# Latest **URL:** https://discuss.elastic.co/latest.md?page=860 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 861 --- ## [Logstash JDBC plugin maintain state in database instead of file](https://discuss.elastic.co/t/logstash-jdbc-plugin-maintain-state-in-database-instead-of-file/321106)
**Author:** [@Thijsvdp](https://discuss.elastic.co/u/Thijsvdp)\ **Replies:** 0\ **Last updated:** [December 13, 2022, 9:50am UTC](https://discuss.elastic.co/t/logstash-jdbc-plugin-maintain-state-in-database-instead-of-file/321106 "2022-12-13T09:50:40Z")
Hi all, I am wondering if it would be possible to maintain the sql\_last\_value in a database instead of a .yml file? This would be beneficial in my case, because it is easier accessible for modification and initializatio… --- ## [Filebeat duplicate logs](https://discuss.elastic.co/t/filebeat-duplicate-logs/321032)
**Author:** [@m3bgwad](https://discuss.elastic.co/u/m3bgwad)\ **Replies:** 7\ **Last updated:** [December 13, 2022, 8:46am UTC](https://discuss.elastic.co/t/filebeat-duplicate-logs/321032 "2022-12-13T08:46:57Z")
Hello everyone, for prevent the duplication data that can be received from Filebeat I used this Logstash filtration fingerprint { source =\> "message" target =\> "\[@metadata\]\[fingerprint\]" method =\> "SHA1" key =\> "ke… --- ## [Mail command failed: 530 5.7.57 Client not authenticated to send mail. \[CH2PR15CA0025.namprd15.prod.outlook.com\]](https://discuss.elastic.co/t/mail-command-failed-530-5-7-57-client-not-authenticated-to-send-mail-ch2pr15ca0025-namprd15-prod-outlook-com/318938)
**Author:** [@breakingcode](https://discuss.elastic.co/u/breakingcode)\ **Replies:** 0\ **Last updated:** [November 15, 2022, 8:36am UTC](https://discuss.elastic.co/t/mail-command-failed-530-5-7-57-client-not-authenticated-to-send-mail-ch2pr15ca0025-namprd15-prod-outlook-com/318938 "2022-11-15T08:36:42Z")
Hii, I am trying to setup alerting in Kibana. I started elastic cloud instance with GCP as provider, with version 8.4.3 of stack. When I run test connector configuration I am getting below error I am doing this setu… --- ## [Logstash escaping characters, want to disable](https://discuss.elastic.co/t/logstash-escaping-characters-want-to-disable/318984)
**Author:** [@Johanna12221](https://discuss.elastic.co/u/Johanna12221)\ **Replies:** 2\ **Last updated:** [December 13, 2022, 7:51am UTC](https://discuss.elastic.co/t/logstash-escaping-characters-want-to-disable/318984 "2022-12-13T07:51:32Z")
Hi! I'm having a problem with how Logstash with JDBC input escapes characters. When I run the SQL query in SSMS I get the result fine: "\\publicerat\\IN0022.pdf" The JDBC input looks like this: input { jdbc { … --- ## [Installation on ubantu](https://discuss.elastic.co/t/installation-on-ubantu/316961)
**Author:** [@smitak](https://discuss.elastic.co/u/smitak)\ **Replies:** 15\ **Last updated:** [December 13, 2022, 7:30am UTC](https://discuss.elastic.co/t/installation-on-ubantu/316961 "2022-12-13T07:30:02Z")
Hello Sir, I have done the search functionality with fscrawler on local server. It is working good. Now I am uploading on ubantu server. Elastic search is active. But for fscralwer getting error for file content. Elast… --- ## [Kibana status yellow and taskmanager is unhealth](https://discuss.elastic.co/t/kibana-status-yellow-and-taskmanager-is-unhealth/321092)
**Author:** [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Replies:** 2\ **Last updated:** [December 13, 2022, 7:16am UTC](https://discuss.elastic.co/t/kibana-status-yellow-and-taskmanager-is-unhealth/321092 "2022-12-13T07:16:30Z")
Hi all I have 1 kibana instance running for a elastic cluster. For sometime i have notice that my kibana always from green to yellow in the monitor tab so when i check the status of kibana it said that the taskManager … --- ## [Elastic cloud APM server time based index template](https://discuss.elastic.co/t/elastic-cloud-apm-server-time-based-index-template/321076)
