# Latest **URL:** https://discuss.elastic.co/latest.md?page=471 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 472 --- ## [\[OPNsense\] (pfsense integration) not logging unbound DNS](https://discuss.elastic.co/t/opnsense-pfsense-integration-not-logging-unbound-dns/348095)
**Author:** [@straw\_hardhat](https://discuss.elastic.co/u/straw_hardhat)\ **Replies:** 0\ **Last updated:** [November 27, 2023, 11:01pm UTC](https://discuss.elastic.co/t/opnsense-pfsense-integration-not-logging-unbound-dns/348095 "2023-11-27T23:01:06Z")
I've set up a OPNsense which is successfully communicating with ELK (running in docker, GitHub - peasead/elastic-container: Stand up a simple Elastic container with Kibana, Fleet, and the Detection Engine) as both filter… --- ## [Elasticsearch TSDS and geo\_point as dimension](https://discuss.elastic.co/t/elasticsearch-tsds-and-geo-point-as-dimension/347674)
**Author:** [@berg](https://discuss.elastic.co/u/berg)\ **Replies:** 2\ **Last updated:** [November 27, 2023, 10:54pm UTC](https://discuss.elastic.co/t/elasticsearch-tsds-and-geo-point-as-dimension/347674 "2023-11-27T22:54:33Z")
We are migrating some data sources across to a new cluster, and we have some wireless metrics that count the number of connected devices on each floor of each building. This seemed like an effective use case for TSDS, a… --- ## [Elastic Security - what is the difference between adding something to the fleet, and a host / endpoint?](https://discuss.elastic.co/t/elastic-security-what-is-the-difference-between-adding-something-to-the-fleet-and-a-host-endpoint/348086)
**Author:** [@jordan\_pritchard](https://discuss.elastic.co/u/jordan_pritchard)\ **Replies:** 0\ **Last updated:** [November 27, 2023, 8:56pm UTC](https://discuss.elastic.co/t/elastic-security-what-is-the-difference-between-adding-something-to-the-fleet-and-a-host-endpoint/348086 "2023-11-27T20:56:11Z")
Hi - I've been testing deploying Elastic Agent. The agent installs without error and I see the agent show up in the fleet, but on roughly half the servers I am testing on, I don't see them show up in Hosts or Endpoints. … --- ## [Alerting on compared aggregations](https://discuss.elastic.co/t/alerting-on-compared-aggregations/348075)
**Author:** [@GD\_DV](https://discuss.elastic.co/u/GD_DV)\ **Replies:** 1\ **Last updated:** [November 27, 2023, 8:51pm UTC](https://discuss.elastic.co/t/alerting-on-compared-aggregations/348075 "2023-11-27T20:51:06Z")
Hello folks, I'm hoping to get a little insight from experienced folks as to how to approach my problem. I have a bunch of devices creating documents in my index. Each document is identified as belonging to a particular… --- ## [Add multiple index per kubernetes metadata for filebeat](https://discuss.elastic.co/t/add-multiple-index-per-kubernetes-metadata-for-filebeat/348082)
**Author:** [@farhad\_kh](https://discuss.elastic.co/u/farhad_kh)\ **Replies:** 0\ **Last updated:** [November 27, 2023, 8:15pm UTC](https://discuss.elastic.co/t/add-multiple-index-per-kubernetes-metadata-for-filebeat/348082 "2023-11-27T20:15:00Z")
I have a limited number of index names that I can use for each namespace How can I do this using Kubernetes metadata? I configured filebeat as below, but red elastic index is not created apiVersion: v1 kind: ConfigMap… --- ## [Unable to search phrase anywhere in the text](https://discuss.elastic.co/t/unable-to-search-phrase-anywhere-in-the-text/348081)
