# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1341 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1342 --- ## [Removing subfield in the elasticsearch output display](https://discuss.elastic.co/t/removing-subfield-in-the-elasticsearch-output-display/277494)
**Author:** [@gisellecarballo](https://discuss.elastic.co/u/gisellecarballo)\ **Replies:** 3\ **Last updated:** [July 1, 2021, 1:25am UTC](https://discuss.elastic.co/t/removing-subfield-in-the-elasticsearch-output-display/277494 "2021-07-01T01:25:13Z")
Hi, Anyone knows how to remove the subfield alone in the elasticsearch display output. In the output there are fields "host: 192.x.x.x" "host.keyword: 192.x.x.x" I want to remove the host.keyword field. Current filter… --- ## [Loop throught context (ctx) data model result at action template in SLACK text field](https://discuss.elastic.co/t/loop-throught-context-ctx-data-model-result-at-action-template-in-slack-text-field/277406)
**Author:** [@Tania\_Raquel\_Stormov](https://discuss.elastic.co/u/Tania_Raquel_Stormov)\ **Replies:** 0\ **Last updated:** [June 30, 2021, 4:31am UTC](https://discuss.elastic.co/t/loop-throught-context-ctx-data-model-result-at-action-template-in-slack-text-field/277406 "2021-06-30T04:31:27Z")
How can loop over array result when integrate with slack using message template? At kibana monitor to over an array example: {{#ctx.results.0.hits.hits}} // Loop over hits {{\_source.message}} {{\_source.module\_nam… --- ## [Why query works in DevTools but not in a Rule?](https://discuss.elastic.co/t/why-query-works-in-devtools-but-not-in-a-rule/277467)
**Author:** [@Sandra\_Schlichting](https://discuss.elastic.co/u/Sandra_Schlichting)\ **Replies:** 3\ **Last updated:** [July 1, 2021, 12:20am UTC](https://discuss.elastic.co/t/why-query-works-in-devtools-but-not-in-a-rule/277467 "2021-07-01T00:20:16Z")
Dear all =) Here is an odd one! If I in Dev Tools do GET \_search { "query": { "query\_string": { "query": "besked:\*" } } } then I get lots of results. If I do the same in a rule, I don't get any results. Are extra… --- ## [Can the rest client be on a lower version than the elastic searver](https://discuss.elastic.co/t/can-the-rest-client-be-on-a-lower-version-than-the-elastic-searver/277501)
**Author:** [@reddroid](https://discuss.elastic.co/u/reddroid)\ **Replies:** 1\ **Last updated:** [June 30, 2021, 11:55pm UTC](https://discuss.elastic.co/t/can-the-rest-client-be-on-a-lower-version-than-the-elastic-searver/277501 "2021-06-30T23:55:11Z")
Hi , Can I use elastic client 7.10 with elastic server 7.10.2 ? --- ## [Metricbeat error fetching kube-state-metrics](https://discuss.elastic.co/t/metricbeat-error-fetching-kube-state-metrics/277493)
**Author:** [@anupshrestha](https://discuss.elastic.co/u/anupshrestha)\ **Replies:** 0\ **Last updated:** [June 30, 2021, 7:31pm UTC](https://discuss.elastic.co/t/metricbeat-error-fetching-kube-state-metrics/277493 "2021-06-30T19:31:42Z")
I am getting the following error in metricbeat deployment that is configured to fetch and push metrics from kube-state-metrics. 2021-06-30T19:25:11.318Z ERROR \[kubernetes.state\_statefulset\] state\_statefulset/state\_state… --- ## [Update few Attributes in Nested Object of index using logstash](https://discuss.elastic.co/t/update-few-attributes-in-nested-object-of-index-using-logstash/277500)
**Author:** [@kamalgunda](https://discuss.elastic.co/u/kamalgunda)\ **Replies:** 0\ **Last updated:** [June 30, 2021, 8:49pm UTC](https://discuss.elastic.co/t/update-few-attributes-in-nested-object-of-index-using-logstash/277500 "2021-06-30T20:49:35Z")
Hi All, Good Day! I have data in elastic search index and want to update the nested object two attributes values out of 20 attributes. Input table has n number of records and whatever matches with document\_id , it sho… --- ## [Need clearity of FileBeat Monitoring logs](https://discuss.elastic.co/t/need-clearity-of-filebeat-monitoring-logs/277496)
