# Latest **URL:** https://discuss.elastic.co/latest.md?page=812 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 813 --- ## [403 on Discover Tab](https://discuss.elastic.co/t/403-on-discover-tab/323690)
**Author:** [@Akash\_Sethiya](https://discuss.elastic.co/u/Akash_Sethiya)\ **Replies:** 0\ **Last updated:** [January 22, 2023, 6:31pm UTC](https://discuss.elastic.co/t/403-on-discover-tab/323690 "2023-01-22T18:31:45Z")
Kibana version - 8.5.3 on k8s Elasticsearch version - 8.5.3 on VM On opening discover tab I keep getting Error: Batch request failed with status 403 at search\_interceptor\_SearchInterceptor.handleSearchError Look… --- ## [Remove monitoring for some specific URL in on application - Elastic APM](https://discuss.elastic.co/t/remove-monitoring-for-some-specific-url-in-on-application-elastic-apm/323685)
**Author:** [@Harhsa\_vardhan](https://discuss.elastic.co/u/Harhsa_vardhan)\ **Replies:** 1\ **Last updated:** [January 22, 2023, 4:48pm UTC](https://discuss.elastic.co/t/remove-monitoring-for-some-specific-url-in-on-application-elastic-apm/323685 "2023-01-22T16:48:33Z")
Trying to implement APM newly in one of my test cluster. My test application has some 6+ URL's which starts with same domain, I need to remove monitoring for some specific URL in on application. Is there any option to … --- ## [Use persian calendar in date\_histogram](https://discuss.elastic.co/t/use-persian-calendar-in-date-histogram/323678)
**Author:** [@masoud\_darvishi](https://discuss.elastic.co/u/masoud_darvishi)\ **Replies:** 0\ **Last updated:** [January 22, 2023, 2:08pm UTC](https://discuss.elastic.co/t/use-persian-calendar-in-date-histogram/323678 "2023-01-22T14:08:49Z")
hi i'm using date histogram with monthly interval aggregation "date\_histogram": { "field": "events.create", "calendar\_interval": "month", "format": "yyyy-MM-dd" } and this is the result { "key\_as\_… --- ## [Designing elasticsearch cluster for a SOC](https://discuss.elastic.co/t/designing-elasticsearch-cluster-for-a-soc/323647)
**Author:** [@TomSLV](https://discuss.elastic.co/u/TomSLV)\ **Replies:** 4\ **Last updated:** [January 22, 2023, 1:09pm UTC](https://discuss.elastic.co/t/designing-elasticsearch-cluster-for-a-soc/323647 "2023-01-22T13:09:13Z")
Hi everyone, I'm Tom, i'm a soc analyst since 4 years and i'm actually working for a company who want to put a SIEM. I've read many blog post on how to designing/sizing an elasticsearch cluster but i want to have your f… --- ## [Ruby Filter : difference between init option and path option in terms of performance](https://discuss.elastic.co/t/ruby-filter-difference-between-init-option-and-path-option-in-terms-of-performance/323677)
**Author:** [@mostafaelsayed](https://discuss.elastic.co/u/mostafaelsayed)\ **Replies:** 0\ **Last updated:** [January 22, 2023, 1:27pm UTC](https://discuss.elastic.co/t/ruby-filter-difference-between-init-option-and-path-option-in-terms-of-performance/323677 "2023-01-22T13:27:07Z")
Hello All, while I am reading on Ruby filter plugin, I found that the "init" option is used to execute any code at startup time. so, is there any 'performance' difference between path option and init option used like t… --- ## [Replacing @timestamp with logs having custom timestamp](https://discuss.elastic.co/t/replacing-timestamp-with-logs-having-custom-timestamp/323656)
**Author:** [@sahoo35](https://discuss.elastic.co/u/sahoo35)\ **Replies:** 7\ **Last updated:** [January 22, 2023, 10:22am UTC](https://discuss.elastic.co/t/replacing-timestamp-with-logs-having-custom-timestamp/323656 "2023-01-22T10:22:39Z")
Hello Everyone, I am newbie in ELK stack and i am still learning the logstash, kibana and its further uses . Currently i am stuck at a point where i want to extract the time stamp from my logs and replace it with @times… --- ## [Adding new fields from timestamp nvarchar(max) with grok filter in logstash](https://discuss.elastic.co/t/adding-new-fields-from-timestamp-nvarchar-max-with-grok-filter-in-logstash/323645)
