# Latest **URL:** https://discuss.elastic.co/latest.md?page=940 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 941 --- ## [How to view contents of heartbeat keystore](https://discuss.elastic.co/t/how-to-view-contents-of-heartbeat-keystore/315933)
**Author:** [@swchandu](https://discuss.elastic.co/u/swchandu)\ **Replies:** 2\ **Last updated:** [October 7, 2022, 4:26am UTC](https://discuss.elastic.co/t/how-to-view-contents-of-heartbeat-keystore/315933 "2022-10-07T04:26:47Z")
Hi, I am trying to check if we can display the contents and values of the heartbeat.keystore. Is there any command to display the entries and values? I am unable to find the documentation on this. can someone help me … --- ## [String comparison inside a update\_by\_query api script](https://discuss.elastic.co/t/string-comparison-inside-a-update-by-query-api-script/316024)
**Author:** [@djoobbani](https://discuss.elastic.co/u/djoobbani)\ **Replies:** 0\ **Last updated:** [October 7, 2022, 12:51am UTC](https://discuss.elastic.co/t/string-comparison-inside-a-update-by-query-api-script/316024 "2022-10-07T00:51:35Z")
I am performing a Update\_by\_query api and inside its script i need to do string comparison of two different parameteres, similar to how u would do it with intgers: So, i need to do something like this with string: str… --- ## [Service token causes index\_not\_found\_exception](https://discuss.elastic.co/t/service-token-causes-index-not-found-exception/315900)
**Author:** [@learningelastic](https://discuss.elastic.co/u/learningelastic)\ **Replies:** 5\ **Last updated:** [October 6, 2022, 11:42pm UTC](https://discuss.elastic.co/t/service-token-causes-index-not-found-exception/315900 "2022-10-06T23:42:44Z")
I want to learn to use service tokens. I followed the instructions here: Specifically, I ran this command from bash CLI of the server 139.177.199.119 bin/elasticsearch-service-tokens create elastic/kibana my-token W… --- ## [COMPOSITE NESTED AGGREGATIONS](https://discuss.elastic.co/t/composite-nested-aggregations/316013)
**Author:** [@Vinicius\_Serafim](https://discuss.elastic.co/u/Vinicius_Serafim)\ **Replies:** 0\ **Last updated:** [October 6, 2022, 9:42pm UTC](https://discuss.elastic.co/t/composite-nested-aggregations/316013 "2022-10-06T21:42:12Z")
Hi, i hope that someone can help me. Supose that i have the following mapping to my index: PUT test-index { "mappings": { "properties": { "nestedOBJField": { "type": "nested", "index": true… --- ## [Grok pattern for suricata/barnyard alert in COMPLETE mode](https://discuss.elastic.co/t/grok-pattern-for-suricata-barnyard-alert-in-complete-mode/316009)
**Author:** [@mvrk](https://discuss.elastic.co/u/mvrk)\ **Replies:** 2\ **Last updated:** [October 6, 2022, 9:12pm UTC](https://discuss.elastic.co/t/grok-pattern-for-suricata-barnyard-alert-in-complete-mode/316009 "2022-10-06T21:12:37Z")
Hi, I have my suricata in pfsense sending the alerts using barnyard in COMPLETE mode to my greylog server. Example message: | \[SNORTIDS\[ALERT\]: \[pfsense.local\] \] || 2022-10-06 19:13:55.186+001 2 \[1:2403344:77870\] ET C… --- ## [Make Single output call with multiple events](https://discuss.elastic.co/t/make-single-output-call-with-multiple-events/315808)
**Author:** [@LJ\_LongWing](https://discuss.elastic.co/u/LJ_LongWing)\ **Replies:** 7\ **Last updated:** [October 6, 2022, 9:11pm UTC](https://discuss.elastic.co/t/make-single-output-call-with-multiple-events/315808 "2022-10-06T21:11:42Z")
I've done a few days of searching but can't find what I'm looking for....the closest I've found is this topic (How to aggregate multiple events into single output) I'll state that I'm starting with a functional pipeline… --- ## [Uptades to template not being applied](https://discuss.elastic.co/t/uptades-to-template-not-being-applied/315606)
