# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1170 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1171 --- ## [Event Filter endpoint agent via Kibana (Fleet) with wildcards](https://discuss.elastic.co/t/event-filter-endpoint-agent-via-kibana-fleet-with-wildcards/288680)
**Author:** [@tfriesen](https://discuss.elastic.co/u/tfriesen)\ **Replies:** 2\ **Last updated:** [November 9, 2021, 5:08pm UTC](https://discuss.elastic.co/t/event-filter-endpoint-agent-via-kibana-fleet-with-wildcards/288680 "2021-11-09T17:08:19Z")
Situation: I'm deploying endpoint security via Fleet and Elastic agent. Many of the default settings cause the agents to be extremely chatty, shipping many uninteresting, chatty logs. I want to filter out some of these e… --- ## [Elastic search with Springboot connection error](https://discuss.elastic.co/t/elastic-search-with-springboot-connection-error/288789)
**Author:** [@adeybabs](https://discuss.elastic.co/u/adeybabs)\ **Replies:** 1\ **Last updated:** [November 9, 2021, 5:03pm UTC](https://discuss.elastic.co/t/elastic-search-with-springboot-connection-error/288789 "2021-11-09T17:03:11Z")
I keep getting this error when I try to load my spring application connected to Elasticsearch --- ## [Index data as nested and flattened to improve aggregation performance?](https://discuss.elastic.co/t/index-data-as-nested-and-flattened-to-improve-aggregation-performance/288799)
**Author:** [@caseydm](https://discuss.elastic.co/u/caseydm)\ **Replies:** 0\ **Last updated:** [November 9, 2021, 4:51pm UTC](https://discuss.elastic.co/t/index-data-as-nested-and-flattened-to-improve-aggregation-performance/288799 "2021-11-09T16:51:39Z")
I am indexing academic papers that have a list of authors. Right now, I index the authors as a nested field type, because we want to query within the list, such as author\_sequence\_number: 1 and author\_display\_name: torre… --- ## [Can't enroll agent to fleet: (Fail to enroll: fail to execute request to fleet-server)](https://discuss.elastic.co/t/cant-enroll-agent-to-fleet-fail-to-enroll-fail-to-execute-request-to-fleet-server/285682)
**Author:** [@John9](https://discuss.elastic.co/u/John9)\ **Replies:** 4\ **Last updated:** [November 9, 2021, 4:29pm UTC](https://discuss.elastic.co/t/cant-enroll-agent-to-fleet-fail-to-enroll-fail-to-execute-request-to-fleet-server/285682 "2021-11-09T16:29:34Z")
Hello, I've been trying to setup a testing ELK stack environment for learning purposes. I am running: VM1 = Ubuntu Server 20.04 running Elasticsearch / Kibana with IP 172.16.0.27. Minimal Security is on. VM2 = Ubuntu … --- ## [Unable to parse Timestamp on CEF LOGS](https://discuss.elastic.co/t/unable-to-parse-timestamp-on-cef-logs/288781)
**Author:** [@Mmatos](https://discuss.elastic.co/u/Mmatos)\ **Replies:** 1\ **Last updated:** [November 9, 2021, 3:46pm UTC](https://discuss.elastic.co/t/unable-to-parse-timestamp-on-cef-logs/288781 "2021-11-09T15:46:59Z")
Hi, I am having problems parsing a set of logs from sophos central Intercept X Antivirus. I am using the sophos tool to download the logs and store them in a File. "Service and Support" Of the multiple formats, the CEF… --- ## [Alternatives to Multiline Codec for logging Java traces with TCP input?](https://discuss.elastic.co/t/alternatives-to-multiline-codec-for-logging-java-traces-with-tcp-input/288784)
**Author:** [@bennetth](https://discuss.elastic.co/u/bennetth)\ **Replies:** 0\ **Last updated:** [November 9, 2021, 3:43pm UTC](https://discuss.elastic.co/t/alternatives-to-multiline-codec-for-logging-java-traces-with-tcp-input/288784 "2021-11-09T15:43:08Z")
Hello all, I have an issue where I am trying to log Java traces for a TCP input. However, it appears that Logstash truncates the trace to just the first line of the trace. I have attempted to use the multiline codec for… --- ## [TypeScript + elasticSearch search has\_child filter](https://discuss.elastic.co/t/typescript-elasticsearch-search-has-child-filter/288775)
