# Latest **URL:** https://discuss.elastic.co/latest.md?page=1983 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1984 --- ## [Give privilege to a user to create index pattern](https://discuss.elastic.co/t/give-privilege-to-a-user-to-create-index-pattern/256143)
**Author:** [@Angelos](https://discuss.elastic.co/u/Angelos)\ **Replies:** 2\ **Last updated:** [November 23, 2020, 10:44am UTC](https://discuss.elastic.co/t/give-privilege-to-a-user-to-create-index-pattern/256143 "2020-11-23T10:44:04Z")
Hello, How can I give privilege to a user to create index patterns but not having the right to create indices? When I use "manage" privilege then the user has access everywhere. Thank you in advance! /Angelos --- ## [Azure NSG Integration help](https://discuss.elastic.co/t/azure-nsg-integration-help/256342)
**Author:** [@Ameer\_Mukadam](https://discuss.elastic.co/u/Ameer_Mukadam)\ **Replies:** 1\ **Last updated:** [November 23, 2020, 10:19am UTC](https://discuss.elastic.co/t/azure-nsg-integration-help/256342 "2020-11-23T10:19:45Z")
Hi, I am trying to integrate Azure NSG Logs into Elastic, I have done 80% but there is 1 field is proving a little difficult for me and it has all the important flow information. Each log event contaains 5 flows inform… --- ## [Metricbeat data flow problem with Kibana](https://discuss.elastic.co/t/metricbeat-data-flow-problem-with-kibana/256247)
**Author:** [@yattaes](https://discuss.elastic.co/u/yattaes)\ **Replies:** 3\ **Last updated:** [November 23, 2020, 10:15am UTC](https://discuss.elastic.co/t/metricbeat-data-flow-problem-with-kibana/256247 "2020-11-23T10:15:38Z")
Hi! I recently deployed Elasticsearch with Kibana on Azure Kubernetes environment. After that I deployed Metricbeat and it seems fine, all pods are running without problem. But I can not see any data flow to Kibana fro… --- ## [Point Kibana to a Subdomain](https://discuss.elastic.co/t/point-kibana-to-a-subdomain/256259)
**Author:** [@ankitdevnalkar](https://discuss.elastic.co/u/ankitdevnalkar)\ **Replies:** 4\ **Last updated:** [November 23, 2020, 10:14am UTC](https://discuss.elastic.co/t/point-kibana-to-a-subdomain/256259 "2020-11-23T10:14:39Z")
I am struggling with pointing Kibana to a subdomain. My domain is hosted on cloudflare and I am trying to point Kibana URL to a subdomain. Do I required to make any changes internally on Elasticsearch or Kibana instance… --- ## [Kibana index pattern, matching index, how to match more than 100](https://discuss.elastic.co/t/kibana-index-pattern-matching-index-how-to-match-more-than-100/256296)
**Author:** [@yt\_h](https://discuss.elastic.co/u/yt_h)\ **Replies:** 5\ **Last updated:** [November 23, 2020, 10:02am UTC](https://discuss.elastic.co/t/kibana-index-pattern-matching-index-how-to-match-more-than-100/256296 "2020-11-23T10:02:49Z")
elasticsearch version: 7.5.1 kibana version: 7.5.1 I have more than 300 indexes. How to use one index pattern to match all of them? When I enter the "pro" index pattern, it shows that 100 indexes are matched, but 300 i… --- ## [Kibana unable to configure fleet access](https://discuss.elastic.co/t/kibana-unable-to-configure-fleet-access/255977)
**Author:** [@Mikel\_U](https://discuss.elastic.co/u/Mikel_U)\ **Replies:** 6\ **Last updated:** [November 23, 2020, 9:52am UTC](https://discuss.elastic.co/t/kibana-unable-to-configure-fleet-access/255977 "2020-11-23T09:52:49Z")
Hi there, I'm trying to configure Fleet on Kibana container. Mi elastic-docker.yml is this (have 3 instances of elastic search and 1 of kibana): version: '2.2' services: es01: image: docker.elastic.co/elasticsear… --- ## [How to shutdown logstash when jdbc or es connection failed?](https://discuss.elastic.co/t/how-to-shutdown-logstash-when-jdbc-or-es-connection-failed/256333)
