# Latest **URL:** https://discuss.elastic.co/latest.md?page=963 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 964 --- ## [\[Kubernetes Integration\] Custom ingest pipeline for subset of k8s cluster's container's logs](https://discuss.elastic.co/t/kubernetes-integration-custom-ingest-pipeline-for-subset-of-k8s-clusters-containers-logs/314601)
**Author:** [@woodywoodsta](https://discuss.elastic.co/u/woodywoodsta)\ **Replies:** 2\ **Last updated:** [September 17, 2022, 12:44pm UTC](https://discuss.elastic.co/t/kubernetes-integration-custom-ingest-pipeline-for-subset-of-k8s-clusters-containers-logs/314601 "2022-09-17T12:44:50Z")
I'm using the Kubernetes Integration managed via fleet to collect container logs from my k8s cluster. At the moment, logs from all containers are passed through the same pipeline by means of the integration. I have a ne… --- ## [Elastic App Search login fails even after correct credentials](https://discuss.elastic.co/t/elastic-app-search-login-fails-even-after-correct-credentials/314616)
**Author:** [@murlidhar\_fichadia](https://discuss.elastic.co/u/murlidhar_fichadia)\ **Replies:** 1\ **Last updated:** [September 17, 2022, 11:09am UTC](https://discuss.elastic.co/t/elastic-app-search-login-fails-even-after-correct-credentials/314616 "2022-09-17T11:09:38Z")
I am unable to login to the Elastic App Search (7.6.0) I see the Request URL in the header is set to localhost:3002. The request to localhost:3002 would fail on the browser as localhost refers to 127.0.0.1 You can see … --- ## [Looking for some assistance with rsyslog-\>ES adding custom field, solvee will get 50$ 100%](https://discuss.elastic.co/t/looking-for-some-assistance-with-rsyslog-es-adding-custom-field-solvee-will-get-50-100/314422)
**Author:** [@PlospRawrs](https://discuss.elastic.co/u/PlospRawrs)\ **Replies:** 2\ **Last updated:** [September 17, 2022, 4:35am UTC](https://discuss.elastic.co/t/looking-for-some-assistance-with-rsyslog-es-adding-custom-field-solvee-will-get-50-100/314422 "2022-09-17T04:35:00Z")
Hi All, Looking for some guidance, per the subject, I will give the solvee 50$ to show my appreciation. I will share solution on thread I don't care, but I will compensate. Setup: Rsyslog version 8.20 ES version 7.10 … --- ## [Elasticsearch won’t start after upgrade to 8.4.1](https://discuss.elastic.co/t/elasticsearch-won-t-start-after-upgrade-to-8-4-1/314583)
**Author:** [@Ubuxa](https://discuss.elastic.co/u/Ubuxa)\ **Replies:** 4\ **Last updated:** [September 17, 2022, 2:12am UTC](https://discuss.elastic.co/t/elasticsearch-won-t-start-after-upgrade-to-8-4-1/314583 "2022-09-17T02:12:40Z")
Similar issue, but this ticket has since been closed: I upgraded Elasticsearch from 7.17.5 to 8.4.1, and unfortunately I did not check for any incompatibilities. I am now unable to start Elasticsearch, and downgrading … --- ## [Mapping question](https://discuss.elastic.co/t/mapping-question/314528)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 10\ **Last updated:** [September 16, 2022, 9:35pm UTC](https://discuss.elastic.co/t/mapping-question/314528 "2022-09-16T21:35:30Z")
I have old index hundreds of them which has following in pattern. I have another index created on different test cluster. which had this place dynamically. What I want is to add this host.name.keyword in previous… --- ## [Elastic Agent Configured By Fleet - Integrations Using MetricBeat - this action is granted by the index privileges error](https://discuss.elastic.co/t/elastic-agent-configured-by-fleet-integrations-using-metricbeat-this-action-is-granted-by-the-index-privileges-error/314603)
