# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=130 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 131 --- ## [Elasticsearch monitoring: Shard Recovery](https://discuss.elastic.co/t/elasticsearch-monitoring-shard-recovery/371186)
**Author:** [@s.buksa](https://discuss.elastic.co/u/s.buksa)\ **Replies:** 1\ **Last updated:** [November 29, 2024, 4:41am UTC](https://discuss.elastic.co/t/elasticsearch-monitoring-shard-recovery/371186 "2024-11-29T04:41:35Z")
Hello, Could someone help me understand where I can find metrics that provide insights into Shard Recoveries, such as the number of Shard Recoveries? I am using the Elasticsearch module with Elastic Agent to collect da… --- ## [Generating Reports via Watcher Issue](https://discuss.elastic.co/t/generating-reports-via-watcher-issue/371085)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 1\ **Last updated:** [November 29, 2024, 2:09am UTC](https://discuss.elastic.co/t/generating-reports-via-watcher-issue/371085 "2024-11-29T02:09:40Z")
Hello, Not sure what's happening but I ran a watcher: { "trigger": { "schedule": { "interval": "1h" } }, "input": { "none": {} }, "condition": { "always": {} }, "actions": { "ema… --- ## [Calculation between two fields in two separate indexes](https://discuss.elastic.co/t/calculation-between-two-fields-in-two-separate-indexes/371182)
**Author:** [@ek9boy](https://discuss.elastic.co/u/ek9boy)\ **Replies:** 1\ **Last updated:** [November 29, 2024, 2:05am UTC](https://discuss.elastic.co/t/calculation-between-two-fields-in-two-separate-indexes/371182 "2024-11-29T02:05:18Z")
Hi, I have Index\_a: with an amount field I have Index\_b: with a threshold field Is there anyway to calculate the percentage of these fields within kibana itself? --- ## [Return all the document missing some certain key (of type nested in the mapping)](https://discuss.elastic.co/t/return-all-the-document-missing-some-certain-key-of-type-nested-in-the-mapping/371128)
**Author:** [@bahnasawy](https://discuss.elastic.co/u/bahnasawy)\ **Replies:** 3\ **Last updated:** [November 28, 2024, 7:17pm UTC](https://discuss.elastic.co/t/return-all-the-document-missing-some-certain-key-of-type-nested-in-the-mapping/371128 "2024-11-28T19:17:49Z")
I have a document of this structure "\_source": {"id":1 , "myNestedField" : \[ {"nested\_id":"u71","Name":"ABC"} , {"nested\_id":"op90","Name":"EG"} \] } The type of the nested\_id in the mapping is nested what i wan… --- ## [Searchable snapshot statistics API Enhancement Suggestion](https://discuss.elastic.co/t/searchable-snapshot-statistics-api-enhancement-suggestion/371203)
**Author:** [@rugenl](https://discuss.elastic.co/u/rugenl)\ **Replies:** 5\ **Last updated:** [November 28, 2024, 5:24pm UTC](https://discuss.elastic.co/t/searchable-snapshot-statistics-api-enhancement-suggestion/371203 "2024-11-28T17:24:23Z")
I'd like to suggest that the node name be added to the info returned, in a "name" field. I think this would make the results more align with node stats return and avoid having to match up the node id's to get the name. … --- ## [Mapping only specific attributes in the Vision One integration](https://discuss.elastic.co/t/mapping-only-specific-attributes-in-the-vision-one-integration/371209)
**Author:** [@cyberm](https://discuss.elastic.co/u/cyberm)\ **Replies:** 1\ **Last updated:** [November 28, 2024, 4:53pm UTC](https://discuss.elastic.co/t/mapping-only-specific-attributes-in-the-vision-one-integration/371209 "2024-11-28T16:53:55Z")
Hi everyone, I’m currently doing a full analysis of all the attributes I’m receiving through the default setup of the Vision One integration (Trend Micro) in Elasticsearch. While reviewing the data, I started wondering: … --- ## [Log stash parsing invalid json string issue](https://discuss.elastic.co/t/log-stash-parsing-invalid-json-string-issue/370431)
