# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1459 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1460 --- ## [Query on dense vectors](https://discuss.elastic.co/t/query-on-dense-vectors/270105)
**Author:** [@Yves\_Benigot](https://discuss.elastic.co/u/Yves_Benigot)\ **Replies:** 2\ **Last updated:** [April 16, 2021, 5:56pm UTC](https://discuss.elastic.co/t/query-on-dense-vectors/270105 "2021-04-16T17:56:54Z")
Is there a way to create a query in Kibana discover on dense vectors ? I found nothing in the documentation. I would be willing to compute the query dense vector outside Kibana and paste it to get my results. Currentl… --- ## [Map IP Address to geolocation and use of the anomaly detector](https://discuss.elastic.co/t/map-ip-address-to-geolocation-and-use-of-the-anomaly-detector/270027)
**Author:** [@Vannessa\_Kemeni](https://discuss.elastic.co/u/Vannessa_Kemeni)\ **Replies:** 4\ **Last updated:** [April 16, 2021, 5:55pm UTC](https://discuss.elastic.co/t/map-ip-address-to-geolocation-and-use-of-the-anomaly-detector/270027 "2021-04-16T17:55:24Z")
Hello everyone, i am using the wazuh software combined with ELK. I get some ip adress from Wazuh and i want to find the corresponding geolocation. How i can do that. Furthermore, i want to use the anomaly detector in or… --- ## [Too many dynamic script compilations within max](https://discuss.elastic.co/t/too-many-dynamic-script-compilations-within-max/270355)
**Author:** [@IYABAO](https://discuss.elastic.co/u/IYABAO)\ **Replies:** 1\ **Last updated:** [April 16, 2021, 4:42pm UTC](https://discuss.elastic.co/t/too-many-dynamic-script-compilations-within-max/270355 "2021-04-16T16:42:10Z")
\[script\] Too many dynamic script compilations within, max: \[75/5m\]; please use indexed, or scripts with parameters instead; this limit can be changed by the \[script.max\_compilations\_rate\] setting How can I get the dynam… --- ## [How to exclude XML & json key-value if key length is greater than 15 char and value length is greater than 100 char](https://discuss.elastic.co/t/how-to-exclude-xml-json-key-value-if-key-length-is-greater-than-15-char-and-value-length-is-greater-than-100-char/270248)
**Author:** [@mangeshmj1992](https://discuss.elastic.co/u/mangeshmj1992)\ **Replies:** 14\ **Last updated:** [April 16, 2021, 4:19pm UTC](https://discuss.elastic.co/t/how-to-exclude-xml-json-key-value-if-key-length-is-greater-than-15-char-and-value-length-is-greater-than-100-char/270248 "2021-04-16T16:19:18Z")
@Badger I want to exclude XML & json key-value if key length is greater than 15 char and value length is greater than 100 char. Is this possible can you please suggest way for it. --- ## [ConnectionClosedException](https://discuss.elastic.co/t/connectionclosedexception/270348)
**Author:** [@Priyank07](https://discuss.elastic.co/u/Priyank07)\ **Replies:** 2\ **Last updated:** [April 16, 2021, 4:18pm UTC](https://discuss.elastic.co/t/connectionclosedexception/270348 "2021-04-16T16:18:53Z")
When I am trying to connect to elastic from java using HighLevelRestClient it is giving connectionClosed Exception but when I am trying to connect using restTemplate it is getting connected without error. Is it necessar… --- ## [Cluster state is yellow when configuring minimal security](https://discuss.elastic.co/t/cluster-state-is-yellow-when-configuring-minimal-security/270286)
**Author:** [@marone](https://discuss.elastic.co/u/marone)\ **Replies:** 6\ **Last updated:** [April 16, 2021, 2:54pm UTC](https://discuss.elastic.co/t/cluster-state-is-yellow-when-configuring-minimal-security/270286 "2021-04-16T14:54:14Z")
Greetings folks, I have a cluster with two nodes (node1 and node2) running ELK 7.12, I activated security feature from this link Set up minimal security for Elasticsearch | Elasticsearch Guide \[7.12\] | Elastic, I follow… --- ## [How to convert extract month from date](https://discuss.elastic.co/t/how-to-convert-extract-month-from-date/270035)