**Author:** [@Parveen\_Sharma](https://discuss.elastic.co/u/Parveen_Sharma)\ **Replies:** 0\ **Last updated:** [June 30, 2021, 8:11pm UTC](https://discuss.elastic.co/t/need-clearity-of-filebeat-monitoring-logs/277496 "2021-06-30T20:11:50Z")
Hi, I am new user of filebeat and need to understand few information from the filebeat logs. Currently, I have deployed filebeat on windows system. In the logs metrics information are logged every 30 sec but i am unabl… --- ## [Exporting to CSV missing values in fields](https://discuss.elastic.co/t/exporting-to-csv-missing-values-in-fields/277389)
**Author:** [@jasieltego](https://discuss.elastic.co/u/jasieltego)\ **Replies:** 4\ **Last updated:** [June 30, 2021, 7:49pm UTC](https://discuss.elastic.co/t/exporting-to-csv-missing-values-in-fields/277389 "2021-06-30T19:49:28Z")
Hi All, Wondering if I can get some help. Currently from Kibana I'm running some Discover Reports, I can see all the fields and information in Kibana, however when I export it to CSV, 4 columns out of 6 have no values a… --- ## [Indexing Xml subfields as a new field](https://discuss.elastic.co/t/indexing-xml-subfields-as-a-new-field/277215)
**Author:** [@anon33720113](https://discuss.elastic.co/u/anon33720113)\ **Replies:** 11\ **Last updated:** [June 30, 2021, 5:01pm UTC](https://discuss.elastic.co/t/indexing-xml-subfields-as-a-new-field/277215 "2021-06-30T17:01:18Z")
Hi all, I have a xml-File with windows eventlogs that is structured like this: \ \ \...\ ... \ \ **Author:** [@Vijaykumar\_Gundavara](https://discuss.elastic.co/u/Vijaykumar_Gundavara)\ **Replies:** 0\ **Last updated:** [June 30, 2021, 4:53pm UTC](https://discuss.elastic.co/t/http-output-plugin-to-update-datastreams-entire-document/277487 "2021-06-30T16:53:24Z") Hi, MY use case is as follows. I have a document which is getting inserted into elasticsearch datastreams. The same document is getting updated multiple times in the application and I would like to use \_update\_query API… --- ## [Error building elasticsearch-hadoop from github](https://discuss.elastic.co/t/error-building-elasticsearch-hadoop-from-github/277486)
**Author:** [@Hardik\_Aggarwal](https://discuss.elastic.co/u/Hardik_Aggarwal)\ **Replies:** 0\ **Last updated:** [June 30, 2021, 4:44pm UTC](https://discuss.elastic.co/t/error-building-elasticsearch-hadoop-from-github/277486 "2021-06-30T16:44:10Z")
Pardon me I am new to ElasticSearch and hadoop. I am trying to build GitHub - elastic/elasticsearch-hadoop: Elasticsearch real-time search and analytics natively integrated with Hadoop this repo locally . I did gradle d… --- ## [Create split series / aggregation based on json message](https://discuss.elastic.co/t/create-split-series-aggregation-based-on-json-message/277401)
**Author:** [@gandhz](https://discuss.elastic.co/u/gandhz)\ **Replies:** 3\ **Last updated:** [June 30, 2021, 4:40pm UTC](https://discuss.elastic.co/t/create-split-series-aggregation-based-on-json-message/277401 "2021-06-30T16:40:18Z")
Hi, I have service logs which contains json message like example below: { "caller\_method\_name": "transferConfirmation", "caller\_line\_number": 328, "message": "Transfer via virtual : {"transferRef":"22151","… --- ## [Can't get fields with an empty date to show up in a data table](https://discuss.elastic.co/t/cant-get-fields-with-an-empty-date-to-show-up-in-a-data-table/276052)
