# Latest **URL:** https://discuss.elastic.co/latest.md?page=809 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 810 --- ## [Recover missing account](https://discuss.elastic.co/t/recover-missing-account/323829)
**Author:** [@WalterDias](https://discuss.elastic.co/u/WalterDias)\ **Replies:** 1\ **Last updated:** [January 25, 2023, 1:18am UTC](https://discuss.elastic.co/t/recover-missing-account/323829 "2023-01-25T01:18:58Z")
Hi every one, I looking for a support contact that can help to retrive an account that a former employee uses to administrate our elastic cloud account. Thx for the help. --- ## [Detecting inactive users in Active Directory](https://discuss.elastic.co/t/detecting-inactive-users-in-active-directory/323650)
**Author:** [@Elnur\_Abbasov](https://discuss.elastic.co/u/Elnur_Abbasov)\ **Replies:** 5\ **Last updated:** [January 25, 2023, 12:29am UTC](https://discuss.elastic.co/t/detecting-inactive-users-in-active-directory/323650 "2023-01-25T00:29:39Z")
Hey All, I need to detect inactive users in Active Directory using Elastic SIEM. Any ideas how can I do that using EQL? I implemented the detection login in Splunk by using lookup files where I write to a lookup file al… --- ## [ElascticsearchClient 8.5.3 (Java) cannot unblock index via client](https://discuss.elastic.co/t/elascticsearchclient-8-5-3-java-cannot-unblock-index-via-client/323812)
**Author:** [@Denko](https://discuss.elastic.co/u/Denko)\ **Replies:** 3\ **Last updated:** [January 24, 2023, 8:42pm UTC](https://discuss.elastic.co/t/elascticsearchclient-8-5-3-java-cannot-unblock-index-via-client/323812 "2023-01-24T20:42:05Z")
Hi, everyone! I'm trying to create a custom health check for Elasticsearch where its status is Down if an index is blocked (read-only, read-only-allow-delete, write) but I can't cover it with tests. This code doesn't wo… --- ## [\_size field (mapper size plugin)](https://discuss.elastic.co/t/size-field-mapper-size-plugin/323863)
**Author:** [@nikssssss](https://discuss.elastic.co/u/nikssssss)\ **Replies:** 0\ **Last updated:** [January 24, 2023, 6:03pm UTC](https://discuss.elastic.co/t/size-field-mapper-size-plugin/323863 "2023-01-24T18:03:15Z")
Hi all, as i understand when we enable this feature (mapper size plugin) the \_size meta field is not a new field in the index but a field on kibana index patern, correct? Because i can see the \_size field on kibana disc… --- ## [How to set a value in timestamp](https://discuss.elastic.co/t/how-to-set-a-value-in-timestamp/323762)
**Author:** [@mariana17](https://discuss.elastic.co/u/mariana17)\ **Replies:** 6\ **Last updated:** [January 24, 2023, 5:22pm UTC](https://discuss.elastic.co/t/how-to-set-a-value-in-timestamp/323762 "2023-01-24T17:22:13Z")
I have two values as my date and hour data and i want them to be my timestamp: "F-MESSAGE-CAB": "20221018","H-MESSAGE-CAB": "601006" "F-MESSAGE-CAB": "20221018","H-MESSAGE-CAB": "1338311" What i'm trying to do is putt… --- ## [Cannot deploy eck elasticsearch cluster after successful operator install](https://discuss.elastic.co/t/cannot-deploy-eck-elasticsearch-cluster-after-successful-operator-install/323861)
**Author:** [@levon.tumanyan](https://discuss.elastic.co/u/levon.tumanyan)\ **Replies:** 2\ **Last updated:** [January 24, 2023, 5:10pm UTC](https://discuss.elastic.co/t/cannot-deploy-eck-elasticsearch-cluster-after-successful-operator-install/323861 "2023-01-24T17:10:44Z")
Hi All, As mentioned I am trying to deploy eck elasticsearch through a manifest install. No helm used. It is failing on the first init container with the following message: bash: /mnt/elastic-internal/scripts/prepare-… --- ## [Logstash log](https://discuss.elastic.co/t/logstash-log/323775)