**Author:** [@Dor\_Steinberg](https://discuss.elastic.co/u/Dor_Steinberg)\ **Replies:** 12\ **Last updated:** [January 22, 2023, 9:57am UTC](https://discuss.elastic.co/t/adding-new-fields-from-timestamp-nvarchar-max-with-grok-filter-in-logstash/323645 "2023-01-22T09:57:40Z")
hey everyone, i want to create 2 new fields (as month, year) from an existing timestamp field that comes from a json filter (payload) when the timestamp field type is nvarchar(max) I tried going in several directions … --- ## [Does NFS Server (remote source) exported in ELK?](https://discuss.elastic.co/t/does-nfs-server-remote-source-exported-in-elk/323667)
**Author:** [@m3bgwad](https://discuss.elastic.co/u/m3bgwad)\ **Replies:** 0\ **Last updated:** [January 22, 2023, 8:43am UTC](https://discuss.elastic.co/t/does-nfs-server-remote-source-exported-in-elk/323667 "2023-01-22T08:43:52Z")
I have a remote source (NFS server) and I want to use the file systems to visualize the row data in elastic and use the search engine (kibana). is there supporting in elastic with NFS? --- ## [Logstash unable to write records to existing elasticsearch index](https://discuss.elastic.co/t/logstash-unable-to-write-records-to-existing-elasticsearch-index/323659)
**Author:** [@learningelastic](https://discuss.elastic.co/u/learningelastic)\ **Replies:** 2\ **Last updated:** [January 21, 2023, 9:46pm UTC](https://discuss.elastic.co/t/logstash-unable-to-write-records-to-existing-elasticsearch-index/323659 "2023-01-21T21:46:13Z")
I can successfully get logstash to write records to an elasticsearch index if the index doesn't exist in the first place. But I can't seem to get logstash to write records to an index if it already exists. For example,… --- ## [Add\_kubernetes\_metadata processor does not seem to work. Filebeat Data indexed to Elastic does not have any fields relevant to kubernetes](https://discuss.elastic.co/t/add-kubernetes-metadata-processor-does-not-seem-to-work-filebeat-data-indexed-to-elastic-does-not-have-any-fields-relevant-to-kubernetes/323596)
**Author:** [@sunil\_s](https://discuss.elastic.co/u/sunil_s)\ **Replies:** 2\ **Last updated:** [January 21, 2023, 9:10pm UTC](https://discuss.elastic.co/t/add-kubernetes-metadata-processor-does-not-seem-to-work-filebeat-data-indexed-to-elastic-does-not-have-any-fields-relevant-to-kubernetes/323596 "2023-01-21T21:10:29Z")
PFB filebeat.yaml filebeat.inputs: - type: container paths: - '/var/log/containers/\*.log' processors: - add\_kubernetes\_metadata: host: ${NODE\_NAME} matchers: - logs\_path: … --- ## [ELK Active Active Setup with Failure Recovery](https://discuss.elastic.co/t/elk-active-active-setup-with-failure-recovery/323621)
**Author:** [@mostafaelsayed](https://discuss.elastic.co/u/mostafaelsayed)\ **Replies:** 2\ **Last updated:** [January 21, 2023, 6:34pm UTC](https://discuss.elastic.co/t/elk-active-active-setup-with-failure-recovery/323621 "2023-01-21T18:34:31Z")
Hello All The use case is that we want to setup Active Active architecture in ELK using two clusters in two different regions. We will index the event to both the local elasticsearch cluster and remote elasticsearch clu… --- ## [Unassigned missng shards after node failure](https://discuss.elastic.co/t/unassigned-missng-shards-after-node-failure/323649)
