# Latest **URL:** https://discuss.elastic.co/latest.md?page=933 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 934 --- ## [Enable audit logging (deployment complains about format)](https://discuss.elastic.co/t/enable-audit-logging-deployment-complains-about-format/314478)
**Author:** [@Giorgi\_Jambazishvili](https://discuss.elastic.co/u/Giorgi_Jambazishvili)\ **Replies:** 1\ **Last updated:** [October 13, 2022, 4:10am UTC](https://discuss.elastic.co/t/enable-audit-logging-deployment-complains-about-format/314478 "2022-10-13T04:10:35Z")
I try to enable logging on elastic cloud deployment. For this I change the cluster configuration and my yml looks like this: This configuration complains about the fact that "include" should be type of "text" (" \* Elast… --- ## [Does a Fleet server need to be its own machine?](https://discuss.elastic.co/t/does-a-fleet-server-need-to-be-its-own-machine/315904)
**Author:** [@Tucker\_Green](https://discuss.elastic.co/u/Tucker_Green)\ **Replies:** 1\ **Last updated:** [October 13, 2022, 3:49am UTC](https://discuss.elastic.co/t/does-a-fleet-server-need-to-be-its-own-machine/315904 "2022-10-13T03:49:10Z")
Hey guys, I am trying to get the stack up and running, but I am having some trouble with Fleet. My first question is.. does Fleet need to be installed on its own VM, or can it be installed on the same one as elasticsearc… --- ## [Elasticsearch version for master and data node](https://discuss.elastic.co/t/elasticsearch-version-for-master-and-data-node/316480)
**Author:** [@Wan\_Nur\_Athirah\_Wan](https://discuss.elastic.co/u/Wan_Nur_Athirah_Wan)\ **Replies:** 0\ **Last updated:** [October 13, 2022, 3:27am UTC](https://discuss.elastic.co/t/elasticsearch-version-for-master-and-data-node/316480 "2022-10-13T03:27:59Z")
Hai. I have one urgent question where below here is my concern: my client have his own master server where he claimed node and master need to be in same version in order to make Elasticsearch works. do the version nee… --- ## [Failed to connect to backoff(elasticsearch(https://\)): Connection marked as failed because the onConnect callback failed: open /usr/share/apm-server/bin/ingest/pipeline/definition.json: no such file or directory](https://discuss.elastic.co/t/failed-to-connect-to-backoff-elasticsearch-https-es-connection-marked-as-failed-because-the-onconnect-callback-failed-open-usr-share-apm-server-bin-ingest-pipeline-definition-json-no-such-file-or-directory/315700)
**Author:** [@preetish\_P](https://discuss.elastic.co/u/preetish_P)\ **Replies:** 3\ **Last updated:** [October 13, 2022, 2:49am UTC](https://discuss.elastic.co/t/failed-to-connect-to-backoff-elasticsearch-https-es-connection-marked-as-failed-because-the-onconnect-callback-failed-open-usr-share-apm-server-bin-ingest-pipeline-definition-json-no-such-file-or-directory/315700 "2022-10-13T02:49:06Z")
Hello, We are running ELK stack v7.11.2 in 3 node cluster (RHEL7) and trying to implement APM server with Node JS agent. APM server is installed in 2 nodes out of the 3 and each will point to all 3 ES nodes. Below is … --- ## [CircuitBreakingException\[\[fielddata\] Data too large, data for \[\_id\] would be \[3105987990/2.8gb\],](https://discuss.elastic.co/t/circuitbreakingexception-fielddata-data-too-large-data-for-id-would-be-3105987990-2-8gb/316423)
**Author:** [@sasvmware](https://discuss.elastic.co/u/sasvmware)\ **Replies:** 2\ **Last updated:** [October 13, 2022, 2:10am UTC](https://discuss.elastic.co/t/circuitbreakingexception-fielddata-data-too-large-data-for-id-would-be-3105987990-2-8gb/316423 "2022-10-13T02:10:56Z")
Hi team, Getting below error while executing query through api. But query is working fine with postman and kibana. \[2022-10-12T02:09:20,323\]\[WARN \]\[o.e.i.b.fielddata \] \[cpq-xxxx-xxxmd1.xxxxxx.com\] \[fielddata\] Ne… --- ## [How do I copy and modify a schema?](https://discuss.elastic.co/t/how-do-i-copy-and-modify-a-schema/316477)
