# Latest **URL:** https://discuss.elastic.co/latest.md?page=975 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 976 --- ## [SSL certificate verify failed when connecting using Route53 CNAME records](https://discuss.elastic.co/t/ssl-certificate-verify-failed-when-connecting-using-route53-cname-records/313648)
**Author:** [@r-uehara0219](https://discuss.elastic.co/u/r-uehara0219)\ **Replies:** 2\ **Last updated:** [September 8, 2022, 3:12am UTC](https://discuss.elastic.co/t/ssl-certificate-verify-failed-when-connecting-using-route53-cname-records/313648 "2022-09-08T03:12:18Z")
using version Elasticsearch 7.16.1 curl 7.74.0 detail I configured traffic filters using AWS PrivateLink. (Configured with reference to the official documentation.) I have created 2 VPC endpoints, and 2 CNAME records … --- ## [Kibana Ingest pipeline Convert String to Date?](https://discuss.elastic.co/t/kibana-ingest-pipeline-convert-string-to-date/313836)
**Author:** [@eagles40cnuh](https://discuss.elastic.co/u/eagles40cnuh)\ **Replies:** 5\ **Last updated:** [September 8, 2022, 2:19am UTC](https://discuss.elastic.co/t/kibana-ingest-pipeline-convert-string-to-date/313836 "2022-09-08T02:19:44Z")
Installed elastic-agent on the server and Collect Custom Log Data I was Create a pipeline in Kibana (Stack Management -\> Ingest pipelines) And "Message" Field -\> Split Data (Success) How can I Convert String F… --- ## [Reset Elasticsearch Internal User Password](https://discuss.elastic.co/t/reset-elasticsearch-internal-user-password/313837)
**Author:** [@hjsroldan](https://discuss.elastic.co/u/hjsroldan)\ **Replies:** 8\ **Last updated:** [September 8, 2022, 1:31am UTC](https://discuss.elastic.co/t/reset-elasticsearch-internal-user-password/313837 "2022-09-08T01:31:49Z")
Hi, Does anyone know how to reset or change Elasticsearch internal user password? --- ## [Elasticsearch Super Slow and using low CPU](https://discuss.elastic.co/t/elasticsearch-super-slow-and-using-low-cpu/313922)
**Author:** [@abr4xc](https://discuss.elastic.co/u/abr4xc)\ **Replies:** 5\ **Last updated:** [September 8, 2022, 1:23am UTC](https://discuss.elastic.co/t/elasticsearch-super-slow-and-using-low-cpu/313922 "2022-09-08T01:23:48Z")
After gone offline for a day the elastic cluster started to be too slow, check of possible misconfigurations and could not fine anything to make it faster, the cluster is on green and there is not unassing shards, howeve… --- ## [How to list users that uses Elasticsearch/Kibana?](https://discuss.elastic.co/t/how-to-list-users-that-uses-elasticsearch-kibana/313934)
**Author:** [@Ggarcia](https://discuss.elastic.co/u/Ggarcia)\ **Replies:** 1\ **Last updated:** [September 8, 2022, 1:03am UTC](https://discuss.elastic.co/t/how-to-list-users-that-uses-elasticsearch-kibana/313934 "2022-09-08T01:03:53Z")
All, I am working in a project to try replace Splunk by ELK. I would like to list the users that logged in Elasticsearch/Kibana per day. Is there any internal index to audit users? Thank you in advanced, Gerson Garci… --- ## [Create custom heartbeat index](https://discuss.elastic.co/t/create-custom-heartbeat-index/313793)
**Author:** [@franckfct](https://discuss.elastic.co/u/franckfct)\ **Replies:** 1\ **Last updated:** [September 8, 2022, 12:58am UTC](https://discuss.elastic.co/t/create-custom-heartbeat-index/313793 "2022-09-08T00:58:34Z")
Hi, I'm trying during several days to make custom index in 'heartbeat'. The goal is to redirect output for diferrents clients. Here my main config in /etc/heartbeat/heartbeat.yml fields\_under\_root: true setup.ilm.ena… --- ## [Does Elastic Agent supports Kafka as an Input?](https://discuss.elastic.co/t/does-elastic-agent-supports-kafka-as-an-input/312290)
