# Latest **URL:** https://discuss.elastic.co/latest.md?page=1911 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1912 --- ## [Notify slack when hosts are up](https://discuss.elastic.co/t/notify-slack-when-hosts-are-up/258942)
**Author:** [@minu.ajith](https://discuss.elastic.co/u/minu.ajith)\ **Replies:** 3\ **Last updated:** [January 5, 2021, 12:37am UTC](https://discuss.elastic.co/t/notify-slack-when-hosts-are-up/258942 "2021-01-05T00:37:26Z")
Hi team, Is there a way to get alerts in slack and auto-resolve pagerduty alerts when the hosts come back online ? Regards, Minu --- ## [Checkpoint Firewall Logs](https://discuss.elastic.co/t/checkpoint-firewall-logs/260133)
**Author:** [@somerandomitperson](https://discuss.elastic.co/u/somerandomitperson)\ **Replies:** 5\ **Last updated:** [January 5, 2021, 12:07am UTC](https://discuss.elastic.co/t/checkpoint-firewall-logs/260133 "2021-01-05T00:07:42Z")
This is my first experience with Elastic. I am trying to set up a Kibana dashboard and create dashboards for my Checkpoint firewall. The built in checkpoint module does not parse logs from my firewall. I have looked into… --- ## [Running elasticsearch as daemon from shell script with password-protected keystore file](https://discuss.elastic.co/t/running-elasticsearch-as-daemon-from-shell-script-with-password-protected-keystore-file/260033)
**Author:** [@dzyubanv](https://discuss.elastic.co/u/dzyubanv)\ **Replies:** 2\ **Last updated:** [January 4, 2021, 11:10pm UTC](https://discuss.elastic.co/t/running-elasticsearch-as-daemon-from-shell-script-with-password-protected-keystore-file/260033 "2021-01-04T23:10:00Z")
Issue - elasticsearch doesn't start when running it as daemon from shell script. Details: I installed elasticsearch version 7.9.3 from archive on RHEL Configured 2 nodes cluster with TLS/SSL in elasticsearch.yml Prote… --- ## [Data Table Time Offset](https://discuss.elastic.co/t/data-table-time-offset/260124)
**Author:** [@stevezemlicka](https://discuss.elastic.co/u/stevezemlicka)\ **Replies:** 2\ **Last updated:** [January 4, 2021, 10:53pm UTC](https://discuss.elastic.co/t/data-table-time-offset/260124 "2021-01-04T22:53:10Z")
I have been building a dashboard with a couple of indexes. After evaluation, it turns out one of the indexes seems to be off by 1hr. For all of my timelion visualizations, this was corrected by modifying each reference… --- ## [Which is better - requests or elasticsearch](https://discuss.elastic.co/t/which-is-better-requests-or-elasticsearch/259974)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 1\ **Last updated:** [January 4, 2021, 10:35pm UTC](https://discuss.elastic.co/t/which-is-better-requests-or-elasticsearch/259974 "2021-01-04T22:35:13Z")
Inside python I can use two different method to retrieve the data. one with requests.get or can use elasticsarch module. for requests.get I can use sql query. while in elasticsearch I have to use REST code. which one … --- ## [Mutate gsub regex pattern help](https://discuss.elastic.co/t/mutate-gsub-regex-pattern-help/260122)
**Author:** [@S3l3ct3d](https://discuss.elastic.co/u/S3l3ct3d)\ **Replies:** 6\ **Last updated:** [January 4, 2021, 10:27pm UTC](https://discuss.elastic.co/t/mutate-gsub-regex-pattern-help/260122 "2021-01-04T22:27:12Z")
I am having an issue with the regex pattern in mutate gsub function. My current filter is below filter { # Log types are "SIEM\_EVENTS", "TTP\_EVENTS", "AUDIT\_EVENTS". mutate { gsub =\> \[ "\[message\]", "^\<\\d+\>", "" \] … --- ## [Filebeats and xpack modules - Confusion about licensing](https://discuss.elastic.co/t/filebeats-and-xpack-modules-confusion-about-licensing/260106)