**Author:** [@Pallavibhushan](https://discuss.elastic.co/u/Pallavibhushan)\ **Replies:** 5\ **Last updated:** [April 16, 2021, 2:35pm UTC](https://discuss.elastic.co/t/how-to-convert-extract-month-from-date/270035 "2021-04-16T14:35:16Z")
Hi, I have below date format . First\_date : Feb-21 (MMM-yy) Second\_date: 12/02/2021 (MM/dd/yyyy) first, I want new field like below: from first date I need month . so output should be first\_date\_month : 02 second … --- ## [Check input contains.message failed](https://discuss.elastic.co/t/check-input-contains-message-failed/270372)
**Author:** [@joepkemel](https://discuss.elastic.co/u/joepkemel)\ **Replies:** 1\ **Last updated:** [April 16, 2021, 2:33pm UTC](https://discuss.elastic.co/t/check-input-contains-message-failed/270372 "2021-04-16T14:33:09Z")
Hi, I am trying to make an if contains /else dissect statement. But I can't really figure it out. This is because a log file contains an extra '|' inside a wanted field. For example 'type|timestamp|IP\[xx.xx| port\]|-' and… --- ## [Date parse failure](https://discuss.elastic.co/t/date-parse-failure/270276)
**Author:** [@Wilfried](https://discuss.elastic.co/u/Wilfried)\ **Replies:** 2\ **Last updated:** [April 16, 2021, 1:42pm UTC](https://discuss.elastic.co/t/date-parse-failure/270276 "2021-04-16T13:42:12Z")
Hello, I struggle to understand why my date matching is failing. We trying to build a reporting application using elasticsearch for our Storage. I've that kind of data in an XML: \ \ \0\ **Author:** [@zozo6015](https://discuss.elastic.co/u/zozo6015)\ **Replies:** 4\ **Last updated:** [April 16, 2021, 1:39pm UTC](https://discuss.elastic.co/t/how-to-configure-multiple-ingest-pipelines-on-filebeat-to-load-data-in-elastic-cloud/270290 "2021-04-16T13:39:30Z") Hi, I am running filebeat to ingest logging data from kubernetes. I am having various applications for which I have set different pipelines. How can I configure filebeat to be able to use multiple pipelines. Thanks in … --- ## [Period system.cpu.total.pct versus system.cpu.total.norm.pct](https://discuss.elastic.co/t/period-system-cpu-total-pct-versus-system-cpu-total-norm-pct/270229)
**Author:** [@\_Manuel](https://discuss.elastic.co/u/_Manuel)\ **Replies:** 4\ **Last updated:** [April 16, 2021, 11:04am UTC](https://discuss.elastic.co/t/period-system-cpu-total-pct-versus-system-cpu-total-norm-pct/270229 "2021-04-16T11:04:10Z")
Hello I have a metricbeat.yml file for system.cpu like metricbeat.modules: - module: system period: 150s metricsets: - cpu - load - memory - network - process - process\_summary cpu.metrics… --- ## [Logstash data load error for a different format data](https://discuss.elastic.co/t/logstash-data-load-error-for-a-different-format-data/270375)
**Author:** [@Gauti](https://discuss.elastic.co/u/Gauti)\ **Replies:** 0\ **Last updated:** [April 16, 2021, 10:58am UTC](https://discuss.elastic.co/t/logstash-data-load-error-for-a-different-format-data/270375 "2021-04-16T10:58:58Z")
Hi All, We are trying to ingest few data into logstash, the data is pretty different like mentioned below, How do i map the collection\_time with 1618556220 and d\_check to 1 I gave a split filter it didnt work. FYI. … --- ## [Remote cluster not displayed but acknowledged](https://discuss.elastic.co/t/remote-cluster-not-displayed-but-acknowledged/269992)
