# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=828 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 829 --- ## [Detection and Response for CVE-2021-40444](https://discuss.elastic.co/t/detection-and-response-for-cve-2021-40444/283800)
**Author:** [@devonkerr](https://discuss.elastic.co/u/devonkerr)\ **Replies:** 1\ **Last updated:** [September 14, 2021, 9:46am UTC](https://discuss.elastic.co/t/detection-and-response-for-cve-2021-40444/283800 "2021-09-14T09:46:31Z")
Detection and Response for CVE-2021-40444 Executive summary Elastic Security Intelligence & Analytics has identified additional behaviors related to or inspired by the disclosure of CVE-2021-40444, a remote code executio… --- ## [Getting errors in web console log after loading Kibana dashboard](https://discuss.elastic.co/t/getting-errors-in-web-console-log-after-loading-kibana-dashboard/284154)
**Author:** [@pranay\_jain](https://discuss.elastic.co/u/pranay_jain)\ **Replies:** 1\ **Last updated:** [September 14, 2021, 9:42am UTC](https://discuss.elastic.co/t/getting-errors-in-web-console-log-after-loading-kibana-dashboard/284154 "2021-09-14T09:42:19Z")
I have Kibana version 7.14.1 installed. After loading the dashboard I noticed that few errors displayed are being on the web console. Refused to execute inline script because it violates the following Content Security P… --- ## [Not exists query](https://discuss.elastic.co/t/not-exists-query/284052)
**Author:** [@ilgrosso](https://discuss.elastic.co/u/ilgrosso)\ **Replies:** 3\ **Last updated:** [September 14, 2021, 9:40am UTC](https://discuss.elastic.co/t/not-exists-query/284052 "2021-09-14T09:40:50Z")
Negating the exists query as suggested by docs does not seem to work as I would intend it, at least with Elasticsearch 7.14. When I send GET to /master\_user/\_search with payload { "query": { "bool": { "must… --- ## [How to design schema for boosting/ranking logic?](https://discuss.elastic.co/t/how-to-design-schema-for-boosting-ranking-logic/284149)
**Author:** [@abhinavkulkarni](https://discuss.elastic.co/u/abhinavkulkarni)\ **Replies:** 3\ **Last updated:** [September 14, 2021, 9:39am UTC](https://discuss.elastic.co/t/how-to-design-schema-for-boosting-ranking-logic/284149 "2021-09-14T09:39:51Z")
Hi, Let us say, I am indexing a bunch of podcasts in my Elasticsearch cluster: Podcast: - \_id (keyword) - email (keyword) - webLink (keyword) - rssLink (keyword) - shortDescription (te… --- ## [London Information Retrieval Meetup (HYBRID) - 15th Sept 2021](https://discuss.elastic.co/t/london-information-retrieval-meetup-hybrid-15th-sept-2021/284165)
**Author:** [@lizbiella](https://discuss.elastic.co/u/lizbiella)\ **Replies:** 0\ **Last updated:** [September 14, 2021, 9:10am UTC](https://discuss.elastic.co/t/london-information-retrieval-meetup-hybrid-15th-sept-2021/284165 "2021-09-14T09:10:49Z")
We are so happy to announce the tenth London Information Retrieval Meetup, a free evening meetup aimed to Information Retrieval passionates and professionals who are curious to explore and discuss the latest trends in th… --- ## [Logstash s3 output plugin not working properly](https://discuss.elastic.co/t/logstash-s3-output-plugin-not-working-properly/284159)
**Author:** [@vishakha.tyagi.blaze](https://discuss.elastic.co/u/vishakha.tyagi.blaze)\ **Replies:** 0\ **Last updated:** [September 14, 2021, 8:53am UTC](https://discuss.elastic.co/t/logstash-s3-output-plugin-not-working-properly/284159 "2021-09-14T08:53:24Z")
So we are trying to use Logstash to send out some logs to s3 and its not working for some reason. This is the code we are using. output { amazon\_es { hosts =\> \["xxxx"\] … --- ## [Failed to put mappings on indices \[\[\[account\_address\_01112020/M\_Yx-7TTTOeBgtJ-ckrHbw\]\]\], type \[\_doc\] java.lang.IllegalArgumentException: mapper \[quater\] of different type, current\_type \[keyword\], merged\_type \[text\]](https://discuss.elastic.co/t/failed-to-put-mappings-on-indices-account-address-01112020-m-yx-7tttoebgtj-ckrhbw-type-doc-java-lang-illegalargumentexception-mapper-quater-of-different-type-current-type-keyword-merged-type-text/284116)
