# Latest **URL:** https://discuss.elastic.co/latest.md?page=424 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 425 --- ## [Which crptographic hash algo does elasticsearch 8.7.0 use?](https://discuss.elastic.co/t/which-crptographic-hash-algo-does-elasticsearch-8-7-0-use/351361)
**Author:** [@sahadev\_d](https://discuss.elastic.co/u/sahadev_d)\ **Replies:** 1\ **Last updated:** [January 23, 2024, 12:28am UTC](https://discuss.elastic.co/t/which-crptographic-hash-algo-does-elasticsearch-8-7-0-use/351361 "2024-01-23T00:28:01Z")
Hi community, just wanted to know which hashing algo does elasticsearch 8.7.0 uses for internal hashing. also does it by any chance use sha1 or sha0 Please let me know how can i check the version --- ## [Logstash container gets closed automatically after installation of the "logstash-input-mongodb" plugin](https://discuss.elastic.co/t/logstash-container-gets-closed-automatically-after-installation-of-the-logstash-input-mongodb-plugin/351479)
**Author:** [@Vladyslav\_Googlya](https://discuss.elastic.co/u/Vladyslav_Googlya)\ **Replies:** 1\ **Last updated:** [January 23, 2024, 12:16am UTC](https://discuss.elastic.co/t/logstash-container-gets-closed-automatically-after-installation-of-the-logstash-input-mongodb-plugin/351479 "2024-01-23T00:16:14Z")
Hi everyone, I'm trying to run the Logstash container in the docker-compose file to sync my MongoDB data with Elastic. But, after the step of installation of the "logstash-input-MongoDB" plugin, the container gets exited… --- ## [Adding an array of events even if there is only one](https://discuss.elastic.co/t/adding-an-array-of-events-even-if-there-is-only-one/351567)
**Author:** [@ylevaill](https://discuss.elastic.co/u/ylevaill)\ **Replies:** 1\ **Last updated:** [January 23, 2024, 12:07am UTC](https://discuss.elastic.co/t/adding-an-array-of-events-even-if-there-is-only-one/351567 "2024-01-23T00:07:38Z")
Hello, I use this filter : json { source =\> "message" add\_field =\> { "\[events\]\[id\]" =\> "%{\_id}" } add\_field =\> { "\[events\]\[nom\]" =\> "%{eventName}" } add\_field =\> { "\[events\]\[timestamp\]" =\> "%{ti… --- ## [Can't drop field in checkpoint filebeat module](https://discuss.elastic.co/t/cant-drop-field-in-checkpoint-filebeat-module/349656)
**Author:** [@krystian](https://discuss.elastic.co/u/krystian)\ **Replies:** 2\ **Last updated:** [January 22, 2024, 11:38pm UTC](https://discuss.elastic.co/t/cant-drop-field-in-checkpoint-filebeat-module/349656 "2024-01-22T23:38:30Z")
I want drop field in checkpoint filebeat module. I try write in "filelds" rule\_name and rule.name and prefix it "checkpoint" but it doesn't work. Please somebody help me. filebeat.yml processors: - drop\_fields: … --- ## [How to resolve ILM errors about missing "scaling\_factor"?](https://discuss.elastic.co/t/how-to-resolve-ilm-errors-about-missing-scaling-factor/345937)
**Author:** [@jerrac](https://discuss.elastic.co/u/jerrac)\ **Replies:** 18\ **Last updated:** [January 22, 2024, 9:13pm UTC](https://discuss.elastic.co/t/how-to-resolve-ilm-errors-about-missing-scaling-factor/345937 "2024-01-22T21:13:32Z")
My ILM policy is configured to downsample metrics. The policy does work, and I have metrics being downsampled, but a few indices are stuck with lifecycle errors. Specifically several .ds-metrics-docker.memory-default... … --- ## [Modsecurity log (split on audit\_data\[messages\]) Only String and Array types are splittable](https://discuss.elastic.co/t/modsecurity-log-split-on-audit-data-messages-only-string-and-array-types-are-splittable/351507)
