# Latest **URL:** https://discuss.elastic.co/latest.md?page=951 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 952 --- ## [Lens Download as CSV](https://discuss.elastic.co/t/lens-download-as-csv/315325)
**Author:** [@Anil\_Alapati](https://discuss.elastic.co/u/Anil_Alapati)\ **Replies:** 1\ **Last updated:** [September 28, 2022, 7:58am UTC](https://discuss.elastic.co/t/lens-download-as-csv/315325 "2022-09-28T07:58:22Z")
Hi, I am using Lens method to create bar views on Kibana. I am using Vertical stack bar. Once the Bar Graph is created. I am trying to download the data of the Bar Graph as Csv file. The csv file download has the multip… --- ## [Can I enable Elasticsearch with ssl without authentication](https://discuss.elastic.co/t/can-i-enable-elasticsearch-with-ssl-without-authentication/315322)
**Author:** [@yasin\_mohammed](https://discuss.elastic.co/u/yasin_mohammed)\ **Replies:** 1\ **Last updated:** [September 28, 2022, 7:40am UTC](https://discuss.elastic.co/t/can-i-enable-elasticsearch-with-ssl-without-authentication/315322 "2022-09-28T07:40:42Z")
Hi... As we are planning to use Elasticsearch ssl and have authentication enabled at firewall is it possible disable Elasticsearch authentication and keep only ssl --- ## [Dissect\_parsing\_error for Apache Tomcat Integration](https://discuss.elastic.co/t/dissect-parsing-error-for-apache-tomcat-integration/315330)
**Author:** [@Marko\_Todoric](https://discuss.elastic.co/u/Marko_Todoric)\ **Replies:** 0\ **Last updated:** [September 28, 2022, 7:36am UTC](https://discuss.elastic.co/t/dissect-parsing-error-for-apache-tomcat-integration/315330 "2022-09-28T07:36:13Z")
Hello everyone, I'm running 3 node Elasticsearch Cluster with ES Version 8.3.3. Elastic Agent is running with same version on Ubuntu 18.04.6 and trying to collect logs from Apache Tomcat 8.5.24 by reading catalina.out … --- ## [Setup functionbeat with elasticsearch on ECK](https://discuss.elastic.co/t/setup-functionbeat-with-elasticsearch-on-eck/244150)
**Author:** [@Kay\_Khan](https://discuss.elastic.co/u/Kay_Khan)\ **Replies:** 3\ **Last updated:** [September 28, 2022, 7:30am UTC](https://discuss.elastic.co/t/setup-functionbeat-with-elasticsearch-on-eck/244150 "2022-09-28T07:30:39Z")
Hi friends, Im looking into setting up functionbeat to ship aws cloudwatch logs to elasticsearch. Ive been looking at the following documentation to setup functionbeat https://www.elastic.co/guide/en/beats/functionbeat/… --- ## [App Search returns zero results for queries with short terms after 8.4.2 update](https://discuss.elastic.co/t/app-search-returns-zero-results-for-queries-with-short-terms-after-8-4-2-update/314872)
**Author:** [@leovalen](https://discuss.elastic.co/u/leovalen)\ **Replies:** 6\ **Last updated:** [September 28, 2022, 7:08am UTC](https://discuss.elastic.co/t/app-search-returns-zero-results-for-queries-with-short-terms-after-8-4-2-update/314872 "2022-09-28T07:08:52Z")
After updating from Enterprise Search 8.4.1 to 8.4.2, queries with one or more short terms (one or two characters) return zero results. As this is new behavior from 8.4.2, I presume it's a bug? Reindexing did not remedi… --- ## [Kibana 8.4 expanded document views objects in multiple rows](https://discuss.elastic.co/t/kibana-8-4-expanded-document-views-objects-in-multiple-rows/315252)
**Author:** [@Kadir\_Goktas](https://discuss.elastic.co/u/Kadir_Goktas)\ **Replies:** 6\ **Last updated:** [September 28, 2022, 6:58am UTC](https://discuss.elastic.co/t/kibana-8-4-expanded-document-views-objects-in-multiple-rows/315252 "2022-09-28T06:58:57Z")
we have recently upgraded our stack to 8.4 and noticed that when we expand a document object fields are displayed in multiple rows as attached below; previously the field is displayed as a json with a toggle details … --- ## [How to write a range query for a date field with an interval on Elasticsearch?](https://discuss.elastic.co/t/how-to-write-a-range-query-for-a-date-field-with-an-interval-on-elasticsearch/315328)