**Author:** [@Francisco\_Ferreira](https://discuss.elastic.co/u/Francisco_Ferreira)\ **Replies:** 1\ **Last updated:** [November 9, 2021, 3:01pm UTC](https://discuss.elastic.co/t/typescript-elasticsearch-search-has-child-filter/288775 "2021-11-09T15:01:47Z")
Hey guys, i'm been building a search endpoint to my api. and when i try to filter the ''has\_child'' query with a match\\term query it returns me all the employees that have childs or none at all here i have the way i'm i… --- ## [ELK Licencing question](https://discuss.elastic.co/t/elk-licencing-question/288681)
**Author:** [@Eduard\_Abril](https://discuss.elastic.co/u/Eduard_Abril)\ **Replies:** 4\ **Last updated:** [November 9, 2021, 2:44pm UTC](https://discuss.elastic.co/t/elk-licencing-question/288681 "2021-11-09T14:44:39Z")
Hello guys, We are planning to deploy an ELK architecture with enterprise features, our though is to deploy 9 Elasticsearch nodes with different roles, 1 kibana node and 2 logstash nodes, my question is How many nodes d… --- ## [%{message} is always empty](https://discuss.elastic.co/t/message-is-always-empty/288765)
**Author:** [@Robert\_Neagu](https://discuss.elastic.co/u/Robert_Neagu)\ **Replies:** 1\ **Last updated:** [November 9, 2021, 2:32pm UTC](https://discuss.elastic.co/t/message-is-always-empty/288765 "2021-11-09T14:32:56Z")
I want to send an email notification if there are any errors inside the Logstash import process. For this I'm using the email plugin inside the output section output { email { to =\> "mail@gmail.com" from =\> "server@… --- ## [Elastisearch snapshots error - Can not find an azure client for account](https://discuss.elastic.co/t/elastisearch-snapshots-error-can-not-find-an-azure-client-for-account/288754)
**Author:** [@Cian](https://discuss.elastic.co/u/Cian)\ **Replies:** 0\ **Last updated:** [November 9, 2021, 11:57am UTC](https://discuss.elastic.co/t/elastisearch-snapshots-error-can-not-find-an-azure-client-for-account/288754 "2021-11-09T11:57:57Z")
Hi Elasticsearch, I want to update the Azure storage account that we upload snapshots to but I get the below error: "Can not find an azure client for account \[null\]\]" this is only happening when I change the storage ac… --- ## [Unable to retrieve version information from Elasticsearch node](https://discuss.elastic.co/t/unable-to-retrieve-version-information-from-elasticsearch-node/288717)
**Author:** [@slashlinux](https://discuss.elastic.co/u/slashlinux)\ **Replies:** 1\ **Last updated:** [November 9, 2021, 1:39pm UTC](https://discuss.elastic.co/t/unable-to-retrieve-version-information-from-elasticsearch-node/288717 "2021-11-09T13:39:33Z")
After I've enabled the xpack security for integrating the Keycloak SSO on Kibana/Elasticsearch, now my kibana says - Kibana server is not ready yet and the kibana logs showing :slight\_smile: {"type":"log","@timestamp":"… --- ## [Is searches faster with more match queries?](https://discuss.elastic.co/t/is-searches-faster-with-more-match-queries/287867)
**Author:** [@MinwooKim](https://discuss.elastic.co/u/MinwooKim)\ **Replies:** 3\ **Last updated:** [November 9, 2021, 1:06pm UTC](https://discuss.elastic.co/t/is-searches-faster-with-more-match-queries/287867 "2021-11-09T13:06:37Z")
I have two queries. And in the index all of the data have collectHour as 10. if I request both queries, the one with more match statements was faster.... I am curious, if all fields are inspected as columns that are in… --- ## [Missing Converter handling for full class name=org.jruby.ext.date.RubyDateTime](https://discuss.elastic.co/t/missing-converter-handling-for-full-class-name-org-jruby-ext-date-rubydatetime/288757)
