# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=1252 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1253 --- ## [How to return multiline or long list of values in painless?](https://discuss.elastic.co/t/how-to-return-multiline-or-long-list-of-values-in-painless/247385)
**Author:** [@kelk](https://discuss.elastic.co/u/kelk)\ **Replies:** 0\ **Last updated:** [September 3, 2020, 1:11pm UTC](https://discuss.elastic.co/t/how-to-return-multiline-or-long-list-of-values-in-painless/247385 "2020-09-03T13:11:40Z")
hi, I've quite a large set of key-value fields to return in the transform as below. But I wanted it to look clean and copy-paste friendly, but fails (if I put all into one line it works) "index\_alert": { "tra… --- ## [Journalbeat in Elastic SIEM](https://discuss.elastic.co/t/journalbeat-in-elastic-siem/247305)
**Author:** [@Alfredo1](https://discuss.elastic.co/u/Alfredo1)\ **Replies:** 1\ **Last updated:** [September 3, 2020, 12:17pm UTC](https://discuss.elastic.co/t/journalbeat-in-elastic-siem/247305 "2020-09-03T12:17:02Z")
I recently started consuming HashiCorp Vault (secrets manager) audit logs into my cluster via Journalbeat, and while it's great to view the logs in Discover, it would be useful to surface those logs and associated metric… --- ## [KV filter not splitting log](https://discuss.elastic.co/t/kv-filter-not-splitting-log/247380)
**Author:** [@varun1992](https://discuss.elastic.co/u/varun1992)\ **Replies:** 0\ **Last updated:** [September 3, 2020, 12:36pm UTC](https://discuss.elastic.co/t/kv-filter-not-splitting-log/247380 "2020-09-03T12:36:47Z")
My config file as below. It's not splitting log read by grok input { file { path =\> "/log/ForwardTrafficLog.log" start\_position =\> "beginning" } } filter { grok { match =\> { "message" =\> \["%{GR… --- ## [Data Stream](https://discuss.elastic.co/t/data-stream/247310)
**Author:** [@js7](https://discuss.elastic.co/u/js7)\ **Replies:** 2\ **Last updated:** [September 3, 2020, 11:28am UTC](https://discuss.elastic.co/t/data-stream/247310 "2020-09-03T11:28:45Z")
Hello, is it possible to visualize in Kibana the Data Streams? I couldn't find a way other than with indexes. Thank you. --- ## [Kibana error fetching fields for index pattern](https://discuss.elastic.co/t/kibana-error-fetching-fields-for-index-pattern/242725)
**Author:** [@Tuckson](https://discuss.elastic.co/u/Tuckson)\ **Replies:** 18\ **Last updated:** [September 3, 2020, 11:27am UTC](https://discuss.elastic.co/t/kibana-error-fetching-fields-for-index-pattern/242725 "2020-09-03T11:27:13Z")
Hi, Have seen this question pass by several times, however yet I have found no solution. I have this ELK 7.7 stack. I try to index a log file and view the reults in Kibana. I have quite a default kibana installation a… --- ## [How to find quorum of the cluster in elasticsearch 7.x](https://discuss.elastic.co/t/how-to-find-quorum-of-the-cluster-in-elasticsearch-7-x/247335)
**Author:** [@bhavya](https://discuss.elastic.co/u/bhavya)\ **Replies:** 4\ **Last updated:** [September 3, 2020, 11:15am UTC](https://discuss.elastic.co/t/how-to-find-quorum-of-the-cluster-in-elasticsearch-7-x/247335 "2020-09-03T11:15:29Z")
I am using Elasticsearch 7.9 version. I want to find the quorum value of my cluster. Before 7.x version, discovery.zen.minimum\_master\_nodes controlled the minimum number of eligible master nodes that a node should “se… --- ## [Cannot connect to elasticsearch but i have connected to kibana](https://discuss.elastic.co/t/cannot-connect-to-elasticsearch-but-i-have-connected-to-kibana/247224)