**Author:** [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Replies:** 1\ **Last updated:** [September 7, 2022, 10:15pm UTC](https://discuss.elastic.co/t/does-elastic-agent-supports-kafka-as-an-input/312290 "2022-09-07T22:15:45Z")
Hello, We are thinking in migrate some of our ingestion from Logstash to the integrations of Elastic Agent, but while researching the documentation of the Elastic Agent we were not able to find anything about using Kafk… --- ## [JSON parse error, Could not set field 'ip' on object '\.\.com' to value '10.XXX.XX.XX'.This is probably due to trying to set a field like \[foo\]\[bar\] = someValuewhen \[foo\] is not either a map or a string"](https://discuss.elastic.co/t/json-parse-error-could-not-set-field-ip-on-object-hostname-domain-com-to-value-10-xxx-xx-xx-this-is-probably-due-to-trying-to-set-a-field-like-foo-bar-somevaluewhen-foo-is-not-either-a-map-or-a-string/313928)
**Author:** [@Enzo\_baker](https://discuss.elastic.co/u/Enzo_baker)\ **Replies:** 0\ **Last updated:** [September 7, 2022, 9:41pm UTC](https://discuss.elastic.co/t/json-parse-error-could-not-set-field-ip-on-object-hostname-domain-com-to-value-10-xxx-xx-xx-this-is-probably-due-to-trying-to-set-a-field-like-foo-bar-somevaluewhen-foo-is-not-either-a-map-or-a-string/313928 "2022-09-07T21:41:51Z")
Hi, Error message - JSON parse error, Could not set field 'ip' on object '\.\.com' to value '10.XXX.XX.XX'.This is probably due to trying to set a field like \[foo\]\[bar\] = someValuewhen \[foo\] is not eit… --- ## [What i do in this situation?](https://discuss.elastic.co/t/what-i-do-in-this-situation/313909)
**Author:** [@morad\_della3](https://discuss.elastic.co/u/morad_della3)\ **Replies:** 1\ **Last updated:** [September 7, 2022, 9:00pm UTC](https://discuss.elastic.co/t/what-i-do-in-this-situation/313909 "2022-09-07T21:00:39Z")
I installed Filebeat, Elasticsearch, and Kibana 8.4.1 in ubuntu I collect FortiGate logs with Integration of Fortinet, in the "discover" the name of the index is filebeat-\* and I want to name it FortiGate like this exa… --- ## [Can't collect the logs of cisco router](https://discuss.elastic.co/t/cant-collect-the-logs-of-cisco-router/312318)
**Author:** [@morad\_della3](https://discuss.elastic.co/u/morad_della3)\ **Replies:** 13\ **Last updated:** [September 7, 2022, 8:47pm UTC](https://discuss.elastic.co/t/cant-collect-the-logs-of-cisco-router/312318 "2022-09-07T20:47:34Z")
this is my lab and i want to collect my router logs with syslog to filebeat installed in the same server of elasticsearch i follow this steps but i don't receive the logs my elastic server is a ubuntu server 22.04 , m… --- ## [Rule That Alerts When Logins Are Past a Certain Time](https://discuss.elastic.co/t/rule-that-alerts-when-logins-are-past-a-certain-time/311887)
**Author:** [@Jared9922](https://discuss.elastic.co/u/Jared9922)\ **Replies:** 1\ **Last updated:** [September 7, 2022, 7:45pm UTC](https://discuss.elastic.co/t/rule-that-alerts-when-logins-are-past-a-certain-time/311887 "2022-09-07T19:45:11Z")
I am trying to write a rule in Kibana that alerts when somebody logs in anytime after 7 PM and before 7 AM. I am trying to do this with a "Custom query" because this seems like the easiest approach. I have elastic agent … --- ## [Writing rules in KQL from a created index pattern](https://discuss.elastic.co/t/writing-rules-in-kql-from-a-created-index-pattern/312517)
