# Latest **URL:** https://discuss.elastic.co/latest.md?page=748 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 749 --- ## [Deploy Fleet server using API](https://discuss.elastic.co/t/deploy-fleet-server-using-api/326951)
**Author:** [@krzychohoho](https://discuss.elastic.co/u/krzychohoho)\ **Replies:** 9\ **Last updated:** [March 15, 2023, 3:55pm UTC](https://discuss.elastic.co/t/deploy-fleet-server-using-api/326951 "2023-03-15T15:55:56Z")
Hi, I am trying to create fully automated script for SIEM deployment. There is one issue. I am not able to install fleet server. I want it to be fully automated no UI interaction. So first i need to create policy using … --- ## [Terraform, Traffic Filters and Kibana](https://discuss.elastic.co/t/terraform-traffic-filters-and-kibana/327767)
**Author:** [@tensor](https://discuss.elastic.co/u/tensor)\ **Replies:** 0\ **Last updated:** [March 15, 2023, 3:48pm UTC](https://discuss.elastic.co/t/terraform-traffic-filters-and-kibana/327767 "2023-03-15T15:48:58Z")
Hi! We have been successfully using Terraform to set up Elasticcloud instances, and using traffic filtering to allow only access via private link to our own Azure serup - almost too successful, as it turns out, as it me… --- ## [Insert in nodejs is slow](https://discuss.elastic.co/t/insert-in-nodejs-is-slow/327705)
**Author:** [@HF\_Mohammad](https://discuss.elastic.co/u/HF_Mohammad)\ **Replies:** 4\ **Last updated:** [March 15, 2023, 3:19pm UTC](https://discuss.elastic.co/t/insert-in-nodejs-is-slow/327705 "2023-03-15T15:19:45Z")
This is my code: for (let i = 0; i \< 500; i++) { await client.index({ index: 'user', body: { name: 'mohammad', type: 'mobile' } }) } This code take time about 3 second to fin… --- ## [Certified Analyst practice exam issues](https://discuss.elastic.co/t/certified-analyst-practice-exam-issues/324946)
**Author:** [@ja.carvajal](https://discuss.elastic.co/u/ja.carvajal)\ **Replies:** 2\ **Last updated:** [March 15, 2023, 2:59pm UTC](https://discuss.elastic.co/t/certified-analyst-practice-exam-issues/324946 "2023-03-15T14:59:05Z")
Continuing the discussion from Certified Analyst practice exam issues: Hello, I am having the same issues that Baron reported. What can I do about it? From a small search I saw that there is data from October until Dec… --- ## [Ingest pipeline created for filebeat log using grok pattern,but unable to run in dev tools](https://discuss.elastic.co/t/ingest-pipeline-created-for-filebeat-log-using-grok-pattern-but-unable-to-run-in-dev-tools/327660)
**Author:** [@PRASHANT\_MEHTA](https://discuss.elastic.co/u/PRASHANT_MEHTA)\ **Replies:** 4\ **Last updated:** [March 15, 2023, 11:43am UTC](https://discuss.elastic.co/t/ingest-pipeline-created-for-filebeat-log-using-grok-pattern-but-unable-to-run-in-dev-tools/327660 "2023-03-15T11:43:12Z")
Hello All, I'm successfully getting output of my log pattern using grok pattern,but when trying to create log ingest pipeline that can be used in template later,I'm getting exception while running the ingest pipeline in… --- ## [Logs Deprecaction](https://discuss.elastic.co/t/logs-deprecaction/327760)
**Author:** [@LeonardoCord](https://discuss.elastic.co/u/LeonardoCord)\ **Replies:** 0\ **Last updated:** [March 15, 2023, 2:22pm UTC](https://discuss.elastic.co/t/logs-deprecaction/327760 "2023-03-15T14:22:01Z")
Hola Me esta sacando este error y quisiera saber como podria solucionarlo this request accesses system indices: \[.apm-agent-configuration, .apm-custom-link, .async-search, .fleet-enrollment-api-keys-7, .fleet-policies-… --- ## [Do we have lookup similar to Splunk lookup](https://discuss.elastic.co/t/do-we-have-lookup-similar-to-splunk-lookup/327550)
