# Latest **URL:** https://discuss.elastic.co/latest.md?page=434 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 435 --- ## [How do I configure auditbeat to show on elastic all the users of the servers and what activities they did on the server](https://discuss.elastic.co/t/how-do-i-configure-auditbeat-to-show-on-elastic-all-the-users-of-the-servers-and-what-activities-they-did-on-the-server/350856)
**Author:** [@Emilia\_Kullutwe](https://discuss.elastic.co/u/Emilia_Kullutwe)\ **Replies:** 0\ **Last updated:** [January 11, 2024, 12:40pm UTC](https://discuss.elastic.co/t/how-do-i-configure-auditbeat-to-show-on-elastic-all-the-users-of-the-servers-and-what-activities-they-did-on-the-server/350856 "2024-01-11T12:40:00Z")
I want to know the usernames of all the users who have access to particular server, I also want to know what activities they did on the server. How do I configure auditbeat to show all this on elastic. I am using Elasti… --- ## [Single Node Cluster - Basic or Minimal Security](https://discuss.elastic.co/t/single-node-cluster-basic-or-minimal-security/350586)
**Author:** [@randomnamegenerator](https://discuss.elastic.co/u/randomnamegenerator)\ **Replies:** 7\ **Last updated:** [January 11, 2024, 12:37pm UTC](https://discuss.elastic.co/t/single-node-cluster-basic-or-minimal-security/350586 "2024-01-11T12:37:41Z")
Hello All, I am looking for a little best practice guidance for our single node cluster on a customer site. The main aim is to create roles in kibana so that we can lock down access to certain individuals and groups. M… --- ## [Update jsonString with UpdateRequest through new java client\[8+ version\]](https://discuss.elastic.co/t/update-jsonstring-with-updaterequest-through-new-java-client-8-version/350855)
**Author:** [@pankaj\_sen](https://discuss.elastic.co/u/pankaj_sen)\ **Replies:** 0\ **Last updated:** [January 11, 2024, 12:31pm UTC](https://discuss.elastic.co/t/update-jsonstring-with-updaterequest-through-new-java-client-8-version/350855 "2024-01-11T12:31:47Z")
Getting below error while trying to update json string through update request. \[x\_content\_parse\_exception\] \[1:8\] \[UpdateRequest\] doc doesn't support values of type: VALUE\_STRING Below is my code snnipt client.update(g… --- ## [Kibana server is not ready yet](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet/350771)
**Author:** [@boubou](https://discuss.elastic.co/u/boubou)\ **Replies:** 1\ **Last updated:** [January 11, 2024, 11:50am UTC](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet/350771 "2024-01-11T11:50:39Z")
I am trying to set up an ELK stack with communication between Kibana and Elasticsearch. I am new to ELK and I am having trouble. I will present my configurations and the results that I am getting. To start, I downloaded… --- ## [Kibana will not connect to elasticsearch](https://discuss.elastic.co/t/kibana-will-not-connect-to-elasticsearch/350773)
**Author:** [@Scott\_Barker](https://discuss.elastic.co/u/Scott_Barker)\ **Replies:** 1\ **Last updated:** [January 11, 2024, 11:34am UTC](https://discuss.elastic.co/t/kibana-will-not-connect-to-elasticsearch/350773 "2024-01-11T11:34:14Z")
When I connect via a web browser I get the error ‘Kibana server is not ready’ I’ve configured elastic with Windows certificates, I can connect to the elk cluster OK that looks OK. https://elkcluster9200/\_cluster/health … --- ## [Logstash date parse issue with date filter using csv file input plugin](https://discuss.elastic.co/t/logstash-date-parse-issue-with-date-filter-using-csv-file-input-plugin/350850)