**Author:** [@Miria\_Bernardes](https://discuss.elastic.co/u/Miria_Bernardes)\ **Replies:** 1\ **Last updated:** [November 9, 2021, 12:44pm UTC](https://discuss.elastic.co/t/missing-converter-handling-for-full-class-name-org-jruby-ext-date-rubydatetime/288757 "2021-11-09T12:44:22Z")
Hey guys, all right? I need help with an issue I've been experiencing when collecting data using jdbc\_streaming, running conf locally through docker the data collection by logstash is performed successfully, but when ap… --- ## [How can I retrieve all user sessions connected to my Kibana, using API](https://discuss.elastic.co/t/how-can-i-retrieve-all-user-sessions-connected-to-my-kibana-using-api/288329)
**Author:** [@dicto](https://discuss.elastic.co/u/dicto)\ **Replies:** 3\ **Last updated:** [November 8, 2021, 10:21am UTC](https://discuss.elastic.co/t/how-can-i-retrieve-all-user-sessions-connected-to-my-kibana-using-api/288329 "2021-11-08T10:21:58Z")
Hi! How can I retrieve all user sessions connected to my Kibana, using API ? I will do a montoring sessions to delete duplicate access to my dashboard in Kibana. I saw that its is possible to DELETE sessions using the… --- ## [Alternative to ingest-convert.sh for YML](https://discuss.elastic.co/t/alternative-to-ingest-convert-sh-for-yml/288597)
**Author:** [@IsaacKr](https://discuss.elastic.co/u/IsaacKr)\ **Replies:** 4\ **Last updated:** [November 9, 2021, 11:42am UTC](https://discuss.elastic.co/t/alternative-to-ingest-convert-sh-for-yml/288597 "2021-11-09T11:42:27Z")
We are using Logstash to ship logs to a cloud based SIEM. We'd like to utilize Filebeat to assist in the parsing, however it seems that Filebeat only provides the ingest pipelines for Elasticsearch. The ingest-convert.sh… --- ## [ElasticSearch \_bulk and \_update got bad performance](https://discuss.elastic.co/t/elasticsearch-bulk-and-update-got-bad-performance/288746)
**Author:** [@Hunter\_Tr\_n](https://discuss.elastic.co/u/Hunter_Tr_n)\ **Replies:** 1\ **Last updated:** [November 9, 2021, 11:41am UTC](https://discuss.elastic.co/t/elasticsearch-bulk-and-update-got-bad-performance/288746 "2021-11-09T11:41:04Z")
I'm using \_bulk request and updating documents by doc. However, some complex cases need to apply script for updating. However, the performance in case script is very bad. It affects search side and index side latency. I… --- ## [Create a count of the total of desired metric](https://discuss.elastic.co/t/create-a-count-of-the-total-of-desired-metric/288594)
**Author:** [@Sugand](https://discuss.elastic.co/u/Sugand)\ **Replies:** 3\ **Last updated:** [November 9, 2021, 11:38am UTC](https://discuss.elastic.co/t/create-a-count-of-the-total-of-desired-metric/288594 "2021-11-09T11:38:15Z")
Hi, I have certain visualizations in dashboard based off condition's. Example: 1\> A metric of company numbers starting with number 1 and 2\> A metric of emails staring with alphabet "a". I want to create another visu… --- ## [Get current year from painless](https://discuss.elastic.co/t/get-current-year-from-painless/288738)
**Author:** [@Andrea\_Bozzano](https://discuss.elastic.co/u/Andrea_Bozzano)\ **Replies:** 2\ **Last updated:** [November 9, 2021, 11:11am UTC](https://discuss.elastic.co/t/get-current-year-from-painless/288738 "2021-11-09T11:11:17Z")
Hi everyone! In my application, I'm trying to retrieve the current year in a scripted field. The idea was (in pseudocode): calculated = currentYear - doc\['field'\].value return calculated; I tried with: Instant Curr… --- ## [Data are processing slowly from the Logstash persistent queue to ES](https://discuss.elastic.co/t/data-are-processing-slowly-from-the-logstash-persistent-queue-to-es/288741)