**Author:** [@Ali\_Nazemian](https://discuss.elastic.co/u/Ali_Nazemian)\ **Replies:** 6\ **Last updated:** [December 13, 2022, 6:55am UTC](https://discuss.elastic.co/t/elastic-cloud-apm-server-time-based-index-template/321076 "2022-12-13T06:55:18Z")
I am running an Elastic cluster 7.17.x on Elastic cloud. I would like to switch to a time-based index template for my APM setup and cannot figure out how to do it. I am looking for a way to include a date in the index na… --- ## [Unable to retrieve version information from elasticsearch nodes](https://discuss.elastic.co/t/unable-to-retrieve-version-information-from-elasticsearch-nodes/321072)
**Author:** [@Eduard\_Abril](https://discuss.elastic.co/u/Eduard_Abril)\ **Replies:** 1\ **Last updated:** [December 13, 2022, 5:43am UTC](https://discuss.elastic.co/t/unable-to-retrieve-version-information-from-elasticsearch-nodes/321072 "2022-12-13T05:43:49Z")
Hi guys, I'm using elasticsearch and kibana 7.17.6 and currently I'm facing some problems with the security settings. I'm trying to setup basic security for a 3 nodes elasticsearch cluster and 1 node kibana using certi… --- ## [How to split a message from rabbit?](https://discuss.elastic.co/t/how-to-split-a-message-from-rabbit/321067)
**Author:** [@TheZadok42](https://discuss.elastic.co/u/TheZadok42)\ **Replies:** 4\ **Last updated:** [December 13, 2022, 5:31am UTC](https://discuss.elastic.co/t/how-to-split-a-message-from-rabbit/321067 "2022-12-13T05:31:56Z")
Hi! I am trying to split this message: {"test": "Test"} {"test": "Test2"} into two messages using this simple config: input { rabbitmq { … --- ## [Track and show transactions progress based on codes](https://discuss.elastic.co/t/track-and-show-transactions-progress-based-on-codes/318867)
**Author:** [@Murali\_Y](https://discuss.elastic.co/u/Murali_Y)\ **Replies:** 3\ **Last updated:** [November 15, 2022, 3:26am UTC](https://discuss.elastic.co/t/track-and-show-transactions-progress-based-on-codes/318867 "2022-11-15T03:26:28Z")
Hello, We are writing our business flow related transactions start and end state using different state codes i.e. When we pick the transaction it will logged with code 10001 (in progress) and end of it will be logged wi… --- ## [Kubernetes Elasticsearch 8.5.3 Statefulset (not ECK) set up username / password](https://discuss.elastic.co/t/kubernetes-elasticsearch-8-5-3-statefulset-not-eck-set-up-username-password/321081)
**Author:** [@khteh](https://discuss.elastic.co/u/khteh)\ **Replies:** 0\ **Last updated:** [December 13, 2022, 2:54am UTC](https://discuss.elastic.co/t/kubernetes-elasticsearch-8-5-3-statefulset-not-eck-set-up-username-password/321081 "2022-12-13T02:54:22Z")
How to automatically setup the password of the default user elastic and add other username/password for Elasticsearch 8.5.3 running on kubernetes cluster with manifests? I am not using ECK. Setting environment variable E… --- ## [Open Cybersecurity Schema Framework](https://discuss.elastic.co/t/open-cybersecurity-schema-framework/320290)
**Author:** [@grandmasterv](https://discuss.elastic.co/u/grandmasterv)\ **Replies:** 2\ **Last updated:** [December 13, 2022, 2:41am UTC](https://discuss.elastic.co/t/open-cybersecurity-schema-framework/320290 "2022-12-13T02:41:45Z")
Hello Elastic Community, With the release of the Open Cybersecurity Schema Framework, I was wondering is there was any discussion happening on aligning the Elastic Common Schema with it? The goals of the OCSF seem simi… --- ## [Logstash GeoIP Database Manager: PKIX path building failed, \_geoip\_expired\_database tag](https://discuss.elastic.co/t/logstash-geoip-database-manager-pkix-path-building-failed-geoip-expired-database-tag/321073)
