# Latest **URL:** https://discuss.elastic.co/latest.md?page=958 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 959 --- ## [Filtering data in Filebeat](https://discuss.elastic.co/t/filtering-data-in-filebeat/314918)
**Author:** [@Lynow](https://discuss.elastic.co/u/Lynow)\ **Replies:** 0\ **Last updated:** [September 22, 2022, 7:15am UTC](https://discuss.elastic.co/t/filtering-data-in-filebeat/314918 "2022-09-22T07:15:34Z")
Hello ! I work on a Proxmox server where I installed a Firewall PfSense router with three interfaces (LAN, DMZ, WAN) with different "user" VMs and as well as servers (web and bdd). So I installed Wazuh and Suricata to … --- ## [How to limit data from source index when rollup data at first time](https://discuss.elastic.co/t/how-to-limit-data-from-source-index-when-rollup-data-at-first-time/314917)
**Author:** [@Be-poz](https://discuss.elastic.co/u/Be-poz)\ **Replies:** 0\ **Last updated:** [September 22, 2022, 6:51am UTC](https://discuss.elastic.co/t/how-to-limit-data-from-source-index-when-rollup-data-at-first-time/314917 "2022-09-22T06:51:34Z")
hi, i'm now using rollup to summary my own data. problem is that the data i'm trying to rollup is too big. it takes a lot of time to rollup and also it affects the performance of es cluster. so i wonder if there is any… --- ## [Failing to get filebeat with suricata module to work](https://discuss.elastic.co/t/failing-to-get-filebeat-with-suricata-module-to-work/314835)
**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Replies:** 7\ **Last updated:** [September 22, 2022, 5:14am UTC](https://discuss.elastic.co/t/failing-to-get-filebeat-with-suricata-module-to-work/314835 "2022-09-22T05:14:29Z")
I have installed filebeat (7.17.1) on an ubuntu system. Run the setup stuff and loaded the dashboards into kibana. I have also "enabled" the suricata module, first by simply adding the appropriate stuff into /etc/fileb… --- ## [APM server doesn't reflect output from Fleet Settings](https://discuss.elastic.co/t/apm-server-doesnt-reflect-output-from-fleet-settings/314909)
**Author:** [@hutstein](https://discuss.elastic.co/u/hutstein)\ **Replies:** 1\ **Last updated:** [September 22, 2022, 5:04am UTC](https://discuss.elastic.co/t/apm-server-doesnt-reflect-output-from-fleet-settings/314909 "2022-09-22T05:04:58Z")
Hi, I have configured proper URL in Fleet Settings Outputs: I used fleet to install apm agents via a policy to some nodes. The output section of the apm\_server.yml doesn't refletct the value from above and is still … --- ## [Unable connect to a .Net 5 project using cloudconnectionpool](https://discuss.elastic.co/t/unable-connect-to-a-net-5-project-using-cloudconnectionpool/314910)
**Author:** [@shrimdog](https://discuss.elastic.co/u/shrimdog)\ **Replies:** 0\ **Last updated:** [September 22, 2022, 4:33am UTC](https://discuss.elastic.co/t/unable-connect-to-a-net-5-project-using-cloudconnectionpool/314910 "2022-09-22T04:33:28Z")
Hi Everyone I wanted to use cloudconnectionpool to connect my local .Net 5 project using NEST API since I have deployed elastic cloud. I have posted some sample data into the Elasticsearch using postman and it works wh… --- ## [EQL rules are wrong, God help me](https://discuss.elastic.co/t/eql-rules-are-wrong-god-help-me/314606)
**Author:** [@zhixiang\_hao](https://discuss.elastic.co/u/zhixiang_hao)\ **Replies:** 6\ **Last updated:** [September 22, 2022, 2:19am UTC](https://discuss.elastic.co/t/eql-rules-are-wrong-god-help-me/314606 "2022-09-22T02:19:11Z")
sequence by process.entity\_id with maxspan = 30s \[process where event.type in ("start", "process\_started") and process.name:("powershell.exe", "pwsh.exe","cmd.exe","wmic.exe","excel.exe") and process.command\_line:("H… --- ## [Search multiple fields using multiple text values](https://discuss.elastic.co/t/search-multiple-fields-using-multiple-text-values/314903)
