# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=757 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 758 --- ## [OutOfMemoryError after PDTrueTypeFont Using fallback font warnings](https://discuss.elastic.co/t/outofmemoryerror-after-pdtruetypefont-using-fallback-font-warnings/290322)
**Author:** [@Cordobel](https://discuss.elastic.co/u/Cordobel)\ **Replies:** 7\ **Last updated:** [December 10, 2021, 10:04am UTC](https://discuss.elastic.co/t/outofmemoryerror-after-pdtruetypefont-using-fallback-font-warnings/290322 "2021-12-10T10:04:34Z")
I noticed twice that Elasticsearch crashed after some warnings about PDTrueTypeFont Using fallback font. After these warnings, the garbage collector starts to alert about the overload. Then a fatal error - lambda $MaybeD… --- ## [Best way to enrich by IP subnets](https://discuss.elastic.co/t/best-way-to-enrich-by-ip-subnets/232771)
**Author:** [@nemhods](https://discuss.elastic.co/u/nemhods)\ **Replies:** 3\ **Last updated:** [December 10, 2021, 9:34am UTC](https://discuss.elastic.co/t/best-way-to-enrich-by-ip-subnets/232771 "2021-12-10T09:34:40Z")
I want to enrich incoming ECS-compatible documents with a tag if they come from VPN IPs. From my testing, the enrich processor cannot deal with IP-ranges. However, i want to use IP-ranges and not manually (or by a scrip… --- ## [Bulksearch with multiple terms and multiple values](https://discuss.elastic.co/t/bulksearch-with-multiple-terms-and-multiple-values/291407)
**Author:** [@GopiSumanth](https://discuss.elastic.co/u/GopiSumanth)\ **Replies:** 0\ **Last updated:** [December 10, 2021, 9:33am UTC](https://discuss.elastic.co/t/bulksearch-with-multiple-terms-and-multiple-values/291407 "2021-12-10T09:33:22Z")
Hi, Currently, we are using the below JSON for search in the repository index. Here we are using one term with multiple values(list of values). Can we change the JSON to search using multiple terms by passing multiple v… --- ## [Kibana rule auditlogs overwhelm audit logs](https://discuss.elastic.co/t/kibana-rule-auditlogs-overwhelm-audit-logs/291301)
**Author:** [@can.ozdemir](https://discuss.elastic.co/u/can.ozdemir)\ **Replies:** 2\ **Last updated:** [December 10, 2021, 8:26am UTC](https://discuss.elastic.co/t/kibana-rule-auditlogs-overwhelm-audit-logs/291301 "2021-12-10T08:26:49Z")
Hello There, We are trying to single out user actions, which contains update create or delete actions under audit\_logs. Our unix administration trying to catch these logs and produce mail alerts, but since we have rules… --- ## [Dec 10th, 2021: \[en\] 5 Useful Tips to Get the Most Out of Fleet](https://discuss.elastic.co/t/dec-10th-2021-en-5-useful-tips-to-get-the-most-out-of-fleet/290491)
**Author:** [@Mark\_Hopkin](https://discuss.elastic.co/u/Mark_Hopkin)\ **Replies:** 0\ **Last updated:** [December 10, 2021, 8:00am UTC](https://discuss.elastic.co/t/dec-10th-2021-en-5-useful-tips-to-get-the-most-out-of-fleet/290491 "2021-12-10T08:00:17Z")
As Fleet became generally available earlier in the year, the Fleet development team and I wanted to share a few tips and tricks for getting the most out of using the Fleet app in Kibana. If you aren't familiar with Flee… --- ## [Не работает multiline в Filebeat с filebeat.inputs: - type: filestream](https://discuss.elastic.co/t/multiline-filebeat-filebeat-inputs-type-filestream/290396)