**Author:** [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Replies:** 2\ **Last updated:** [December 12, 2022, 11:31pm UTC](https://discuss.elastic.co/t/logstash-geoip-database-manager-pkix-path-building-failed-geoip-expired-database-tag/321073 "2022-12-12T23:31:24Z")
Hello, I started to get this error on a couple of Logstash nodes. \[2022-12-12T20:10:23,983\]\[ERROR\]\[logstash.filters.geoip.databasemanager\] PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderExc… --- ## [Kibana Dashboard syslog ECS](https://discuss.elastic.co/t/kibana-dashboard-syslog-ecs/318911)
**Author:** [@sharbich](https://discuss.elastic.co/u/sharbich)\ **Replies:** 0\ **Last updated:** [November 14, 2022, 11:54pm UTC](https://discuss.elastic.co/t/kibana-dashboard-syslog-ecs/318911 "2022-11-14T23:54:59Z")
Hello, I get the following message in my Kibana Dashboard. "1 of 2 shards failed. The data you are seeing might be incomplete or wrong." The message disappears after 30 seconds and only comes back when i refresh the D… --- ## [Distributed Tracing Feature for nested Iframes](https://discuss.elastic.co/t/distributed-tracing-feature-for-nested-iframes/321040)
**Author:** [@Bjarke\_Jensen](https://discuss.elastic.co/u/Bjarke_Jensen)\ **Replies:** 1\ **Last updated:** [December 12, 2022, 7:31pm UTC](https://discuss.elastic.co/t/distributed-tracing-feature-for-nested-iframes/321040 "2022-12-12T19:31:42Z")
Hello. I'm owrking on setting up an APM RUM agent for a old-style website where you have iframes within iframes within iframes. I want to be able to see a collected trace timeline for the entire hierarchy of iframes. I … --- ## [Does Cloud Workload Protection requires license?](https://discuss.elastic.co/t/does-cloud-workload-protection-requires-license/320799)
**Author:** [@German\_Bravo](https://discuss.elastic.co/u/German_Bravo)\ **Replies:** 3\ **Last updated:** [December 12, 2022, 6:54pm UTC](https://discuss.elastic.co/t/does-cloud-workload-protection-requires-license/320799 "2022-12-12T18:54:16Z")
Hello, I just updated to v8.x from 7.x, and Im curious about Cloud Workload Protection. I saw that it is necessary to have a license for CIS benchmarking Kubernetes (findings section in Elastic Security), but for protec… --- ## [Read from Logstash file and format](https://discuss.elastic.co/t/read-from-logstash-file-and-format/320970)
**Author:** [@mail2shanth](https://discuss.elastic.co/u/mail2shanth)\ **Replies:** 1\ **Last updated:** [December 12, 2022, 6:22pm UTC](https://discuss.elastic.co/t/read-from-logstash-file-and-format/320970 "2022-12-12T18:22:35Z")
Hi, I am new to the Logstash. I've below log that I want to read in from a file, it is basically from another logstash server. Below is just one row from the file, there are millions of such rows. {"@timestamp":"2022-… --- ## [Disable auto refresh for Monitoring dashboards](https://discuss.elastic.co/t/disable-auto-refresh-for-monitoring-dashboards/320965)
**Author:** [@Animesh\_Agarwal](https://discuss.elastic.co/u/Animesh_Agarwal)\ **Replies:** 1\ **Last updated:** [December 12, 2022, 6:08pm UTC](https://discuss.elastic.co/t/disable-auto-refresh-for-monitoring-dashboards/320965 "2022-12-12T18:08:38Z")
Hi By default the refresh interval is 10s for monitoring dashboards in Kibana. Even though I can disable auto refresh, but if we load the page again, it gets reverted to 10s. How can we set the auto refresh to off per… --- ## [Enrollment Token deletion](https://discuss.elastic.co/t/enrollment-token-deletion/320335)