**Author:** [@somatusjn](https://discuss.elastic.co/u/somatusjn)\ **Replies:** 9\ **Last updated:** [October 6, 2022, 6:25pm UTC](https://discuss.elastic.co/t/uptades-to-template-not-being-applied/315606 "2022-10-06T18:25:41Z")
I'm getting an error when trying to post a document. The error I think is that the format I used for a date property is incorrect. I initially used YYYY-MM-DD'T'hh:mm:ssZ, but since then I have made like 10 calls to upda… --- ## [8.4.3 canvas and sql problems](https://discuss.elastic.co/t/8-4-3-canvas-and-sql-problems/315986)
**Author:** [@Ibrahim\_Z\_HIDIR](https://discuss.elastic.co/u/Ibrahim_Z_HIDIR)\ **Replies:** 1\ **Last updated:** [October 6, 2022, 6:16pm UTC](https://discuss.elastic.co/t/8-4-3-canvas-and-sql-problems/315986 "2022-10-06T18:16:39Z")
Hi All After upgrade from 8.3.1 to 8.4.1 Canvas reveal images only displaying exclamation mark. I've tried many different ways to fix this but nothing worked. All my reveal images using sql like select case when count… --- ## [Invalid version of beats protocol integration with spring boot](https://discuss.elastic.co/t/invalid-version-of-beats-protocol-integration-with-spring-boot/315997)
**Author:** [@Nikolas1306](https://discuss.elastic.co/u/Nikolas1306)\ **Replies:** 0\ **Last updated:** [October 6, 2022, 5:31pm UTC](https://discuss.elastic.co/t/invalid-version-of-beats-protocol-integration-with-spring-boot/315997 "2022-10-06T17:31:09Z")
i used a test with integrated log with spring-boot and logstash this is xml configuration \ \ \ **Author:** [@txmrlevine](https://discuss.elastic.co/u/txmrlevine)\ **Replies:** 6\ **Last updated:** [October 6, 2022, 4:30pm UTC](https://discuss.elastic.co/t/when-i-add-xpack-to-stack-it-is-not-working/314522 "2022-10-06T16:30:58Z") When trying to implement xpack on my stack I get an "error loading data" message in Cerebro and it does not let me login. when set to false all works - when set to true it does not. here is info on the stack { "nam… --- ## [Structure of document affect speed?](https://discuss.elastic.co/t/structure-of-document-affect-speed/315897)
**Author:** [@MaVa](https://discuss.elastic.co/u/MaVa)\ **Replies:** 1\ **Last updated:** [October 6, 2022, 4:23pm UTC](https://discuss.elastic.co/t/structure-of-document-affect-speed/315897 "2022-10-06T16:23:10Z")
I have a question out of curiosity. Does the structure of the document have any effect on the indexing and searching speed in an index? Would e.g. "user": { "id":"123", "first\_name":"John", "last\_n… --- ## [How to grok first line from an XML format](https://discuss.elastic.co/t/how-to-grok-first-line-from-an-xml-format/315877)
**Author:** [@anupvtr](https://discuss.elastic.co/u/anupvtr)\ **Replies:** 1\ **Last updated:** [October 6, 2022, 4:19pm UTC](https://discuss.elastic.co/t/how-to-grok-first-line-from-an-xml-format/315877 "2022-10-06T16:19:04Z")
Hi All, I am quite new to the magic world of Grok. Any help will be thankful. I need to apply filter for the following file. 2022-08-22 22:18:59 , 666 INFO @ (blockurcolumn-11) \[rbbit\_MQ\_Versa.appache 75\] start col… --- ## [Restoring snapshot from 5.0 into 6.8 for upgrades](https://discuss.elastic.co/t/restoring-snapshot-from-5-0-into-6-8-for-upgrades/315818)
