# Latest **URL:** https://discuss.elastic.co/latest.md?page=900 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 901 --- ## [How to install two Winlogbeat instances in same machine](https://discuss.elastic.co/t/how-to-install-two-winlogbeat-instances-in-same-machine/318674)
**Author:** [@hiruni.insyncit.net](https://discuss.elastic.co/u/hiruni.insyncit.net)\ **Replies:** 2\ **Last updated:** [November 10, 2022, 5:53pm UTC](https://discuss.elastic.co/t/how-to-install-two-winlogbeat-instances-in-same-machine/318674 "2022-11-10T17:53:36Z")
I'm using Elasticsearch 8.1 version and I want send Winlogbeat data to different ES clusters. I want to know how I can do it...? --- ## [How to enable authentication with logstash email output](https://discuss.elastic.co/t/how-to-enable-authentication-with-logstash-email-output/318473)
**Author:** [@learningelastic](https://discuss.elastic.co/u/learningelastic)\ **Replies:** 11\ **Last updated:** [November 10, 2022, 5:28pm UTC](https://discuss.elastic.co/t/how-to-enable-authentication-with-logstash-email-output/318473 "2022-11-10T17:28:44Z")
I want to learn how to use logstash with mailtrap smtp for development purposes. I installed logstash then ran this command: /usr/share/logstash/bin/logstash -e 'input { stdin { } } output { email { to =\> "user@examp… --- ## [Strange behavior in PHP Elasticsearch 8.5 API](https://discuss.elastic.co/t/strange-behavior-in-php-elasticsearch-8-5-api/318622)
**Author:** [@abkrim](https://discuss.elastic.co/u/abkrim)\ **Replies:** 9\ **Last updated:** [November 10, 2022, 4:57pm UTC](https://discuss.elastic.co/t/strange-behavior-in-php-elasticsearch-8-5-api/318622 "2022-11-10T16:57:47Z")
I feel totally lost. Having spent some time understanding that to connect to an Elasticsearch single-node, built with docker-compose, without security, I should use the configuration below, now I find that it doesn't wo… --- ## [What is boost in similarity score function?](https://discuss.elastic.co/t/what-is-boost-in-similarity-score-function/318091)
**Author:** [@fsanzestevez](https://discuss.elastic.co/u/fsanzestevez)\ **Replies:** 1\ **Last updated:** [November 10, 2022, 4:36pm UTC](https://discuss.elastic.co/t/what-is-boost-in-similarity-score-function/318091 "2022-11-10T16:36:26Z")
Hi, I have a question regarding the similarity function with BM25. I understand tf and idf. However it's not clear for me what the boost variable is and what it depends on. When I get the explanation of the score for … --- ## [Webhook with variables from Query DSL hits](https://discuss.elastic.co/t/webhook-with-variables-from-query-dsl-hits/318319)
**Author:** [@Alex\_Molina\_Bastos](https://discuss.elastic.co/u/Alex_Molina_Bastos)\ **Replies:** 3\ **Last updated:** [November 10, 2022, 4:22pm UTC](https://discuss.elastic.co/t/webhook-with-variables-from-query-dsl-hits/318319 "2022-11-10T16:22:35Z")
Hi, I am trying to create a rule that when triggered gets a variable, an IP in this case, from Query DSL and sends this variable through a webhook. I should be available to get an array of these variables if there are … --- ## [Reindex just one specific index in datastrem](https://discuss.elastic.co/t/reindex-just-one-specific-index-in-datastrem/317079)
**Author:** [@Oleksandr\_Isniuk](https://discuss.elastic.co/u/Oleksandr_Isniuk)\ **Replies:** 8\ **Last updated:** [November 10, 2022, 3:58pm UTC](https://discuss.elastic.co/t/reindex-just-one-specific-index-in-datastrem/317079 "2022-11-10T15:58:35Z")
We changed field mappings in our template. After rollover new index file works with correct field types. We supposed that we can use smaller time ranges to be sure that all data was read fro the new file. But it is not e… --- ## [Incompatible encodings: IBM437 and UTF-8](https://discuss.elastic.co/t/incompatible-encodings-ibm437-and-utf-8/316918)
