# Latest **URL:** https://discuss.elastic.co/latest.md?page=867 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 868 --- ## [Re-installing elasticsearch](https://discuss.elastic.co/t/re-installing-elasticsearch/320602)
**Author:** [@ericmalta](https://discuss.elastic.co/u/ericmalta)\ **Replies:** 4\ **Last updated:** [December 7, 2022, 9:20pm UTC](https://discuss.elastic.co/t/re-installing-elasticsearch/320602 "2022-12-07T21:20:32Z")
Hello team I have a quick question. If I re-install my elasticsearch cluster via apt like this: sudo apt install --reinstall -o Dpkg::Options::="--force-confask,confnew,confmiss" elasticsearch Will I lose my cluster da… --- ## [USB Detection Using Elastic-agent or some other beat](https://discuss.elastic.co/t/usb-detection-using-elastic-agent-or-some-other-beat/320710)
**Author:** [@Mohsin\_Ashraf](https://discuss.elastic.co/u/Mohsin_Ashraf)\ **Replies:** 0\ **Last updated:** [December 7, 2022, 6:25pm UTC](https://discuss.elastic.co/t/usb-detection-using-elastic-agent-or-some-other-beat/320710 "2022-12-07T18:25:57Z")
Hi, Can we detect USB when it plugs into the system on windows or Linux using elastic-agent or some other beats? --- ## [Cannot give custom plugin permission org.elasticsearch.secure\_sm.ThreadPermission "modifyArbitraryThreadGroup"](https://discuss.elastic.co/t/cannot-give-custom-plugin-permission-org-elasticsearch-secure-sm-threadpermission-modifyarbitrarythreadgroup/320720)
**Author:** [@smillies](https://discuss.elastic.co/u/smillies)\ **Replies:** 0\ **Last updated:** [December 7, 2022, 8:40pm UTC](https://discuss.elastic.co/t/cannot-give-custom-plugin-permission-org-elasticsearch-secure-sm-threadpermission-modifyarbitrarythreadgroup/320720 "2022-12-07T20:40:26Z")
I have written a custom plugin that includes some third-party jars that do magic stuff requiring certain permissions. So I have added them to my plugin-security.policy like this grant { permission java.lang.reflect.Re… --- ## [Best way to analyze Event Correlation Sequence detections](https://discuss.elastic.co/t/best-way-to-analyze-event-correlation-sequence-detections/320497)
**Author:** [@nemhods](https://discuss.elastic.co/u/nemhods)\ **Replies:** 5\ **Last updated:** [December 7, 2022, 8:20pm UTC](https://discuss.elastic.co/t/best-way-to-analyze-event-correlation-sequence-detections/320497 "2022-12-07T20:20:57Z")
Hey, I want to analyse an Event Correlation rule detection (EQL) in Elastic SIEM. However, for sequence-type EQL queries, the alert details and SIEM app don't show me all the information I need to do my analysis. Consid… --- ## [Creating alerts with aggregation and query filter](https://discuss.elastic.co/t/creating-alerts-with-aggregation-and-query-filter/319842)
**Author:** [@solange.sonaglio](https://discuss.elastic.co/u/solange.sonaglio)\ **Replies:** 2\ **Last updated:** [December 7, 2022, 8:03pm UTC](https://discuss.elastic.co/t/creating-alerts-with-aggregation-and-query-filter/319842 "2022-12-07T20:03:13Z")
With the current data that we have in APM, we felt the need to create an alert based on an aggregated value, as the "Index threshold" type allows, however, we needed to include some filters in the data, as the "Elasticse… --- ## [SearchResponse as JSON](https://discuss.elastic.co/t/searchresponse-as-json/320475)
