Hello Team, Is It possible to use yara custom rules with osquery manager integration ?? I'm using version 7.17.1 Many thanks.
---
## [Index management : change index name in filebeat](https://discuss.elastic.co/t/index-management-change-index-name-in-filebeat/202876)
hello, I try to change the index name in filebeat.yml but when I start the filebeat, it still running on the oldest conf : filebeat.yml : output.elasticsearch: hosts: \["xx.xx.xx.xx:9200"\] #index: "filebeat-%{\[agent.…
---
## [Get current number of fields in index](https://discuss.elastic.co/t/get-current-number-of-fields-in-index/91334)
I'd like to see how close I am to reaching the limit of fields in my index (currently set to 1000). In Kibana, my index pattern says the index has a total of 76 fields. However, on the discover tab, I have over 500 fie…
---
## [7.5.0 rolling update tried but getting java error in trace when bringing up nodes 2 and 3 in my cluster](https://discuss.elastic.co/t/7-5-0-rolling-update-tried-but-getting-java-error-in-trace-when-bringing-up-nodes-2-and-3-in-my-cluster/211876)
I tried doing the rolling update from 7.3 to 7.5.0 The cluster went offline when I took one node down. I stopped all nodes. I upgraded node 1 and started no problem. I try to start nodes 2 and 3 and I get a java err…
---
## [How to synchronize with oracle when data updated?](https://discuss.elastic.co/t/how-to-synchronize-with-oracle-when-data-updated/69381)
I'm trying to synchronize oracle to Elasticsearch by logstash-input-jdbc .But I failed. Could you tell me how to do it? Env: windows 7 64bit (※Japanese) oracleDB 11g Elasticsearch 5.1.1 Logstash 5.1.1 Ex: synte…
---
## [Need more clarity on user access in X-pack?](https://discuss.elastic.co/t/need-more-clarity-on-user-access-in-x-pack/59158)
Hi Experts, I installed X-pack and i loved it . I still have some concerns regarding user access and please let me know if the following can be achieved with X-pack access management . So my requirement is 1) User ca…
---
## [Kibana 8.19.14, 9.2.8, 9.3.3 Security Update (ESA-2026-21)](https://discuss.elastic.co/t/kibana-8-19-14-9-2-8-9-3-3-security-update-esa-2026-21/385811)
Execution with Unnecessary Privileges in Kibana Leading to reading index data beyond their direct Elasticsearch RBAC scope Execution with Unnecessary Privileges (CWE-250) in Kibana’s Fleet plugin debug route handlers ca…
---
## [Filtering with script on nested fields](https://discuss.elastic.co/t/filtering-with-script-on-nested-fields/116844)
Hey guys, I'm building search for my project. Now I need filter by nested field. Using Rails, so using elasticsearch gem. Mapping: mapping do indexes 'name', type: 'string', analyzer: 'russ…
---
## [Problem combining "copy\_to", "analyzer" and wildcard "query string" query](https://discuss.elastic.co/t/problem-combining-copy-to-analyzer-and-wildcard-query-string-query/141953)
I have a bit of a weird problem here: I use es 5.6.4 I copy some fields via "copy\_to" mapping into a field named "search" I added a german analyzer to the field mapping of the search field I use a query string query li…
---
## [Export the visualization in PDF format](https://discuss.elastic.co/t/export-the-visualization-in-pdf-format/139149)
i need to export the visualization in pdf format in kibana dashboards
---
## [Ldap resultCode=89 Simple bind operations are not allowed to contain a bind DN without a password](https://discuss.elastic.co/t/ldap-resultcode-89-simple-bind-operations-are-not-allowed-to-contain-a-bind-dn-without-a-password/198919)
Hi there, I am trying to add an ldap Connection to the ECE Cluster. But it always throws a warning. \[2019-09-10T14:31:26,948\]\[WARN \]\[org.elasticsearch.xpack.security.authc.AuthenticationService\] \[instance-0000000048\] …
---
## [Logstash json parse failure when json contains a "message" field](https://discuss.elastic.co/t/logstash-json-parse-failure-when-json-contains-a-message-field/184407)
Hello, I'm using the json filter to parse the json formatted logfile. The json includes a message field. The (formatted) record looks like this: { "transactionId": "1559728771468", "hostName": "AUE2RHEESSVMSSP010000…
---
