# Latest **URL:** https://discuss.elastic.co/latest.md?page=887 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 888 --- ## [Elasticsearch 7.17.7 ReadOnly Root FileSystem/Privileged Container](https://discuss.elastic.co/t/elasticsearch-7-17-7-readonly-root-filesystem-privileged-container/319473)
**Author:** [@rsoares82](https://discuss.elastic.co/u/rsoares82)\ **Replies:** 0\ **Last updated:** [November 21, 2022, 3:37pm UTC](https://discuss.elastic.co/t/elasticsearch-7-17-7-readonly-root-filesystem-privileged-container/319473 "2022-11-21T15:37:23Z")
Hi all, I am using elasticsearch on version 7.17.7 we deploy to kubernetes using helm charts, it happens that our containers are marked vulnerable because they don't have a read only root file system and the containers … --- ## [Deleting document by query](https://discuss.elastic.co/t/deleting-document-by-query/318570)
**Author:** [@sssamant](https://discuss.elastic.co/u/sssamant)\ **Replies:** 4\ **Last updated:** [November 21, 2022, 12:09am UTC](https://discuss.elastic.co/t/deleting-document-by-query/318570 "2022-11-21T00:09:00Z")
I am trying to use delete\_by\_query to delete some documents for a particular index. But it fails with illegal version value and I read that delete\_by\_query cannot be used to delete documents with index version zero. Is t… --- ## [Logstash s3 input .gz/folder/file patter possible?](https://discuss.elastic.co/t/logstash-s3-input-gz-folder-file-patter-possible/319493)
**Author:** [@acavalier](https://discuss.elastic.co/u/acavalier)\ **Replies:** 3\ **Last updated:** [November 21, 2022, 9:14pm UTC](https://discuss.elastic.co/t/logstash-s3-input-gz-folder-file-patter-possible/319493 "2022-11-21T21:14:29Z")
I want the s3 input to read the .gz/folder/file is this possible or will i need to use somthing else i.e. lambda to extract the files first. Currently the s3 input is reading the folder as the file. Any help is appreciat… --- ## [Elasticsearch refreshing indices, but documents still don't show up in search](https://discuss.elastic.co/t/elasticsearch-refreshing-indices-but-documents-still-dont-show-up-in-search/319325)
**Author:** [@Ivo\_Tavares](https://discuss.elastic.co/u/Ivo_Tavares)\ **Replies:** 2\ **Last updated:** [November 21, 2022, 8:51pm UTC](https://discuss.elastic.co/t/elasticsearch-refreshing-indices-but-documents-still-dont-show-up-in-search/319325 "2022-11-21T20:51:45Z")
I'm creating some documents on an index, using bulk. I can access them using get or mget. When I did a search, those documents didn't show up. So, I decided to refresh the indices. However, in some cases, it still happen… --- ## [Problem bringing string part in ElasticSearch](https://discuss.elastic.co/t/problem-bringing-string-part-in-elasticsearch/319492)
**Author:** [@Diego\_Souza](https://discuss.elastic.co/u/Diego_Souza)\ **Replies:** 0\ **Last updated:** [November 21, 2022, 8:04pm UTC](https://discuss.elastic.co/t/problem-bringing-string-part-in-elasticsearch/319492 "2022-11-21T20:04:55Z")
I'm having a problem getting string part in Elasticsearch. Below is the configuration of index. PUT exemplo { "settings": { "analysis": { "analyzer": { "portuguese\_br": { "type": "portugu… --- ## [Dashboard ID update or complete redo](https://discuss.elastic.co/t/dashboard-id-update-or-complete-redo/318982)
**Author:** [@cronwel](https://discuss.elastic.co/u/cronwel)\ **Replies:** 4\ **Last updated:** [November 21, 2022, 7:50pm UTC](https://discuss.elastic.co/t/dashboard-id-update-or-complete-redo/318982 "2022-11-21T19:50:02Z")
I'm developing a dashboard with saved objects(visualizations) that I had to reingest. I've been remaking the visualization because I receive error messages related to the id. Is there a way to update visualizations/dash… --- ## [We are just getting started using Search UI library with angular and struck with query suggestion](https://discuss.elastic.co/t/we-are-just-getting-started-using-search-ui-library-with-angular-and-struck-with-query-suggestion/319248)
