# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=184 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 185 --- ## [Date histogram don't work](https://discuss.elastic.co/t/date-histogram-dont-work/364685)
**Author:** [@UMUT\_CAN\_ARGUN](https://discuss.elastic.co/u/UMUT_CAN_ARGUN)\ **Replies:** 3\ **Last updated:** [August 20, 2024, 7:47am UTC](https://discuss.elastic.co/t/date-histogram-dont-work/364685 "2024-08-20T07:47:48Z")
I have a dataset like that which was successfully imported into the elasticsearch: I want to generate the table of how many units of items were ordered per year or month. But when i do the settings on Kibana, no sing… --- ## [How to do Trellis/Facet/Small Multiple in Kibana Lens with a pie chart](https://discuss.elastic.co/t/how-to-do-trellis-facet-small-multiple-in-kibana-lens-with-a-pie-chart/364872)
**Author:** [@binarysamurais](https://discuss.elastic.co/u/binarysamurais)\ **Replies:** 1\ **Last updated:** [August 20, 2024, 7:44am UTC](https://discuss.elastic.co/t/how-to-do-trellis-facet-small-multiple-in-kibana-lens-with-a-pie-chart/364872 "2024-08-20T07:44:08Z")
I have a pie chart that I would like to show the percentage between two metrics Blocked & Not Blocked but I would like to Trellis/Fact/Small Multiple this pie chart by Category/Mitre Tactic (Reconnaissance, Resource Deve… --- ## [Cant see my services inside APM with elastic user login](https://discuss.elastic.co/t/cant-see-my-services-inside-apm-with-elastic-user-login/365112)
**Author:** [@Amol\_Nagotkar](https://discuss.elastic.co/u/Amol_Nagotkar)\ **Replies:** 1\ **Last updated:** [August 19, 2024, 11:23am UTC](https://discuss.elastic.co/t/cant-see-my-services-inside-apm-with-elastic-user-login/365112 "2024-08-19T11:23:03Z")
hi all, 10.40.12.20 is my local IP ----------apm-server.yml-------- apm-server: host: "0.0.0.0:8200" kibana: enabled: true host: "http://10.40.12.20:5601" # Replace with your Kibana URL username: "kibana\_system"… --- ## [Logs Received by Logstash Have Zero Length](https://discuss.elastic.co/t/logs-received-by-logstash-have-zero-length/364361)
**Author:** [@Manal\_A](https://discuss.elastic.co/u/Manal_A)\ **Replies:** 1\ **Last updated:** [August 19, 2024, 7:11pm UTC](https://discuss.elastic.co/t/logs-received-by-logstash-have-zero-length/364361 "2024-08-19T19:11:40Z")
Hello, I have an issue with the logs received by my Logstash. Their length is 0. I don't know why. Could it be related to Logstash? Thank you --- ## [NotFoundError](https://discuss.elastic.co/t/notfounderror/365150)
**Author:** [@dsagent](https://discuss.elastic.co/u/dsagent)\ **Replies:** 11\ **Last updated:** [August 19, 2024, 6:35pm UTC](https://discuss.elastic.co/t/notfounderror/365150 "2024-08-19T18:35:49Z")
Hi, I have alias in which a number of index are associated When I want to update documents using alias it returns this error to me From Update Method-\> NotFoundError(404, 'document missing exception', '\[ks5N 44B1PKbf… --- ## [How to create a runtime field with an array](https://discuss.elastic.co/t/how-to-create-a-runtime-field-with-an-array/365155)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 2\ **Last updated:** [August 19, 2024, 6:25pm UTC](https://discuss.elastic.co/t/how-to-create-a-runtime-field-with-an-array/365155 "2024-08-19T18:25:43Z")
Hello, I was wondering how I can create a runtime field based on a value inside of a field array. For example I have this keyword field: fruit.names : \[kiwi, bananas, apple\] I want to create a new field based on coup… --- ## [Importing panel to the dashboard](https://discuss.elastic.co/t/importing-panel-to-the-dashboard/365033)
