elastic.co/u/niidy)\ **Replies:** 1\ **Last updated:** [January 29, 2021, 8:16am UTC](https://discuss.elastic.co/t/how-to-load-balance-an-es-cluster-with-70-nodes-and-70-replica-shards/262608 "2021-01-29T08:16:42Z")
My es is 70+nodes and there is an index with a pri shard and 70+ replica shards, because there is no new data written, but there are a lot of queries. but now, only some of them are 80+ cpu and 20+ load (my node is 16c … --- ## [New document in one index should update a value in another index](https://discuss.elastic.co/t/new-document-in-one-index-should-update-a-value-in-another-index/262601)
**Author:** [@Parimelazhagan\_Vinay](https://discuss.elastic.co/u/Parimelazhagan_Vinay)\ **Replies:** 1\ **Last updated:** [January 29, 2021, 8:14am UTC](https://discuss.elastic.co/t/new-document-in-one-index-should-update-a-value-in-another-index/262601 "2021-01-29T08:14:30Z")
Hi All, I am new elasticsearch. Any help on the below use case would be helpful. I have the data which is flowing into one index say index\_raw ELK Dev 1.0 Time1 ELK Dev 2.0 Time2 ELK Stage 1.0 Time3 Now I wanted t… --- ## [Custom authentication plugin for Elastic search(7.10.0)](https://discuss.elastic.co/t/custom-authentication-plugin-for-elastic-search-7-10-0/262315)
**Author:** [@Hargovind](https://discuss.elastic.co/u/Hargovind)\ **Replies:** 5\ **Last updated:** [January 29, 2021, 8:11am UTC](https://discuss.elastic.co/t/custom-authentication-plugin-for-elastic-search-7-10-0/262315 "2021-01-29T08:11:46Z")
Hi everyone, I need to secure my elasticsearch server with custom authentication. pls help me to create a plugin for custom authentication in elasticsearch. Thanks. --- ## [MongoDB logs no more displayed in Kibana Filebeat MongoDB dashboard after 7.10 migration](https://discuss.elastic.co/t/mongodb-logs-no-more-displayed-in-kibana-filebeat-mongodb-dashboard-after-7-10-migration/262344)
**Author:** [@ORich](https://discuss.elastic.co/u/ORich)\ **Replies:** 5\ **Last updated:** [January 29, 2021, 7:37am UTC](https://discuss.elastic.co/t/mongodb-logs-no-more-displayed-in-kibana-filebeat-mongodb-dashboard-after-7-10-migration/262344 "2021-01-29T07:37:31Z")
Dear experts, after migration from 6.5.4 to 7.10.2, I cannot display anymore my logs collected by the default Filebeat MongoDB module in Kibana Dashboard Overview \[Filebeat MongoDB\]. I notice some updates in the provid… --- ## [How to get response header with cookie from POST request to Kibana REST API /internal/security/login](https://discuss.elastic.co/t/how-to-get-response-header-with-cookie-from-post-request-to-kibana-rest-api-internal-security-login/262530)
**Author:** [@gaetano](https://discuss.elastic.co/u/gaetano)\ **Replies:** 1\ **Last updated:** [January 29, 2021, 7:12am UTC](https://discuss.elastic.co/t/how-to-get-response-header-with-cookie-from-post-request-to-kibana-rest-api-internal-security-login/262530 "2021-01-29T07:12:27Z")
My goal is to skip login page in Kibana. With an HTTP request, I would to login in Kibana using the REST API /internal/security/login. The request is come from my Angular application and to bypass CORS and multi-origi… --- ## [How to re-generate certificate for nodes elasticsearch to enable xpack](https://discuss.elastic.co/t/how-to-re-generate-certificate-for-nodes-elasticsearch-to-enable-xpack/262554)
**Author:** [@testsemd\_email](https://discuss.elastic.co/u/testsemd_email)\ **Replies:** 2\ **Last updated:** [January 29, 2021, 7:07am UTC](https://discuss.elastic.co/t/how-to-re-generate-certificate-for-nodes-elasticsearch-to-enable-xpack/262554 "2021-01-29T07:07:39Z")
How to re-generate certificate for nodes elasticsearch after the password is generated for elastic cluster. I re-generated the certificate for nodes, got the error "client did not trust this server's certificate, closi… --- ## [Ingest processor for sending email gives \`access denied ("java.lang.RuntimePermission" "setFactory")\`](https://discuss.elastic.co/t/ingest-processor-for-sending-email-gives-access-denied-java-lang-runtimepermission-setfactory/262594)