**Author:** [@talaatkamal](https://discuss.elastic.co/u/talaatkamal)\ **Replies:** 10\ **Last updated:** [September 3, 2020, 10:51am UTC](https://discuss.elastic.co/t/cannot-connect-to-elasticsearch-but-i-have-connected-to-kibana/247224 "2020-09-03T10:51:54Z")
I cannot connect to elasticsearch , when I try to connect it through client winlogbeat , connection refused by server. --- ## [Logstash - grok - ruby and random numbers](https://discuss.elastic.co/t/logstash-grok-ruby-and-random-numbers/247367)
**Author:** [@BBQigniter](https://discuss.elastic.co/u/BBQigniter)\ **Replies:** 0\ **Last updated:** [September 3, 2020, 10:36am UTC](https://discuss.elastic.co/t/logstash-grok-ruby-and-random-numbers/247367 "2020-09-03T10:36:02Z")
hello, maybe someone has an idea here. we use following setup for our log-filtering: source -- (dns-rr) --\> 3 x logstash -\> 3-node-rabbitmq-cluster -\> 3 x logstash -\> elasticsearch-cluster on the 3-node rabbitmq-clus… --- ## [Elasticsearch: JSON processor issue in Elastic V7.8.1](https://discuss.elastic.co/t/elasticsearch-json-processor-issue-in-elastic-v7-8-1/247360)
**Author:** [@Hung\_M\_Le](https://discuss.elastic.co/u/Hung_M_Le)\ **Replies:** 0\ **Last updated:** [September 3, 2020, 9:57am UTC](https://discuss.elastic.co/t/elasticsearch-json-processor-issue-in-elastic-v7-8-1/247360 "2020-09-03T09:57:49Z")
Hi I have followed the example outlined inside the document about the JSON processor: https://www.elastic.co/guide/en/elasticsearch/reference/6.8/json-processor.html Here is the code: { "json" : { "field" : "st… --- ## [Use wildcard data type ,The number of events does not match when querying](https://discuss.elastic.co/t/use-wildcard-data-type-the-number-of-events-does-not-match-when-querying/247318)
**Author:** [@woxiang-H](https://discuss.elastic.co/u/woxiang-H)\ **Replies:** 5\ **Last updated:** [September 3, 2020, 10:01am UTC](https://discuss.elastic.co/t/use-wildcard-data-type-the-number-of-events-does-not-match-when-querying/247318 "2020-09-03T10:01:03Z")
I use two field types: text and wildcard to store the same error log. When I query, I find the missing content GET test-wildcard/\_search { "query": { "match": { "json.thrown.stack": "\*invokeWithoutCircuitBre… --- ## [Logstash-input-wmi error in logs](https://discuss.elastic.co/t/logstash-input-wmi-error-in-logs/246796)
**Author:** [@Adriann](https://discuss.elastic.co/u/Adriann)\ **Replies:** 3\ **Last updated:** [September 3, 2020, 9:53am UTC](https://discuss.elastic.co/t/logstash-input-wmi-error-in-logs/246796 "2020-09-03T09:53:50Z")
Hello, I installed logstash-wmi plugin into my logstash installation 7.8 using logstash executable and command install. I am not able to move forward with my configuration becouse of "(LoadError) load error: win32ole/w… --- ## [Logstash not detecting newly added records in elastic](https://discuss.elastic.co/t/logstash-not-detecting-newly-added-records-in-elastic/247358)
**Author:** [@B\_K\_V\_GOPI\_KRISHNA\_G](https://discuss.elastic.co/u/B_K_V_GOPI_KRISHNA_G)\ **Replies:** 0\ **Last updated:** [September 3, 2020, 9:45am UTC](https://discuss.elastic.co/t/logstash-not-detecting-newly-added-records-in-elastic/247358 "2020-09-03T09:45:48Z")
I have a sql db and I have logstash running on it for every 1min with docupsert true , everything is fine . But when i add a record into elastic using my backend code , its being pushed into the elastic successfully bu… --- ## [.task index to large](https://discuss.elastic.co/t/task-index-to-large/247352)