## [Error when copying a field to multiple others in a single mutate block](https://discuss.elastic.co/t/error-when-copying-a-field-to-multiple-others-in-a-single-mutate-block/234709)
I noticed today, that copying the same field to multiple destinations inside the same mutate block, leads to a \_mutate\_error. Splitting the copy operation up to two mutate blocks works without any problem. Is this an int…
---
## [Load only some metricbeat dashboards](https://discuss.elastic.co/t/load-only-some-metricbeat-dashboards/152899)
I would like to import only some metricbeat dashboards into kibana. The metricbeat setup has no flags for --modules What is the recommended way to do this? On a different note: the documentation shows the filebeat u…
---
## [Syslog from Aruba Switches](https://discuss.elastic.co/t/syslog-from-aruba-switches/270543)
Hi Forum I've build my first ELK server - and have some incomming data - But I cannot make my Aruba 2530 Switches send the logfiles to elastic - and missing something somewhere. On My Aruba switches - I set the followi…
---
## [Nested types are slower?](https://discuss.elastic.co/t/nested-types-are-slower/90546)
https://www.elastic.co/guide/en/elasticsearch/guide/current/nested-objects.html Not only that, because of the way that nested objects are indexed, joining the nested documents to the root document at query time is fast—a…
---
## [How to rename Index](https://discuss.elastic.co/t/how-to-rename-index/70044)
Hi, How to rename index in elasticsearch 2.2.1, i want to rename the temp document to original document after updating the temp document. Thanks Thanigaivelan
---
## [SOLVED - Issue converting JSON after JDBC Streaming](https://discuss.elastic.co/t/solved-issue-converting-json-after-jdbc-streaming/90856)
Hi Team, I have a logstash config file that takes input source of SQS. I then take this and apply a filter to convert the JSON message from SQS into a data structure (this is working fine) I then apply another filter w…
---
## [Better to use "must" and "terms", or "should", in a bool query?](https://discuss.elastic.co/t/better-to-use-must-and-terms-or-should-in-a-bool-query/15200)
Hi guys. These 2 queries produce the same results via different approaches. Is there any reason why one should be used over another? Thanks, Nick { "size": 10, "fields": \["id", "name"\], "sort": \[ { "nam…
---
## [Unable to start elastcsearch 5.5.0 service, getting 203 error](https://discuss.elastic.co/t/unable-to-start-elastcsearch-5-5-0-service-getting-203-error/224706)
Hi, I have just installed elasticsearch 5.5.0 using RPM and I am not able to start the services, here is all the details, also I have uploaded the yml file. \[root@xxxxxx\]# systemctl status elasticsearch.service ● elas…
---
## [Show Zero Value in Line Chart](https://discuss.elastic.co/t/show-zero-value-in-line-chart/141263)
Is there a way to show zero values in line chart? One single point looks weird to me. It would be great if we have things like this: I use a date histogram aggregation for X-axis and a term aggregation as the sub-b…
---
## [Elasticsearch query using API manager](https://discuss.elastic.co/t/elasticsearch-query-using-api-manager/108941)
I am involved in a project for work where I have to query an Elasticsearch server using an API manager and Python. I have the below code but the error I'm getting indicates I'm using the wrong content-type. I'm not sure …
---
## [Any way to use DEV tools page to query Kibana API?](https://discuss.elastic.co/t/any-way-to-use-dev-tools-page-to-query-kibana-api/241352)
The dev tools page in Kibana (\/app/kibana#/dev\_tools/console) seems to connect to elasticsearch API only (eg I can query elasticsearch data, searches etc) But the Kibana API's (like siem rules api, saved\_objects, …
---
## [How to display Panels in Kibana from different Indices?](https://discuss.elastic.co/t/how-to-display-panels-in-kibana-from-different-indices/116695)
I have 2 indices av1 and av2 , in Kibana I am merging both the indices into one like av\*. With this approach I got 100 fields (50 each index). Now I want to create dashboard which will have multiple panels , some of the …
---
## [How to set up: Synology -\> Logstash RFC3164](https://discuss.elastic.co/t/how-to-set-up-synology-logstash-rfc3164/73756)
Hi, I'm very new to the complete ELK stack. I set up on a ESXI 6.5 a CentOS 7 (minimal installation) the ELK stack. Everything is working so far (I think so). I used for that: http://www.tecmint.com/install-elasticsear…