**Author:** [@divadpoc](https://discuss.elastic.co/u/divadpoc)\ **Replies:** 19\ **Last updated:** [December 7, 2022, 7:29pm UTC](https://discuss.elastic.co/t/searchresponse-as-json/320475 "2022-12-07T19:29:07Z")
Hi, I'm using version 8.5.1 w/ the Java client. I'm looking for a way to get the SearchResponse as JSON, or at least the same output I'd get when executing the query in Kibana. Thanks for any hints. --- ## [Kibana runtime fields in elastic 8.4.0](https://discuss.elastic.co/t/kibana-runtime-fields-in-elastic-8-4-0/320704)
**Author:** [@Ajmal\_Khalil](https://discuss.elastic.co/u/Ajmal_Khalil)\ **Replies:** 1\ **Last updated:** [December 7, 2022, 5:32pm UTC](https://discuss.elastic.co/t/kibana-runtime-fields-in-elastic-8-4-0/320704 "2022-12-07T17:32:21Z")
Hi, I'm trying to create a runtime field but getting errors with my syntax also after creating the field not getting that under discover in fields. I hope you can help me in this. Actuall i have logs like this "No tr… --- ## [Ingest Pipeline for custom logs](https://discuss.elastic.co/t/ingest-pipeline-for-custom-logs/320380)
**Author:** [@shuuny-matrix](https://discuss.elastic.co/u/shuuny-matrix)\ **Replies:** 6\ **Last updated:** [December 7, 2022, 5:42pm UTC](https://discuss.elastic.co/t/ingest-pipeline-for-custom-logs/320380 "2022-12-07T17:42:37Z")
Hi, I am ingesting the standards syslogs using the elastic agent "custom logs" integration. I am trying to parse the logs before indexing and for that I am using ingest pipeline. I have two processors for that: Grok an… --- ## [Issue with using apm in node with elastic-apm-node package and http server url](https://discuss.elastic.co/t/issue-with-using-apm-in-node-with-elastic-apm-node-package-and-http-server-url/320649)
**Author:** [@gauravsunstone](https://discuss.elastic.co/u/gauravsunstone)\ **Replies:** 1\ **Last updated:** [December 7, 2022, 6:50pm UTC](https://discuss.elastic.co/t/issue-with-using-apm-in-node-with-elastic-apm-node-package-and-http-server-url/320649 "2022-12-07T18:50:59Z")
Using elastic-apm-node package for apm setup in my nodejs application suddenly started facing below issue SSL routines:ssl3\_get\_record:wrong version number:../deps/openssl/openssl/ssl/record/ssl3\_record.c:332 Using htt… --- ## [Count the latest records in Kibana visualization?](https://discuss.elastic.co/t/count-the-latest-records-in-kibana-visualization/320669)
**Author:** [@Maruthappan\_Muthu](https://discuss.elastic.co/u/Maruthappan_Muthu)\ **Replies:** 6\ **Last updated:** [December 7, 2022, 6:28pm UTC](https://discuss.elastic.co/t/count-the-latest-records-in-kibana-visualization/320669 "2022-12-07T18:28:04Z")
I have document like as below Every two minutes once the "status" field records will get change and I want to count only the recent status records in Kibana visualization. Ex., The total count of status value 1 is 3 & … --- ## [Missed Events](https://discuss.elastic.co/t/missed-events/320702)
**Author:** [@Tim\_Mobley](https://discuss.elastic.co/u/Tim_Mobley)\ **Replies:** 0\ **Last updated:** [December 7, 2022, 4:25pm UTC](https://discuss.elastic.co/t/missed-events/320702 "2022-12-07T16:25:52Z")
I have a situation where we are receiving Windows Event ID 3000 sometimes but not other times. This is very problematic, as the event is used to troubleshoot process exits. The endpoint uses Windows Event Forwarding (WEF… --- ## [Rule not trigger](https://discuss.elastic.co/t/rule-not-trigger/318585)
