# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=110 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 111 --- ## [Sentinelone integration api expires](https://discuss.elastic.co/t/sentinelone-integration-api-expires/373615)
**Author:** [@amarasinghe.kaluarac](https://discuss.elastic.co/u/amarasinghe.kaluarac)\ **Replies:** 0\ **Last updated:** [January 24, 2025, 5:52am UTC](https://discuss.elastic.co/t/sentinelone-integration-api-expires/373615 "2025-01-24T05:52:28Z")
Hi all, I have notice that the when the API token expires integration stop ingesting data to the siem, doesnt the integration automaticaly renew the token if it expires ? for a example lets say I created a token for a o… --- ## [Displaying values on Kibana images](https://discuss.elastic.co/t/displaying-values-on-kibana-images/373429)
**Author:** [@SaraAlshamsi](https://discuss.elastic.co/u/SaraAlshamsi)\ **Replies:** 4\ **Last updated:** [January 24, 2025, 3:53am UTC](https://discuss.elastic.co/t/displaying-values-on-kibana-images/373429 "2025-01-24T03:53:12Z")
Hello everyone, I would like to display data on Kibana images in my dashboard. I know how to insert images by adding the image panel: But, there is no option to display data on top of the images. For example, I wa… --- ## [Changing the session time for non cloud version loging out](https://discuss.elastic.co/t/changing-the-session-time-for-non-cloud-version-loging-out/371496)
**Author:** [@nash3650](https://discuss.elastic.co/u/nash3650)\ **Replies:** 1\ **Last updated:** [January 24, 2025, 2:07am UTC](https://discuss.elastic.co/t/changing-the-session-time-for-non-cloud-version-loging-out/371496 "2025-01-24T02:07:24Z")
Hi, Does anyone know how I can change the logout time session to an 1hr? --- ## [Elastic Security use cases and Logsdb](https://discuss.elastic.co/t/elastic-security-use-cases-and-logsdb/373608)
**Author:** [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Replies:** 0\ **Last updated:** [January 23, 2025, 11:46pm UTC](https://discuss.elastic.co/t/elastic-security-use-cases-and-logsdb/373608 "2025-01-23T23:46:16Z")
Hello, I'm just starting a new deployment on Elastic Cloud with the goal of going Enterprise to save space with by using both logsdb mode and searchable snapshots. I was reading the blog announcement about logsdb going… --- ## [How to auto sync the log files to log stash server](https://discuss.elastic.co/t/how-to-auto-sync-the-log-files-to-log-stash-server/373605)
**Author:** [@JyotiPrakash](https://discuss.elastic.co/u/JyotiPrakash)\ **Replies:** 0\ **Last updated:** [January 23, 2025, 10:39pm UTC](https://discuss.elastic.co/t/how-to-auto-sync-the-log-files-to-log-stash-server/373605 "2025-01-23T22:39:23Z")
Here is my set up, I am running ELK on a remote VM, and I am trying to sync all the logfiles from the local machine to the remote server without restarting the filebeat service (note the filebeat service is running on m… --- ## [How to search for last document per composite aggregation](https://discuss.elastic.co/t/how-to-search-for-last-document-per-composite-aggregation/373517)
**Author:** [@bzyku11](https://discuss.elastic.co/u/bzyku11)\ **Replies:** 3\ **Last updated:** [January 23, 2025, 9:23pm UTC](https://discuss.elastic.co/t/how-to-search-for-last-document-per-composite-aggregation/373517 "2025-01-23T21:23:52Z")
Hi, can someone help me with query: get last version of document per composite of fields(author, type, name) {"author" : "Mike", "type" : "expense\_report", "name": "trip to europe 2023", "updated" : "1727544249"} \<-re… --- ## [Logstash issue with duplicates of logs](https://discuss.elastic.co/t/logstash-issue-with-duplicates-of-logs/373599)