**Author:** [@talsh87](https://discuss.elastic.co/u/talsh87)\ **Replies:** 1\ **Last updated:** [January 4, 2021, 9:16pm UTC](https://discuss.elastic.co/t/filebeats-and-xpack-modules-confusion-about-licensing/260106 "2021-01-04T21:16:12Z")
In case I'd just like to leverage Filebeats including x-pack modules (such as Office365) and Logstash as part of a backend infrastructure - Is a license needed? The ingestion process (and Filebeats\\Logstash inside) isn'… --- ## [Multiple Workplace search instances](https://discuss.elastic.co/t/multiple-workplace-search-instances/259930)
**Author:** [@EJLegarda](https://discuss.elastic.co/u/EJLegarda)\ **Replies:** 1\ **Last updated:** [January 4, 2021, 8:57pm UTC](https://discuss.elastic.co/t/multiple-workplace-search-instances/259930 "2021-01-04T20:57:07Z")
Newbie here.. Let’s say there are 4 content sources defined in workplace, is it possible to have a workplace search page with sources 1, 2 & 3 and have another workplace search page with sources 3 & 4, and other search p… --- ## [Filebeat 7.3.0 High CPU](https://discuss.elastic.co/t/filebeat-7-3-0-high-cpu/260130)
**Author:** [@tarpanpathak](https://discuss.elastic.co/u/tarpanpathak)\ **Replies:** 0\ **Last updated:** [January 4, 2021, 8:47pm UTC](https://discuss.elastic.co/t/filebeat-7-3-0-high-cpu/260130 "2021-01-04T20:47:55Z")
Hi, I am not sure if this is the best place to discuss this but one of our compute nodes in Kubernetes is constantly alerting on high CPU. After digging a bit deeper, we see that the Filebeat process on the node is trig… --- ## [\[7.10\] ingest\_admin pour certains index seulement](https://discuss.elastic.co/t/7-10-ingest-admin-pour-certains-index-seulement/260096)
**Author:** [@dao](https://discuss.elastic.co/u/dao)\ **Replies:** 5\ **Last updated:** [January 4, 2021, 8:40pm UTC](https://discuss.elastic.co/t/7-10-ingest-admin-pour-certains-index-seulement/260096 "2021-01-04T20:40:12Z")
Bonjour, je veux donner l'autorisation à certains utilisateurs d'injecter des données (machine learning/data visualizer/file) Je veux toutefois n'autoriser cela que pour certain index de type customer\_index\_\* et interd… --- ## [Multiple Different Clients](https://discuss.elastic.co/t/multiple-different-clients/258935)
**Author:** [@austinsonger](https://discuss.elastic.co/u/austinsonger)\ **Replies:** 4\ **Last updated:** [January 4, 2021, 7:25pm UTC](https://discuss.elastic.co/t/multiple-different-clients/258935 "2021-01-04T19:25:00Z")
Is it possible to use a single instance of Elastic SIEM to monitor two different companies networks and separate them so their information will be separated? --- ## [Stuck on "going to run"](https://discuss.elastic.co/t/stuck-on-going-to-run/258262)
**Author:** [@hilt86](https://discuss.elastic.co/u/hilt86)\ **Replies:** 7\ **Last updated:** [January 4, 2021, 7:14pm UTC](https://discuss.elastic.co/t/stuck-on-going-to-run/258262 "2021-01-04T19:14:05Z")
I have a detection rule that looks for indicator matches on a filebeat-misp index and every so often it will get stuck on "going to run" with a date that is in the past. If it is failing then I'm none the wiser but I'd … --- ## [Problems with Lab 3 in Lab Guide: Sentiment Analysis and Brand Monitoring](https://discuss.elastic.co/t/problems-with-lab-3-in-lab-guide-sentiment-analysis-and-brand-monitoring/259747)