**Author:** [@Saurabhpandey](https://discuss.elastic.co/u/Saurabhpandey)\ **Replies:** 5\ **Last updated:** [March 15, 2023, 2:19pm UTC](https://discuss.elastic.co/t/do-we-have-lookup-similar-to-splunk-lookup/327550 "2023-03-15T14:19:02Z")
Do we have lookup similar to Splunk lookup --- ## [Best Web crawler to index data to elasticsearch](https://discuss.elastic.co/t/best-web-crawler-to-index-data-to-elasticsearch/327759)
**Author:** [@Disha\_Bodade](https://discuss.elastic.co/u/Disha_Bodade)\ **Replies:** 0\ **Last updated:** [March 15, 2023, 1:55pm UTC](https://discuss.elastic.co/t/best-web-crawler-to-index-data-to-elasticsearch/327759 "2023-03-15T13:55:05Z")
Hi Team, As elastic appsearch supports to crawl websites which uses basic auth alone. Any suggestions which web crawler we can use with elasticsearch to crawl the SSO, SAML, NTLM protected websites? Thanks, Disha --- ## [Mapping directly in Logstash Pipeline](https://discuss.elastic.co/t/mapping-directly-in-logstash-pipeline/327757)
**Author:** [@\_Thomas](https://discuss.elastic.co/u/_Thomas)\ **Replies:** 2\ **Last updated:** [March 15, 2023, 1:49pm UTC](https://discuss.elastic.co/t/mapping-directly-in-logstash-pipeline/327757 "2023-03-15T13:49:24Z")
Hi Guys, since I didn't find anything helpful on the net - I need to ask here: Is it possible to do the Mapping of fields directly in the Logstash Pipeline - either in the Input or in the Filter section? As I do have … --- ## [Query Suggestions and Special Characters](https://discuss.elastic.co/t/query-suggestions-and-special-characters/327699)
**Author:** [@ryans](https://discuss.elastic.co/u/ryans)\ **Replies:** 0\ **Last updated:** [March 14, 2023, 8:54pm UTC](https://discuss.elastic.co/t/query-suggestions-and-special-characters/327699 "2023-03-14T20:54:17Z")
Hi there. I have created and configured an Elasticsearch Index-based App Search Engine that has a char\_filter to not strip $, \*, and / characters as they are important to my business. My search queries work great, but … --- ## [Actual use of join type field](https://discuss.elastic.co/t/actual-use-of-join-type-field/327627)
**Author:** [@SheetalM](https://discuss.elastic.co/u/SheetalM)\ **Replies:** 5\ **Last updated:** [March 15, 2023, 12:39pm UTC](https://discuss.elastic.co/t/actual-use-of-join-type-field/327627 "2023-03-15T12:39:28Z")
Hello Experts, We have a use case with a one-to-many relation scenario where number of documents of a child type are huge for one parent type of document. Something similar to a log store where all the events/messages f… --- ## [Logstash ruby filter hash class exception](https://discuss.elastic.co/t/logstash-ruby-filter-hash-class-exception/327747)
**Author:** [@onuruzun](https://discuss.elastic.co/u/onuruzun)\ **Replies:** 0\ **Last updated:** [March 15, 2023, 11:47am UTC](https://discuss.elastic.co/t/logstash-ruby-filter-hash-class-exception/327747 "2023-03-15T11:47:29Z")
I tried to get the difference between these two JSON objects coming from JDBC in Logstash. example JDBC JSON: before = '{"heroes":\[{"id":1,"name":"pudge"},{"id":2,"name":"slark"},{"id":3,"name":"techies"}\]}' after = '… --- ## [What's the meaning of rally operations when starting a track](https://discuss.elastic.co/t/whats-the-meaning-of-rally-operations-when-starting-a-track/325852)