**Author:** [@arcsons](https://discuss.elastic.co/u/arcsons)\ **Replies:** 0\ **Last updated:** [January 23, 2025, 7:46pm UTC](https://discuss.elastic.co/t/logstash-issue-with-duplicates-of-logs/373599 "2025-01-23T19:46:22Z")
Hello, I have a simple logstash.conf file that looks something like this. When using Filebeat, it remembered which logs were sent to Elasticsearch. How can I implement a similar solution for Logstash? Currently, it's se… --- ## [How can i use elasticsearch as a graphdb?](https://discuss.elastic.co/t/how-can-i-use-elasticsearch-as-a-graphdb/373552)
**Author:** [@Ali\_Zeiynali](https://discuss.elastic.co/u/Ali_Zeiynali)\ **Replies:** 1\ **Last updated:** [January 23, 2025, 6:53pm UTC](https://discuss.elastic.co/t/how-can-i-use-elasticsearch-as-a-graphdb/373552 "2025-01-23T18:53:57Z")
want to use Elasticsearch as a graph database, but I'm not sure how this is possible. I'm working on a text analysis project for coding and other analytics, similar to Maxqda. I want to implement some graph algorithms li… --- ## [How can I put mapping on a remote cluster index](https://discuss.elastic.co/t/how-can-i-put-mapping-on-a-remote-cluster-index/373596)
**Author:** [@rachelyang](https://discuss.elastic.co/u/rachelyang)\ **Replies:** 0\ **Last updated:** [January 23, 2025, 6:44pm UTC](https://discuss.elastic.co/t/how-can-i-put-mapping-on-a-remote-cluster-index/373596 "2025-01-23T18:44:54Z")
I have connected to a remote cluster. I want to parse a field and extract a value from this field by mapping script. I refer to this article: https://www.elastic.co/guide/en/elasticsearch/reference/7.14/scripting-field-e… --- ## [How to calculate Elasticsearch Cloud in Azure TCO](https://discuss.elastic.co/t/how-to-calculate-elasticsearch-cloud-in-azure-tco/373501)
**Author:** [@kdwolf](https://discuss.elastic.co/u/kdwolf)\ **Replies:** 6\ **Last updated:** [January 23, 2025, 4:36pm UTC](https://discuss.elastic.co/t/how-to-calculate-elasticsearch-cloud-in-azure-tco/373501 "2025-01-23T16:36:13Z")
Apologies I couldn't find a better category to raise this question. I want to consider moving diagnostics indices to Elasticsearch Cloud and I can use their following link to calculate the costs of subscription. But I c… --- ## [Grok for this log format](https://discuss.elastic.co/t/grok-for-this-log-format/373247)
**Author:** [@nkknkk](https://discuss.elastic.co/u/nkknkk)\ **Replies:** 16\ **Last updated:** [January 23, 2025, 3:59pm UTC](https://discuss.elastic.co/t/grok-for-this-log-format/373247 "2025-01-23T15:59:02Z")
Hi, I am trying to parse log file. I am using elastic agent. below is the log format \[\<1 15, 2025 11:12:12 AM\>: This is message1\] \[\<1 15, 2025 11:12:12 AM\>: This is message2 \] This is the grok i am using and it only … --- ## [Logstash 7.6.2 cant connect to Elastic in Elastic Cloud](https://discuss.elastic.co/t/logstash-7-6-2-cant-connect-to-elastic-in-elastic-cloud/373584)
**Author:** [@Vinay6288](https://discuss.elastic.co/u/Vinay6288)\ **Replies:** 0\ **Last updated:** [January 23, 2025, 2:23pm UTC](https://discuss.elastic.co/t/logstash-7-6-2-cant-connect-to-elastic-in-elastic-cloud/373584 "2025-01-23T14:23:20Z")
I have Logstash 7.6.2 running in my local & using elasticsearch output plugin to write data to Elastic in Elastic Cloud. elasticsearch { hosts =\> \["https://ELASTIC-CLOUD-DNS:9243"\] ssl =\> true ssl\_certificat… --- ## [Destination.port field missing](https://discuss.elastic.co/t/destination-port-field-missing/373221)