**Author:** [@kadamik](https://discuss.elastic.co/u/kadamik)\ **Replies:** 1\ **Last updated:** [January 24, 2023, 5:02pm UTC](https://discuss.elastic.co/t/logstash-log/323775 "2023-01-24T17:02:35Z")
I have having trouble getting logstash and elasticsearch setup. I have my rsyslog server sending my logs from my Unifi UDM device. I have it setup for the most-part but the problem is how logstash is trasforming the l… --- ## [Methodology for merge data nodes to big one](https://discuss.elastic.co/t/methodology-for-merge-data-nodes-to-big-one/323823)
**Author:** [@INS](https://discuss.elastic.co/u/INS)\ **Replies:** 3\ **Last updated:** [January 24, 2023, 3:52pm UTC](https://discuss.elastic.co/t/methodology-for-merge-data-nodes-to-big-one/323823 "2023-01-24T15:52:10Z")
Hi I need to change architecture of my cluster, thus I need to know Your's idea/approaches to do this. So currently my cluster consist on 3 bare metal server with sdd and hdd disk. But I need to increase memory of the… --- ## [Filebeat module ingest pipeline](https://discuss.elastic.co/t/filebeat-module-ingest-pipeline/323270)
**Author:** [@Daniel\_B](https://discuss.elastic.co/u/Daniel_B)\ **Replies:** 5\ **Last updated:** [January 24, 2023, 3:36pm UTC](https://discuss.elastic.co/t/filebeat-module-ingest-pipeline/323270 "2023-01-24T15:36:17Z")
I'm new to elastic. I'm using filebeat v8.5 and I have enabled some modules example: IIS, Checkpoint and few others which are working great. I also would like to create a new filebeat module for a specific device which … --- ## [Keep data in a rolling window of 3 months](https://discuss.elastic.co/t/keep-data-in-a-rolling-window-of-3-months/323458)
**Author:** [@Harsh0145](https://discuss.elastic.co/u/Harsh0145)\ **Replies:** 7\ **Last updated:** [January 24, 2023, 3:31pm UTC](https://discuss.elastic.co/t/keep-data-in-a-rolling-window-of-3-months/323458 "2023-01-24T15:31:31Z")
Hi, I am trying to delete or archive documents older than 3 months. Since our use case allows customers to update the data for the last 3 months, so at any moment in time, we should have the last 3 months of data. Accor… --- ## [Unable to install Fleet on 8.6.0](https://discuss.elastic.co/t/unable-to-install-fleet-on-8-6-0/323528)
**Author:** [@gyterpena](https://discuss.elastic.co/u/gyterpena)\ **Replies:** 1\ **Last updated:** [January 24, 2023, 3:19pm UTC](https://discuss.elastic.co/t/unable-to-install-fleet-on-8-6-0/323528 "2023-01-24T15:19:49Z")
Hello I'm unable to install/initiate fleet on our kibana. I get below error message Debug logs for plugin.fleet {"service":{"node":{"roles":\["background\_tasks","ui"\]}},"ecs":{"version":"8.4.0"},"@timestamp":"2023-01… --- ## [How to create file that contain tracking\_column date](https://discuss.elastic.co/t/how-to-create-file-that-contain-tracking-column-date/323846)
**Author:** [@odelacruzc](https://discuss.elastic.co/u/odelacruzc)\ **Replies:** 0\ **Last updated:** [January 24, 2023, 3:01pm UTC](https://discuss.elastic.co/t/how-to-create-file-that-contain-tracking-column-date/323846 "2023-01-24T15:01:42Z")
Hi, please your help, I have a pipeline with input JDBC so I work with tracking\_colum, I have a file .sql\_last\_value\_date with this format: --- !ruby/object:DateTime '2022-07-01 05:00:00.000000000 Z' this the date that … --- ## [\[illegal\_state\_exception\] alias \[x\] has more than one write index \[y,z\]](https://discuss.elastic.co/t/illegal-state-exception-alias-x-has-more-than-one-write-index-y-z/323843)