**Author:** [@jayp-glb](https://discuss.elastic.co/u/jayp-glb)\ **Replies:** 3\ **Last updated:** [October 6, 2022, 4:18pm UTC](https://discuss.elastic.co/t/restoring-snapshot-from-5-0-into-6-8-for-upgrades/315818 "2022-10-06T16:18:07Z")
Hi community, and thanks for all the help you've given everyone for years and years. Today, I'm facing a very interesting situation. I'm finally going around on upgrading a quite old Elasticsearch 5.0 cluster hosted in… --- ## [Is there a way to merge two indices](https://discuss.elastic.co/t/is-there-a-way-to-merge-two-indices/315980)
**Author:** [@Dedsec0](https://discuss.elastic.co/u/Dedsec0)\ **Replies:** 1\ **Last updated:** [October 6, 2022, 4:17pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-merge-two-indices/315980 "2022-10-06T16:17:50Z")
Hi, I want to merge two indices( index 1, index 2) and make as one index( index 3), For instance : let say, I have index 1 and index 2 have matching fields like ... index 1 :(doc count 1) { "operation": "add", "ti… --- ## [Kafka-beats-logstash](https://discuss.elastic.co/t/kafka-beats-logstash/314902)
**Author:** [@emmanuel\_stevens\_LED](https://discuss.elastic.co/u/emmanuel_stevens_LED)\ **Replies:** 1\ **Last updated:** [October 6, 2022, 3:50pm UTC](https://discuss.elastic.co/t/kafka-beats-logstash/314902 "2022-10-06T15:50:42Z")
Hello, I have difficulties with a task. I received help from @stephenb to configure My ELKK, it works fine. https://discuss.elastic.co/t/metribeats-to-kafka-no-dashboard-appear-in-kibana/309688/15 My probleme is for t… --- ## [Kibana data table representaion](https://discuss.elastic.co/t/kibana-data-table-representaion/315988)
**Author:** [@PRASHANT\_MEHTA](https://discuss.elastic.co/u/PRASHANT_MEHTA)\ **Replies:** 1\ **Last updated:** [October 6, 2022, 3:22pm UTC](https://discuss.elastic.co/t/kibana-data-table-representaion/315988 "2022-10-06T15:22:40Z")
Hello All, I would like to dispaly the data as its shown below table. How can this be achieved best in kibana using enhanced/data table ? Here the challenge is the date fields are dynamice.Would have been only date fi… --- ## [Document enrichment via ingest pipeline or Indicator Match rule - which is preferable?](https://discuss.elastic.co/t/document-enrichment-via-ingest-pipeline-or-indicator-match-rule-which-is-preferable/315830)
**Author:** [@kossde](https://discuss.elastic.co/u/kossde)\ **Replies:** 1\ **Last updated:** [October 6, 2022, 3:15pm UTC](https://discuss.elastic.co/t/document-enrichment-via-ingest-pipeline-or-indicator-match-rule-which-is-preferable/315830 "2022-10-06T15:15:29Z")
Our elastic cluster is being used as a SIEM and is currently ingesting approximately 3x the data than originally scoped to ingest. It's working pretty hard. We have recently begun ingesting a MISP for enrichment and al… --- ## [Sending alerts via email](https://discuss.elastic.co/t/sending-alerts-via-email/315870)
**Author:** [@domw](https://discuss.elastic.co/u/domw)\ **Replies:** 1\ **Last updated:** [October 6, 2022, 3:06pm UTC](https://discuss.elastic.co/t/sending-alerts-via-email/315870 "2022-10-06T15:06:22Z")
Hello, I am hoping there is a way via email to notify on how many alerts we are receiving. And is there a way to have a report sent out periodically on how many alerts were received within a time frame? Thank you! --- ## [Filter unstructured logs with filebeat before sending to logstash](https://discuss.elastic.co/t/filter-unstructured-logs-with-filebeat-before-sending-to-logstash/315960)