**Author:** [@jgregory\_tc](https://discuss.elastic.co/u/jgregory_tc)\ **Replies:** 0\ **Last updated:** [January 11, 2024, 11:23am UTC](https://discuss.elastic.co/t/logstash-date-parse-issue-with-date-filter-using-csv-file-input-plugin/350850 "2024-01-11T11:23:30Z")
Hoping someone can assist me with my issue below: I have Logstash conf setup to use the csv input plugin. The data inputs a date field with value like follows… 2024-01-09 22:21:04 I then have this logic in the filter … --- ## [Elastic Unstable](https://discuss.elastic.co/t/elastic-unstable/350593)
**Author:** [@Dea\_Agra](https://discuss.elastic.co/u/Dea_Agra)\ **Replies:** 16\ **Last updated:** [January 11, 2024, 10:38am UTC](https://discuss.elastic.co/t/elastic-unstable/350593 "2024-01-11T10:38:34Z")
Hi Team Elastic, I have been stressful latelty because my logs are coming to Elasticsearch delay for about 10 hours. I have 3 nodes, Node 1: master, ingest, transform, resource: 16vCPU, 16GB, 500GB Node 2: data\_hot, … --- ## [Elasticsearch doesn't work!](https://discuss.elastic.co/t/elasticsearch-doesnt-work/350842)
**Author:** [@boubou](https://discuss.elastic.co/u/boubou)\ **Replies:** 1\ **Last updated:** [January 11, 2024, 10:28am UTC](https://discuss.elastic.co/t/elasticsearch-doesnt-work/350842 "2024-01-11T10:28:20Z")
I am having difficulties using Elasticsearch. I am on Linux and I have installed Elasticsearch 8.2. I have modified my elasticsearch.yml and here is what it contains: cluster.name: elasticsearch-prod node.name: myserve… --- ## [What's the best way to create the combined fields in Elastic Search?](https://discuss.elastic.co/t/whats-the-best-way-to-create-the-combined-fields-in-elastic-search/350843)
**Author:** [@Nomerator](https://discuss.elastic.co/u/Nomerator)\ **Replies:** 0\ **Last updated:** [January 11, 2024, 10:02am UTC](https://discuss.elastic.co/t/whats-the-best-way-to-create-the-combined-fields-in-elastic-search/350843 "2024-01-11T10:02:49Z")
For example, I have fields street, city, state, continent, planet. There is situation when I should search by combination of two fields street and city, and there is situation when I should search by combination of all … --- ## [ILM Hot, Warm, Cold not moving indexes](https://discuss.elastic.co/t/ilm-hot-warm-cold-not-moving-indexes/350756)
**Author:** [@DaddyYusk](https://discuss.elastic.co/u/DaddyYusk)\ **Replies:** 3\ **Last updated:** [January 11, 2024, 9:25am UTC](https://discuss.elastic.co/t/ilm-hot-warm-cold-not-moving-indexes/350756 "2024-01-11T09:25:26Z")
Hi, Despite the ILM policy applied to all logs (Managed), the indexes are moved to the Warm node but not deleted on the Hot node and I'm actually reaching disk capacity on the Hot node... Here is my Elastic Cluster : w… --- ## [K8s daemonset filebeat stop harvesting log after a while](https://discuss.elastic.co/t/k8s-daemonset-filebeat-stop-harvesting-log-after-a-while/350839)
**Author:** [@sailorqh0321](https://discuss.elastic.co/u/sailorqh0321)\ **Replies:** 0\ **Last updated:** [January 11, 2024, 9:07am UTC](https://discuss.elastic.co/t/k8s-daemonset-filebeat-stop-harvesting-log-after-a-while/350839 "2024-01-11T09:07:26Z")
k8s daemonset filebeat stop harvesting log after a while. I started daemonset filebeat in my k8s cluster to collect my Java logs filebeat-version: 8.3.3 My configmap content is as follows --- apiVersion: v1 kind: Con… --- ## [Need help deciding how to partition data](https://discuss.elastic.co/t/need-help-deciding-how-to-partition-data/350837)
**Author:** [@favoca](https://discuss.elastic.co/u/favoca)\ **Replies:** 1\ **Last updated:** [January 11, 2024, 8:44am UTC](https://discuss.elastic.co/t/need-help-deciding-how-to-partition-data/350837 "2024-01-11T08:44:05Z")
The document in my RDMS has a schema similar to this: { PatientId: "string", Date: "date", IsAvailable: "bool", \_hospitalId: "6-digit number which can be a number or a string" } The \_hospitalId acts like a partition ke… --- ## [Time difference calculation in vega](https://discuss.elastic.co/t/time-difference-calculation-in-vega/350820)