**Author:** [@FabianEidner](https://discuss.elastic.co/u/FabianEidner)\ **Replies:** 10\ **Last updated:** [December 12, 2022, 5:57pm UTC](https://discuss.elastic.co/t/enrollment-token-deletion/320335 "2022-12-12T17:57:24Z")
Hello, im struggle to delete old enrollment tokens under: Kibana -\> Fleet -\> Enrollment Tokens Neither in the ui nor via the api i'm able to delete them. In the ui they just are flagged as inactive and via the api "ap… --- ## [Can replicas serve kNN search requests?](https://discuss.elastic.co/t/can-replicas-serve-knn-search-requests/321059)
**Author:** [@robertdebug](https://discuss.elastic.co/u/robertdebug)\ **Replies:** 1\ **Last updated:** [December 12, 2022, 5:37pm UTC](https://discuss.elastic.co/t/can-replicas-serve-knn-search-requests/321059 "2022-12-12T17:37:32Z")
Hello, I have a question about kNN search and index replicas. According to the documentation, replicas can increase capacity to serve read requests like searching or retrieving a document. Does this also applies for ap… --- ## [Automating Connectors via Saved Object API](https://discuss.elastic.co/t/automating-connectors-via-saved-object-api/320896)
**Author:** [@Hayden\_WB](https://discuss.elastic.co/u/Hayden_WB)\ **Replies:** 2\ **Last updated:** [December 12, 2022, 5:32pm UTC](https://discuss.elastic.co/t/automating-connectors-via-saved-object-api/320896 "2022-12-12T17:32:10Z")
Hi folks! I'm attempting to automate Dashboards and Alerts for a team within my company. This involves creating a MS Teams Connector. I have written a bash script that posts the Connector NDJSON to the Saved Objects end… --- ## [Manually backup data from frozer tier](https://discuss.elastic.co/t/manually-backup-data-from-frozer-tier/320730)
**Author:** [@dimitris\_sb](https://discuss.elastic.co/u/dimitris_sb)\ **Replies:** 2\ **Last updated:** [December 12, 2022, 5:06pm UTC](https://discuss.elastic.co/t/manually-backup-data-from-frozer-tier/320730 "2022-12-12T17:06:44Z")
Hi All, What would be the correct way to make an independent backup (snapshot) of data in the frozen tier? If I take a snapshot of these indices, will the backup be usable as indices from hot/warm/cold tier or it will a… --- ## [Some stack management tabs missing in kibana after upgrading from 7.6.2 to 7.17.3](https://discuss.elastic.co/t/some-stack-management-tabs-missing-in-kibana-after-upgrading-from-7-6-2-to-7-17-3/316928)
**Author:** [@danksim](https://discuss.elastic.co/u/danksim)\ **Replies:** 0\ **Last updated:** [October 18, 2022, 6:16pm UTC](https://discuss.elastic.co/t/some-stack-management-tabs-missing-in-kibana-after-upgrading-from-7-6-2-to-7-17-3/316928 "2022-10-18T18:16:15Z")
some stack management tabs went missing in elasticsearch/kibana after upgrading from 7.6.2 to 7.17.3 missing ones like index management policies, security, index managment, etc. running the basic version and not the … --- ## [Using Grok filter](https://discuss.elastic.co/t/using-grok-filter/321051)
**Author:** [@Groove](https://discuss.elastic.co/u/Groove)\ **Replies:** 0\ **Last updated:** [December 12, 2022, 3:31pm UTC](https://discuss.elastic.co/t/using-grok-filter/321051 "2022-12-12T15:31:40Z")
Hello, I am pretty new to ELK stack. Currently I am trying to parse my application log using grok pattern. But since my logs are not structured I may have to use grok conditions, because in output I have windows event an… --- ## [How to send number of shard , activeshard, reallocationg shard every day via watcher](https://discuss.elastic.co/t/how-to-send-number-of-shard-activeshard-reallocationg-shard-every-day-via-watcher/318180)