**Author:** [@pbroek](https://discuss.elastic.co/u/pbroek)\ **Replies:** 1\ **Last updated:** [January 4, 2021, 7:00pm UTC](https://discuss.elastic.co/t/problems-with-lab-3-in-lab-guide-sentiment-analysis-and-brand-monitoring/259747 "2021-01-04T19:00:15Z")
Hello, I am working on lab 3 in Sentiment Analysis and Brand Monitoring. Until Lab 3 question 3 everythin gs is clear. But In Lab 3 question 3 there is no mentioning about starting the lab3.conf. So I started the lab3… --- ## [Logstash multiline pattern](https://discuss.elastic.co/t/logstash-multiline-pattern/259997)
**Author:** [@Muhammad\_Faisal](https://discuss.elastic.co/u/Muhammad_Faisal)\ **Replies:** 3\ **Last updated:** [January 4, 2021, 6:19pm UTC](https://discuss.elastic.co/t/logstash-multiline-pattern/259997 "2021-01-04T18:19:49Z")
hi guys, i have a log file which consists of below pattern , i need to treat all lines of this log file as 1 aggregate event.file will close after 30 minutes and then new log will start..which pattern will work here...… --- ## [Logstash do not import file](https://discuss.elastic.co/t/logstash-do-not-import-file/260114)
**Author:** [@Sad\_Creem](https://discuss.elastic.co/u/Sad_Creem)\ **Replies:** 2\ **Last updated:** [January 4, 2021, 6:15pm UTC](https://discuss.elastic.co/t/logstash-do-not-import-file/260114 "2021-01-04T18:15:30Z")
Is Logstash have a limit for max line characters leight? I have 12 mb json file wich content single line json with multi objects. Logstash do not work with this file i'am dont know why no error no debug string just sta… --- ## [Fix broken cluster with elasticsearch-node detach-cluster not working](https://discuss.elastic.co/t/fix-broken-cluster-with-elasticsearch-node-detach-cluster-not-working/260070)
**Author:** [@ebuildy](https://discuss.elastic.co/u/ebuildy)\ **Replies:** 17\ **Last updated:** [January 4, 2021, 5:58pm UTC](https://discuss.elastic.co/t/fix-broken-cluster-with-elasticsearch-node-detach-cluster-not-working/260070 "2021-01-04T17:58:28Z")
I want to fix a broken cluster (when a node cannot join because differente cluster UUID by exemple) without removing all data folder (the dirty solution I can see every time....), currently I am testing it, using officia… --- ## [Using tokens with the endpoint /internal/security/login for logging instead of basic authentication](https://discuss.elastic.co/t/using-tokens-with-the-endpoint-internal-security-login-for-logging-instead-of-basic-authentication/259909)
**Author:** [@DMinovski](https://discuss.elastic.co/u/DMinovski)\ **Replies:** 4\ **Last updated:** [January 4, 2021, 5:29pm UTC](https://discuss.elastic.co/t/using-tokens-with-the-endpoint-internal-security-login-for-logging-instead-of-basic-authentication/259909 "2021-01-04T17:29:28Z")
In this post, Kibana 7.10 login issues, there is an example of using basic authentication to log through the /internal/security/login API endpoint by using: --data-raw '{"providerType":"basic","providerName":"basic","cu… --- ## [Trying to setup beats](https://discuss.elastic.co/t/trying-to-setup-beats/257794)
**Author:** [@knagasri](https://discuss.elastic.co/u/knagasri)\ **Replies:** 6\ **Last updated:** [January 4, 2021, 5:22pm UTC](https://discuss.elastic.co/t/trying-to-setup-beats/257794 "2021-01-04T17:22:47Z")
I had deployed Elasticsearch cluster along with kibana in GCP. I was trying to deploy beats as well. I had used the beats yaml files which are in the following link: I just changed the elastic and kibana references… --- ## [Alerting visualization in kibana](https://discuss.elastic.co/t/alerting-visualization-in-kibana/260074)