**Author:** [@Awais\_Jilani](https://discuss.elastic.co/u/Awais_Jilani)\ **Replies:** 1\ **Last updated:** [November 28, 2024, 4:05pm UTC](https://discuss.elastic.co/t/log-stash-parsing-invalid-json-string-issue/370431 "2024-11-28T16:05:11Z")
I am facing issue in logstash 7.6.1 while reading a mesages which is json but nested map is in json string which cause it invalid json and logstash gives json parsing error. I tried to remove that tag from message but i… --- ## [Google Workspace Integration no logs been received](https://discuss.elastic.co/t/google-workspace-integration-no-logs-been-received/371147)
**Author:** [@flczaja](https://discuss.elastic.co/u/flczaja)\ **Replies:** 3\ **Last updated:** [November 28, 2024, 3:57pm UTC](https://discuss.elastic.co/t/google-workspace-integration-no-logs-been-received/371147 "2024-11-28T15:57:02Z")
Hi folks, I'm trying to configure Google Workspace Integration to receive audit reports, but there is no log been received. I've followed the integration doc, but looks like doen't work for me. I know I'm missing somet… --- ## [Issues with Gsub moving from Logstash 7 to 8](https://discuss.elastic.co/t/issues-with-gsub-moving-from-logstash-7-to-8/371189)
**Author:** [@Jose\_E](https://discuss.elastic.co/u/Jose_E)\ **Replies:** 2\ **Last updated:** [November 28, 2024, 3:12pm UTC](https://discuss.elastic.co/t/issues-with-gsub-moving-from-logstash-7-to-8/371189 "2024-11-28T15:12:29Z")
Hi all, as the title says, I'm experiencing some issues with GSUB, moving from logstash 7 to logstash 8. I discarded a problem with ECS compatibility (I didn't think it was involved here, but just in case), so it must be… --- ## [Filebeat Lost of first lines when rotating files](https://discuss.elastic.co/t/filebeat-lost-of-first-lines-when-rotating-files/371150)
**Author:** [@Florian\_Bahu](https://discuss.elastic.co/u/Florian_Bahu)\ **Replies:** 4\ **Last updated:** [November 28, 2024, 2:19pm UTC](https://discuss.elastic.co/t/filebeat-lost-of-first-lines-when-rotating-files/371150 "2024-11-28T14:19:01Z")
Hello, I noticed some issues when Filebeat reads a new file: the first line is sometimes skipped. So I made a quick script to test this: #/bin/bash for i in {00..100}; do mv toto.log toto.log.${i} && touch toto.log ech… --- ## [Elastic Agent on Kubernetes standalone did not collect some important metrics](https://discuss.elastic.co/t/elastic-agent-on-kubernetes-standalone-did-not-collect-some-important-metrics/371195)
**Author:** [@Iure\_Oliveira](https://discuss.elastic.co/u/Iure_Oliveira)\ **Replies:** 0\ **Last updated:** [November 28, 2024, 2:07pm UTC](https://discuss.elastic.co/t/elastic-agent-on-kubernetes-standalone-did-not-collect-some-important-metrics/371195 "2024-11-28T14:07:00Z")
Hello everyone, I’ve deployed Elastic Agent in standalone mode on my Kubernetes cluster (Elastic Stack version 8.14.3). While most of the data is being collected as expected, I’ve noticed that some important Kubernetes … --- ## [ES|QL Grok parsing](https://discuss.elastic.co/t/es-ql-grok-parsing/371171)
**Author:** [@fitastronaut](https://discuss.elastic.co/u/fitastronaut)\ **Replies:** 1\ **Last updated:** [November 28, 2024, 10:42am UTC](https://discuss.elastic.co/t/es-ql-grok-parsing/371171 "2024-11-28T10:42:18Z")
Hello all, I have this raw log which I want to parse using GROK. I tried this but can't get it to parse. Appreciate any help I get :slight\_smile: Sample Data 2024-11-05 08:36:53 UTC:ip-10-0-1-111.ap-southeast-1.co… --- ## [OIDC Login Problem](https://discuss.elastic.co/t/oidc-login-problem/371063)