**Author:** [@tjmartins](https://discuss.elastic.co/u/tjmartins)\ **Replies:** 0\ **Last updated:** [September 3, 2020, 9:25am UTC](https://discuss.elastic.co/t/task-index-to-large/247352 "2020-09-03T09:25:16Z")
I'm using elasticsearch 5.6.1 and when I list my indexes I have a .task index with almost 80GB. Is there anything I can do to shrink or delete (if possible) this index? Any help please? Best regards, Tiago Martins --- ## [Logstash Configuration Error](https://discuss.elastic.co/t/logstash-configuration-error/247211)
**Author:** [@Chandana\_Koppal](https://discuss.elastic.co/u/Chandana_Koppal)\ **Replies:** 2\ **Last updated:** [September 3, 2020, 6:28am UTC](https://discuss.elastic.co/t/logstash-configuration-error/247211 "2020-09-03T06:28:32Z")
\[2020-09-02T16:11:38,526\]\[ERROR\]\[logstash.agent \] Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:main, :exception=\>"LogStash::ConfigurationError", :message=\>"Expected one of \[ \\… --- ## [Cannot see restored indices in Kibana](https://discuss.elastic.co/t/cannot-see-restored-indices-in-kibana/247226)
**Author:** [@jze](https://discuss.elastic.co/u/jze)\ **Replies:** 2\ **Last updated:** [September 3, 2020, 8:39am UTC](https://discuss.elastic.co/t/cannot-see-restored-indices-in-kibana/247226 "2020-09-03T08:39:11Z")
Hello, I installed new ELK stack using the same template/process as with existing ones and restored an old snapshot from another ELK stack via POST /\_snapshot/\/date:20200715/\_restore Now I can see via curl -s … --- ## [Audit logs or other way to ensure integrity of the logs](https://discuss.elastic.co/t/audit-logs-or-other-way-to-ensure-integrity-of-the-logs/247332)
**Author:** [@raulgs](https://discuss.elastic.co/u/raulgs)\ **Replies:** 2\ **Last updated:** [September 3, 2020, 8:34am UTC](https://discuss.elastic.co/t/audit-logs-or-other-way-to-ensure-integrity-of-the-logs/247332 "2020-09-03T08:34:29Z")
Hi all, I am wondering if audit logging like described here (https://www.elastic.co/guide/en/elasticsearch/reference/current/enable-audit-logging.html) is also available for elastic cloud on kubernetes deployments. If s… --- ## [\[Solved\] Rolling upgrade 7.6.1 -\> 7.9.0 suddenly failed on node: Java error?](https://discuss.elastic.co/t/solved-rolling-upgrade-7-6-1-7-9-0-suddenly-failed-on-node-java-error/247217)
**Author:** [@alexolivan](https://discuss.elastic.co/u/alexolivan)\ **Replies:** 4\ **Last updated:** [September 3, 2020, 8:33am UTC](https://discuss.elastic.co/t/solved-rolling-upgrade-7-6-1-7-9-0-suddenly-failed-on-node-java-error/247217 "2020-09-03T08:33:41Z")
Hi... I'm doing a rolling upgrade... overall, never had an issue with this.. The cluster is 7.6.1 and I'm going to latest 7.9.0 All nodes are identical machines: Debian stable machines... so far so good. I tried upgra… --- ## [Set score lower bound](https://discuss.elastic.co/t/set-score-lower-bound/247342)
**Author:** [@Alex\_D](https://discuss.elastic.co/u/Alex_D)\ **Replies:** 0\ **Last updated:** [September 3, 2020, 8:33am UTC](https://discuss.elastic.co/t/set-score-lower-bound/247342 "2020-09-03T08:33:02Z")
Hi all ! I am trying to set score lower bound for query. If I use simple query construction, "min\_score" works properly GET my-index/\_search { "query": { "match": { "textField": "something" } }, "… --- ## [Could not index event to Elasticsearch, mapper \[geoip.location\] of different type](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch-mapper-geoip-location-of-different-type/247254)