**Author:** [@Mesut\_Yilmaz](https://discuss.elastic.co/u/Mesut_Yilmaz)\ **Replies:** 4\ **Last updated:** [September 14, 2021, 8:37am UTC](https://discuss.elastic.co/t/failed-to-put-mappings-on-indices-account-address-01112020-m-yx-7tttoebgtj-ckrhbw-type-doc-java-lang-illegalargumentexception-mapper-quater-of-different-type-current-type-keyword-merged-type-text/284116 "2021-09-14T08:37:54Z")
Hi, I am having a problem as below. What could be the reason of this specific problem which was occured only two hours during the day first time and do not know how to repeat the same problem. It occured and does not r… --- ## [Problem installing ruby gem active\_support](https://discuss.elastic.co/t/problem-installing-ruby-gem-active-support/283466)
**Author:** [@chris\_ts24](https://discuss.elastic.co/u/chris_ts24)\ **Replies:** 1\ **Last updated:** [September 14, 2021, 8:33am UTC](https://discuss.elastic.co/t/problem-installing-ruby-gem-active-support/283466 "2021-09-14T08:33:57Z")
Hi all, Some specs: Logstash 7.13.1 Ruby 2.5.0 activesupport 6.1.4.1 I'd like to use some active\_support functionality in my ruby filters that I list in my logstash config files. I'm having a problem however with my… --- ## [How I can use the highlighter in react app](https://discuss.elastic.co/t/how-i-can-use-the-highlighter-in-react-app/283494)
**Author:** [@Drsaud](https://discuss.elastic.co/u/Drsaud)\ **Replies:** 4\ **Last updated:** [September 14, 2021, 8:04am UTC](https://discuss.elastic.co/t/how-i-can-use-the-highlighter-in-react-app/283494 "2021-09-14T08:04:16Z")
Hi, I want to ask how to apply the highlighter in my react app because when I tried it says its not parameter, I try it on my get req axios .get( \`http://localhost:9200/ncar\_index/ncar/\_search?q=${e… --- ## [User Prioritization | Indexing workload Prioritization](https://discuss.elastic.co/t/user-prioritization-indexing-workload-prioritization/284061)
**Author:** [@Chinnu](https://discuss.elastic.co/u/Chinnu)\ **Replies:** 3\ **Last updated:** [September 14, 2021, 7:52am UTC](https://discuss.elastic.co/t/user-prioritization-indexing-workload-prioritization/284061 "2021-09-14T07:52:51Z")
Hello, I am also looking for some documentation on prioritization among Users and Tokens in Cluster. Also, is there some kind of priority that we can set between indexing-load and querying-load ? Reason for asking thi… --- ## [Which Mappings settings can help improve indexing speed?](https://discuss.elastic.co/t/which-mappings-settings-can-help-improve-indexing-speed/283981)
**Author:** [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Replies:** 3\ **Last updated:** [September 14, 2021, 7:50am UTC](https://discuss.elastic.co/t/which-mappings-settings-can-help-improve-indexing-speed/283981 "2021-09-14T07:50:18Z")
Hello, I'm trying to improve the indexing performance on my cluster and everything listed in the tune for indexing speed document was already checked. Currently the indexing is done using Logstash with the elasticsearc… --- ## [What is the right way to query nested fields](https://discuss.elastic.co/t/what-is-the-right-way-to-query-nested-fields/283949)
