# Latest **URL:** https://discuss.elastic.co/latest.md?page=985 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 986 --- ## [Apache integration - own log pattern](https://discuss.elastic.co/t/apache-integration-own-log-pattern/313357)
**Author:** [@elkuser1234](https://discuss.elastic.co/u/elkuser1234)\ **Replies:** 1\ **Last updated:** [September 1, 2022, 5:32am UTC](https://discuss.elastic.co/t/apache-integration-own-log-pattern/313357 "2022-09-01T05:32:56Z")
Hi I used elk stack 8.3 I would like to use the apache integration, but the log format is non-standard. access\_log\_pattern=%{X-Forwarded-For}i %h %l %u %t \\"%r\\" %s %b \\"%{Referer}i\\" \\"%{User-Agent}i\\" I get the mes… --- ## [Fetch values from excel sheet in Logstash](https://discuss.elastic.co/t/fetch-values-from-excel-sheet-in-logstash/313406)
**Author:** [@ImranArif](https://discuss.elastic.co/u/ImranArif)\ **Replies:** 0\ **Last updated:** [September 1, 2022, 3:46am UTC](https://discuss.elastic.co/t/fetch-values-from-excel-sheet-in-logstash/313406 "2022-09-01T03:46:05Z")
Hi all, I am parsing CDN logs, which contains a web url that serves images to users, and push these logs to Elasticsearch using Logstash. I want to add a field 'site region' in the logs which contains the region that we… --- ## [querySuggestion with custom analyzer](https://discuss.elastic.co/t/querysuggestion-with-custom-analyzer/312600)
**Author:** [@matip](https://discuss.elastic.co/u/matip)\ **Replies:** 1\ **Last updated:** [August 31, 2022, 11:31pm UTC](https://discuss.elastic.co/t/querysuggestion-with-custom-analyzer/312600 "2022-08-31T23:31:12Z")
Hi, is it possible to define an own analyzer for the query suggestions in App Search? We are currently calling appSearchClient.querySuggestion(value, getQuerySuggestionOptions(fields, size)) and and have to trick the s… --- ## [Parse Nested Airflow Logs with Logstash](https://discuss.elastic.co/t/parse-nested-airflow-logs-with-logstash/313401)
**Author:** [@Chma](https://discuss.elastic.co/u/Chma)\ **Replies:** 0\ **Last updated:** [August 31, 2022, 10:58pm UTC](https://discuss.elastic.co/t/parse-nested-airflow-logs-with-logstash/313401 "2022-08-31T22:58:08Z")
I am new to Logstash and ELK as a whole. I am trying to send my airflow logs to Logstash. I am confused on how to configure my configuration file, especially because I have several (nested) log files. My airflow is depl… --- ## [Can I push logs to logstash via an API endpoint?](https://discuss.elastic.co/t/can-i-push-logs-to-logstash-via-an-api-endpoint/313399)
**Author:** [@clarkmcc](https://discuss.elastic.co/u/clarkmcc)\ **Replies:** 1\ **Last updated:** [August 31, 2022, 10:43pm UTC](https://discuss.elastic.co/t/can-i-push-logs-to-logstash-via-an-api-endpoint/313399 "2022-08-31T22:43:33Z")
We have ~30 services that run on customer-premise (not our premise) and we'd like to push logs from our service on their machine to an Elasticsearch instance for debugging and analysis. We'd like to avoid having to insta… --- ## [Azure Resource Metrics Integration. elastic\_agent.metricbeat\]\[warn\] Charges amounted](https://discuss.elastic.co/t/azure-resource-metrics-integration-elastic-agent-metricbeat-warn-charges-amounted/311790)
**Author:** [@vithal\_wadje](https://discuss.elastic.co/u/vithal_wadje)\ **Replies:** 1\ **Last updated:** [August 31, 2022, 10:31pm UTC](https://discuss.elastic.co/t/azure-resource-metrics-integration-elastic-agent-metricbeat-warn-charges-amounted/311790 "2022-08-31T22:31:13Z")
We are retrieving the Azure resource metrics data to the elastic cloud, but in the log I see some messages. \[elastic\_agent.metricbeat\]\[warn\] Charges amounted to 27 are being applied while retrieving the metric values fro… --- ## [Azure Service Bus, Event hub, event grid metrics not collected](https://discuss.elastic.co/t/azure-service-bus-event-hub-event-grid-metrics-not-collected/311836)
