# Latest **URL:** https://discuss.elastic.co/latest.md?page=927 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 928 --- ## [Winlogbeat SSL connection to ES\\Kibana](https://discuss.elastic.co/t/winlogbeat-ssl-connection-to-es-kibana/316645)
**Author:** [@EExisT](https://discuss.elastic.co/u/EExisT)\ **Replies:** 4\ **Last updated:** [October 18, 2022, 3:27pm UTC](https://discuss.elastic.co/t/winlogbeat-ssl-connection-to-es-kibana/316645 "2022-10-18T15:27:38Z")
Hello, i have an Ubuntu VM where I run ES and Kibana and a Windows VM where i want to run Winlogbeat. The idea is to send windows events to ES and visualise it with Kibana. Kibana is reachable by browser from both VMs… --- ## [Sending Data to elasticsearch](https://discuss.elastic.co/t/sending-data-to-elasticsearch/316911)
**Author:** [@VitorBarroso](https://discuss.elastic.co/u/VitorBarroso)\ **Replies:** 0\ **Last updated:** [October 18, 2022, 3:11pm UTC](https://discuss.elastic.co/t/sending-data-to-elasticsearch/316911 "2022-10-18T15:11:26Z")
Hello, When i try to connect to my elasticsearch, i have this problem. If i dont use ca\_certs, its ok but i have the warnings because i dont use the ssl, but when i use the ssl, i have this error( elastic\_transport.Tl… --- ## [The result of "metricbeat test modules sql" has timeout failure when the query does not have any output](https://discuss.elastic.co/t/the-result-of-metricbeat-test-modules-sql-has-timeout-failure-when-the-query-does-not-have-any-output/316874)
**Author:** [@donald\_b90](https://discuss.elastic.co/u/donald_b90)\ **Replies:** 1\ **Last updated:** [October 18, 2022, 3:01pm UTC](https://discuss.elastic.co/t/the-result-of-metricbeat-test-modules-sql-has-timeout-failure-when-the-query-does-not-have-any-output/316874 "2022-10-18T15:01:32Z")
Hi All, First of all, I appreciate your attention in advance. Since, I am new in using ELK Stack, I have one question. I have one simple query in my sql.yml file which returns no records (The sql module is enabled). /… --- ## [No data log in Discover section](https://discuss.elastic.co/t/no-data-log-in-discover-section/316775)
**Author:** [@EExisT](https://discuss.elastic.co/u/EExisT)\ **Replies:** 1\ **Last updated:** [October 18, 2022, 2:29pm UTC](https://discuss.elastic.co/t/no-data-log-in-discover-section/316775 "2022-10-18T14:29:46Z")
Hi, I'm sending Winlogbeat events form a Windows VM to an Ubuntu VM, where are running both ES than Kibana. The VM's are on the same subnet and I can access the https Kibana GUI from both VM's. If I go to "Stack Manag… --- ## [Frontend click metrics](https://discuss.elastic.co/t/frontend-click-metrics/316563)
**Author:** [@batata](https://discuss.elastic.co/u/batata)\ **Replies:** 2\ **Last updated:** [October 18, 2022, 2:23pm UTC](https://discuss.elastic.co/t/frontend-click-metrics/316563 "2022-10-18T14:23:31Z")
Hi. I'm new to Elastic and I have been reading the docs for what I need and I can't find something precise. I want a metric click event only on some parts of the interface. This button triggers a third party widget ap… --- ## [ElasticSearch snapshots are not visisble](https://discuss.elastic.co/t/elasticsearch-snapshots-are-not-visisble/316808)
**Author:** [@not\_correct](https://discuss.elastic.co/u/not_correct)\ **Replies:** 7\ **Last updated:** [October 18, 2022, 2:12pm UTC](https://discuss.elastic.co/t/elasticsearch-snapshots-are-not-visisble/316808 "2022-10-18T14:12:39Z")
Hi, I have Elasticsearch cluster running and s3 bucket that contains snapshot files to this cluster. However, when I first listed \_snapshot/\_all no repository, and/or snapshots were found. I added the repository using t… --- ## [Logstash hardware requirements](https://discuss.elastic.co/t/logstash-hardware-requirements/316851)