**Author:** [@Ahkam\_Naseek](https://discuss.elastic.co/u/Ahkam_Naseek)\ **Replies:** 0\ **Last updated:** [September 28, 2022, 6:55am UTC](https://discuss.elastic.co/t/how-to-write-a-range-query-for-a-date-field-with-an-interval-on-elasticsearch/315328 "2022-09-28T06:55:23Z")
This is my current query which fetches documents which are older than 365 days from now. "query": { "bool": { "must": \[ { "match": { "doc\_type": "AP - ACH CHECKS" } }, { "range":… --- ## [Metricbeats logging into /var/log/messages](https://discuss.elastic.co/t/metricbeats-logging-into-var-log-messages/315316)
**Author:** [@justinepaulpadayao](https://discuss.elastic.co/u/justinepaulpadayao)\ **Replies:** 1\ **Last updated:** [September 28, 2022, 6:17am UTC](https://discuss.elastic.co/t/metricbeats-logging-into-var-log-messages/315316 "2022-09-28T06:17:18Z")
Hello! I'm trying to redirect my metricbeats logs to /var/log/metricbeats instead of /var/log/messages. I'm using metricbeat 8.0.0 and I've configured the metricbeat.yml logging section to this: #======================… --- ## [Elastic Cloud Enterprise 3.1.1 Security Update](https://discuss.elastic.co/t/elastic-cloud-enterprise-3-1-1-security-update/315317)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [September 28, 2022, 4:15am UTC](https://discuss.elastic.co/t/elastic-cloud-enterprise-3-1-1-security-update/315317 "2022-09-28T04:15:37Z")
Elastic Cloud Enterprise Sensitive information disclosure issue (ESA-2022-11) A flaw was discovered in ECE before 3.1.1 that could lead to the disclosure of the SAML signing private key used for the RBAC features, in de… --- ## [Cannot parse suricata.eve.http.content\_range](https://discuss.elastic.co/t/cannot-parse-suricata-eve-http-content-range/315295)
**Author:** [@opoplawski](https://discuss.elastic.co/u/opoplawski)\ **Replies:** 8\ **Last updated:** [September 27, 2022, 11:13pm UTC](https://discuss.elastic.co/t/cannot-parse-suricata-eve-http-content-range/315295 "2022-09-27T23:13:41Z")
I'm using the suricata module from beats 7.17.3 to parse suricata 6.0.4 EVE json logs and I'm getting the following parse error: "error"=\>{"type"=\>"mapper\_parsing\_exception", "reason"=\>"object mapping for \[suricata.eve.… --- ## [🧐 Observability \> Alerts \> Manage Rules: "Unable to load rules"](https://discuss.elastic.co/t/observability-alerts-manage-rules-unable-to-load-rules/315170)
**Author:** [@Its\_Anton](https://discuss.elastic.co/u/Its_Anton)\ **Replies:** 12\ **Last updated:** [September 28, 2022, 12:02am UTC](https://discuss.elastic.co/t/observability-alerts-manage-rules-unable-to-load-rules/315170 "2022-09-28T00:02:40Z")
Hi! When I navigate to Observability \> Alerts \> Manage Rules, I get 2 "Unable to load rules" errors in a small popup: And I see two 400 errors, that say {"statusCode":400,"error":"Bad Request","message":"KQLSyntaxE… --- ## [Error when connecting to powerBI through ODBC](https://discuss.elastic.co/t/error-when-connecting-to-powerbi-through-odbc/315307)
**Author:** [@David\_Arancibia](https://discuss.elastic.co/u/David_Arancibia)\ **Replies:** 1\ **Last updated:** [September 27, 2022, 8:52pm UTC](https://discuss.elastic.co/t/error-when-connecting-to-powerbi-through-odbc/315307 "2022-09-27T20:52:30Z")
I recently migrated from self hosted ELK to elastic cloud, everything is working well except the ODBC connector to powerBI i've been using. It seems to be able to see the data but for some reason its slightly larger th… --- ## [DeprecationWarning for request\_timeout](https://discuss.elastic.co/t/deprecationwarning-for-request-timeout/315311)