**Author:** [@vithal\_wadje](https://discuss.elastic.co/u/vithal_wadje)\ **Replies:** 1\ **Last updated:** [August 31, 2022, 10:04pm UTC](https://discuss.elastic.co/t/azure-service-bus-event-hub-event-grid-metrics-not-collected/311836 "2022-08-31T22:04:00Z")
Hi , We are using the Azure Resource Metrics collector integration and we were expecting to get the integration services metrics such as service bus, event hub, and event grid, but it seems it is not collecting. Are se… --- ## [Empty array getting dropped from output, how do I keep it?](https://discuss.elastic.co/t/empty-array-getting-dropped-from-output-how-do-i-keep-it/313392)
**Author:** [@Ben-G](https://discuss.elastic.co/u/Ben-G)\ **Replies:** 2\ **Last updated:** [August 31, 2022, 10:02pm UTC](https://discuss.elastic.co/t/empty-array-getting-dropped-from-output-how-do-i-keep-it/313392 "2022-08-31T22:02:12Z")
The input to my logstash is is populating \[Current\]\[Alarms\] from the input ...\\"Alarms\\":null... when there are no alarms, and when there are alarms then it is a list. When there are no alarms, I still want to see "Ala… --- ## [Strigo Lab Credentials](https://discuss.elastic.co/t/strigo-lab-credentials/313351)
**Author:** [@rossg](https://discuss.elastic.co/u/rossg)\ **Replies:** 0\ **Last updated:** [August 31, 2022, 11:27am UTC](https://discuss.elastic.co/t/strigo-lab-credentials/313351 "2022-08-31T11:27:13Z")
Hello, I am unable to log into the mysql db with username elastic for the labs, the provided password does not seem to work. --- ## [Get the latest index of a certain form in elasticsearch](https://discuss.elastic.co/t/get-the-latest-index-of-a-certain-form-in-elasticsearch/313379)
**Author:** [@kosmylo](https://discuss.elastic.co/u/kosmylo)\ **Replies:** 1\ **Last updated:** [August 31, 2022, 9:22pm UTC](https://discuss.elastic.co/t/get-the-latest-index-of-a-certain-form-in-elasticsearch/313379 "2022-08-31T21:22:15Z")
I am periodically training an anomaly detection model and I am saving it in elasticsearch index of the form 'anomaly\_detection\_model-' + date\_model\_trained. This means that I am ending up with indices of the form: anomal… --- ## [Kibana server is not ready yet](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet/313385)
**Author:** [@Boodle](https://discuss.elastic.co/u/Boodle)\ **Replies:** 1\ **Last updated:** [August 31, 2022, 9:07pm UTC](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet/313385 "2022-08-31T21:07:55Z")
upgraded Elasticsearch from 7.10 to 7.17. After Upgrade, the ES & kibana nodes are up but when trying to access the Kibana frontend, gets error"Kibana server is not ready yet". I checked logs at \\var\\logs\\messages\\ and… --- ## [Using a single Life Cycle Policy for many Index Templates](https://discuss.elastic.co/t/using-a-single-life-cycle-policy-for-many-index-templates/311236)
**Author:** [@dturner](https://discuss.elastic.co/u/dturner)\ **Replies:** 4\ **Last updated:** [August 31, 2022, 8:03pm UTC](https://discuss.elastic.co/t/using-a-single-life-cycle-policy-for-many-index-templates/311236 "2022-08-31T20:03:55Z")
Hello, We are using Elastic agent with different policies for different integrations. This has created many index templates for these different data sources. Each one of these index templates is using a different index … --- ## [Switching from cert-util to cert-manager](https://discuss.elastic.co/t/switching-from-cert-util-to-cert-manager/312195)
