# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1315 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1316 --- ## [What happens with my message field if I use decode\_json\_fields processor?](https://discuss.elastic.co/t/what-happens-with-my-message-field-if-i-use-decode-json-fields-processor/279139)
**Author:** [@testisnullus](https://discuss.elastic.co/u/testisnullus)\ **Replies:** 1\ **Last updated:** [July 20, 2021, 11:02am UTC](https://discuss.elastic.co/t/what-happens-with-my-message-field-if-i-use-decode-json-fields-processor/279139 "2021-07-20T11:02:51Z")
Greatings all! I have the next message field: message: {"app":"rbac","args":\[\],"commandTag":null,"fields.time":353859,"file":"adapter.go","func":"Log","level":"info","msg":"Exec","pid":28700,"sql":";","time":"2021-07-2… --- ## [ES 2.4 GC time % unmanageable. Any tip?](https://discuss.elastic.co/t/es-2-4-gc-time-unmanageable-any-tip/279124)
**Author:** [@rschirin](https://discuss.elastic.co/u/rschirin)\ **Replies:** 4\ **Last updated:** [July 20, 2021, 9:37am UTC](https://discuss.elastic.co/t/es-2-4-gc-time-unmanageable-any-tip/279124 "2021-07-20T09:37:04Z")
Hey there, I am trying to find the sweet spot for my application. I got these results: DATA nodes 8cpu-32gb ram with 16gb heap size and 8gb young heap size GC time % is generally around 5% (this is in case the limit) … --- ## [Import data into ES](https://discuss.elastic.co/t/import-data-into-es/279044)
**Author:** [@kfaf](https://discuss.elastic.co/u/kfaf)\ **Replies:** 3\ **Last updated:** [July 20, 2021, 9:29am UTC](https://discuss.elastic.co/t/import-data-into-es/279044 "2021-07-20T09:29:47Z")
Please i really need help. i want to import json file to my ES using logstash. but nothing goes well on my side. this is my logstash.conf: \< input { file { start\_position =\> "beginning" path =\> "C:\\Users\\Downloa… --- ## [Getting "too many scroll contexts" when re-indexing](https://discuss.elastic.co/t/getting-too-many-scroll-contexts-when-re-indexing/279065)
**Author:** [@malsioufi](https://discuss.elastic.co/u/malsioufi)\ **Replies:** 3\ **Last updated:** [July 20, 2021, 8:47am UTC](https://discuss.elastic.co/t/getting-too-many-scroll-contexts-when-re-indexing/279065 "2021-07-20T08:47:46Z")
Hi, I have a task where I need to sort by the field "\_id" I knew that I should not use this field for sorting and that instead it is better to add an extra field the has the same value as \_id and then I can use that fie… --- ## [How to split the field in Kibana?](https://discuss.elastic.co/t/how-to-split-the-field-in-kibana/279048)
**Author:** [@testisnullus](https://discuss.elastic.co/u/testisnullus)\ **Replies:** 2\ **Last updated:** [July 20, 2021, 8:22am UTC](https://discuss.elastic.co/t/how-to-split-the-field-in-kibana/279048 "2021-07-20T08:22:57Z")
Hi all! I have the message field in Kibana like this: I want to convert this field in something like: message.app: rbac message.args: \[\] message.commandTag: null message.fields.time: 330709 etc Kibana version: 7.7… --- ## [Error in adding yaml file for destinantion path in translate filter](https://discuss.elastic.co/t/error-in-adding-yaml-file-for-destinantion-path-in-translate-filter/278890)