**Author:** [@pradeepjanga](https://discuss.elastic.co/u/pradeepjanga)\ **Replies:** 4\ **Last updated:** [November 21, 2022, 7:23pm UTC](https://discuss.elastic.co/t/we-are-just-getting-started-using-search-ui-library-with-angular-and-struck-with-query-suggestion/319248 "2022-11-21T19:23:19Z")
I see there is autocompleteQuery in Search Driver. I did set that but it is not calling querySuggestions api call. how can i trigger that ? this.searchDriver.setAutocompleteQuery({ suggestions: { … --- ## [Beats vs Elastic Agent - use case of SIEM](https://discuss.elastic.co/t/beats-vs-elastic-agent-use-case-of-siem/319377)
**Author:** [@SirMuffington](https://discuss.elastic.co/u/SirMuffington)\ **Replies:** 2\ **Last updated:** [November 21, 2022, 7:00pm UTC](https://discuss.elastic.co/t/beats-vs-elastic-agent-use-case-of-siem/319377 "2022-11-21T19:00:15Z")
Hello dear Community! I wanted to ask a beginner question - what is the difference between Beats and Elastic Agent and what is better for SIEM analysis? Cheers --- ## [Logstash input google pubsub - clarification](https://discuss.elastic.co/t/logstash-input-google-pubsub-clarification/319489)
**Author:** [@metalshanked](https://discuss.elastic.co/u/metalshanked)\ **Replies:** 0\ **Last updated:** [November 21, 2022, 6:48pm UTC](https://discuss.elastic.co/t/logstash-input-google-pubsub-clarification/319489 "2022-11-21T18:48:28Z")
Hi, I wanted clarification on the below statement in the docs for the logstash Google pubsub input plugin All messages received from Pub/Sub will be converted to a logstash event and added to the processing pipeline qu… --- ## [Error setup passwords](https://discuss.elastic.co/t/error-setup-passwords/319370)
**Author:** [@ardue](https://discuss.elastic.co/u/ardue)\ **Replies:** 6\ **Last updated:** [November 21, 2022, 6:38pm UTC](https://discuss.elastic.co/t/error-setup-passwords/319370 "2022-11-21T18:38:47Z")
Hello, I am currently trying to connect two nodes to make a cluster Here is the configuration for node1 cluster.name: underpass node.name: node-01 path.data: /var/lib/elasticsearch path.logs: /var/log/elasticsearch … --- ## [Trying to export from OpenTelemetry dotnet to Elastic APM 7.17.7](https://discuss.elastic.co/t/trying-to-export-from-opentelemetry-dotnet-to-elastic-apm-7-17-7/319445)
**Author:** [@StefanBilliet](https://discuss.elastic.co/u/StefanBilliet)\ **Replies:** 1\ **Last updated:** [November 21, 2022, 5:46pm UTC](https://discuss.elastic.co/t/trying-to-export-from-opentelemetry-dotnet-to-elastic-apm-7-17-7/319445 "2022-11-21T17:46:17Z")
Kibana version: 7.17.7 Elasticsearch version: 7.17.7 APM Server version: 7.17.7 Hi :slightly\_smiling\_face: I'm working on an ASP.NET application with .NET 4.8, which I've instrumented with OpenTelemetry. Exportin… --- ## [\[Java\] new equivalent of boolQuery.hasClauses() in ES 8 Java client?](https://discuss.elastic.co/t/java-new-equivalent-of-boolquery-hasclauses-in-es-8-java-client/319485)
**Author:** [@toto12214](https://discuss.elastic.co/u/toto12214)\ **Replies:** 0\ **Last updated:** [November 21, 2022, 5:44pm UTC](https://discuss.elastic.co/t/java-new-equivalent-of-boolquery-hasclauses-in-es-8-java-client/319485 "2022-11-21T17:44:59Z")
Hello, I'm looking for the new equivalent of the old BoolQueryBuilder.hasClauses() for Elasticsearch 8 Java client. It seems to have completely dissapear ? Any workaround about ? --- ## [In a .NET Console app, can I flush data instead of waiting flush interval?](https://discuss.elastic.co/t/in-a-net-console-app-can-i-flush-data-instead-of-waiting-flush-interval/319174)