**Author:** [@Helmut](https://discuss.elastic.co/u/Helmut)\ **Replies:** 11\ **Last updated:** [November 10, 2022, 3:48pm UTC](https://discuss.elastic.co/t/incompatible-encodings-ibm437-and-utf-8/316918 "2022-11-10T15:48:06Z")
Hi, I just installed logstash 8.4.3 on Windows Server 2019 and copied over configs from 8.2.3. logstash doesn't start: \[2022-10-18T18:24:26,830\]\[ERROR\]\[logstash.outputs.elasticsearch\]\[main\]\[42989fb99e78bec7495dbe5bfe5a… --- ## [How to understand the APM data span.duration.us value](https://discuss.elastic.co/t/how-to-understand-the-apm-data-span-duration-us-value/318611)
**Author:** [@pratikshatiwari](https://discuss.elastic.co/u/pratikshatiwari)\ **Replies:** 1\ **Last updated:** [November 10, 2022, 2:25pm UTC](https://discuss.elastic.co/t/how-to-understand-the-apm-data-span-duration-us-value/318611 "2022-11-10T14:25:53Z")
Hello, I am trying to prepare custom dashboard by using span.duration.us field. My query is what is the value inside span.duration.us field is value in microsecond? If it is microsecond how do i apply logic to see the… --- ## [Winlogbeat 8.0.0 parsing with module](https://discuss.elastic.co/t/winlogbeat-8-0-0-parsing-with-module/317812)
**Author:** [@vitkon](https://discuss.elastic.co/u/vitkon)\ **Replies:** 9\ **Last updated:** [November 10, 2022, 2:25pm UTC](https://discuss.elastic.co/t/winlogbeat-8-0-0-parsing-with-module/317812 "2022-11-10T14:25:49Z")
Hello everyone I have an ELK 8.0.0 series. I am testing the build of windows logs using winlogbeat 8.0.0. As I understand from the elastic documentation, the parsing of raw windows events will be by means of Security, P… --- ## [Using discover plugin in kibana custom plugin](https://discuss.elastic.co/t/using-discover-plugin-in-kibana-custom-plugin/314736)
**Author:** [@eshnajain](https://discuss.elastic.co/u/eshnajain)\ **Replies:** 3\ **Last updated:** [November 10, 2022, 2:24pm UTC](https://discuss.elastic.co/t/using-discover-plugin-in-kibana-custom-plugin/314736 "2022-11-10T14:24:10Z")
HI, I am trying to make a discover page like event table in my custom plug-in. Is it possible ? What is the best way to proceed ? --- ## [Machine Learning 1 Day Bucket Span and Alerts](https://discuss.elastic.co/t/machine-learning-1-day-bucket-span-and-alerts/317825)
**Author:** [@edang](https://discuss.elastic.co/u/edang)\ **Replies:** 6\ **Last updated:** [November 10, 2022, 2:23pm UTC](https://discuss.elastic.co/t/machine-learning-1-day-bucket-span-and-alerts/317825 "2022-11-10T14:23:21Z")
Hi All, I have unique data coming in once a day for a field and set up an advanced ML job with a bucket span of one day accordingly. The configured detector is a summation of a unique number field partitioned by another… --- ## [Fortinet Integration not parsing all data](https://discuss.elastic.co/t/fortinet-integration-not-parsing-all-data/316849)
**Author:** [@sirineb](https://discuss.elastic.co/u/sirineb)\ **Replies:** 3\ **Last updated:** [November 10, 2022, 1:54pm UTC](https://discuss.elastic.co/t/fortinet-integration-not-parsing-all-data/316849 "2022-11-10T13:54:55Z")
Hi, I noticed a problem with the Fortinet integration. I have an Elastic Agent 8.3 installed on a virtual machine. The policy for this Agent is composed of system and the fortinet integration. Our fortianalyzer is sendi… --- ## [Java capture overloaded method](https://discuss.elastic.co/t/java-capture-overloaded-method/318434)