**Author:** [@Sarthak\_Mishra](https://discuss.elastic.co/u/Sarthak_Mishra)\ **Replies:** 2\ **Last updated:** [July 20, 2021, 8:14am UTC](https://discuss.elastic.co/t/error-in-adding-yaml-file-for-destinantion-path-in-translate-filter/278890 "2021-07-20T08:14:49Z")
Hello community, I am trying to use translate filter where I add a yaml file with list of ips. When the ips in the csv don't match with IP in yaml file a new field is created "Added\_asset" with value as new. Please help… --- ## [What happens with my message field if I use decode\_json\_fields processor?](https://discuss.elastic.co/t/what-happens-with-my-message-field-if-i-use-decode-json-fields-processor/279061)
**Author:** [@testisnullus](https://discuss.elastic.co/u/testisnullus)\ **Replies:** 0\ **Last updated:** [July 19, 2021, 12:48pm UTC](https://discuss.elastic.co/t/what-happens-with-my-message-field-if-i-use-decode-json-fields-processor/279061 "2021-07-19T12:48:01Z")
Greatings all! I have the next message field: message: {"app":"rbac","args":\[\],"commandTag":null,"fields.time":353859,"file":"adapter.go","func":"Log","level":"info","msg":"Exec","pid":28700,"sql":";","time":"2021-07-2… --- ## [Old Elastic Cloud agent policies](https://discuss.elastic.co/t/old-elastic-cloud-agent-policies/279126)
**Author:** [@hermlam](https://discuss.elastic.co/u/hermlam)\ **Replies:** 0\ **Last updated:** [July 20, 2021, 7:47am UTC](https://discuss.elastic.co/t/old-elastic-cloud-agent-policies/279126 "2021-07-20T07:47:28Z")
Hi, With every new version of Elastic a new "Elastic Cloud agent policy" is created in Fleet. Can I safely delete the old ones? And how? See screenshot. Thanks, Herman --- ## [Elastic-Agent Zombie process](https://discuss.elastic.co/t/elastic-agent-zombie-process/279123)
**Author:** [@hermlam](https://discuss.elastic.co/u/hermlam)\ **Replies:** 0\ **Last updated:** [July 20, 2021, 7:38am UTC](https://discuss.elastic.co/t/elastic-agent-zombie-process/279123 "2021-07-20T07:38:53Z")
Hi, On all my (freshly installed) Ubuntu servers I installed elastic-agent via the tarball method. On every server there is a 'zombie' elastic-agent process present next to the working elastic-agent. What's going on he… --- ## [Can an Elasticsearch Search plugin filter results post-search?](https://discuss.elastic.co/t/can-an-elasticsearch-search-plugin-filter-results-post-search/278503)
**Author:** [@Dor\_Levi](https://discuss.elastic.co/u/Dor_Levi)\ **Replies:** 4\ **Last updated:** [July 20, 2021, 6:42am UTC](https://discuss.elastic.co/t/can-an-elasticsearch-search-plugin-filter-results-post-search/278503 "2021-07-20T06:42:42Z")
Hi, I'm trying to figure out a way to have the default search done by ES to filter out some of the hits after getting back from the core engine, before passing them as a result to the rest caller. The actual filtering … --- ## [DateFormat throws null Pointer in 4.2.x](https://discuss.elastic.co/t/dateformat-throws-null-pointer-in-4-2-x/277483)
**Author:** [@Kst](https://discuss.elastic.co/u/Kst)\ **Replies:** 2\ **Last updated:** [July 20, 2021, 6:31am UTC](https://discuss.elastic.co/t/dateformat-throws-null-pointer-in-4-2-x/277483 "2021-07-20T06:31:08Z")
Hi, I am trying to upgrade spring data Elasticsearch from 4.1.10 to 4.2.2 I have a date field definition like below @Field(type = FieldType.Date, format = DateFormat.date\_optional\_time, index = false) private LocalD… --- ## [Daemonset - collecting the pod's namespace along with log](https://discuss.elastic.co/t/daemonset-collecting-the-pods-namespace-along-with-log/278979)
**Author:** [@Jongz\_Puangput](https://discuss.elastic.co/u/Jongz_Puangput)\ **Replies:** 1\ **Last updated:** [July 20, 2021, 3:00am UTC](https://discuss.elastic.co/t/daemonset-collecting-the-pods-namespace-along-with-log/278979 "2021-07-20T03:00:13Z")
Hi Guys, I set up Filebeat with the DaemonSet approach. All containers log is shipped to LogStash successfully. However, I'm facing the issue that I cannot differentiate container logs for DEV and QA namespace under the… --- ## [Sending a Kibana Alert through a proxy help](https://discuss.elastic.co/t/sending-a-kibana-alert-through-a-proxy-help/279115)