**Author:** [@Nikita\_Vasyliev](https://discuss.elastic.co/u/Nikita_Vasyliev)\ **Replies:** 3\ **Last updated:** [August 19, 2024, 6:23pm UTC](https://discuss.elastic.co/t/importing-panel-to-the-dashboard/365033 "2024-08-19T18:23:26Z")
Hi everyone, I have a dashboard and I'd like to import the markdown visualisation (containing only text) to the chosen dashboard via API. First I export the visualisation data, analyse it and after I'd like to import t… --- ## [Logstash Sending older logs](https://discuss.elastic.co/t/logstash-sending-older-logs/365019)
**Author:** [@devops\_training](https://discuss.elastic.co/u/devops_training)\ **Replies:** 5\ **Last updated:** [August 19, 2024, 2:44pm UTC](https://discuss.elastic.co/t/logstash-sending-older-logs/365019 "2024-08-19T14:44:27Z")
Logstash is sending older messages. Below is my pipeline. input { file { path =\> "C:/Program Files (x86)/dataops/ag/web/Logs/webSvr\*" type =\> "webSvr" start\_position =\> "beginning" } file { path =\> … --- ## [Some agents not returning anything to osquery queries regarding bitlocker\_info table](https://discuss.elastic.co/t/some-agents-not-returning-anything-to-osquery-queries-regarding-bitlocker-info-table/365148)
**Author:** [@buzzdeee](https://discuss.elastic.co/u/buzzdeee)\ **Replies:** 0\ **Last updated:** [August 19, 2024, 2:12pm UTC](https://discuss.elastic.co/t/some-agents-not-returning-anything-to-osquery-queries-regarding-bitlocker-info-table/365148 "2024-08-19T14:12:52Z")
Hi, running live query to Windows Elastic Agents: select \* from bitlocker\_info; From the 27 targetted hosts, only 5 or so reply with a result set, the others don't seem to return anything. For a host that doesn't retu… --- ## [How to create thresholds in Lens](https://discuss.elastic.co/t/how-to-create-thresholds-in-lens/365034)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 3\ **Last updated:** [August 19, 2024, 2:05pm UTC](https://discuss.elastic.co/t/how-to-create-thresholds-in-lens/365034 "2024-08-19T14:05:35Z")
Hello, I know this can be done with TVSB: TVSB Example: But is it possible to add thresholds to Lens: The reason I want to use Lens over TVSB is just that in the TVSB example it considers "/" as "empty" --- ## [ELK Snaspshots are not getting listed](https://discuss.elastic.co/t/elk-snaspshots-are-not-getting-listed/365102)
**Author:** [@Nijal](https://discuss.elastic.co/u/Nijal)\ **Replies:** 5\ **Last updated:** [August 19, 2024, 10:59am UTC](https://discuss.elastic.co/t/elk-snaspshots-are-not-getting-listed/365102 "2024-08-19T10:59:30Z")
I am using the below approach to backup/restore elasticsearch data Snapshot the data to Shared File system Repo. Before copying the contents, I made the repository read only , so no more data will be written to it. Cop… --- ## [ECS compliance ogs-elastic\_agent.endpoint\_security?](https://discuss.elastic.co/t/ecs-compliance-ogs-elastic-agent-endpoint-security/365127)
**Author:** [@buzzdeee](https://discuss.elastic.co/u/buzzdeee)\ **Replies:** 0\ **Last updated:** [August 19, 2024, 10:31am UTC](https://discuss.elastic.co/t/ecs-compliance-ogs-elastic-agent-endpoint-security/365127 "2024-08-19T10:31:13Z")
Hi, looking at: Log Fields | Elastic Common Schema (ECS) Reference \[8.11\] | Elastic I found that for example: log.origin.XXX fields should be "extended". But when I look in Kibana onto logs for example ingested from /… --- ## [Endpoint logs spammed with: ProcFile.cpp:701 and ProcFile.cpp:175 related messages](https://discuss.elastic.co/t/endpoint-logs-spammed-with-procfile-cpp-701-and-procfile-cpp-175-related-messages/365125)