**Author:** [@Didi\_Lilou](https://discuss.elastic.co/u/Didi_Lilou)\ **Replies:** 1\ **Last updated:** [September 7, 2022, 7:35pm UTC](https://discuss.elastic.co/t/writing-rules-in-kql-from-a-created-index-pattern/312517 "2022-09-07T19:35:24Z")
\#elastic-stack:logstash. Hello. I created an index pattern coming from snort in json format. I used logstash to create it But now i would like to write rules (xpack is activated) in kql coming from my snort index patt… --- ## [Using misp detection](https://discuss.elastic.co/t/using-misp-detection/312830)
**Author:** [@VitorBarroso](https://discuss.elastic.co/u/VitorBarroso)\ **Replies:** 1\ **Last updated:** [September 7, 2022, 7:29pm UTC](https://discuss.elastic.co/t/using-misp-detection/312830 "2022-09-07T19:29:02Z")
It's possible to use misp on endpoint security? What i need to do is, when i have a detect/prevent event, i need to say is which category of malware is. If this is not possible with misp, any other solution of this? --- ## [Enterprise Search 8 - option for anonymous / no authentication](https://discuss.elastic.co/t/enterprise-search-8-option-for-anonymous-no-authentication/313387)
**Author:** [@anonymous-75421](https://discuss.elastic.co/u/anonymous-75421)\ **Replies:** 1\ **Last updated:** [September 7, 2022, 7:05pm UTC](https://discuss.elastic.co/t/enterprise-search-8-option-for-anonymous-no-authentication/313387 "2022-09-07T19:05:15Z")
Version: 8.4.1 I'm attempting to setup a 8.4.1 stack for local development work in docker. Currently my config is Enterprise Search 8.x - Docker Compose example and its working fine. However each developer on the team h… --- ## [Ecommerce site test data](https://discuss.elastic.co/t/ecommerce-site-test-data/313524)
**Author:** [@Gayrat\_Vlasov](https://discuss.elastic.co/u/Gayrat_Vlasov)\ **Replies:** 1\ **Last updated:** [September 7, 2022, 6:53pm UTC](https://discuss.elastic.co/t/ecommerce-site-test-data/313524 "2022-09-07T18:53:15Z")
In documentation I fond excellent ecommerce example: live: github: I want to repeat this project from scratch: make new App search engines, load test data , configure search Is it possible to get json test data t… --- ## [Custom Domain Names](https://discuss.elastic.co/t/custom-domain-names/313918)
**Author:** [@Austin\_ES\_Questions](https://discuss.elastic.co/u/Austin_ES_Questions)\ **Replies:** 1\ **Last updated:** [September 7, 2022, 6:51pm UTC](https://discuss.elastic.co/t/custom-domain-names/313918 "2022-09-07T18:51:48Z")
Are custom domain names supported yet? There are a series of posts asking for them like Custom Domain Name but each one just says it's "coming soon" I do not want to setup a proxy (e.g. nginx) for this purpose, as the … --- ## [Jdbc input plugin connection pooling?](https://discuss.elastic.co/t/jdbc-input-plugin-connection-pooling/313915)
**Author:** [@steevhise](https://discuss.elastic.co/u/steevhise)\ **Replies:** 1\ **Last updated:** [September 7, 2022, 6:50pm UTC](https://discuss.elastic.co/t/jdbc-input-plugin-connection-pooling/313915 "2022-09-07T18:50:44Z")
Is there a way to give logstash jdbc plugin several db servers (all replicas of same master) to connect to? Do you just provide an array of connection strings? or what? --- ## [Detect Rules](https://discuss.elastic.co/t/detect-rules/312889)