**Author:** [@eylon\_koren](https://discuss.elastic.co/u/eylon_koren)\ **Replies:** 3\ **Last updated:** [September 14, 2021, 7:36am UTC](https://discuss.elastic.co/t/what-is-the-right-way-to-query-nested-fields/283949 "2021-09-14T07:36:48Z")
Hi ! I am providing accessibility to search on ES using my own UI which uses query string. Selecting query string is essential, beacuse the users might not be familier with advance quering in ES, And I would like to ke… --- ## [Logstash persistent queue settings](https://discuss.elastic.co/t/logstash-persistent-queue-settings/284144)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 6\ **Last updated:** [September 14, 2021, 6:35am UTC](https://discuss.elastic.co/t/logstash-persistent-queue-settings/284144 "2021-09-14T06:35:32Z")
Using logstash 7.13 We are running logstash on linux server which has 4 cpu(s) 15gb of ram of 100gb of ssd. We are using persistent queue settings in logstash but we actually can't sure is this right configuration or c… --- ## [Watcherで特定のフィールドの値ごとに集計して件数超過で通知する方法](https://discuss.elastic.co/t/watcher/282658)
**Author:** [@a-naga](https://discuss.elastic.co/u/a-naga)\ **Replies:** 2\ **Last updated:** [September 14, 2021, 6:12am UTC](https://discuss.elastic.co/t/watcher/282658 "2021-09-14T06:12:24Z")
ElasticsearchにIPフィールドを含むログデータがindexされていく状態で、 以下のようなWatcher定義を検討しています。 過去10分間のログを対象に、IPフィールドのIPアドレス毎に同一IPアドレスの件数を集計し、 5件以上出ている全てのIPアドレスのドキュメント内容をメールで通知する Watcherでこのような条件が可能かどうか、良い方法があればご教示いただきたいです。 --- ## [Linux-Endpoint-security State changed to DEGRADED-Artifact endpoint-trustlist-linux-v1 is unavailablee](https://discuss.elastic.co/t/linux-endpoint-security-state-changed-to-degraded-artifact-endpoint-trustlist-linux-v1-is-unavailablee/282061)
**Author:** [@pedimave](https://discuss.elastic.co/u/pedimave)\ **Replies:** 3\ **Last updated:** [September 14, 2021, 5:21am UTC](https://discuss.elastic.co/t/linux-endpoint-security-state-changed-to-degraded-artifact-endpoint-trustlist-linux-v1-is-unavailablee/282061 "2021-09-14T05:21:33Z")
I have installed Elastic 7.14 and testing Endoint Security over fleet with Linux Machines (Debian 10). All seems that is working but after few minutes appear the message : State changed to DEGRADED with all of them. Af… --- ## [How to monitor/discover modification of documents?](https://discuss.elastic.co/t/how-to-monitor-discover-modification-of-documents/283629)
**Author:** [@d.silwon](https://discuss.elastic.co/u/d.silwon)\ **Replies:** 2\ **Last updated:** [September 14, 2021, 4:58am UTC](https://discuss.elastic.co/t/how-to-monitor-discover-modification-of-documents/283629 "2021-09-14T04:58:43Z")
Dears, ELK version: 7.7.0 Is there any way to monitor/discover modification of documents in the ELK? Any idea? Best Regards, Dan --- ## [Logstash api endpoints are not accessible outside the logstash container](https://discuss.elastic.co/t/logstash-api-endpoints-are-not-accessible-outside-the-logstash-container/284135)
**Author:** [@vijayebpzr](https://discuss.elastic.co/u/vijayebpzr)\ **Replies:** 3\ **Last updated:** [September 14, 2021, 4:49am UTC](https://discuss.elastic.co/t/logstash-api-endpoints-are-not-accessible-outside-the-logstash-container/284135 "2021-09-14T04:49:49Z")
We deployed the ELK stack in kubernetes cluster and everything is working fine. Now we are trying to monitor logstash from kibana stack monitoring using metricbeat. We could see that logstash section is not visible in st… --- ## [How to know the node is unable to work by master node](https://discuss.elastic.co/t/how-to-know-the-node-is-unable-to-work-by-master-node/284134)
**Author:** [@Hungming\_Chiu](https://discuss.elastic.co/u/Hungming_Chiu)\ **Replies:** 1\ **Last updated:** [September 14, 2021, 3:31am UTC](https://discuss.elastic.co/t/how-to-know-the-node-is-unable-to-work-by-master-node/284134 "2021-09-14T03:31:08Z")
Hi there , I would like to know whether the master node enable to find out the node only breath (with ping response), actually it cannot work anymore. Thank you. B.rgds --- ## [Parsing SQL queries using ruby; any recommended gem package?](https://discuss.elastic.co/t/parsing-sql-queries-using-ruby-any-recommended-gem-package/284132)