**Author:** [@pavel.entner](https://discuss.elastic.co/u/pavel.entner)\ **Replies:** 1\ **Last updated:** [April 16, 2021, 8:35am UTC](https://discuss.elastic.co/t/remote-cluster-not-displayed-but-acknowledged/269992 "2021-04-16T08:35:38Z")
Hello, I'm quite new to Elasticsearch. I have installed two Elasticsearch clusters consisting of 3x master node and 3x data node each. On one master node on each cluster I'm running Kibana. I'm using https and transport… --- ## [Oracle Metrics through metricbeat](https://discuss.elastic.co/t/oracle-metrics-through-metricbeat/270182)
**Author:** [@Dhruvil\_Doshi](https://discuss.elastic.co/u/Dhruvil_Doshi)\ **Replies:** 3\ **Last updated:** [April 16, 2021, 7:42am UTC](https://discuss.elastic.co/t/oracle-metrics-through-metricbeat/270182 "2021-04-16T07:42:40Z")
I am using ELK 7.10 Basic version. I want to get oracle metrics from metricbeat. I enabled oracle module from below command : metricbeat modules enable oracle I installed oracle client and set it's path as system varia… --- ## [Provided Grok patterns do not match data in the input](https://discuss.elastic.co/t/provided-grok-patterns-do-not-match-data-in-the-input/270265)
**Author:** [@Cris\_R](https://discuss.elastic.co/u/Cris_R)\ **Replies:** 4\ **Last updated:** [April 16, 2021, 6:57am UTC](https://discuss.elastic.co/t/provided-grok-patterns-do-not-match-data-in-the-input/270265 "2021-04-16T06:57:17Z")
Hi, Trying to create my own grok patterns, I'm using the following with the Grok Debugger : Sample data : \[ 4812 6032\]\[15 Feb 18:23:15\]\[LdManInit\] Loading Library in Load mode Grok Pattern : %{IDLOG:whom} %{TIMEST:… --- ## [Getting "You do not have permission to access the requested page" after configuring SSO](https://discuss.elastic.co/t/getting-you-do-not-have-permission-to-access-the-requested-page-after-configuring-sso/270301)
**Author:** [@challa](https://discuss.elastic.co/u/challa)\ **Replies:** 2\ **Last updated:** [April 16, 2021, 6:18am UTC](https://discuss.elastic.co/t/getting-you-do-not-have-permission-to-access-the-requested-page-after-configuring-sso/270301 "2021-04-16T06:18:38Z")
Hi, I have configured SSO using the guide here: Configuring SAML single-sign-on on the Elastic Stack | Elasticsearch Guide \[7.12\] | Elastic I also did role mapped my AD group to the role "superuser", when I try to login… --- ## [Vlookup type of thing](https://discuss.elastic.co/t/vlookup-type-of-thing/270298)
**Author:** [@Elitlogik](https://discuss.elastic.co/u/Elitlogik)\ **Replies:** 3\ **Last updated:** [April 16, 2021, 6:01am UTC](https://discuss.elastic.co/t/vlookup-type-of-thing/270298 "2021-04-16T06:01:39Z")
I generate a table of MAC addresses in Kibana. However I’d like to translate the MAC address into a readable name. The MAC, Readable name table is and will forever be static and have and will forever have 50 rows. What’… --- ## [I have a query regarding dense\_vector in elastic search](https://discuss.elastic.co/t/i-have-a-query-regarding-dense-vector-in-elastic-search/270327)
**Author:** [@Rahul\_Singh](https://discuss.elastic.co/u/Rahul_Singh)\ **Replies:** 0\ **Last updated:** [April 16, 2021, 5:55am UTC](https://discuss.elastic.co/t/i-have-a-query-regarding-dense-vector-in-elastic-search/270327 "2021-04-16T05:55:14Z")
Hi, I am using elastic search using python, i am creating dense\_vector in mapping and then trying to add the feild via python a list of float value e.g - \[1.02,2,1.01..\] and am unable to ad it. the error says cant chan… --- ## [Filebeat failed to collect docker metadata](https://discuss.elastic.co/t/filebeat-failed-to-collect-docker-metadata/270321)
