# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1731 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1732 --- ## [Iterate through influencer\_field\_values when they contain more than one value, that exists inside ctx.payload.hits.hits.stream()](https://discuss.elastic.co/t/iterate-through-influencer-field-values-when-they-contain-more-than-one-value-that-exists-inside-ctx-payload-hits-hits-stream/253156)
**Author:** [@ironcard](https://discuss.elastic.co/u/ironcard)\ **Replies:** 4\ **Last updated:** [October 26, 2020, 6:20pm UTC](https://discuss.elastic.co/t/iterate-through-influencer-field-values-when-they-contain-more-than-one-value-that-exists-inside-ctx-payload-hits-hits-stream/253156 "2020-10-26T18:20:42Z")
Consider the following output: Anomaly on Sep 16 @ 11:45 PM: Partner: p1 Brand: b1 Score=94.71 Actual=15 Typical=744.49 How do I go about adding more partners or brands, instead of getting this… --- ## [How to store iis x-forwarded-for ip with field type IPORHOST](https://discuss.elastic.co/t/how-to-store-iis-x-forwarded-for-ip-with-field-type-iporhost/253186)
**Author:** [@Thanura\_Kannangara](https://discuss.elastic.co/u/Thanura_Kannangara)\ **Replies:** 4\ **Last updated:** [October 26, 2020, 6:16pm UTC](https://discuss.elastic.co/t/how-to-store-iis-x-forwarded-for-ip-with-field-type-iporhost/253186 "2020-10-26T18:16:31Z")
I'm trying to grok these entries #Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) cs(Referer) sc-status sc-substatus sc-win32-status time-taken X-Forwarded-For 2020-10-23… --- ## [Endpoint not detecting installed plugins](https://discuss.elastic.co/t/endpoint-not-detecting-installed-plugins/253352)
**Author:** [@columbian\_chris](https://discuss.elastic.co/u/columbian_chris)\ **Replies:** 0\ **Last updated:** [October 26, 2020, 5:03pm UTC](https://discuss.elastic.co/t/endpoint-not-detecting-installed-plugins/253352 "2020-10-26T17:03:04Z")
I have installed a couple plugins into my elasticsearch setup, but nothing gets listed when I use the /\_cat/plugins endpoint. I can confirm that they're installed because bin/elasticsearch-plugin list correctly lists th… --- ## [ML watcher configs](https://discuss.elastic.co/t/ml-watcher-configs/251696)
**Author:** [@saraKM](https://discuss.elastic.co/u/saraKM)\ **Replies:** 3\ **Last updated:** [October 26, 2020, 4:59pm UTC](https://discuss.elastic.co/t/ml-watcher-configs/251696 "2020-10-26T16:59:45Z")
We have a watcher running for a daily ML job (1d bucket span) over .ml-anomalies\* and fires for record results where in\_interim is false and some other conditions on record\_score and actual values. The watcher has a sche… --- ## [Documentation error](https://discuss.elastic.co/t/documentation-error/253330)
**Author:** [@gborg](https://discuss.elastic.co/u/gborg)\ **Replies:** 1\ **Last updated:** [October 26, 2020, 4:39pm UTC](https://discuss.elastic.co/t/documentation-error/253330 "2020-10-26T16:39:01Z")
In the logstash mutete filter documentation there seems to be an error, or at least it seems like an error to me mutate { split =\> \["hostname", "."\] add\_field =\> { "shortHostname" =\> "%{hostname\[0\]… --- ## [O/p not getting in console](https://discuss.elastic.co/t/o-p-not-getting-in-console/253344)