**Author:** [@dandcp](https://discuss.elastic.co/u/dandcp)\ **Replies:** 2\ **Last updated:** [June 30, 2021, 4:27pm UTC](https://discuss.elastic.co/t/cant-get-fields-with-an-empty-date-to-show-up-in-a-data-table/276052 "2021-06-30T16:27:48Z")
I have a data table (and I've done this before) let's say the fields are: Name Quantity End of Support Date End of Contract Date There are 30 records in the dataset right now. Of those 30 maybe 15 have the end of s… --- ## [Logstash Keystore While Running As A Service](https://discuss.elastic.co/t/logstash-keystore-while-running-as-a-service/277262)
**Author:** [@ankitdevnalkar](https://discuss.elastic.co/u/ankitdevnalkar)\ **Replies:** 5\ **Last updated:** [June 30, 2021, 4:15pm UTC](https://discuss.elastic.co/t/logstash-keystore-while-running-as-a-service/277262 "2021-06-30T16:15:16Z")
Hello Team, I have created Logstash Keystore with command sudo -E /usr/share/logstash/bin/logstash-keystore --path.settings /etc/logstash create but while running /usr/share/logstash/bin/logstash-keystore list it is thro… --- ## [Logstash (Unable to retrieve license information from license server {:message=\>"Unsupported or unrecognized SSL message"})](https://discuss.elastic.co/t/logstash-unable-to-retrieve-license-information-from-license-server-message-unsupported-or-unrecognized-ssl-message/277484)
**Author:** [@Ashwin\_Patil1](https://discuss.elastic.co/u/Ashwin_Patil1)\ **Replies:** 0\ **Last updated:** [June 30, 2021, 4:02pm UTC](https://discuss.elastic.co/t/logstash-unable-to-retrieve-license-information-from-license-server-message-unsupported-or-unrecognized-ssl-message/277484 "2021-06-30T16:02:49Z")
I am getting the following error, does anyone know what is happening? localhost:/etc/logstash # tail -f /var/log/logstash/logstash-plain.log \[2021-06-30T16:44:31,287\]\[ERROR\]\[logstash.licensechecker.licensereader\] Unabl… --- ## [Creating Kibana Chart of Latest time stamps with sum](https://discuss.elastic.co/t/creating-kibana-chart-of-latest-time-stamps-with-sum/277476)
**Author:** [@kibanaNewbie23](https://discuss.elastic.co/u/kibanaNewbie23)\ **Replies:** 4\ **Last updated:** [June 30, 2021, 3:45pm UTC](https://discuss.elastic.co/t/creating-kibana-chart-of-latest-time-stamps-with-sum/277476 "2021-06-30T15:45:35Z")
Hello! I have a record like this : { server: 1, size: 10, @timestamp: "2021-6-28 09:00"} { server: 2, size: 30, @timestamp: "2021-6-28 09:00"} { server: 3, size: 40, @timestamp: "2021-6-28 09:00"} { server: 1, size: … --- ## [Kibana not filtering specific visulization](https://discuss.elastic.co/t/kibana-not-filtering-specific-visulization/277360)
**Author:** [@thibdeb](https://discuss.elastic.co/u/thibdeb)\ **Replies:** 6\ **Last updated:** [June 30, 2021, 3:33pm UTC](https://discuss.elastic.co/t/kibana-not-filtering-specific-visulization/277360 "2021-06-30T15:33:20Z")
Hello everyone, I'm working on a project on Kibana to do a dashboard with specifics visualizations from 2 files, a .log file and a .csv file, I have two index patterns too. I use a panel to select what kind of data I w… --- ## [Filebeat is not using custom pipeline mentioned in the output.elasticsearch](https://discuss.elastic.co/t/filebeat-is-not-using-custom-pipeline-mentioned-in-the-output-elasticsearch/277465)
**Author:** [@Mahesh\_Gadagi](https://discuss.elastic.co/u/Mahesh_Gadagi)\ **Replies:** 4\ **Last updated:** [June 30, 2021, 3:24pm UTC](https://discuss.elastic.co/t/filebeat-is-not-using-custom-pipeline-mentioned-in-the-output-elasticsearch/277465 "2021-06-30T15:24:42Z")
Hello all, Currently, I am using filebeat, elastic search 7.9.1 version and I have added the custom Ingest pipeline to push the logs but still, filebeat creates a new Ingest pipeline as filebeat-7.9.1-haproxy-log-pipeli… --- ## [Write thread pool queue size defaults](https://discuss.elastic.co/t/write-thread-pool-queue-size-defaults/277449)