**Author:** [@hoodaiy](https://discuss.elastic.co/u/hoodaiy)\ **Replies:** 0\ **Last updated:** [January 11, 2024, 6:07am UTC](https://discuss.elastic.co/t/time-difference-calculation-in-vega/350820 "2024-01-11T06:07:35Z")
hello everyone, i want to calculate the time difference between "startTimestamp" and "endTimestamp", where the filters created for each match. i think i'm getting an issue while connecting to the source, as i'm getting… --- ## [Visualization - matching on a condition](https://discuss.elastic.co/t/visualization-matching-on-a-condition/350795)
**Author:** [@radio\_1](https://discuss.elastic.co/u/radio_1)\ **Replies:** 1\ **Last updated:** [January 11, 2024, 12:42am UTC](https://discuss.elastic.co/t/visualization-matching-on-a-condition/350795 "2024-01-11T00:42:24Z")
Hi - very new to Kibana and visualizations. I have a number of hosts reporting a bunch of objects, each containing a field with a "yes" or "no" value. I'm trying to create a visualization with timestamp on the H-axis a… --- ## [Creating Mappings for Index Interconnections in ElasticSearch: How to Establish Relationships Between Tables?](https://discuss.elastic.co/t/creating-mappings-for-index-interconnections-in-elasticsearch-how-to-establish-relationships-between-tables/350749)
**Author:** [@Neelesh\_Gupta](https://discuss.elastic.co/u/Neelesh_Gupta)\ **Replies:** 2\ **Last updated:** [January 11, 2024, 12:21am UTC](https://discuss.elastic.co/t/creating-mappings-for-index-interconnections-in-elasticsearch-how-to-establish-relationships-between-tables/350749 "2024-01-11T00:21:22Z")
I've successfully uploaded 10 CSV file as tables to Elasticsearch to create a Kibana dashboard. However, since these tables are interlinked with foreign keys, they have been transformed into JSON (NoSQL) format in elasti… --- ## [Elasticsearch unable to form a cluster](https://discuss.elastic.co/t/elasticsearch-unable-to-form-a-cluster/350798)
**Author:** [@ido.shoy](https://discuss.elastic.co/u/ido.shoy)\ **Replies:** 0\ **Last updated:** [January 11, 2024, 12:00am UTC](https://discuss.elastic.co/t/elasticsearch-unable-to-form-a-cluster/350798 "2024-01-11T00:00:55Z")
this is my docker-compose.yml version: '3.8' services: els01: image: docker.elastic.co/elasticsearch/elasticsearch:8.11.3 hostname: els01 volumes: - /mnt/data/els01:/usr/share/e… --- ## [Enterprise Search - GZip compression for App Engine API response](https://discuss.elastic.co/t/enterprise-search-gzip-compression-for-app-engine-api-response/350515)
**Author:** [@Pradeep\_Renukaiah](https://discuss.elastic.co/u/Pradeep_Renukaiah)\ **Replies:** 12\ **Last updated:** [January 10, 2024, 10:20pm UTC](https://discuss.elastic.co/t/enterprise-search-gzip-compression-for-app-engine-api-response/350515 "2024-01-10T22:20:55Z")
We are using Enterprise Search to build our e-commerce use cases. One of our challenges is the API response time and payload size. I am wondering if there is a way we can enable GZip compression for the Enterprise Search… --- ## [Kibana security roles access control](https://discuss.elastic.co/t/kibana-security-roles-access-control/350614)
**Author:** [@mst3r25](https://discuss.elastic.co/u/mst3r25)\ **Replies:** 3\ **Last updated:** [January 10, 2024, 10:05pm UTC](https://discuss.elastic.co/t/kibana-security-roles-access-control/350614 "2024-01-10T22:05:41Z")
My ELK stack stop respecting roles and role mapping. Anyone with a vaild cert can access any Space or index even if they don'tt have that role assigned to them. I upgrade to version 8.11.2 from 8.8.1 last month, but I a … --- ## [Is it possible to run text\_expansion query on a field that has an array of tokens generated by ELSER?](https://discuss.elastic.co/t/is-it-possible-to-run-text-expansion-query-on-a-field-that-has-an-array-of-tokens-generated-by-elser/350782)