**Author:** [@danksim](https://discuss.elastic.co/u/danksim)\ **Replies:** 1\ **Last updated:** [August 31, 2022, 7:52pm UTC](https://discuss.elastic.co/t/switching-from-cert-util-to-cert-manager/312195 "2022-08-31T19:52:50Z")
Elasticsearch version: 7.6.2 Running it with Helm on AWS EKS Old setup (v1): cert-util is run manually (some makefile/script) before helm install in CI. Not using InitContainers Current setup (v2): helm chart now crea… --- ## [The new version of the official documentation is too bad to use！](https://discuss.elastic.co/t/the-new-version-of-the-official-documentation-is-too-bad-to-use/313312)
**Author:** [@laoyang360](https://discuss.elastic.co/u/laoyang360)\ **Replies:** 6\ **Last updated:** [August 31, 2022, 5:31pm UTC](https://discuss.elastic.co/t/the-new-version-of-the-official-documentation-is-too-bad-to-use/313312 "2022-08-31T17:31:04Z")
After the revision of the official Elasticstack documentation, the new drop-down menu bar has become extremely difficult to use. I would like to ask if it is possible to go back to the previous version which is easy to … --- ## [Failed to connect to localhost port 9200: Connection refused](https://discuss.elastic.co/t/failed-to-connect-to-localhost-port-9200-connection-refused/312954)
**Author:** [@ishan.abhinit](https://discuss.elastic.co/u/ishan.abhinit)\ **Replies:** 14\ **Last updated:** [August 31, 2022, 5:17pm UTC](https://discuss.elastic.co/t/failed-to-connect-to-localhost-port-9200-connection-refused/312954 "2022-08-31T17:17:08Z")
I am trying to install Elasticsearch 8.4.0 and kibana on Rocky Linux 8.6 using this article. Both elasticsearch and kibana are active and running but running this cmd: curl -X GET 'http://localhost:9200' I get curl: … --- ## [How to reset Fleet Server default output configuration?](https://discuss.elastic.co/t/how-to-reset-fleet-server-default-output-configuration/313178)
**Author:** [@GustavoPires](https://discuss.elastic.co/u/GustavoPires)\ **Replies:** 7\ **Last updated:** [August 31, 2022, 4:34pm UTC](https://discuss.elastic.co/t/how-to-reset-fleet-server-default-output-configuration/313178 "2022-08-31T16:34:55Z")
Hello, I am trying to change default output fleet server configuration, It is possible? I don't want to reinstall all my elasticsearch again. --- ## [Best way to implement a daily based time series, where current day data is being refreshed](https://discuss.elastic.co/t/best-way-to-implement-a-daily-based-time-series-where-current-day-data-is-being-refreshed/313377)
**Author:** [@dashiad](https://discuss.elastic.co/u/dashiad)\ **Replies:** 0\ **Last updated:** [August 31, 2022, 4:11pm UTC](https://discuss.elastic.co/t/best-way-to-implement-a-daily-based-time-series-where-current-day-data-is-being-refreshed/313377 "2022-08-31T16:11:00Z")
We're trying to find which would be the best way to handle this case: We are storing daily data from a remote source. This remote source updates the data several times per day, so we'd need to refresh the index too, for… --- ## [Kibana Generate CSV - Could Not Load Plugin](https://discuss.elastic.co/t/kibana-generate-csv-could-not-load-plugin/313298)
**Author:** [@JulieB](https://discuss.elastic.co/u/JulieB)\ **Replies:** 3\ **Last updated:** [August 31, 2022, 3:44pm UTC](https://discuss.elastic.co/t/kibana-generate-csv-could-not-load-plugin/313298 "2022-08-31T15:44:54Z")
Hi there, I am trying to export some data using Share \> CSV Reports \> Generate CSV feature (see picture). Once the file is ready to download, a new tab would normally open and trigger the download of the CSV file. Howeve… --- ## [How to create users for file based auth and deploy using Helm Chart](https://discuss.elastic.co/t/how-to-create-users-for-file-based-auth-and-deploy-using-helm-chart/313374)