**Author:** [@ktpktr0](https://discuss.elastic.co/u/ktpktr0)\ **Replies:** 0\ **Last updated:** [April 16, 2021, 3:20am UTC](https://discuss.elastic.co/t/filebeat-failed-to-collect-docker-metadata/270321 "2021-04-16T03:20:05Z")
I use filebeat to collect docker container logs. The log is collected by ID, but the corresponding container name cannot be collected. So I tried to add metadata for the docker container, but I couldn't succeed（Auto disc… --- ## [Upgrarding from logstash 5.6.16 to 6.8 results in errors for logstash tcp input plugin](https://discuss.elastic.co/t/upgrarding-from-logstash-5-6-16-to-6-8-results-in-errors-for-logstash-tcp-input-plugin/270316)
**Author:** [@mchoudhary](https://discuss.elastic.co/u/mchoudhary)\ **Replies:** 0\ **Last updated:** [April 16, 2021, 1:19am UTC](https://discuss.elastic.co/t/upgrarding-from-logstash-5-6-16-to-6-8-results-in-errors-for-logstash-tcp-input-plugin/270316 "2021-04-16T01:19:43Z")
After upgrading the logstash version from 5.6.16 to 6.8, the logstash tcp plugin from 4.2.2 to 5.2.2 After upgrade, we do see the following errors in the logstash logs: \[2021-04-16T01:14:50,392\]\[ERROR\]\[logstash.inputs.… --- ## [Kibana unable to query index data from ES](https://discuss.elastic.co/t/kibana-unable-to-query-index-data-from-es/270134)
**Author:** [@GregoryBrown](https://discuss.elastic.co/u/GregoryBrown)\ **Replies:** 10\ **Last updated:** [April 16, 2021, 1:14am UTC](https://discuss.elastic.co/t/kibana-unable-to-query-index-data-from-es/270134 "2021-04-16T01:14:36Z")
I am able to upload the following data into my ES Cluster, and have an index template apply to it. However the default search of kibana (using an index pattern) doesn't query the data. Index Template that gets applied t… --- ## [Display string list returned by scripted field in new line in discovery](https://discuss.elastic.co/t/display-string-list-returned-by-scripted-field-in-new-line-in-discovery/270074)
**Author:** [@yash\_gupta](https://discuss.elastic.co/u/yash_gupta)\ **Replies:** 2\ **Last updated:** [April 16, 2021, 1:13am UTC](https://discuss.elastic.co/t/display-string-list-returned-by-scripted-field-in-new-line-in-discovery/270074 "2021-04-16T01:13:30Z")
Hi, I have a scripted filed returning a list of String, when I am viewing the field in discovery page I can see the values are coming as coma separated but I need them to come in new line. Is there any way to achieve t… --- ## [Distinct Report based on 2 columns (Text Field )](https://discuss.elastic.co/t/distinct-report-based-on-2-columns-text-field/270143)
**Author:** [@Showman](https://discuss.elastic.co/u/Showman)\ **Replies:** 3\ **Last updated:** [April 16, 2021, 1:05am UTC](https://discuss.elastic.co/t/distinct-report-based-on-2-columns-text-field/270143 "2021-04-16T01:05:25Z")
Hello, am new to kibana & elastic am trying to get a simple report from a table that has different status for the same Refrence id as Follows: '''''' { "took": 0, "timed\_out": false, "\_shards": { "total": 1, "su… --- ## [Is metricbeat pod sending right host metadata on kubernetes?](https://discuss.elastic.co/t/is-metricbeat-pod-sending-right-host-metadata-on-kubernetes/270177)
**Author:** [@roh](https://discuss.elastic.co/u/roh)\ **Replies:** 2\ **Last updated:** [April 16, 2021, 12:15am UTC](https://discuss.elastic.co/t/is-metricbeat-pod-sending-right-host-metadata-on-kubernetes/270177 "2021-04-16T00:15:49Z")
Hi all! Thanks to you guys that I could deploy metricbeat pods on AWS EKS easily because of yaml file on documentation. I added add\_host\_metadata processor and watched how host os data comes and it was like below: "h… --- ## [Kibana- vega: might be kibana vega context issue - querying separate index data](https://discuss.elastic.co/t/kibana-vega-might-be-kibana-vega-context-issue-querying-separate-index-data/269909)