**Author:** [@mangeshmj1992](https://discuss.elastic.co/u/mangeshmj1992)\ **Replies:** 2\ **Last updated:** [December 12, 2022, 11:04am UTC](https://discuss.elastic.co/t/how-to-send-number-of-shard-activeshard-reallocationg-shard-every-day-via-watcher/318180 "2022-12-12T11:04:17Z")
Hello team, I need to send email every day with below status. can i know how i can achieve this using watcher. Kibana Health check for \*\*Todays Date\*\* is \*\*Green / Red /Yellow\*\*. PFA for detail log ingestion and clust… --- ## [Add multiple https API in watcher](https://discuss.elastic.co/t/add-multiple-https-api-in-watcher/321033)
**Author:** [@mangeshmj1992](https://discuss.elastic.co/u/mangeshmj1992)\ **Replies:** 2\ **Last updated:** [December 12, 2022, 3:03pm UTC](https://discuss.elastic.co/t/add-multiple-https-api-in-watcher/321033 "2022-12-12T15:03:43Z")
Hi team, I am able to send cluster health data using GET \_cluster/health using below input and condition. Now in input section I want to use other two more APIs: GET /\_cat/allocation?v=true&s=node GET \_cat/nodes?v=tru… --- ## [Elastic Endpoint respond not working](https://discuss.elastic.co/t/elastic-endpoint-respond-not-working/320966)
**Author:** [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Replies:** 1\ **Last updated:** [December 12, 2022, 2:54pm UTC](https://discuss.elastic.co/t/elastic-endpoint-respond-not-working/320966 "2022-12-12T14:54:38Z")
Hi all I'm trying the elastic endpoint security and i see that there is a respond option for the endpoint. But mine got greyout and it said my current version of the Agent is not supported and i need to upgrade the ver… --- ## [Using transform with enrich pipeline to enrich ip with latest vulnerabilities](https://discuss.elastic.co/t/using-transform-with-enrich-pipeline-to-enrich-ip-with-latest-vulnerabilities/320553)
**Author:** [@siginigin](https://discuss.elastic.co/u/siginigin)\ **Replies:** 6\ **Last updated:** [December 12, 2022, 2:51pm UTC](https://discuss.elastic.co/t/using-transform-with-enrich-pipeline-to-enrich-ip-with-latest-vulnerabilities/320553 "2022-12-12T14:51:05Z")
Hi, I want to enrich incoming event that contains local source.ip/destination.ip with vulnerability field with this logic: match source.ip with server.ip, get highest vulnerability.severity\_num from latest vulnerabilit… --- ## [Ctx.payload variable to be used to send nodes and allocation API details](https://discuss.elastic.co/t/ctx-payload-variable-to-be-used-to-send-nodes-and-allocation-api-details/321041)
**Author:** [@mangeshmj1992](https://discuss.elastic.co/u/mangeshmj1992)\ **Replies:** 0\ **Last updated:** [December 12, 2022, 2:29pm UTC](https://discuss.elastic.co/t/ctx-payload-variable-to-be-used-to-send-nodes-and-allocation-api-details/321041 "2022-12-12T14:29:47Z")
Hello team, I need to send output of below two API in one email . Unable to find which variable used to send below data for below API. Can you please help me with this. GET \_cat/nodes?v=true&s=name : ip he… --- ## [Audit log time based deletion policy not working](https://discuss.elastic.co/t/audit-log-time-based-deletion-policy-not-working/321022)
**Author:** [@irivas95](https://discuss.elastic.co/u/irivas95)\ **Replies:** 3\ **Last updated:** [December 12, 2022, 12:59pm UTC](https://discuss.elastic.co/t/audit-log-time-based-deletion-policy-not-working/321022 "2022-12-12T12:59:00Z")
Hi, I have the following policy for deleting audit logs older than 7 days in my log4j2.properties config file: appender.audit\_rolling.type = RollingFile appender.audit\_rolling.name = audit\_rolling appender.audit\_rollin… [Previous page](https://discuss.elastic.co/latest.md?page=859) [Next page](https://discuss.elastic.co/latest.md?page=861)