**Author:** [@Mistgun\_Scripts](https://discuss.elastic.co/u/Mistgun_Scripts)\ **Replies:** 0\ **Last updated:** [November 27, 2023, 8:10pm UTC](https://discuss.elastic.co/t/unable-to-search-phrase-anywhere-in-the-text/348081 "2023-11-27T20:10:12Z")
So I'm trying to search for a given phrase in text, already tried different methods e.g match\_phrase/query\_string but I still get invalid results. Let's say we have such documents with titles: "This is a phrase" "Anot… --- ## [Attend to bugfix(es) on python library](https://discuss.elastic.co/t/attend-to-bugfix-es-on-python-library/347926)
**Author:** [@Thijs\_Miedema](https://discuss.elastic.co/u/Thijs_Miedema)\ **Replies:** 1\ **Last updated:** [November 27, 2023, 8:04pm UTC](https://discuss.elastic.co/t/attend-to-bugfix-es-on-python-library/347926 "2023-11-27T20:04:03Z")
Some fixes have been provided from minor bugs on the python elasticapm library Pull requests · elastic/apm-agent-python · GitHub that are not being attended to, in particular Fix asyncpg tests to make it compatible with … --- ## [How to install elastic agent on remote machine out of docker container using fleet](https://discuss.elastic.co/t/how-to-install-elastic-agent-on-remote-machine-out-of-docker-container-using-fleet/348079)
**Author:** [@datalaf](https://discuss.elastic.co/u/datalaf)\ **Replies:** 0\ **Last updated:** [November 27, 2023, 8:01pm UTC](https://discuss.elastic.co/t/how-to-install-elastic-agent-on-remote-machine-out-of-docker-container-using-fleet/348079 "2023-11-27T20:01:58Z")
Hi, i am currently running elasticsearch with kibana on a cloud server in a docker container and i want to use the fleetserver to enroll a elastic agent on a remote linux machine. But when i am trying to setup a fleet s… --- ## [Unable to connect to Elasticsearch. Error: index\_not\_found\_exception index\_not\_found\_exception: no such index \[.kibana\]](https://discuss.elastic.co/t/unable-to-connect-to-elasticsearch-error-index-not-found-exception-index-not-found-exception-no-such-index-kibana/348026)
**Author:** [@abkrim](https://discuss.elastic.co/u/abkrim)\ **Replies:** 1\ **Last updated:** [November 27, 2023, 6:31pm UTC](https://discuss.elastic.co/t/unable-to-connect-to-elasticsearch-error-index-not-found-exception-index-not-found-exception-no-such-index-kibana/348026 "2023-11-27T18:31:54Z")
I'm trying to install and configure a simple node on my local machine using Docker, following the documentation. However, when I try to execute the first step of the Kibana configuration and paste the enrollment token, … --- ## [Deploy multiple elasticsearch replicas in kubernetes](https://discuss.elastic.co/t/deploy-multiple-elasticsearch-replicas-in-kubernetes/348076)
**Author:** [@ali\_abdelfattah](https://discuss.elastic.co/u/ali_abdelfattah)\ **Replies:** 0\ **Last updated:** [November 27, 2023, 6:14pm UTC](https://discuss.elastic.co/t/deploy-multiple-elasticsearch-replicas-in-kubernetes/348076 "2023-11-27T18:14:03Z")
I deployed ELK stack with kubernetes, it works with no error if i use one replica for elasticsearch deployment . But when it increase a replicas to 2 i get the following error \[2023-11-27T18:03:54.296+00:00\]\[… --- ## [Anomaly Detection for input logs (Elastic Agents)](https://discuss.elastic.co/t/anomaly-detection-for-input-logs-elastic-agents/346073)
**Author:** [@yzaritskyi](https://discuss.elastic.co/u/yzaritskyi)\ **Replies:** 20\ **Last updated:** [November 27, 2023, 5:26pm UTC](https://discuss.elastic.co/t/anomaly-detection-for-input-logs-elastic-agents/346073 "2023-11-27T17:26:14Z")
I want to create something like a Machine Learning or Threshold rule that triggers when my infrastructure loses events from elastic agents. For example, the medium of events per day is 500k logs. But if I will get only … --- ## [Failed migration of system indices (.triggered\_watches) with Upgrade Assistant using v7.17.14](https://discuss.elastic.co/t/failed-migration-of-system-indices-triggered-watches-with-upgrade-assistant-using-v7-17-14/346966)
