# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1344 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1345 --- ## [Prevent duplicates when enrolling, scripted unenroll?](https://discuss.elastic.co/t/prevent-duplicates-when-enrolling-scripted-unenroll/277331)
**Author:** [@tjfred](https://discuss.elastic.co/u/tjfred)\ **Replies:** 0\ **Last updated:** [June 29, 2021, 9:53am UTC](https://discuss.elastic.co/t/prevent-duplicates-when-enrolling-scripted-unenroll/277331 "2021-06-29T09:53:14Z")
Hello, Testing Fleet here on our Cloud deployment. I'm building an installer for Elastic Agent that gives us greater control when deploying to endpoints via our management system. My questions: Agent allows enrollin… --- ## [How to get kibana time range filter value on a Scripted metric aggregation](https://discuss.elastic.co/t/how-to-get-kibana-time-range-filter-value-on-a-scripted-metric-aggregation/277330)
**Author:** [@ayanam](https://discuss.elastic.co/u/ayanam)\ **Replies:** 0\ **Last updated:** [June 29, 2021, 9:52am UTC](https://discuss.elastic.co/t/how-to-get-kibana-time-range-filter-value-on-a-scripted-metric-aggregation/277330 "2021-06-29T09:52:18Z")
Hi, I'm trying to retrieve the min and max of the time range set on kibana in a scripted metric aggregation (in the reduce\_script part), if anyone has an idea on how to achieve this. --- ## [Problem parsing date with date filter](https://discuss.elastic.co/t/problem-parsing-date-with-date-filter/277329)
**Author:** [@Neelu\_Chandrasekhar](https://discuss.elastic.co/u/Neelu_Chandrasekhar)\ **Replies:** 0\ **Last updated:** [June 29, 2021, 9:47am UTC](https://discuss.elastic.co/t/problem-parsing-date-with-date-filter/277329 "2021-06-29T09:47:49Z")
I have a log like this {"log":"{\\"@timestamp\\":\\"2021-06-01T02:08:25.7387857-04:00\\",\\"level\\":\\"Information\\",\\"messageTemplate\\":\\"Got patients request\\",\\"message\\":\\"Got patients request I am trying to parse date w… --- ## [Performance impact of changing number\_of\_replicas on a live index](https://discuss.elastic.co/t/performance-impact-of-changing-number-of-replicas-on-a-live-index/277191)
**Author:** [@ghallas](https://discuss.elastic.co/u/ghallas)\ **Replies:** 1\ **Last updated:** [June 29, 2021, 9:21am UTC](https://discuss.elastic.co/t/performance-impact-of-changing-number-of-replicas-on-a-live-index/277191 "2021-06-29T09:21:12Z")
Hello, I have a cluster with 3 master nodes and 9 data nodes. My main index has 3 shards, and number\_of\_replicas:1 . It also has some 5 million documents, and receives around 30 requests per second. Data node CPU util… --- ## [Comparing the last aggregated sub bucket count in the watcher condition](https://discuss.elastic.co/t/comparing-the-last-aggregated-sub-bucket-count-in-the-watcher-condition/276950)
**Author:** [@venkatkumar229](https://discuss.elastic.co/u/venkatkumar229)\ **Replies:** 1\ **Last updated:** [June 29, 2021, 9:08am UTC](https://discuss.elastic.co/t/comparing-the-last-aggregated-sub-bucket-count-in-the-watcher-condition/276950 "2021-06-29T09:08:24Z")
Hi Team, I am working on a watcher alert which will send an alert when the last aggregated bucket doc\_count crossed certain value. Could you please help me how to achieve it to compare the last sub backets doc\_count val… --- ## [Watcher not firing](https://discuss.elastic.co/t/watcher-not-firing/276945)