**Author:** [@nigel.wadsworth](https://discuss.elastic.co/u/nigel.wadsworth)\ **Replies:** 0\ **Last updated:** [July 20, 2021, 12:39am UTC](https://discuss.elastic.co/t/sending-a-kibana-alert-through-a-proxy-help/279115 "2021-07-20T00:39:22Z")
Hi there We have an OT environment that has a requirement to create incidents in a cloud-based ServiceNow instance. To do this, we have to go through a proxy which requires kibana.yml to be modified to allow this. We … --- ## [Kibana 7.11.0 with authentication is failing to connect to ES cluster](https://discuss.elastic.co/t/kibana-7-11-0-with-authentication-is-failing-to-connect-to-es-cluster/278419)
**Author:** [@imranrehman5155](https://discuss.elastic.co/u/imranrehman5155)\ **Replies:** 8\ **Last updated:** [July 19, 2021, 11:25pm UTC](https://discuss.elastic.co/t/kibana-7-11-0-with-authentication-is-failing-to-connect-to-es-cluster/278419 "2021-07-19T23:25:17Z")
I have a Elastic Search set up with 2 nodes and running 7.11.0 version with TLS configured I have kibana-7.11.0 installed in a docker image. when I am trying to bring up the kibana, its is failing to connect to the ES … --- ## [2 configurations for logstash](https://discuss.elastic.co/t/2-configurations-for-logstash/279107)
**Author:** [@creativeguitar](https://discuss.elastic.co/u/creativeguitar)\ **Replies:** 1\ **Last updated:** [July 19, 2021, 8:39pm UTC](https://discuss.elastic.co/t/2-configurations-for-logstash/279107 "2021-07-19T20:39:22Z")
I have 2 configs under /etc/logstash/conf.d/ If I load the configs individually /usr/share/logstash/bin/logstash -f /etc/logstash/conf.d/config1.conf and then /usr/share/logstash/bin/logstash -f /etc/logstash/conf.d/… --- ## [Elasticsearch mapping](https://discuss.elastic.co/t/elasticsearch-mapping/278860)
**Author:** [@varsha\_patil](https://discuss.elastic.co/u/varsha_patil)\ **Replies:** 1\ **Last updated:** [July 19, 2021, 8:18pm UTC](https://discuss.elastic.co/t/elasticsearch-mapping/278860 "2021-07-19T20:18:48Z")
RequestError(400, 'mapper\_parsing\_exception', 'Root mapping definition has unsupported parameters: Facing such issue while adding mapping and creating index. Using elasticsearch version 7.13.2 --- ## [The index-pattern does not work on the 7.13.3 but 7.10 works well](https://discuss.elastic.co/t/the-index-pattern-does-not-work-on-the-7-13-3-but-7-10-works-well/278810)
**Author:** [@harry\_010](https://discuss.elastic.co/u/harry_010)\ **Replies:** 2\ **Last updated:** [July 19, 2021, 8:17pm UTC](https://discuss.elastic.co/t/the-index-pattern-does-not-work-on-the-7-13-3-but-7-10-works-well/278810 "2021-07-19T20:17:32Z")
I used the following json to create the index-pattern, the index-pattern is empty but the name. no fields in it. { "attributes": { "fields": "\[{"name":"@timestamp","type":"date","esTypes":\["date"\],"count":0,"scripted"… --- ## [Creating pattern issue from 7.11.0](https://discuss.elastic.co/t/creating-pattern-issue-from-7-11-0/278822)
**Author:** [@harry\_010](https://discuss.elastic.co/u/harry_010)\ **Replies:** 1\ **Last updated:** [July 19, 2021, 8:14pm UTC](https://discuss.elastic.co/t/creating-pattern-issue-from-7-11-0/278822 "2021-07-19T20:14:40Z")
if still supporting the field entry when creating the index pattern. "attributes": { "fields": "\[{"name":"@timestamp","type":"date","esTypes":\["date"\],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"r… --- ## [Connecting excel sheet to kibana](https://discuss.elastic.co/t/connecting-excel-sheet-to-kibana/278784)