**Author:** [@wpm](https://discuss.elastic.co/u/wpm)\ **Replies:** 1\ **Last updated:** [October 13, 2022, 12:59am UTC](https://discuss.elastic.co/t/how-do-i-copy-and-modify-a-schema/316477 "2022-10-13T00:59:06Z")
I indexed a bunch of documents and let Elastic automatically pick the field types. It got some of them right and some of them wrong. (e.g. a field is keyword when it should be string and vice versa). My documents have ma… --- ## [More like this query term questions](https://discuss.elastic.co/t/more-like-this-query-term-questions/316163)
**Author:** [@catmanjan](https://discuss.elastic.co/u/catmanjan)\ **Replies:** 1\ **Last updated:** [October 13, 2022, 12:41am UTC](https://discuss.elastic.co/t/more-like-this-query-term-questions/316163 "2022-10-13T00:41:47Z")
We are using the More like this query and we have some questions about its operation (I have read this page More like this query | Elasticsearch Guide \[8.4\] | Elastic) max\_query\_terms: The maximum number of query terms … --- ## [Keystore in Elastic Cloud](https://discuss.elastic.co/t/keystore-in-elastic-cloud/316459)
**Author:** [@rlperry](https://discuss.elastic.co/u/rlperry)\ **Replies:** 1\ **Last updated:** [October 13, 2022, 12:04am UTC](https://discuss.elastic.co/t/keystore-in-elastic-cloud/316459 "2022-10-13T00:04:38Z")
Secrets keystore for secure settings | Logstash Reference \[8.4\] | Elastic outlines how to use environment variables inside pipelines and how to create and maintain a Keystore in the path.settings directory. How does one… --- ## [Unreasonable search returns](https://discuss.elastic.co/t/unreasonable-search-returns/315062)
**Author:** [@Leroy\_Livingston](https://discuss.elastic.co/u/Leroy_Livingston)\ **Replies:** 7\ **Last updated:** [October 12, 2022, 10:43pm UTC](https://discuss.elastic.co/t/unreasonable-search-returns/315062 "2022-10-12T22:43:24Z")
I'm getting different results for specific search terms where if I search over a large number of fields it returns the correct number of items, but if I search over a smaller number of fields it returns a different numbe… --- ## [Elasticsearch stateless roadmap](https://discuss.elastic.co/t/elasticsearch-stateless-roadmap/316306)
**Author:** [@Nirdoc](https://discuss.elastic.co/u/Nirdoc)\ **Replies:** 0\ **Last updated:** [October 11, 2022, 9:35am UTC](https://discuss.elastic.co/t/elasticsearch-stateless-roadmap/316306 "2022-10-11T09:35:01Z")
Reading this recently published blog post I wonder how was this indexing improvement achieved. I have two main questions: What kind of storage was used for the stateful cluster? Was it network based storage or local SS… --- ## [Restoring Kibana related indices and users in 7.17?](https://discuss.elastic.co/t/restoring-kibana-related-indices-and-users-in-7-17/316433)
**Author:** [@NetwarSystem](https://discuss.elastic.co/u/NetwarSystem)\ **Replies:** 0\ **Last updated:** [October 12, 2022, 11:57am UTC](https://discuss.elastic.co/t/restoring-kibana-related-indices-and-users-in-7-17/316433 "2022-10-12T11:57:47Z")
I have a system running Elasticsearch and Kibana 7.17.6. This is a single host with roughly 600 million items in 300 indices. The host OS is Ubuntu 22.04. Earlier today a clumsy rsync command on my part stepped on some … --- ## [Error Starting Kibana 8.4.3 Onpremise](https://discuss.elastic.co/t/error-starting-kibana-8-4-3-onpremise/316454)