**Author:** [@jw3b3r](https://discuss.elastic.co/u/jw3b3r)\ **Replies:** 1\ **Last updated:** [June 29, 2021, 9:06am UTC](https://discuss.elastic.co/t/watcher-not-firing/276945 "2021-06-29T09:06:55Z")
Hi! I want this watcher to send me an email when they find the code 0, but I'm not receiving any emails. I was told that the email is configured on elastic.yml. Maybe Imm doing something wrong. Could you help me, pleas… --- ## [Auto-acknowledging mailing notification based on error string](https://discuss.elastic.co/t/auto-acknowledging-mailing-notification-based-on-error-string/276930)
**Author:** [@asif.safdary](https://discuss.elastic.co/u/asif.safdary)\ **Replies:** 1\ **Last updated:** [June 29, 2021, 9:05am UTC](https://discuss.elastic.co/t/auto-acknowledging-mailing-notification-based-on-error-string/276930 "2021-06-29T09:05:59Z")
Dear community, is there a possibility to auto-acknowledge elastic alerts and not send out duplicate emails if already an email was sent out for a specific log source or error string? There is the possibility to set th… --- ## [Printing the email body in watcher using nested array objects](https://discuss.elastic.co/t/printing-the-email-body-in-watcher-using-nested-array-objects/276919)
**Author:** [@venkatkumar229](https://discuss.elastic.co/u/venkatkumar229)\ **Replies:** 1\ **Last updated:** [June 29, 2021, 9:05am UTC](https://discuss.elastic.co/t/printing-the-email-body-in-watcher-using-nested-array-objects/276919 "2021-06-29T09:05:05Z")
Hi Team, I am working on a watcher alert which will send an alert when the aggregated bucket count crossed certain value. I am getting aggregations output with nested array of objects and I want to print them line by li… --- ## [Watcher: comparing two fields from different indexes](https://discuss.elastic.co/t/watcher-comparing-two-fields-from-different-indexes/276699)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 4\ **Last updated:** [June 29, 2021, 9:00am UTC](https://discuss.elastic.co/t/watcher-comparing-two-fields-from-different-indexes/276699 "2021-06-29T09:00:11Z")
Hi, Im running a chained input watch with two queries: "first" and "second", and comparing the fields partition\_field\_value from "first" against hostname from "second", Im certain that in both indexes exist a partition\_… --- ## [Kibana Query Language (KQL) library to convert KQL to ElasticSearch Query](https://discuss.elastic.co/t/kibana-query-language-kql-library-to-convert-kql-to-elasticsearch-query/276722)
**Author:** [@Saurabh\_Kumar](https://discuss.elastic.co/u/Saurabh_Kumar)\ **Replies:** 3\ **Last updated:** [June 29, 2021, 8:31am UTC](https://discuss.elastic.co/t/kibana-query-language-kql-library-to-convert-kql-to-elasticsearch-query/276722 "2021-06-29T08:31:02Z")
Hello Experts, I am trying to create DataQueryInterface (API Layer) which is independent from backend Datasource. Current I am thinking to have ElasticSearch as my datasource but in future if I want to move out of Elast… --- ## [Filbeat to logstash extremely slow](https://discuss.elastic.co/t/filbeat-to-logstash-extremely-slow/277311)
**Author:** [@Zyrel](https://discuss.elastic.co/u/Zyrel)\ **Replies:** 0\ **Last updated:** [June 29, 2021, 7:52am UTC](https://discuss.elastic.co/t/filbeat-to-logstash-extremely-slow/277311 "2021-06-29T07:52:10Z")
Hi everybody; I have Filebeat 7.12 deployed as a DaemonSet on a EKS Cluster, fetching the logs from containers filtered by namespace; persistence queue on disk is enabled with a max size of 10GB. Filebeat ships logs to… --- ## [Unable to push documents and index patterns in indexes in kibana plugin using core api](https://discuss.elastic.co/t/unable-to-push-documents-and-index-patterns-in-indexes-in-kibana-plugin-using-core-api/276911)