**Author:** [@glacasa](https://discuss.elastic.co/u/glacasa)\ **Replies:** 1\ **Last updated:** [November 21, 2022, 5:44pm UTC](https://discuss.elastic.co/t/in-a-net-console-app-can-i-flush-data-instead-of-waiting-flush-interval/319174 "2022-11-21T17:44:42Z")
I'm trying to monitor a console app (automatically run every hour) in .NET The app is built on an HostBuilder, I have called .UseAllElasticApm() and .UseConsoleLifetime() on it, and I make a transaction by code : var t… --- ## [Kibana TSVB how to visualize unique records count](https://discuss.elastic.co/t/kibana-tsvb-how-to-visualize-unique-records-count/319474)
**Author:** [@azulgrana](https://discuss.elastic.co/u/azulgrana)\ **Replies:** 4\ **Last updated:** [November 21, 2022, 5:28pm UTC](https://discuss.elastic.co/t/kibana-tsvb-how-to-visualize-unique-records-count/319474 "2022-11-21T17:28:48Z")
Hi there! I'm exploring TSVB and I couldn't find a way to report unique record count w/ the "counter" viz. Any guidance on that? TIA Azulgrana --- ## [Request for help/direction to create node certificates/keys using own CA certificates in place](https://discuss.elastic.co/t/request-for-help-direction-to-create-node-certificates-keys-using-own-ca-certificates-in-place/317884)
**Author:** [@arunhk3](https://discuss.elastic.co/u/arunhk3)\ **Replies:** 3\ **Last updated:** [November 21, 2022, 5:05pm UTC](https://discuss.elastic.co/t/request-for-help-direction-to-create-node-certificates-keys-using-own-ca-certificates-in-place/317884 "2022-11-21T17:05:22Z")
Hi All, We have our OWN CA certificates namely: ABC-Issuing-CA.crt ABC-Root-CA.crt With this we would like to create new Elasticsearch node certificates where we could not find any resource online for it. I am new t… --- ## [Elasticsearch does not start CentOS7](https://discuss.elastic.co/t/elasticsearch-does-not-start-centos7/318373)
**Author:** [@vassiliy.vins](https://discuss.elastic.co/u/vassiliy.vins)\ **Replies:** 36\ **Last updated:** [November 21, 2022, 4:54pm UTC](https://discuss.elastic.co/t/elasticsearch-does-not-start-centos7/318373 "2022-11-21T16:54:38Z")
Hi! Installed Elasticsearch as mentioned in Elastic Docs Generated certificates and keys - followed this link - How to install Elasticsearch and Kibana 8.0 on Centos 7 puppet here in the log - just name of the serve… --- ## [Ingesting csv data to elastic cloud by doc generator to specific index](https://discuss.elastic.co/t/ingesting-csv-data-to-elastic-cloud-by-doc-generator-to-specific-index/316299)
**Author:** [@ramreddy09](https://discuss.elastic.co/u/ramreddy09)\ **Replies:** 1\ **Last updated:** [October 25, 2022, 2:42pm UTC](https://discuss.elastic.co/t/ingesting-csv-data-to-elastic-cloud-by-doc-generator-to-specific-index/316299 "2022-10-25T14:42:05Z")
we in our project scrapping tweets using tweepy the data collected is in the csv that should be updated to index using python to elastic cloud in our code it is showing successful but we are unable to see index in the da… --- ## [GuardDuty en Elastic](https://discuss.elastic.co/t/guardduty-en-elastic/317442)
**Author:** [@Gonzalo\_Sandoval\_A](https://discuss.elastic.co/u/Gonzalo_Sandoval_A)\ **Replies:** 6\ **Last updated:** [November 21, 2022, 4:18pm UTC](https://discuss.elastic.co/t/guardduty-en-elastic/317442 "2022-11-21T16:18:07Z")
I am trying to create dashboard with information from AWS GuadDuty. I was already able to bring data to elastic through the elastic agent by enabling SQS integration from S3. The relevant information is in a field call… --- ## [DSL Query to filter an IP type field to display documents that have a public IP address](https://discuss.elastic.co/t/dsl-query-to-filter-an-ip-type-field-to-display-documents-that-have-a-public-ip-address/319007)