**Author:** [@APandey](https://discuss.elastic.co/u/APandey)\ **Replies:** 6\ **Last updated:** [November 10, 2022, 1:51pm UTC](https://discuss.elastic.co/t/java-capture-overloaded-method/318434 "2022-11-10T13:51:03Z")
Hello everyone, I want to understand whether we can capture overloaded methods. We want to find which overloaded method was called with number of arguments and their type so we can use it for further correlation. --- ## [Snapshot migration on existing index](https://discuss.elastic.co/t/snapshot-migration-on-existing-index/318663)
**Author:** [@Rahul\_Gupta1](https://discuss.elastic.co/u/Rahul_Gupta1)\ **Replies:** 1\ **Last updated:** [November 10, 2022, 1:41pm UTC](https://discuss.elastic.co/t/snapshot-migration-on-existing-index/318663 "2022-11-10T13:41:04Z")
Is it possible to migrate the snapshot from one cluster to another cluster where the index mapping is present ? when i tried that same thing based on the local facing the following issue: - { "error": { "ro… --- ## [Kibana csv reporting error randomly](https://discuss.elastic.co/t/kibana-csv-reporting-error-randomly/318609)
**Author:** [@sbyunnn](https://discuss.elastic.co/u/sbyunnn)\ **Replies:** 1\ **Last updated:** [November 10, 2022, 1:34pm UTC](https://discuss.elastic.co/t/kibana-csv-reporting-error-randomly/318609 "2022-11-10T13:34:34Z")
my kibana error randomly when reporting a csv file. error: Unable to generate report Error: Failed to decrypt report job data. Please ensure that xpack.reporting.encryptionKey is set and re-generate this report. Erro… --- ## [Filebeat @timestamp not overwritten parsing error](https://discuss.elastic.co/t/filebeat-timestamp-not-overwritten-parsing-error/318466)
**Author:** [@pi314](https://discuss.elastic.co/u/pi314)\ **Replies:** 2\ **Last updated:** [November 10, 2022, 12:36pm UTC](https://discuss.elastic.co/t/filebeat-timestamp-not-overwritten-parsing-error/318466 "2022-11-10T12:36:09Z")
Hello, i see this warning in filebeat logs: 2022-11-08T15:24:21.094Z ERROR \[jsonhelper\] jsontransform/jsonhelper.go:62 JSON: Won't overwrite @timestamp because of parsing error: parsing time "2022-11-07T14… --- ## [Restart Elastic Agent from Fleet Centralized management](https://discuss.elastic.co/t/restart-elastic-agent-from-fleet-centralized-management/318646)
**Author:** [@frederikvandeputte](https://discuss.elastic.co/u/frederikvandeputte)\ **Replies:** 2\ **Last updated:** [November 10, 2022, 12:21pm UTC](https://discuss.elastic.co/t/restart-elastic-agent-from-fleet-centralized-management/318646 "2022-11-10T12:21:23Z")
Feature Request: Please add functionality to allow for elastic agent to be restarted remotely from Kibana - Fleet Centralized management, regardless of on which OS the agent is running on. Thanks KR --- ## [Upgrade to Elastic 8: GET /api/lists/privileges status code 400](https://discuss.elastic.co/t/upgrade-to-elastic-8-get-api-lists-privileges-status-code-400/318655)
**Author:** [@amcsi](https://discuss.elastic.co/u/amcsi)\ **Replies:** 0\ **Last updated:** [November 10, 2022, 12:19pm UTC](https://discuss.elastic.co/t/upgrade-to-elastic-8-get-api-lists-privileges-status-code-400/318655 "2022-11-10T12:19:12Z")
With this message: "undefined: undefined". I've upgraded my docker ELK stack from 7.17 to 8.5 and am getting this. I see nothing in docker logs for elasticsearch, nor anything in journalctl for it. Where do I begin fi… --- ## [HTTP Headers response Logstash http filter](https://discuss.elastic.co/t/http-headers-response-logstash-http-filter/318652)