**Author:** [@sneh3091](https://discuss.elastic.co/u/sneh3091)\ **Replies:** 3\ **Last updated:** [January 10, 2024, 9:47pm UTC](https://discuss.elastic.co/t/is-it-possible-to-run-text-expansion-query-on-a-field-that-has-an-array-of-tokens-generated-by-elser/350782 "2024-01-10T21:47:09Z")
Hi we are using Elastic 8.10.4 We have a certain process that ingests documents( like PDF ) and runs a "script" processor to split text from those documents into multiple chunks and then runs an inference processor for … --- ## [I have error in logstash](https://discuss.elastic.co/t/i-have-error-in-logstash/350790)
**Author:** [@ahmedtamawe](https://discuss.elastic.co/u/ahmedtamawe)\ **Replies:** 1\ **Last updated:** [January 10, 2024, 8:50pm UTC](https://discuss.elastic.co/t/i-have-error-in-logstash/350790 "2024-01-10T20:50:34Z")
i have this error and want to solve it --- ## [Logs received from panorama](https://discuss.elastic.co/t/logs-received-from-panorama/350785)
**Author:** [@juancamiloll](https://discuss.elastic.co/u/juancamiloll)\ **Replies:** 2\ **Last updated:** [January 10, 2024, 8:41pm UTC](https://discuss.elastic.co/t/logs-received-from-panorama/350785 "2024-01-10T20:41:25Z")
Hello everyone, Normally when I do the ELK installation I ask the firewall administrators to send the logs via port 514 TPC to the server I administer. In the server what I do is that I modify the rsyslog.com file to o… --- ## [Shard Count based on incomming data (MBits/sec) or max MBits/sec of Node (datastream included)?](https://discuss.elastic.co/t/shard-count-based-on-incomming-data-mbits-sec-or-max-mbits-sec-of-node-datastream-included/350788)
**Author:** [@LaszloE](https://discuss.elastic.co/u/LaszloE)\ **Replies:** 0\ **Last updated:** [January 10, 2024, 8:20pm UTC](https://discuss.elastic.co/t/shard-count-based-on-incomming-data-mbits-sec-or-max-mbits-sec-of-node-datastream-included/350788 "2024-01-10T20:20:12Z")
Let us say I have 300 GB data coming in from one client in a day. I store this data on the hot nodes and at the end of the day I move it to the warm nodes. For this 300 GB in order to have acceptable sized shards (let … --- ## [Elastic search 8.7.1 cluster is not forming, Here is yml: and command to create a token run on CENTOS7](https://discuss.elastic.co/t/elastic-search-8-7-1-cluster-is-not-forming-here-is-yml-and-command-to-create-a-token-run-on-centos7/350613)
**Author:** [@Varinder](https://discuss.elastic.co/u/Varinder)\ **Replies:** 9\ **Last updated:** [January 10, 2024, 7:10pm UTC](https://discuss.elastic.co/t/elastic-search-8-7-1-cluster-is-not-forming-here-is-yml-and-command-to-create-a-token-run-on-centos7/350613 "2024-01-10T19:10:56Z")
path.data: /var/lib/elasticsearch path.logs: /var/log/elasticsearch xpack.security.enabled: false xpack.security.enrollment.enabled: true xpack.security.http.ssl: enabled: false keystore.path: certs/http.p12 xpack… --- ## [Elastic Agent on windows Unhealthy : 1 error: initialization of reader failed: failed to expand counter (query='\\Process(\*)\\% Processor Time'): The specified object was not found on the computer](https://discuss.elastic.co/t/elastic-agent-on-windows-unhealthy-1-error-initialization-of-reader-failed-failed-to-expand-counter-query-process-processor-time-the-specified-object-was-not-found-on-the-computer/350770)
**Author:** [@HansPeterSloot](https://discuss.elastic.co/u/HansPeterSloot)\ **Replies:** 2\ **Last updated:** [January 10, 2024, 6:18pm UTC](https://discuss.elastic.co/t/elastic-agent-on-windows-unhealthy-1-error-initialization-of-reader-failed-failed-to-expand-counter-query-process-processor-time-the-specified-object-was-not-found-on-the-computer/350770 "2024-01-10T18:18:56Z")
Hello all, Just for the record. One of my Agents (Windows Server) was unhealthy showing this message: 1 error: initialization of reader failed: failed to expand counter (query='\\Process(\*)% Processor Time'): The speci… --- ## [How to extract the time stamp from](https://discuss.elastic.co/t/how-to-extract-the-time-stamp-from/348741)