**Author:** [@dnimon](https://discuss.elastic.co/u/dnimon)\ **Replies:** 0\ **Last updated:** [September 16, 2022, 9:15pm UTC](https://discuss.elastic.co/t/elastic-agent-configured-by-fleet-integrations-using-metricbeat-this-action-is-granted-by-the-index-privileges-error/314603 "2022-09-16T21:15:20Z")
I am running into an issue when trying to use Elastic Fleet and the elastic agents. I am using 8.4.1 for all parts (kibana, elastic, elastic-agent). I was able to setup a elastic-agent on the elastic/kibana server to se… --- ## [After filebeat upgrades & preserving registry it sending duplicate events](https://discuss.elastic.co/t/after-filebeat-upgrades-preserving-registry-it-sending-duplicate-events/313701)
**Author:** [@krish0608](https://discuss.elastic.co/u/krish0608)\ **Replies:** 14\ **Last updated:** [September 16, 2022, 4:15pm UTC](https://discuss.elastic.co/t/after-filebeat-upgrades-preserving-registry-it-sending-duplicate-events/313701 "2022-09-16T16:15:01Z")
I am having a trouble with duplicate events in elasticsearch after updating it to 7.17.3 from 5.6.5. In case of Linux its working as expected but in windows its sending duplicate events. Below are my configurations: ===… --- ## [Osquery Manager Feedback - OSQuery manager API needed for automatically downloading Elastic packs](https://discuss.elastic.co/t/osquery-manager-feedback-osquery-manager-api-needed-for-automatically-downloading-elastic-packs/314536)
**Author:** [@joedissmeyer](https://discuss.elastic.co/u/joedissmeyer)\ **Replies:** 2\ **Last updated:** [September 16, 2022, 7:36pm UTC](https://discuss.elastic.co/t/osquery-manager-feedback-osquery-manager-api-needed-for-automatically-downloading-elastic-packs/314536 "2022-09-16T19:36:51Z")
Hello! Is there a Kibana API I can use to automatically download and install the Elastic created OSquery manager packs? There are several APIs available documented here, Osquery manager API | Kibana Guide \[8.4\] | Elasti… --- ## [Query DSL in kibana discover](https://discuss.elastic.co/t/query-dsl-in-kibana-discover/314526)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 2\ **Last updated:** [September 16, 2022, 6:58pm UTC](https://discuss.elastic.co/t/query-dsl-in-kibana-discover/314526 "2022-09-16T18:58:46Z")
I want to run this below query in kibana discover filter "aggs": { "response\_term": { "terms": { "field": "ResponseCode.keyword", "size": 100000 }, "aggs": { "response": { "… --- ## [Create a table where the columns change depending on which fields exist for the data returned (given filters and searches)](https://discuss.elastic.co/t/create-a-table-where-the-columns-change-depending-on-which-fields-exist-for-the-data-returned-given-filters-and-searches/314596)
**Author:** [@akitatak](https://discuss.elastic.co/u/akitatak)\ **Replies:** 0\ **Last updated:** [September 16, 2022, 5:55pm UTC](https://discuss.elastic.co/t/create-a-table-where-the-columns-change-depending-on-which-fields-exist-for-the-data-returned-given-filters-and-searches/314596 "2022-09-16T17:55:21Z")
Hello, So in my index pattern objects\* has multiple different object types within it that all have their own fields. Example: Object 1: type=house, id=0, color=blue, size=2000, city=Portland) Object 2: type=car, id=1… --- ## [Xpack security troubles](https://discuss.elastic.co/t/xpack-security-troubles/314594)
**Author:** [@Mo\_the\_literate](https://discuss.elastic.co/u/Mo_the_literate)\ **Replies:** 0\ **Last updated:** [September 16, 2022, 5:30pm UTC](https://discuss.elastic.co/t/xpack-security-troubles/314594 "2022-09-16T17:30:58Z")
Hi guys, I have installed graylog-server 4.3.5-1 on Debian 11.4 as well as elasticsearch 7.17.5 When I run the setup without uncommenting #xpack.security.enabled: true I get these here warnings in logs: "Elasticsear… --- ## [Unable to see winlogbeat logs in the analytics discover](https://discuss.elastic.co/t/unable-to-see-winlogbeat-logs-in-the-analytics-discover/314590)
