# Latest **URL:** https://discuss.elastic.co/latest.md?page=800 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 801 --- ## [Can not install fleet server's elastic agent in Logstash server](https://discuss.elastic.co/t/can-not-install-fleet-servers-elastic-agent-in-logstash-server/324409)
**Author:** [@Kosala\_Randika\_Paran](https://discuss.elastic.co/u/Kosala_Randika_Paran)\ **Replies:** 0\ **Last updated:** [February 1, 2023, 10:30am UTC](https://discuss.elastic.co/t/can-not-install-fleet-servers-elastic-agent-in-logstash-server/324409 "2023-02-01T10:30:51Z")
Hi, I am trying to install fleet server's elastic agent in logstash server, but once I installed it given following error. any support on this? --- ## [Search Match for all tokens from decompound filter](https://discuss.elastic.co/t/search-match-for-all-tokens-from-decompound-filter/322483)
**Author:** [@florin\_olah](https://discuss.elastic.co/u/florin_olah)\ **Replies:** 3\ **Last updated:** [February 1, 2023, 10:03am UTC](https://discuss.elastic.co/t/search-match-for-all-tokens-from-decompound-filter/322483 "2023-02-01T10:03:47Z")
Hello, I am trying to do the same thing described in the topic here: German compound words in an e-commerce search simple example: searching for "sprachkurs" which is tokenized as "sprachkurs, sprach, kurs" Desired re… --- ## [Watcher Alert with multi match](https://discuss.elastic.co/t/watcher-alert-with-multi-match/323831)
**Author:** [@vaibhav.ubale](https://discuss.elastic.co/u/vaibhav.ubale)\ **Replies:** 2\ **Last updated:** [February 1, 2023, 10:03am UTC](https://discuss.elastic.co/t/watcher-alert-with-multi-match/323831 "2023-02-01T10:03:36Z")
Hi Team , I am New to community, I want to set up the watcher alert on the logs with messages like following "message: The user has selected account 84900-1 has no limit left" Where 84900 is account type and 1 is sub… --- ## [Java APM tag external http request made with reactive webclient](https://discuss.elastic.co/t/java-apm-tag-external-http-request-made-with-reactive-webclient/324263)
**Author:** [@mrodal](https://discuss.elastic.co/u/mrodal)\ **Replies:** 4\ **Last updated:** [February 1, 2023, 9:49am UTC](https://discuss.elastic.co/t/java-apm-tag-external-http-request-made-with-reactive-webclient/324263 "2023-02-01T09:49:45Z")
Kibana version: 8.6 Elasticsearch version: 8.6 APM Server version: 8.6 APM Agent language and version: 1.35.0 Browser version: - Original install method (e.g. download page, yum, deb, from source, etc.) and version:… --- ## [ElasticsearchException\[failed to bind service\]; nested: IndexFormatTooNewException\[Format version is not supported](https://discuss.elastic.co/t/elasticsearchexception-failed-to-bind-service-nested-indexformattoonewexception-format-version-is-not-supported/324353)
**Author:** [@Doums\_D](https://discuss.elastic.co/u/Doums_D)\ **Replies:** 2\ **Last updated:** [February 1, 2023, 9:46am UTC](https://discuss.elastic.co/t/elasticsearchexception-failed-to-bind-service-nested-indexformattoonewexception-format-version-is-not-supported/324353 "2023-02-01T09:46:57Z")
Hello everyone, I have a issue on my elasticsearch server. i extended the storage from 1To to 2To and after rebooting i never could restart my elasticsearch service. Here is what i have actually in my journalctl when i… --- ## [Runtime field kibana](https://discuss.elastic.co/t/runtime-field-kibana/324362)