**Author:** [@marone](https://discuss.elastic.co/u/marone)\ **Replies:** 6\ **Last updated:** [March 15, 2023, 11:39am UTC](https://discuss.elastic.co/t/whats-the-meaning-of-rally-operations-when-starting-a-track/325852 "2023-03-15T11:39:57Z")
Hello, It's been several times working with rally and every time I feel like it's hard to understand and use. I started an http\_logs track against a cluster, and can't find the meaning of the following operations that r… --- ## [Custom Plugin: EuiToast is being displayed as a section of pagebody rather than](https://discuss.elastic.co/t/custom-plugin-euitoast-is-being-displayed-as-a-section-of-pagebody-rather-than/327744)
**Author:** [@cyrildaniel](https://discuss.elastic.co/u/cyrildaniel)\ **Replies:** 0\ **Last updated:** [March 15, 2023, 10:22am UTC](https://discuss.elastic.co/t/custom-plugin-euitoast-is-being-displayed-as-a-section-of-pagebody-rather-than/327744 "2023-03-15T10:22:29Z")
When displaying the EuiToast it comes below as a bottom section of the EuiPageBody tag and does not appear as expected. observed output =\> expected output=\> --- ## [Upgrade from 7.x to 8.x requires multi upgrades?](https://discuss.elastic.co/t/upgrade-from-7-x-to-8-x-requires-multi-upgrades/327408)
**Author:** [@atdc12](https://discuss.elastic.co/u/atdc12)\ **Replies:** 5\ **Last updated:** [March 15, 2023, 9:36am UTC](https://discuss.elastic.co/t/upgrade-from-7-x-to-8-x-requires-multi-upgrades/327408 "2023-03-15T09:36:38Z")
We have a few production sites running ES 7.16 and would like to upgrade to 8.6: upgrade will be done with full cluster restart all indices were created under ES 7.x we have checked Upgrade Assistant on ES 7.16 and con… --- ## [Elasticsearch continuously on yellow Status - Unassigned Shards](https://discuss.elastic.co/t/elasticsearch-continuously-on-yellow-status-unassigned-shards/327742)
**Author:** [@Apostolos\_Koutoulas](https://discuss.elastic.co/u/Apostolos_Koutoulas)\ **Replies:** 1\ **Last updated:** [March 15, 2023, 9:34am UTC](https://discuss.elastic.co/t/elasticsearch-continuously-on-yellow-status-unassigned-shards/327742 "2023-03-15T09:34:13Z")
Hello all! Hope you are doing well Cluster status in yellow with unassigned replica shards Elasticsearch version 6.8.23 Cluster status: \[root@d38-pan020 ~\]# es\_cluster.sh health { "cluster\_name" : "\_\_pan\_cluster\_\_… --- ## [How can I mark root object as null](https://discuss.elastic.co/t/how-can-i-mark-root-object-as-null/327719)
**Author:** [@Vivek\_Burman](https://discuss.elastic.co/u/Vivek_Burman)\ **Replies:** 11\ **Last updated:** [March 15, 2023, 9:02am UTC](https://discuss.elastic.co/t/how-can-i-mark-root-object-as-null/327719 "2023-03-15T09:02:34Z")
So my mapping looks like this. My query is I would like to mark the custom\_field property as null as a root \[NULL\_VALUES IN ELASTIC SEARCH\] (null\_value | Elasticsearch Guide \[8.6\] | Elastic) "custom\_field":{ … --- ## [Data not ingested into master node](https://discuss.elastic.co/t/data-not-ingested-into-master-node/327649)
**Author:** [@truekonrads](https://discuss.elastic.co/u/truekonrads)\ **Replies:** 6\ **Last updated:** [March 15, 2023, 7:57am UTC](https://discuss.elastic.co/t/data-not-ingested-into-master-node/327649 "2023-03-15T07:57:19Z")
Hello, I have a three node cluster set up with no explicitly defined roles for each nodes. I can see by disk usage and index document count that no data was ingested into master node - only non-master nodes have data on… --- ## [Elasticsearch not receiving Metricbeat data completely](https://discuss.elastic.co/t/elasticsearch-not-receiving-metricbeat-data-completely/327723)