**Author:** [@Neyo](https://discuss.elastic.co/u/Neyo)\ **Replies:** 0\ **Last updated:** [September 16, 2022, 4:58pm UTC](https://discuss.elastic.co/t/unable-to-see-winlogbeat-logs-in-the-analytics-discover/314590 "2022-09-16T16:58:28Z")
I'm unable to see the logs in the dashboard, Please give some advice: winlogbeat.yml file: ###################### Winlogbeat Configuration Example ######################## # This file is an example configuration file … --- ## [Break down log messages to keywords](https://discuss.elastic.co/t/break-down-log-messages-to-keywords/314588)
**Author:** [@Mark\_S](https://discuss.elastic.co/u/Mark_S)\ **Replies:** 0\ **Last updated:** [September 16, 2022, 3:39pm UTC](https://discuss.elastic.co/t/break-down-log-messages-to-keywords/314588 "2022-09-16T15:39:40Z")
I want to index logs from different applications in one index. However some applications don't use exactly the same log format.... How can I use a grok pattern in the input section of the config file to break down the … --- ## [Kibana Dashboard Enlarge image on click](https://discuss.elastic.co/t/kibana-dashboard-enlarge-image-on-click/314404)
**Author:** [@mirokrastev](https://discuss.elastic.co/u/mirokrastev)\ **Replies:** 5\ **Last updated:** [September 16, 2022, 3:24pm UTC](https://discuss.elastic.co/t/kibana-dashboard-enlarge-image-on-click/314404 "2022-09-16T15:24:28Z")
Hello, Please take a look at the attached snippet. Basically we have a table, which has images into it. My goal here is to be able to enlarge the image, when I click on it. Can you let me know if there is such functiona… --- ## [Logstash from SQL Server to Elasticsearch character encoding problem](https://discuss.elastic.co/t/logstash-from-sql-server-to-elasticsearch-character-encoding-problem/314587)
**Author:** [@Startech](https://discuss.elastic.co/u/Startech)\ **Replies:** 0\ **Last updated:** [September 16, 2022, 3:23pm UTC](https://discuss.elastic.co/t/logstash-from-sql-server-to-elasticsearch-character-encoding-problem/314587 "2022-09-16T15:23:25Z")
Hi, I am using ELK stack v8.4.1 and trying to integrate data between SQL Server and Elasticsearch via Logstash. My source table includes Turkish characters (collation SQL\_Latin1\_General\_CP1\_CI\_AS). When Logstash writes … --- ## [How to run a pipeline from a pipeline](https://discuss.elastic.co/t/how-to-run-a-pipeline-from-a-pipeline/314562)
**Author:** [@reed](https://discuss.elastic.co/u/reed)\ **Replies:** 4\ **Last updated:** [September 16, 2022, 2:37pm UTC](https://discuss.elastic.co/t/how-to-run-a-pipeline-from-a-pipeline/314562 "2022-09-16T14:37:30Z")
Hi All, in my project I have 3 pipelines, I know that a pipeline can be scheduled but in my case I need to run the third one at the end of other two. There is a way to do this? run the pipelines in order: pipeline1 -\>… --- ## [Filebeat hogged the IO](https://discuss.elastic.co/t/filebeat-hogged-the-io/314581)
**Author:** [@silence-linhl](https://discuss.elastic.co/u/silence-linhl)\ **Replies:** 0\ **Last updated:** [September 16, 2022, 2:35pm UTC](https://discuss.elastic.co/t/filebeat-hogged-the-io/314581 "2022-09-16T14:35:20Z")
filebeat hogged the IO After starting filebeat, I found that the IO of the machine became very high. After the digging, it was found that filebeat kept writing to disk a file named checkpoint.new after it was started. S… --- ## [UDP Listener died, address already in use](https://discuss.elastic.co/t/udp-listener-died-address-already-in-use/314281)