**Author:** [@jenifer\_raja](https://discuss.elastic.co/u/jenifer_raja)\ **Replies:** 0\ **Last updated:** [November 9, 2021, 10:14am UTC](https://discuss.elastic.co/t/data-are-processing-slowly-from-the-logstash-persistent-queue-to-es/288741 "2021-11-09T10:14:22Z")
We are facing an issue with Logstash parsing, Initially parsing speed is very high and then it decreases gradually, because of this we have around 10 gb of data in queue. We tried increasing swap size, increasing workers… --- ## [Where to find Fleet Integration new additions and changelogs](https://discuss.elastic.co/t/where-to-find-fleet-integration-new-additions-and-changelogs/286636)
**Author:** [@zx8086](https://discuss.elastic.co/u/zx8086)\ **Replies:** 3\ **Last updated:** [November 9, 2021, 9:52am UTC](https://discuss.elastic.co/t/where-to-find-fleet-integration-new-additions-and-changelogs/286636 "2021-11-09T09:52:51Z")
Is there a way to identify which new Fleet Integrations are added and also a changelog when they are upgraded? Is there a central location for this information? I can only tell right now (maybe incorrectly) via the Inte… --- ## [Heartbeat input plugin](https://discuss.elastic.co/t/heartbeat-input-plugin/288621)
**Author:** [@BeMoore](https://discuss.elastic.co/u/BeMoore)\ **Replies:** 2\ **Last updated:** [November 9, 2021, 9:50am UTC](https://discuss.elastic.co/t/heartbeat-input-plugin/288621 "2021-11-09T09:50:40Z")
Hiya all, if i want to change the input plugins listen port for heartbeat how can i do this? the guide doesn't list it as an option input { heartbeat { port =\> 2600 } } generates this error \[ERROR\]\[logstash.… --- ## [Specific retention duration for logs (Index Lifecycle Policy)](https://discuss.elastic.co/t/specific-retention-duration-for-logs-index-lifecycle-policy/288635)
**Author:** [@Sco](https://discuss.elastic.co/u/Sco)\ **Replies:** 1\ **Last updated:** [November 9, 2021, 9:48am UTC](https://discuss.elastic.co/t/specific-retention-duration-for-logs-index-lifecycle-policy/288635 "2021-11-09T09:48:27Z")
Hi guys, I would need some help with Index Lifecycle Policies, and it's setup. I need to set up winlogbeat to store data for X days and delete it afterward. Simple as that. Tried different configurations in ILM but I … --- ## [Filebest not reading log files whos names as numeric only](https://discuss.elastic.co/t/filebest-not-reading-log-files-whos-names-as-numeric-only/288672)
**Author:** [@Azfar](https://discuss.elastic.co/u/Azfar)\ **Replies:** 2\ **Last updated:** [November 9, 2021, 9:46am UTC](https://discuss.elastic.co/t/filebest-not-reading-log-files-whos-names-as-numeric-only/288672 "2021-11-09T09:46:15Z")
I have log files whose names are in numbers only like "34567854322", these are an application logs and I don't have control to append any extension. Blockquote ls -l total 12 -rw-rw-r-- 1 barakat barakat 1254 Nov 2… --- ## [Restore KQL time filter on Kibana Dashboard](https://discuss.elastic.co/t/restore-kql-time-filter-on-kibana-dashboard/287975)
**Author:** [@pranay\_jain](https://discuss.elastic.co/u/pranay_jain)\ **Replies:** 4\ **Last updated:** [November 9, 2021, 9:42am UTC](https://discuss.elastic.co/t/restore-kql-time-filter-on-kibana-dashboard/287975 "2021-11-09T09:42:27Z")
Is there a way to restore time filter selection on Kibana dashboard. Use case : We have menu button on our web page from where we open Kibana dashboard by using tokens with the endpoint /internal/security/login for log… --- ## [Functionbeat throwing the error add\_cloud\_metadata: hosting provider type not detected](https://discuss.elastic.co/t/functionbeat-throwing-the-error-add-cloud-metadata-hosting-provider-type-not-detected/288675)