**Author:** [@Ihms](https://discuss.elastic.co/u/Ihms)\ **Replies:** 2\ **Last updated:** [October 6, 2022, 3:05pm UTC](https://discuss.elastic.co/t/filter-unstructured-logs-with-filebeat-before-sending-to-logstash/315960 "2022-10-06T15:05:40Z")
Hello, I'm new to Elasticsearch and have some questions. Filebeat is fetching way too many logs and for the sake of bandwidth, I want to filter the logs at the edge before sending to logstash. The logs don't have the s… --- ## [Remove backslash from xml log](https://discuss.elastic.co/t/remove-backslash-from-xml-log/315891)
**Author:** [@Jathurshan\_Sumandira](https://discuss.elastic.co/u/Jathurshan_Sumandira)\ **Replies:** 4\ **Last updated:** [October 6, 2022, 12:32pm UTC](https://discuss.elastic.co/t/remove-backslash-from-xml-log/315891 "2022-10-06T12:32:39Z")
\ I wanted to remove the backslashs ("\\") in above xml log-line and I have tried ruby { code =\> ' d= event.… --- ## [Best structure for easy/efficient searching of complex data](https://discuss.elastic.co/t/best-structure-for-easy-efficient-searching-of-complex-data/315990)
**Author:** [@EmaysHRT](https://discuss.elastic.co/u/EmaysHRT)\ **Replies:** 0\ **Last updated:** [October 6, 2022, 2:39pm UTC](https://discuss.elastic.co/t/best-structure-for-easy-efficient-searching-of-complex-data/315990 "2022-10-06T14:39:52Z")
I'm working on exporting result data from our configuration management system into Elasticsearch, so we can more easily understand failures across our fleet. Each run is composed of many "states" that are applied to a ma… --- ## [Can't connect to Elasticsearch at \:9200 - Logs don't show any errors](https://discuss.elastic.co/t/cant-connect-to-elasticsearch-at-publicip-9200-logs-dont-show-any-errors/315920)
**Author:** [@Chma](https://discuss.elastic.co/u/Chma)\ **Replies:** 12\ **Last updated:** [October 6, 2022, 1:53pm UTC](https://discuss.elastic.co/t/cant-connect-to-elasticsearch-at-publicip-9200-logs-dont-show-any-errors/315920 "2022-10-06T13:53:02Z")
This worked, thanks. I am running into a different issue. Elasticsearch status says it's active, but I can't connect at http://:9200. My elasticsearch logs doesn't show any issue. This is the yaml file which was working… --- ## [Watcher Aggregation returning null](https://discuss.elastic.co/t/watcher-aggregation-returning-null/315914)
**Author:** [@serena-skilljar](https://discuss.elastic.co/u/serena-skilljar)\ **Replies:** 1\ **Last updated:** [October 6, 2022, 2:20pm UTC](https://discuss.elastic.co/t/watcher-aggregation-returning-null/315914 "2022-10-06T14:20:40Z")
Hi there - We have a few watchers that were running successfully and suddenly started to error out. Can confirm that nothing was changed on our end. Watch (actions and transform ommited): { "trigger": { "schedul… --- ## [Elasticsearch Upgrade JVM Error](https://discuss.elastic.co/t/elasticsearch-upgrade-jvm-error/315928)
**Author:** [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Replies:** 0\ **Last updated:** [October 6, 2022, 3:31am UTC](https://discuss.elastic.co/t/elasticsearch-upgrade-jvm-error/315928 "2022-10-06T03:31:38Z")
Trying to upgrade Elasticsearch from 8.2 to 8.4.3 running on Windows. I copied the config folder from the old version to the new one, adjusted file paths in elasticsearch.yml, deleted the old service, then ran elasticse… --- ## [Kibana Visualization: need a solution to get range(average(utilization), min, max)](https://discuss.elastic.co/t/kibana-visualization-need-a-solution-to-get-range-average-utilization-min-max/315955)