**Author:** [@sunnysigara](https://discuss.elastic.co/u/sunnysigara)\ **Replies:** 4\ **Last updated:** [January 22, 2024, 8:50pm UTC](https://discuss.elastic.co/t/modsecurity-log-split-on-audit-data-messages-only-string-and-array-types-are-splittable/351507 "2024-01-22T20:50:57Z")
{ "transaction": { "time": "20/Jan/2024:00:10:51 +0530", "transaction\_id": "16717361827536742843", "remote\_address": "20.1.198.110", "remote\_port": 80, "local\_address": "127.0.… --- ## [Kibana Discover / Dashboards Read Only](https://discuss.elastic.co/t/kibana-discover-dashboards-read-only/351286)
**Author:** [@randomnamegenerator](https://discuss.elastic.co/u/randomnamegenerator)\ **Replies:** 6\ **Last updated:** [January 22, 2024, 8:35pm UTC](https://discuss.elastic.co/t/kibana-discover-dashboards-read-only/351286 "2024-01-22T20:35:20Z")
Hello All, We wish to lock down access on a customer sites ELK in a way that they can view the Analytics/Discover & Dashboards but not edit. The indices already exist. I have created a space,role and user with this aim… --- ## [In pipeline: translate causes logstash to crash](https://discuss.elastic.co/t/in-pipeline-translate-causes-logstash-to-crash/351386)
**Author:** [@michael\_c\_michael](https://discuss.elastic.co/u/michael_c_michael)\ **Replies:** 4\ **Last updated:** [January 22, 2024, 7:22pm UTC](https://discuss.elastic.co/t/in-pipeline-translate-causes-logstash-to-crash/351386 "2024-01-22T19:22:22Z")
I'm using a JSON dictionary to convert values to strings, it looks like this: { "1.1.0.80.1.\*.\*": "Motorcycle -\> Generic Scooter (Small)", "1.1.0.80.2.\*.\*": "Motorcycle -\> Generic Sport/Street (Mid-Size)", … --- ## [Watcher pulling \_cat/indices and splitting results on newline to create multiple documents?](https://discuss.elastic.co/t/watcher-pulling-cat-indices-and-splitting-results-on-newline-to-create-multiple-documents/351003)
**Author:** [@dreynolds](https://discuss.elastic.co/u/dreynolds)\ **Replies:** 2\ **Last updated:** [January 22, 2024, 6:54pm UTC](https://discuss.elastic.co/t/watcher-pulling-cat-indices-and-splitting-results-on-newline-to-create-multiple-documents/351003 "2024-01-22T18:54:10Z")
I'm successfully pulling \_cat/indices with a watcher but can't get the results split based on each line. The below works, but the output is all one document. { "trigger": { "schedule": { "interval": "12h" … --- ## [Index deleted by lifecycle after snapshot restore](https://discuss.elastic.co/t/index-deleted-by-lifecycle-after-snapshot-restore/351569)
**Author:** [@lee.clemens](https://discuss.elastic.co/u/lee.clemens)\ **Replies:** 1\ **Last updated:** [January 22, 2024, 6:46pm UTC](https://discuss.elastic.co/t/index-deleted-by-lifecycle-after-snapshot-restore/351569 "2024-01-22T18:46:26Z")
Hello, I recently struggled with waking up to see a restore completed, but the restored index was missing. Is there a way to remove the lifecycle policy after the restore (I resorted to a script to do so after waiting f… --- ## [Copy\_fields and Syslog parsing out of order](https://discuss.elastic.co/t/copy-fields-and-syslog-parsing-out-of-order/350418)
**Author:** [@Hythloday-zero](https://discuss.elastic.co/u/Hythloday-zero)\ **Replies:** 1\ **Last updated:** [January 22, 2024, 6:39pm UTC](https://discuss.elastic.co/t/copy-fields-and-syslog-parsing-out-of-order/350418 "2024-01-22T18:39:14Z")
When I use a Custom TCP Logs integration with Syslog parsing, I expect that Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent bef… --- ## [Re-Allow Write After Index Shrink](https://discuss.elastic.co/t/re-allow-write-after-index-shrink/351568)
**Author:** [@ktbishop](https://discuss.elastic.co/u/ktbishop)\ **Replies:** 3\ **Last updated:** [January 22, 2024, 6:36pm UTC](https://discuss.elastic.co/t/re-allow-write-after-index-shrink/351568 "2024-01-22T18:36:57Z")
Hello all! Currently on Elasticsearch 7.17. I have a data stream with an ILM policy that rolls data over from Hot to Warm after a period of time. Once an index rolls over to the Warm phase it is shrunk, which I understa… --- ## [Use watcher index action with multiple documents](https://discuss.elastic.co/t/use-watcher-index-action-with-multiple-documents/351503)