**Author:** [@SHINRA](https://discuss.elastic.co/u/SHINRA)\ **Replies:** 0\ **Last updated:** [September 14, 2021, 2:44am UTC](https://discuss.elastic.co/t/parsing-sql-queries-using-ruby-any-recommended-gem-package/284132 "2021-09-14T02:44:08Z")
Hi, I'm new to Ruby language and I thought I could still do a simple task of normalizing + parsing SQL query using some third party library; but I had no luck finding any that works to my intention. Here's what I'm try… --- ## [How to display count of all attributes in Kibana visualization](https://discuss.elastic.co/t/how-to-display-count-of-all-attributes-in-kibana-visualization/283233)
**Author:** [@Sam\_Chats](https://discuss.elastic.co/u/Sam_Chats)\ **Replies:** 6\ **Last updated:** [September 13, 2021, 10:54pm UTC](https://discuss.elastic.co/t/how-to-display-count-of-all-attributes-in-kibana-visualization/283233 "2021-09-13T22:54:18Z")
My data has about 50 different attributes. I have created a dashboard in Kibana to display value distributions of some of these attributes based on the date filter at the top. I want to create one more visualization to s… --- ## [How to match lines in unstructured log starting with specific string](https://discuss.elastic.co/t/how-to-match-lines-in-unstructured-log-starting-with-specific-string/284112)
**Author:** [@ansamHox](https://discuss.elastic.co/u/ansamHox)\ **Replies:** 3\ **Last updated:** [September 13, 2021, 7:18pm UTC](https://discuss.elastic.co/t/how-to-match-lines-in-unstructured-log-starting-with-specific-string/284112 "2021-09-13T19:18:35Z")
I have a very big unstructured file. Firstly, I want to parse all lines that starts with ABC or CDE and store them as one document in Elasticsearch. One file should be one document in index, so @message should look like … --- ## [Aggregating transaction data for payments](https://discuss.elastic.co/t/aggregating-transaction-data-for-payments/283713)
**Author:** [@Fenix](https://discuss.elastic.co/u/Fenix)\ **Replies:** 4\ **Last updated:** [September 13, 2021, 8:19pm UTC](https://discuss.elastic.co/t/aggregating-transaction-data-for-payments/283713 "2021-09-13T20:19:13Z")
I want to know how many payments in my environment are of a given status, at a given time broken down by direction, and protocol. In our case, a payment is a collection of transactions (docs) with the same paymentId. Th… --- ## [Unable to select keyword field for term aggregation](https://discuss.elastic.co/t/unable-to-select-keyword-field-for-term-aggregation/283914)
**Author:** [@adam3](https://discuss.elastic.co/u/adam3)\ **Replies:** 1\ **Last updated:** [September 13, 2021, 5:55pm UTC](https://discuss.elastic.co/t/unable-to-select-keyword-field-for-term-aggregation/283914 "2021-09-13T17:55:45Z")
Hey using 7.10.2 and I'm trying to make some visualizations. There are some fields that I can't select for term aggregations in charts etc. Not sure what I'm doing wrong. But I've tried all sorts of mapping templ… --- ## [Slower query\_string query in elasticsearch 7.5 as compared to elasticsearch 2.4](https://discuss.elastic.co/t/slower-query-string-query-in-elasticsearch-7-5-as-compared-to-elasticsearch-2-4/282222)
**Author:** [@nishant.saini](https://discuss.elastic.co/u/nishant.saini)\ **Replies:** 8\ **Last updated:** [September 13, 2021, 5:12pm UTC](https://discuss.elastic.co/t/slower-query-string-query-in-elasticsearch-7-5-as-compared-to-elasticsearch-2-4/282222 "2021-09-13T17:12:29Z")
We have recently started migrating from elasticsearch 2.4.1 to elasticsearch 7.5.2 but have faced a major roadblock because of query performance. A query string query that used to respond in around 800ms when queried in … --- ## [Wildcard phrase search using query\_string](https://discuss.elastic.co/t/wildcard-phrase-search-using-query-string/284108)