**Author:** [@Lakshmi\_Narayana\_Red](https://discuss.elastic.co/u/Lakshmi_Narayana_Red)\ **Replies:** 3\ **Last updated:** [October 6, 2022, 2:00pm UTC](https://discuss.elastic.co/t/kibana-visualization-need-a-solution-to-get-range-average-utilization-min-max/315955 "2022-10-06T14:00:34Z")
Hi Friends, We have a list of machines with and it's data like date, names, and utilization as mentioned below: date machine\_name utilization 01-10-2022 machine\_a 10 01-10-2022 machine\_b 5 01-10-2022 mach… --- ## [Data loss when sending logs to Kibana through Filebeat](https://discuss.elastic.co/t/data-loss-when-sending-logs-to-kibana-through-filebeat/315926)
**Author:** [@xyu](https://discuss.elastic.co/u/xyu)\ **Replies:** 7\ **Last updated:** [October 6, 2022, 1:59pm UTC](https://discuss.elastic.co/t/data-loss-when-sending-logs-to-kibana-through-filebeat/315926 "2022-10-06T13:59:31Z")
Hi, I am new to elastic stalk and currently I am facing some difficulties to read all the logs in JSON format. {"code":"28000","file":"auth.c","length":164,"level":"error","line":"496","message":"no entry for host","na… --- ## [Filebeat setup: error loading index pattern: returned 413 to import file: invalid character ‘\<’ looking for beginning of value](https://discuss.elastic.co/t/filebeat-setup-error-loading-index-pattern-returned-413-to-import-file-invalid-character-looking-for-beginning-of-value/315329)
**Author:** [@Nick95](https://discuss.elastic.co/u/Nick95)\ **Replies:** 1\ **Last updated:** [October 6, 2022, 1:50pm UTC](https://discuss.elastic.co/t/filebeat-setup-error-loading-index-pattern-returned-413-to-import-file-invalid-character-looking-for-beginning-of-value/315329 "2022-10-06T13:50:49Z")
Hi, I try to run a filebeat on a server. Elastic and Kibana are installed on another server and are pushed on 443 port via a Nginx reverse proxy. Kibana GUI is working on the IP I set up (https with self-generated certi… --- ## [Snapshots with a shard failure](https://discuss.elastic.co/t/snapshots-with-a-shard-failure/315838)
**Author:** [@Nicolaegis](https://discuss.elastic.co/u/Nicolaegis)\ **Replies:** 4\ **Last updated:** [October 6, 2022, 12:33pm UTC](https://discuss.elastic.co/t/snapshots-with-a-shard-failure/315838 "2022-10-06T12:33:15Z")
Hello, I would like to know if a snapshot with a failed shard can be retried without restarting the whole process. Thank you --- ## [Azure Vnet / NSG Flow Logs](https://discuss.elastic.co/t/azure-vnet-nsg-flow-logs/315957)
**Author:** [@Chandrapaul](https://discuss.elastic.co/u/Chandrapaul)\ **Replies:** 1\ **Last updated:** [October 6, 2022, 12:21pm UTC](https://discuss.elastic.co/t/azure-vnet-nsg-flow-logs/315957 "2022-10-06T12:21:45Z")
How to ingest Azure VNet / NSG flow logs into elasticsearch ? --- ## [ElasticSearch 2-out-of-4 Master Replica goes down](https://discuss.elastic.co/t/elasticsearch-2-out-of-4-master-replica-goes-down/315840)
**Author:** [@roybalderama](https://discuss.elastic.co/u/roybalderama)\ **Replies:** 7\ **Last updated:** [October 6, 2022, 12:18pm UTC](https://discuss.elastic.co/t/elasticsearch-2-out-of-4-master-replica-goes-down/315840 "2022-10-06T12:18:52Z")
Hi, We bootstraped ELK Stack (in kubernetes using helm) to collect all the audit and application logs of the system. This has been running for almost a year now, and we were able to achieve the high-availability using t… [Previous page](https://discuss.elastic.co/latest.md?page=939) [Next page](https://discuss.elastic.co/latest.md?page=941)