**Author:** [@lazaro\_mobicare](https://discuss.elastic.co/u/lazaro_mobicare)\ **Replies:** 0\ **Last updated:** [January 24, 2023, 2:34pm UTC](https://discuss.elastic.co/t/illegal-state-exception-alias-x-has-more-than-one-write-index-y-z/323843 "2023-01-24T14:34:38Z")
Hi! I'm having the following problem when trying to restore an index snapshot: \[illegal\_state\_exception\] alias \[x\] has more than one write index \[y,z\]. I followed the following resolution but I came across another proble… --- ## [MongoDB Native Connector in Enterprise Search](https://discuss.elastic.co/t/mongodb-native-connector-in-enterprise-search/322961)
**Author:** [@m.hanna](https://discuss.elastic.co/u/m.hanna)\ **Replies:** 9\ **Last updated:** [January 24, 2023, 2:23pm UTC](https://discuss.elastic.co/t/mongodb-native-connector-in-enterprise-search/322961 "2023-01-24T14:23:25Z")
I am trying to configure the MongoDB Connector in Enterprise Search to see if we can pull MongoDB collections into Elasticsearch Indices. I have Elasticsearch 8.6.0, Kibana 8.6.0, Enterprise Search 8.6.0, and MongoDB 6.0… --- ## [Mapper \[signal.ancestors.index\] cannot be changed from type \[text\] to \[keyword\]](https://discuss.elastic.co/t/mapper-signal-ancestors-index-cannot-be-changed-from-type-text-to-keyword/323331)
**Author:** [@Enrico\_Pasqualotto](https://discuss.elastic.co/u/Enrico_Pasqualotto)\ **Replies:** 8\ **Last updated:** [January 24, 2023, 2:13pm UTC](https://discuss.elastic.co/t/mapper-signal-ancestors-index-cannot-be-changed-from-type-text-to-keyword/323331 "2023-01-24T14:13:03Z")
Hello, probably after an upgrade (current ver. 7.17.6) every time we accesso to alerts/rules of Security section we got the following error: { "name": "Error", "body": { "message": "illegal\_argument\_exception: mapper… --- ## [500 error on running commands on kibana console](https://discuss.elastic.co/t/500-error-on-running-commands-on-kibana-console/323728)
**Author:** [@pranita.ch](https://discuss.elastic.co/u/pranita.ch)\ **Replies:** 8\ **Last updated:** [January 24, 2023, 2:01pm UTC](https://discuss.elastic.co/t/500-error-on-running-commands-on-kibana-console/323728 "2023-01-24T14:01:33Z")
Version Elasticsearch 7.10 Service software version R20220928-P2 (latest) on Kibana after running GET \_snapshot/my-snapshot-repo/\_all?pretty its gives 500 error { "error" : { "root\_cause" : \[ { "type" : "repositor… --- ## [Logstash, query not executing inside of the elasticsearch input plugin](https://discuss.elastic.co/t/logstash-query-not-executing-inside-of-the-elasticsearch-input-plugin/323655)
**Author:** [@mohsin106](https://discuss.elastic.co/u/mohsin106)\ **Replies:** 4\ **Last updated:** [January 24, 2023, 1:41pm UTC](https://discuss.elastic.co/t/logstash-query-not-executing-inside-of-the-elasticsearch-input-plugin/323655 "2023-01-24T13:41:08Z")
Hi, I have a logstash pipeline where I'm reading data in from Kafka and then inside of the filter plugin I have a conditional to call the elasticsearch input plugin if a certain condition is met. The condition: If ser… --- ## [Apm-kafka-plugin seems to only support binary traceparent header](https://discuss.elastic.co/t/apm-kafka-plugin-seems-to-only-support-binary-traceparent-header/323737)
**Author:** [@Henkoglobin](https://discuss.elastic.co/u/Henkoglobin)\ **Replies:** 2\ **Last updated:** [January 24, 2023, 1:08pm UTC](https://discuss.elastic.co/t/apm-kafka-plugin-seems-to-only-support-binary-traceparent-header/323737 "2023-01-24T13:08:45Z")
We're using the ElasticApmAttacher to collect data from our Java services, while most of our services are using Go. All our services communicate via Kafka messages. The java services seem to fail to extract the tracepar… --- ## [Missing Legend Entries](https://discuss.elastic.co/t/missing-legend-entries/322625)