**Author:** [@S-elk](https://discuss.elastic.co/u/S-elk)\ **Replies:** 0\ **Last updated:** [November 10, 2022, 12:08pm UTC](https://discuss.elastic.co/t/http-headers-response-logstash-http-filter/318652 "2022-11-10T12:08:54Z")
Hello! I am trying to use logstash's http filter to get some data from apis. One of the most important values is received as a header and yet logstash is not showing me all the headers. Including those that have the sa… --- ## [Using http poller for https server](https://discuss.elastic.co/t/using-http-poller-for-https-server/318648)
**Author:** [@yuswanul](https://discuss.elastic.co/u/yuswanul)\ **Replies:** 0\ **Last updated:** [November 10, 2022, 11:58am UTC](https://discuss.elastic.co/t/using-http-poller-for-https-server/318648 "2022-11-10T11:58:38Z")
Hi there i want to ask about http poller. so i test this plugin in my VM, and this is the configuration: input{ http\_poller{ urls =\> { test =\> { method =\> get user =\> "elastic" password =\> "myPassword" url =\> "h… --- ## [Strange behavior of "no data" alerts](https://discuss.elastic.co/t/strange-behavior-of-no-data-alerts/318531)
**Author:** [@EDzhelyov](https://discuss.elastic.co/u/EDzhelyov)\ **Replies:** 1\ **Last updated:** [November 10, 2022, 11:47am UTC](https://discuss.elastic.co/t/strange-behavior-of-no-data-alerts/318531 "2022-11-10T11:47:09Z")
We have an alert that checks if there is a controllermanager.master, it's configured to use the document count function, see the screenshot below. It started to report "no data" and triggered the alert after we creat… --- ## [Elastic-agent add - error protocol integration http/https](https://discuss.elastic.co/t/elastic-agent-add-error-protocol-integration-http-https/318401)
**Author:** [@grillo](https://discuss.elastic.co/u/grillo)\ **Replies:** 4\ **Last updated:** [November 10, 2022, 11:54am UTC](https://discuss.elastic.co/t/elastic-agent-add-error-protocol-integration-http-https/318401 "2022-11-10T11:54:45Z")
Hi, I have created a security policy for a windows computer and now I want to associate the windows computers with the "elastic-agent"... I have installed it as a service and I have specified, as indicated... revision:… --- ## [Migrate data to existing index in sanpshot approch in Elastic Search](https://discuss.elastic.co/t/migrate-data-to-existing-index-in-sanpshot-approch-in-elastic-search/318645)
**Author:** [@Rahul\_Gupta1](https://discuss.elastic.co/u/Rahul_Gupta1)\ **Replies:** 1\ **Last updated:** [November 10, 2022, 10:42am UTC](https://discuss.elastic.co/t/migrate-data-to-existing-index-in-sanpshot-approch-in-elastic-search/318645 "2022-11-10T10:42:17Z")
Hi, I want to migrate the data from one elasticsearch cluster to another using snapshot from a remote server. Is it possible to restore the old data to new cluster, the approch we are thinking is ot:- change configu… --- ## [How to visualize deeper into a donut chart?](https://discuss.elastic.co/t/how-to-visualize-deeper-into-a-donut-chart/318017)
**Author:** [@tinrik](https://discuss.elastic.co/u/tinrik)\ **Replies:** 6\ **Last updated:** [November 10, 2022, 10:23am UTC](https://discuss.elastic.co/t/how-to-visualize-deeper-into-a-donut-chart/318017 "2022-11-10T10:23:57Z")
Hi! We'd like to implement something similar to the "baobab" tool on Ubuntu. It's a tool that displays information about the size of all the folders and files in the hard drive. It starts with a simple donut chart repr… --- ## [Filebeat -\> Exiting: failed reading meta file: unexpected end of JSON input](https://discuss.elastic.co/t/filebeat-exiting-failed-reading-meta-file-unexpected-end-of-json-input/318535)
