# Latest **URL:** https://discuss.elastic.co/latest.md?page=935 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 936 --- ## [Osquery View in Discover issue](https://discuss.elastic.co/t/osquery-view-in-discover-issue/315367)
**Author:** [@matled](https://discuss.elastic.co/u/matled)\ **Replies:** 2\ **Last updated:** [October 11, 2022, 7:38pm UTC](https://discuss.elastic.co/t/osquery-view-in-discover-issue/315367 "2022-10-11T19:38:56Z")
We are running Elastic-Stack 8.4.2 (All components, inclusive the agents) and started to use Osquery. It is a great technology, however there are some problems we've encountered: Displaying the Data in Discover with the… --- ## [Elasticsearch Search Query](https://discuss.elastic.co/t/elasticsearch-search-query/316372)
**Author:** [@Ankita\_Pachauri](https://discuss.elastic.co/u/Ankita_Pachauri)\ **Replies:** 0\ **Last updated:** [October 11, 2022, 7:09pm UTC](https://discuss.elastic.co/t/elasticsearch-search-query/316372 "2022-10-11T19:09:49Z")
Hi Team, I have written a DSL Query as shown below: GET metricbeat\*/\_search { "size": 0, "aggs": { "hosts": { "terms": { "field": "agent.hostname", "size": "100", "order": { "memory": "desc" } }, "aggs": { … --- ## [Continous Alerting without rules](https://discuss.elastic.co/t/continous-alerting-without-rules/316207)
**Author:** [@OmFJ](https://discuss.elastic.co/u/OmFJ)\ **Replies:** 1\ **Last updated:** [October 11, 2022, 6:49pm UTC](https://discuss.elastic.co/t/continous-alerting-without-rules/316207 "2022-10-11T18:49:58Z")
Good evening, everyone. So i just enabled alert rules and connectors to send {{context.reason}} in elasticsearch 8.4. since we know alert only triggers when the requirements are met, is there anyway i could do to send … --- ## [How to set the max file size to unlimited in windows 10?](https://discuss.elastic.co/t/how-to-set-the-max-file-size-to-unlimited-in-windows-10/316366)
**Author:** [@JamesD\_7](https://discuss.elastic.co/u/JamesD_7)\ **Replies:** 0\ **Last updated:** [October 11, 2022, 6:30pm UTC](https://discuss.elastic.co/t/how-to-set-the-max-file-size-to-unlimited-in-windows-10/316366 "2022-10-11T18:30:03Z")
I'm ingesting a single CSV file in ES 8.4 using Kibana, but I found I hit the maximum size limit of 100k rows and had to split the file in two. I saw in the docs that you can set this file: /etc/security/limits.conf usi… --- ## [Modify ciphers used on Elasticsearch Service API endpoints?](https://discuss.elastic.co/t/modify-ciphers-used-on-elasticsearch-service-api-endpoints/315717)
**Author:** [@glg](https://discuss.elastic.co/u/glg)\ **Replies:** 6\ **Last updated:** [October 11, 2022, 6:20pm UTC](https://discuss.elastic.co/t/modify-ciphers-used-on-elasticsearch-service-api-endpoints/315717 "2022-10-11T18:20:58Z")
We use Elasticsearch Service hosted on AWS and use the hosted App Search for a custom search feature on our site. We've received a report from an end user that when they submit a search request, that an authentication di… --- ## [Multiple syslog input into logstash](https://discuss.elastic.co/t/multiple-syslog-input-into-logstash/316360)
**Author:** [@kazishafiullah](https://discuss.elastic.co/u/kazishafiullah)\ **Replies:** 2\ **Last updated:** [October 11, 2022, 5:24pm UTC](https://discuss.elastic.co/t/multiple-syslog-input-into-logstash/316360 "2022-10-11T17:24:27Z")
Hello, I wanted to parse logs of network devices into logstash. I have configured individual pipeline for cisco and paloalto. I have configured the input as syslog with different ports and output to different index name… --- ## [Filter on Aggragted Result](https://discuss.elastic.co/t/filter-on-aggragted-result/316315)