**Author:** [@Sakthivanan](https://discuss.elastic.co/u/Sakthivanan)\ **Replies:** 0\ **Last updated:** [October 26, 2020, 4:31pm UTC](https://discuss.elastic.co/t/o-p-not-getting-in-console/253344 "2020-10-26T16:31:41Z")
Hi All, I m trying to load CSV file for that i used below config file.its running without error in cmd prompt but I didnt get output. This my CSV File with header cds,rtype,schoolname,districtname,countyname,charter\_f… --- ## [Elastic LDAP config issues](https://discuss.elastic.co/t/elastic-ldap-config-issues/252880)
**Author:** [@dmartinezz23](https://discuss.elastic.co/u/dmartinezz23)\ **Replies:** 8\ **Last updated:** [October 26, 2020, 4:09pm UTC](https://discuss.elastic.co/t/elastic-ldap-config-issues/252880 "2020-10-26T16:09:39Z")
Hello, I’m working on setting up Ldap/AD auth. However, I’m not sure what I’m missing here. In terms of logging, I’m not seeing much of anything in Kibana or Elasticsearch at all. Mainly due to the logs getting clobbered… --- ## [Problem with query date elastichsearch with php](https://discuss.elastic.co/t/problem-with-query-date-elastichsearch-with-php/253336)
**Author:** [@joseantonio.sanchez](https://discuss.elastic.co/u/joseantonio.sanchez)\ **Replies:** 0\ **Last updated:** [October 26, 2020, 3:43pm UTC](https://discuss.elastic.co/t/problem-with-query-date-elastichsearch-with-php/253336 "2020-10-26T15:43:56Z")
good afternoon, I am making a query from php to elasticsearch, I give you some parameters $params = \[ 'scroll' =\> '30s', // how long between scroll requests. should be small! 'size' =\> 300, //… --- ## [No logs after enable TLS](https://discuss.elastic.co/t/no-logs-after-enable-tls/253337)
**Author:** [@LuWe](https://discuss.elastic.co/u/LuWe)\ **Replies:** 0\ **Last updated:** [October 26, 2020, 3:57pm UTC](https://discuss.elastic.co/t/no-logs-after-enable-tls/253337 "2020-10-26T15:57:12Z")
Hi, i have a ELK-cluster to log a firewall. That worked well until i enabled TLS/SSL. Now Kibana do not show new logs. Here ist one of the config files: input { udp { port =\> 514 type =\> firewall } } filter { if \[type\]… --- ## [How to only use score of best matching term](https://discuss.elastic.co/t/how-to-only-use-score-of-best-matching-term/253317)
**Author:** [@JF2018](https://discuss.elastic.co/u/JF2018)\ **Replies:** 2\ **Last updated:** [October 26, 2020, 3:53pm UTC](https://discuss.elastic.co/t/how-to-only-use-score-of-best-matching-term/253317 "2020-10-26T15:53:43Z")
Hey I have four terms, Term\_A, Term\_B, Term\_C and Term\_D. I would like to do something like this: { "query": { "bool" : { "should" : \[ { "term" : { "tags\_field" : "Term\_A" } }, … --- ## [Kibana latency display bug or real?](https://discuss.elastic.co/t/kibana-latency-display-bug-or-real/252882)
**Author:** [@PublicName](https://discuss.elastic.co/u/PublicName)\ **Replies:** 2\ **Last updated:** [October 26, 2020, 3:44pm UTC](https://discuss.elastic.co/t/kibana-latency-display-bug-or-real/252882 "2020-10-26T15:44:49Z")
With a kibana instance 7.9.2 running ingest manager I have about 100 clients connected. Looking in stack monitor everything appears fine CPU usage is low RAM is not under any pressure and disk io at storage and VM level… --- ## [Has\_child query match children-less parent](https://discuss.elastic.co/t/has-child-query-match-children-less-parent/253325)
**Author:** [@rfferrao](https://discuss.elastic.co/u/rfferrao)\ **Replies:** 1\ **Last updated:** [October 26, 2020, 3:36pm UTC](https://discuss.elastic.co/t/has-child-query-match-children-less-parent/253325 "2020-10-26T15:36:59Z")
Is it possible to do this? Here's what I've tried: { "query": { "bool": { "should": { "has\_child": { "type": "group", "query": { "bool": { "should": { "match\_all": { } } } }, … --- ## [Logstash combining dissect and grok to add date to my timestamps without date](https://discuss.elastic.co/t/logstash-combining-dissect-and-grok-to-add-date-to-my-timestamps-without-date/253314)