**Author:** [@cafuego](https://discuss.elastic.co/u/cafuego)\ **Replies:** 3\ **Last updated:** [November 28, 2024, 10:19am UTC](https://discuss.elastic.co/t/oidc-login-problem/371063 "2024-11-28T10:19:23Z")
After updating from 8.15.3 to 8.16.1 today, we found we were unable to login to Kibana via our SSO server. Instead we got the message "We hit an authentication error". After a bunch of digging, I eventually found an err… --- ## [Issue when trying to delete Agent Policy with Managed Package Policies](https://discuss.elastic.co/t/issue-when-trying-to-delete-agent-policy-with-managed-package-policies/371167)
**Author:** [@bradleysb](https://discuss.elastic.co/u/bradleysb)\ **Replies:** 0\ **Last updated:** [November 28, 2024, 7:36am UTC](https://discuss.elastic.co/t/issue-when-trying-to-delete-agent-policy-with-managed-package-policies/371167 "2024-11-28T07:36:00Z")
Hi community, We have a problem where we cannot delete a Agent Policy because it states that "Agent policy with managed package policies cannot be deleted". Context: We copied an existing Agent Policy with 33 integrat… --- ## [Issue with Labels in MSSQL Curated Dashboards](https://discuss.elastic.co/t/issue-with-labels-in-mssql-curated-dashboards/370898)
**Author:** [@Ankita\_Pachauri](https://discuss.elastic.co/u/Ankita_Pachauri)\ **Replies:** 1\ **Last updated:** [November 28, 2024, 6:06am UTC](https://discuss.elastic.co/t/issue-with-labels-in-mssql-curated-dashboards/370898 "2024-11-28T06:06:03Z")
Hi Team, We are using Elastic MSSQL integration (ELK Version 8.13.4) to pull error logs. The elastic agent is installed on the Windows node running the MSSQL service and is managed by fleet. The curated log dashboard do… --- ## [Can I have 2 analyzer for the same field in the document?](https://discuss.elastic.co/t/can-i-have-2-analyzer-for-the-same-field-in-the-document/371165)
**Author:** [@Hooman\_Bahreini](https://discuss.elastic.co/u/Hooman_Bahreini)\ **Replies:** 0\ **Last updated:** [November 28, 2024, 5:17am UTC](https://discuss.elastic.co/t/can-i-have-2-analyzer-for-the-same-field-in-the-document/371165 "2024-11-28T05:17:35Z")
I am using Elasticsearch for a search jobs. Jobs have Title, Description, company and Location, as shown below: I am using english\_analyzer for Title and Description and keyword\_analizer for company and location, as sho… --- ## [Mongo db + elastic](https://discuss.elastic.co/t/mongo-db-elastic/371164)
**Author:** [@yahimin](https://discuss.elastic.co/u/yahimin)\ **Replies:** 0\ **Last updated:** [November 28, 2024, 5:09am UTC](https://discuss.elastic.co/t/mongo-db-elastic/371164 "2024-11-28T05:09:34Z")
I am trying to implement a search function using elastic. The general search filtering function and search function are functions found in shopping apps. What I'm curious about is whether it's the right choice to manag… --- ## [Resolving Message Queue Clogs in Elasticsearch with Informatica C360](https://discuss.elastic.co/t/resolving-message-queue-clogs-in-elasticsearch-with-informatica-c360/363014)
**Author:** [@SelvamaniTaurus](https://discuss.elastic.co/u/SelvamaniTaurus)\ **Replies:** 3\ **Last updated:** [November 27, 2024, 10:42pm UTC](https://discuss.elastic.co/t/resolving-message-queue-clogs-in-elasticsearch-with-informatica-c360/363014 "2024-11-27T22:42:38Z")
Hello Team, In our organization, we use Informatica C360 for Customer MDM, alongside Elastic Search to implement the Smart Search capability that Informatica provides. While we appreciate the optimized searching techniq… --- ## [Problems monitoring cluster with metricbeat on 8.15](https://discuss.elastic.co/t/problems-monitoring-cluster-with-metricbeat-on-8-15/365827)