**Author:** [@Ripu\_Sudan](https://discuss.elastic.co/u/Ripu_Sudan)\ **Replies:** 4\ **Last updated:** [January 29, 2021, 7:05am UTC](https://discuss.elastic.co/t/ingest-processor-for-sending-email-gives-access-denied-java-lang-runtimepermission-setfactory/262594 "2021-01-29T07:05:06Z")
I was making an ingest processor that would send an email on a particular condition, i'm using "compile 'javax.mail:javax.mail-api:1.5.3'" while running "gradle check" if gives permisson error. REPRODUCE WITH: ./gradle… --- ## ["Signed fields invalid" for configuring HTTPS transport layer](https://discuss.elastic.co/t/signed-fields-invalid-for-configuring-https-transport-layer/262491)
**Author:** [@gvx3](https://discuss.elastic.co/u/gvx3)\ **Replies:** 2\ **Last updated:** [January 29, 2021, 6:53am UTC](https://discuss.elastic.co/t/signed-fields-invalid-for-configuring-https-transport-layer/262491 "2021-01-29T06:53:01Z")
Hi all, I know that these kind of questions have been asking a lot, but I'm really stuck and can't help it I'm using Helm to deploy elasticsearch, I use letsencrypt to generate cert, so I have fullchain.pem which is fo… --- ## [Permission to give permission to Indices](https://discuss.elastic.co/t/permission-to-give-permission-to-indices/262253)
**Author:** [@Zerobot](https://discuss.elastic.co/u/Zerobot)\ **Replies:** 4\ **Last updated:** [January 29, 2021, 5:57am UTC](https://discuss.elastic.co/t/permission-to-give-permission-to-indices/262253 "2021-01-29T05:57:07Z")
Hi! I was wondering - is it possible to give someone permission to read some indices AND also a permission to give read-only permissions to other users? My point is: I have 5 indices and 5 people, each person has permi… --- ## [Elasticsearch 7.10 | XPACK enabled | Does not start after machine reboot](https://discuss.elastic.co/t/elasticsearch-7-10-xpack-enabled-does-not-start-after-machine-reboot/262508)
**Author:** [@dp119](https://discuss.elastic.co/u/dp119)\ **Replies:** 1\ **Last updated:** [January 29, 2021, 5:53am UTC](https://discuss.elastic.co/t/elasticsearch-7-10-xpack-enabled-does-not-start-after-machine-reboot/262508 "2021-01-29T05:53:15Z")
Hello, I enabled X-Pack with this command elasticsearch-setup-passwords auto I had to stop ES and restart the host machine. I'm trying to start Elasticsearch after the machine boot. ES doesn't start and has the below… --- ## [Multiple indices in kibana dashboard](https://discuss.elastic.co/t/multiple-indices-in-kibana-dashboard/261751)
**Author:** [@Srikanth\_Kesireddy](https://discuss.elastic.co/u/Srikanth_Kesireddy)\ **Replies:** 3\ **Last updated:** [January 29, 2021, 5:49am UTC](https://discuss.elastic.co/t/multiple-indices-in-kibana-dashboard/261751 "2021-01-29T05:49:56Z")
I have 10 target servers installed Filebeat on all machines... Logstash , ElasticSearch , Kibana these 3 are installed on main server. How can I create 10 indices for 10 target machines --- ## [SSLError: ConnectionErro SSL: WRONG\_VERSION\_NUMBER](https://discuss.elastic.co/t/sslerror-connectionerro-ssl-wrong-version-number/262566)
**Author:** [@pemfir](https://discuss.elastic.co/u/pemfir)\ **Replies:** 3\ **Last updated:** [January 29, 2021, 5:49am UTC](https://discuss.elastic.co/t/sslerror-connectionerro-ssl-wrong-version-number/262566 "2021-01-29T05:49:15Z")
After enabling Xpack and setting SSL/TSL for a single node and username and password, i am trying to index a single data point from elasticsearch import Elasticsearch from datetime import datetime es = Elasticsearch( … --- ## [How to escape sprintf (to compare against an uninterpolated value)](https://discuss.elastic.co/t/how-to-escape-sprintf-to-compare-against-an-uninterpolated-value/262581)
**Author:** [@cknz](https://discuss.elastic.co/u/cknz)\ **Replies:** 2\ **Last updated:** [January 29, 2021, 3:59am UTC](https://discuss.elastic.co/t/how-to-escape-sprintf-to-compare-against-an-uninterpolated-value/262581 "2021-01-29T03:59:43Z")
Hi all, I'm on Elastic 7.10.2, and I noticed a problem with my processing. Some incoming data has tried to set a field using a sprintf string, but the sprintf expression did not result in a replacement, so I'm left with … [Previous page](https://discuss.elastic.co/latest.md?page=1867) [Next page](https://discuss.elastic.co/latest.md?page=1869)