**Author:** [@jeroen1](https://discuss.elastic.co/u/jeroen1)\ **Replies:** 0\ **Last updated:** [September 27, 2022, 8:37pm UTC](https://discuss.elastic.co/t/deprecationwarning-for-request-timeout/315311 "2022-09-27T20:37:45Z")
I initialize my ES connection in Python with Elasticsearch.options(), setting a global timeout. For some complex searches I need a custom (longer) timeout. To achieve this, I use es.search(request\_timeout=timeout, \[..\]).… --- ## [Fleet Custom Logs integration add\_fields processor](https://discuss.elastic.co/t/fleet-custom-logs-integration-add-fields-processor/315070)
**Author:** [@Gustavo\_Llermaly](https://discuss.elastic.co/u/Gustavo_Llermaly)\ **Replies:** 11\ **Last updated:** [September 27, 2022, 8:25pm UTC](https://discuss.elastic.co/t/fleet-custom-logs-integration-add-fields-processor/315070 "2022-09-27T20:25:42Z")
Hello Team, we are trying to add fields to a Custom Logs integration via "Advanced settings" tried many formats but none of them is working: - processors: add\_fields: target: fields: foo:ba… --- ## [Agent returns access denied](https://discuss.elastic.co/t/agent-returns-access-denied/315310)
**Author:** [@simpleman](https://discuss.elastic.co/u/simpleman)\ **Replies:** 0\ **Last updated:** [September 27, 2022, 8:21pm UTC](https://discuss.elastic.co/t/agent-returns-access-denied/315310 "2022-09-27T20:21:34Z")
We have an air gapped network. We use Symantec Endpoint Security. We have successfully installed ELK 8.4.1 on VM. On the same VM we have the fleet server running. The registry is running on docker in another VM. I try to… --- ## [Watcher creation help](https://discuss.elastic.co/t/watcher-creation-help/315309)
**Author:** [@ffmdsuperit](https://discuss.elastic.co/u/ffmdsuperit)\ **Replies:** 0\ **Last updated:** [September 27, 2022, 8:20pm UTC](https://discuss.elastic.co/t/watcher-creation-help/315309 "2022-09-27T20:20:09Z")
Hello! I'm very new to Elasticsearch and I am attempting to create a Watcher, but I just can't seem to put the pieces together. I have a index named "transactions". For that index I run this query "TerminalID : 999999 a… --- ## [Machine Learning low sum is not working as expected](https://discuss.elastic.co/t/machine-learning-low-sum-is-not-working-as-expected/315292)
**Author:** [@Ann\_Abbott](https://discuss.elastic.co/u/Ann_Abbott)\ **Replies:** 1\ **Last updated:** [September 27, 2022, 7:08pm UTC](https://discuss.elastic.co/t/machine-learning-low-sum-is-not-working-as-expected/315292 "2022-09-27T19:08:54Z")
Hi, I am trying to use machine learning - anomaly detection. Whenever I try to use regular sum function it detects both low and high anomalies. High sum is also working expected since it's only showing high anomalies. … --- ## [How to add search\_type in settings](https://discuss.elastic.co/t/how-to-add-search-type-in-settings/314717)
**Author:** [@prashantreddy](https://discuss.elastic.co/u/prashantreddy)\ **Replies:** 4\ **Last updated:** [September 27, 2022, 6:46pm UTC](https://discuss.elastic.co/t/how-to-add-search-type-in-settings/314717 "2022-09-27T18:46:49Z")
Hello, I am pretty new to ES and i use templates for search. we have separate settings file to add analyzers and all. I am trying to add search\_type in same file. is it possible to add search\_type in settings file? i t… --- ## [Filebeat 8.4.2 modules Panw : Panw modules does not parse log correctly](https://discuss.elastic.co/t/filebeat-8-4-2-modules-panw-panw-modules-does-not-parse-log-correctly/315299)