**Author:** [@zvazquez](https://discuss.elastic.co/u/zvazquez)\ **Replies:** 0\ **Last updated:** [November 9, 2022, 7:12pm UTC](https://discuss.elastic.co/t/rule-not-trigger/318585 "2022-11-09T19:12:21Z")
Hi, We have an index which stores data around every 10 minutes. We have added this index to the metric indexes to create alerts/rules. We are trying to create alerts from properties with float data type. For some reaso… --- ## [What stops Alerting from working?](https://discuss.elastic.co/t/what-stops-alerting-from-working/320705)
**Author:** [@TXBigDawg1836](https://discuss.elastic.co/u/TXBigDawg1836)\ **Replies:** 2\ **Last updated:** [December 7, 2022, 4:56pm UTC](https://discuss.elastic.co/t/what-stops-alerting-from-working/320705 "2022-12-07T16:56:56Z")
Attempting to put together a flowchart of our ELK workflow for troubleshooting. At what point does Alerting possibly break or stop working? Will alerts stop if the Kibana GUI or service is down? Or, does the Elasticse… --- ## [Multi-host docker-compose setup woes](https://discuss.elastic.co/t/multi-host-docker-compose-setup-woes/320692)
**Author:** [@bobus](https://discuss.elastic.co/u/bobus)\ **Replies:** 3\ **Last updated:** [December 7, 2022, 4:56pm UTC](https://discuss.elastic.co/t/multi-host-docker-compose-setup-woes/320692 "2022-12-07T16:56:35Z")
On three hosts A, B, and C, where a v5 cluster is already running, I need to setup a new v7 cluster, so that at some point I can migrate to v7 and drop the v5. This means I have to map ports 9200 & 9300 to different po… --- ## [Is Kibana EQL Rule Using Async Search?](https://discuss.elastic.co/t/is-kibana-eql-rule-using-async-search/320687)
**Author:** [@davendu](https://discuss.elastic.co/u/davendu)\ **Replies:** 4\ **Last updated:** [December 7, 2022, 3:55pm UTC](https://discuss.elastic.co/t/is-kibana-eql-rule-using-async-search/320687 "2022-12-07T15:55:05Z")
Hi everyone, Similar to this thread, I also was notified by error Request timed out like the following debug log says: { ... "message":"Changing rule status to \\"failed\\". An error occurred during rule execution: messa… --- ## [Dec 4th 2022: \[EN\] Ingesting JSON logs with Elastic-Agent (and/or Filebeat)](https://discuss.elastic.co/t/dec-4th-2022-en-ingesting-json-logs-with-elastic-agent-and-or-filebeat/319536)
**Author:** [@TiagoQueiroz](https://discuss.elastic.co/u/TiagoQueiroz)\ **Replies:** 2\ **Last updated:** [December 7, 2022, 3:26pm UTC](https://discuss.elastic.co/t/dec-4th-2022-en-ingesting-json-logs-with-elastic-agent-and-or-filebeat/319536 "2022-12-07T15:26:13Z")
This article is also available in Portuguese. Structured logging has almost became a standard in the industry, allowing for easy understanding and parsing of the logs. While the Elastic-Agent provides integrations to… --- ## [New Logstash Grok add\_field](https://discuss.elastic.co/t/new-logstash-grok-add-field/320659)
**Author:** [@anon74213320](https://discuss.elastic.co/u/anon74213320)\ **Replies:** 2\ **Last updated:** [December 7, 2022, 3:14pm UTC](https://discuss.elastic.co/t/new-logstash-grok-add-field/320659 "2022-12-07T15:14:14Z")
Hi everyone I am trying to add a new field for pick up a hostname from a logfile like this format: Source : \\\\abc123 I tried with setting patterns file and add\_filed in grok and mutate but it is not added, it seems is… --- ## [Elasticsearch](https://discuss.elastic.co/t/elasticsearch/320691)