**Author:** [@Hendrawns](https://discuss.elastic.co/u/Hendrawns)\ **Replies:** 6\ **Last updated:** [January 23, 2025, 1:59pm UTC](https://discuss.elastic.co/t/destination-port-field-missing/373221 "2025-01-23T13:59:08Z")
Hello everyone, after I tried to install elastic on a new vm, I realized that there were several fields that did not appear when I used the discovery feature, the field that did not appear was “destination.port”, has any… --- ## [Import error](https://discuss.elastic.co/t/import-error/373472)
**Author:** [@searchwithme](https://discuss.elastic.co/u/searchwithme)\ **Replies:** 1\ **Last updated:** [January 23, 2025, 1:19pm UTC](https://discuss.elastic.co/t/import-error/373472 "2025-01-23T13:19:16Z")
Hi! I am trying out implementing this piece of code from search labs. git page says prerequisite is docker but I am trying to run using jupyter notebook. here is the error I am encountering: ImportError: /home/ec2-user… --- ## [TCP output plugin blocking port on pipeline reload](https://discuss.elastic.co/t/tcp-output-plugin-blocking-port-on-pipeline-reload/373574)
**Author:** [@Sidd](https://discuss.elastic.co/u/Sidd)\ **Replies:** 0\ **Last updated:** [January 23, 2025, 10:30am UTC](https://discuss.elastic.co/t/tcp-output-plugin-blocking-port-on-pipeline-reload/373574 "2025-01-23T10:30:23Z")
On upgrading from logstash-oss-8.5.2-1 to 8.15.4 which started to use logstash-output-tcp Plugin version: v6.2.1 from Plugin version: v6.1.1. It seems the bug which was resolved as mentioned in changelog of 6.1.0 is intr… --- ## [Azure Native ISV Service](https://discuss.elastic.co/t/azure-native-isv-service/373580)
**Author:** [@fabry\_00](https://discuss.elastic.co/u/fabry_00)\ **Replies:** 0\ **Last updated:** [January 23, 2025, 12:15pm UTC](https://discuss.elastic.co/t/azure-native-isv-service/373580 "2025-01-23T12:15:49Z")
We are evaluating to deploy ELK on Azure using "Azure Native ISV Service" Here some linkgs: Azure Native ISV Service | Elasticsearch Service Documentation | Elastic Elastic integration overview - Azure Native ISV Serv… --- ## [Latest value in ESQL Elasticsearch piped query language on kibana](https://discuss.elastic.co/t/latest-value-in-esql-elasticsearch-piped-query-language-on-kibana/373427)
**Author:** [@roopeshetty](https://discuss.elastic.co/u/roopeshetty)\ **Replies:** 2\ **Last updated:** [January 23, 2025, 12:11pm UTC](https://discuss.elastic.co/t/latest-value-in-esql-elasticsearch-piped-query-language-on-kibana/373427 "2025-01-23T12:11:07Z")
Hi Guys We are running below ES|QL query on Kibana to make a table of list of alerts triggered from a external Monitoring tool. FROM winlogbeat-\* | WHERE event.code == "3003" | stats Alert\_Time = VALUES(@timestamp), Se… --- ## [How to retrieve fields content when quering runtime fields from Logstash](https://discuss.elastic.co/t/how-to-retrieve-fields-content-when-quering-runtime-fields-from-logstash/360466)
**Author:** [@Christian\_SANCHEZ](https://discuss.elastic.co/u/Christian_SANCHEZ)\ **Replies:** 1\ **Last updated:** [January 23, 2025, 9:57am UTC](https://discuss.elastic.co/t/how-to-retrieve-fields-content-when-quering-runtime-fields-from-logstash/360466 "2025-01-23T09:57:35Z")
Hello I am implementing Runtime fields. I added my runtime fields in my Index mapping. When searching the data from the Dev Console, i see by "fields" attribute, containing all the runtime fields I am expecting. But,… --- ## [LS constantly reloading failing pipeline & exhausting host connections](https://discuss.elastic.co/t/ls-constantly-reloading-failing-pipeline-exhausting-host-connections/373571)