**Author:** [@ahmet\_erkol](https://discuss.elastic.co/u/ahmet_erkol)\ **Replies:** 1\ **Last updated:** [October 11, 2022, 5:24pm UTC](https://discuss.elastic.co/t/filter-on-aggragted-result/316315 "2022-10-11T17:24:23Z")
Hi, We made a map layer that calculates the average of success. We want to filter the map based on the succes rate. For example we want to show geo fileds only succes rate higher than %70. In the picture we want to fil… --- ## [org.elasticsearch.action.admin.indices.exists.indices.IndicesExistsResponse deprecated in 8.x](https://discuss.elastic.co/t/org-elasticsearch-action-admin-indices-exists-indices-indicesexistsresponse-deprecated-in-8-x/316332)
**Author:** [@Pachidermus](https://discuss.elastic.co/u/Pachidermus)\ **Replies:** 2\ **Last updated:** [October 11, 2022, 5:16pm UTC](https://discuss.elastic.co/t/org-elasticsearch-action-admin-indices-exists-indices-indicesexistsresponse-deprecated-in-8-x/316332 "2022-10-11T17:16:34Z")
Hi, org.elasticsearch.action.admin.indices.exists.indices.IndicesExistsResponse was available in 7.x but no longer in 8.x. What is the replacement for this API (needed to update a plugin to support 8.x)? Thanks. --- ## [Why "View single document" is "button" tag in HTML and not a "a" tag with URL?](https://discuss.elastic.co/t/why-view-single-document-is-button-tag-in-html-and-not-a-a-tag-with-url/315583)
**Author:** [@bryancev](https://discuss.elastic.co/u/bryancev)\ **Replies:** 2\ **Last updated:** [October 11, 2022, 5:04pm UTC](https://discuss.elastic.co/t/why-view-single-document-is-button-tag-in-html-and-not-a-a-tag-with-url/315583 "2022-10-11T17:04:14Z")
Hi all! Why in Kibana version 8.1.2 the "View single document" document view is implemented via the button tag? This is extremely inconvenient, since I would like to open documents in a new tab by clicking the mouse wh… --- ## [Trying to implement CDC transfer from MongoDB to Elasticsearch 8.4](https://discuss.elastic.co/t/trying-to-implement-cdc-transfer-from-mongodb-to-elasticsearch-8-4/316007)
**Author:** [@Venkatesh\_Guruprasad](https://discuss.elastic.co/u/Venkatesh_Guruprasad)\ **Replies:** 7\ **Last updated:** [October 11, 2022, 4:55pm UTC](https://discuss.elastic.co/t/trying-to-implement-cdc-transfer-from-mongodb-to-elasticsearch-8-4/316007 "2022-10-11T16:55:25Z")
We are trying to implement CDC transfer from MongoDB to Elasticsearch 8.4. Do we have to manually create index mappings for each Mongo collection or can we enable dynamic mappings on create within Elasticsearch --- ## [Spring + ElasticSearch - How to bulk create or update document with autogenerated string \_id/id](https://discuss.elastic.co/t/spring-elasticsearch-how-to-bulk-create-or-update-document-with-autogenerated-string-id-id/316352)
**Author:** [@Java2avaj](https://discuss.elastic.co/u/Java2avaj)\ **Replies:** 1\ **Last updated:** [October 11, 2022, 4:49pm UTC](https://discuss.elastic.co/t/spring-elasticsearch-how-to-bulk-create-or-update-document-with-autogenerated-string-id-id/316352 "2022-10-11T16:49:00Z")
currently, we are forcing the \_id of the Elasticsearch documents by setting the id field. This simplifies the design, as it allows to perform updates and/or creation of new documents without previously knowing whether a … --- ## [Filebeat doesn't resolve variable set for kubernetes pod](https://discuss.elastic.co/t/filebeat-doesnt-resolve-variable-set-for-kubernetes-pod/316356)