**Author:** [@anjali28](https://discuss.elastic.co/u/anjali28)\ **Replies:** 3\ **Last updated:** [January 4, 2021, 4:55pm UTC](https://discuss.elastic.co/t/alerting-visualization-in-kibana/260074 "2021-01-04T16:55:16Z")
Hello, i want to create a visual representing the application status up in green mode and when down in red mode. Data is in boolean format for UP it is 1 and down it is 0 Description : From which visualization i can… --- ## [Multipe host output using keystore passwords](https://discuss.elastic.co/t/multipe-host-output-using-keystore-passwords/260090)
**Author:** [@mcosta](https://discuss.elastic.co/u/mcosta)\ **Replies:** 4\ **Last updated:** [January 4, 2021, 4:29pm UTC](https://discuss.elastic.co/t/multipe-host-output-using-keystore-passwords/260090 "2021-01-04T16:29:29Z")
Hi All, I need to configure logstash (ver 7.7) to write to two elastisearch. I have two separate output blocks, one for each elasticsearch but how do I configure password retrieval from keystore, since documentation ref… --- ## [SocketTimeoutException within Java High Level Client](https://discuss.elastic.co/t/sockettimeoutexception-within-java-high-level-client/259871)
**Author:** [@David-Lor](https://discuss.elastic.co/u/David-Lor)\ **Replies:** 4\ **Last updated:** [January 4, 2021, 4:13pm UTC](https://discuss.elastic.co/t/sockettimeoutexception-within-java-high-level-client/259871 "2021-01-04T16:13:11Z")
I'm building an application involving SpringBoot and the official Elastic REST High Level Client, and it seems that the connection with the Elastic server eventually dies if not used after some time. On the application … --- ## [Kibana Build "ERROR \[bootstrap\] failed":](https://discuss.elastic.co/t/kibana-build-error-bootstrap-failed/259776)
**Author:** [@Dhruvil\_Doshi](https://discuss.elastic.co/u/Dhruvil_Doshi)\ **Replies:** 3\ **Last updated:** [January 4, 2021, 4:07pm UTC](https://discuss.elastic.co/t/kibana-build-error-bootstrap-failed/259776 "2021-01-04T16:07:28Z")
I have downloaded kibana 7.10 from Github. I am not able to build kibana. After running, yarn kbn bootstrap I am getting below error. yarn run v1.22.5 $ node scripts/kbn bootstrap info \[kibana\] running yarn $ node… --- ## [Hostname and timestamp gets overwritten when using archived event logs using winlogbeat](https://discuss.elastic.co/t/hostname-and-timestamp-gets-overwritten-when-using-archived-event-logs-using-winlogbeat/257739)
**Author:** [@p1k4chu](https://discuss.elastic.co/u/p1k4chu)\ **Replies:** 1\ **Last updated:** [January 4, 2021, 4:00pm UTC](https://discuss.elastic.co/t/hostname-and-timestamp-gets-overwritten-when-using-archived-event-logs-using-winlogbeat/257739 "2021-01-04T16:00:45Z")
Version : Winlogbeat 7.9.2 Platform: Windows 10 Reproduction Instructions: Use winlogbeat to upload an event log file (.evtx file using -E option) and use the default config file. I used this script to upload bulk fil… --- ## [ELastic Endpoint Security Agent not visible in Kibana Security App](https://discuss.elastic.co/t/elastic-endpoint-security-agent-not-visible-in-kibana-security-app/259631)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 2\ **Last updated:** [January 4, 2021, 3:49pm UTC](https://discuss.elastic.co/t/elastic-endpoint-security-agent-not-visible-in-kibana-security-app/259631 "2021-01-04T15:49:14Z")
Hello, Tried to install an Elastic Agent on my home Windows 10. Deployed the Agent through fleet. with a system, windows and endpoint policy. But when I go to Security Administration, it says "Endpoints are enrollin… --- ## [Hot-warm policy](https://discuss.elastic.co/t/hot-warm-policy/259862)