**Author:** [@cva](https://discuss.elastic.co/u/cva)\ **Replies:** 1\ **Last updated:** [December 10, 2021, 7:56am UTC](https://discuss.elastic.co/t/multiline-filebeat-filebeat-inputs-type-filestream/290396 "2021-12-10T07:56:21Z")
Добрый день! Я столкнулся с проблемой многострочной обработки в Filebeat, когда в параметрах filebeat.inputs: указано type: filestream - журналы файлового потока не анализируются в соответствии с требованиями multiline.… --- ## [Работа filebeat завершилась ошибкой: ERROR \[logstash\] logstash/async.go:280](https://discuss.elastic.co/t/filebeat-error-logstash-logstash-async-go-280/291395)
**Author:** [@cva](https://discuss.elastic.co/u/cva)\ **Replies:** 0\ **Last updated:** [December 10, 2021, 7:34am UTC](https://discuss.elastic.co/t/filebeat-error-logstash-logstash-async-go-280/291395 "2021-12-10T07:34:09Z")
Failbeat перестал отдавать данные в logstash, в лога failbeat вижу ошибку: ERROR \[logstash\] logstash/async.go:280 Failed to publish events caused by: write tcp 10.0.10.5:53536-\>10.0.10.6:5044: wsasend: An existing conne… --- ## [Elastic search storage exception](https://discuss.elastic.co/t/elastic-search-storage-exception/290642)
**Author:** [@mehmood1](https://discuss.elastic.co/u/mehmood1)\ **Replies:** 8\ **Last updated:** [December 10, 2021, 4:03am UTC](https://discuss.elastic.co/t/elastic-search-storage-exception/290642 "2021-12-10T04:03:25Z")
Elasticsearch run in read only mode due to storage. i dont want to extend storage this time because it is only for testing purpose. below is Elasticsearch yml file # ======================== Elasticsearch Configuratio… --- ## [No audit log file in /usr/share/elasticsearch/logs directory when I opend the audit log configuration](https://discuss.elastic.co/t/no-audit-log-file-in-usr-share-elasticsearch-logs-directory-when-i-opend-the-audit-log-configuration/291387)
**Author:** [@Hello-Linux](https://discuss.elastic.co/u/Hello-Linux)\ **Replies:** 0\ **Last updated:** [December 10, 2021, 3:43am UTC](https://discuss.elastic.co/t/no-audit-log-file-in-usr-share-elasticsearch-logs-directory-when-i-opend-the-audit-log-configuration/291387 "2021-12-10T03:43:38Z")
I have set the config xpack.security.audit.enabled: true,and restart Elasticsearch,but in the logs file I can't find the json file what name is \_audit.json,why? look at No audit log file in /usr/share/elasticsearch/logs … --- ## [Nothing under Security will load all of a sudden](https://discuss.elastic.co/t/nothing-under-security-will-load-all-of-a-sudden/287948)
**Author:** [@plaroche0](https://discuss.elastic.co/u/plaroche0)\ **Replies:** 10\ **Last updated:** [December 10, 2021, 12:50am UTC](https://discuss.elastic.co/t/nothing-under-security-will-load-all-of-a-sudden/287948 "2021-12-10T00:50:02Z")
All of a sudden nothing will load under the Security section of our Elastic instance. Everything else works fine. If I try to use anything under Security I just get the elastic logo. I have no idea where to begin troub… --- ## [Detection tab is not loading](https://discuss.elastic.co/t/detection-tab-is-not-loading/289440)
**Author:** [@aditi\_salunke](https://discuss.elastic.co/u/aditi_salunke)\ **Replies:** 1\ **Last updated:** [November 19, 2021, 1:09pm UTC](https://discuss.elastic.co/t/detection-tab-is-not-loading/289440 "2021-11-19T13:09:46Z")
Hello, I am utilizing detection feature on kibana 7.13.2 But many times detection tab is blank. After restarting kibana service , i am able to view detection tab. how should i solve this issue ? It is happening fre… --- ## [Case insensitive term query (case\_insensitive) performance penalty?](https://discuss.elastic.co/t/case-insensitive-term-query-case-insensitive-performance-penalty/291371)