**Author:** [@priti](https://discuss.elastic.co/u/priti)\ **Replies:** 0\ **Last updated:** [March 15, 2023, 6:42am UTC](https://discuss.elastic.co/t/elasticsearch-not-receiving-metricbeat-data-completely/327723 "2023-03-15T06:42:04Z")
After install metricbeat and enable CPU,memory,disk, proccess enable only we are receiving process related data. Please guide how to troubleshoot , why CPU , memory and disk data not coming. --- ## [404 Error installing Filebeat on Debian Linux via apt](https://discuss.elastic.co/t/404-error-installing-filebeat-on-debian-linux-via-apt/327701)
**Author:** [@michael.jarvis](https://discuss.elastic.co/u/michael.jarvis)\ **Replies:** 1\ **Last updated:** [March 15, 2023, 2:36am UTC](https://discuss.elastic.co/t/404-error-installing-filebeat-on-debian-linux-via-apt/327701 "2023-03-15T02:36:35Z")
Hello, I am trying to install filebeat on some Debian Linux devices, using the instructions from this link. Unfortunately, the URL provided on that page (https://artifacts.elastic.co/packages/8.x/apt) is not working. Am… --- ## [Kibana Audit Log - Alerting Rule Deletion](https://discuss.elastic.co/t/kibana-audit-log-alerting-rule-deletion/327645)
**Author:** [@wanch](https://discuss.elastic.co/u/wanch)\ **Replies:** 0\ **Last updated:** [March 14, 2023, 9:59am UTC](https://discuss.elastic.co/t/kibana-audit-log-alerting-rule-deletion/327645 "2023-03-14T09:59:51Z")
Hi, I have a question regarding Kibana's audit logging and the deletion of alerting rules. Below is the audit logs I got for deleting an alerting rule in Kibana UI: { "event": { "action": "http\_request", "ca… --- ## [How to pass multiple indies to ElasticSearch UI ElasticsearchAPIConnector](https://discuss.elastic.co/t/how-to-pass-multiple-indies-to-elasticsearch-ui-elasticsearchapiconnector/327707)
**Author:** [@Sheng111](https://discuss.elastic.co/u/Sheng111)\ **Replies:** 0\ **Last updated:** [March 15, 2023, 12:08am UTC](https://discuss.elastic.co/t/how-to-pass-multiple-indies-to-elasticsearch-ui-elasticsearchapiconnector/327707 "2023-03-15T00:08:35Z")
Hi there, I am using Search UI with Elasticsearch, wondering how to pass multiple indies to config? I got requirement is build a global search box, so users can search multiple indies data based on different attribute … --- ## [Runtime field painless script to extract from a field](https://discuss.elastic.co/t/runtime-field-painless-script-to-extract-from-a-field/327696)
**Author:** [@zx8086](https://discuss.elastic.co/u/zx8086)\ **Replies:** 1\ **Last updated:** [March 15, 2023, 12:05am UTC](https://discuss.elastic.co/t/runtime-field-painless-script-to-extract-from-a-field/327696 "2023-03-15T00:05:51Z")
Hi Have a field named path with content "first\_part/second\_part/third\_part" and what to extract the first\_part with a painless script Thanks --- ## [How to integrate my logs to Elastic Observability](https://discuss.elastic.co/t/how-to-integrate-my-logs-to-elastic-observability/326233)
**Author:** [@schavaku](https://discuss.elastic.co/u/schavaku)\ **Replies:** 2\ **Last updated:** [March 14, 2023, 10:01pm UTC](https://discuss.elastic.co/t/how-to-integrate-my-logs-to-elastic-observability/326233 "2023-03-14T22:01:05Z")
How can I configure my logs from SQL Server on Elastic Search server( is already exists). How can I integrate the logs? Pleas let me know the steps. --- ## [Useragent filter not working as expected after enabling ECS](https://discuss.elastic.co/t/useragent-filter-not-working-as-expected-after-enabling-ecs/327662)