**Author:** [@buzzdeee](https://discuss.elastic.co/u/buzzdeee)\ **Replies:** 0\ **Last updated:** [August 19, 2024, 9:59am UTC](https://discuss.elastic.co/t/endpoint-logs-spammed-with-procfile-cpp-701-and-procfile-cpp-175-related-messages/365125 "2024-08-19T09:59:04Z")
Looking at the "\[Elastic Agent\] Agent Info" dashboard, I noticed quite a number of hosts reporting a lot of errors in the "\[Elastic Agent\] Agents with Errors" looking closer, seems /opt/Elastic/Endpoint/state/log/endpoi… --- ## [Corrupted Drive](https://discuss.elastic.co/t/corrupted-drive/365122)
**Author:** [@LucasKH](https://discuss.elastic.co/u/LucasKH)\ **Replies:** 1\ **Last updated:** [August 19, 2024, 9:11am UTC](https://discuss.elastic.co/t/corrupted-drive/365122 "2024-08-19T09:11:31Z")
Hello, I have set up a POC for Elastic Stack and it has been gathering logs for ~1-2 months in smaller volumes. However, one day the service has stopped and upon connecting to the server I was faced with the following e… --- ## [Not able to install Salesforce input plugin on Windows](https://discuss.elastic.co/t/not-able-to-install-salesforce-input-plugin-on-windows/365117)
**Author:** [@mosaadshaikh1998](https://discuss.elastic.co/u/mosaadshaikh1998)\ **Replies:** 0\ **Last updated:** [August 19, 2024, 8:13am UTC](https://discuss.elastic.co/t/not-able-to-install-salesforce-input-plugin-on-windows/365117 "2024-08-19T08:13:14Z")
Hi, I am trying to install the salesforce input plugin on the windows server 2019 Datacenter. Below is the command I am trying to run which i found in documentation: bin/logstash-plugin install logstash-input-salesfor… --- ## [Recreate index, error 'resource\_already\_exists\_exception'](https://discuss.elastic.co/t/recreate-index-error-resource-already-exists-exception/365105)
**Author:** [@LiJie20190102](https://discuss.elastic.co/u/LiJie20190102)\ **Replies:** 4\ **Last updated:** [August 19, 2024, 7:36am UTC](https://discuss.elastic.co/t/recreate-index-error-resource-already-exists-exception/365105 "2024-08-19T07:36:40Z")
My goal is to quickly clear the index, but I found that the 'delete-by\_query' courier is slow, so I plan to delete it first and then create a new index like before, but I find that errors often occur： --- ## [Elasticsearch error :missing authentication credentials for REST request](https://discuss.elastic.co/t/elasticsearch-error-missing-authentication-credentials-for-rest-request/364941)
**Author:** [@Frank23](https://discuss.elastic.co/u/Frank23)\ **Replies:** 1\ **Last updated:** [August 19, 2024, 3:24am UTC](https://discuss.elastic.co/t/elasticsearch-error-missing-authentication-credentials-for-rest-request/364941 "2024-08-19T03:24:26Z")
I installed version 8.11.1 of elasticsearch in the domain server. After the local configuration is complete, the web page can be opened normally. But when you try to open a web page in an external browser, you are promp… --- ## [Access event fields for connector action](https://discuss.elastic.co/t/access-event-fields-for-connector-action/365097)
**Author:** [@gunlomboy](https://discuss.elastic.co/u/gunlomboy)\ **Replies:** 0\ **Last updated:** [August 19, 2024, 2:25am UTC](https://discuss.elastic.co/t/access-event-fields-for-connector-action/365097 "2024-08-19T02:25:50Z")
Hi, I am trying to create an alert which utilises the index connector. The connector works fine and writes to the index, however I have been unable to populate any data from the event itself. What I want is something … --- ## [How to fix the security problem of the EPR and logstash 8.15.0](https://discuss.elastic.co/t/how-to-fix-the-security-problem-of-the-epr-and-logstash-8-15-0/364997)
**Author:** [@jevonsnotes](https://discuss.elastic.co/u/jevonsnotes)\ **Replies:** 3\ **Last updated:** [August 19, 2024, 1:26am UTC](https://discuss.elastic.co/t/how-to-fix-the-security-problem-of-the-epr-and-logstash-8-15-0/364997 "2024-08-19T01:26:02Z")
Elastic Package Registry and logstash has been scanned for the following vulnerabilities，is there anyway to fix them ? version 8.15.0 EPR: CVE-2023-42365 CVE-2023-42364 CVE-2023-42366 CVE-2023-42363 CVE-2023-69… --- ## [How Can I Efficiently Use Elasticsearch for Location-Based Searches with a Focus on Qibla Direction Online Tools?](https://discuss.elastic.co/t/how-can-i-efficiently-use-elasticsearch-for-location-based-searches-with-a-focus-on-qibla-direction-online-tools/365087)