**Author:** [@roytmana](https://discuss.elastic.co/u/roytmana)\ **Replies:** 0\ **Last updated:** [December 9, 2021, 11:20pm UTC](https://discuss.elastic.co/t/case-insensitive-term-query-case-insensitive-performance-penalty/291371 "2021-12-09T23:20:28Z")
Hello, Is there any significant performance penalty for using case\_insensitive: true in term queries? If I use keyword mapping with lowercase normalizer, highlighter would emit lowercased results which I would like to … --- ## [Duplicate events ingested by m365\_defender module](https://discuss.elastic.co/t/duplicate-events-ingested-by-m365-defender-module/290901)
**Author:** [@Foxboron](https://discuss.elastic.co/u/Foxboron)\ **Replies:** 1\ **Last updated:** [December 9, 2021, 11:19pm UTC](https://discuss.elastic.co/t/duplicate-events-ingested-by-m365-defender-module/290901 "2021-12-09T23:19:13Z")
It seems like m365\_defender creates duplicate events. This seems to be because of non-stable ordering of the document fields. In our data it seems like fields inside the alert object changes their order and some of the f… --- ## [Kibana.alert.reason in actions](https://discuss.elastic.co/t/kibana-alert-reason-in-actions/290081)
**Author:** [@probson](https://discuss.elastic.co/u/probson)\ **Replies:** 1\ **Last updated:** [December 9, 2021, 11:10pm UTC](https://discuss.elastic.co/t/kibana-alert-reason-in-actions/290081 "2021-12-09T23:10:50Z")
Is it possible to use kibana.alert.reason within the actions. I have tried {{#context.alerts}}{{kibana.alert.reason}}{{/context.alerts}} --- ## [Logstash not creating new index](https://discuss.elastic.co/t/logstash-not-creating-new-index/291265)
**Author:** [@will.nickisch](https://discuss.elastic.co/u/will.nickisch)\ **Replies:** 7\ **Last updated:** [December 9, 2021, 10:28pm UTC](https://discuss.elastic.co/t/logstash-not-creating-new-index/291265 "2021-12-09T22:28:02Z")
I am having an issue with multiple tcp inputs and logstash not pulling in messages from the second tcp input. The data received on port 6050 is going into the default index logstash-%{+YYYY.MM.dd} but the data sent from… --- ## [Replace string in elastic](https://discuss.elastic.co/t/replace-string-in-elastic/291320)
**Author:** [@idoweiss1](https://discuss.elastic.co/u/idoweiss1)\ **Replies:** 1\ **Last updated:** [December 9, 2021, 9:52pm UTC](https://discuss.elastic.co/t/replace-string-in-elastic/291320 "2021-12-09T21:52:07Z")
Hi , I have a string from the kibana and need to change the output : from "mdc.correlationId" to "correlation-id" --- ## [ES not found documents](https://discuss.elastic.co/t/es-not-found-documents/291227)
**Author:** [@xunterix](https://discuss.elastic.co/u/xunterix)\ **Replies:** 6\ **Last updated:** [December 9, 2021, 7:39pm UTC](https://discuss.elastic.co/t/es-not-found-documents/291227 "2021-12-09T19:39:47Z")
Hi, after resetting the index and re-indexing, the search stopped finding any documents. In the logs I see all shards failed. What could be the problem? { "cluster\_name" : "elasticsearch", "status" : "yellow", "ti… --- ## [APM Java Agent Security Update](https://discuss.elastic.co/t/apm-java-agent-security-update/291355)
**Author:** [@douglasday](https://discuss.elastic.co/u/douglasday)\ **Replies:** 0\ **Last updated:** [December 9, 2021, 5:25pm UTC](https://discuss.elastic.co/t/apm-java-agent-security-update/291355 "2021-12-09T17:25:33Z")
APM Java Agent Local Privilege Escalation issue (ESA-2021-30) A local privilege escalation issue was found with the APM Java agent, where a user on the system could attach a malicious plugin to an application running th… --- ## [Can you search for a specific slide in powerpoint deck?](https://discuss.elastic.co/t/can-you-search-for-a-specific-slide-in-powerpoint-deck/291354)