**Author:** [@numpty-boy](https://discuss.elastic.co/u/numpty-boy)\ **Replies:** 4\ **Last updated:** [November 27, 2024, 10:27pm UTC](https://discuss.elastic.co/t/problems-monitoring-cluster-with-metricbeat-on-8-15/365827 "2024-11-27T22:27:46Z")
Hi Team, I've just migrated a 7.17.23 TEST cluster on which stack monitoring via metricbeat was working fine, to 8.15. Now stack monitoring has stopped working and I get taken to the 'no monitoring data found'. If I c… --- ## [Complex order on numerics and filtering](https://discuss.elastic.co/t/complex-order-on-numerics-and-filtering/371143)
**Author:** [@argy](https://discuss.elastic.co/u/argy)\ **Replies:** 0\ **Last updated:** [November 27, 2024, 2:36pm UTC](https://discuss.elastic.co/t/complex-order-on-numerics-and-filtering/371143 "2024-11-27T14:36:22Z")
Good day, I am developing a solution whereby I will have an index with below documents { "name" : "Powlowski, Schaden and Kuvalis", "financials" : \[ { "revenue\_value\_type" … --- ## [Proofpoint Integration Web Socket Unregistering](https://discuss.elastic.co/t/proofpoint-integration-web-socket-unregistering/371103)
**Author:** [@elasticfantastik](https://discuss.elastic.co/u/elasticfantastik)\ **Replies:** 1\ **Last updated:** [November 27, 2024, 7:28pm UTC](https://discuss.elastic.co/t/proofpoint-integration-web-socket-unregistering/371103 "2024-11-27T19:28:11Z")
We have an elastic agent running a "Proofpoint On Demand" integration. However, it sporadically stops getting data. To clarify, we poll the API once every hour, and at some unpredictable point, it completely stops gettin… --- ## [How to filter all data but the index names with jq in kibana: GET \_all/\_ilm/explain | jq](https://discuss.elastic.co/t/how-to-filter-all-data-but-the-index-names-with-jq-in-kibana-get-all-ilm-explain-jq/371092)
**Author:** [@mpniel](https://discuss.elastic.co/u/mpniel)\ **Replies:** 5\ **Last updated:** [November 27, 2024, 7:16pm UTC](https://discuss.elastic.co/t/how-to-filter-all-data-but-the-index-names-with-jq-in-kibana-get-all-ilm-explain-jq/371092 "2024-11-27T19:16:39Z")
Hello, How to filter all data, but the index names with jq in kibana: GET \_all/\_ilm/explain | jq . Only the indexes with phase : cold. --- ## [Elastic.Clients.Elasticsearch - Query list of codes](https://discuss.elastic.co/t/elastic-clients-elasticsearch-query-list-of-codes/371156)
**Author:** [@romatos](https://discuss.elastic.co/u/romatos)\ **Replies:** 0\ **Last updated:** [November 27, 2024, 5:20pm UTC](https://discuss.elastic.co/t/elastic-clients-elasticsearch-query-list-of-codes/371156 "2024-11-27T17:20:54Z")
Hello, good afternoon, I am using Elastic.Clients.Elasticsearch, but I am unable to perform queries using a list of codes. Here is how I did it: var listaDeValores = new List\ { 1, 2, 3, 4 }; var searchRequest = … --- ## [Logstash 8 grok is resolving host.name as host.hostname](https://discuss.elastic.co/t/logstash-8-grok-is-resolving-host-name-as-host-hostname/371149)
**Author:** [@Jose\_E](https://discuss.elastic.co/u/Jose_E)\ **Replies:** 7\ **Last updated:** [November 27, 2024, 5:13pm UTC](https://discuss.elastic.co/t/logstash-8-grok-is-resolving-host-name-as-host-hostname/371149 "2024-11-27T17:13:01Z")
Hi all, I'm currently working on migrating from Logstash 7.x to logstash 8.x and it's being a bit trippy. We already used ECS so supposedly it should be straight forward, but I'm experiencing some weird errors with grok.… --- ## [Need Taco connecter for Elasticsearch version 6.8.23](https://discuss.elastic.co/t/need-taco-connecter-for-elasticsearch-version-6-8-23/371033)