**Author:** [@kibanaPluginDev](https://discuss.elastic.co/u/kibanaPluginDev)\ **Replies:** 1\ **Last updated:** [June 29, 2021, 7:44am UTC](https://discuss.elastic.co/t/unable-to-push-documents-and-index-patterns-in-indexes-in-kibana-plugin-using-core-api/276911 "2021-06-29T07:44:57Z")
I am unable to push the documents in the newly created index and add new fields to it using the kibana core API . Although I was able to do it with the dev tool. i want to implement this feature in my plugin to add docum… --- ## [Unable to get new logstash data after using DELETE /logstash](https://discuss.elastic.co/t/unable-to-get-new-logstash-data-after-using-delete-logstash/277309)
**Author:** [@vikram.sablok](https://discuss.elastic.co/u/vikram.sablok)\ **Replies:** 0\ **Last updated:** [June 29, 2021, 7:41am UTC](https://discuss.elastic.co/t/unable-to-get-new-logstash-data-after-using-delete-logstash/277309 "2021-06-29T07:41:13Z")
Unable to get new logstash data after using DELETE /logstash. The data is fetched from logstash using JDBC to logstash however this is not visible in Kibana --- ## [Different markdown value based on data from sql query](https://discuss.elastic.co/t/different-markdown-value-based-on-data-from-sql-query/277098)
**Author:** [@qlikq](https://discuss.elastic.co/u/qlikq)\ **Replies:** 2\ **Last updated:** [June 29, 2021, 7:40am UTC](https://discuss.elastic.co/t/different-markdown-value-based-on-data-from-sql-query/277098 "2021-06-29T07:40:18Z")
Could someone point me in right direction how to manipulate text in markdown component based on value that i am getting in data ? I have created it as filters | essql query="SELECT 'dobry' AS "mojstatus"" | markdown … --- ## [Elasticsearch mapping](https://discuss.elastic.co/t/elasticsearch-mapping/277303)
**Author:** [@kanchan\_thakur](https://discuss.elastic.co/u/kanchan_thakur)\ **Replies:** 0\ **Last updated:** [June 29, 2021, 7:32am UTC](https://discuss.elastic.co/t/elasticsearch-mapping/277303 "2021-06-29T07:32:03Z")
Hi, I am using User dictionary rules in Kuromoji tokenizer in ES mapping. When I am feeding my data to Elasticsearch cluster it mapped some of the keywords strangely like keyword 禰󠄀豆子. I got that ES normalizes the … --- ## [Logstash stucks if Index is not available](https://discuss.elastic.co/t/logstash-stucks-if-index-is-not-available/277173)
**Author:** [@tusharnemade](https://discuss.elastic.co/u/tusharnemade)\ **Replies:** 1\ **Last updated:** [June 29, 2021, 7:23am UTC](https://discuss.elastic.co/t/logstash-stucks-if-index-is-not-available/277173 "2021-06-29T07:23:08Z")
Hello Team I am using Elasticsearch version 7.8.0 and Logstash 7.8.0. I am trying to extract data from Elasticsearch index to csv file. I am using a script to perform the activity for various different indexes created… --- ## [Use Office 365 module in Logstash?](https://discuss.elastic.co/t/use-office-365-module-in-logstash/276528)
**Author:** [@riahc3](https://discuss.elastic.co/u/riahc3)\ **Replies:** 3\ **Last updated:** [June 29, 2021, 7:21am UTC](https://discuss.elastic.co/t/use-office-365-module-in-logstash/276528 "2021-06-29T07:21:00Z")
Hello Is it possible to use the Office 365 module with Logstash? Thanks --- ## [How to add Dashboard in mail body](https://discuss.elastic.co/t/how-to-add-dashboard-in-mail-body/277230)
**Author:** [@mangeshmj1992](https://discuss.elastic.co/u/mangeshmj1992)\ **Replies:** 4\ **Last updated:** [June 29, 2021, 7:12am UTC](https://discuss.elastic.co/t/how-to-add-dashboard-in-mail-body/277230 "2021-06-29T07:12:49Z")
Hello team, I have created one dashboard by adding 2 visualization. I need to send that dashboard in email alert body after every 12 hours. Can you please help me out how to achieve this. I tried with adding attachment… --- ## [I can't figure out How to create a histogram that's sorted wrt it's corresponding value](https://discuss.elastic.co/t/i-cant-figure-out-how-to-create-a-histogram-thats-sorted-wrt-its-corresponding-value/277168)