**Author:** [@dwollerman](https://discuss.elastic.co/u/dwollerman)\ **Replies:** 1\ **Last updated:** [December 9, 2021, 5:24pm UTC](https://discuss.elastic.co/t/can-you-search-for-a-specific-slide-in-powerpoint-deck/291354 "2021-12-09T17:24:36Z")
scenario is if there are multiple powerpoints in my environment and i want to identify a specific slide in a deck i can programmatically export and import into my current deck. Issue is indexers grab all the content fro… --- ## [High CPU utilization on master node](https://discuss.elastic.co/t/high-cpu-utilization-on-master-node/290096)
**Author:** [@guptaparv-rlr](https://discuss.elastic.co/u/guptaparv-rlr)\ **Replies:** 26\ **Last updated:** [December 9, 2021, 5:01pm UTC](https://discuss.elastic.co/t/high-cpu-utilization-on-master-node/290096 "2021-12-09T17:01:58Z")
I'm operating a Elasticsearch cluster using ECK Operator. Recently, we have observed high CPU utilization on master nodes. Here is the topology of the cluster: 3 master nodes 3 data nodes On running the nodes hot thr… --- ## [Unable to perform a Regex Search for Asterisk](https://discuss.elastic.co/t/unable-to-perform-a-regex-search-for-asterisk/291036)
**Author:** [@GreenBlueSkys](https://discuss.elastic.co/u/GreenBlueSkys)\ **Replies:** 1\ **Last updated:** [December 9, 2021, 4:44pm UTC](https://discuss.elastic.co/t/unable-to-perform-a-regex-search-for-asterisk/291036 "2021-12-09T16:44:18Z")
\[Edit: Elastic parsed out the Asterisk, the proper log is now visible\] I am trying to perform a search against an AWS CloudTrail log identifying different instances of the asterisk (or escaped wildcard). To do this I a… --- ## [ML job behavior changed](https://discuss.elastic.co/t/ml-job-behavior-changed/291109)
**Author:** [@dao](https://discuss.elastic.co/u/dao)\ **Replies:** 1\ **Last updated:** [December 9, 2021, 3:47pm UTC](https://discuss.elastic.co/t/ml-job-behavior-changed/291109 "2021-12-09T15:47:00Z")
Hello, J'ai un job de ML qui tourne depuis qq années, et je vois un changement (bug)? Explications: Voici ce que j'ai Il semble bien que le ML tourne, et qu'il détecte des anomalies. Par contre, quand je passe en … --- ## [ML job behavior changed](https://discuss.elastic.co/t/ml-job-behavior-changed/291230)
**Author:** [@dao](https://discuss.elastic.co/u/dao)\ **Replies:** 6\ **Last updated:** [December 9, 2021, 3:30pm UTC](https://discuss.elastic.co/t/ml-job-behavior-changed/291230 "2021-12-09T15:30:46Z")
Hello, I have a ML jon that is started for a long time, but since a few monthes, there is a change (is it a bug?) Explanations: Here is what I have As you can see, It seems that the ML runs OK and detects some ano… --- ## [Metric data from csv](https://discuss.elastic.co/t/metric-data-from-csv/291314)
**Author:** [@sirReeall](https://discuss.elastic.co/u/sirReeall)\ **Replies:** 1\ **Last updated:** [December 9, 2021, 2:52pm UTC](https://discuss.elastic.co/t/metric-data-from-csv/291314 "2021-12-09T14:52:11Z")
Hello, I'm trying to import metrics data from a CSV file. Currently I'm using a csv filter like: filter { csv { autodetect\_column\_names =\> true } date { match =\> \["\[t\]","UNIX"\] } mutat… --- ## [Kibana not successfully filtering in Discover](https://discuss.elastic.co/t/kibana-not-successfully-filtering-in-discover/290918)