**Author:** [@Chinmay\_Bhusate](https://discuss.elastic.co/u/Chinmay_Bhusate)\ **Replies:** 2\ **Last updated:** [November 27, 2024, 4:22pm UTC](https://discuss.elastic.co/t/need-taco-connecter-for-elasticsearch-version-6-8-23/371033 "2024-11-27T16:22:26Z")
We are trying to connect tableau with elasticsearch v 6.8.23. But on official website we are only able to see Tableau connecter for Elasticsearch until version 7.9.0. Need to know if elasticsearch provides taco connecte… --- ## [Filebeat modules to use proxy](https://discuss.elastic.co/t/filebeat-modules-to-use-proxy/371148)
**Author:** [@grumo35](https://discuss.elastic.co/u/grumo35)\ **Replies:** 0\ **Last updated:** [November 27, 2024, 3:23pm UTC](https://discuss.elastic.co/t/filebeat-modules-to-use-proxy/371148 "2024-11-27T15:23:53Z")
Hi, I'm still struggling to find a relevant configuration to use proxy inside modules, the var.proxy.url does not seems to be picked up. FIlebeat modules proxy I already created a topic on this specific issue this has … --- ## [Ingest pipeline (attachment) unable to find base64 encoded field](https://discuss.elastic.co/t/ingest-pipeline-attachment-unable-to-find-base64-encoded-field/371140)
**Author:** [@petlit2049](https://discuss.elastic.co/u/petlit2049)\ **Replies:** 0\ **Last updated:** [November 27, 2024, 1:44pm UTC](https://discuss.elastic.co/t/ingest-pipeline-attachment-unable-to-find-base64-encoded-field/371140 "2024-11-27T13:44:24Z")
Hi! I have a very basic ingest pipeline case where I'd like to call an attachment processor. A simple curl -X PUT with provided Json-data works perfectly but when I do the following from my c# code: var response = awai… --- ## [Remove double quotation (") from all fields values](https://discuss.elastic.co/t/remove-double-quotation-from-all-fields-values/371025)
**Author:** [@lduvnjak](https://discuss.elastic.co/u/lduvnjak)\ **Replies:** 3\ **Last updated:** [November 27, 2024, 2:28pm UTC](https://discuss.elastic.co/t/remove-double-quotation-from-all-fields-values/371025 "2024-11-27T14:28:32Z")
I'm having some issues with normalizing my CEF logs coming over Elastic Agent's CEF integration. To be precise, they're logs from Silverfort, and there's no way to configure detailed logging options on it to remove the … --- ## [Kibana Authentication attempt failed: UNEXPECTED\_SESSION\_ERROR](https://discuss.elastic.co/t/kibana-authentication-attempt-failed-unexpected-session-error/369920)
**Author:** [@seb\_l](https://discuss.elastic.co/u/seb_l)\ **Replies:** 3\ **Last updated:** [November 27, 2024, 1:51pm UTC](https://discuss.elastic.co/t/kibana-authentication-attempt-failed-unexpected-session-error/369920 "2024-11-27T13:51:39Z")
Hello! First time posting and i have been using the ELK stack for quite a while now. I've encountered an issue that i haven't found much about in the forums or elsewhere and it's related to the security when it comes t… --- ## [Problem: Kibana Dashboard Created with Terraform is Not Deleted by terraform destroy](https://discuss.elastic.co/t/problem-kibana-dashboard-created-with-terraform-is-not-deleted-by-terraform-destroy/371134)
**Author:** [@tachibana](https://discuss.elastic.co/u/tachibana)\ **Replies:** 0\ **Last updated:** [November 27, 2024, 11:51am UTC](https://discuss.elastic.co/t/problem-kibana-dashboard-created-with-terraform-is-not-deleted-by-terraform-destroy/371134 "2024-11-27T11:51:48Z")
I have created a Kibana dashboard using Terraform, but the dashboard is not deleted when I execute terraform destroy. Could you provide guidance on how to resolve this issue or explain potential causes? I am referring t… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=129) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=131)