**Author:** [@perezdev](https://discuss.elastic.co/u/perezdev)\ **Replies:** 1\ **Last updated:** [October 18, 2022, 1:55pm UTC](https://discuss.elastic.co/t/logstash-hardware-requirements/316851 "2022-10-18T13:55:32Z")
Hello, I'm going to install logstash in a Linux VM. I'm trying to find out the best hardware requirements for this VM so that logstash could handle the amount of data expected as smooth as possible. The amount of data … --- ## [How to Apply cross filtering only to plots that can be applied and avoid the remaining](https://discuss.elastic.co/t/how-to-apply-cross-filtering-only-to-plots-that-can-be-applied-and-avoid-the-remaining/316606)
**Author:** [@eleven\_e](https://discuss.elastic.co/u/eleven_e)\ **Replies:** 3\ **Last updated:** [October 18, 2022, 1:52pm UTC](https://discuss.elastic.co/t/how-to-apply-cross-filtering-only-to-plots-that-can-be-applied-and-avoid-the-remaining/316606 "2022-10-18T13:52:17Z")
I'm working on a dashboard and I have 2 indices with different structure and when i apply the cross filtering by clicking on a particular bar in a bar graph the data gets filtered and some plots turn to 'NO RESULTS FOUND… --- ## [Unable to create snapshot repo in azure](https://discuss.elastic.co/t/unable-to-create-snapshot-repo-in-azure/316804)
**Author:** [@jaykb77](https://discuss.elastic.co/u/jaykb77)\ **Replies:** 5\ **Last updated:** [October 18, 2022, 1:33pm UTC](https://discuss.elastic.co/t/unable-to-create-snapshot-repo-in-azure/316804 "2022-10-18T13:33:58Z")
Im trying to register an azure blob as snapshot repository. I have already tested this with elasticsearch 7.17 on test VMs outside my firm but it is failing when Im trying the same steps inside the firm. My first impre… --- ## [How to specify an UNC-Path (network share) for logstash file input plugin](https://discuss.elastic.co/t/how-to-specify-an-unc-path-network-share-for-logstash-file-input-plugin/316900)
**Author:** [@simon137](https://discuss.elastic.co/u/simon137)\ **Replies:** 0\ **Last updated:** [October 18, 2022, 1:29pm UTC](https://discuss.elastic.co/t/how-to-specify-an-unc-path-network-share-for-logstash-file-input-plugin/316900 "2022-10-18T13:29:16Z")
Hello, I tried specifying a UNC-Path for the "path"-Setting of the logstash file input plugin and unfortunately it doesn't work. Is this a known issue or does someone here know how to get this to work on a windows masc… --- ## [Inode change without reason](https://discuss.elastic.co/t/inode-change-without-reason/316898)
**Author:** [@Victor\_Caetano](https://discuss.elastic.co/u/Victor_Caetano)\ **Replies:** 0\ **Last updated:** [October 18, 2022, 1:23pm UTC](https://discuss.elastic.co/t/inode-change-without-reason/316898 "2022-10-18T13:23:37Z")
I Have an ELK stack stablished using the following workflow A DB2 server generating logs in .txt format, a FTP for ingest those logs into a S3 bucket in my AWS environment Than a s3fs-fuse mount system, using this S3 b… --- ## [How come recoveries for a given shard with EMPTY\_STORE is not showing but the index has data?](https://discuss.elastic.co/t/how-come-recoveries-for-a-given-shard-with-empty-store-is-not-showing-but-the-index-has-data/316894)
**Author:** [@jmlucjav](https://discuss.elastic.co/u/jmlucjav)\ **Replies:** 0\ **Last updated:** [October 18, 2022, 1:08pm UTC](https://discuss.elastic.co/t/how-come-recoveries-for-a-given-shard-with-empty-store-is-not-showing-but-the-index-has-data/316894 "2022-10-18T13:08:39Z")
I have an index in red state. It has some docs, so at some point it was in yellow or green..But if I run GET/indexA/\_recovery I get entries for shards 0 and 2, but shard 1 is not showing up at all, does it mean it was … --- ## [Convert java query output in json format](https://discuss.elastic.co/t/convert-java-query-output-in-json-format/316893)