**Author:** [@azulgrana](https://discuss.elastic.co/u/azulgrana)\ **Replies:** 1\ **Last updated:** [November 21, 2022, 4:10pm UTC](https://discuss.elastic.co/t/dsl-query-to-filter-an-ip-type-field-to-display-documents-that-have-a-public-ip-address/319007 "2022-11-21T16:10:20Z")
Hi there! I have documents with an IP type field showing 1 or more IP addresses and I need to apply a filter to the documents to show only the documents where there's a public IP address ( non-RFC1918). For example, le… --- ## [CA and certs](https://discuss.elastic.co/t/ca-and-certs/319422)
**Author:** [@davidafolabi](https://discuss.elastic.co/u/davidafolabi)\ **Replies:** 2\ **Last updated:** [November 21, 2022, 3:39pm UTC](https://discuss.elastic.co/t/ca-and-certs/319422 "2022-11-21T15:39:18Z")
Hi, I have been able to create a CA, what command do I use to create an instance of that certificate. P.S: this is on a Windows OS. Thank you in advance for your help, David. --- ## [Logstash dissect change datatype to timestamp](https://discuss.elastic.co/t/logstash-dissect-change-datatype-to-timestamp/319470)
**Author:** [@edim2525](https://discuss.elastic.co/u/edim2525)\ **Replies:** 1\ **Last updated:** [November 21, 2022, 3:04pm UTC](https://discuss.elastic.co/t/logstash-dissect-change-datatype-to-timestamp/319470 "2022-11-21T15:04:40Z")
Hi , Is there a way to change the mapping field to timestamp ? This is my input "Time :2022-11-21 12:01:30.85" I'm using "dissect \> mapping" to map this field, but the output data type is "text" and I want it as a tim… --- ## [Kibana Vega Gantt chart](https://discuss.elastic.co/t/kibana-vega-gantt-chart/319351)
**Author:** [@liorh](https://discuss.elastic.co/u/liorh)\ **Replies:** 1\ **Last updated:** [November 21, 2022, 2:51pm UTC](https://discuss.elastic.co/t/kibana-vega-gantt-chart/319351 "2022-11-21T14:51:43Z")
Hi guys I got this very simple example of Gantt chart with Vega: { "$schema": "https://vega.github.io/schema/vega-lite/v2.json", "description": "A simple bar chart with ranged data (aka Gantt Chart).", "data": { … --- ## [Parsing errors in Winlogbeat Powershell module](https://discuss.elastic.co/t/parsing-errors-in-winlogbeat-powershell-module/319468)
**Author:** [@amitypete](https://discuss.elastic.co/u/amitypete)\ **Replies:** 0\ **Last updated:** [November 21, 2022, 2:49pm UTC](https://discuss.elastic.co/t/parsing-errors-in-winlogbeat-powershell-module/319468 "2022-11-21T14:49:26Z")
I am trying to determine why I am getting so many Powershell parsing errors for event.code 800 events when ingesting with winlogbeat v 7.17.5. I'm seeing more than 50% of these ingested events being tagged with "\_js\_exc… --- ## [Aggregate on multiple data fields from time series data](https://discuss.elastic.co/t/aggregate-on-multiple-data-fields-from-time-series-data/319466)
**Author:** [@rvadiga](https://discuss.elastic.co/u/rvadiga)\ **Replies:** 0\ **Last updated:** [November 21, 2022, 2:40pm UTC](https://discuss.elastic.co/t/aggregate-on-multiple-data-fields-from-time-series-data/319466 "2022-11-21T14:40:10Z")
Dear Team, I am a newbie to ELK world so far. Please bear with my question. I have a time-series data which has many numeric data fields, needs a way to define an aggregation of those fields across time-series period. … --- ## [Fleet-server cannot write to a fleet managed index](https://discuss.elastic.co/t/fleet-server-cannot-write-to-a-fleet-managed-index/318138)