**Author:** [@HilaireDenise](https://discuss.elastic.co/u/HilaireDenise)\ **Replies:** 1\ **Last updated:** [August 18, 2024, 7:00pm UTC](https://discuss.elastic.co/t/how-can-i-efficiently-use-elasticsearch-for-location-based-searches-with-a-focus-on-qibla-direction-online-tools/365087 "2024-08-18T19:00:30Z")
I’ve been using Elasticsearch for a while now, mainly for various search-related tasks, and I recently came across the need to perform location-based searches. Specifically, I’m curious about how Elasticsearch handles ge… --- ## [HTTPS config for Elasticsearch](https://discuss.elastic.co/t/https-config-for-elasticsearch/365073)
**Author:** [@BrainFried](https://discuss.elastic.co/u/BrainFried)\ **Replies:** 13\ **Last updated:** [August 18, 2024, 6:51pm UTC](https://discuss.elastic.co/t/https-config-for-elasticsearch/365073 "2024-08-18T18:51:15Z")
I've been stuck for a few days tying to enable HTTPS for public access from my elasticsearch javascript client. My elasticsearch server is running on the host machine. The server is only reachable using HTTP: curl -k -… --- ## [Two logstash http\_poller (API query) configs are outputting documents to each other's indices](https://discuss.elastic.co/t/two-logstash-http-poller-api-query-configs-are-outputting-documents-to-each-others-indices/365066)
**Author:** [@taniumalloy](https://discuss.elastic.co/u/taniumalloy)\ **Replies:** 3\ **Last updated:** [August 17, 2024, 2:44pm UTC](https://discuss.elastic.co/t/two-logstash-http-poller-api-query-configs-are-outputting-documents-to-each-others-indices/365066 "2024-08-17T14:44:25Z")
I have a unique issue in Logstash where my data is not being routed to the correct index name appropriatly. I have two conf.d config files that each use http\_poller as input source and are gathering data from seperate AP… --- ## [To separate x-pack plugin from core kibana](https://discuss.elastic.co/t/to-separate-x-pack-plugin-from-core-kibana/364821)
**Author:** [@mzm1370](https://discuss.elastic.co/u/mzm1370)\ **Replies:** 5\ **Last updated:** [August 17, 2024, 4:43am UTC](https://discuss.elastic.co/t/to-separate-x-pack-plugin-from-core-kibana/364821 "2024-08-17T04:43:35Z")
hi, we want to separate the x-pack plugin from core Kibana and move it to folder plugins in the root folder Kibana and convert the x-pack plugin to an external plugin then we can first bootstrap core Kibana and install … --- ## [\[Solved\] Elasticsearch integration metric settings (elastic-agetnt)](https://discuss.elastic.co/t/solved-elasticsearch-integration-metric-settings-elastic-agetnt/364984)
**Author:** [@Abdarrahmane](https://discuss.elastic.co/u/Abdarrahmane)\ **Replies:** 4\ **Last updated:** [August 16, 2024, 8:55pm UTC](https://discuss.elastic.co/t/solved-elasticsearch-integration-metric-settings-elastic-agetnt/364984 "2024-08-16T20:55:59Z")
hello everyone, I have installed the elastic agent (enrolled in fleet) in all the nodes in my elasticsearch cluster they all have these settings # Enable security features xpack.security.enabled: true xpack.security.en… --- ## [How can I make fields in Elasticsearch v8 match v7?](https://discuss.elastic.co/t/how-can-i-make-fields-in-elasticsearch-v8-match-v7/365025)