**Author:** [@AEA27](https://discuss.elastic.co/u/AEA27)\ **Replies:** 3\ **Last updated:** [November 27, 2023, 4:37pm UTC](https://discuss.elastic.co/t/failed-migration-of-system-indices-triggered-watches-with-upgrade-assistant-using-v7-17-14/346966 "2023-11-27T16:37:55Z")
Using the upgrade assistant the migration of system indices fails for watcher which we're using. We're using elastic cloud and trying to migrate to Elasticsearch 8. Another fun fact is that the index that is failing to … --- ## [Restricting user to confluence document in elastic workplace search](https://discuss.elastic.co/t/restricting-user-to-confluence-document-in-elastic-workplace-search/347462)
**Author:** [@smohan5](https://discuss.elastic.co/u/smohan5)\ **Replies:** 1\ **Last updated:** [November 27, 2023, 4:01pm UTC](https://discuss.elastic.co/t/restricting-user-to-confluence-document-in-elastic-workplace-search/347462 "2023-11-27T16:01:41Z")
I have integrated confluence connector with Elasticsearch and set up Document-level permissions. I mapped confluence user ID to a Workplace Search username and did a sync But my get api external returns empty permissio… --- ## [How to view file content](https://discuss.elastic.co/t/how-to-view-file-content/348036)
**Author:** [@min\_liu](https://discuss.elastic.co/u/min_liu)\ **Replies:** 4\ **Last updated:** [November 27, 2023, 3:45pm UTC](https://discuss.elastic.co/t/how-to-view-file-content/348036 "2023-11-27T15:45:03Z")
I would like to know what is written inside the Elasticsearch data directory file. Is there a tool available to view the file content? thanks --- ## [Elastic Forwarder for Cloudwatch](https://discuss.elastic.co/t/elastic-forwarder-for-cloudwatch/348056)
**Author:** [@Jasonespo](https://discuss.elastic.co/u/Jasonespo)\ **Replies:** 0\ **Last updated:** [November 27, 2023, 1:49pm UTC](https://discuss.elastic.co/t/elastic-forwarder-for-cloudwatch/348056 "2023-11-27T13:49:39Z")
Hi, We're using the Elastic Serverless forwarder with Cloudwatch and I was wondering if anyone can clarify these questions? What are the parameters around the subscription filter, is it every time a new log hits Cloud… --- ## [Limit Metricbeat Memory Usage](https://discuss.elastic.co/t/limit-metricbeat-memory-usage/348062)
**Author:** [@nvanalphen](https://discuss.elastic.co/u/nvanalphen)\ **Replies:** 2\ **Last updated:** [November 27, 2023, 3:41pm UTC](https://discuss.elastic.co/t/limit-metricbeat-memory-usage/348062 "2023-11-27T15:41:29Z")
Is it possible to limit the memory that Metricbeat may use? I am seeing huge memory loads on my Windows Servers (2016, 2019 and 2022), between 2 and 3 Gb on VMs and a staggering 24Gb on a HyperV host Stopping and sta… --- ## [Metricbeat, filebeat](https://discuss.elastic.co/t/metricbeat-filebeat/348049)
**Author:** [@Haytham\_Shammout](https://discuss.elastic.co/u/Haytham_Shammout)\ **Replies:** 1\ **Last updated:** [November 27, 2023, 2:42pm UTC](https://discuss.elastic.co/t/metricbeat-filebeat/348049 "2023-11-27T14:42:28Z")
I am trying to find Metricbeat and filebeat versions for AIX systems, with no luck is elastic support AIX servers with filebeat and metricbeat? --- ## [Windows service monitoring options](https://discuss.elastic.co/t/windows-service-monitoring-options/348060)
**Author:** [@Ryan\_Downey](https://discuss.elastic.co/u/Ryan_Downey)\ **Replies:** 0\ **Last updated:** [November 27, 2023, 2:23pm UTC](https://discuss.elastic.co/t/windows-service-monitoring-options/348060 "2023-11-27T14:23:59Z")
I'm currently working on monitoring Windows Services and the best way to do this seems to be within Stack Management. I would have thought this would be done in the Observability area but when I looked through the avail… --- ## [Elastic APM + Yarp](https://discuss.elastic.co/t/elastic-apm-yarp/347667)