**Author:** [@sadiki-dev](https://discuss.elastic.co/u/sadiki-dev)\ **Replies:** 2\ **Last updated:** [September 22, 2022, 1:28am UTC](https://discuss.elastic.co/t/search-multiple-fields-using-multiple-text-values/314903 "2022-09-22T01:28:50Z")
I work with address searching. and I want to search with two formats (multiple values) of an adress using multiple fields. adress is a text input not a keyword. For example : user\_address = 88 South East Street Raeford… --- ## [I have installed a Search guard Plugin in ELK 7.17.3 VERSION IN Windows, but the ELK Cluster is not starting up](https://discuss.elastic.co/t/i-have-installed-a-search-guard-plugin-in-elk-7-17-3-version-in-windows-but-the-elk-cluster-is-not-starting-up/314882)
**Author:** [@AKCG23](https://discuss.elastic.co/u/AKCG23)\ **Replies:** 3\ **Last updated:** [September 22, 2022, 12:15am UTC](https://discuss.elastic.co/t/i-have-installed-a-search-guard-plugin-in-elk-7-17-3-version-in-windows-but-the-elk-cluster-is-not-starting-up/314882 "2022-09-22T00:15:35Z")
I have the ELK Cluster(7.17.3)\* on the Windows 2019 Server. I have installed Search Guard Plugin. But after the plugin install the ELK Cluster nodes will not start up. It gives an error \`\`\` Javalang Illegalstateexcep… --- ## [Is it possible to format Logstash output in a way that it shows in Uptime?](https://discuss.elastic.co/t/is-it-possible-to-format-logstash-output-in-a-way-that-it-shows-in-uptime/314883)
**Author:** [@SamuelSMendes](https://discuss.elastic.co/u/SamuelSMendes)\ **Replies:** 3\ **Last updated:** [September 21, 2022, 8:50pm UTC](https://discuss.elastic.co/t/is-it-possible-to-format-logstash-output-in-a-way-that-it-shows-in-uptime/314883 "2022-09-21T20:50:25Z")
I was thinking if, by using mutate in the output of my pipeline on logstash in a way that "mimics" the heartbeat output, I could have an uptime application to see the return of my pseudo-heartbeat (generated by the logst… --- ## [Create custom transaction for jmeter transactions](https://discuss.elastic.co/t/create-custom-transaction-for-jmeter-transactions/314898)
**Author:** [@senyam08](https://discuss.elastic.co/u/senyam08)\ **Replies:** 0\ **Last updated:** [September 21, 2022, 8:16pm UTC](https://discuss.elastic.co/t/create-custom-transaction-for-jmeter-transactions/314898 "2022-09-21T20:16:24Z")
Trying to use elastic APM to track requests executed from jmeter load testing tool. Added trace method for http sampler by adding sampler.HTTPHC4Impl#sample. Works fine. Issue is elastic apm creating transaction with nam… --- ## [ElasticsearchStatusException\[Unable to parse response body\] \[HTTP/1.1 301 Moved Permanently\]](https://discuss.elastic.co/t/elasticsearchstatusexception-unable-to-parse-response-body-http-1-1-301-moved-permanently/314888)
**Author:** [@Jai\_Tripathi](https://discuss.elastic.co/u/Jai_Tripathi)\ **Replies:** 3\ **Last updated:** [September 21, 2022, 8:13pm UTC](https://discuss.elastic.co/t/elasticsearchstatusexception-unable-to-parse-response-body-http-1-1-301-moved-permanently/314888 "2022-09-21T20:13:59Z")
Hello Everyone, Key Points: I am able to get response from Elastic search (deployed on AWS) using postman at my machine. However when I am trying to use elasticsearch API to get the response, I am getting Elasticsearc… --- ## [Tips on mirroring Elasticsearch plugin repos?](https://discuss.elastic.co/t/tips-on-mirroring-elasticsearch-plugin-repos/314893)