**Author:** [@EthanJ1999](https://discuss.elastic.co/u/EthanJ1999)\ **Replies:** 0\ **Last updated:** [January 21, 2023, 1:59pm UTC](https://discuss.elastic.co/t/unassigned-missng-shards-after-node-failure/323649 "2023-01-21T13:59:43Z")
Hi how's going every body. the proble is one of the shards of an specific index on a cluster is unassigned. the problem occures when a cluster node left, after rejoining to the cluster the shard reamain unassigned so we … --- ## [Divide two counts of the same index with different filters](https://discuss.elastic.co/t/divide-two-counts-of-the-same-index-with-different-filters/323631)
**Author:** [@TheFish](https://discuss.elastic.co/u/TheFish)\ **Replies:** 3\ **Last updated:** [January 21, 2023, 12:00pm UTC](https://discuss.elastic.co/t/divide-two-counts-of-the-same-index-with-different-filters/323631 "2023-01-21T12:00:32Z")
Hi, I'm trying to divide two counts in TSVB, and I've read the related answer at Divides two sum fields in kibana? but I have a twist, and I can't get it to work: I have one index with "death" events in a game. Each eve… --- ## [Segment size/ merge policy for large indices](https://discuss.elastic.co/t/segment-size-merge-policy-for-large-indices/323623)
**Author:** [@GregoryJC](https://discuss.elastic.co/u/GregoryJC)\ **Replies:** 7\ **Last updated:** [January 21, 2023, 6:44am UTC](https://discuss.elastic.co/t/segment-size-merge-policy-for-large-indices/323623 "2023-01-21T06:44:19Z")
I am new to Elastic, I started learning about it in depth a month ago as I moved into a position to take over the more or less unmanaged cloud install we had. We have quite a few indices with segment counts ranging from… --- ## [Elasticsearch search response time / latency metrics](https://discuss.elastic.co/t/elasticsearch-search-response-time-latency-metrics/323613)
**Author:** [@jaykb77](https://discuss.elastic.co/u/jaykb77)\ **Replies:** 1\ **Last updated:** [January 20, 2023, 9:55pm UTC](https://discuss.elastic.co/t/elasticsearch-search-response-time-latency-metrics/323613 "2023-01-20T21:55:33Z")
We are trying to use elasticsearch-exporter (GitHub - prometheus-community/elasticsearch\_exporter: Elasticsearch stats exporter for Prometheus) for monitoring our clusters(v7.17) and we want to monitor the cluster perfor… --- ## [151209 (4) - OpenJDK 7 \<= 7u281 / 8 \<= 8u272 / 11.0.0 \<= 11.0.9 / 13.0.0 \<= 13.0.5 / 15.0.0 \<= 15.0.1 Vulnerability (2021-01-19)](https://discuss.elastic.co/t/151209-4-openjdk-7-7u281-8-8u272-11-0-0-11-0-9-13-0-0-13-0-5-15-0-0-15-0-1-vulnerability-2021-01-19/323620)
**Author:** [@khadija70](https://discuss.elastic.co/u/khadija70)\ **Replies:** 7\ **Last updated:** [January 20, 2023, 10:04pm UTC](https://discuss.elastic.co/t/151209-4-openjdk-7-7u281-8-8u272-11-0-0-11-0-9-13-0-0-13-0-5-15-0-0-15-0-1-vulnerability-2021-01-19/323620 "2023-01-20T22:04:22Z")
Hi , We have receive vulnerabilities affecting elasticksearch servers : 151209 (4) - OpenJDK 7 \<= 7u281 / 8 \<= 8u272 / 11.0.0 \<= 11.0.9 / 13.0.0 \<= 13.0.5 / 15.0.0 \<= 15.0.1 Vulnerability (2021-01-19) The solution pr… --- ## [Java.io.tmpdir](https://discuss.elastic.co/t/java-io-tmpdir/323534)
**Author:** [@chuck1](https://discuss.elastic.co/u/chuck1)\ **Replies:** 10\ **Last updated:** [January 20, 2023, 9:35pm UTC](https://discuss.elastic.co/t/java-io-tmpdir/323534 "2023-01-20T21:35:27Z")
Hello, My elasticsearch version is 8.5.3-1 I have a hardened RHEL 8 system which requires that /tmp be mounted with the "noexec" option. I have tried to adjust my jvm.options file in /etc/elasticsearch/jvm.options to s… --- ## [SANITIZE FIELD NAMES in body when contain sensitive values](https://discuss.elastic.co/t/sanitize-field-names-in-body-when-contain-sensitive-values/323626)