**Author:** [@manikanta](https://discuss.elastic.co/u/manikanta)\ **Replies:** 1\ **Last updated:** [December 7, 2022, 2:36pm UTC](https://discuss.elastic.co/t/elasticsearch/320691 "2022-12-07T14:36:40Z")
Can you write if - else type based queries in Elasticsearch? --- ## [Logstash: Optional fields in grok](https://discuss.elastic.co/t/logstash-optional-fields-in-grok/320604)
**Author:** [@anon99430464](https://discuss.elastic.co/u/anon99430464)\ **Replies:** 2\ **Last updated:** [December 7, 2022, 2:35pm UTC](https://discuss.elastic.co/t/logstash-optional-fields-in-grok/320604 "2022-12-07T14:35:34Z")
Hi there I'm trying to create a logstash for our logs. Our log files can look like the following 2022-11-22 10:43:59,061 INFO \[SERVER1.Subscription\] |\>\> | \[ctx:0ecaa086-f9b7-4d0e-bce4-1b8513238745\] \[req:facdaf2c-b8e6… --- ## [How to enable sql in elastic 7.3](https://discuss.elastic.co/t/how-to-enable-sql-in-elastic-7-3/320447)
**Author:** [@Bhanuji\_paluri](https://discuss.elastic.co/u/Bhanuji_paluri)\ **Replies:** 3\ **Last updated:** [December 7, 2022, 1:48pm UTC](https://discuss.elastic.co/t/how-to-enable-sql-in-elastic-7-3/320447 "2022-12-07T13:48:04Z")
can you please let me know how to run the sql queries in devtool? how to enable the sql , how to test it? --- ## [Docker filebeat installation error](https://discuss.elastic.co/t/docker-filebeat-installation-error/320686)
**Author:** [@AnkurYogi](https://discuss.elastic.co/u/AnkurYogi)\ **Replies:** 0\ **Last updated:** [December 7, 2022, 1:27pm UTC](https://discuss.elastic.co/t/docker-filebeat-installation-error/320686 "2022-12-07T13:27:59Z")
\ **Author:** [@yarons](https://discuss.elastic.co/u/yarons)\ **Replies:** 1\ **Last updated:** [December 7, 2022, 1:25pm UTC](https://discuss.elastic.co/t/ilm-policy-interval-is-later-than-configured/320682 "2022-12-07T13:25:34Z") Hi, I have created the following ILM Policy for testing: { "test-1-m": { "version": 6, "modified\_date": "2022-12-07T11:27:55.648Z", "policy": { "phases": { "hot": { "min\_age": "0ms"… --- ## [Insert Events with Changed Status Only using Logstash](https://discuss.elastic.co/t/insert-events-with-changed-status-only-using-logstash/319196)
**Author:** [@sajid](https://discuss.elastic.co/u/sajid)\ **Replies:** 2\ **Last updated:** [December 7, 2022, 1:17pm UTC](https://discuss.elastic.co/t/insert-events-with-changed-status-only-using-logstash/319196 "2022-12-07T13:17:56Z")
Hi All, Need your help to solve an issue. Below are the details: Pipeline1 : Polls multiple http endpoints every minute using http\_poller and insert the response to index1 in ES. Below is the sample response of one of… --- ## [NPE using APM Agent 1.34.1](https://discuss.elastic.co/t/npe-using-apm-agent-1-34-1/317179)
**Author:** [@barath](https://discuss.elastic.co/u/barath)\ **Replies:** 19\ **Last updated:** [December 7, 2022, 12:55pm UTC](https://discuss.elastic.co/t/npe-using-apm-agent-1-34-1/317179 "2022-12-07T12:55:55Z")
The same error that was reported in NPE using APM Agent 1.33.0 still happens in Java agent 1.34.1. java.lang.NullPointerException at co.elastic.apm.agent.impl.transaction.Span.afterEnd(Span.java:289) at co.elastic.apm… --- ## [Able to connect from pod: but error comes co.elastic.apm.agent.report.IntakeV2ReportingEventHandler](https://discuss.elastic.co/t/able-to-connect-from-pod-but-error-comes-co-elastic-apm-agent-report-intakev2reportingeventhandler/320587)