**Author:** [@LeoCP](https://discuss.elastic.co/u/LeoCP)\ **Replies:** 2\ **Last updated:** [October 12, 2022, 9:26pm UTC](https://discuss.elastic.co/t/error-starting-kibana-8-4-3-onpremise/316454 "2022-10-12T21:26:50Z")
respectful greeting, I am evaluating the onpremise version of elasticsearch & Kibana 8.4.3 on windows 10, starting Elasticsearch, it works ok, I can see it http://localhost:9200/...... but when I try to run kibana. I ge… --- ## [How can I collect Palo Alto firewall metrics (CPU, RAM, Disk usage)](https://discuss.elastic.co/t/how-can-i-collect-palo-alto-firewall-metrics-cpu-ram-disk-usage/316097)
**Author:** [@shortone](https://discuss.elastic.co/u/shortone)\ **Replies:** 1\ **Last updated:** [October 12, 2022, 6:52pm UTC](https://discuss.elastic.co/t/how-can-i-collect-palo-alto-firewall-metrics-cpu-ram-disk-usage/316097 "2022-10-12T18:52:42Z")
Hello! I've recently setup the elastic agent on an intermediate host, I have syslog forwarding from our palo alto firewall to this host which is then shipping to elasticsearch and the palo alto integration seems to be w… --- ## [Group regex while search](https://discuss.elastic.co/t/group-regex-while-search/316461)
**Author:** [@Indeed2000](https://discuss.elastic.co/u/Indeed2000)\ **Replies:** 0\ **Last updated:** [October 12, 2022, 6:09pm UTC](https://discuss.elastic.co/t/group-regex-while-search/316461 "2022-10-12T18:09:27Z")
Hi I have log file that contain lines like this: 08:00:00.032 user parameter: A\[0\]B\[0\]C: Action successful. How can i extract A value, B value while searching with regular expression. FYI:i don't want to change a… --- ## [Why logstash merge index of 3 different config?](https://discuss.elastic.co/t/why-logstash-merge-index-of-3-different-config/316450)
**Author:** [@Nikolas1306](https://discuss.elastic.co/u/Nikolas1306)\ **Replies:** 2\ **Last updated:** [October 12, 2022, 4:12pm UTC](https://discuss.elastic.co/t/why-logstash-merge-index-of-3-different-config/316450 "2022-10-12T16:12:07Z")
i ve 3 config but i see the 3 index is similar why ? all index contais info all 3 index this is my type config is different for path and name index in \*\* lines input { file { \*\*path =\> \[ "/logstash\_dir/fede… --- ## [Best solution for Aggregation SUM without losing precision](https://discuss.elastic.co/t/best-solution-for-aggregation-sum-without-losing-precision/316448)
**Author:** [@SooperTee](https://discuss.elastic.co/u/SooperTee)\ **Replies:** 0\ **Last updated:** [October 12, 2022, 3:35pm UTC](https://discuss.elastic.co/t/best-solution-for-aggregation-sum-without-losing-precision/316448 "2022-10-12T15:35:44Z")
Hi All, I think maybe similar subject was brought up here before, however, I was not able to find a satisfactory answer from the past posts in this forum. So I create a post of my own. I would like to state the constra… --- ## [Filebeat-Apache Module- Nodata](https://discuss.elastic.co/t/filebeat-apache-module-nodata/314977)
**Author:** [@emmanuel\_stevens\_LED](https://discuss.elastic.co/u/emmanuel_stevens_LED)\ **Replies:** 5\ **Last updated:** [October 12, 2022, 3:27pm UTC](https://discuss.elastic.co/t/filebeat-apache-module-nodata/314977 "2022-10-12T15:27:56Z")
Hello, I configure filebeat in my system, the probleme is, whaen i configure the modure system , i receive all datas and graphic, it is not the same for apache. We donot receive anaything I have enable the module and c… --- ## [Performance bottleneck enriching documents due to only a single node processing the ingest pipelines](https://discuss.elastic.co/t/performance-bottleneck-enriching-documents-due-to-only-a-single-node-processing-the-ingest-pipelines/315950)
**Author:** [@JvSPV](https://discuss.elastic.co/u/JvSPV)\ **Replies:** 6\ **Last updated:** [October 12, 2022, 3:24pm UTC](https://discuss.elastic.co/t/performance-bottleneck-enriching-documents-due-to-only-a-single-node-processing-the-ingest-pipelines/315950 "2022-10-12T15:24:03Z")
We have a cluster of 4 nodes: A, B, C, and D. All four have all default roles assigned, including the ingest role. We also have a separate master node. We have recently put new ingest pipelines into use with which we en… --- ## [Hierarchical Facets using out-of-the-box Search UI](https://discuss.elastic.co/t/hierarchical-facets-using-out-of-the-box-search-ui/316314)