**Author:** [@VitorBarroso](https://discuss.elastic.co/u/VitorBarroso)\ **Replies:** 1\ **Last updated:** [September 7, 2022, 6:36pm UTC](https://discuss.elastic.co/t/detect-rules/312889 "2022-09-07T18:36:47Z")
How i "connect" my detect rules with my events on External alert trend? My detect rules are those i load from the system. --- ## [Detect rules](https://discuss.elastic.co/t/detect-rules/312893)
**Author:** [@VitorBarroso](https://discuss.elastic.co/u/VitorBarroso)\ **Replies:** 1\ **Last updated:** [September 7, 2022, 6:30pm UTC](https://discuss.elastic.co/t/detect-rules/312893 "2022-09-07T18:30:01Z")
I need the elastic premium to use the Security\>Detect\>Alerts? If not, how i connect my external events to Security\>Detect\>Alerts? --- ## [CSPM for AWS](https://discuss.elastic.co/t/cspm-for-aws/313715)
**Author:** [@keiransteele](https://discuss.elastic.co/u/keiransteele)\ **Replies:** 1\ **Last updated:** [September 7, 2022, 6:05pm UTC](https://discuss.elastic.co/t/cspm-for-aws/313715 "2022-09-07T18:05:08Z")
Are there plans to have CSPM for AWS rather than just a misleading name and only Kubernetes? --- ## [JSON filter wipes out existing objects in memory](https://discuss.elastic.co/t/json-filter-wipes-out-existing-objects-in-memory/312047)
**Author:** [@juan.domenech](https://discuss.elastic.co/u/juan.domenech)\ **Replies:** 3\ **Last updated:** [September 7, 2022, 5:40pm UTC](https://discuss.elastic.co/t/json-filter-wipes-out-existing-objects-in-memory/312047 "2022-09-07T17:40:45Z")
I'd like to share this behaviour to find out whether or not is expected or desired. Problem: A field exists in memory (i.e. log.syslog.hostname:ZEUS1 ) A JSON message arrives that includes a sub-field of the existing … --- ## [Aggregation in Ingest Pipeline of Elastic Agent - Custom Logs integration](https://discuss.elastic.co/t/aggregation-in-ingest-pipeline-of-elastic-agent-custom-logs-integration/313910)
**Author:** [@rowra](https://discuss.elastic.co/u/rowra)\ **Replies:** 0\ **Last updated:** [September 7, 2022, 4:56pm UTC](https://discuss.elastic.co/t/aggregation-in-ingest-pipeline-of-elastic-agent-custom-logs-integration/313910 "2022-09-07T16:56:29Z")
Hey, Currently I have a Logstash pipeline parsing, aggregating and finally delivering Postfix logs to the Elasticsearch. I want to retire Logstash completely and use Fleet to deploy a policy with Custom Logs integration… --- ## [Trace sample logs error KQL](https://discuss.elastic.co/t/trace-sample-logs-error-kql/313703)
**Author:** [@davjl](https://discuss.elastic.co/u/davjl)\ **Replies:** 1\ **Last updated:** [September 6, 2022, 11:38pm UTC](https://discuss.elastic.co/t/trace-sample-logs-error-kql/313703 "2022-09-06T23:38:23Z")
Hi All, We have recently upgraded our older ELK cluster which was on 7.15.2 to 8.4, We used Log correlation but when upgrade cluster we have the next error When use investigate \> trace logs I have results do i ne… --- ## [What is the tsconfig.json file for?](https://discuss.elastic.co/t/what-is-the-tsconfig-json-file-for/312446)
**Author:** [@Sheereen](https://discuss.elastic.co/u/Sheereen)\ **Replies:** 1\ **Last updated:** [September 7, 2022, 4:39pm UTC](https://discuss.elastic.co/t/what-is-the-tsconfig-json-file-for/312446 "2022-09-07T16:39:02Z")
The below is the tsconfig.json file that comes by default when creating a plugin using kibana plugin generator. What is this file for? The below are the contents in the same. { "extends": "../../tsconfig.json", "… --- ## [YML File for Elasticsearch Installed with Home-brew](https://discuss.elastic.co/t/yml-file-for-elasticsearch-installed-with-home-brew/313908)