**Author:** [@agentw](https://discuss.elastic.co/u/agentw)\ **Replies:** 1\ **Last updated:** [December 9, 2021, 2:51pm UTC](https://discuss.elastic.co/t/kibana-not-successfully-filtering-in-discover/290918 "2021-12-09T14:51:44Z")
I recently updated our Elastic instances to 7.15.2. I am seeing mixed results when applying filters in Discover. For example, when filtering out a host on the agent.hostname field (i.e. 'NOT agent.hostname: example\_host)… --- ## [Flood-stage watermark?](https://discuss.elastic.co/t/flood-stage-watermark/291217)
**Author:** [@maltewhiite](https://discuss.elastic.co/u/maltewhiite)\ **Replies:** 3\ **Last updated:** [December 9, 2021, 1:50pm UTC](https://discuss.elastic.co/t/flood-stage-watermark/291217 "2021-12-09T13:50:19Z")
Hello. English isn't my first language. How do I troubleshoot this error-message? What does it mean? What is the solution? We never got this error when we used the old daily indices. Now we get them after transitionin… --- ## [ECE availability zone for tiebreaker only](https://discuss.elastic.co/t/ece-availability-zone-for-tiebreaker-only/291332)
**Author:** [@Zerobot](https://discuss.elastic.co/u/Zerobot)\ **Replies:** 0\ **Last updated:** [December 9, 2021, 1:21pm UTC](https://discuss.elastic.co/t/ece-availability-zone-for-tiebreaker-only/291332 "2021-12-09T13:21:04Z")
Hello! Due to upcoming changes in my company's DC structure we will have 2 separate "big" sites, and 1 "smaller" site, mainly for all the quorum things. It would be easiest for us to delegate quorum / tiebreaker nodes t… --- ## [Apply ingest node pipeline to an index/data stream](https://discuss.elastic.co/t/apply-ingest-node-pipeline-to-an-index-data-stream/291328)
**Author:** [@girija](https://discuss.elastic.co/u/girija)\ **Replies:** 1\ **Last updated:** [December 9, 2021, 1:07pm UTC](https://discuss.elastic.co/t/apply-ingest-node-pipeline-to-an-index-data-stream/291328 "2021-12-09T13:07:40Z")
Hello, I have created a ingest node pipeline to transform data received via elastic. Now I need to apply this pipeline to my index so that I can see the transformed fields under discover, and also create charts usin… --- ## [Bucket aggregation - calculate my own metric inside bucket](https://discuss.elastic.co/t/bucket-aggregation-calculate-my-own-metric-inside-bucket/291326)
**Author:** [@Detlic\_Detlicko](https://discuss.elastic.co/u/Detlic_Detlicko)\ **Replies:** 0\ **Last updated:** [December 9, 2021, 12:42pm UTC](https://discuss.elastic.co/t/bucket-aggregation-calculate-my-own-metric-inside-bucket/291326 "2021-12-09T12:42:42Z")
Hello, i collect data from my router and store into Elasticsearch. My data mappings are in this form : \< {"interface\_name":"keyword", "value":"double", "timestamp":"integer"}. \> I need to measure flow for each inter… --- ## [How to find a large text from documents](https://discuss.elastic.co/t/how-to-find-a-large-text-from-documents/291324)
**Author:** [@RamyaE](https://discuss.elastic.co/u/RamyaE)\ **Replies:** 0\ **Last updated:** [December 9, 2021, 12:27pm UTC](https://discuss.elastic.co/t/how-to-find-a-large-text-from-documents/291324 "2021-12-09T12:27:45Z")
Hi All, I have a textfield with name textContent, where we insert all the contents. I wanted to find the large text from all the textContents. How can I find the large text from those documents, or anyway to know the w… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=756) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=758)