**Author:** [@Wonder\_Garance](https://discuss.elastic.co/u/Wonder_Garance)\ **Replies:** 0\ **Last updated:** [September 13, 2021, 4:55pm UTC](https://discuss.elastic.co/t/wildcard-phrase-search-using-query-string/284108 "2021-09-13T16:55:58Z")
I use query\_string to generate phrase queries with a proximity, on Elasticsearch 7.9.3 Does query\_string work with wildcard? I found some old similar questions, there wasn't the way to do it. Here is my query: … --- ## [Looking for a list of "Out of the Box" Use Cases for Elastic SIEM](https://discuss.elastic.co/t/looking-for-a-list-of-out-of-the-box-use-cases-for-elastic-siem/284101)
**Author:** [@MKirby](https://discuss.elastic.co/u/MKirby)\ **Replies:** 1\ **Last updated:** [September 13, 2021, 4:34pm UTC](https://discuss.elastic.co/t/looking-for-a-list-of-out-of-the-box-use-cases-for-elastic-siem/284101 "2021-09-13T16:34:18Z")
I am working on a secure project that is utilizing ELK SIEM and we are looking for Use Cases that we can direct the client towards for answering what the Elastic SIEM can do for them. Is there a link or area that I can … --- ## [Exec command Linux and extract specific field](https://discuss.elastic.co/t/exec-command-linux-and-extract-specific-field/283254)
**Author:** [@Mira\_9](https://discuss.elastic.co/u/Mira_9)\ **Replies:** 2\ **Last updated:** [September 6, 2021, 2:13pm UTC](https://discuss.elastic.co/t/exec-command-linux-and-extract-specific-field/283254 "2021-09-06T14:13:17Z")
Hi Community, i'm executing several linux commands in Logstash. and i want to extract specific fields to build some graphs in Kibana. for Example this is the result of an executed command \[2021-02-13 19:28:49.200\] chan… --- ## [How to match by different prefixes](https://discuss.elastic.co/t/how-to-match-by-different-prefixes/284104)
**Author:** [@mydeadvictoria](https://discuss.elastic.co/u/mydeadvictoria)\ **Replies:** 0\ **Last updated:** [September 13, 2021, 4:01pm UTC](https://discuss.elastic.co/t/how-to-match-by-different-prefixes/284104 "2021-09-13T16:01:14Z")
Will try to explain what I mean by saying "different prefixes". I have a text field "Name", and I want to check (while searching) whether this field starts with some particular prefix with length varying from 3 to 5. Le… --- ## [如何给按条件分组的查询设置默认值](https://discuss.elastic.co/t/topic/284102)
**Author:** [@xxm404](https://discuss.elastic.co/u/xxm404)\ **Replies:** 0\ **Last updated:** [September 13, 2021, 3:59pm UTC](https://discuss.elastic.co/t/topic/284102 "2021-09-13T15:59:19Z")
我想使用 ELK 分析 Nginx 日志，统计每个接口的 Apdex 积分，所以我需要计算不同耗时区间内的请求数，但我发现某些接口在特定耗时区间请求数为 0，在 es 的查询结果中会显示为没有结果，这导致我无法进行后续的计算，请问我该如何解决这个问题，或者说有没有其他方法来计算接口的 Apdex 积分 我的查询大致如下： // 请求总数 logname:"access\_log" AND fields.tagname:"service… --- ## [Forcing elasticsearch cluster to run on single node in the event of failure](https://discuss.elastic.co/t/forcing-elasticsearch-cluster-to-run-on-single-node-in-the-event-of-failure/283658)
**Author:** [@preetish\_P](https://discuss.elastic.co/u/preetish_P)\ **Replies:** 3\ **Last updated:** [September 13, 2021, 3:58pm UTC](https://discuss.elastic.co/t/forcing-elasticsearch-cluster-to-run-on-single-node-in-the-event-of-failure/283658 "2021-09-13T15:58:33Z")
Hi folks, Currently we are in the process of setting up 3 node elasticsearch cluster on v7.11.2 (self-managed) using below setup : All 3 nodes will be data nodes and master eligible. We will set "index.number\_of\_repl… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=827) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=829)