**Author:** [@acbiccy](https://discuss.elastic.co/u/acbiccy)\ **Replies:** 3\ **Last updated:** [January 24, 2023, 12:54pm UTC](https://discuss.elastic.co/t/missing-legend-entries/322625 "2023-01-24T12:54:21Z")
Hi Everyone I have a report that has approximately 200 legend entries, however the screen only displays around 25. I have tried moving the legend position but above and below give even less entries. I have tried diffe… --- ## [Elasticserch is refusing connection from my external Java client, but accepting it when they are on the same server](https://discuss.elastic.co/t/elasticserch-is-refusing-connection-from-my-external-java-client-but-accepting-it-when-they-are-on-the-same-server/323816)
**Author:** [@m.jaafar](https://discuss.elastic.co/u/m.jaafar)\ **Replies:** 0\ **Last updated:** [January 24, 2023, 12:06pm UTC](https://discuss.elastic.co/t/elasticserch-is-refusing-connection-from-my-external-java-client-but-accepting-it-when-they-are-on-the-same-server/323816 "2023-01-24T12:06:44Z")
I have a server that I connect to through \:22226, my java client uses port 8099, while elasticsearch is installed on docker on the same server but with port 9200. I got the certificate from elasticsear… --- ## [Kibana Dashboard is not getting updated with latest data](https://discuss.elastic.co/t/kibana-dashboard-is-not-getting-updated-with-latest-data/323303)
**Author:** [@vidvar](https://discuss.elastic.co/u/vidvar)\ **Replies:** 19\ **Last updated:** [January 24, 2023, 12:38pm UTC](https://discuss.elastic.co/t/kibana-dashboard-is-not-getting-updated-with-latest-data/323303 "2023-01-24T12:38:09Z")
In our Kibana, dashboards are not getting displayed the latest data from Nov 04, 2022 and we could see below logs snippets at kibana.log. Could someone please assist what is missing here. {"type":"log","@timestamp":"20… --- ## [Get random record using must\_not](https://discuss.elastic.co/t/get-random-record-using-must-not/323786)
**Author:** [@sphawk](https://discuss.elastic.co/u/sphawk)\ **Replies:** 4\ **Last updated:** [January 24, 2023, 12:20pm UTC](https://discuss.elastic.co/t/get-random-record-using-must-not/323786 "2023-01-24T12:20:36Z")
hello again I need to get a random record excluding some values using must\_not directive. this is the query i've created using some online post. { "index": "articles", "body": { "size": 1, … --- ## [CCR replication paused indices](https://discuss.elastic.co/t/ccr-replication-paused-indices/323817)
**Author:** [@Jairam\_Gauns](https://discuss.elastic.co/u/Jairam_Gauns)\ **Replies:** 0\ **Last updated:** [January 24, 2023, 12:12pm UTC](https://discuss.elastic.co/t/ccr-replication-paused-indices/323817 "2023-01-24T12:12:05Z")
Hi Guys, I am new to this CCR setup. The CCR setup was working fine when we had fewer and smaller indices, but as of today we have many indices. Monitoring of the ccr was not done for quite sometime. We saw there were … --- ## [\[Logstash OSS\] Invalid UTF-8 start byte issue](https://discuss.elastic.co/t/logstash-oss-invalid-utf-8-start-byte-issue/323772)
**Author:** [@dstepanov25](https://discuss.elastic.co/u/dstepanov25)\ **Replies:** 7\ **Last updated:** [January 24, 2023, 11:32am UTC](https://discuss.elastic.co/t/logstash-oss-invalid-utf-8-start-byte-issue/323772 "2023-01-24T11:32:03Z")
Describe the bug It's not possible to save item with non-ASCII characters into OpenSearch To Reproduce Steps to reproduce the behavior: Run OpenSearch in a Docker container: docker run -d -p 9200:9200 -p 9600:9600… --- ## [Watcher and python client (8.6)](https://discuss.elastic.co/t/watcher-and-python-client-8-6/323811)
