# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=648 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 649 --- ## [Doc\_values and Inverted Index in Elastic 8.1](https://discuss.elastic.co/t/doc-values-and-inverted-index-in-elastic-8-1/302716)
**Author:** [@SamuelSMendes](https://discuss.elastic.co/u/SamuelSMendes)\ **Replies:** 4\ **Last updated:** [April 25, 2022, 2:51pm UTC](https://discuss.elastic.co/t/doc-values-and-inverted-index-in-elastic-8-1/302716 "2022-04-25T14:51:18Z")
Hello everyone, my question is about the feature that makes possible to disable inverted index in Elastic 8.1. Can I still mannipulate the data I get from Logstash even without the inverted index? On my learning of ELK (… --- ## [Elasticsearch enrich index](https://discuss.elastic.co/t/elasticsearch-enrich-index/303158)
**Author:** [@Slim\_Saddem](https://discuss.elastic.co/u/Slim_Saddem)\ **Replies:** 1\ **Last updated:** [April 25, 2022, 2:07pm UTC](https://discuss.elastic.co/t/elasticsearch-enrich-index/303158 "2022-04-25T14:07:11Z")
Hi everyone! I use enrich policy to enrich indexes with data from another indexes. Link Documentation : Enrich your data | Elasticsearch Guide \[7.16\] | Elastic its works fine, but my problem is Elasticsearch doesn't r… --- ## [Map Point to Point Custom Color Ramp Lower Limit](https://discuss.elastic.co/t/map-point-to-point-custom-color-ramp-lower-limit/303051)
**Author:** [@stefan.elser](https://discuss.elastic.co/u/stefan.elser)\ **Replies:** 2\ **Last updated:** [April 25, 2022, 1:28pm UTC](https://discuss.elastic.co/t/map-point-to-point-custom-color-ramp-lower-limit/303051 "2022-04-25T13:28:28Z")
Hi, I'm trying to customize a color ramp for my point to point visualization, but can't seem to be able to set the lower limit. The values range from 0 to 2, and are the result of an Average calculation. I want to set 0… --- ## [Deprecate and remove Multiple Data Paths](https://discuss.elastic.co/t/deprecate-and-remove-multiple-data-paths/297911)
**Author:** [@st4r.f1sch](https://discuss.elastic.co/u/st4r.f1sch)\ **Replies:** 9\ **Last updated:** [April 25, 2022, 11:05am UTC](https://discuss.elastic.co/t/deprecate-and-remove-multiple-data-paths/297911 "2022-04-25T11:05:25Z")
Hi there, While I don't agree that this should be discussed here, but if that helps ¯\_(ツ)\_/¯ The issue is that Elastic is removing multiple data paths from the configuration that is a big issue when you have a ton of d… --- ## [Audit log fields](https://discuss.elastic.co/t/audit-log-fields/302874)
**Author:** [@anushka1203](https://discuss.elastic.co/u/anushka1203)\ **Replies:** 2\ **Last updated:** [April 25, 2022, 10:46am UTC](https://discuss.elastic.co/t/audit-log-fields/302874 "2022-04-25T10:46:06Z")
Hi, I have a set of audit call events, Example: type=SYSCALL msg=audit(1647800652.003:104): arch=c00000b7 syscall=221 success=yes exit=0 a0=ffff96c3a518 a1=ffffe65a32e8 a2=ffffe65a3c78 a3=8 items=0 ppid=5916 pid=7997 au… --- ## [M365 Defender Logs integration- duplicated alerts from Defender for Endpoint](https://discuss.elastic.co/t/m365-defender-logs-integration-duplicated-alerts-from-defender-for-endpoint/303141)