**Author:** [@wangyf2010](https://discuss.elastic.co/u/wangyf2010)\ **Replies:** 1\ **Last updated:** [April 15, 2021, 10:52pm UTC](https://discuss.elastic.co/t/kibana-vega-might-be-kibana-vega-context-issue-querying-separate-index-data/269909 "2021-04-15T22:52:33Z")
I'm using vega to work out my visualization. As you can see, I'm querying "telemetry" index. While if I input via filter (either in dashboard filter field or visualization filter - KQL) by using "appName" field, I foun… --- ## [Problem when activating Flattened field type on Filebeat fields.yml](https://discuss.elastic.co/t/problem-when-activating-flattened-field-type-on-filebeat-fields-yml/270168)
**Author:** [@Laamimech\_Salah](https://discuss.elastic.co/u/Laamimech_Salah)\ **Replies:** 0\ **Last updated:** [April 15, 2021, 2:43am UTC](https://discuss.elastic.co/t/problem-when-activating-flattened-field-type-on-filebeat-fields-yml/270168 "2021-04-15T02:43:00Z")
Hello, We encounter an error like the one in the following example ,when we activate Flattened field type on the template /etc/filebeat/fields.yml : Filebeat version : 7.6.2 Elasticsearch version : 7.6.2 2021-04-15T0… --- ## [Using Fortinet Integration in Logstash](https://discuss.elastic.co/t/using-fortinet-integration-in-logstash/270304)
**Author:** [@b0r1s](https://discuss.elastic.co/u/b0r1s)\ **Replies:** 2\ **Last updated:** [April 15, 2021, 10:17pm UTC](https://discuss.elastic.co/t/using-fortinet-integration-in-logstash/270304 "2021-04-15T22:17:28Z")
Hey everyone o/ I'm using that conf I found on this topic for parsing logs from FortigateFW with Logstash: input { udp { port =\> 514 type =\> "forti\_log" tags =\> \[""\] } } #THE BEGINNING DOESN'T FORMAT TO CODE … --- ## [Issue setting up basic security on Elasticsearch 7.12](https://discuss.elastic.co/t/issue-setting-up-basic-security-on-elasticsearch-7-12/270284)
**Author:** [@byoungman](https://discuss.elastic.co/u/byoungman)\ **Replies:** 1\ **Last updated:** [April 15, 2021, 8:39pm UTC](https://discuss.elastic.co/t/issue-setting-up-basic-security-on-elasticsearch-7-12/270284 "2021-04-15T20:39:23Z")
I just downloaded Elasticsearch 7.12 and have it configured for basic operation with no security enabled. When I go to enable minimum security as per the documentation - Set up minimal security for Elasticsearch and ena… --- ## [Functionbeat for logs available in S3 bucket](https://discuss.elastic.co/t/functionbeat-for-logs-available-in-s3-bucket/270305)
**Author:** [@Shivani92](https://discuss.elastic.co/u/Shivani92)\ **Replies:** 0\ **Last updated:** [April 15, 2021, 7:55pm UTC](https://discuss.elastic.co/t/functionbeat-for-logs-available-in-s3-bucket/270305 "2021-04-15T19:55:16Z")
Can we use functionbeat to ship logs available in s3 bucket to Elasticsearch? If yes, kindly explain flow and functionbeat configuration a bit. --- ## [How to identify the ip address of application which sends the bulk updates to elasticsearch cluster?](https://discuss.elastic.co/t/how-to-identify-the-ip-address-of-application-which-sends-the-bulk-updates-to-elasticsearch-cluster/270154)
**Author:** [@mario12](https://discuss.elastic.co/u/mario12)\ **Replies:** 7\ **Last updated:** [April 15, 2021, 7:32pm UTC](https://discuss.elastic.co/t/how-to-identify-the-ip-address-of-application-which-sends-the-bulk-updates-to-elasticsearch-cluster/270154 "2021-04-15T19:32:45Z")
How to identify the IP address of the application which sends the bulk updates to elasticsearch cluster? [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1458) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1460)