**Author:** [@Alex\_Abdulin](https://discuss.elastic.co/u/Alex_Abdulin)\ **Replies:** 2\ **Last updated:** [June 30, 2021, 3:12pm UTC](https://discuss.elastic.co/t/write-thread-pool-queue-size-defaults/277449 "2021-06-30T15:12:05Z")
Hello, everyone! I'm tuning ES 6.8 for indexing performance and noticed one interesting thing. There is a significant difference in the default value of the q size in versions 6.8 and 7.x. The documentation states: ES … --- ## [Unable to find "kibana.autocompleteTimeout" in kibana.yml](https://discuss.elastic.co/t/unable-to-find-kibana-autocompletetimeout-in-kibana-yml/277472)
**Author:** [@Shreesh\_Narayanan](https://discuss.elastic.co/u/Shreesh_Narayanan)\ **Replies:** 2\ **Last updated:** [June 30, 2021, 2:51pm UTC](https://discuss.elastic.co/t/unable-to-find-kibana-autocompletetimeout-in-kibana-yml/277472 "2021-06-30T14:51:35Z")
I have a control visualization , where i can't seem to find a filename that was processed . i can only see one of the files (two log files were ingested) . These are very large files and contain huge lines of informatio… --- ## [Change colour of Metric Visualization for Percentile ranks aggregation](https://discuss.elastic.co/t/change-colour-of-metric-visualization-for-percentile-ranks-aggregation/277454)
**Author:** [@pavank](https://discuss.elastic.co/u/pavank)\ **Replies:** 3\ **Last updated:** [June 30, 2021, 2:48pm UTC](https://discuss.elastic.co/t/change-colour-of-metric-visualization-for-percentile-ranks-aggregation/277454 "2021-06-30T14:48:57Z")
Hi Kibana: 7.9.3 We are using metric visualization to get percentile ranks. Based on the percentage, I am trying to change colour of the background from Green to Red. But the color remains the same for any Ranges I giv… --- ## [Filebeat multiline.max\_lines limit](https://discuss.elastic.co/t/filebeat-multiline-max-lines-limit/277474)
**Author:** [@adityasingh](https://discuss.elastic.co/u/adityasingh)\ **Replies:** 0\ **Last updated:** [June 30, 2021, 2:43pm UTC](https://discuss.elastic.co/t/filebeat-multiline-max-lines-limit/277474 "2021-06-30T14:43:13Z")
Hi, I had a query regarding filebeat's multiline.max\_lines option. I know the default value for this is 500 and we can configure it to a number of our choice and the lines after the configured number will be ignored whi… --- ## [Unable to create "Maps" visualization - Getting "Selected index pattern does not contain source and destination fields."](https://discuss.elastic.co/t/unable-to-create-maps-visualization-getting-selected-index-pattern-does-not-contain-source-and-destination-fields/276683)
**Author:** [@Shreesh\_Narayanan](https://discuss.elastic.co/u/Shreesh_Narayanan)\ **Replies:** 11\ **Last updated:** [June 30, 2021, 2:29pm UTC](https://discuss.elastic.co/t/unable-to-create-maps-visualization-getting-selected-index-pattern-does-not-contain-source-and-destination-fields/276683 "2021-06-30T14:29:25Z")
I'm unable to create "Maps" visualization. I get the error "Selected index pattern does not contain source and destination fields." I'm on version 7.13.2 ELK I used geoip to define the source and destination IP fields … --- ## [Kibana Showing Limited UI Options](https://discuss.elastic.co/t/kibana-showing-limited-ui-options/277357)
**Author:** [@toneyalexander](https://discuss.elastic.co/u/toneyalexander)\ **Replies:** 2\ **Last updated:** [June 30, 2021, 1:56pm UTC](https://discuss.elastic.co/t/kibana-showing-limited-ui-options/277357 "2021-06-30T13:56:26Z")
I have an Elasticsearch cluster with Kibana installed on one of the nodes. We have a beta and a prod cluster which are generally very similar, however one of them has been having a strange Kibana issue. Normally, and on … --- ## [Ship metrics to Graphite](https://discuss.elastic.co/t/ship-metrics-to-graphite/277263)