**Author:** [@Thomas\_Piart](https://discuss.elastic.co/u/Thomas_Piart)\ **Replies:** 1\ **Last updated:** [November 27, 2023, 2:17pm UTC](https://discuss.elastic.co/t/elastic-apm-yarp/347667 "2023-11-27T14:17:45Z")
Hello, I'm doing an http call to server, which in turn does an http call to another server All that is instrumented with Elastic APM Http \> Server A \> Http \> Server B If I use an httpclient to do the call from server… --- ## [Custom date\_format for parse\_origination\_date](https://discuss.elastic.co/t/custom-date-format-for-parse-origination-date/348042)
**Author:** [@tbabic](https://discuss.elastic.co/u/tbabic)\ **Replies:** 1\ **Last updated:** [November 27, 2023, 12:50pm UTC](https://discuss.elastic.co/t/custom-date-format-for-parse-origination-date/348042 "2023-11-27T12:50:05Z")
Currently date\_format is yyyy.MM.dd in index.lifecycle.parse\_origination\_date which is great if you have logs in format like logs-2016.10.31-000002, but since index name is custom and can be like eg logs-2016-10-31-00 th… --- ## [Metricbeat's docker.diskio.read/write.rate is always zero when using cgroups v2](https://discuss.elastic.co/t/metricbeats-docker-diskio-read-write-rate-is-always-zero-when-using-cgroups-v2/348048)
**Author:** [@christian.k](https://discuss.elastic.co/u/christian.k)\ **Replies:** 0\ **Last updated:** [November 27, 2023, 12:46pm UTC](https://discuss.elastic.co/t/metricbeats-docker-diskio-read-write-rate-is-always-zero-when-using-cgroups-v2/348048 "2023-11-27T12:46:19Z")
We want to use the docker.diskio.read/write.rate metric to monitor our systems. However, Metricbeat's Docker module reports all docker.diskio metrics (except the docker.diskio.read/write.bytes metric) as zero when using … --- ## ["Input not supported" with File Integrity Monitoring on Elastic Agent](https://discuss.elastic.co/t/input-not-supported-with-file-integrity-monitoring-on-elastic-agent/346671)
**Author:** [@ivanchak](https://discuss.elastic.co/u/ivanchak)\ **Replies:** 1\ **Last updated:** [November 27, 2023, 12:35pm UTC](https://discuss.elastic.co/t/input-not-supported-with-file-integrity-monitoring-on-elastic-agent/346671 "2023-11-27T12:35:11Z")
As stated in the title, once adding the FIM integration to my Ubuntu 22.04 server. The fleet agent turned "Unhealthy", and shows "input not supported". Once I remove the FIM integration, then everything works just fine a… --- ## [Update an event fields based on another event](https://discuss.elastic.co/t/update-an-event-fields-based-on-another-event/347975)
**Author:** [@marcowiskhy](https://discuss.elastic.co/u/marcowiskhy)\ **Replies:** 5\ **Last updated:** [November 27, 2023, 12:25pm UTC](https://discuss.elastic.co/t/update-an-event-fields-based-on-another-event/347975 "2023-11-27T12:25:34Z")
Hi, i have some logs indexed in elasticsearch by logstash that provides two types of events: { "@timestamp": "Nov 23, 2023 @ 15:24:33.064", "Detection ID": "ldt:87654321", "logSource": "CS De… --- ## [Trouble connecting logstash to a secure elastic search cluster](https://discuss.elastic.co/t/trouble-connecting-logstash-to-a-secure-elastic-search-cluster/348045)
**Author:** [@debo9912](https://discuss.elastic.co/u/debo9912)\ **Replies:** 0\ **Last updated:** [November 27, 2023, 12:22pm UTC](https://discuss.elastic.co/t/trouble-connecting-logstash-to-a-secure-elastic-search-cluster/348045 "2023-11-27T12:22:17Z")
Hi, I'm facing issues connecting logstash to elasticsearch cluster over https. I'm using the official elastic helm charts to setup my cluster. I'm pretty new to setting up such clusters so might be missing out something. … --- ## [How to change logo and header](https://discuss.elastic.co/t/how-to-change-logo-and-header/348034)