**Author:** [@lizozom](https://discuss.elastic.co/u/lizozom)\ **Replies:** 3\ **Last updated:** [January 22, 2024, 6:35pm UTC](https://discuss.elastic.co/t/use-watcher-index-action-with-multiple-documents/351503 "2024-01-22T18:35:54Z")
I have an index and I am using a watcher to monitor it. When a condition is met, I want to copy each document to a different index. I'm following the example here: "index\_payload": { "transform": { "script… --- ## [One search in discover being used for different visualisation](https://discuss.elastic.co/t/one-search-in-discover-being-used-for-different-visualisation/351543)
**Author:** [@skshandilya69](https://discuss.elastic.co/u/skshandilya69)\ **Replies:** 4\ **Last updated:** [January 22, 2024, 5:47pm UTC](https://discuss.elastic.co/t/one-search-in-discover-being-used-for-different-visualisation/351543 "2024-01-22T17:47:10Z")
I have many nodes, and each node sends an event that happens repeatedly every 12 hours. all nodes do not send this at the same time. I need one saved search which is very generic, I want to visualise this through variou… --- ## [Scoring and relevance report from optimzely hosted cluster; packet interception using wireshark](https://discuss.elastic.co/t/scoring-and-relevance-report-from-optimzely-hosted-cluster-packet-interception-using-wireshark/351566)
**Author:** [@Echo9Zulu](https://discuss.elastic.co/u/Echo9Zulu)\ **Replies:** 0\ **Last updated:** [January 22, 2024, 5:22pm UTC](https://discuss.elastic.co/t/scoring-and-relevance-report-from-optimzely-hosted-cluster-packet-interception-using-wireshark/351566 "2024-01-22T17:22:33Z")
Hello! I work for a website that uses a hosted Elasticsearch instance. My work focuses on improving search experience. However, I am frequently hitting a wall when it comes to scoring and relevance. The report Optimizel… --- ## [Elastic agent installation: 502 Bad Gateway](https://discuss.elastic.co/t/elastic-agent-installation-502-bad-gateway/351013)
**Author:** [@elhog03](https://discuss.elastic.co/u/elhog03)\ **Replies:** 1\ **Last updated:** [January 22, 2024, 4:44pm UTC](https://discuss.elastic.co/t/elastic-agent-installation-502-bad-gateway/351013 "2024-01-22T16:44:32Z")
I try to install the Elastic agent using the following command (as I do not want the publish our token here, I write "OMITTED" instead of the token): sudo ./elastic-agent install --url=https://172.16.201.8:443 --enrollm… --- ## [Does the '--ca-sha256' command line option for Elastic Agent actually work?](https://discuss.elastic.co/t/does-the-ca-sha256-command-line-option-for-elastic-agent-actually-work/351397)
**Author:** [@digital-thought](https://discuss.elastic.co/u/digital-thought)\ **Replies:** 1\ **Last updated:** [January 22, 2024, 4:41pm UTC](https://discuss.elastic.co/t/does-the-ca-sha256-command-line-option-for-elastic-agent-actually-work/351397 "2024-01-22T16:41:07Z")
I have a self-managed fleet server that has a self-signed certificate on it. I can successfully enrol an agent if I use the following command line options: --certificate-authorities=elasticsearch-ca.pem --fleet-server-… --- ## [Elastic agent sending to second node if first node unreachable](https://discuss.elastic.co/t/elastic-agent-sending-to-second-node-if-first-node-unreachable/351564)
**Author:** [@TIT](https://discuss.elastic.co/u/TIT)\ **Replies:** 1\ **Last updated:** [January 22, 2024, 4:37pm UTC](https://discuss.elastic.co/t/elastic-agent-sending-to-second-node-if-first-node-unreachable/351564 "2024-01-22T16:37:10Z")
in fleet outputs settings if modifiying the hosts section and add multiple hosts will that mean that agent will send data the the second hosts only when the first one is unreachable , or data will be sent to the both … --- ## [Can Elastic SIEM alerts be configured to work on a time basis?](https://discuss.elastic.co/t/can-elastic-siem-alerts-be-configured-to-work-on-a-time-basis/351547)