**Author:** [@jdswifty](https://discuss.elastic.co/u/jdswifty)\ **Replies:** 0\ **Last updated:** [January 23, 2025, 9:56am UTC](https://discuss.elastic.co/t/ls-constantly-reloading-failing-pipeline-exhausting-host-connections/373571 "2025-01-23T09:56:11Z")
Noticed that when I have a pipeline, with an Elasticsearch output, that is failing, LS is then reloading the pipeline over & over but not clearing down the previously spawned connections to ES so I end up with connection… --- ## [Connection Pool Shutdown happening very frequently for s3 snapshot repository](https://discuss.elastic.co/t/connection-pool-shutdown-happening-very-frequently-for-s3-snapshot-repository/373570)
**Author:** [@Dharani\_Vattamwar](https://discuss.elastic.co/u/Dharani_Vattamwar)\ **Replies:** 0\ **Last updated:** [January 23, 2025, 9:53am UTC](https://discuss.elastic.co/t/connection-pool-shutdown-happening-very-frequently-for-s3-snapshot-repository/373570 "2025-01-23T09:53:50Z")
We have a need to perform automated restore testing for the snapshots stored . Whenever we connect the s3 to another ES cluster (readOnly mode) we will need to restart new ES cluster inorder to connect successfully. Late… --- ## [Is time series forecasting included in open source elasticsearch / kibana?](https://discuss.elastic.co/t/is-time-series-forecasting-included-in-open-source-elasticsearch-kibana/373564)
**Author:** [@vchalmel](https://discuss.elastic.co/u/vchalmel)\ **Replies:** 0\ **Last updated:** [January 23, 2025, 9:21am UTC](https://discuss.elastic.co/t/is-time-series-forecasting-included-in-open-source-elasticsearch-kibana/373564 "2025-01-23T09:21:28Z")
I am a long term user of elasticsearch for text data but have never really used the times series analytics capabilites. Being currently working towards a new project including a heavy workload on time series I was natur… --- ## [APP connect logs are not properly offload into elk](https://discuss.elastic.co/t/app-connect-logs-are-not-properly-offload-into-elk/372973)
**Author:** [@sahithi](https://discuss.elastic.co/u/sahithi)\ **Replies:** 2\ **Last updated:** [January 23, 2025, 8:59am UTC](https://discuss.elastic.co/t/app-connect-logs-are-not-properly-offload-into-elk/372973 "2025-01-23T08:59:52Z")
We are encountering issues where response and outbound blocks are not being captured into ELK logs. Upon investigation, it appears that the root cause is related to heterogeneous data types in the adjacent structure. Spe… --- ## [Json Array Problem](https://discuss.elastic.co/t/json-array-problem/373561)
**Author:** [@pcglr](https://discuss.elastic.co/u/pcglr)\ **Replies:** 0\ **Last updated:** [January 23, 2025, 8:52am UTC](https://discuss.elastic.co/t/json-array-problem/373561 "2025-01-23T08:52:16Z")
Hi everyone, The sample log I sent to Elastic is below. Although the value of a ‘Statement’ field is null, when I assign ‘key’ as a row in the dashboard, it shows the value of another Statement field instead of showing… --- ## ["Combined beat ran only by the Elastic Agent" Processes Running in Task Manager](https://discuss.elastic.co/t/combined-beat-ran-only-by-the-elastic-agent-processes-running-in-task-manager/373406)
**Author:** [@pcglr](https://discuss.elastic.co/u/pcglr)\ **Replies:** 2\ **Last updated:** [January 23, 2025, 8:18am UTC](https://discuss.elastic.co/t/combined-beat-ran-only-by-the-elastic-agent-processes-running-in-task-manager/373406 "2025-01-23T08:18:22Z")
Hi everyone, I'm encountering an issue where multiple processes named "Combined beat ran only by the Elastic Agent" are running simultaneously on my system. I'm using Elastic Agent to manage and collect logs. I notice… --- ## [How can i add count of no. of requests (Throughput) in kibana dashboard with count graph?](https://discuss.elastic.co/t/how-can-i-add-count-of-no-of-requests-throughput-in-kibana-dashboard-with-count-graph/373384)