**Author:** [@twilson](https://discuss.elastic.co/u/twilson)\ **Replies:** 1\ **Last updated:** [November 21, 2022, 2:33pm UTC](https://discuss.elastic.co/t/fleet-server-cannot-write-to-a-fleet-managed-index/318138 "2022-11-21T14:33:04Z")
I created a custom ingest pipeline (logs-system.security@custom) that looks for event ID 5152 or 5157 in the Windows security log, and redirects those events to the iptables indexes (logs-iptables.log-default), after mod… --- ## [Rarest term filter](https://discuss.elastic.co/t/rarest-term-filter/319455)
**Author:** [@Karel\_Haerens](https://discuss.elastic.co/u/Karel_Haerens)\ **Replies:** 0\ **Last updated:** [November 21, 2022, 1:20pm UTC](https://discuss.elastic.co/t/rarest-term-filter/319455 "2022-11-21T13:20:22Z")
Hi all, would there be a way to filter matches to a query in such a way that only matches are accepted where (at least) the rarest term in the result occurs in the query. worded differently: there cannot be any unmatch… --- ## [Fail to checkin to fleet server](https://discuss.elastic.co/t/fail-to-checkin-to-fleet-server/318932)
**Author:** [@subash](https://discuss.elastic.co/u/subash)\ **Replies:** 7\ **Last updated:** [November 21, 2022, 1:42pm UTC](https://discuss.elastic.co/t/fail-to-checkin-to-fleet-server/318932 "2022-11-21T13:42:18Z")
We are using Elasticsearch 7.17.4 on private cloud. We have 4 elastic agents installed on windows 10 PCs and managed by fleet. It is observed that the Elastic agent status switches between 'Healthy' and 'Offline'. Belo… --- ## [Filebeat running on ECK cannot create an index](https://discuss.elastic.co/t/filebeat-running-on-eck-cannot-create-an-index/316464)
**Author:** [@cloudmatt](https://discuss.elastic.co/u/cloudmatt)\ **Replies:** 3\ **Last updated:** [November 21, 2022, 1:34pm UTC](https://discuss.elastic.co/t/filebeat-running-on-eck-cannot-create-an-index/316464 "2022-11-21T13:34:10Z")
I'm trying to wrap my head around running ECK and using filebeat. I've successfully deployed filebeat and I see it grabbing logs from my GCP pub/sub topic but it keeps dropping them because of the following error: Priva… --- ## [Cmd/enroll\_cmd.go:776 Fleet Server - Error - x509: certificate is valid for (old hostname), not (current hostname)](https://discuss.elastic.co/t/cmd-enroll-cmd-go-776-fleet-server-error-x509-certificate-is-valid-for-old-hostname-not-current-hostname/318427)
**Author:** [@Foe\_Clicker](https://discuss.elastic.co/u/Foe_Clicker)\ **Replies:** 2\ **Last updated:** [November 21, 2022, 1:26pm UTC](https://discuss.elastic.co/t/cmd-enroll-cmd-go-776-fleet-server-error-x509-certificate-is-valid-for-old-hostname-not-current-hostname/318427 "2022-11-21T13:26:55Z")
Hi, I have the same issue like couple more people here, unfortinately they did not get any help, so I try myself:) Enrolling agent fails with message certificate is valid for (old hostname), not (current hostname). But… --- ## [Fleet server & integrations does not provide log/data](https://discuss.elastic.co/t/fleet-server-integrations-does-not-provide-log-data/316473)
**Author:** [@swchandu](https://discuss.elastic.co/u/swchandu)\ **Replies:** 3\ **Last updated:** [November 21, 2022, 1:23pm UTC](https://discuss.elastic.co/t/fleet-server-integrations-does-not-provide-log-data/316473 "2022-11-21T13:23:03Z")
Need help on fleet I have recently installed a cluster (8.4.0 docker) and facing issues with fleet/APM integration. Fleet container is running in the same elk server and getting registered with healthy status. However,… [Previous page](https://discuss.elastic.co/latest.md?page=886) [Next page](https://discuss.elastic.co/latest.md?page=888)