**Author:** [@bobmaza](https://discuss.elastic.co/u/bobmaza)\ **Replies:** 0\ **Last updated:** [October 26, 2020, 1:27pm UTC](https://discuss.elastic.co/t/logstash-combining-dissect-and-grok-to-add-date-to-my-timestamps-without-date/253314 "2020-10-26T13:27:50Z")
Hi, i totally new to the elastic stack, and currently working on a dash board for logs through kibana, but i'm still at the data ingestion stage unfortunately ! took me some days to learn how to make things work, frist… --- ## [Custom access\_log and ECS](https://discuss.elastic.co/t/custom-access-log-and-ecs/253148)
**Author:** [@rmrfchik](https://discuss.elastic.co/u/rmrfchik)\ **Replies:** 2\ **Last updated:** [October 26, 2020, 1:33pm UTC](https://discuss.elastic.co/t/custom-access-log-and-ecs/253148 "2020-10-26T13:33:12Z")
I have custom access\_log and want to use power of ECS. So, filebeat simply chew log file (type: log) and forward lines to logstash. Logstash groks line and fills "user\_agent.original" field. So far so good. I made sim… --- ## [Create a weekly newsletter that contains e.g. a Dashboard](https://discuss.elastic.co/t/create-a-weekly-newsletter-that-contains-e-g-a-dashboard/253331)
**Author:** [@kwoxer](https://discuss.elastic.co/u/kwoxer)\ **Replies:** 0\ **Last updated:** [October 26, 2020, 3:05pm UTC](https://discuss.elastic.co/t/create-a-weekly-newsletter-that-contains-e-g-a-dashboard/253331 "2020-10-26T15:05:46Z")
I would like to send a newsletter every week with the information of one Dashboard. So I already found the Email action. But I'm not so sure if that is actually what I need. Is there maybe a more detailed tutorial abou… --- ## [Is Kibana Capable to use right to left (for Arabic) graphics and Arabic characters?](https://discuss.elastic.co/t/is-kibana-capable-to-use-right-to-left-for-arabic-graphics-and-arabic-characters/253210)
**Author:** [@fiore\_el](https://discuss.elastic.co/u/fiore_el)\ **Replies:** 1\ **Last updated:** [October 26, 2020, 2:59pm UTC](https://discuss.elastic.co/t/is-kibana-capable-to-use-right-to-left-for-arabic-graphics-and-arabic-characters/253210 "2020-10-26T14:59:48Z")
Is Kibana Capable to use right to left graphics/chars and Arabic characters? We want to use it do create a complete Arabic Dashboards --- ## [Create a table counting the number of buckets having same count (count pipeline ?)](https://discuss.elastic.co/t/create-a-table-counting-the-number-of-buckets-having-same-count-count-pipeline/252914)
**Author:** [@tenchi](https://discuss.elastic.co/u/tenchi)\ **Replies:** 3\ **Last updated:** [October 26, 2020, 2:46pm UTC](https://discuss.elastic.co/t/create-a-table-counting-the-number-of-buckets-having-same-count-count-pipeline/252914 "2020-10-26T14:46:11Z")
Hello, I have an index with a line for each customer order. I am trying to get a visualization table listing the number of customers ordering several times, with one line per number of recurrent orders. Number of … --- ## [ES Flush Latency is too high](https://discuss.elastic.co/t/es-flush-latency-is-too-high/253324)