**Author:** [@Kiwisaki](https://discuss.elastic.co/u/Kiwisaki)\ **Replies:** 0\ **Last updated:** [January 22, 2024, 2:12pm UTC](https://discuss.elastic.co/t/can-elastic-siem-alerts-be-configured-to-work-on-a-time-basis/351547 "2024-01-22T14:12:39Z")
Hi, Is it possible to configure alerts to work on a clock ? I.e, i want some alarms to trigger during out of hours or weekends, but not during mon-fri hours. Is this possible ? Additionally, Can you stack events and … --- ## [FSCrawler - Tika Configuration for escape quotes in TextandCSVParser](https://discuss.elastic.co/t/fscrawler-tika-configuration-for-escape-quotes-in-textandcsvparser/351273)
**Author:** [@kamalsharma](https://discuss.elastic.co/u/kamalsharma)\ **Replies:** 4\ **Last updated:** [January 22, 2024, 1:39pm UTC](https://discuss.elastic.co/t/fscrawler-tika-configuration-for-escape-quotes-in-textandcsvparser/351273 "2024-01-22T13:39:25Z")
When I am ingesting a csv file using FSCrawler, I am getting the error "IOException reading next record: java.io.IOException: (line 131664) invalid char between encapsulated token and delimiter -\> (line 131664) invalid c… --- ## [A user who can create, delete their indexes but restricted to deleting others'](https://discuss.elastic.co/t/a-user-who-can-create-delete-their-indexes-but-restricted-to-deleting-others/351296)
**Author:** [@jeannshuti](https://discuss.elastic.co/u/jeannshuti)\ **Replies:** 3\ **Last updated:** [January 22, 2024, 1:40pm UTC](https://discuss.elastic.co/t/a-user-who-can-create-delete-their-indexes-but-restricted-to-deleting-others/351296 "2024-01-22T13:40:54Z")
I am new to the ELK stack and I am trying to find a built-in role that could allow a user to create and delete their own indexes but restricted to deleting others' indexes (read-only). Is there any specific role that has… --- ## [How to take backup of specific time range of data from elastic search using Curator](https://discuss.elastic.co/t/how-to-take-backup-of-specific-time-range-of-data-from-elastic-search-using-curator/351542)
**Author:** [@shobana](https://discuss.elastic.co/u/shobana)\ **Replies:** 0\ **Last updated:** [January 22, 2024, 1:39pm UTC](https://discuss.elastic.co/t/how-to-take-backup-of-specific-time-range-of-data-from-elastic-search-using-curator/351542 "2024-01-22T13:39:23Z")
Hello All, I need to take specific time period of data as a backup. in index range what i need to give while taking doing ae elastic backup. --- ## [Building Kibana code in WSL giving error](https://discuss.elastic.co/t/building-kibana-code-in-wsl-giving-error/349790)
**Author:** [@vikas.shirke](https://discuss.elastic.co/u/vikas.shirke)\ **Replies:** 7\ **Last updated:** [January 22, 2024, 1:24pm UTC](https://discuss.elastic.co/t/building-kibana-code-in-wsl-giving-error/349790 "2024-01-22T13:24:28Z")
I am trying to build Kibana code locally in wsl enviroment. I am using version 8.11.3 I have ran below commands: git checkout 8.11.3 nvm use yarn kbn clean yarn cache clean rm yarn.lock yarn kbn bootstrap --force-… --- ## [S3 repository snapshot](https://discuss.elastic.co/t/s3-repository-snapshot/351486)
**Author:** [@Haytham\_Shammout](https://discuss.elastic.co/u/Haytham_Shammout)\ **Replies:** 5\ **Last updated:** [January 22, 2024, 1:04pm UTC](https://discuss.elastic.co/t/s3-repository-snapshot/351486 "2024-01-22T13:04:10Z")
Hello, I am trying to create a s3 repository snapshot that will take 1 exact day which is the day before 7 days, noting that all the indices I have is daily based, and this needs to be done every day at a specific time. … --- ## [/\_security/api\_key timeout](https://discuss.elastic.co/t/security-api-key-timeout/351366)