**Author:** [@zhangyunkun](https://discuss.elastic.co/u/zhangyunkun)\ **Replies:** 0\ **Last updated:** [November 23, 2020, 9:46am UTC](https://discuss.elastic.co/t/how-to-shutdown-logstash-when-jdbc-or-es-connection-failed/256333 "2020-11-23T09:46:01Z")
I found that logstash won't shutdown when jdbc or es connection failed。 It troubles me because I'll never find this mistake unless I take the initiative to see it。 And i tried configue the jdbc plugin setting 'co… --- ## [Elasticsearch Transform Document ID](https://discuss.elastic.co/t/elasticsearch-transform-document-id/256192)
**Author:** [@kaijun](https://discuss.elastic.co/u/kaijun)\ **Replies:** 1\ **Last updated:** [November 23, 2020, 9:40am UTC](https://discuss.elastic.co/t/elasticsearch-transform-document-id/256192 "2020-11-23T09:40:46Z")
When we use the transform API to transform our data into a new index, is there a way for us to set the document ID? (I think currently the default setting is randomly assigned some string as the document ID) --- ## [Alerting Webhook Action force don't use proxy](https://discuss.elastic.co/t/alerting-webhook-action-force-dont-use-proxy/256331)
**Author:** [@usrigp](https://discuss.elastic.co/u/usrigp)\ **Replies:** 0\ **Last updated:** [November 23, 2020, 9:38am UTC](https://discuss.elastic.co/t/alerting-webhook-action-force-dont-use-proxy/256331 "2020-11-23T09:38:20Z")
Hi, We need to force a Webhook Action don't use the proxy. We know we can config a webhook action using proxy.host and proxy.port. Are there any way to force it doesn't use a proxy (ignoring proxy configured on the se… --- ## [How can I read the timefilter range within an external plugin?](https://discuss.elastic.co/t/how-can-i-read-the-timefilter-range-within-an-external-plugin/256022)
**Author:** [@cascandaliato](https://discuss.elastic.co/u/cascandaliato)\ **Replies:** 4\ **Last updated:** [November 23, 2020, 9:30am UTC](https://discuss.elastic.co/t/how-can-i-read-the-timefilter-range-within-an-external-plugin/256022 "2020-11-23T09:30:23Z")
Hello, I've followed these instructions to scaffold a new plugin project (starting from master) and the plugin page comes with a time filter: How can I read the time range selected by the user? Some old posts refer… --- ## [Nodes fall out of the cluster es 7.9.1](https://discuss.elastic.co/t/nodes-fall-out-of-the-cluster-es-7-9-1/256309)
**Author:** [@ThreatInter](https://discuss.elastic.co/u/ThreatInter)\ **Replies:** 2\ **Last updated:** [November 23, 2020, 9:25am UTC](https://discuss.elastic.co/t/nodes-fall-out-of-the-cluster-es-7-9-1/256309 "2020-11-23T09:25:58Z")
Hello, we have the following problem: nodes can periodically fall out of the cluster \[2020-11-19T09:00:37,415\]\[INFO \]\[o.e.c.s.MasterService \] \[h1-es03\] node-left\[{h1-es02}{qgmMV2UbT-ScN9uRr6YM8g}{klj1K8UMRHGtYpYozIuq… --- ## [Setup metricbeat to monitor docker containers](https://discuss.elastic.co/t/setup-metricbeat-to-monitor-docker-containers/255985)