**Author:** [@Rohit\_Shrivastava](https://discuss.elastic.co/u/Rohit_Shrivastava)\ **Replies:** 0\ **Last updated:** [August 31, 2022, 3:38pm UTC](https://discuss.elastic.co/t/how-to-create-users-for-file-based-auth-and-deploy-using-helm-chart/313374 "2022-08-31T15:38:24Z")
Hi I wanted to know how should I automate the users file creation (file based authentication) with helm chart. Docs suggests to use elasticsearch-users cli, should I run an init container and run the script? Should I g… --- ## [Cross Cluster Search(CCS) or Cross Cluster Replication?](https://discuss.elastic.co/t/cross-cluster-search-ccs-or-cross-cluster-replication/313031)
**Author:** [@lcui\_dxc](https://discuss.elastic.co/u/lcui_dxc)\ **Replies:** 2\ **Last updated:** [August 31, 2022, 3:19pm UTC](https://discuss.elastic.co/t/cross-cluster-search-ccs-or-cross-cluster-replication/313031 "2022-08-31T15:19:47Z")
Hi there: We have a client, they sell goods over the world. They wanted to build a search engine so anyone over the world would be able to use the search engine to find their needs. The database for their goods informat… --- ## [New Install - error setting certificate location](https://discuss.elastic.co/t/new-install-error-setting-certificate-location/313373)
**Author:** [@dci-sigh](https://discuss.elastic.co/u/dci-sigh)\ **Replies:** 0\ **Last updated:** [August 31, 2022, 3:19pm UTC](https://discuss.elastic.co/t/new-install-error-setting-certificate-location/313373 "2022-08-31T15:19:26Z")
the issue in the link is marked as closed due to inactivity, but I am still having this issue - curl error 77 when doing a fresh elasticsearch 8.4 install (see link above). Below is a workaround. Any updates on this i… --- ## [Crowdstrike Fleet Integration Ingest Pipeline Modifies Agent Fields](https://discuss.elastic.co/t/crowdstrike-fleet-integration-ingest-pipeline-modifies-agent-fields/313368)
**Author:** [@BrianD](https://discuss.elastic.co/u/BrianD)\ **Replies:** 0\ **Last updated:** [August 31, 2022, 2:37pm UTC](https://discuss.elastic.co/t/crowdstrike-fleet-integration-ingest-pipeline-modifies-agent-fields/313368 "2022-08-31T14:37:15Z")
From my understanding, the 'agent' field holds information about the filebeat agent used to pull in data from the Fleet integration. However, the Crowdstrike integration makes several changes to the 'agent.type' and 'age… --- ## [Large number of entries in \`host.ip\` of almost all logs from Elastic Agent](https://discuss.elastic.co/t/large-number-of-entries-in-host-ip-of-almost-all-logs-from-elastic-agent/313359)
**Author:** [@woodywoodsta](https://discuss.elastic.co/u/woodywoodsta)\ **Replies:** 0\ **Last updated:** [August 31, 2022, 12:39pm UTC](https://discuss.elastic.co/t/large-number-of-entries-in-host-ip-of-almost-all-logs-from-elastic-agent/313359 "2022-08-31T12:39:30Z")
I have an ECK managed Elastic Agent shipping logs to ES. In logs and metrics documents, the host.ip field has a large list of duplicate IPV6 addresses. An example: \[\, … --- ## [Keyword field type keep getting Mapped as a Multifield](https://discuss.elastic.co/t/keyword-field-type-keep-getting-mapped-as-a-multifield/313267)
**Author:** [@xef](https://discuss.elastic.co/u/xef)\ **Replies:** 2\ **Last updated:** [August 31, 2022, 2:47pm UTC](https://discuss.elastic.co/t/keyword-field-type-keep-getting-mapped-as-a-multifield/313267 "2022-08-31T14:47:51Z")
Hi We are tryoing to create an index with a field of type Keyowrd, but elasticsearch keeps creating a mapping for a multifield even though we have specified the field as a keyowrd. i..e 2 fields one with field and one w… --- ## [Disable geoip](https://discuss.elastic.co/t/disable-geoip/313366)