**Author:** [@Shubh](https://discuss.elastic.co/u/Shubh)\ **Replies:** 0\ **Last updated:** [October 18, 2022, 1:06pm UTC](https://discuss.elastic.co/t/convert-java-query-output-in-json-format/316893 "2022-10-18T13:06:31Z")
Hi all, can someone help get my java query output in json format im just printing it in line and now i want to upgrade my code output tried multiple ways but no luck. Below is my code elasticsearch java api code. try… --- ## [Tons of Alerts Using "Threat Intel Indicator Match"](https://discuss.elastic.co/t/tons-of-alerts-using-threat-intel-indicator-match/316783)
**Author:** [@Viral-Technology](https://discuss.elastic.co/u/Viral-Technology)\ **Replies:** 4\ **Last updated:** [October 18, 2022, 11:44am UTC](https://discuss.elastic.co/t/tons-of-alerts-using-threat-intel-indicator-match/316783 "2022-10-18T11:44:15Z")
Hello Elastic Community!! in the last few days I have received a ton of alerts using "Threat Intel Indicator match" it is matching specific ports with specific Ip addresses. however, after researching, I have found th… --- ## [Standard Memory recommendation for each POD having 3 node cluster running on Elasticsearch 7.17.1](https://discuss.elastic.co/t/standard-memory-recommendation-for-each-pod-having-3-node-cluster-running-on-elasticsearch-7-17-1/316854)
**Author:** [@bikas](https://discuss.elastic.co/u/bikas)\ **Replies:** 2\ **Last updated:** [October 18, 2022, 10:24am UTC](https://discuss.elastic.co/t/standard-memory-recommendation-for-each-pod-having-3-node-cluster-running-on-elasticsearch-7-17-1/316854 "2022-10-18T10:24:08Z")
Hello, I would like to know the recommended Memory needs to be allocated to Elasticsearch 7.17.1 POD. Currently we have 3 node cluster deployed in GKE. Each POD is being allocated to 4GB RAM and 50% of its memory to Hea… --- ## [Writing events to different indexes through a variable](https://discuss.elastic.co/t/writing-events-to-different-indexes-through-a-variable/316814)
**Author:** [@Aleksei](https://discuss.elastic.co/u/Aleksei)\ **Replies:** 7\ **Last updated:** [October 18, 2022, 10:19am UTC](https://discuss.elastic.co/t/writing-events-to-different-indexes-through-a-variable/316814 "2022-10-18T10:19:22Z")
Hi everyone I did not find a suitable topic in the community, I decided to create a topic. Has anyone tried this configuration ? output { \*\* \*\* elasticsearch { \*\* \*\* index =\> "%{\[some\_field\]\[sub\_field\]}-… --- ## [High cpu usage during search](https://discuss.elastic.co/t/high-cpu-usage-during-search/316795)
**Author:** [@faisal.k](https://discuss.elastic.co/u/faisal.k)\ **Replies:** 9\ **Last updated:** [October 18, 2022, 9:52am UTC](https://discuss.elastic.co/t/high-cpu-usage-during-search/316795 "2022-10-18T09:52:18Z")
Hello, I have tried to read through most of the topics and tried with the suggestions, nothing has helped so far. We are running an elasticsearch cluster (v7.16.1) with 2 nodes (4 CPUs, heap assigned as 16GB - physical… --- ## [Can we use conditions in input plugin of logstash](https://discuss.elastic.co/t/can-we-use-conditions-in-input-plugin-of-logstash/316873)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 0\ **Last updated:** [October 18, 2022, 9:51am UTC](https://discuss.elastic.co/t/can-we-use-conditions-in-input-plugin-of-logstash/316873 "2022-10-18T09:51:46Z")