**Author:** [@cass](https://discuss.elastic.co/u/cass)\ **Replies:** 1\ **Last updated:** [July 19, 2021, 8:13pm UTC](https://discuss.elastic.co/t/connecting-excel-sheet-to-kibana/278784 "2021-07-19T20:13:19Z")
Hi everyone, I was wondering: is there a way to connect automatically a local excel sheet directly to Kibana? To illustrate, each time that I will modify a sheet, there is an update on all the visualisations that use th… --- ## [How to build Kibana-OSS from source code 7.10.2?](https://discuss.elastic.co/t/how-to-build-kibana-oss-from-source-code-7-10-2/279019)
**Author:** [@kkhadka](https://discuss.elastic.co/u/kkhadka)\ **Replies:** 1\ **Last updated:** [July 19, 2021, 8:10pm UTC](https://discuss.elastic.co/t/how-to-build-kibana-oss-from-source-code-7-10-2/279019 "2021-07-19T20:10:18Z")
Hi, i am trying to build kibana from the source code for version 7.10.2 i am able to build kibana by following this is there any way to build kibana-OSS from the source code? Cheers, Krishna --- ## [Funnel in Kibana](https://discuss.elastic.co/t/funnel-in-kibana/279073)
**Author:** [@Rafael\_Almeida1](https://discuss.elastic.co/u/Rafael_Almeida1)\ **Replies:** 1\ **Last updated:** [July 19, 2021, 8:07pm UTC](https://discuss.elastic.co/t/funnel-in-kibana/279073 "2021-07-19T20:07:16Z")
Hi, I want know if Kibana will add a Visualization of Funnel in your option of graphs. I know about Vega option but need learn about so will very welcome a option of funnel inside kibana --- ## [Logstash to parse nested json arrays that contain different log formats](https://discuss.elastic.co/t/logstash-to-parse-nested-json-arrays-that-contain-different-log-formats/279106)
**Author:** [@JakeKos21](https://discuss.elastic.co/u/JakeKos21)\ **Replies:** 0\ **Last updated:** [July 19, 2021, 7:33pm UTC](https://discuss.elastic.co/t/logstash-to-parse-nested-json-arrays-that-contain-different-log-formats/279106 "2021-07-19T19:33:46Z")
I am seeking assistance with developing/determining the best course of action for ingesting json data from an AWS environment. Ordinarily this would not be difficult for me via Logstash, however the logs contain a neste… --- ## [Need assistance on CEF \_grokparsefailure](https://discuss.elastic.co/t/need-assistance-on-cef-grokparsefailure/278270)
**Author:** [@Xor44](https://discuss.elastic.co/u/Xor44)\ **Replies:** 7\ **Last updated:** [July 19, 2021, 6:34pm UTC](https://discuss.elastic.co/t/need-assistance-on-cef-grokparsefailure/278270 "2021-07-19T18:34:51Z")
Hi Folk , I'm new on ELK since many days I have configure a pipeline for parsing CEF logs from netscout device . When I'm checking logs I see some \_grokparsefailure tage on Kibana . I conclude that there is some issue… --- ## [Pie Chart Query Question](https://discuss.elastic.co/t/pie-chart-query-question/279101)
**Author:** [@JDMurph](https://discuss.elastic.co/u/JDMurph)\ **Replies:** 2\ **Last updated:** [July 19, 2021, 6:27pm UTC](https://discuss.elastic.co/t/pie-chart-query-question/279101 "2021-07-19T18:27:58Z")
Is it possible to do a pie chart that gives the following with the below instance? Sum up the errors per factory and if the error count is equal to 3 or greater it would be classified as "Failing". If it's greater than … --- ## [Kibana Metrics (take percentage of the sum of a field)](https://discuss.elastic.co/t/kibana-metrics-take-percentage-of-the-sum-of-a-field/278925)