**Author:** [@flalar](https://discuss.elastic.co/u/flalar)\ **Replies:** 2\ **Last updated:** [March 14, 2023, 8:13pm UTC](https://discuss.elastic.co/t/useragent-filter-not-working-as-expected-after-enabling-ecs/327662 "2023-03-14T20:13:13Z")
We're having trouble with the useragent filter not adding the data to the document sent to Elasticsearch or stdout. Seems this happend after enabling support for ECS. Upgrading from Logstash 7.17.9 to 8.6.2 did not solv… --- ## [Sinker: a new tool to synchronize Postgres to Elasticsearch](https://discuss.elastic.co/t/sinker-a-new-tool-to-synchronize-postgres-to-elasticsearch/327691)
**Author:** [@loren](https://discuss.elastic.co/u/loren)\ **Replies:** 0\ **Last updated:** [March 14, 2023, 4:53pm UTC](https://discuss.elastic.co/t/sinker-a-new-tool-to-synchronize-postgres-to-elasticsearch/327691 "2023-03-14T16:53:41Z")
I built a change data capture tool to synchronize normalized Postgres data into denormalized Elasticsearch documents, and my employer let me open-source it yesterday. We tried some existing solutions but they weren't a… --- ## [Problems upgrading Elasticsearch from version 7.17 to 8.6.2 in ECE](https://discuss.elastic.co/t/problems-upgrading-elasticsearch-from-version-7-17-to-8-6-2-in-ece/327680)
**Author:** [@JRM](https://discuss.elastic.co/u/JRM)\ **Replies:** 0\ **Last updated:** [March 14, 2023, 2:42pm UTC](https://discuss.elastic.co/t/problems-upgrading-elasticsearch-from-version-7-17-to-8-6-2-in-ece/327680 "2023-03-14T14:42:37Z")
I am upgrading Elasticsearch from version 7.17 to 8.6.2 in ECE , and it gives this error: plan change failed: some instances were not running. I have used the upgrade wizard and everything was correct to perform the upg… --- ## [Missing headers even with include\_headers (Csv codec plugin) set to true](https://discuss.elastic.co/t/missing-headers-even-with-include-headers-csv-codec-plugin-set-to-true/327555)
**Author:** [@alexus](https://discuss.elastic.co/u/alexus)\ **Replies:** 5\ **Last updated:** [March 14, 2023, 4:34pm UTC](https://discuss.elastic.co/t/missing-headers-even-with-include-headers-csv-codec-plugin-set-to-true/327555 "2023-03-14T16:34:56Z")
Hello World! per Csv codec plugin | Logstash Reference \[7.17\] | Elastic I'm set include\_headers flag to value true, yet even though headers gets included into output on first run, at later time on re-run schedule of ve… --- ## [Animal Sniffer plugin build problem](https://discuss.elastic.co/t/animal-sniffer-plugin-build-problem/327665)
**Author:** [@sadu](https://discuss.elastic.co/u/sadu)\ **Replies:** 1\ **Last updated:** [March 14, 2023, 4:23pm UTC](https://discuss.elastic.co/t/animal-sniffer-plugin-build-problem/327665 "2023-03-14T16:23:33Z")
Elasticsearch version: Stack Management 8.6.2 APM Agent language and version: Java 1.36.0 \*\*Java version \*\*: For build I use java 11 Original install method (e.g. download page, yum, deb, from source, etc.) and ver… --- ## [Logstash S3 input slow ingestion](https://discuss.elastic.co/t/logstash-s3-input-slow-ingestion/327653)
**Author:** [@true64gurus](https://discuss.elastic.co/u/true64gurus)\ **Replies:** 5\ **Last updated:** [March 14, 2023, 3:55pm UTC](https://discuss.elastic.co/t/logstash-s3-input-slow-ingestion/327653 "2023-03-14T15:55:12Z")
I have setup where logstash reads Kubernetes logs from 20 different buckets and send them to ELK. The logs seems to be coming 3-5 minutes late to ELK. The logstash running docker on VM with 31GB Xms/Xmx. I am using one … [Previous page](https://discuss.elastic.co/latest.md?page=747) [Next page](https://discuss.elastic.co/latest.md?page=749)