**Author:** [@seism0saurus](https://discuss.elastic.co/u/seism0saurus)\ **Replies:** 2\ **Last updated:** [January 22, 2024, 12:50pm UTC](https://discuss.elastic.co/t/security-api-key-timeout/351366 "2024-01-22T12:50:15Z")
Hi, I encounter a problem with the API key management in Kibana. The page behind Stack Management -\> Security -\> API keys does not load. After some time it displays "Could not load API keys." Under technical details i… --- ## [Logstash filters not working as expected](https://discuss.elastic.co/t/logstash-filters-not-working-as-expected/351536)
**Author:** [@Mansi\_Kamthane](https://discuss.elastic.co/u/Mansi_Kamthane)\ **Replies:** 0\ **Last updated:** [January 22, 2024, 11:58am UTC](https://discuss.elastic.co/t/logstash-filters-not-working-as-expected/351536 "2024-01-22T11:58:03Z")
I am working with logstash filter no filter works here here is the config file of logstash \` input { tcp { id =\> "\*\*\*" port =\> \*\*\* codec =\> json\_lines } } filter { cipher { algorithm =\> "aes-128-cbc" key =\> … --- ## [ECE v3.6.2 installation failure: client version 1.23 is too old. Minimum supported API version is 1.24](https://discuss.elastic.co/t/ece-v3-6-2-installation-failure-client-version-1-23-is-too-old-minimum-supported-api-version-is-1-24/351534)
**Author:** [@kuradakis](https://discuss.elastic.co/u/kuradakis)\ **Replies:** 1\ **Last updated:** [January 22, 2024, 11:56am UTC](https://discuss.elastic.co/t/ece-v3-6-2-installation-failure-client-version-1-23-is-too-old-minimum-supported-api-version-is-1-24/351534 "2024-01-22T11:56:14Z")
Hi All! I have recently started getting this error, last week(3rd week Jan 2024) all was working fine. Same error with 3.6.0 as well. The output is this: $ bash elastic-cloud-enterprise.sh install --cloud-enterprise… --- ## [How to see Kibana Dashboard after setup winlogbeat](https://discuss.elastic.co/t/how-to-see-kibana-dashboard-after-setup-winlogbeat/351499)
**Author:** [@aguskhohar](https://discuss.elastic.co/u/aguskhohar)\ **Replies:** 1\ **Last updated:** [January 22, 2024, 11:01am UTC](https://discuss.elastic.co/t/how-to-see-kibana-dashboard-after-setup-winlogbeat/351499 "2024-01-22T11:01:58Z")
Hi All, Could you please arrange to see winlogbeat after installing on kibana (os windows) --- ## [Unable to Connect to Server from Spring boot application in es 8.12](https://discuss.elastic.co/t/unable-to-connect-to-server-from-spring-boot-application-in-es-8-12/351494)
**Author:** [@Aditya\_Teltia](https://discuss.elastic.co/u/Aditya_Teltia)\ **Replies:** 2\ **Last updated:** [January 22, 2024, 10:40am UTC](https://discuss.elastic.co/t/unable-to-connect-to-server-from-spring-boot-application-in-es-8-12/351494 "2024-01-22T10:40:15Z")
While I am able to connect for version es 7.17 but when I am doing the same for version 8.x I am unable to connect. I have to connect to 8.x since I want to use KNN query which it seems is only available in 8.x and late… --- ## [OIDC role mapping not working](https://discuss.elastic.co/t/oidc-role-mapping-not-working/350743)
**Author:** [@natharran](https://discuss.elastic.co/u/natharran)\ **Replies:** 2\ **Last updated:** [January 22, 2024, 10:28am UTC](https://discuss.elastic.co/t/oidc-role-mapping-not-working/350743 "2024-01-22T10:28:49Z")
Hello all, I'm experiencing a problem with role mapping after successful OIDC authentication. My OP provides ID Token where the following data about user can be found (copied from ES log): \\"resource\_access\\":{\\"kibana… [Previous page](https://discuss.elastic.co/latest.md?page=423) [Next page](https://discuss.elastic.co/latest.md?page=425)