**Author:** [@Dissonance](https://discuss.elastic.co/u/Dissonance)\ **Replies:** 3\ **Last updated:** [November 10, 2022, 10:21am UTC](https://discuss.elastic.co/t/filebeat-exiting-failed-reading-meta-file-unexpected-end-of-json-input/318535 "2022-11-10T10:21:32Z")
Good afternoon, OS: Ubuntu 22.04 I tried Filebeat (version 8.5 and 7.17.1). Both versions cannot be started with the error: {"log.level":"error","@timestamp":"2022-11-09T11:28:21.598Z","log.origin":{"file.name":"insta… --- ## [Access request header in plugin configuration](https://discuss.elastic.co/t/access-request-header-in-plugin-configuration/318642)
**Author:** [@dhggw](https://discuss.elastic.co/u/dhggw)\ **Replies:** 0\ **Last updated:** [November 10, 2022, 10:08am UTC](https://discuss.elastic.co/t/access-request-header-in-plugin-configuration/318642 "2022-11-10T10:08:47Z")
Hi all, we use the Http input plugin to process events via http request in Logstash. The Logstash version is 7.16.2. With the http request we get a special http header, e.g. x-test-header: test-value We now want to r… --- ## [Where to apply the JSON settings in Filebeat input section](https://discuss.elastic.co/t/where-to-apply-the-json-settings-in-filebeat-input-section/318289)
**Author:** [@yasar](https://discuss.elastic.co/u/yasar)\ **Replies:** 4\ **Last updated:** [November 10, 2022, 10:03am UTC](https://discuss.elastic.co/t/where-to-apply-the-json-settings-in-filebeat-input-section/318289 "2022-11-10T10:03:37Z")
Hi team, We would like to separate to view the JSON field and message field in kibana logs and that we found out the JSON settings below. json.keys\_under\_root: true json.add\_error\_key: true json.message\_key: log Coul… --- ## [Join two indices query where there is 1-to-many relationship](https://discuss.elastic.co/t/join-two-indices-query-where-there-is-1-to-many-relationship/318306)
**Author:** [@areobode](https://discuss.elastic.co/u/areobode)\ **Replies:** 1\ **Last updated:** [November 10, 2022, 9:58am UTC](https://discuss.elastic.co/t/join-two-indices-query-where-there-is-1-to-many-relationship/318306 "2022-11-10T09:58:57Z")
I have two indices; authors and articles. Since one author writes several articles, there are 1-to-many relationship between them. The article index has title, vote, and authorId attributes. Here is an example index. … --- ## [Elastic Agent with Private Service connect](https://discuss.elastic.co/t/elastic-agent-with-private-service-connect/318613)
**Author:** [@Chris\_Pinto](https://discuss.elastic.co/u/Chris_Pinto)\ **Replies:** 2\ **Last updated:** [November 10, 2022, 9:40am UTC](https://discuss.elastic.co/t/elastic-agent-with-private-service-connect/318613 "2022-11-10T09:40:33Z")
Hi Team, Is there a way to add multiple fleet hosts endpoint in the fleet and create a separation based on the agent policies? Our current Elastic deployment hosted on Elastic cloud has default fleet hosts and the agen… --- ## [Logstash and elasticsearch certification issue](https://discuss.elastic.co/t/logstash-and-elasticsearch-certification-issue/318326)
**Author:** [@manasa3](https://discuss.elastic.co/u/manasa3)\ **Replies:** 8\ **Last updated:** [November 10, 2022, 9:37am UTC](https://discuss.elastic.co/t/logstash-and-elasticsearch-certification-issue/318326 "2022-11-10T09:37:44Z")
below is the configuration of our conf file input { file { path =\> "C:\\Users\\Windows\\Documents\\elk\\mule.csv" start\_position =\> "beginning" } } filter { csv { columns =\> \["Title", "Author", "ID","Pages"\] … [Previous page](https://discuss.elastic.co/latest.md?page=899) [Next page](https://discuss.elastic.co/latest.md?page=901)