**Author:** [@Sauerbrei](https://discuss.elastic.co/u/Sauerbrei)\ **Replies:** 2\ **Last updated:** [November 23, 2020, 9:21am UTC](https://discuss.elastic.co/t/setup-metricbeat-to-monitor-docker-containers/255985 "2020-11-23T09:21:21Z")
Hi there, I am trying to setup metricbeat inside a local docker environment to write the collected data into an AWS Elastic Search Service. The Service runs and authentication is available via Basic Authentication. Here… --- ## [Need to remove two Node out of three node Elasticsearch clusters](https://discuss.elastic.co/t/need-to-remove-two-node-out-of-three-node-elasticsearch-clusters/256101)
**Author:** [@SumanUk](https://discuss.elastic.co/u/SumanUk)\ **Replies:** 4\ **Last updated:** [November 23, 2020, 9:13am UTC](https://discuss.elastic.co/t/need-to-remove-two-node-out-of-three-node-elasticsearch-clusters/256101 "2020-11-23T09:13:33Z")
Hi Team, Need guidelines for how to remove two Nodes out of three Node in Elastic Cluster without data loss we have install Elasticsearch in single node but it has connected three node which is early install still it's… --- ## [Aggregate filter plugin](https://discuss.elastic.co/t/aggregate-filter-plugin/255729)
**Author:** [@Andex](https://discuss.elastic.co/u/Andex)\ **Replies:** 5\ **Last updated:** [November 23, 2020, 9:09am UTC](https://discuss.elastic.co/t/aggregate-filter-plugin/255729 "2020-11-23T09:09:25Z")
Hi, i create my aggregate filter plugin but it doesn't start with this error : \[ERROR\]\[logstash.filters.aggregate\] Missing a required setting for the aggregate filter plugin: filter { aggregate { code =\> # SETTING MI… --- ## [Export/Import Saved objects](https://discuss.elastic.co/t/export-import-saved-objects/256148)
**Author:** [@alfredo.deluca](https://discuss.elastic.co/u/alfredo.deluca)\ **Replies:** 4\ **Last updated:** [November 23, 2020, 8:36am UTC](https://discuss.elastic.co/t/export-import-saved-objects/256148 "2020-11-23T08:36:27Z")
Hi all. I have 2 elastic installed. one is 7.7 and the second one is 7.8. Trying to export/import saved objects and specifically Visualizations but I got errors as per below when I do export Your file is downloading … --- ## [Http.max\_header\_size](https://discuss.elastic.co/t/http-max-header-size/256318)
**Author:** [@thetell75](https://discuss.elastic.co/u/thetell75)\ **Replies:** 2\ **Last updated:** [November 23, 2020, 8:24am UTC](https://discuss.elastic.co/t/http-max-header-size/256318 "2020-11-23T08:24:40Z")
Hello everybody, I have an issue with User having to many groups on Microsoft Azure. As we do authenticate through openid on Azure. I saw a Problem with Header Size. So I tried to increase the Header\_Size from 8KB to 1… --- ## [Sending New Relic Logs to ELK](https://discuss.elastic.co/t/sending-new-relic-logs-to-elk/256311)
**Author:** [@Edwin.v](https://discuss.elastic.co/u/Edwin.v)\ **Replies:** 0\ **Last updated:** [November 23, 2020, 7:10am UTC](https://discuss.elastic.co/t/sending-new-relic-logs-to-elk/256311 "2020-11-23T07:10:13Z")
Hello Everyone, I would like to know if there is a way I can send new relic logs to ELK stack. Any documentation will be really helpful. Thanks. --- ## [Kibana 7.10.0. licensing error](https://discuss.elastic.co/t/kibana-7-10-0-licensing-error/256019)
**Author:** [@ans\_x](https://discuss.elastic.co/u/ans_x)\ **Replies:** 6\ **Last updated:** [November 23, 2020, 6:53am UTC](https://discuss.elastic.co/t/kibana-7-10-0-licensing-error/256019 "2020-11-23T06:53:03Z")
After upgrading the stack from version 7.8.0 to 7.10.0, a license error appeared in Kibana. Full kibana.log xpack settings were included. After the update, the config did not change, only deleted the Kibana system in… --- ## [Filebeat MSSQL ECS](https://discuss.elastic.co/t/filebeat-mssql-ecs/256308)