**Author:** [@Rustin\_Spencer](https://discuss.elastic.co/u/Rustin_Spencer)\ **Replies:** 3\ **Last updated:** [October 12, 2022, 3:14pm UTC](https://discuss.elastic.co/t/hierarchical-facets-using-out-of-the-box-search-ui/316314 "2022-10-12T15:14:17Z")
I'm trying to implement hierarchical facets (Province -\> District) using out-of-the-box Search UI. With searchDriver can I do facets like this Province 1 - District 1-1 - District 1-2 Province 2 - District 2… --- ## [Logstash cut line why?](https://discuss.elastic.co/t/logstash-cut-line-why/316440)
**Author:** [@Nikolas1306](https://discuss.elastic.co/u/Nikolas1306)\ **Replies:** 4\ **Last updated:** [October 12, 2022, 2:51pm UTC](https://discuss.elastic.co/t/logstash-cut-line-why/316440 "2022-10-12T14:51:06Z")
i have this secotion of logs 2022-09-28 16:19:49,383 ERROR \[it.unidoc.cdr.core.route.Iti41MllpSource\] (TcpSocketConsumerRunnable\[mllp://0.0.0.0:9010\] - /192.168.0.7:56372 =\> /192.168.0.32:9010) Conversion error: ca.uhn… --- ## [Enrich execution takes long time (about 3 min)](https://discuss.elastic.co/t/enrich-execution-takes-long-time-about-3-min/316390)
**Author:** [@hyungsun\_lim](https://discuss.elastic.co/u/hyungsun_lim)\ **Replies:** 2\ **Last updated:** [October 12, 2022, 2:15pm UTC](https://discuss.elastic.co/t/enrich-execution-takes-long-time-about-3-min/316390 "2022-10-12T14:15:02Z")
We use elasticsearch 7.5.0 version, and we use enrich pipelint to join two index every 15 min. However, enrich execution time takes about 3-5 min. It's so long time... I don't know the exact cause. What is the altern… --- ## [Kibana 8.4.2 dashboard date filter not working in firefox](https://discuss.elastic.co/t/kibana-8-4-2-dashboard-date-filter-not-working-in-firefox/316437)
**Author:** [@Jonas\_S](https://discuss.elastic.co/u/Jonas_S)\ **Replies:** 1\ **Last updated:** [October 12, 2022, 2:04pm UTC](https://discuss.elastic.co/t/kibana-8-4-2-dashboard-date-filter-not-working-in-firefox/316437 "2022-10-12T14:04:42Z")
Hello, when i try to add a filter for a date field with the add filter menu in firefox, the date given is not recognized. In chrome it works fine. I type for example 1.1.22, press tab and the date is there: Trying … --- ## [Can I convert a string column type to a timestamp?](https://discuss.elastic.co/t/can-i-convert-a-string-column-type-to-a-timestamp/316385)
**Author:** [@wpm](https://discuss.elastic.co/u/wpm)\ **Replies:** 1\ **Last updated:** [October 12, 2022, 1:38pm UTC](https://discuss.elastic.co/t/can-i-convert-a-string-column-type-to-a-timestamp/316385 "2022-10-12T13:38:06Z")
I ingested a bunch of documents. They have a property "time" containing strings of the form "2015-01-20 07:52:05.013047". I let Elastic automatically detect the data types and it treated "time" as a string. The schema ha… --- ## [Operator will not start](https://discuss.elastic.co/t/operator-will-not-start/316104)
**Author:** [@Jeff\_Rankin](https://discuss.elastic.co/u/Jeff_Rankin)\ **Replies:** 1\ **Last updated:** [October 12, 2022, 12:33pm UTC](https://discuss.elastic.co/t/operator-will-not-start/316104 "2022-10-12T12:33:03Z")
My operator which has worked just fine for a couple of years (with upgrades of course) is failing today. Logs are below. We had some kubernetes issues earlier but they are are all fixed now. This is the only issue we … --- ## [Warning : regular expression has redundant nested repeat operator](https://discuss.elastic.co/t/warning-regular-expression-has-redundant-nested-repeat-operator/316436)