**Author:** [@misiel](https://discuss.elastic.co/u/misiel)\ **Replies:** 0\ **Last updated:** [April 25, 2022, 9:46am UTC](https://discuss.elastic.co/t/m365-defender-logs-integration-duplicated-alerts-from-defender-for-endpoint/303141 "2022-04-25T09:46:29Z")
Hello! M365 Defender Logs integration is spamming with duplicated Microsft Defender for Endpoint alerts. It retrieves the same alerts every 5 minutes, even when the alerts and incidents are already marked as resoled in… --- ## [Darktrace integration](https://discuss.elastic.co/t/darktrace-integration/303030)
**Author:** [@Pim\_Bos](https://discuss.elastic.co/u/Pim_Bos)\ **Replies:** 1\ **Last updated:** [April 25, 2022, 9:26am UTC](https://discuss.elastic.co/t/darktrace-integration/303030 "2022-04-25T09:26:41Z")
Hi there, Currently I am using splunk for monitoring log. For consolidation reasons we like to migrate this to elastic. I am confident this will work in most cases, but one thing I am not so sure off. Splunk has an gre… --- ## [Export Openshift metrics to an external ELK cluster](https://discuss.elastic.co/t/export-openshift-metrics-to-an-external-elk-cluster/303129)
**Author:** [@yvan.l](https://discuss.elastic.co/u/yvan.l)\ **Replies:** 0\ **Last updated:** [April 25, 2022, 8:20am UTC](https://discuss.elastic.co/t/export-openshift-metrics-to-an-external-elk-cluster/303129 "2022-04-25T08:20:59Z")
Hello We are running multiple Openshift Cluster with version 4.9.x Prometheus is monitoring openshift by default As we have an Internal (not inside openshift) ELK Cluster (7.16.2) We would like to forward metrics fro… --- ## [Trying to make all the fields as Dynamic false](https://discuss.elastic.co/t/trying-to-make-all-the-fields-as-dynamic-false/303117)
**Author:** [@Shaiju\_Sam](https://discuss.elastic.co/u/Shaiju_Sam)\ **Replies:** 1\ **Last updated:** [April 25, 2022, 7:51am UTC](https://discuss.elastic.co/t/trying-to-make-all-the-fields-as-dynamic-false/303117 "2022-04-25T07:51:02Z")
Hi Team, I am getting an error in logstash from an index since the total fields crossed 2000. I am trying to make all the fields as dynamic=false so there wont be additional fields adding up. Can someone pls let me know… --- ## [Resource management with Ingest and Transform](https://discuss.elastic.co/t/resource-management-with-ingest-and-transform/302239)
**Author:** [@bianca6](https://discuss.elastic.co/u/bianca6)\ **Replies:** 7\ **Last updated:** [April 25, 2022, 7:23am UTC](https://discuss.elastic.co/t/resource-management-with-ingest-and-transform/302239 "2022-04-25T07:23:13Z")
Hi, I currently have a running pipeline like this: Filebeat -\> Logstash -\> Elasticsearch \> Elasticsearch Transform I'm trying to process 10GB of logs. The data ingestion (Logstash -\> Elasticsearch) takes 30 mins, use… --- ## [Grok Match but not include](https://discuss.elastic.co/t/grok-match-but-not-include/303046)
**Author:** [@sukur55](https://discuss.elastic.co/u/sukur55)\ **Replies:** 2\ **Last updated:** [April 25, 2022, 6:42am UTC](https://discuss.elastic.co/t/grok-match-but-not-include/303046 "2022-04-25T06:42:27Z")
Hello, I am trying to parse a custom date&time field like: date=2022-04-22 time=09:38:04, currently I have filter like: (?\%{YEAR}-%{MONTHNUM}-%{MONTHDAY} time=%{TIME}) and result of timestamp is: 2022-04… --- ## [Logstash SNMP Input 분리 관련 문의](https://discuss.elastic.co/t/logstash-snmp-input/303113)
**Author:** [@inwoo1](https://discuss.elastic.co/u/inwoo1)\ **Replies:** 0\ **Last updated:** [April 25, 2022, 5:44am UTC](https://discuss.elastic.co/t/logstash-snmp-input/303113 "2022-04-25T05:44:04Z")
안녕하세요~! 고수님들의 고견을 기다려봅니다. snmp 수신을 받고 있는데, 한개의 설정 파일에서 snmp를 두개 따로 설정하는게 혹시 가능한가요? 예를 들면 아래와 같이 설정하는게 가능한지 궁금합니다. --- ## [How to persist data after logstash pod restart?](https://discuss.elastic.co/t/how-to-persist-data-after-logstash-pod-restart/303108)