**Author:** [@sirineb](https://discuss.elastic.co/u/sirineb)\ **Replies:** 4\ **Last updated:** [September 16, 2022, 2:24pm UTC](https://discuss.elastic.co/t/udp-listener-died-address-already-in-use/314281 "2022-09-16T14:24:49Z")
Hi, I have two pipeline configurations located in /etc/logstash/conf.d. I can make work both seperately by running /usr/share/logstash/bin/logstash -f /etc/logstash/conf.d/\*\*.conf -r, and it sends data to elasticsearch … --- ## [How to handle inconsistent field types](https://discuss.elastic.co/t/how-to-handle-inconsistent-field-types/314064)
**Author:** [@elastimatic](https://discuss.elastic.co/u/elastimatic)\ **Replies:** 3\ **Last updated:** [September 16, 2022, 2:12pm UTC](https://discuss.elastic.co/t/how-to-handle-inconsistent-field-types/314064 "2022-09-16T14:12:51Z")
I am trying to index a JSON object (comes from Postgres) that has sometimes-inconsistent types that is tripping me up. an example would be: { "financials": { "amount": "100" } }, { "financials": { … --- ## [Elastic Agent Tomcat Integration Error](https://discuss.elastic.co/t/elastic-agent-tomcat-integration-error/314579)
**Author:** [@DougR](https://discuss.elastic.co/u/DougR)\ **Replies:** 0\ **Last updated:** [September 16, 2022, 1:53pm UTC](https://discuss.elastic.co/t/elastic-agent-tomcat-integration-error/314579 "2022-09-16T13:53:40Z")
What versions of Tomcat are supported by the Elastic Agent Tomcat integration? I have an instance which runs an older version of Tomcat (8.5), and I get dissect\_parsing\_error in my events, which are pushed to Elasticsear… --- ## [Issue with logstash agent](https://discuss.elastic.co/t/issue-with-logstash-agent/314578)
**Author:** [@yas](https://discuss.elastic.co/u/yas)\ **Replies:** 0\ **Last updated:** [September 16, 2022, 1:34pm UTC](https://discuss.elastic.co/t/issue-with-logstash-agent/314578 "2022-09-16T13:34:02Z")
Having an issue with Logstash agents ( linux hosts ) sending files to a server - what seems to happen is on the agent starting up , the first few rows of the logs are sent after which it just stops and nothing further is… --- ## [Custom API integration](https://discuss.elastic.co/t/custom-api-integration/314538)
**Author:** [@alextg](https://discuss.elastic.co/u/alextg)\ **Replies:** 1\ **Last updated:** [September 16, 2022, 11:51am UTC](https://discuss.elastic.co/t/custom-api-integration/314538 "2022-09-16T11:51:19Z")
Hello, I'm running into issues while implementing the Custom API integration which sends API get requests. I have setup successfully other integrations using the Custom Logs integration, however, the Custom API integrat… --- ## [Auditbeat logs write to /var/log/messages](https://discuss.elastic.co/t/auditbeat-logs-write-to-var-log-messages/314361)
**Author:** [@masonlu2014](https://discuss.elastic.co/u/masonlu2014)\ **Replies:** 3\ **Last updated:** [September 16, 2022, 12:32pm UTC](https://discuss.elastic.co/t/auditbeat-logs-write-to-var-log-messages/314361 "2022-09-16T12:32:09Z")
hi guys, we are sawing weird issue, we are using auditbeat as pod running on our kubenets cluster, however in some day, we saw there is a large audit events has been write to our work node /var/log/message, and i can co… --- ## [Unable to acquire permit to use snapshot files during recovery](https://discuss.elastic.co/t/unable-to-acquire-permit-to-use-snapshot-files-during-recovery/313935)
**Author:** [@yuswanul](https://discuss.elastic.co/u/yuswanul)\ **Replies:** 10\ **Last updated:** [September 16, 2022, 12:14pm UTC](https://discuss.elastic.co/t/unable-to-acquire-permit-to-use-snapshot-files-during-recovery/313935 "2022-09-16T12:14:28Z")
Hello there, i want to ask something about this. i haven't made any changes and i just wanted to check my cluster but suddenly one of my data node was offline and my cluster state from green to yellow. i found much log … --- ## [Process events from split](https://discuss.elastic.co/t/process-events-from-split/314564)