**Author:** [@MalfuncEddie](https://discuss.elastic.co/u/MalfuncEddie)\ **Replies:** 0\ **Last updated:** [January 24, 2023, 11:17am UTC](https://discuss.elastic.co/t/watcher-and-python-client-8-6/323811 "2023-01-24T11:17:21Z")
Hi, I was hoping someone can help me get started using the python client form elastic. Background: I just upgrades to 8.6 and e python script that reads .watches does not work anymore. results = es.search(size = 200,… --- ## [FSCrawler Rest with Elasticsearch](https://discuss.elastic.co/t/fscrawler-rest-with-elasticsearch/323803)
**Author:** [@Johnson\_F](https://discuss.elastic.co/u/Johnson_F)\ **Replies:** 4\ **Last updated:** [January 24, 2023, 11:09am UTC](https://discuss.elastic.co/t/fscrawler-rest-with-elasticsearch/323803 "2023-01-24T11:09:36Z")
Dear All, I had configured fscrawler 2.10 on ubuntu which works great, got some minor issues: - a. why touch is required? i can understand timestamp has to be new on copied or uploaded files in directory so fscrawler l… --- ## [Custom pattern in grok debugger](https://discuss.elastic.co/t/custom-pattern-in-grok-debugger/323805)
**Author:** [@ira-zaya](https://discuss.elastic.co/u/ira-zaya)\ **Replies:** 1\ **Last updated:** [January 24, 2023, 10:49am UTC](https://discuss.elastic.co/t/custom-pattern-in-grok-debugger/323805 "2023-01-24T10:49:08Z")
Hi I'm trying to set up a grok filter for custom logs, look like this: 2023-01-20 00:00:05.235+0000 \[L: DEBUG\] \[O: S.c.t.d.e.DSLScript\] \[I: \] \[U: Administrator\] \[S: \] \[P: \] \[T: TWEventProcessor-3\] @@@ Property Write Que… --- ## [Required APM-RUM agent for VueJs Apps](https://discuss.elastic.co/t/required-apm-rum-agent-for-vuejs-apps/323785)
**Author:** [@Kiran30](https://discuss.elastic.co/u/Kiran30)\ **Replies:** 2\ **Last updated:** [January 24, 2023, 10:46am UTC](https://discuss.elastic.co/t/required-apm-rum-agent-for-vuejs-apps/323785 "2023-01-24T10:46:21Z")
Currently we are using 7.17.1 version of ELK Stack Enterprise edition. I implemented APM and RUM features for .Net and Python applications. Now I want to implement RUM features for VueJs application to see "User Experi… --- ## [Cannot access to Security in Kibana due privilege ERROR](https://discuss.elastic.co/t/cannot-access-to-security-in-kibana-due-privilege-error/323804)
**Author:** [@Dor\_Steinberg](https://discuss.elastic.co/u/Dor_Steinberg)\ **Replies:** 0\ **Last updated:** [January 24, 2023, 9:40am UTC](https://discuss.elastic.co/t/cannot-access-to-security-in-kibana-due-privilege-error/323804 "2023-01-24T09:40:02Z")
when i trying to enter Security (Dashboards, Alert, Manage ...) got the message "Failed to retrieve lists privileges" i created spaces and several dashboards and now i want for Each user (spaces) to restrict viewing of… --- ## [Elasticsearch search by part of a word](https://discuss.elastic.co/t/elasticsearch-search-by-part-of-a-word/323748)
**Author:** [@maks1](https://discuss.elastic.co/u/maks1)\ **Replies:** 3\ **Last updated:** [January 24, 2023, 9:37am UTC](https://discuss.elastic.co/t/elasticsearch-search-by-part-of-a-word/323748 "2023-01-24T09:37:38Z")
Hello. Could you help me? There is an ELK cluster (version 5) and through kibana I execute a query for a part of a word using a wildcard, for example, examp\*, but nothing is found. If I search for the whole word example,… [Previous page](https://discuss.elastic.co/latest.md?page=808) [Next page](https://discuss.elastic.co/latest.md?page=810)