**Author:** [@robertitox](https://discuss.elastic.co/u/robertitox)\ **Replies:** 0\ **Last updated:** [October 26, 2020, 2:33pm UTC](https://discuss.elastic.co/t/es-flush-latency-is-too-high/253324 "2020-10-26T14:33:47Z")
Dear people, I have a 3 node ES 7.9.1 cluster running OK. But when I activate the ES template for my Zabbix monitor, I get these warnings for each of my three ES nodes: And this is the trigger in Zabbix: My storag… --- ## [Coordinating node license requirement](https://discuss.elastic.co/t/coordinating-node-license-requirement/253279)
**Author:** [@Jalpesh1](https://discuss.elastic.co/u/Jalpesh1)\ **Replies:** 1\ **Last updated:** [October 26, 2020, 2:41pm UTC](https://discuss.elastic.co/t/coordinating-node-license-requirement/253279 "2020-10-26T14:41:26Z")
Hi Team, We have 5 Nodes cluster with Platinum license . Now we are planning to add 1 coordinating node for request/response. Do we require additional license for coordinating node ? Regards, Jalpesh --- ## [Efficient kv parser - replacement?](https://discuss.elastic.co/t/efficient-kv-parser-replacement/253320)
**Author:** [@wedkarz014](https://discuss.elastic.co/u/wedkarz014)\ **Replies:** 0\ **Last updated:** [October 26, 2020, 2:17pm UTC](https://discuss.elastic.co/t/efficient-kv-parser-replacement/253320 "2020-10-26T14:17:54Z")
Hi, In filter part I have a parser like here: kv { field\_split =\> "," trim\_value =\> "\\"" value\_split =\> "=" include\_keys =\> \["Hostname","SlotId","EOCTimestamp","RequestStartTimestamp","ResponseStartTi… --- ## [ILM index priority not being set correctly](https://discuss.elastic.co/t/ilm-index-priority-not-being-set-correctly/250379)
**Author:** [@samcook](https://discuss.elastic.co/u/samcook)\ **Replies:** 2\ **Last updated:** [October 26, 2020, 2:08pm UTC](https://discuss.elastic.co/t/ilm-index-priority-not-being-set-correctly/250379 "2020-10-26T14:08:24Z")
I have an ILM policy defined that looks like this: GET \_ilm/policy/warm-shrink-merge-after-1-year { "warm-shrink-merge-after-1-year" : { "version" : 1, "modified\_date" : "2020-09-28T23:03:18.959Z", "policy… --- ## [Elastic Ingest Pipeline with enrich processor to enrich nested objects](https://discuss.elastic.co/t/elastic-ingest-pipeline-with-enrich-processor-to-enrich-nested-objects/253044)
**Author:** [@bgiordano](https://discuss.elastic.co/u/bgiordano)\ **Replies:** 2\ **Last updated:** [October 26, 2020, 1:36pm UTC](https://discuss.elastic.co/t/elastic-ingest-pipeline-with-enrich-processor-to-enrich-nested-objects/253044 "2020-10-26T13:36:39Z")
What is the correct syntax for the enrich processor to access field for enrichment for an object within an array? This works to get access to field in single object, as shown in the example provided. This is what I am s… --- ## [Index Lifecycle Policy Failures](https://discuss.elastic.co/t/index-lifecycle-policy-failures/253306)
**Author:** [@Mohammad\_Etemad](https://discuss.elastic.co/u/Mohammad_Etemad)\ **Replies:** 0\ **Last updated:** [October 26, 2020, 12:39pm UTC](https://discuss.elastic.co/t/index-lifecycle-policy-failures/253306 "2020-10-26T12:39:24Z")
Hello, I am using Elasticsearch version 7.4 and have configured rollover policies for my indices. Every now and then on some indices (by random) I get some failures on rollover. The errors include: illegal\_argument\_exc… --- ## [LOSING OUTPUT DELETE TAKES HOURS](https://discuss.elastic.co/t/losing-output-delete-takes-hours/253305)
**Author:** [@Daniel\_Lopez](https://discuss.elastic.co/u/Daniel_Lopez)\ **Replies:** 0\ **Last updated:** [October 26, 2020, 12:37pm UTC](https://discuss.elastic.co/t/losing-output-delete-takes-hours/253305 "2020-10-26T12:37:06Z")
HI to all I will try to explain this issue: I have these lines in log 08:41:39.691 new resources port:6215 trunk:1 08:41:40.128 Release resources port:6215 The First line is index at 08:46, so late i think, but wit… --- ## [Elastic Stack OIDC Google](https://discuss.elastic.co/t/elastic-stack-oidc-google/251898)