**Author:** [@clueless\_chris](https://discuss.elastic.co/u/clueless_chris)\ **Replies:** 0\ **Last updated:** [September 21, 2022, 7:45pm UTC](https://discuss.elastic.co/t/tips-on-mirroring-elasticsearch-plugin-repos/314893 "2022-09-21T19:45:25Z")
Hello, I've seen some similar questions on the forum, but wanted to see if I could get any official input on this. Is there any way to properly mirror the Elasticsearch plugins that are in: https://artifacts.elastic.co/… --- ## [Jira and Confluence connector issue](https://discuss.elastic.co/t/jira-and-confluence-connector-issue/314684)
**Author:** [@PA3mEP](https://discuss.elastic.co/u/PA3mEP)\ **Replies:** 8\ **Last updated:** [September 21, 2022, 7:01pm UTC](https://discuss.elastic.co/t/jira-and-confluence-connector-issue/314684 "2022-09-21T19:01:21Z")
Hi, beautiful people. It seems that I cannot integrate out Jira and Confluence with Enterprise Search any more. Jira(Server) version 9.0.0 and Confluence(Server) 7.18.2. It feels like Atlassian has deprecated OAuth1.0 an… --- ## [Error migrating legacy index templates to composable](https://discuss.elastic.co/t/error-migrating-legacy-index-templates-to-composable/314885)
**Author:** [@Bob\_Penrod](https://discuss.elastic.co/u/Bob_Penrod)\ **Replies:** 0\ **Last updated:** [September 21, 2022, 5:15pm UTC](https://discuss.elastic.co/t/error-migrating-legacy-index-templates-to-composable/314885 "2022-09-21T17:15:16Z")
I'm running into errors on ES 7.17 migrating "legacy" index templates to the new composable style. Given the following two templates, creating the 2nd gets an error: PUT \_index\_template/test\_template\_1 { "index\_patte… --- ## [Avoid Timestamp and host from the logstash file output](https://discuss.elastic.co/t/avoid-timestamp-and-host-from-the-logstash-file-output/314870)
**Author:** [@evgrajesh](https://discuss.elastic.co/u/evgrajesh)\ **Replies:** 4\ **Last updated:** [September 21, 2022, 4:38pm UTC](https://discuss.elastic.co/t/avoid-timestamp-and-host-from-the-logstash-file-output/314870 "2022-09-21T16:38:35Z")
Hi I am using very simple configuration. Receive strings from TCP input and write to a file Sent string This is new string 8 Written in to file 2022-09-21T12:36:28.278922Z %{host} This is new string 8 I want to avo… --- ## [Environment variable in if condition is not working](https://discuss.elastic.co/t/environment-variable-in-if-condition-is-not-working/314863)
**Author:** [@seb.sch](https://discuss.elastic.co/u/seb.sch)\ **Replies:** 4\ **Last updated:** [September 21, 2022, 4:18pm UTC](https://discuss.elastic.co/t/environment-variable-in-if-condition-is-not-working/314863 "2022-09-21T16:18:36Z")
Hello there, I have the following pipeline output configuration: output { if ("${ELASTICSEARCH\_HOSTS:}" == "http://elasticsearch:9200") { elasticsearch { action =\> "index" index =\> "street" host… --- ## [Elastic-Agent Upgrade missing Version number in Source URI when setting custom Repository](https://discuss.elastic.co/t/elastic-agent-upgrade-missing-version-number-in-source-uri-when-setting-custom-repository/314865)
**Author:** [@matled](https://discuss.elastic.co/u/matled)\ **Replies:** 0\ **Last updated:** [September 21, 2022, 12:19pm UTC](https://discuss.elastic.co/t/elastic-agent-upgrade-missing-version-number-in-source-uri-when-setting-custom-repository/314865 "2022-09-21T12:19:21Z")
Elastic-Stack 8.4.2 Elastic-Agent 8.4.1 -\> Elastic Agent 8.4.2 Upgrade Windows Server 2016 We've encountered an issue with the upgrade of the elastic-agents to the newest version. Looking into the log message from fle… --- ## [Guidance on running Kibana with a CDN](https://discuss.elastic.co/t/guidance-on-running-kibana-with-a-cdn/314598)
**Author:** [@HockeyFan0000](https://discuss.elastic.co/u/HockeyFan0000)\ **Replies:** 4\ **Last updated:** [September 21, 2022, 3:58pm UTC](https://discuss.elastic.co/t/guidance-on-running-kibana-with-a-cdn/314598 "2022-09-21T15:58:59Z")
When we upgraded Kibana recently, the scripts for the plugins stopped working. It seems they were attempting to pull from the CDN but they would fail. We finally cleared the cache on the CDN and everything started work… --- ## [Use of Index Pattern with Canvas](https://discuss.elastic.co/t/use-of-index-pattern-with-canvas/314788)