**Author:** [@raghav1](https://discuss.elastic.co/u/raghav1)\ **Replies:** 2\ **Last updated:** [June 30, 2021, 1:27pm UTC](https://discuss.elastic.co/t/ship-metrics-to-graphite/277263 "2021-06-30T13:27:49Z")
Is there a way to ship metrics to Graphite ? If yes can you please provide an example. --- ## [Compare a collection/array of 2 numeric field values within same document](https://discuss.elastic.co/t/compare-a-collection-array-of-2-numeric-field-values-within-same-document/277461)
**Author:** [@Munazza](https://discuss.elastic.co/u/Munazza)\ **Replies:** 0\ **Last updated:** [June 30, 2021, 12:52pm UTC](https://discuss.elastic.co/t/compare-a-collection-array-of-2-numeric-field-values-within-same-document/277461 "2021-06-30T12:52:58Z")
I am trying to load sql server data to elasticsearch using logstash and have the watcher rule to alert if one field value is greater than the other field value within the same document. I am looking for a condition in … --- ## [Filebeat isn’t shipping the last line of a file](https://discuss.elastic.co/t/filebeat-isn-t-shipping-the-last-line-of-a-file/277459)
**Author:** [@jack5](https://discuss.elastic.co/u/jack5)\ **Replies:** 0\ **Last updated:** [June 30, 2021, 12:36pm UTC](https://discuss.elastic.co/t/filebeat-isn-t-shipping-the-last-line-of-a-file/277459 "2021-06-30T12:36:17Z")
Hi everyone, I'm new in filebeat, I'm using filebeat+ingest node pipeline to send csv properties into elasticsearch. Unfortunately filebeat doesn't send last line of my csv file. I read https://www.elastic.co/guide/en/… --- ## [\[threatintel Filebeat module\] MISP configuration errors with filebeat threatintel module](https://discuss.elastic.co/t/threatintel-filebeat-module-misp-configuration-errors-with-filebeat-threatintel-module/277448)
**Author:** [@Balor](https://discuss.elastic.co/u/Balor)\ **Replies:** 3\ **Last updated:** [June 30, 2021, 12:35pm UTC](https://discuss.elastic.co/t/threatintel-filebeat-module-misp-configuration-errors-with-filebeat-threatintel-module/277448 "2021-06-30T12:35:42Z")
Hello All, A question about the Filebeat module " threatintel ". On the MISP configuration . Using Filebeat 7.13.2.The below are the settings that I have tested but shows with errors in the filebeat logs. The config is … --- ## [Create a new HOME LOAN index using the file homeloan\_index.json](https://discuss.elastic.co/t/create-a-new-home-loan-index-using-the-file-homeloan-index-json/277248)
**Author:** [@BalakN](https://discuss.elastic.co/u/BalakN)\ **Replies:** 6\ **Last updated:** [June 30, 2021, 12:35pm UTC](https://discuss.elastic.co/t/create-a-new-home-loan-index-using-the-file-homeloan-index-json/277248 "2021-06-30T12:35:35Z")
I'm completely new to ELK and how to complete the following requirement. Create a new index "TEST-LOAN-INDEX" in QA environment using the json file "loan\_index.json" . --- ## [Logstash compare field with quotedstring fails](https://discuss.elastic.co/t/logstash-compare-field-with-quotedstring-fails/277385)
**Author:** [@mtudisco](https://discuss.elastic.co/u/mtudisco)\ **Replies:** 2\ **Last updated:** [June 30, 2021, 12:32pm UTC](https://discuss.elastic.co/t/logstash-compare-field-with-quotedstring-fails/277385 "2021-06-30T12:32:17Z")
Hi, I'm parsing modsecurity messages from apache error log, one of the fields i get is ruleid that is parsed with a grok filter using the pattern QUOTEDSTRING. So in the field for instance i get a string with quotes: ""… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1340) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1342)