**Author:** [@Amol\_Nagotkar](https://discuss.elastic.co/u/Amol_Nagotkar)\ **Replies:** 0\ **Last updated:** [January 20, 2025, 7:57am UTC](https://discuss.elastic.co/t/how-can-i-add-count-of-no-of-requests-throughput-in-kibana-dashboard-with-count-graph/373384 "2025-01-20T07:57:58Z")
Hi all, how can i add total count of no. of requests (Throughput) of http api in kibana(v 7.17.1) graph dashboard with count ? Obervability-\>APM-services-\>service\_name-\>transactions. currently i am using free version.… --- ## [Having trouble connecting to Kibana. New user](https://discuss.elastic.co/t/having-trouble-connecting-to-kibana-new-user/373476)
**Author:** [@CarlosDanger142](https://discuss.elastic.co/u/CarlosDanger142)\ **Replies:** 19\ **Last updated:** [January 22, 2025, 10:59pm UTC](https://discuss.elastic.co/t/having-trouble-connecting-to-kibana-new-user/373476 "2025-01-22T22:59:44Z")
Can't get the server to listen on port 5601. netstat -ant shows nothing on port 5601. Getting connection refused on port 5601 with Curl. telemetry.enabled: false telemetry.optIn: false newsfeed.enabled: false se… --- ## [Problem installing Elasticsearch](https://discuss.elastic.co/t/problem-installing-elasticsearch/373525)
**Author:** [@ktotsuka](https://discuss.elastic.co/u/ktotsuka)\ **Replies:** 6\ **Last updated:** [January 22, 2025, 8:59pm UTC](https://discuss.elastic.co/t/problem-installing-elasticsearch/373525 "2025-01-22T20:59:53Z")
I'm trying to install Elasticsearch, but the script is failing. I'm using Windows 11 Enterprise. Downloaded the installer (elasticsearch-8.17.1-windows-x86\_64.zip) from Download Elasticsearch | Elastic Unzip the zip f… --- ## [Kibana - Client request timeout](https://discuss.elastic.co/t/kibana-client-request-timeout/373520)
**Author:** [@Shahram](https://discuss.elastic.co/u/Shahram)\ **Replies:** 0\ **Last updated:** [January 22, 2025, 3:02pm UTC](https://discuss.elastic.co/t/kibana-client-request-timeout/373520 "2025-01-22T15:02:11Z")
I am using dev consule of kibana to modify elasticsearch index. My request reads the data of a field and writes it in another field of the same index. The size of the index is 20 milion documents. This is my script: P… --- ## [Aggregation with Concatenation](https://discuss.elastic.co/t/aggregation-with-concatenation/373526)
**Author:** [@kdwolf](https://discuss.elastic.co/u/kdwolf)\ **Replies:** 0\ **Last updated:** [January 22, 2025, 4:34pm UTC](https://discuss.elastic.co/t/aggregation-with-concatenation/373526 "2025-01-22T16:34:42Z")
I have an index (see below) which stores RTT (Realtime Text) - every time someone types a letter within a conversation, it is stored as a document as a "typed" event. If someone deletes the letter, it will be stored as a… --- ## [How to choose different saved search in a single panel based on drop down selection type in kibana dashboard](https://discuss.elastic.co/t/how-to-choose-different-saved-search-in-a-single-panel-based-on-drop-down-selection-type-in-kibana-dashboard/373483)
**Author:** [@halex](https://discuss.elastic.co/u/halex)\ **Replies:** 2\ **Last updated:** [January 22, 2025, 3:07pm UTC](https://discuss.elastic.co/t/how-to-choose-different-saved-search-in-a-single-panel-based-on-drop-down-selection-type-in-kibana-dashboard/373483 "2025-01-22T15:07:51Z")
I have use case where based on TransactionType(dropdown), I need to execute different searches in the visualisation dashboard. Example: PO - I have created a search where i have to group the events by OrderNumber A… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=109) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=111)