**Author:** [@Jose\_Antonio\_Pinto\_d](https://discuss.elastic.co/u/Jose_Antonio_Pinto_d)\ **Replies:** 0\ **Last updated:** [January 20, 2023, 7:29pm UTC](https://discuss.elastic.co/t/sanitize-field-names-in-body-when-contain-sensitive-values/323626 "2023-01-20T19:29:47Z")
I'm trying to sanitize sensitive fields in body, but I can't do this. It's not work to me. func NewGorillaMux() Http { router := mux.NewRouter().PathPrefix("/").Subrouter() router.Use(middleware.NewCorsMiddleware("\*")… --- ## [Loading large table from Mysql to ES via Logstash](https://discuss.elastic.co/t/loading-large-table-from-mysql-to-es-via-logstash/323442)
**Author:** [@Het\_Desai](https://discuss.elastic.co/u/Het_Desai)\ **Replies:** 7\ **Last updated:** [January 20, 2023, 7:07pm UTC](https://discuss.elastic.co/t/loading-large-table-from-mysql-to-es-via-logstash/323442 "2023-01-20T19:07:53Z")
Hello, I have multiple large tables (each table contains ~15M records and consumes ~70GB of data). My logstash configuration is as given below. input { jdbc { jdbc\_connection\_string =\> "jdbc:mysql:… --- ## [VSS errors with endpoint](https://discuss.elastic.co/t/vss-errors-with-endpoint/323533)
**Author:** [@yak990](https://discuss.elastic.co/u/yak990)\ **Replies:** 2\ **Last updated:** [January 20, 2023, 6:55pm UTC](https://discuss.elastic.co/t/vss-errors-with-endpoint/323533 "2023-01-20T18:55:18Z")
I get the error below in my application event log several times a minute at times if the endpoint features are enabled. It's a conflict with macrium reflect. To reproduce: Install free trial of macrium: Macrium Softwa… --- ## [Apache Log4j 2.0 \< 2.3.2 / 2.4 \< 2.12.4 / 2.13 \< 2.17.1 RCE](https://discuss.elastic.co/t/apache-log4j-2-0-2-3-2-2-4-2-12-4-2-13-2-17-1-rce/323614)
**Author:** [@khadija70](https://discuss.elastic.co/u/khadija70)\ **Replies:** 6\ **Last updated:** [January 20, 2023, 6:51pm UTC](https://discuss.elastic.co/t/apache-log4j-2-0-2-3-2-2-4-2-12-4-2-13-2-17-1-rce/323614 "2023-01-20T18:51:19Z")
Hi , We have recently receive security vulnerabilities related to Log4j , as solution proposed is to Upgrade to Apache Log4j version 2.17.1, 2.12.4, or 2.3.2 or later. Could you please confirm if there is a patch to … --- ## [How to sum fieds of collapsed results?](https://discuss.elastic.co/t/how-to-sum-fieds-of-collapsed-results/323617)
**Author:** [@denise.castagna](https://discuss.elastic.co/u/denise.castagna)\ **Replies:** 0\ **Last updated:** [January 20, 2023, 5:04pm UTC](https://discuss.elastic.co/t/how-to-sum-fieds-of-collapsed-results/323617 "2023-01-20T17:04:54Z")
Hi, I need to do a sum aggregation on a collapsed result. I know that collapse does not effect on aggregation but there are other ways? For example: Field1 = A, Field2 = 50, Order = 1 Field1 = A, Field2 = 30, Order =… --- ## [Calculations inside ES Query](https://discuss.elastic.co/t/calculations-inside-es-query/323610)
**Author:** [@bpax51](https://discuss.elastic.co/u/bpax51)\ **Replies:** 1\ **Last updated:** [January 20, 2023, 4:43pm UTC](https://discuss.elastic.co/t/calculations-inside-es-query/323610 "2023-01-20T16:43:07Z")
So I have to following query that gives me to count of successful and failed http queries using aggregations. { "size": 0, "query": { "bool": { "filter": \[ { … --- ## [Clean old indexes automatically in elasticsearch](https://discuss.elastic.co/t/clean-old-indexes-automatically-in-elasticsearch/323551)
**Author:** [@Joao\_Malebo](https://discuss.elastic.co/u/Joao_Malebo)\ **Replies:** 5\ **Last updated:** [January 20, 2023, 4:38pm UTC](https://discuss.elastic.co/t/clean-old-indexes-automatically-in-elasticsearch/323551 "2023-01-20T16:38:05Z")
Hello friends, I'm having problems with the storage where elasticsearch is installed... I'm constantly having a full disk. What can I do to delete or clean up old indexes? --- ## [Kibana - Metric Threshold Alert - {{context.group}}](https://discuss.elastic.co/t/kibana-metric-threshold-alert-context-group/323544)