**Author:** [@Jonas\_S](https://discuss.elastic.co/u/Jonas_S)\ **Replies:** 1\ **Last updated:** [August 31, 2022, 2:40pm UTC](https://discuss.elastic.co/t/disable-geoip/313366 "2022-08-31T14:40:51Z")
Hello, i have a logstash pipeline creating elasticsearch indices. Everytime a new index is created, geoip fields are already in the mappings. I do not use them and they never get filled with data. How do i stop them fro… --- ## [XML or Json into elasticasearch](https://discuss.elastic.co/t/xml-or-json-into-elasticasearch/311931)
**Author:** [@kim\_frederiksen](https://discuss.elastic.co/u/kim_frederiksen)\ **Replies:** 3\ **Last updated:** [August 31, 2022, 2:01pm UTC](https://discuss.elastic.co/t/xml-or-json-into-elasticasearch/311931 "2022-08-31T14:01:39Z")
Hi everybody, I think we are doing something wrong here and I really need your help because we are stuck. We have several systems where we pass documents(xml/json) through. We want pass these document on to ELK so we c… --- ## [=\>"Expected one of \[ \\\\t\\\\r\\\\n\], \\"#\\", \\"{\\", \\"}\\"](https://discuss.elastic.co/t/expected-one-of-t-r-n/313258)
**Author:** [@syedabdullah](https://discuss.elastic.co/u/syedabdullah)\ **Replies:** 2\ **Last updated:** [August 31, 2022, 1:59pm UTC](https://discuss.elastic.co/t/expected-one-of-t-r-n/313258 "2022-08-31T13:59:17Z")
I am getting the following error and is resulting in a ingestion issue and cant seem to figure this out: \[2022-08-29T14:23:39,615\]\[ERROR\]\[logstash.agent \] Failed to execute action {:action=\>LogStash::PipelineA… --- ## [Highlighting not working after upgrade](https://discuss.elastic.co/t/highlighting-not-working-after-upgrade/312095)
**Author:** [@henke71](https://discuss.elastic.co/u/henke71)\ **Replies:** 1\ **Last updated:** [August 31, 2022, 1:17pm UTC](https://discuss.elastic.co/t/highlighting-not-working-after-upgrade/312095 "2022-08-31T13:17:35Z")
Highlighting has stopped working after upgrade from 7.16 to 8.3.3 This is when using must\_not. Steps to reproduce Create index PUT /test { "mappings": { "properties": { "Name": { "type": "text" }, "… --- ## [Field \[content\] not present as part of path \[content\] when update\_by\_query](https://discuss.elastic.co/t/field-content-not-present-as-part-of-path-content-when-update-by-query/313336)
**Author:** [@sherry\_cs](https://discuss.elastic.co/u/sherry_cs)\ **Replies:** 0\ **Last updated:** [August 31, 2022, 9:01am UTC](https://discuss.elastic.co/t/field-content-not-present-as-part-of-path-content-when-update-by-query/313336 "2022-08-31T09:01:00Z")
Hi, guys. I created an index with a pipeline which extracted field from the file attachments. It works well except the partial update. I tried the request : POST test\_know/\_update/G3LH2oIBXGHwpDNidXe9 { "doc": { … --- ## [Query\_string search on Date type returns incorrect results](https://discuss.elastic.co/t/query-string-search-on-date-type-returns-incorrect-results/313204)
**Author:** [@Miguel\_Rios](https://discuss.elastic.co/u/Miguel_Rios)\ **Replies:** 3\ **Last updated:** [August 31, 2022, 1:12pm UTC](https://discuss.elastic.co/t/query-string-search-on-date-type-returns-incorrect-results/313204 "2022-08-31T13:12:20Z")
We made a pretty big leap recently in elasticsearch versions and one issue we've run into is that when using query\_string's on Date fields we get items which are outside the range of the deadline date. I have the follow… [Previous page](https://discuss.elastic.co/latest.md?page=984) [Next page](https://discuss.elastic.co/latest.md?page=986)