**Author:** [@hnf](https://discuss.elastic.co/u/hnf)\ **Replies:** 4\ **Last updated:** [September 21, 2022, 3:53pm UTC](https://discuss.elastic.co/t/use-of-index-pattern-with-canvas/314788 "2022-09-21T15:53:56Z")
Hello Everyone, I have an index pattern that I want to use with Canvas. I tried to use poc\_alarms-%{dd-MM-YYYY} in the select request but I get this error I don't have a problem when I try with the full name referenc… --- ## [How to set a schedule on Filter or reuse the content of a event](https://discuss.elastic.co/t/how-to-set-a-schedule-on-filter-or-reuse-the-content-of-a-event/314520)
**Author:** [@SamuelSMendes](https://discuss.elastic.co/u/SamuelSMendes)\ **Replies:** 4\ **Last updated:** [September 21, 2022, 3:49pm UTC](https://discuss.elastic.co/t/how-to-set-a-schedule-on-filter-or-reuse-the-content-of-a-event/314520 "2022-09-21T15:49:42Z")
Hello everyone, need a share of your help again. This time with Logstash. The context of the problem is: I got a pipeline which goes into an API to retrieve a token with a POST, once I got this token I use it on anothe… --- ## [How to query for getting aggregating count of variable in "Rules and Connectors"](https://discuss.elastic.co/t/how-to-query-for-getting-aggregating-count-of-variable-in-rules-and-connectors/314776)
**Author:** [@girish\_5565](https://discuss.elastic.co/u/girish_5565)\ **Replies:** 0\ **Last updated:** [September 20, 2022, 1:00pm UTC](https://discuss.elastic.co/t/how-to-query-for-getting-aggregating-count-of-variable-in-rules-and-connectors/314776 "2022-09-20T13:00:50Z")
Hi , Please help me in this regard, how to get the aggregated count of one variable by query in Rules. Thanks & Regards, Gireesh --- ## [Sliced scroll returning more hits than normal search (without slice)](https://discuss.elastic.co/t/sliced-scroll-returning-more-hits-than-normal-search-without-slice/314599)
**Author:** [@Divit\_Sharma](https://discuss.elastic.co/u/Divit_Sharma)\ **Replies:** 3\ **Last updated:** [September 21, 2022, 2:36pm UTC](https://discuss.elastic.co/t/sliced-scroll-returning-more-hits-than-normal-search-without-slice/314599 "2022-09-21T14:36:03Z")
In short, normal search hits \< scroll slice 1 hits + scroll slice 2 hits When I add up sliced scroll hits, it is more than total no of documents returned from single search. Normal search query GET index\*/\_search { … --- ## [Real estate property likes and views](https://discuss.elastic.co/t/real-estate-property-likes-and-views/314758)
**Author:** [@mohammedsajidkhaleel](https://discuss.elastic.co/u/mohammedsajidkhaleel)\ **Replies:** 3\ **Last updated:** [September 21, 2022, 2:20pm UTC](https://discuss.elastic.co/t/real-estate-property-likes-and-views/314758 "2022-09-21T14:20:06Z")
Am working on a property finder project. We are using Elasticsearch to enable flexibility for user to search property. We have option in our app to show whether a user viewed a property before or no while its listed and … --- ## [Java API Client - GetResponse source null values converted to String "null"](https://discuss.elastic.co/t/java-api-client-getresponse-source-null-values-converted-to-string-null/314808)
**Author:** [@nsorauf](https://discuss.elastic.co/u/nsorauf)\ **Replies:** 2\ **Last updated:** [September 21, 2022, 1:32pm UTC](https://discuss.elastic.co/t/java-api-client-getresponse-source-null-values-converted-to-string-null/314808 "2022-09-21T13:32:25Z")
Hi, I'm working with the new Java client, v8.3.3. I'm trying to do the following: take a source from a GetResponse\ create a Jakarta JsonObjectBuilder from that JsonData source use an ObjectMapper to convert… --- ## [Pipelines.yml ignored on logstash](https://discuss.elastic.co/t/pipelines-yml-ignored-on-logstash/314807)