---
## [How do I determine which master node won an election?](https://discuss.elastic.co/t/how-do-i-determine-which-master-node-won-an-election/61173)
I am trying to configure an alert in monit to alarm when my cluster state falls out of green. I have a short script that returns the text of the cluster state and issues a numeric return code that I can use to trigger a…
---
## [Elasticsearch 6.4 Kerberos: Checksum failed](https://discuss.elastic.co/t/elasticsearch-6-4-kerberos-checksum-failed/146735)
Hello, there. We are doing PoC on 6.4 build in Kerberos Auth for elasticsearch. Here is a problem I have ran into with trying to set it up (please help me understand what is happening here): my Kerberos part of elasti…
---
## [Multiplication in logstash grok filter](https://discuss.elastic.co/t/multiplication-in-logstash-grok-filter/59875)
I have following filter filter { if \[type\] == "apache-access" { grok { match =\> { "message" =\> "%{APACHE}" } add\_field =\> { "tym1" =\> "%{microseconds} \* 0.000001" }…
---
## [Error at startup:Transport SSL must be enabled for setups with production licenses. Please set \[xpack.security.transport.ssl.enabled\] to \[true\] or disable security by setting \[xpack.security.enabled\] to \[false\]](https://discuss.elastic.co/t/error-at-startup-transport-ssl-must-be-enabled-for-setups-with-production-licenses-please-set-xpack-security-transport-ssl-enabled-to-true-or-disable-security-by-setting-xpack-security-enabled-to-false/128208)
I already checked a similar thread that was closed with the link to the configuration page for TLS. I have already checked that and modified my config several times to test which one works.. but it does not seems to. I…
---
## [How to get report of before and after 5 lines of log when message match = my-error to my email in x-pack in elasticsearch in plain text format](https://discuss.elastic.co/t/how-to-get-report-of-before-and-after-5-lines-of-log-when-message-match-my-error-to-my-email-in-x-pack-in-elasticsearch-in-plain-text-format/162572)
I'm trying to parse zookeeper wchc output using logstash: 0x167892507c74d32 /zookeeper/cluster\_name/stores/31/alive /zookeeper/cluster\_name/stores/24/alive /zookeeper/cluster\_name/stores/32/alive for each session id…
---
## [ERROR when filebeat test output talk to server](https://discuss.elastic.co/t/error-when-filebeat-test-output-talk-to-server/275786)
Hi, I encounter an error while I tried to connect filebeat to my elk cluster: # filebeat test output elasticsearch: \:9200... parse url... OK connection... parse host... OK dns lookup... OK…
---
## [ElasticSearch query string query default\_operator](https://discuss.elastic.co/t/elasticsearch-query-string-query-default-operator/62682)
The following query finds onlyl the documents that have all of the words "look", "for" and "this: "query": { "query\_string": { "query": "look for this", "default\_operator":"A…
---
## [Running Kibana on Windows](https://discuss.elastic.co/t/running-kibana-on-windows/26884)
Hi When i run kibana.bat on Windows environment, the terminal exits and when i go to http://localhost:5601/ , i got ERR\_CONNECTION\_REFUSED
---
## [Filebeat 5.0 doesn't work for large files](https://discuss.elastic.co/t/filebeat-5-0-doesnt-work-for-large-files/66964)
When I go to discover tab, it doesn't show the data. This error occurred just a few hours ago. Before that, it was working perfectly fine. The error traceback is: TypeError: Cannot read property 'indexOf' of undefined …
---
## [Not able to start filebeat](https://discuss.elastic.co/t/not-able-to-start-filebeat/169597)
Hi Team I am not able to start the filebeat service. below is the error I am getting \[root@inmbz1196 config\]# service filebeat status ● filebeat.service - Filebeat sends log files to Logstash or directly to Elasticsea…
---
## [Cannot start Kibana with fatal CLI error YAMLException](https://discuss.elastic.co/t/cannot-start-kibana-with-fatal-cli-error-yamlexception/191859)
Anyone saw this error before? what's the resolution? Thanks, Here is the error in the log: Jul 23 00:59:59 awselsprdlap01 systemd: kibana.service holdoff time over, scheduling restart. Jul 23 00:59:59 awselsprdlap01 s…