**Author:** [@Jijo\_Johny](https://discuss.elastic.co/u/Jijo_Johny)\ **Replies:** 1\ **Last updated:** [November 9, 2021, 9:38am UTC](https://discuss.elastic.co/t/functionbeat-throwing-the-error-add-cloud-metadata-hosting-provider-type-not-detected/288675 "2021-11-09T09:38:21Z")
I am trying to connect to the Elasticsearch and Kibana 7.10.2, launched from AWS under open source licence. I am trying to stream the logs from AWS CLoudwatch log group to Kibana, I have finished the set up of functionbe… --- ## [Coordinate converting issue!](https://discuss.elastic.co/t/coordinate-converting-issue/288733)
**Author:** [@FURKAN\_KURT](https://discuss.elastic.co/u/FURKAN_KURT)\ **Replies:** 0\ **Last updated:** [November 9, 2021, 9:26am UTC](https://discuss.elastic.co/t/coordinate-converting-issue/288733 "2021-11-09T09:26:56Z")
Hello. I am stuck in this issue for days. I send the bounding box and get this response: { "took": 2, "timed\_out": false, "\_shards": { "total": 5, "successful": 5, "skipped": 0, "failed": 0 }, … --- ## [Is an issue with AD](https://discuss.elastic.co/t/is-an-issue-with-ad/288558)
**Author:** [@tbs575](https://discuss.elastic.co/u/tbs575)\ **Replies:** 2\ **Last updated:** [November 9, 2021, 9:10am UTC](https://discuss.elastic.co/t/is-an-issue-with-ad/288558 "2021-11-09T09:10:26Z")
set Elasticsearch 7.15 using Windows AD to verify account, and mapping AD group into xinc\_user role, and it is working, but now I met problem, not sure if it is issue. login with AD account by kibana check account pr… --- ## [Is there any way to change the precision\_threshold when use es-sql?](https://discuss.elastic.co/t/is-there-any-way-to-change-the-precision-threshold-when-use-es-sql/288729)
**Author:** [@danielduan](https://discuss.elastic.co/u/danielduan)\ **Replies:** 0\ **Last updated:** [November 9, 2021, 9:08am UTC](https://discuss.elastic.co/t/is-there-any-way-to-change-the-precision-threshold-when-use-es-sql/288729 "2021-11-09T09:08:09Z")
We know that when use es api we can setting the value of precision\_threshold , is there any way to overwrite the default value when use es-sql? if the answer is no , could you please tell us how to modify the default v… --- ## [\_bulk request with routing parameter](https://discuss.elastic.co/t/bulk-request-with-routing-parameter/288723)
**Author:** [@Hunter\_Tr\_n](https://discuss.elastic.co/u/Hunter_Tr_n)\ **Replies:** 2\ **Last updated:** [November 9, 2021, 9:00am UTC](https://discuss.elastic.co/t/bulk-request-with-routing-parameter/288723 "2021-11-09T09:00:01Z")
Currently, I am applying \_bulk requests for reindexing. Each \_bulk request contains a ton of reindex requests ( creating, updating, or deleting). Each document already has its own routing. I wonder if I apply routing on… --- ## [Elasticsearch can't restart and join the cluster](https://discuss.elastic.co/t/elasticsearch-cant-restart-and-join-the-cluster/288630)
**Author:** [@songfj](https://discuss.elastic.co/u/songfj)\ **Replies:** 3\ **Last updated:** [November 9, 2021, 8:22am UTC](https://discuss.elastic.co/t/elasticsearch-cant-restart-and-join-the-cluster/288630 "2021-11-09T08:22:02Z")
Hello everyone, when I restart one node from Elasticsearch cluster, the node can't join cluster,I 'm sure I have config the security.I can't start my node, when I start it , my kibana can't login in with my old username … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1169) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1171)