**Author:** [@TXBigDawg1836](https://discuss.elastic.co/u/TXBigDawg1836)\ **Replies:** 1\ **Last updated:** [January 20, 2023, 3:50pm UTC](https://discuss.elastic.co/t/kibana-metric-threshold-alert-context-group/323544 "2023-01-20T15:50:54Z")
Have configured a Metric Threshold Alert using a field within the results called "Provider-City" in the Group Alerts By. In the message body we have a key/value pair "Provider-City": "{{context.group}}" which is worki… --- ## [Install Metricbeat on Kubernetes Cluster ( Azure)](https://discuss.elastic.co/t/install-metricbeat-on-kubernetes-cluster-azure/323328)
**Author:** [@Swathi12](https://discuss.elastic.co/u/Swathi12)\ **Replies:** 5\ **Last updated:** [January 20, 2023, 3:30pm UTC](https://discuss.elastic.co/t/install-metricbeat-on-kubernetes-cluster-azure/323328 "2023-01-20T15:30:27Z")
Hi team, i am trying for several weeks to install metricbeat on kubernetes cluster (azure) and i following these instructions: Run Metricbeat on Kubernetes | Metricbeat Reference \[8.6\] | Elastic i edited the metricbea… --- ## [Elastic cluster is getting overloaded by incorrect shard allocation](https://discuss.elastic.co/t/elastic-cluster-is-getting-overloaded-by-incorrect-shard-allocation/323595)
**Author:** [@Petr.Simik](https://discuss.elastic.co/u/Petr.Simik)\ **Replies:** 2\ **Last updated:** [January 20, 2023, 2:12pm UTC](https://discuss.elastic.co/t/elastic-cluster-is-getting-overloaded-by-incorrect-shard-allocation/323595 "2023-01-20T14:12:55Z")
Hi Community, May I ask for help: We have elastic v7.17.0 with 43 nodes. Sizing 2TB SSD, 8cores, 32GB RAM, 16GB Heap. Currently about 2400 indices and 6400shards. some nodes have less shards but have disk full which … --- ## [Click Launch APM failed](https://discuss.elastic.co/t/click-launch-apm-failed/323599)
**Author:** [@gaetano](https://discuss.elastic.co/u/gaetano)\ **Replies:** 0\ **Last updated:** [January 20, 2023, 2:08pm UTC](https://discuss.elastic.co/t/click-launch-apm-failed/323599 "2023-01-20T14:08:07Z")
Kibana 8.5.2: Elasticsearch 8.5.2: APM Server 8.6.0: APM Agent 5.x @elastic/apm-rum-angular: After checked successfully APM Server and APM agent status, and clicked on Launch APM button in Observability/APM page. … --- ## [Using LDAP to set up Users and Roles in elasticsearch.yml file](https://discuss.elastic.co/t/using-ldap-to-set-up-users-and-roles-in-elasticsearch-yml-file/323440)
**Author:** [@sswilley88](https://discuss.elastic.co/u/sswilley88)\ **Replies:** 15\ **Last updated:** [January 20, 2023, 2:06pm UTC](https://discuss.elastic.co/t/using-ldap-to-set-up-users-and-roles-in-elasticsearch-yml-file/323440 "2023-01-20T14:06:44Z")
I am trying to set up user/role details in the elasticsearch.yaml file with LDAP settings, and need some support. I have followed elastic documentation, but it’s not working. I have added below details (with our own deta… --- ## [I am getting below error while setting elastic search](https://discuss.elastic.co/t/i-am-getting-below-error-while-setting-elastic-search/323019)
**Author:** [@devdev7711](https://discuss.elastic.co/u/devdev7711)\ **Replies:** 9\ **Last updated:** [January 20, 2023, 1:50pm UTC](https://discuss.elastic.co/t/i-am-getting-below-error-while-setting-elastic-search/323019 "2023-01-20T13:50:20Z")
I am installing 8.5.3 elastic. after yml file change I am double clicking elasticsearch.bat file and service is not starting looks like. \[2023-01-12T14:38:25,268\]\[INFO \]\[o.e.n.Node \] \[node-1\] node name \[… [Previous page](https://discuss.elastic.co/latest.md?page=811) [Next page](https://discuss.elastic.co/latest.md?page=813)