**Author:** [@jmandrive](https://discuss.elastic.co/u/jmandrive)\ **Replies:** 0\ **Last updated:** [October 11, 2022, 4:03pm UTC](https://discuss.elastic.co/t/filebeat-doesnt-resolve-variable-set-for-kubernetes-pod/316356 "2022-10-11T16:03:24Z")
Dears, I want to customize index as per the environment (prod, dev , ...), the filebeat couldn't substitue the value of "kubernetes.labels.env" and put instead "na" The index definiton inside output section in filebea… --- ## [Filebeat Error creating runner from config: failed to initialize condition](https://discuss.elastic.co/t/filebeat-error-creating-runner-from-config-failed-to-initialize-condition/316351)
**Author:** [@juliana\_cg](https://discuss.elastic.co/u/juliana_cg)\ **Replies:** 0\ **Last updated:** [October 11, 2022, 3:37pm UTC](https://discuss.elastic.co/t/filebeat-error-creating-runner-from-config-failed-to-initialize-condition/316351 "2022-10-11T15:37:39Z")
Hello, Got Filebeat installed as a daemonset in Kubernetes cluster, to collect logs from different pods using hint autodiscovery. On filebeat logs we have plenty of errors of this type: ERROR \[autodiscover\] cfg… --- ## [Collapse not working with search\_after with single sort field and PIT](https://discuss.elastic.co/t/collapse-not-working-with-search-after-with-single-sort-field-and-pit/316165)
**Author:** [@Reese\_Allison](https://discuss.elastic.co/u/Reese_Allison)\ **Replies:** 1\ **Last updated:** [October 11, 2022, 3:30pm UTC](https://discuss.elastic.co/t/collapse-not-working-with-search-after-with-single-sort-field-and-pit/316165 "2022-10-11T15:30:06Z")
I have an Elastic query that initially returns results. When I attempt the query again using search\_after for paging, I am getting the error: Cannot use \[collapse\] in conjunction with \[search\_after\] unless the search is … --- ## [Getting the same values multiple times while integrating Mysql with Logstash](https://discuss.elastic.co/t/getting-the-same-values-multiple-times-while-integrating-mysql-with-logstash/316277)
**Author:** [@Ritikapawar](https://discuss.elastic.co/u/Ritikapawar)\ **Replies:** 1\ **Last updated:** [October 11, 2022, 2:37pm UTC](https://discuss.elastic.co/t/getting-the-same-values-multiple-times-while-integrating-mysql-with-logstash/316277 "2022-10-11T14:37:22Z")
I've created a pipeline to get data directly from Mysql to kibana using logstash and Jdbc input plugin But when I do the actual execution on .conf file I'm getting the same values multiple time in the elastic index. he… --- ## [Elastic agent in k8s after several days stops sending same metrics](https://discuss.elastic.co/t/elastic-agent-in-k8s-after-several-days-stops-sending-same-metrics/316342)
**Author:** [@gabrielfsousa](https://discuss.elastic.co/u/gabrielfsousa)\ **Replies:** 0\ **Last updated:** [October 11, 2022, 2:32pm UTC](https://discuss.elastic.co/t/elastic-agent-in-k8s-after-several-days-stops-sending-same-metrics/316342 "2022-10-11T14:32:16Z")
in 7.16.2 after installing elastic agent in k8s everything works. but after several days stops sending same metrics. if i restart the elastic agent pods, starts working good. there's NOTHING in the logs. ZERO errors … --- ## [Reindex specific documents](https://discuss.elastic.co/t/reindex-specific-documents/316333)
**Author:** [@spike83](https://discuss.elastic.co/u/spike83)\ **Replies:** 1\ **Last updated:** [October 11, 2022, 2:28pm UTC](https://discuss.elastic.co/t/reindex-specific-documents/316333 "2022-10-11T14:28:41Z")
Hi, I have accidentally mixed docs into an index (not going to go into how lets just call it a silly config mistake) I have luckily tagged the docs and would like to reindex all docs that meet a specific tag. Could an… --- ## [Deploy Logstash pipeline through Gitlab CI/CD](https://discuss.elastic.co/t/deploy-logstash-pipeline-through-gitlab-ci-cd/316257)