Hi team, Can we used multiple inputs plugin based on conditions we have specified --- ## [How to extract timestamp and log level from message and add it as a filed](https://discuss.elastic.co/t/how-to-extract-timestamp-and-log-level-from-message-and-add-it-as-a-filed/316639)
**Author:** [@Akumar22](https://discuss.elastic.co/u/Akumar22)\ **Replies:** 6\ **Last updated:** [October 18, 2022, 9:47am UTC](https://discuss.elastic.co/t/how-to-extract-timestamp-and-log-level-from-message-and-add-it-as-a-filed/316639 "2022-10-18T09:47:42Z")
Hi I want to extract timestamp and log level from message and want to add it as a field can you please suggest some filter or grok pattern to do this sample log : 2022-10-12 12:02:32,611 \[DEBUG\]\[pool-5-thread-14\]\[com.… --- ## [Palo alto sent to server via syslog](https://discuss.elastic.co/t/palo-alto-sent-to-server-via-syslog/316870)
**Author:** [@GEHsu](https://discuss.elastic.co/u/GEHsu)\ **Replies:** 0\ **Last updated:** [October 18, 2022, 9:40am UTC](https://discuss.elastic.co/t/palo-alto-sent-to-server-via-syslog/316870 "2022-10-18T09:40:34Z")
I tried paloalto (TRAFFIC/THREAT) 2 kinds of logs. Build to a different index. Below is my Logstash config input { syslog { port =\> "4560" } } filter { # Traffic Logs grok { match =\> { "message" =\> "%{… --- ## [Error 400 when using API to create index pattern](https://discuss.elastic.co/t/error-400-when-using-api-to-create-index-pattern/316791)
**Author:** [@JorisV](https://discuss.elastic.co/u/JorisV)\ **Replies:** 1\ **Last updated:** [October 18, 2022, 9:34am UTC](https://discuss.elastic.co/t/error-400-when-using-api-to-create-index-pattern/316791 "2022-10-18T09:34:52Z")
Hi, i'm trying to use Kibana API to create an index pattern with a specific ID. Here's my code var req0 = new XMLHttpRequest(); var req1 = new XMLHttpRequest(); req0.open("DELETE","https://my.server/kb/api/index\_patter… --- ## [Filebeat and logstash ssl config is correct?](https://discuss.elastic.co/t/filebeat-and-logstash-ssl-config-is-correct/316868)
**Author:** [@Nikolas1306](https://discuss.elastic.co/u/Nikolas1306)\ **Replies:** 1\ **Last updated:** [October 18, 2022, 9:31am UTC](https://discuss.elastic.co/t/filebeat-and-logstash-ssl-config-is-correct/316868 "2022-10-18T09:31:23Z")
filebeat filebeat.inputs: - type: filestream paths: - G:\\filebeat-8.4.3-windows-x86\_64\\logs\\\*.\* output.logstash: hosts: \["172.22.10.202:5044"\] protocol: "http" ssl.enabled: true ssl.certificate\_a… --- ## [Unhide System Indices](https://discuss.elastic.co/t/unhide-system-indices/316736)
**Author:** [@Ankita\_Pachauri](https://discuss.elastic.co/u/Ankita_Pachauri)\ **Replies:** 7\ **Last updated:** [October 18, 2022, 8:04am UTC](https://discuss.elastic.co/t/unhide-system-indices/316736 "2022-10-18T08:04:32Z")
Hi Team, I am using searchguard for alerting purpose. The indices of searchguard are stored in elasticsearch with .signals naming convention. I need to get the alert ID for the alerts. However, i cannot write a search q… --- ## [Domain redirection is not happening for workplace search endpoint](https://discuss.elastic.co/t/domain-redirection-is-not-happening-for-workplace-search-endpoint/316852)
**Author:** [@Elastic\_User3](https://discuss.elastic.co/u/Elastic_User3)\ **Replies:** 0\ **Last updated:** [October 18, 2022, 7:51am UTC](https://discuss.elastic.co/t/domain-redirection-is-not-happening-for-workplace-search-endpoint/316852 "2022-10-18T07:51:37Z")
we tried to change the domain and redirect to searchcapillary.com but its not happening. https://searchabc.in we are trying to point below mentioned endpoint to above mentioned end point, but once we done with that. we… --- ## [Add a new field to the .ml-anomalies-shared index](https://discuss.elastic.co/t/add-a-new-field-to-the-ml-anomalies-shared-index/316847)