**Author:** [@ZeroCafe](https://discuss.elastic.co/u/ZeroCafe)\ **Replies:** 0\ **Last updated:** [September 7, 2022, 4:36pm UTC](https://discuss.elastic.co/t/yml-file-for-elasticsearch-installed-with-home-brew/313908 "2022-09-07T16:36:57Z")
Hello, Team! I would like to edit the .yml configuration file for the local instance of Elasticsearch I installed using Home-brew, but I can not find the location of the .yml. This is the second time I’ve run into this.… --- ## [Export Transformations Kibana](https://discuss.elastic.co/t/export-transformations-kibana/312708)
**Author:** [@atony](https://discuss.elastic.co/u/atony)\ **Replies:** 1\ **Last updated:** [September 7, 2022, 4:07pm UTC](https://discuss.elastic.co/t/export-transformations-kibana/312708 "2022-09-07T16:07:18Z")
Hello guys, I would like to export all my dashboards, transformations and new indexes from a Kibana instance to another one. I have found that with saved objects -\> export, I can export all dashboards and related object… --- ## [Output Heap Space Usage for Kibana](https://discuss.elastic.co/t/output-heap-space-usage-for-kibana/313827)
**Author:** [@andreakatie](https://discuss.elastic.co/u/andreakatie)\ **Replies:** 2\ **Last updated:** [September 7, 2022, 3:45pm UTC](https://discuss.elastic.co/t/output-heap-space-usage-for-kibana/313827 "2022-09-07T15:45:25Z")
Hello all -- I was wondering if there was a way to gather heap space usage data for Kibana (and NGINX) specifically. Using JMeter, I am able to gather real-time heap data usage for the Elasticsearch service, but I have … --- ## [Rollover index lifecycle error](https://discuss.elastic.co/t/rollover-index-lifecycle-error/313900)
**Author:** [@artax\_sb](https://discuss.elastic.co/u/artax_sb)\ **Replies:** 1\ **Last updated:** [September 7, 2022, 3:26pm UTC](https://discuss.elastic.co/t/rollover-index-lifecycle-error/313900 "2022-09-07T15:26:09Z")
Hi all! I know there are plenty post about this error but although i read them and all the doc I cant understand what is the error. I have an index already created which contains many logs--\> intextest I want to a… --- ## [Fail to restore a snapshot of a rollover index without any error message](https://discuss.elastic.co/t/fail-to-restore-a-snapshot-of-a-rollover-index-without-any-error-message/313691)
**Author:** [@rutika\_kamble](https://discuss.elastic.co/u/rutika_kamble)\ **Replies:** 0\ **Last updated:** [September 5, 2022, 1:42pm UTC](https://discuss.elastic.co/t/fail-to-restore-a-snapshot-of-a-rollover-index-without-any-error-message/313691 "2022-09-05T13:42:41Z")
I have two indices in my setup. marimba-000001 & marimba-000002 with alias marimba. Before applying to ILM I created a policy with rollover action. Then, on the existing template, I added that policy, added an alias, … --- ## [Need to get documents with field have length \> 200 words](https://discuss.elastic.co/t/need-to-get-documents-with-field-have-length-200-words/312432)
**Author:** [@mani7](https://discuss.elastic.co/u/mani7)\ **Replies:** 1\ **Last updated:** [September 7, 2022, 3:04pm UTC](https://discuss.elastic.co/t/need-to-get-documents-with-field-have-length-200-words/312432 "2022-09-07T15:04:01Z")
Trying to find the documents having field values lenght \> 200 characters [Previous page](https://discuss.elastic.co/latest.md?page=974) [Next page](https://discuss.elastic.co/latest.md?page=976)