**Author:** [@LorensiusOksigii](https://discuss.elastic.co/u/LorensiusOksigii)\ **Replies:** 1\ **Last updated:** [February 1, 2023, 9:45am UTC](https://discuss.elastic.co/t/runtime-field-kibana/324362 "2023-02-01T09:45:55Z")
hi, i want make three new field that capture alert, source address and destination address from message field. anyone can help me how to do it. i have try using runtime field, but i cannot extract the value from the mes… --- ## [Organisation of the document to index in the java API with a nested field](https://discuss.elastic.co/t/organisation-of-the-document-to-index-in-the-java-api-with-a-nested-field/324400)
**Author:** [@QuentinV](https://discuss.elastic.co/u/QuentinV)\ **Replies:** 1\ **Last updated:** [February 1, 2023, 9:22am UTC](https://discuss.elastic.co/t/organisation-of-the-document-to-index-in-the-java-api-with-a-nested-field/324400 "2023-02-01T09:22:00Z")
Hello. In my project, I success to connect, create and index documents to an elasticsearch with the new java API but I want to index a file with an nested field and I don't find any information about it. Can you explai… --- ## [Monitor systemd service from dockerized Metricbeat](https://discuss.elastic.co/t/monitor-systemd-service-from-dockerized-metricbeat/324395)
**Author:** [@Yungxin\_Shin](https://discuss.elastic.co/u/Yungxin_Shin)\ **Replies:** 0\ **Last updated:** [February 1, 2023, 8:11am UTC](https://discuss.elastic.co/t/monitor-systemd-service-from-dockerized-metricbeat/324395 "2023-02-01T08:11:34Z")
I wonder if there's a way to stream the metrics (such as cpu, mem usage, diskio etc.) of systemd services to Elasticsearch through Metricbeat. To monitor the services running on the host, we could use the system module. … --- ## [Error on disable data\_detection](https://discuss.elastic.co/t/error-on-disable-data-detection/324265)
**Author:** [@sphawk](https://discuss.elastic.co/u/sphawk)\ **Replies:** 2\ **Last updated:** [February 1, 2023, 7:44am UTC](https://discuss.elastic.co/t/error-on-disable-data-detection/324265 "2023-02-01T07:44:27Z")
I'm trying to disable data\_detection via curl. I delete the shard curl -s -H 'Content-Type: application/json' -X DELETE 'http://localhost:9200/video?pretty' { "acknowledged" : true } then curl -H 'Content-Type: ap… --- ## [Upgrade Elasticsearch to 7.17.8](https://discuss.elastic.co/t/upgrade-elasticsearch-to-7-17-8/324391)
**Author:** [@Sandeepa\_Kariyawasam](https://discuss.elastic.co/u/Sandeepa_Kariyawasam)\ **Replies:** 1\ **Last updated:** [February 1, 2023, 7:27am UTC](https://discuss.elastic.co/t/upgrade-elasticsearch-to-7-17-8/324391 "2023-02-01T07:27:09Z")
I'm trying to upgrade my elasticsearch to version 7.17.8 from version 7.14.0. I have a single instant with kibana and logstash included. Current version has quiet a lot of data so it's hard to back it up. When I upgr… --- ## [Kibana control has white back ground](https://discuss.elastic.co/t/kibana-control-has-white-back-ground/323367)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 3\ **Last updated:** [February 1, 2023, 6:48am UTC](https://discuss.elastic.co/t/kibana-control-has-white-back-ground/323367 "2023-02-01T06:48:59Z")
Kibana 8.5.3 after upgrade I notice that background is white and hardly able to read on it. how do I fix it. whole dashbaord is in dark mode. it was working ok on 7.x version. this selection is old style control which… --- ## [Export of Users & Roles in Kibana as CSV](https://discuss.elastic.co/t/export-of-users-roles-in-kibana-as-csv/324196)
**Author:** [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\ **Replies:** 2\ **Last updated:** [February 1, 2023, 3:25am UTC](https://discuss.elastic.co/t/export-of-users-roles-in-kibana-as-csv/324196 "2023-02-01T03:25:29Z")
Hi all, For my internal purposes, I want to export a CSV of all users , roles and their permissions. I know I can see them in Roles & Users, but want an export of CSV. I believe every user is created as seperate inde… --- ## [Azure Event Hub Explanation](https://discuss.elastic.co/t/azure-event-hub-explanation/324373)