**Author:** [@irivas95](https://discuss.elastic.co/u/irivas95)\ **Replies:** 0\ **Last updated:** [October 18, 2022, 6:58am UTC](https://discuss.elastic.co/t/add-a-new-field-to-the-ml-anomalies-shared-index/316847 "2022-10-18T06:58:26Z")
Hi, I need to add a new field, "anomaly level" to the .ml-anomalies-shared index to new data and already indexed data. The field would have a different value based on the value of the record score field, for example: i… --- ## [Elastic-agent disappeared](https://discuss.elastic.co/t/elastic-agent-disappeared/316846)
**Author:** [@gx\_zhao](https://discuss.elastic.co/u/gx_zhao)\ **Replies:** 0\ **Last updated:** [October 18, 2022, 6:43am UTC](https://discuss.elastic.co/t/elastic-agent-disappeared/316846 "2022-10-18T06:43:59Z")
I'm using elk 8.4.3, and deploy by eck 2.4.0. My fleet server and agents always disappeared about 10 days after enrollment. I suspect it is because I changed some Index Lifecycle Policy, like 'logs' or 'metrics', by adde… --- ## [Time Zone issue with Range Query](https://discuss.elastic.co/t/time-zone-issue-with-range-query/316764)
**Author:** [@vipin.meshram13098](https://discuss.elastic.co/u/vipin.meshram13098)\ **Replies:** 0\ **Last updated:** [October 17, 2022, 10:53am UTC](https://discuss.elastic.co/t/time-zone-issue-with-range-query/316764 "2022-10-17T10:53:12Z")
Hello, I am facing one strange issue with range query "time\_zone" parameter. I have the Elasticsearch documents stored in the server of America/Chicago timezone. Basically, I am trying to fetch records from "12:00 AM … --- ## [Create indexes from previous nginx access logs](https://discuss.elastic.co/t/create-indexes-from-previous-nginx-access-logs/316818)
**Author:** [@kosmylo](https://discuss.elastic.co/u/kosmylo)\ **Replies:** 3\ **Last updated:** [October 18, 2022, 5:21am UTC](https://discuss.elastic.co/t/create-indexes-from-previous-nginx-access-logs/316818 "2022-10-18T05:21:59Z")
I use filebeat to send nginx access logs to logstash to parse them and then to elasticsearch. The folder includes access logs my previous days, but when I deploy the ELK stack, only the newly arrived nginx access logs ar… --- ## [When starting up a ELK Cluster, one Node fails with Java lang out of memory error](https://discuss.elastic.co/t/when-starting-up-a-elk-cluster-one-node-fails-with-java-lang-out-of-memory-error/316693)
**Author:** [@AKAM14](https://discuss.elastic.co/u/AKAM14)\ **Replies:** 8\ **Last updated:** [October 18, 2022, 2:46am UTC](https://discuss.elastic.co/t/when-starting-up-a-elk-cluster-one-node-fails-with-java-lang-out-of-memory-error/316693 "2022-10-18T02:46:34Z")
I have a 3 node ELK Cluster - with two logstash and 1 kibana server . When i start my Elk cluster it is giving an error in two nodes and fails. it is all realted to Jvm memory error. I have attached the error screenshot. … --- ## [WebNMS security vulnerability](https://discuss.elastic.co/t/webnms-security-vulnerability/316766)
**Author:** [@aligege123](https://discuss.elastic.co/u/aligege123)\ **Replies:** 3\ **Last updated:** [October 18, 2022, 1:19am UTC](https://discuss.elastic.co/t/webnms-security-vulnerability/316766 "2022-10-18T01:19:18Z")
Is elasticsearch related with ZOHO webNMS ? I recently meet a vulnerability report from es http server port 9200 about webNMS. The vulnerability detail: CVE - CVE-2016-6600 (mitre.org) My elasticsearch version is 7.6.1.… [Previous page](https://discuss.elastic.co/latest.md?page=926) [Next page](https://discuss.elastic.co/latest.md?page=928)