**Author:** [@Dhruv\_Makwana](https://discuss.elastic.co/u/Dhruv_Makwana)\ **Replies:** 3\ **Last updated:** [June 29, 2021, 7:09am UTC](https://discuss.elastic.co/t/i-cant-figure-out-how-to-create-a-histogram-thats-sorted-wrt-its-corresponding-value/277168 "2021-06-29T07:09:44Z")
My graph looks something like this. I want the bars to sorted wrt the request time. I've tried "Order by" field. But it's not giving me the result I desire. Maybe I'm missing something. Please help me out. --- ## [AKS Custom log to Kibana](https://discuss.elastic.co/t/aks-custom-log-to-kibana/277298)
**Author:** [@shankar\_ananth](https://discuss.elastic.co/u/shankar_ananth)\ **Replies:** 0\ **Last updated:** [June 29, 2021, 7:03am UTC](https://discuss.elastic.co/t/aks-custom-log-to-kibana/277298 "2021-06-29T07:03:59Z")
Hi all, We are routing the application logs to a file in an aks pod in different path. I am not sure where i should map this path in the filebeat.yaml to push these logs to kibana. Any one please help me to fix this. --- ## [L32sv2 vs DS5v2 on Azure](https://discuss.elastic.co/t/l32sv2-vs-ds5v2-on-azure/277083)
**Author:** [@porscheme](https://discuss.elastic.co/u/porscheme)\ **Replies:** 6\ **Last updated:** [June 29, 2021, 6:31am UTC](https://discuss.elastic.co/t/l32sv2-vs-ds5v2-on-azure/277083 "2021-06-29T06:31:15Z")
For deploying huge Elasticsearch which Azure VM SKU is better? DS5v2 – Intel Xeon processor RAM: 56 GB vCPU(s): 16 Managed Disk: Premium SSD L32s v2: AMD EPYC 7551 processor RAM: 256 GB vCPU(s): 32 Local NVMe pre… --- ## [How to send our custom created logs to elasticsearch for indexing using beats](https://discuss.elastic.co/t/how-to-send-our-custom-created-logs-to-elasticsearch-for-indexing-using-beats/277290)
**Author:** [@mstrbgn](https://discuss.elastic.co/u/mstrbgn)\ **Replies:** 0\ **Last updated:** [June 29, 2021, 6:10am UTC](https://discuss.elastic.co/t/how-to-send-our-custom-created-logs-to-elasticsearch-for-indexing-using-beats/277290 "2021-06-29T06:10:29Z")
I need to visualize my organization service log in kibana. But i am unable to find any ways how can i send my logs to elasticsearch for indexing and later to kibana for visualizing. Any Help will be appreciable --- ## [How can I sort String with has\_parent in ElasticSearch](https://discuss.elastic.co/t/how-can-i-sort-string-with-has-parent-in-elasticsearch/277289)
**Author:** [@ryo](https://discuss.elastic.co/u/ryo)\ **Replies:** 0\ **Last updated:** [June 29, 2021, 6:07am UTC](https://discuss.elastic.co/t/how-can-i-sort-string-with-has-parent-in-elasticsearch/277289 "2021-06-29T06:07:17Z")
I use has\_parent for query data, but I want to sort this data follow some parent field which is a String . I tried to find solutions, I found how to sort in ElasticSearch documents "query": { "has\_parent" : { … --- ## [How can we add URL links in data table to different dashboards](https://discuss.elastic.co/t/how-can-we-add-url-links-in-data-table-to-different-dashboards/276901)
**Author:** [@Prasanth\_V](https://discuss.elastic.co/u/Prasanth_V)\ **Replies:** 4\ **Last updated:** [June 29, 2021, 5:42am UTC](https://discuss.elastic.co/t/how-can-we-add-url-links-in-data-table-to-different-dashboards/276901 "2021-06-29T05:42:24Z")
I need create a table, having some links in each row for different dashboards --- ## [File input doesn t read incoming Json file from web application but when modified everythnig is fine](https://discuss.elastic.co/t/file-input-doesn-t-read-incoming-json-file-from-web-application-but-when-modified-everythnig-is-fine/277284)