**Author:** [@acarrazzoni-qontigo](https://discuss.elastic.co/u/acarrazzoni-qontigo)\ **Replies:** 1\ **Last updated:** [August 16, 2024, 8:48pm UTC](https://discuss.elastic.co/t/how-can-i-make-fields-in-elasticsearch-v8-match-v7/365025 "2024-08-16T20:48:01Z")
I have a Elasticsearch environment I use for logging that I'm updating from v7 to v8 and I noticed that when I look at the logs in Kibana every field that has a name that ends with .keyword in v7 now has a name that ends… --- ## [What are the Elastic Agent managed by Fleet Log settings?](https://discuss.elastic.co/t/what-are-the-elastic-agent-managed-by-fleet-log-settings/365049)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 1\ **Last updated:** [August 16, 2024, 6:07pm UTC](https://discuss.elastic.co/t/what-are-the-elastic-agent-managed-by-fleet-log-settings/365049 "2024-08-16T18:07:16Z")
Hello, I was wondering where I can find the log settings of a Fleet Managed Elastic Agent. --- ## [Copying query doesn't copy group and threshold, only time window](https://discuss.elastic.co/t/copying-query-doesnt-copy-group-and-threshold-only-time-window/365050)
**Author:** [@ajtjavier](https://discuss.elastic.co/u/ajtjavier)\ **Replies:** 0\ **Last updated:** [August 16, 2024, 5:06pm UTC](https://discuss.elastic.co/t/copying-query-doesnt-copy-group-and-threshold-only-time-window/365050 "2024-08-16T17:06:26Z")
I'm trying to copy a query generated by a rule as described on this thread, and then convert that JSON to a TOML file for detection as code. See below the query I've built on Elastic: When I click on Copy query, thi… --- ## [How to free up write thread queues](https://discuss.elastic.co/t/how-to-free-up-write-thread-queues/364981)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 4\ **Last updated:** [August 16, 2024, 4:56pm UTC](https://discuss.elastic.co/t/how-to-free-up-write-thread-queues/364981 "2024-08-16T16:56:36Z")
Hello, How do we free or flush the threadpool write queue in Elastic? --- ## [Collecting logs from filebeats at k8s to logstash, can't filter fields](https://discuss.elastic.co/t/collecting-logs-from-filebeats-at-k8s-to-logstash-cant-filter-fields/365038)
**Author:** [@atchaikovski](https://discuss.elastic.co/u/atchaikovski)\ **Replies:** 5\ **Last updated:** [August 16, 2024, 4:44pm UTC](https://discuss.elastic.co/t/collecting-logs-from-filebeats-at-k8s-to-logstash-cant-filter-fields/365038 "2024-08-16T16:44:59Z")
hi there!! sorry i'm very new to this technology. ELK got installed at k8s cluster, working fine. from beats to logstash i get these things (see code below). which i'm happy about. but i need to get rid of several fields… --- ## [Failed to get the temporary directory; falling back to: /tmp \[2022-09-23T20:38:58,847\]\[ERROR\]\[o.e.b.Elasticsearch \] \[elastic\] fatal exception while booting Elasticsearch java.security.AccessControlException: access denied ("java.io.FilePermission" "/](https://discuss.elastic.co/t/failed-to-get-the-temporary-directory-falling-back-to-tmp-2022-09-23t2058-847-error-o-e-b-elasticsearch-elastic-fatal-exception-while-booting-elasticsearch-java-security-accesscontrolexception-access-denied-java-io-filepermission/365041)
**Author:** [@sarathrock](https://discuss.elastic.co/u/sarathrock)\ **Replies:** 1\ **Last updated:** [August 16, 2024, 4:36pm UTC](https://discuss.elastic.co/t/failed-to-get-the-temporary-directory-falling-back-to-tmp-2022-09-23t2058-847-error-o-e-b-elasticsearch-elastic-fatal-exception-while-booting-elasticsearch-java-security-accesscontrolexception-access-denied-java-io-filepermission/365041 "2024-08-16T16:36:06Z")
Failed to get the temporary directory; falling back to: /tmp \[2022-09-23T20:38:58,847\]\[ERROR\]\[o.e.b.Elasticsearch \] \[elastic\] fatal exception while booting Elasticsearch java.security.AccessControlException: acces… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=183) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=185)