**Author:** [@amruth](https://discuss.elastic.co/u/amruth)\ **Replies:** 0\ **Last updated:** [April 25, 2022, 1:35am UTC](https://discuss.elastic.co/t/how-to-persist-data-after-logstash-pod-restart/303108 "2022-04-25T01:35:27Z")
Hello All, I am using Logstash helm chart. I want to persist a file after logstash pod restart. For that I can see an option persistence: enabled: true But there is no much documentation on it on how to pass variabl… --- ## [데이터가 있지만 대시보드에 보여지지 않습니다](https://discuss.elastic.co/t/topic/302168)
**Author:** [@inwoo1](https://discuss.elastic.co/u/inwoo1)\ **Replies:** 4\ **Last updated:** [April 25, 2022, 1:20am UTC](https://discuss.elastic.co/t/topic/302168 "2022-04-25T01:20:47Z")
안녕하세요~ 고수님들의 고견을 기다립니다 데이터가 존재하지만 대시보드에 표시되지 않는 현상이 매우 빈번하게 발생합니다. 왜 이런 현상이 발생하는 것인가요?? 제가 뭐 설정을 잘못한걸까요? 혹시 아시는 분 계실까요? --- ## [Logstash Kafka SASL\_PLAIN input plugin config](https://discuss.elastic.co/t/logstash-kafka-sasl-plain-input-plugin-config/303107)
**Author:** [@Prateek\_Tiwari](https://discuss.elastic.co/u/Prateek_Tiwari)\ **Replies:** 0\ **Last updated:** [April 24, 2022, 10:04pm UTC](https://discuss.elastic.co/t/logstash-kafka-sasl-plain-input-plugin-config/303107 "2022-04-24T22:04:49Z")
Hi, I have been trying to connect logstash to my remote kafka instance, which has SASL\_PLAIN authentication method, but still not able establish the connection and getting the following error : org.apache.kafka.clients… --- ## [DSL query not working post upgrade](https://discuss.elastic.co/t/dsl-query-not-working-post-upgrade/303095)
**Author:** [@Ankit\_Chauhan1](https://discuss.elastic.co/u/Ankit_Chauhan1)\ **Replies:** 3\ **Last updated:** [April 24, 2022, 6:55pm UTC](https://discuss.elastic.co/t/dsl-query-not-working-post-upgrade/303095 "2022-04-24T18:55:08Z")
Earlier below query was working well in the DSL query mode. but the same has stopped working post elastic upgrade to 7.17.1 {"query":{"bool":{"must":\[{"match":{"eT.keyword":"TRANSFER"}},{"nested": {"path": "actions","qu… --- ## [Issue with PVC in ECK](https://discuss.elastic.co/t/issue-with-pvc-in-eck/301071)
**Author:** [@Nids\_Rai](https://discuss.elastic.co/u/Nids_Rai)\ **Replies:** 2\ **Last updated:** [April 24, 2022, 4:58pm UTC](https://discuss.elastic.co/t/issue-with-pvc-in-eck/301071 "2022-04-24T16:58:47Z")
Trying to setup elastic cluster using ECK documentation, but it fails and stays in Pending state kubectl get pvc -n staging NAME STATUS VOLUME CAPACITY ACCESS MODES STORA… --- ## [Logstash-CIDR Plugin](https://discuss.elastic.co/t/logstash-cidr-plugin/301990)
**Author:** [@leela](https://discuss.elastic.co/u/leela)\ **Replies:** 12\ **Last updated:** [April 24, 2022, 4:57pm UTC](https://discuss.elastic.co/t/logstash-cidr-plugin/301990 "2022-04-24T16:57:31Z")
How can we pass multiple IP's and Location names in Logstash config file with CIDR plugin for Source and Destination --- ## [Tuning ranking in search result](https://discuss.elastic.co/t/tuning-ranking-in-search-result/303097)