**Author:** [@hadii](https://discuss.elastic.co/u/hadii)\ **Replies:** 0\ **Last updated:** [June 29, 2021, 4:56am UTC](https://discuss.elastic.co/t/file-input-doesn-t-read-incoming-json-file-from-web-application-but-when-modified-everythnig-is-fine/277284 "2021-06-29T04:56:27Z")
I have to project in rails which have huge logs, I want to parse them in logstash and kibana, the problem is when logs do from web application logstash could not pars them but after modified them even very unused change … --- ## [InnerHitBuilder field query](https://discuss.elastic.co/t/innerhitbuilder-field-query/277280)
**Author:** [@111487](https://discuss.elastic.co/u/111487)\ **Replies:** 0\ **Last updated:** [June 29, 2021, 3:56am UTC](https://discuss.elastic.co/t/innerhitbuilder-field-query/277280 "2021-06-29T03:56:27Z")
I have some questions.in the InnerHitBuilder field query , Can I support custom queries for Innerhitbuilder field queries? --- ## [Error writing registrar state to statestore: failed in store/get operation on store 'filebeat'](https://discuss.elastic.co/t/error-writing-registrar-state-to-statestore-failed-in-store-get-operation-on-store-filebeat/277265)
**Author:** [@bhavaniprasad\_reddy](https://discuss.elastic.co/u/bhavaniprasad_reddy)\ **Replies:** 0\ **Last updated:** [June 28, 2021, 6:34pm UTC](https://discuss.elastic.co/t/error-writing-registrar-state-to-statestore-failed-in-store-get-operation-on-store-filebeat/277265 "2021-06-28T18:34:16Z")
I am using filebeat 7.12.0 autodiscover to collect events from kubernetes pods. The filebeat log contains an error message as, 2021-06-28T09:56:42.626Z ERROR \[registrar\] registrar/registrar.go:205 Erro… --- ## [Get datetime from logs](https://discuss.elastic.co/t/get-datetime-from-logs/277175)
**Author:** [@Rashmika\_Gamage](https://discuss.elastic.co/u/Rashmika_Gamage)\ **Replies:** 2\ **Last updated:** [June 29, 2021, 3:45am UTC](https://discuss.elastic.co/t/get-datetime-from-logs/277175 "2021-06-29T03:45:10Z")
I am trying to get logs to Kibana using logstash and filebeats. However kibana doesn't take data and time (which in the logs) as datetime. Instead in takes as string and cannot change format as well . Appreciate your he… --- ## [Customizing Kibana advanced settings in a Docker container?](https://discuss.elastic.co/t/customizing-kibana-advanced-settings-in-a-docker-container/276365)
**Author:** [@GrahamHannington](https://discuss.elastic.co/u/GrahamHannington)\ **Replies:** 2\ **Last updated:** [June 28, 2021, 2:23am UTC](https://discuss.elastic.co/t/customizing-kibana-advanced-settings-in-a-docker-container/276365 "2021-06-28T02:23:04Z")
Background to my question I want to deploy a set of Kibana dashboards in a Docker container. This will include changing some Kibana advanced settings, such as courier:ignoreFilterIfFieldNotInIndex, from their default val… --- ## [Planned total network page - how will the cluster react?](https://discuss.elastic.co/t/planned-total-network-page-how-will-the-cluster-react/277235)
**Author:** [@ankh](https://discuss.elastic.co/u/ankh)\ **Replies:** 4\ **Last updated:** [June 29, 2021, 3:10am UTC](https://discuss.elastic.co/t/planned-total-network-page-how-will-the-cluster-react/277235 "2021-06-29T03:10:07Z")
We have a planned network outage for 8 hours that will stop communication between all hosts, including between nodes in our elastic cluster. We have 3 master nodes and 2 minimum master nodes set. Using logstash to write… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1343) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1345)