**Author:** [@real\_user](https://discuss.elastic.co/u/real_user)\ **Replies:** 4\ **Last updated:** [September 3, 2020, 8:27am UTC](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch-mapper-geoip-location-of-different-type/247254 "2020-09-03T08:27:00Z")
Hi All I have configured logstash and elasticsearch v7.8. This is the logstash part geoip { source =\> "\[iis\]\[access\]\[client\_ip\]" } Index template: GET /\_template/iis { "iis" : { "order" : 0, … --- ## [Filebeat and metricbeat as daemonset with eck](https://discuss.elastic.co/t/filebeat-and-metricbeat-as-daemonset-with-eck/210935)
**Author:** [@ikaposi](https://discuss.elastic.co/u/ikaposi)\ **Replies:** 4\ **Last updated:** [September 3, 2020, 7:20am UTC](https://discuss.elastic.co/t/filebeat-and-metricbeat-as-daemonset-with-eck/210935 "2020-09-03T07:20:01Z")
Hi, I've deployed an eck elastic cluster and now I'd like to enable the metricbeat and filebeat daemonsets. The daemonsets are however complaining the x509 certificate is not trusted. I'd prefer to somehow reference th… --- ## [Where are filebeat for eck?](https://discuss.elastic.co/t/where-are-filebeat-for-eck/229931)
**Author:** [@willes](https://discuss.elastic.co/u/willes)\ **Replies:** 3\ **Last updated:** [September 3, 2020, 7:19am UTC](https://discuss.elastic.co/t/where-are-filebeat-for-eck/229931 "2020-09-03T07:19:21Z")
when i delpoy eck, i find there no filebeat , so is there have a examle for me to deploy filebeat or other beats for eck? --- ## [Java version in Elasticsearch 7.8.0](https://discuss.elastic.co/t/java-version-in-elasticsearch-7-8-0/247329)
**Author:** [@pratiksha](https://discuss.elastic.co/u/pratiksha)\ **Replies:** 1\ **Last updated:** [September 3, 2020, 7:04am UTC](https://discuss.elastic.co/t/java-version-in-elasticsearch-7-8-0/247329 "2020-09-03T07:04:21Z")
Elasticsearch 7.8.0 comes with Java 14 and it is build using it. As per the elastic document, we can use our own version of Java and it is recommended to use a supported LTS version of Java. So, we are installing and u… --- ## [Set number of shards of index created by dateindexname processor](https://discuss.elastic.co/t/set-number-of-shards-of-index-created-by-dateindexname-processor/247263)
**Author:** [@matteocalisti](https://discuss.elastic.co/u/matteocalisti)\ **Replies:** 2\ **Last updated:** [September 3, 2020, 6:56am UTC](https://discuss.elastic.co/t/set-number-of-shards-of-index-created-by-dateindexname-processor/247263 "2020-09-03T06:56:25Z")
Hello! I'd like to know if it is possible to set the number of shards of an index created by a dateindexname processor. Right now, my pipeline creates a new index based on a date field, but creates only one primary sha… --- ## [Can we use workload Identity for leasticsearch backup and restore](https://discuss.elastic.co/t/can-we-use-workload-identity-for-leasticsearch-backup-and-restore/247232)
**Author:** [@knagasri](https://discuss.elastic.co/u/knagasri)\ **Replies:** 2\ **Last updated:** [September 3, 2020, 6:33am UTC](https://discuss.elastic.co/t/can-we-use-workload-identity-for-leasticsearch-backup-and-restore/247232 "2020-09-03T06:33:54Z")
Can we use workload Identity instead of creating k8s secrets manually for easticsearch backup and restore for elasticsearch 7.4 --- ## [Tracking\_column not found in dataset when using JDBC driver with mongodb (input)](https://discuss.elastic.co/t/tracking-column-not-found-in-dataset-when-using-jdbc-driver-with-mongodb-input/246706)