**Author:** [@creativeguitar](https://discuss.elastic.co/u/creativeguitar)\ **Replies:** 2\ **Last updated:** [July 19, 2021, 6:02pm UTC](https://discuss.elastic.co/t/kibana-metrics-take-percentage-of-the-sum-of-a-field/278925 "2021-07-19T18:02:13Z")
I am new to ELK and I could use some help. I have a field named VM that has true and false values. If the system is a physical server then the value is false, otherwise if it is a VM it is true. I need to take a percen… --- ## [Transfer and indexing data on JSON](https://discuss.elastic.co/t/transfer-and-indexing-data-on-json/277832)
**Author:** [@Wonder\_Garance](https://discuss.elastic.co/u/Wonder_Garance)\ **Replies:** 4\ **Last updated:** [July 19, 2021, 5:53pm UTC](https://discuss.elastic.co/t/transfer-and-indexing-data-on-json/277832 "2021-07-19T17:53:02Z")
Hello, we have a data server which contains XML and / or JSON data, we want to transform these data on JSON, transfer and indexing them on Elasticsearch. After a quick search, it's possible to use Filebeat. I think File… --- ## [Watcher Webhook s\_s\_l\_handshake\_exception](https://discuss.elastic.co/t/watcher-webhook-s-s-l-handshake-exception/278551)
**Author:** [@yoli1888](https://discuss.elastic.co/u/yoli1888)\ **Replies:** 4\ **Last updated:** [July 19, 2021, 5:52pm UTC](https://discuss.elastic.co/t/watcher-webhook-s-s-l-handshake-exception/278551 "2021-07-19T17:52:20Z")
I am using 7.9.1. Kibana is running in a docker container. Trying to setup a Webhook action in Watcher with the following code: "webhook\_2" : { "webhook" : { "scheme" : "https", "host" : "e… --- ## [Short URL for public users](https://discuss.elastic.co/t/short-url-for-public-users/277266)
**Author:** [@martinsz](https://discuss.elastic.co/u/martinsz)\ **Replies:** 2\ **Last updated:** [July 19, 2021, 5:00pm UTC](https://discuss.elastic.co/t/short-url-for-public-users/277266 "2021-07-19T17:00:41Z")
Hello, we're having an issue trying to generate short permalinks for our public users. Our set-up is login via header in an nginx proxy for the public user and the public space, which are very restricted. But the links … --- ## [Auto Delete index log ElasticSearch by period](https://discuss.elastic.co/t/auto-delete-index-log-elasticsearch-by-period/279086)
**Author:** [@java\_dev](https://discuss.elastic.co/u/java_dev)\ **Replies:** 1\ **Last updated:** [July 19, 2021, 4:49pm UTC](https://discuss.elastic.co/t/auto-delete-index-log-elasticsearch-by-period/279086 "2021-07-19T16:49:47Z")
How can i configure ElasticSearch to delete logs passed 1 month, or if there is no sush conf, how can i call api delete from java client i want to send post with authentification and with query for delete : json = { "… --- ## [Finding the parent id/ session id of an activity (logs)](https://discuss.elastic.co/t/finding-the-parent-id-session-id-of-an-activity-logs/279091)
**Author:** [@NoviceESCoder](https://discuss.elastic.co/u/NoviceESCoder)\ **Replies:** 0\ **Last updated:** [July 19, 2021, 4:17pm UTC](https://discuss.elastic.co/t/finding-the-parent-id-session-id-of-an-activity-logs/279091 "2021-07-19T16:17:15Z")
Is there a way to find parent id/session id that measures from the start to the end of an activity in Elasticsearch. I was reading up on spans and how they can help with this. However, besides using APM, does elasticsear… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1314) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1316)