**Author:** [@Bjoern\_Boschman](https://discuss.elastic.co/u/Bjoern_Boschman)\ **Replies:** 2\ **Last updated:** [October 26, 2020, 12:28pm UTC](https://discuss.elastic.co/t/elastic-stack-oidc-google/251898 "2020-10-26T12:28:39Z")
Hi, I'm trying to get OIDC integration with google working without any success for quite some time. Im using Elastic Stack as a Service First I configured within Elasticsearch keystore: xpack.security.authc.realms.oi… --- ## [Count of each API in a different table](https://discuss.elastic.co/t/count-of-each-api-in-a-different-table/253302)
**Author:** [@rohitarorait82](https://discuss.elastic.co/u/rohitarorait82)\ **Replies:** 1\ **Last updated:** [October 26, 2020, 12:28pm UTC](https://discuss.elastic.co/t/count-of-each-api-in-a-different-table/253302 "2020-10-26T12:28:24Z")
Hi All, We need to create a table where we can store daily counts of all the apis. We actually keep data of around 1 month in ELK but will be needing count details for around an year for analysis. Is there a way to do … --- ## [Watcher configuration error](https://discuss.elastic.co/t/watcher-configuration-error/253292)
**Author:** [@Syed.Ubaid](https://discuss.elastic.co/u/Syed.Ubaid)\ **Replies:** 1\ **Last updated:** [October 26, 2020, 12:25pm UTC](https://discuss.elastic.co/t/watcher-configuration-error/253292 "2020-10-26T12:25:57Z")
I am configuring watcher email in elasticsearch yml using this configuration xpack.notification.email.account: gmail\_account: profile: gmail smtp: auth: true starttls.enable: true host: smtp.gmail.com port: 587 … --- ## [Grok parser date processor problem](https://discuss.elastic.co/t/grok-parser-date-processor-problem/253207)
**Author:** [@gizem](https://discuss.elastic.co/u/gizem)\ **Replies:** 4\ **Last updated:** [October 26, 2020, 12:23pm UTC](https://discuss.elastic.co/t/grok-parser-date-processor-problem/253207 "2020-10-26T12:23:04Z")
Hi, I have the grok parser below: { "description": "pipeline", "processors": \[ { "grok": { "if": "ctx.message.contains('LOG1')", "field": "message", "patterns": \[ "\\\\\[%{G… --- ## [Dataset of IP's to query against Index](https://discuss.elastic.co/t/dataset-of-ips-to-query-against-index/253056)
**Author:** [@MichaelHuff](https://discuss.elastic.co/u/MichaelHuff)\ **Replies:** 3\ **Last updated:** [October 26, 2020, 12:22pm UTC](https://discuss.elastic.co/t/dataset-of-ips-to-query-against-index/253056 "2020-10-26T12:22:19Z")
I have a data set of around 40k of IP Addresses that are known bad IP's. I am wanting to query that data set against an index in my stack. When I query the data I wanna bring back any specific username that has had a suc… --- ## [ES aggregation query](https://discuss.elastic.co/t/es-aggregation-query/253284)
**Author:** [@niraj\_pandey](https://discuss.elastic.co/u/niraj_pandey)\ **Replies:** 4\ **Last updated:** [October 26, 2020, 12:05pm UTC](https://discuss.elastic.co/t/es-aggregation-query/253284 "2020-10-26T12:05:22Z")
I am running a huge aggregation query and getting the following error. This aggregation creates too many buckets (10001) and will throw an error in future versions. You should update the \[search.max\_buckets\] cluster set… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1730) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1732)