**Author:** [@pero](https://discuss.elastic.co/u/pero)\ **Replies:** 20\ **Last updated:** [January 10, 2024, 5:24pm UTC](https://discuss.elastic.co/t/how-to-extract-the-time-stamp-from/348741 "2024-01-10T17:24:43Z")
Hi All, Please I need help on how to extract the timestamp from "type=SYSCALL msg=audit(1701877882.123:5786893): " in the below code using grok filter { "\_index": "auditbeat-2023.12.06", "\_type": "\_doc", "\_id": "… --- ## [Creating Mappings for Index Interconnections in ElasticSearch: How to Establish Relationships Between Tables?](https://discuss.elastic.co/t/creating-mappings-for-index-interconnections-in-elasticsearch-how-to-establish-relationships-between-tables/350751)
**Author:** [@Neelesh\_Gupta](https://discuss.elastic.co/u/Neelesh_Gupta)\ **Replies:** 1\ **Last updated:** [January 10, 2024, 5:12pm UTC](https://discuss.elastic.co/t/creating-mappings-for-index-interconnections-in-elasticsearch-how-to-establish-relationships-between-tables/350751 "2024-01-10T17:12:53Z")
I've uploaded 10 CSV tables to Elasticsearch to create a Kibana dashboard. However, since these tables are interlinked with foreign keys, they have been transformed into JSON (NoSQL) format. I'm now looking for guidance … --- ## [Nagios Log Server: Cannot login](https://discuss.elastic.co/t/nagios-log-server-cannot-login/350780)
**Author:** [@riahc3](https://discuss.elastic.co/u/riahc3)\ **Replies:** 0\ **Last updated:** [January 10, 2024, 5:04pm UTC](https://discuss.elastic.co/t/nagios-log-server-cannot-login/350780 "2024-01-10T17:04:38Z")
Hello Im using Nagios Log Server (which is ELK) and the issue Im having is that when I point the data directory to a NFS share, it says invalid username or password. Doesnt matter if I even reset it, it says the same th… --- ## [I have a question about packetbeat character encoding](https://discuss.elastic.co/t/i-have-a-question-about-packetbeat-character-encoding/350637)
**Author:** [@67PNV5pp1gS6q53B](https://discuss.elastic.co/u/67PNV5pp1gS6q53B)\ **Replies:** 5\ **Last updated:** [January 10, 2024, 3:50pm UTC](https://discuss.elastic.co/t/i-have-a-question-about-packetbeat-character-encoding/350637 "2024-01-10T15:50:31Z")
I want to capture the request and return of the http port, but the data returned by http contains Chinese characters and uses GBK encoding. Garbled characters appear after packetbeat is sent to elastic. I did not find th… --- ## [Elastic Agents Sending Large Amounts of Data](https://discuss.elastic.co/t/elastic-agents-sending-large-amounts-of-data/350413)
**Author:** [@sourcreamnormanbates](https://discuss.elastic.co/u/sourcreamnormanbates)\ **Replies:** 5\ **Last updated:** [January 10, 2024, 3:37pm UTC](https://discuss.elastic.co/t/elastic-agents-sending-large-amounts-of-data/350413 "2024-01-10T15:37:34Z")
Some of my agents are sending 1GB of data every hour. They are all laptops and desktops with a basic setup. Would they do that if the elasticsearch destination they are sending data to is down? --- ## [Can we assign colors to specific fields in kibana?](https://discuss.elastic.co/t/can-we-assign-colors-to-specific-fields-in-kibana/327624)
**Author:** [@smchamberlin](https://discuss.elastic.co/u/smchamberlin)\ **Replies:** 10\ **Last updated:** [January 10, 2024, 3:32pm UTC](https://discuss.elastic.co/t/can-we-assign-colors-to-specific-fields-in-kibana/327624 "2024-01-10T15:32:00Z")
Hello, I can see how to select a color palette for a kibanaq dashboard lens visualization, but what I'd really like to be able to do is choose a particular field (like a "bad" field) and assign it red, and choose a "goo… [Previous page](https://discuss.elastic.co/latest.md?page=433) [Next page](https://discuss.elastic.co/latest.md?page=435)