**Author:** [@gabrieligbastos](https://discuss.elastic.co/u/gabrieligbastos)\ **Replies:** 2\ **Last updated:** [February 1, 2023, 2:37am UTC](https://discuss.elastic.co/t/azure-event-hub-explanation/324373 "2023-02-01T02:37:23Z")
Hello, Im new to ELK Stack, and Im trying to increase observability with it. Im here have some doubts that I could not find a answer in other topics, probably because my problem is just too newbie! :slight\_smile: I dep… --- ## [Logstash occupies superior folder of log folder](https://discuss.elastic.co/t/logstash-occupies-superior-folder-of-log-folder/324379)
**Author:** [@Steven29](https://discuss.elastic.co/u/Steven29)\ **Replies:** 0\ **Last updated:** [February 1, 2023, 2:27am UTC](https://discuss.elastic.co/t/logstash-occupies-superior-folder-of-log-folder/324379 "2023-02-01T02:27:12Z")
I assigned the path ' /AllLog/Logstash'. But sometimes when I start the logstash, log(log of logstash) is not stacked because the AllLog folder is full(capacity). But when I stop the logstash, the capacity of AllLog f… --- ## [Getting "event\_agent\_id\_status auth\_metadata\_missing" error while sending logs from standalone elasticagent](https://discuss.elastic.co/t/getting-event-agent-id-status-auth-metadata-missing-error-while-sending-logs-from-standalone-elasticagent/324378)
**Author:** [@Bhrugu\_Sharma](https://discuss.elastic.co/u/Bhrugu_Sharma)\ **Replies:** 0\ **Last updated:** [February 1, 2023, 2:06am UTC](https://discuss.elastic.co/t/getting-event-agent-id-status-auth-metadata-missing-error-while-sending-logs-from-standalone-elasticagent/324378 "2023-02-01T02:06:18Z")
I am trying to send the logs from my AKS cluster into Elasticsearch the log that I am getting is "event.agent\_id\_status auth\_metadata\_missing" in my kibana even after all the volume mounts are done correctly here's my … --- ## [How much is xpack-siem, please tell me , thanks](https://discuss.elastic.co/t/how-much-is-xpack-siem-please-tell-me-thanks/324375)
**Author:** [@dingyouqiang](https://discuss.elastic.co/u/dingyouqiang)\ **Replies:** 2\ **Last updated:** [February 1, 2023, 1:04am UTC](https://discuss.elastic.co/t/how-much-is-xpack-siem-please-tell-me-thanks/324375 "2023-02-01T01:04:23Z")
i don't know the price of xpack and i never use them. I want to know the price , and tell my boss. thanks --- ## [App Search Wierd Issue](https://discuss.elastic.co/t/app-search-wierd-issue/324326)
**Author:** [@pknaangal](https://discuss.elastic.co/u/pknaangal)\ **Replies:** 2\ **Last updated:** [January 31, 2023, 11:21pm UTC](https://discuss.elastic.co/t/app-search-wierd-issue/324326 "2023-01-31T23:21:51Z")
Hi Everybody, I have the App Search subscription. In my search engine when I do the following search: {'page': {'size': 200},'query':'kesavananda bharti v. State of Kerala'} It returns zero results. However when I do t… --- ## [Multiline Logstash that handles timestamp on each line](https://discuss.elastic.co/t/multiline-logstash-that-handles-timestamp-on-each-line/322556)
**Author:** [@Scotsie](https://discuss.elastic.co/u/Scotsie)\ **Replies:** 5\ **Last updated:** [January 31, 2023, 9:58pm UTC](https://discuss.elastic.co/t/multiline-logstash-that-handles-timestamp-on-each-line/322556 "2023-01-31T21:58:46Z")
I'm currently ingesting logs from multiple devices successfully, one document per row. One particular brand, Polycom, is sending a multiline entry that includes the timestamp for each row. Sample Logging (with normal an… --- ## [Convert NanoSecond Unix timestamp](https://discuss.elastic.co/t/convert-nanosecond-unix-timestamp/324368)