**Author:** [@Rutuja\_More](https://discuss.elastic.co/u/Rutuja_More)\ **Replies:** 1\ **Last updated:** [November 27, 2023, 12:19pm UTC](https://discuss.elastic.co/t/how-to-change-logo-and-header/348034 "2023-11-27T12:19:07Z")
How can i change the logo of login page and Welcome to elastic, is it free or paid , if paid then what is the process and which paid Elastic Stack subscriptions is there ? --- ## [Error: fail to enroll: fail to execute request to fleet-server: x509: cannot validate certificate for X.X.X.X because it doesn't contain any IP SANs](https://discuss.elastic.co/t/error-fail-to-enroll-fail-to-execute-request-to-fleet-server-x509-cannot-validate-certificate-for-x-x-x-x-because-it-doesnt-contain-any-ip-sans/347124)
**Author:** [@ethical20](https://discuss.elastic.co/u/ethical20)\ **Replies:** 5\ **Last updated:** [November 27, 2023, 12:03pm UTC](https://discuss.elastic.co/t/error-fail-to-enroll-fail-to-execute-request-to-fleet-server-x509-cannot-validate-certificate-for-x-x-x-x-because-it-doesnt-contain-any-ip-sans/347124 "2023-11-27T12:03:15Z")
Hi, i was using elastic 8.8.0 and all my agents were online green. Updating the stack went smooth but when came to upgrade the elastic agents from fleet to 8.9.1 i can see that the agents are offline but still getting d… --- ## [Elastic serverless forwarder json formatting](https://discuss.elastic.co/t/elastic-serverless-forwarder-json-formatting/347959)
**Author:** [@vsv0001](https://discuss.elastic.co/u/vsv0001)\ **Replies:** 1\ **Last updated:** [November 27, 2023, 11:45am UTC](https://discuss.elastic.co/t/elastic-serverless-forwarder-json-formatting/347959 "2023-11-27T11:45:01Z")
we write our logs in json format to cloudwatch. does elastic serverless forwarder have any way (Deploy Elastic Serverless Forwarder | Elastic Serverless Forwarder Guide | Elastic) to send the logs in a json structure to… --- ## [Spatial Join results](https://discuss.elastic.co/t/spatial-join-results/347980)
**Author:** [@Cory34](https://discuss.elastic.co/u/Cory34)\ **Replies:** 1\ **Last updated:** [November 27, 2023, 10:34am UTC](https://discuss.elastic.co/t/spatial-join-results/347980 "2023-11-27T10:34:54Z")
Can the results of a spatial join (8.11) be displayed in any other way besides as a map layer? Lens? Alerts? Thanks. --- ## [Keyword typed field partially matching user query](https://discuss.elastic.co/t/keyword-typed-field-partially-matching-user-query/348033)
**Author:** [@spino17](https://discuss.elastic.co/u/spino17)\ **Replies:** 0\ **Last updated:** [November 27, 2023, 10:03am UTC](https://discuss.elastic.co/t/keyword-typed-field-partially-matching-user-query/348033 "2023-11-27T10:03:25Z")
I am using ES 7.9 version. I have a category index with document like doc\_1 = { "value": "laptops" } doc-2 = { "value": "air cooler" } with following schema: { "mappings": { "properties": { "v… --- ## [Elasticsearch configure 2 network host](https://discuss.elastic.co/t/elasticsearch-configure-2-network-host/348024)
**Author:** [@avnere](https://discuss.elastic.co/u/avnere)\ **Replies:** 1\ **Last updated:** [November 27, 2023, 9:31am UTC](https://discuss.elastic.co/t/elasticsearch-configure-2-network-host/348024 "2023-11-27T09:31:09Z")
Hi, Is it possible to configure elasticsearch to be accessible for both localhost and and ip address? [Previous page](https://discuss.elastic.co/latest.md?page=470) [Next page](https://discuss.elastic.co/latest.md?page=472)