**Author:** [@PM75](https://discuss.elastic.co/u/PM75)\ **Replies:** 0\ **Last updated:** [October 12, 2022, 12:26pm UTC](https://discuss.elastic.co/t/warning-regular-expression-has-redundant-nested-repeat-operator/316436 "2022-10-12T12:26:51Z")
Hello, After an update to version 8.4.3, I have this warning: regular expression has redundant nested repeat operator I took the time to search for it, but no post was found: \[ES 7.6\] regular expression has redundant… --- ## [Not able to view new features in Elastic security 8.4 i.e. (Respond Action0](https://discuss.elastic.co/t/not-able-to-view-new-features-in-elastic-security-8-4-i-e-respond-action0/316409)
**Author:** [@theacodes](https://discuss.elastic.co/u/theacodes)\ **Replies:** 2\ **Last updated:** [October 12, 2022, 12:19pm UTC](https://discuss.elastic.co/t/not-able-to-view-new-features-in-elastic-security-8-4-i-e-respond-action0/316409 "2022-10-12T12:19:31Z")
Hi! As shown in this video below section \[Purpose-built response automation interface \] Elastic Security 8.4: SOAR for modern security operations arms analysts to remediate threats faster | Elastic Blog where we go to … --- ## [I can't use the bulk function on my centos8](https://discuss.elastic.co/t/i-cant-use-the-bulk-function-on-my-centos8/316361)
**Author:** [@Vitoria\_De\_Lara](https://discuss.elastic.co/u/Vitoria_De_Lara)\ **Replies:** 1\ **Last updated:** [October 12, 2022, 12:17pm UTC](https://discuss.elastic.co/t/i-cant-use-the-bulk-function-on-my-centos8/316361 "2022-10-12T12:17:47Z")
{ "error" : { "root\_cause" : \[ { "type" : "illegal\_argument\_exception", "reason" : "Malformed action/metadata line \[3\], expected START\_OBJECT or END\_OBJECT but found \[VALUE\_STRING\]" } \], "type" : "illegal\_argumen… --- ## [How to properly close a connection in a Java API Client?](https://discuss.elastic.co/t/how-to-properly-close-a-connection-in-a-java-api-client/314995)
**Author:** [@jacksparrow414](https://discuss.elastic.co/u/jacksparrow414)\ **Replies:** 5\ **Last updated:** [October 12, 2022, 11:58am UTC](https://discuss.elastic.co/t/how-to-properly-close-a-connection-in-a-java-api-client/314995 "2022-10-12T11:58:10Z")
Configuration Sample Code @ApplicationScoped public class ElasticSearchConfiguration { private static ElasticsearchClient client; private static synchronized void connectElasticSearchCluster() { if (Ob… --- ## [MSSQL span durations inaccurate when sourced from SqlClientDiagnosticListener](https://discuss.elastic.co/t/mssql-span-durations-inaccurate-when-sourced-from-sqlclientdiagnosticlistener/316225)
**Author:** [@andrew012345](https://discuss.elastic.co/u/andrew012345)\ **Replies:** 1\ **Last updated:** [October 12, 2022, 11:36am UTC](https://discuss.elastic.co/t/mssql-span-durations-inaccurate-when-sourced-from-sqlclientdiagnosticlistener/316225 "2022-10-12T11:36:20Z")
Kibana version: 7.17.3 Elasticsearch version: 7.17.3 APM Server version: 7.17.3 APM Agent language and version: dotnet 1.14.1 + 1.17.0 Browser version: N/A Original install method (e.g. download page, yum, deb, from… --- ## [Lucene query for string containing # (hash symbol)](https://discuss.elastic.co/t/lucene-query-for-string-containing-hash-symbol/316429)
**Author:** [@ykara84](https://discuss.elastic.co/u/ykara84)\ **Replies:** 0\ **Last updated:** [October 12, 2022, 11:28am UTC](https://discuss.elastic.co/t/lucene-query-for-string-containing-hash-symbol/316429 "2022-10-12T11:28:42Z")
How to query in Lucene for strings containing special characters such as @ and # for example #rescheduled i.e. it has to have the # in front of the word and not just the word itself, currently getting: Tried all sorts o… [Previous page](https://discuss.elastic.co/latest.md?page=932) [Next page](https://discuss.elastic.co/latest.md?page=934)