**Author:** [@maskrider1111](https://discuss.elastic.co/u/maskrider1111)\ **Replies:** 8\ **Last updated:** [January 31, 2023, 9:57pm UTC](https://discuss.elastic.co/t/convert-nanosecond-unix-timestamp/324368 "2023-01-31T21:57:29Z")
Hi Folks, Any idea how to convert the nanosecond unix timestamp in logstash filter? date { match =\> \[ "eventtime","UNIX\_MS", "ISO8601" \] target =\> "Epoch" timezone =\> "UT… --- ## [Line break in grok pattern](https://discuss.elastic.co/t/line-break-in-grok-pattern/324369)
**Author:** [@mariana17](https://discuss.elastic.co/u/mariana17)\ **Replies:** 1\ **Last updated:** [January 31, 2023, 8:52pm UTC](https://discuss.elastic.co/t/line-break-in-grok-pattern/324369 "2023-01-31T20:52:38Z")
I am trying to get the data from a log, however in the middle of the log there is a line break which prevents the Grok filter from reading it correctly. If I adjust it to a single line it works, however, it would require… --- ## [Nginx Logs Can't Be Parsed Because Symlinks](https://discuss.elastic.co/t/nginx-logs-cant-be-parsed-because-symlinks/323958)
**Author:** [@Christian\_Jacobs](https://discuss.elastic.co/u/Christian_Jacobs)\ **Replies:** 7\ **Last updated:** [January 31, 2023, 8:42pm UTC](https://discuss.elastic.co/t/nginx-logs-cant-be-parsed-because-symlinks/323958 "2023-01-31T20:42:49Z")
Currently I have an nginx container that has filebeat running in the background. \[nginx:latest as base\] I have enabled the nginx module with filebeat modules enable nginx, my filebeat.yml has an input defined for the lo… --- ## [I have a problema with send data from filebeat to Logstash](https://discuss.elastic.co/t/i-have-a-problema-with-send-data-from-filebeat-to-logstash/324366)
**Author:** [@odelacruzc](https://discuss.elastic.co/u/odelacruzc)\ **Replies:** 3\ **Last updated:** [January 31, 2023, 8:40pm UTC](https://discuss.elastic.co/t/i-have-a-problema-with-send-data-from-filebeat-to-logstash/324366 "2023-01-31T20:40:01Z")
Hello, can you help me pleae, I have a filebeat in my local computer and logstash in a VM Ubuntu in VirtualBox, so I check conectivity from my PC to remote server ubuntu with telnet 192.168.1.12 5044 and was successfull … --- ## [Twitter Input - Logstash filter mutate remove\_field - Elasticsearch](https://discuss.elastic.co/t/twitter-input-logstash-filter-mutate-remove-field-elasticsearch/324290)
**Author:** [@xalmer](https://discuss.elastic.co/u/xalmer)\ **Replies:** 10\ **Last updated:** [January 31, 2023, 8:38pm UTC](https://discuss.elastic.co/t/twitter-input-logstash-filter-mutate-remove-field-elasticsearch/324290 "2023-01-31T20:38:45Z")
Hello eveybody, Im trying to discover the fantastic world of possibilities of ELK. But i stop in a problem, and maybe someone can solve this "equation". Im using the Twitter Input Plugin to receive Twitter data, but i … --- ## [Logstash will not start with /tmp mounted noexec](https://discuss.elastic.co/t/logstash-will-not-start-with-tmp-mounted-noexec/324125)
**Author:** [@chuck1](https://discuss.elastic.co/u/chuck1)\ **Replies:** 6\ **Last updated:** [January 31, 2023, 7:39pm UTC](https://discuss.elastic.co/t/logstash-will-not-start-with-tmp-mounted-noexec/324125 "2023-01-31T19:39:53Z")
Logstash will not start with the /tmp directory mounted as noexec on RHEL 8.6. We fixed this with Elasticsearch. However, do not have the proper variables, guidance on how to fix this with Logstash. Thank You For Your … --- ## [Pending\_tasks has millions of entries, many of with are exact duplicates of ilm-move-to-step](https://discuss.elastic.co/t/pending-tasks-has-millions-of-entries-many-of-with-are-exact-duplicates-of-ilm-move-to-step/324329)