**Author:** [@bering](https://discuss.elastic.co/u/bering)\ **Replies:** 0\ **Last updated:** [November 23, 2020, 6:52am UTC](https://discuss.elastic.co/t/filebeat-mssql-ecs/256308 "2020-11-23T06:52:26Z")
I would like to improve the MSSQL module in filebeats so that that the multiline messages in the SQL log maps into an ECS structure. The multiline messages that I am looking at always has 'Error:' in the messsage. What… --- ## [Metricbeat MSSQL User Role required](https://discuss.elastic.co/t/metricbeat-mssql-user-role-required/256159)
**Author:** [@kotha](https://discuss.elastic.co/u/kotha)\ **Replies:** 1\ **Last updated:** [November 23, 2020, 6:33am UTC](https://discuss.elastic.co/t/metricbeat-mssql-user-role-required/256159 "2020-11-23T06:33:40Z")
what is the minimum role required to gather stats for Metric MSSQL beat. Right now we are using sysadmin role, but there is a push back from the DBA in using that role for the user that collects the metrics for MSSQL --- ## [Can we store two Elastic search indices in different data directory](https://discuss.elastic.co/t/can-we-store-two-elastic-search-indices-in-different-data-directory/256221)
**Author:** [@Vivek\_Sagar](https://discuss.elastic.co/u/Vivek_Sagar)\ **Replies:** 4\ **Last updated:** [November 23, 2020, 6:20am UTC](https://discuss.elastic.co/t/can-we-store-two-elastic-search-indices-in-different-data-directory/256221 "2020-11-23T06:20:06Z")
Can we have multiple indices in different data paths in elastic search? In my application, I want to separate index to keep sensitive data in dm-crypted volume and others on non encrypted volume. So separate indices for … --- ## [Kibana NoShardsAvailable Exception](https://discuss.elastic.co/t/kibana-noshardsavailable-exception/256080)
**Author:** [@tamilarasanbravo](https://discuss.elastic.co/u/tamilarasanbravo)\ **Replies:** 2\ **Last updated:** [November 23, 2020, 6:13am UTC](https://discuss.elastic.co/t/kibana-noshardsavailable-exception/256080 "2020-11-23T06:13:07Z")
Hi Team, I have been using Kibana to visualize and the last few days it is throwing error :NoShardsAvailableException, please find the snap below. Note : Ignore the index name Please note that I ran few queries to u… --- ## [Unable to set up SAML on elastic cloud 7.9 deployment](https://discuss.elastic.co/t/unable-to-set-up-saml-on-elastic-cloud-7-9-deployment/256203)
**Author:** [@cguerrero](https://discuss.elastic.co/u/cguerrero)\ **Replies:** 2\ **Last updated:** [November 23, 2020, 5:55am UTC](https://discuss.elastic.co/t/unable-to-set-up-saml-on-elastic-cloud-7-9-deployment/256203 "2020-11-23T05:55:47Z")
Deployment ID: 020c87b v7.9.3 I keep running into the following error while trying to authenticate to kibana on an elastic cloud deployment, using SAML (OneLogin). Authentication to realm saml1 failed - Provided SAML … --- ## [APM - traces are not showing for transactions in Kibana APM tab but data was able to visualize in discover tab](https://discuss.elastic.co/t/apm-traces-are-not-showing-for-transactions-in-kibana-apm-tab-but-data-was-able-to-visualize-in-discover-tab/255966)
**Author:** [@r.ganeshbabu](https://discuss.elastic.co/u/r.ganeshbabu)\ **Replies:** 0\ **Last updated:** [November 19, 2020, 10:56am UTC](https://discuss.elastic.co/t/apm-traces-are-not-showing-for-transactions-in-kibana-apm-tab-but-data-was-able-to-visualize-in-discover-tab/255966 "2020-11-19T10:56:47Z")
Hi All, I am trying to monitor my internal applications using Elastic apm and I have setup the APM using helm chart (apm-server 8.5.1 · elastic/elastic) below is the helm install command I have used to bring up the apm… --- ## [Length of a field - Multi-line](https://discuss.elastic.co/t/length-of-a-field-multi-line/256300)