**Author:** [@kmz161](https://discuss.elastic.co/u/kmz161)\ **Replies:** 3\ **Last updated:** [October 11, 2022, 12:56pm UTC](https://discuss.elastic.co/t/deploy-logstash-pipeline-through-gitlab-ci-cd/316257 "2022-10-11T12:56:22Z")
Hi! I use Centralized Pipeline Management for creation and management pipeline. But I can’t saved changing of pipeline settings . Because of it I started use Gitlab to store pipelines config. And now I need perform tw… --- ## [Kibana (8.4.2) visualization does not show metadata fields](https://discuss.elastic.co/t/kibana-8-4-2-visualization-does-not-show-metadata-fields/316279)
**Author:** [@amirfarsi](https://discuss.elastic.co/u/amirfarsi)\ **Replies:** 3\ **Last updated:** [October 11, 2022, 12:32pm UTC](https://discuss.elastic.co/t/kibana-8-4-2-visualization-does-not-show-metadata-fields/316279 "2022-10-11T12:32:07Z")
Hello friends. We updated our ELK from 7.\* to 8.4.2, and we used from our backups to restoring visualization, dashboards, data views (index pattern) and ... We had problems that were fixed, except for the following : … --- ## [Issue in parsing JSON data](https://discuss.elastic.co/t/issue-in-parsing-json-data/316210)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 1\ **Last updated:** [October 11, 2022, 12:06pm UTC](https://discuss.elastic.co/t/issue-in-parsing-json-data/316210 "2022-10-11T12:06:10Z")
Sample Logs \[{ "Name":"abc", "Phone\_no":"9877231", "Gender":"M" } \] I am getting data from filebeat - paths: - /root/test.log fields: {log\_type: json-multiline} multiline.type: pattern multiline.pattern: '^\\… --- ## [Document level security not behaving as expected](https://discuss.elastic.co/t/document-level-security-not-behaving-as-expected/316320)
**Author:** [@iaata](https://discuss.elastic.co/u/iaata)\ **Replies:** 2\ **Last updated:** [October 11, 2022, 11:16am UTC](https://discuss.elastic.co/t/document-level-security-not-behaving-as-expected/316320 "2022-10-11T11:16:42Z")
Hello. I am trying to setup document level security for a single index. My goal is to restrict access to documents in a way, where users only have access to the documents where their username match a field in the docum… --- ## [🐌 Poor search performance when searching in data stream indexes](https://discuss.elastic.co/t/poor-search-performance-when-searching-in-data-stream-indexes/315531)
**Author:** [@Its\_Anton](https://discuss.elastic.co/u/Its_Anton)\ **Replies:** 4\ **Last updated:** [October 11, 2022, 10:48am UTC](https://discuss.elastic.co/t/poor-search-performance-when-searching-in-data-stream-indexes/315531 "2022-10-11T10:48:00Z")
Hi! :wave: I have a pretty small amount of documents from Metricbeat and I have loaded them into 2 ways into Elasticsearch: Using the default Metricbeat index template and datastream (created by Metricbeat), ILM poli… --- ## [LDAP User Authentication Multiple Users](https://discuss.elastic.co/t/ldap-user-authentication-multiple-users/316319)
**Author:** [@Tarah](https://discuss.elastic.co/u/Tarah)\ **Replies:** 0\ **Last updated:** [October 11, 2022, 10:47am UTC](https://discuss.elastic.co/t/ldap-user-authentication-multiple-users/316319 "2022-10-11T10:47:29Z")
Hi Elastic Team, I'm still new on configuring LDAP User Auth. Just wanted to ask if it's possible to use the password value in LDAP directly as the bind password? Because what I have done today was only 1 user and just … --- ## [Salesforce integration with ELK](https://discuss.elastic.co/t/salesforce-integration-with-elk/316317)