**Author:** [@jmlucjav](https://discuss.elastic.co/u/jmlucjav)\ **Replies:** 4\ **Last updated:** [January 31, 2023, 6:56pm UTC](https://discuss.elastic.co/t/pending-tasks-has-millions-of-entries-many-of-with-are-exact-duplicates-of-ilm-move-to-step/324329 "2023-01-31T18:56:58Z")
hi, I have a 7.10.2 cluster, quite large, with 10k indices, and we are having issues with millions of pending tasks being queued at some point. I managed to get a dump of them while they were just 2M, and I saw: 90% … --- ## [Runtime conditional](https://discuss.elastic.co/t/runtime-conditional/324210)
**Author:** [@LorensiusOksigii](https://discuss.elastic.co/u/LorensiusOksigii)\ **Replies:** 7\ **Last updated:** [January 31, 2023, 6:39pm UTC](https://discuss.elastic.co/t/runtime-conditional/324210 "2023-01-31T18:39:59Z")
Hi, i get confuse how to set a new value for msg value from message field. i want set if message value == { "msg" : "ICMP flood" }, msg value will show only ICMP flood i have try this but getting error --- ## [TCP input and answer to client](https://discuss.elastic.co/t/tcp-input-and-answer-to-client/324338)
**Author:** [@M\_K1](https://discuss.elastic.co/u/M_K1)\ **Replies:** 4\ **Last updated:** [January 31, 2023, 6:01pm UTC](https://discuss.elastic.co/t/tcp-input-and-answer-to-client/324338 "2023-01-31T18:01:22Z")
Hello! is it possible to do in logstash? i need to receive strings throuth tcp input and after succssesful recievment i need to answer the client with string for example "ok" or "bad format" --- ## [Elasticsearch and Kibana certificate expired](https://discuss.elastic.co/t/elasticsearch-and-kibana-certificate-expired/323800)
**Author:** [@Kosala\_Randika\_Paran](https://discuss.elastic.co/u/Kosala_Randika_Paran)\ **Replies:** 2\ **Last updated:** [January 31, 2023, 5:29pm UTC](https://discuss.elastic.co/t/elasticsearch-and-kibana-certificate-expired/323800 "2023-01-31T17:29:49Z")
Hi folks, We have 2 Elasticsearch servers and 1 Kibana server. Seem like the certificate has been expired in every servers, so can you help me to how to renew them. Seem like servers already having self sign certificat… --- ## [Running eck in production best practices](https://discuss.elastic.co/t/running-eck-in-production-best-practices/324248)
**Author:** [@elastic-db-user](https://discuss.elastic.co/u/elastic-db-user)\ **Replies:** 2\ **Last updated:** [January 31, 2023, 4:59pm UTC](https://discuss.elastic.co/t/running-eck-in-production-best-practices/324248 "2023-01-31T16:59:09Z")
I am about to go for running multiple Elasticsearch clusters managed by an eck operator on k8 in production. eIasticsearch, kibana, curator and all other deployments are working as expected. I am wondering if there's any… --- ## [How to ingest firewall log data to elastic security](https://discuss.elastic.co/t/how-to-ingest-firewall-log-data-to-elastic-security/324138)
**Author:** [@yak990](https://discuss.elastic.co/u/yak990)\ **Replies:** 2\ **Last updated:** [January 31, 2023, 4:36pm UTC](https://discuss.elastic.co/t/how-to-ingest-firewall-log-data-to-elastic-security/324138 "2023-01-31T16:36:38Z")
I've figured out how to parse my firewall logs with logstash, and they are in ECS format now. I can create a new index and edit some settings to get it to show in discover. How do I add the new index pattern to the log… [Previous page](https://discuss.elastic.co/latest.md?page=799) [Next page](https://discuss.elastic.co/latest.md?page=801)