**Author:** [@soufiane\_adn](https://discuss.elastic.co/u/soufiane_adn)\ **Replies:** 0\ **Last updated:** [September 27, 2022, 6:17pm UTC](https://discuss.elastic.co/t/filebeat-8-4-2-modules-panw-panw-modules-does-not-parse-log-correctly/315299 "2022-09-27T18:17:50Z")
hello team, i found a problem with filebeat v 8.4.1 on parsing palo alto logs using panw modules. below the error: field \[generated\_time\] not present as part of path \[temp.generated\_time\] any help? PS: i received th… --- ## [Want term frequency in a individual document text fields with my query results. How?](https://discuss.elastic.co/t/want-term-frequency-in-a-individual-document-text-fields-with-my-query-results-how/315298)
**Author:** [@ljdtenny](https://discuss.elastic.co/u/ljdtenny)\ **Replies:** 0\ **Last updated:** [September 27, 2022, 6:01pm UTC](https://discuss.elastic.co/t/want-term-frequency-in-a-individual-document-text-fields-with-my-query-results-how/315298 "2022-09-27T18:01:37Z")
I have a text field which has large text values. I do a query, get my hits, highlights, all good. There's just one more thing I want. For each hit of my SIZE hits, I want the term frequency of the query term(s) within… --- ## [Generate reports from a script in CSV is not working](https://discuss.elastic.co/t/generate-reports-from-a-script-in-csv-is-not-working/314876)
**Author:** [@thirty2](https://discuss.elastic.co/u/thirty2)\ **Replies:** 4\ **Last updated:** [September 27, 2022, 5:33pm UTC](https://discuss.elastic.co/t/generate-reports-from-a-script-in-csv-is-not-working/314876 "2022-09-27T17:33:38Z")
Hi, i am trying to use a script to generate reports in CSV and i am following the steps as written in the documentation here When i try to run a curl command i am getting error like this: {"error":"Incorrect HTTP me… --- ## [Action \[indices:admin/flush\[s\]\] is unauthorized for user \[admin\] with roles \[superuser\] on restricted indices \[.kibana\_task\_manager\_7.17.5\_001\], this action is granted by the index privileges \[maintenance,manage,all\]](https://discuss.elastic.co/t/action-indices-admin-flush-s-is-unauthorized-for-user-admin-with-roles-superuser-on-restricted-indices-kibana-task-manager-7-17-5-001-this-action-is-granted-by-the-index-privileges-maintenance-manage-all/315291)
**Author:** [@Leonardo\_Henrique](https://discuss.elastic.co/u/Leonardo_Henrique)\ **Replies:** 1\ **Last updated:** [September 27, 2022, 5:27pm UTC](https://discuss.elastic.co/t/action-indices-admin-flush-s-is-unauthorized-for-user-admin-with-roles-superuser-on-restricted-indices-kibana-task-manager-7-17-5-001-this-action-is-granted-by-the-index-privileges-maintenance-manage-all/315291 "2022-09-27T17:27:40Z")
Hello, guys! I am running a rolling upgrade in a cluster 7.17.5 to 8.3.2. When I try to run the GET /\_flush I am receiving this error as return { "\_shards" : { "total" : 148, "successful" : 77, "failed" … --- ## [Error while fetching resource Kibana APM](https://discuss.elastic.co/t/error-while-fetching-resource-kibana-apm/315284)
**Author:** [@danksim](https://discuss.elastic.co/u/danksim)\ **Replies:** 1\ **Last updated:** [September 27, 2022, 4:07pm UTC](https://discuss.elastic.co/t/error-while-fetching-resource-kibana-apm/315284 "2022-09-27T16:07:55Z")
elasticsearch, logstash, kibana: 7.17.3 apm-server: 7.5.2 I am getting the following error when trying to access the APM tab on Kibana: Error while fetching resource search\_phase\_execution\_exception: \[illegal\_argume… --- ## [Search for documents containing an item not present in a list](https://discuss.elastic.co/t/search-for-documents-containing-an-item-not-present-in-a-list/314958)
**Author:** [@Adrian\_Fresco](https://discuss.elastic.co/u/Adrian_Fresco)\ **Replies:** 2\ **Last updated:** [September 27, 2022, 3:48pm UTC](https://discuss.elastic.co/t/search-for-documents-containing-an-item-not-present-in-a-list/314958 "2022-09-27T15:48:40Z")
I have indexed documents that contain a field name with a string value: \[ { "fruits": \[ { "name": "apple", "color": "red" }, { … --- ## [403 Forbidden when using '"es.nodes.path.prefix" pyspark 8.4.1 pyspark 3.3](https://discuss.elastic.co/t/403-forbidden-when-using-es-nodes-path-prefix-pyspark-8-4-1-pyspark-3-3/315084)