**Author:** [@Ayaan\_Shaik](https://discuss.elastic.co/u/Ayaan_Shaik)\ **Replies:** 0\ **Last updated:** [October 11, 2022, 10:40am UTC](https://discuss.elastic.co/t/salesforce-integration-with-elk/316317 "2022-10-11T10:40:45Z")
Hi team, I'm Using ELK version : 8.3.3 I am trying to ingest Salesforce data with the help of file beat module Salesforce through logstash , But I'm unable to get the data into kibana and elasticsearch . Suppose if I … --- ## [Field mapping: "ignore\_above" and "index" settings](https://discuss.elastic.co/t/field-mapping-ignore-above-and-index-settings/316235)
**Author:** [@gdd](https://discuss.elastic.co/u/gdd)\ **Replies:** 0\ **Last updated:** [October 10, 2022, 2:24pm UTC](https://discuss.elastic.co/t/field-mapping-ignore-above-and-index-settings/316235 "2022-10-10T14:24:36Z")
I experienced bulks by logstash returning some errors, The template contained this mapping for event.original field: {"index": false, "type": "keyword", "doc\_values": false } The unexpected solution has been the intro… --- ## [ES upgrade from 6 to 8 - How to?](https://discuss.elastic.co/t/es-upgrade-from-6-to-8-how-to/316290)
**Author:** [@Eduardo\_Montes](https://discuss.elastic.co/u/Eduardo_Montes)\ **Replies:** 0\ **Last updated:** [October 11, 2022, 8:40am UTC](https://discuss.elastic.co/t/es-upgrade-from-6-to-8-how-to/316290 "2022-10-11T08:40:35Z")
Hi, I tried to make the ES upgrade from 6.2.4 to 8.4. I found out that there are many not supported features in 8 version. E.g. missing tree a precision attributes in geo\_shape data type, not supported possibility to d… --- ## [Apm-agent-java don't work](https://discuss.elastic.co/t/apm-agent-java-dont-work/315742)
**Author:** [@odelacruzc](https://discuss.elastic.co/u/odelacruzc)\ **Replies:** 3\ **Last updated:** [October 11, 2022, 10:22am UTC](https://discuss.elastic.co/t/apm-agent-java-dont-work/315742 "2022-10-11T10:22:42Z")
Hi friends, I configured elastic-agent with elastic-agent-java to monitoring app myapp.jar, but I have the follow error: ERROR co.elastic.apm.agent.report.IntakeV2ReportingEventHandler - Error sending data to APM server… --- ## [Logstash input configuration](https://discuss.elastic.co/t/logstash-input-configuration/316296)
**Author:** [@ttyser](https://discuss.elastic.co/u/ttyser)\ **Replies:** 2\ **Last updated:** [October 11, 2022, 10:09am UTC](https://discuss.elastic.co/t/logstash-input-configuration/316296 "2022-10-11T10:09:00Z")
Hello, I have a question how should Logstash input config look like in case I have Fleet server, multiple agents/endpoints, checkpoint firewall etc logging to Logstash. What I am trying to ask is, should every agent have… --- ## [Retreive slowlog on ECE](https://discuss.elastic.co/t/retreive-slowlog-on-ece/316308)
**Author:** [@zanga](https://discuss.elastic.co/u/zanga)\ **Replies:** 0\ **Last updated:** [October 11, 2022, 9:58am UTC](https://discuss.elastic.co/t/retreive-slowlog-on-ece/316308 "2022-10-11T09:58:41Z")
Hello everyone, I am trying to investigate one of my cluster, thus I am trying to setup the slowlogs so that I can monitor queries. I modified my cluster settings as so : "index.search.slowlog.threshold.query.trace": … --- ## [Point In Time for multi threaded queries / slices](https://discuss.elastic.co/t/point-in-time-for-multi-threaded-queries-slices/316243)
**Author:** [@str8y](https://discuss.elastic.co/u/str8y)\ **Replies:** 0\ **Last updated:** [October 10, 2022, 3:51pm UTC](https://discuss.elastic.co/t/point-in-time-for-multi-threaded-queries-slices/316243 "2022-10-10T15:51:19Z")
Hi, I read in the documentation that every result could contain an updated id for the pit I created, which I have to use in subsequent search requests. How does that behave in scenarios where I'm using multiple searche… [Previous page](https://discuss.elastic.co/latest.md?page=934) [Next page](https://discuss.elastic.co/latest.md?page=936)