**Author:** [@bevano](https://discuss.elastic.co/u/bevano)\ **Replies:** 0\ **Last updated:** [November 23, 2020, 4:48am UTC](https://discuss.elastic.co/t/length-of-a-field-multi-line/256300 "2020-11-23T04:48:20Z")
Hi All, Need some help with writing a query. I have a field called receipttext (mapped as a text and keyword) and it contains data that spans over multiple lines (eg. think of a receipt that you get from a purchase). I… --- ## [Page not Found /management/kibana/settings](https://discuss.elastic.co/t/page-not-found-management-kibana-settings/256255)
**Author:** [@zbioe](https://discuss.elastic.co/u/zbioe)\ **Replies:** 4\ **Last updated:** [November 23, 2020, 4:01am UTC](https://discuss.elastic.co/t/page-not-found-management-kibana-settings/256255 "2020-11-23T04:01:30Z")
When i go to Visualize in elasticsearch, i see this message. When i click in the link, who sees like: https://kibana.example.com.com/app/visualize#/management/kibana/settings I go to this error page Someone can h… --- ## [Format email in the Alerting and Actions](https://discuss.elastic.co/t/format-email-in-the-alerting-and-actions/254505)
**Author:** [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Replies:** 1\ **Last updated:** [November 23, 2020, 1:33am UTC](https://discuss.elastic.co/t/format-email-in-the-alerting-and-actions/254505 "2020-11-23T01:33:24Z")
Hi all, I want to format the mail that when SIEM or system monitor send mail there will be some information that i can see so i dont really have to access SIEM app to see them. From what i know the watcher has that for… --- ## [Filebeat Office 365 Failed getting a token](https://discuss.elastic.co/t/filebeat-office-365-failed-getting-a-token/256264)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 1\ **Last updated:** [November 23, 2020, 12:58am UTC](https://discuss.elastic.co/t/filebeat-office-365-failed-getting-a-token/256264 "2020-11-23T00:58:53Z")
Hello, Configured the Filebet o365 module. Everything worked fine for some time, but last night things stopped working. The last event sent was: When I restart Filebeat, things start working again. Anyone an idea wh… --- ## [Filebeat 7.10 doesn't follow log while log rotation occur](https://discuss.elastic.co/t/filebeat-7-10-doesnt-follow-log-while-log-rotation-occur/256034)
**Author:** [@Mahoni](https://discuss.elastic.co/u/Mahoni)\ **Replies:** 1\ **Last updated:** [November 23, 2020, 12:33am UTC](https://discuss.elastic.co/t/filebeat-7-10-doesnt-follow-log-while-log-rotation-occur/256034 "2020-11-23T00:33:46Z")
filebeat 7.10 doesn't follow log while log rotation occur, log files inode number is changing but filebeat doesn't follow the log file; # ls -ltr /logs/user-app.tomcat/applicationLogs/tra\*.log\* -rw-r--r-- 1 use… --- ## [Index Lifecycle Policies vs Rollup Jobs](https://discuss.elastic.co/t/index-lifecycle-policies-vs-rollup-jobs/256290)
**Author:** [@lamp123432](https://discuss.elastic.co/u/lamp123432)\ **Replies:** 1\ **Last updated:** [November 23, 2020, 12:14am UTC](https://discuss.elastic.co/t/index-lifecycle-policies-vs-rollup-jobs/256290 "2020-11-23T00:14:28Z")
Hello, Can someone explain the main differences between Index Lifecycle Policies vs Rollup Jobs? Thank you! [Previous page](https://discuss.elastic.co/latest.md?page=1982) [Next page](https://discuss.elastic.co/latest.md?page=1984)