**Author:** [@VVK](https://discuss.elastic.co/u/VVK)\ **Replies:** 2\ **Last updated:** [December 7, 2022, 12:39pm UTC](https://discuss.elastic.co/t/able-to-connect-from-pod-but-error-comes-co-elastic-apm-agent-report-intakev2reportingeventhandler/320587 "2022-12-07T12:39:19Z")
Hello APM Server Gurus, APM Server version: docker.elastic.co/apm/apm-server:7.17.6 APM Agent language and version: NodeJs : javascript : 3.38 and Java 1.33 Browser version: Not applicable Original install method … --- ## [Java elasticsearch-java-8.5.1 error on deserialisation of Instant Field](https://discuss.elastic.co/t/java-elasticsearch-java-8-5-1-error-on-deserialisation-of-instant-field/320681)
**Author:** [@Philip\_Bannon](https://discuss.elastic.co/u/Philip_Bannon)\ **Replies:** 1\ **Last updated:** [December 7, 2022, 12:36pm UTC](https://discuss.elastic.co/t/java-elasticsearch-java-8-5-1-error-on-deserialisation-of-instant-field/320681 "2022-12-07T12:36:17Z")
Hi, I have a Spring Boot app (Version 2.7.6) and I'm using the java API client elasticsearch-java-8.5.1. I'm doing a basic query but my object in ES contains an INSTANT value (see POJO below). When I perform the query I… --- ## [Open a non-http link](https://discuss.elastic.co/t/open-a-non-http-link/320674)
**Author:** [@GinkoLucas](https://discuss.elastic.co/u/GinkoLucas)\ **Replies:** 1\ **Last updated:** [December 7, 2022, 11:39am UTC](https://discuss.elastic.co/t/open-a-non-http-link/320674 "2022-12-07T11:39:59Z")
Hello, In my data i have some ip adress. I would like to open a teamviewer connection with this IP adress. So, for this, i have modified the data view. I change the field's type in "Link", and i put this in the URL tem… --- ## [/usr/share/elasticsearch/bin/elasticsearch](https://discuss.elastic.co/t/usr-share-elasticsearch-bin-elasticsearch/320640)
**Author:** [@Alejandro\_Abeijon](https://discuss.elastic.co/u/Alejandro_Abeijon)\ **Replies:** 2\ **Last updated:** [December 7, 2022, 11:27am UTC](https://discuss.elastic.co/t/usr-share-elasticsearch-bin-elasticsearch/320640 "2022-12-07T11:27:58Z")
Hi, thanks in advance for the help. I installed Elasticsearch in a thousand ways and I always get the same error. Can someone guide me where to start exploring? Thank you very much! elasticsearch@test:~$ /usr/share/el… --- ## [How to remove .Keywords in kibana](https://discuss.elastic.co/t/how-to-remove-keywords-in-kibana/320677)
**Author:** [@vijay78](https://discuss.elastic.co/u/vijay78)\ **Replies:** 2\ **Last updated:** [December 7, 2022, 11:19am UTC](https://discuss.elastic.co/t/how-to-remove-keywords-in-kibana/320677 "2022-12-07T11:19:02Z")
Can someone assist here with how to remove (exclude)these highlighted .keywords in kibana ,thanking in advance. --- ## [Issue while updating the TLS certificates](https://discuss.elastic.co/t/issue-while-updating-the-tls-certificates/320472)
**Author:** [@h.allaoui](https://discuss.elastic.co/u/h.allaoui)\ **Replies:** 1\ **Last updated:** [December 7, 2022, 10:58am UTC](https://discuss.elastic.co/t/issue-while-updating-the-tls-certificates/320472 "2022-12-07T10:58:53Z")
Hi All, I tried to update the TLS certificates on ECE UI using below certificates got from GoDaddy but it is failing. 57736c67a7538a4.crt 57736c67a7538a4.pem gd\_bundle-g2-g1.crt The chain file uploaded was created b… [Previous page](https://discuss.elastic.co/latest.md?page=866) [Next page](https://discuss.elastic.co/latest.md?page=868)