---
## [Keep newline formating with multiline](https://discuss.elastic.co/t/keep-newline-formating-with-multiline/104335)
Here is my config file. I am processing java logs. The errors do come into Kibana but are all one long chunk of text. Is there a way to have the entry come in as one event but keep the formating so it is more readable? i…
---
## [Web browser high memory usage for Kibana Dashboard](https://discuss.elastic.co/t/web-browser-high-memory-usage-for-kibana-dashboard/51992)
Hi All, I use nxlog to collect Windows performance stats and store them in Elasticsearch and have a dashboard with 14 visualizations to show all different stats such as ASP.NET requests, processor time, available memor…
---
## [How to change the field type ,and there are some question](https://discuss.elastic.co/t/how-to-change-the-field-type-and-there-are-some-question/109677)
i have two fields ,and i want to show them on the Coordinate Map. i remeber someone said that we can't change the field type ,unless changing the index . those are my two fields , "lonlat1" =\> { "lat" =\> "20", "lon"…
---
## [Azure Analytics Logs to ELK Stack?](https://discuss.elastic.co/t/azure-analytics-logs-to-elk-stack/223907)
Is there a way to send my Azure Analytics Logs to Elasticsarch?
---
## [Elastic REST API calls?](https://discuss.elastic.co/t/elastic-rest-api-calls/80200)
Hello! I'm looking for an Elastic solution that can: 1. Periodically send a web request to a REST API 2. Receive the JSON response and 3. Send it to logstash for processing Is there something offered in Elastic that …
---
## [Adjusting a ISO8601 @timestamp field](https://discuss.elastic.co/t/adjusting-a-iso8601-timestamp-field/218874)
Hi all, I'm a bit stuck and confused about how to use the Logstash date plugin for what I'm trying to do. My situation is such that I have incoming data (coming from kafka input) populating the @timestamp field in ISO8…
---
## [Error: \[400\] Filters contains an invalid set of keys for object inside of field: filters root; can only have clauses or a single field name](https://discuss.elastic.co/t/error-400-filters-contains-an-invalid-set-of-keys-for-object-inside-of-field-filters-root-can-only-have-clauses-or-a-single-field-name/221124)
I'm trying to get filtered result from elastic/app-search. Below is facets data from first search. \Brand\ \ \…
---
## [Tough Memlock issue in Docker Swarm on Centos](https://discuss.elastic.co/t/tough-memlock-issue-in-docker-swarm-on-centos/173788)
Hello, I'm having trouble lighting up a Elastic Search stack on Docker. The error I'm seeing is this: \[2019-03-25T15:10:08,955\]\[WARN \]\[o.e.b.JNANatives \] \[unknown\] Unable to lock JVM Memory: error=12, reason=C…
---
## [Elasticsearch cluster red](https://discuss.elastic.co/t/elasticsearch-cluster-red/37784)
I might killed my local es instance by accident. but when I restarted the es, it is red and can't do anything literally. curl -XGET 'http://localhost:9200/\_cat/shards' .marvel-es-2015.12.20 0 p UNASSIGNED …
---
## [Use Solr instead of ElasticSearch](https://discuss.elastic.co/t/use-solr-instead-of-elasticsearch/89960)
Hi, I already configured the process, Filebeat --\>Logstash--\> Elastic Search --\>Kibana, it is working good, but we have the requirement to use Solr instead of Elastic Search, while researching on internet i found about S…
---
## [Elastic Search Access denied exception](https://discuss.elastic.co/t/elastic-search-access-denied-exception/105338)
Hi, I am using ES 2.4. while indexing from MongoDb to elastic search by using mongoConnector i got some exception mention below. i am having around 16000 to 20000 records while pushing those records to elastic search a…
---
## [Exporting data from a visualization](https://discuss.elastic.co/t/exporting-data-from-a-visualization/320976)
Hi, I'm new to Kibana, and I need to export some data from a table visualization (pull it once in a while, with the current time), using python. What I actually want, is basically a csv or a JSONI can turn to a pandas …
[Previous page](https://discuss.elastic.co/top.md?page=482&per_page=50&period=all)
[Next page](https://discuss.elastic.co/top.md?page=484&per_page=50&period=all)