**Author:** [@kentoto](https://discuss.elastic.co/u/kentoto)\ **Replies:** 1\ **Last updated:** [April 24, 2022, 1:12pm UTC](https://discuss.elastic.co/t/tuning-ranking-in-search-result/303097 "2022-04-24T13:12:00Z")
doc1 = {"id":1,"text":"tonight"} doc2 = {"id":2,"text":"tonight tonight"} doc3 = {"id":3,"text":"tonight tonight tonight"} doc4 = {"id":4,"text":"tonight and something else"} doc5 = {"id":5,"text":"tonight and you"} es.… --- ## [How to solve index millions of files content with scalable approach?](https://discuss.elastic.co/t/how-to-solve-index-millions-of-files-content-with-scalable-approach/303084)
**Author:** [@sushilprj](https://discuss.elastic.co/u/sushilprj)\ **Replies:** 5\ **Last updated:** [April 24, 2022, 11:49am UTC](https://discuss.elastic.co/t/how-to-solve-index-millions-of-files-content-with-scalable-approach/303084 "2022-04-24T11:49:02Z")
I am working with an application that requires indexing thousands of files' content to make the content searchable. I use tika to extract the file content and then index it to Elasticsearch. I also tried to ingest pipeli… --- ## [Sub-aggregations in bucket Aggregation's Terms return 0 as Value](https://discuss.elastic.co/t/sub-aggregations-in-bucket-aggregations-terms-return-0-as-value/303053)
**Author:** [@Draken](https://discuss.elastic.co/u/Draken)\ **Replies:** 5\ **Last updated:** [April 24, 2022, 1:28am UTC](https://discuss.elastic.co/t/sub-aggregations-in-bucket-aggregations-terms-return-0-as-value/303053 "2022-04-24T01:28:57Z")
Hello, I'm recently introduced to Elasticsearch and currently trying to build a Monitoring application on top of it, at first everything went smoothly as we worked on elastic version 6.5.4, then we decided to move on to … --- ## [Logstash multiple output blocking: output blocking with multiple output using the isolation pattern](https://discuss.elastic.co/t/logstash-multiple-output-blocking-output-blocking-with-multiple-output-using-the-isolation-pattern/303078)
**Author:** [@yeppazu](https://discuss.elastic.co/u/yeppazu)\ **Replies:** 4\ **Last updated:** [April 23, 2022, 9:37pm UTC](https://discuss.elastic.co/t/logstash-multiple-output-blocking-output-blocking-with-multiple-output-using-the-isolation-pattern/303078 "2022-04-23T21:37:49Z")
Hello everyone, we have a trouble with a pipeline in logstash (7.17), with multiple output and isolator pattern. We have adopted the solution suggested in: In our case, input is Winlogbeat and the two outputs are: El… --- ## [How do I match by all objects in an array of objects in Elasticsearch?](https://discuss.elastic.co/t/how-do-i-match-by-all-objects-in-an-array-of-objects-in-elasticsearch/303074)
**Author:** [@codinges](https://discuss.elastic.co/u/codinges)\ **Replies:** 2\ **Last updated:** [April 23, 2022, 3:51pm UTC](https://discuss.elastic.co/t/how-do-i-match-by-all-objects-in-an-array-of-objects-in-elasticsearch/303074 "2022-04-23T15:51:03Z")
I want to get documents like below with match from Elasticsearch. { "configurationId": "dp4wb8kpw4k1s2z", "type": 1, "items": \[ { "text": "car", "rank": 1 }, { "text": "ship", "… --- ## [How to divide new index shard in all nodes](https://discuss.elastic.co/t/how-to-divide-new-index-shard-in-all-nodes/303070)
**Author:** [@DJ\_Zhu](https://discuss.elastic.co/u/DJ_Zhu)\ **Replies:** 1\ **Last updated:** [April 23, 2022, 2:19pm UTC](https://discuss.elastic.co/t/how-to-divide-new-index-shard-in-all-nodes/303070 "2022-04-23T14:19:02Z")
Thanks for your read first. I use Elasticsearch to store app logs which contains about 100 TB data in a single cluster. The data is store in a new index per 4 hours and old index will be deleted after 7 days. Since the … --- ## [Understanding the java code (Pattern Capture token filter)](https://discuss.elastic.co/t/understanding-the-java-code-pattern-capture-token-filter/303072)