**Author:** [@rbigley](https://discuss.elastic.co/u/rbigley)\ **Replies:** 8\ **Last updated:** [September 27, 2022, 3:42pm UTC](https://discuss.elastic.co/t/403-forbidden-when-using-es-nodes-path-prefix-pyspark-8-4-1-pyspark-3-3/315084 "2022-09-27T15:42:01Z")
Pyspark 3.3 with elasticsearch-spark-30\_2.12-8.4.1.jar (I've also tried with the elasticsearch-spark-30\_2.12-717.6.jar with same result) I have access to the index and have validated via curl and the normal python elas… --- ## [Logstash on docker not listening to port](https://discuss.elastic.co/t/logstash-on-docker-not-listening-to-port/315285)
**Author:** [@Juan\_Fernandez\_Bern1](https://discuss.elastic.co/u/Juan_Fernandez_Bern1)\ **Replies:** 0\ **Last updated:** [September 27, 2022, 3:33pm UTC](https://discuss.elastic.co/t/logstash-on-docker-not-listening-to-port/315285 "2022-09-27T15:33:49Z")
Hello, im running logstash with docker-compose and for some reason im unable to listen to port 9015 in one of the nodes. image: docker.elastic.co/logstash/logstash:7.12.0 container\_name: logstash-node03 port… --- ## [Enable CORS settings in a Self-Managed Azure Cluster?](https://discuss.elastic.co/t/enable-cors-settings-in-a-self-managed-azure-cluster/315282)
**Author:** [@Dante\_Nahuel](https://discuss.elastic.co/u/Dante_Nahuel)\ **Replies:** 0\ **Last updated:** [September 27, 2022, 3:20pm UTC](https://discuss.elastic.co/t/enable-cors-settings-in-a-self-managed-azure-cluster/315282 "2022-09-27T15:20:36Z")
Hi I deployed an Azure Elasticsearch Self-Managed cluster. According to our Dev team, we need to enable CORS by adding these settings into the Configuration File yaml: "http.cors.enabled": true, "http.cors.allo… --- ## [User control and management](https://discuss.elastic.co/t/user-control-and-management/315279)
**Author:** [@meyer1](https://discuss.elastic.co/u/meyer1)\ **Replies:** 1\ **Last updated:** [September 27, 2022, 3:18pm UTC](https://discuss.elastic.co/t/user-control-and-management/315279 "2022-09-27T15:18:58Z")
Hello everyone, I need a little information, is it possible to create a user on kibana and give him access to a certain dashboard? Or is he obliged to have access to all of them? If it is possible to do it, how to do i… --- ## [SharePoint Server connector package](https://discuss.elastic.co/t/sharepoint-server-connector-package/302586)
**Author:** [@Serena\_Chou](https://discuss.elastic.co/u/Serena_Chou)\ **Replies:** 8\ **Last updated:** [September 27, 2022, 3:06pm UTC](https://discuss.elastic.co/t/sharepoint-server-connector-package/302586 "2022-09-27T15:06:59Z")
Starting in the 8.1 Enterprise Search release, we have a new Elastic SharePoint Server connector package available for beta. This connector package extends the existing Workplace Search content source catalog, with a ful… --- ## [Winlogbeat Sending Bad Json Message](https://discuss.elastic.co/t/winlogbeat-sending-bad-json-message/315271)
**Author:** [@Rohit\_Kumbhar](https://discuss.elastic.co/u/Rohit_Kumbhar)\ **Replies:** 0\ **Last updated:** [September 27, 2022, 2:16pm UTC](https://discuss.elastic.co/t/winlogbeat-sending-bad-json-message/315271 "2022-09-27T14:16:02Z")
Hi @elastic Team, All versions are 7.16.2 My Setup is Winlogbeat(logstash output)=\>(beats input)collector(logstash TCP output)=\> (tcp input)loadbalancer(elastic output) I am able to receive most of the data from serve… [Previous page](https://discuss.elastic.co/latest.md?page=950) [Next page](https://discuss.elastic.co/latest.md?page=952)