**Author:** [@Abdelhalim](https://discuss.elastic.co/u/Abdelhalim)\ **Replies:** 2\ **Last updated:** [January 4, 2021, 3:48pm UTC](https://discuss.elastic.co/t/hot-warm-policy/259862 "2021-01-04T15:48:19Z")
Hello, I would like to create a Hot-warm policy , and the index should rollover when the index is 20Gb of size or max\_age equal to 30days BUT, if the size condition occur before the age condition, the index should rollo… --- ## [Ilm - index creation time picked as future date and time](https://discuss.elastic.co/t/ilm-index-creation-time-picked-as-future-date-and-time/260075)
**Author:** [@kannan\_raj](https://discuss.elastic.co/u/kannan_raj)\ **Replies:** 1\ **Last updated:** [January 4, 2021, 3:44pm UTC](https://discuss.elastic.co/t/ilm-index-creation-time-picked-as-future-date-and-time/260075 "2021-01-04T15:44:33Z")
ILM rollover stopped working from 12/27/2020, because of wrong index creation time. we verified system date, system date was correct during index creation. we could confirm by seeing the elasticsearch log that system d… --- ## [Logstash plugin is installed and listed but not found by logstash](https://discuss.elastic.co/t/logstash-plugin-is-installed-and-listed-but-not-found-by-logstash/259895)
**Author:** [@Travis](https://discuss.elastic.co/u/Travis)\ **Replies:** 3\ **Last updated:** [January 4, 2021, 3:43pm UTC](https://discuss.elastic.co/t/logstash-plugin-is-installed-and-listed-but-not-found-by-logstash/259895 "2021-01-04T15:43:34Z")
Hello Elasticians ! I installed syslog output plug in (logstash-output-syslog-3.0.5.gem) using offline method as I don't have wan access on target server. Plug in has been successfully installed and is listed with lo… --- ## [Resizable Table Legends and Multiple Terms aggregations](https://discuss.elastic.co/t/resizable-table-legends-and-multiple-terms-aggregations/260039)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 2\ **Last updated:** [January 4, 2021, 3:40pm UTC](https://discuss.elastic.co/t/resizable-table-legends-and-multiple-terms-aggregations/260039 "2021-01-04T15:40:55Z")
Hello, In Grafana we have the option to show legends as a table, showing a lot of useful aggregated info, for example: I have tried many things to achieve the same in Kibana, but never managed to get even close to w… --- ## [Renaming the user agent "Elastic-Heartbeat/7.x.x" in Heartbeat (http monitor type)](https://discuss.elastic.co/t/renaming-the-user-agent-elastic-heartbeat-7-x-x-in-heartbeat-http-monitor-type/260017)
**Author:** [@Rysiu](https://discuss.elastic.co/u/Rysiu)\ **Replies:** 1\ **Last updated:** [January 4, 2021, 3:25pm UTC](https://discuss.elastic.co/t/renaming-the-user-agent-elastic-heartbeat-7-x-x-in-heartbeat-http-monitor-type/260017 "2021-01-04T15:25:51Z")
Hello, Is it possible to change the name the user agent "Elastic-Heartbeat/7.x.x" in Heartbeat (http monitor type)? Is such modification relatively easy to implement? I do not see the appropriate option in the configu… --- ## [Index multiple payload hits to hits array in new index](https://discuss.elastic.co/t/index-multiple-payload-hits-to-hits-array-in-new-index/260101)
**Author:** [@esguy](https://discuss.elastic.co/u/esguy)\ **Replies:** 0\ **Last updated:** [January 4, 2021, 3:17pm UTC](https://discuss.elastic.co/t/index-multiple-payload-hits-to-hits-array-in-new-index/260101 "2021-01-04T15:17:46Z")
Hello, I am developing a watch that needs access to previous watch payload data. Since the watch scope is that of itself, I was thinking that an index action to index the desired payload for future reference was the way… [Previous page](https://discuss.elastic.co/latest.md?page=1910) [Next page](https://discuss.elastic.co/latest.md?page=1912)