**Author:** [@timgau](https://discuss.elastic.co/u/timgau)\ **Replies:** 9\ **Last updated:** [September 3, 2020, 4:50am UTC](https://discuss.elastic.co/t/tracking-column-not-found-in-dataset-when-using-jdbc-driver-with-mongodb-input/246706 "2020-09-03T04:50:24Z")
I'm quite unclear of how to use :sql\_last\_value in my mongodb query statement like: statement =\> "var lastId = ':sql\_last\_value'; db.docs.find({ \_id: { $gte : lastId }})" my config is like this input { jdbc { jd… --- ## [Elastic search: Regex for matching longest string from list of strings in autocomplete suggester](https://discuss.elastic.co/t/elastic-search-regex-for-matching-longest-string-from-list-of-strings-in-autocomplete-suggester/247322)
**Author:** [@SatyaAditya](https://discuss.elastic.co/u/SatyaAditya)\ **Replies:** 0\ **Last updated:** [September 3, 2020, 3:48am UTC](https://discuss.elastic.co/t/elastic-search-regex-for-matching-longest-string-from-list-of-strings-in-autocomplete-suggester/247322 "2020-09-03T03:48:23Z")
I am very new to elastic search and trying to implement autocomplete suggester with regex queries. Once i receive a query, i am taking last 5 words of query and forming a list of tokens in this format query - i am tryin… --- ## [Snapshot repository encryption with FS type](https://discuss.elastic.co/t/snapshot-repository-encryption-with-fs-type/247323)
**Author:** [@nethisandeep](https://discuss.elastic.co/u/nethisandeep)\ **Replies:** 0\ **Last updated:** [September 3, 2020, 4:03am UTC](https://discuss.elastic.co/t/snapshot-repository-encryption-with-fs-type/247323 "2020-09-03T04:03:35Z")
Any inbuilt functionality that we can use for encrypting elasticsearch snapshot repository using "FS" type? or any other known solutions? May I know in which version of elasticsearch can we see this feature https://gith… --- ## [Security Header](https://discuss.elastic.co/t/security-header/247167)
**Author:** [@champes](https://discuss.elastic.co/u/champes)\ **Replies:** 7\ **Last updated:** [September 3, 2020, 3:48am UTC](https://discuss.elastic.co/t/security-header/247167 "2020-09-03T03:48:21Z")
Any thoughts on how to configure the following HTTP secure headers: X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 ; includeSubDomains … --- ## [Is it possible to access cloned event to add some more fields to it later on](https://discuss.elastic.co/t/is-it-possible-to-access-cloned-event-to-add-some-more-fields-to-it-later-on/247313)
**Author:** [@pk.241011](https://discuss.elastic.co/u/pk.241011)\ **Replies:** 1\ **Last updated:** [September 3, 2020, 3:15am UTC](https://discuss.elastic.co/t/is-it-possible-to-access-cloned-event-to-add-some-more-fields-to-it-later-on/247313 "2020-09-03T03:15:19Z")
Hi All, I have cloned an event and removed a field from it. Now I am wondering if I can later on access this cloned event in the logstash and add another field to it. clone { clones =\> \["cloned"\] … --- ## [Scheduling Logstash in Windows](https://discuss.elastic.co/t/scheduling-logstash-in-windows/247317)
**Author:** [@whyptrap](https://discuss.elastic.co/u/whyptrap)\ **Replies:** 0\ **Last updated:** [September 3, 2020, 2:52am UTC](https://discuss.elastic.co/t/scheduling-logstash-in-windows/247317 "2020-09-03T02:52:57Z")
Hi, i think i need help. I have 2 logstash configuration files with different csv file on input, and output to different index pattern too. I've try to create 2 task scheduler to run each file, and stop the task after … [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1251) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1253)