**Author:** [@reswob](https://discuss.elastic.co/u/reswob)\ **Replies:** 9\ **Last updated:** [September 21, 2022, 1:17pm UTC](https://discuss.elastic.co/t/pipelines-yml-ignored-on-logstash/314807 "2022-09-21T13:17:28Z")
I have looked at the following: I have LS 8.3.3 and here is version 1 of pipelines.yml located in /opt/logstash/config/pipelines.yml - pipeline.id: main path.config: "/opt/logstash/lab\_conf/\*.conf" - pipeline.id:… --- ## [Filebeat.input and filebeat.config.modules:](https://discuss.elastic.co/t/filebeat-input-and-filebeat-config-modules/314773)
**Author:** [@morad\_della3](https://discuss.elastic.co/u/morad_della3)\ **Replies:** 7\ **Last updated:** [September 21, 2022, 1:16pm UTC](https://discuss.elastic.co/t/filebeat-input-and-filebeat-config-modules/314773 "2022-09-21T13:16:32Z")
Hello, First I don't understand the role of this option in the config of filebeat , i read the docuentation but i don't understand exactly the fonction of it because i let it false and i receive the logs of the ubuntu in… --- ## [RUM JS not collecting user agent location](https://discuss.elastic.co/t/rum-js-not-collecting-user-agent-location/310993)
**Author:** [@marone](https://discuss.elastic.co/u/marone)\ **Replies:** 21\ **Last updated:** [September 21, 2022, 1:04pm UTC](https://discuss.elastic.co/t/rum-js-not-collecting-user-agent-location/310993 "2022-09-21T13:04:21Z")
This is my 3rd time configuring elastic APM, and always face a problem populating the "Page load distribution" over countries. By default elastic uses geoip processor to add client location for rum data but it's not the … --- ## [S3 snapshot failing with error Member must have length greater than or equal to 20](https://discuss.elastic.co/t/s3-snapshot-failing-with-error-member-must-have-length-greater-than-or-equal-to-20/314866)
**Author:** [@Maksym\_Postument](https://discuss.elastic.co/u/Maksym_Postument)\ **Replies:** 1\ **Last updated:** [September 21, 2022, 12:29pm UTC](https://discuss.elastic.co/t/s3-snapshot-failing-with-error-member-must-have-length-greater-than-or-equal-to-20/314866 "2022-09-21T12:29:39Z")
Hello, i m trying to configure s3 backup on cluster created with eck. I createad iam role and service account. Specified pods to use this service account. Then i added initcontainer initContainers: … --- ## [Using Java api client with json method not found error in 7.17.1](https://discuss.elastic.co/t/using-java-api-client-with-json-method-not-found-error-in-7-17-1/314825)
**Author:** [@Raghunandan](https://discuss.elastic.co/u/Raghunandan)\ **Replies:** 3\ **Last updated:** [September 21, 2022, 12:29pm UTC](https://discuss.elastic.co/t/using-java-api-client-with-json-method-not-found-error-in-7-17-1/314825 "2022-09-21T12:29:04Z")
Not able to find withJson method in any of elasticsearch request and response in version 7.17.1 where it is mentioned in all documentation. If there is no way to use it , what alternative can be used in 7.17.1 to use jso… --- ## [DB connection information](https://discuss.elastic.co/t/db-connection-information/314793)
**Author:** [@KiranMohan](https://discuss.elastic.co/u/KiranMohan)\ **Replies:** 0\ **Last updated:** [September 20, 2022, 4:39pm UTC](https://discuss.elastic.co/t/db-connection-information/314793 "2022-09-20T16:39:35Z")
It seems Logstash (7.10) Input JDBC plugin is leaking DB connections in one of the production servers. Is it possible to trace the DB connection information? The underlying Sequel library has an option to log\_connectio… [Previous page](https://discuss.elastic.co/latest.md?page=957) [Next page](https://discuss.elastic.co/latest.md?page=959)