**Author:** [@dishant.sharma](https://discuss.elastic.co/u/dishant.sharma)\ **Replies:** 0\ **Last updated:** [April 23, 2022, 11:41am UTC](https://discuss.elastic.co/t/understanding-the-java-code-pattern-capture-token-filter/303072 "2022-04-23T11:41:11Z")
--- ## [Logstash CSV mutate, split and filter](https://discuss.elastic.co/t/logstash-csv-mutate-split-and-filter/301084)
**Author:** [@parthmaniar](https://discuss.elastic.co/u/parthmaniar)\ **Replies:** 5\ **Last updated:** [April 23, 2022, 9:44am UTC](https://discuss.elastic.co/t/logstash-csv-mutate-split-and-filter/301084 "2022-04-23T09:44:15Z")
Hello, I hope my message finds the Elastic community safe and healthy. I am trying to import CSV files wherein I want to create a new field - tld using data from one of the columns being imported. Source Column name… --- ## [Node failed to run](https://discuss.elastic.co/t/node-failed-to-run/303066)
**Author:** [@korjavin](https://discuss.elastic.co/u/korjavin)\ **Replies:** 3\ **Last updated:** [April 23, 2022, 7:30am UTC](https://discuss.elastic.co/t/node-failed-to-run/303066 "2022-04-23T07:30:50Z")
Node has been restarted and then \[2022-04-23T05:04:36,452\]\[ERROR\]\[o.e.b.ElasticsearchUncaughtExceptionHandler\] \[elastic-elasticsearch-data-2\] fatal error in thread \[elasticsearch\[elastic-elasticsearch-data-2\]\[generic\]\[T… --- ## [Updating the alerting for all rules with the API](https://discuss.elastic.co/t/updating-the-alerting-for-all-rules-with-the-api/303065)
**Author:** [@ARDiver86](https://discuss.elastic.co/u/ARDiver86)\ **Replies:** 0\ **Last updated:** [April 22, 2022, 11:20pm UTC](https://discuss.elastic.co/t/updating-the-alerting-for-all-rules-with-the-api/303065 "2022-04-22T23:20:02Z")
Since the ability to bulk edit rules and assign an action does not exist, how can I do this with the API? I've tried a few methods via the Kibana console under dev tools but cannot get any of the GET's to return data (li… --- ## [Extract data from Elastic search using pem cert](https://discuss.elastic.co/t/extract-data-from-elastic-search-using-pem-cert/302849)
**Author:** [@newelastic](https://discuss.elastic.co/u/newelastic)\ **Replies:** 8\ **Last updated:** [April 22, 2022, 7:59pm UTC](https://discuss.elastic.co/t/extract-data-from-elastic-search-using-pem-cert/302849 "2022-04-22T19:59:32Z")
Hello, I'm new to ELK stack and we are trying to extract data from ES via logstash pipeline from existing system. Below is the logstash input pipeline being used for extracting data and my output pipeline targeted to K… --- ## [Count Last received logs](https://discuss.elastic.co/t/count-last-received-logs/303024)
**Author:** [@Bo-Wyatt](https://discuss.elastic.co/u/Bo-Wyatt)\ **Replies:** 1\ **Last updated:** [April 22, 2022, 6:59pm UTC](https://discuss.elastic.co/t/count-last-received-logs/303024 "2022-04-22T18:59:15Z")
Hello, I have a SIEM-like flow o logs. I mean, 3 or more logs with an identifier (same value in all the logs). My last received log the one I want to "keep" or "consider". Is there any way to apply this concept to my Vis… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=647) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=649)