**Author:** [@sirReeall](https://discuss.elastic.co/u/sirReeall)\ **Replies:** 1\ **Last updated:** [September 16, 2022, 10:01am UTC](https://discuss.elastic.co/t/process-events-from-split/314564 "2022-09-16T10:01:34Z")
Is it possible to have logstash process the events generated from a split? For example, give the following: 2022-09-06 23:39:01.034+0000 INFO \[my.java.class\] Process started \\n some lines \\n some more lines \\n … --- ## [Create elastic field alias](https://discuss.elastic.co/t/create-elastic-field-alias/313966)
**Author:** [@sirReeall](https://discuss.elastic.co/u/sirReeall)\ **Replies:** 4\ **Last updated:** [September 16, 2022, 9:25am UTC](https://discuss.elastic.co/t/create-elastic-field-alias/313966 "2022-09-16T09:25:34Z")
Hello, Is it possible for logstash to alias fields as described in the elastic docs below? --- ## [Spring + ES 8 server, can't make it compatible](https://discuss.elastic.co/t/spring-es-8-server-cant-make-it-compatible/314557)
**Author:** [@lhberg](https://discuss.elastic.co/u/lhberg)\ **Replies:** 0\ **Last updated:** [September 16, 2022, 8:16am UTC](https://discuss.elastic.co/t/spring-es-8-server-cant-make-it-compatible/314557 "2022-09-16T08:16:36Z")
Hi! So, I'm new to ES and been running ES locally through docker on ES 7.17.3 with RestHighLevelClient, Spring Data ES and running queries with QueryBuilders etc. Now I've been hosting Elastic Search through your/their… --- ## [Invalid Index Name-Index name must be lowercase error](https://discuss.elastic.co/t/invalid-index-name-index-name-must-be-lowercase-error/314287)
**Author:** [@tapas](https://discuss.elastic.co/u/tapas)\ **Replies:** 15\ **Last updated:** [September 16, 2022, 7:55am UTC](https://discuss.elastic.co/t/invalid-index-name-index-name-must-be-lowercase-error/314287 "2022-09-16T07:55:52Z")
I am getting error in logstash logs saying that the index is invalid and reason is it should be lower case.but the index name in the log is different from the index i declared in the logstash.config file.in log file it i… --- ## [Kibana visualization to show intime value count of different fieldski](https://discuss.elastic.co/t/kibana-visualization-to-show-intime-value-count-of-different-fieldski/312642)
**Author:** [@PRASHANT\_MEHTA](https://discuss.elastic.co/u/PRASHANT_MEHTA)\ **Replies:** 3\ **Last updated:** [September 16, 2022, 7:42am UTC](https://discuss.elastic.co/t/kibana-visualization-to-show-intime-value-count-of-different-fieldski/312642 "2022-09-16T07:42:32Z")
Hello All, How to make TSVB visualization displaying all the count values for given filelds. Here I'm trying to dispaly the index updated,nodes travered,entrie process and chunk "intime" count value wrt statistic time.… --- ## [Slow performance Logstash/Filebeat](https://discuss.elastic.co/t/slow-performance-logstash-filebeat/314040)
**Author:** [@AsapNoCare](https://discuss.elastic.co/u/AsapNoCare)\ **Replies:** 6\ **Last updated:** [September 16, 2022, 7:19am UTC](https://discuss.elastic.co/t/slow-performance-logstash-filebeat/314040 "2022-09-16T07:19:12Z")
Hi everyone, It’s the first time I ask for help so feel free to tell me if you need more information from me. Something else, English is not my native language so sorry in advance for the mistakes. Here is my data flo… [Previous page](https://discuss.elastic.co/latest.md?page=962) [Next page](https://discuss.elastic.co/latest.md?page=964)