# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=205 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 206 --- ## [Filebeat gave error](https://discuss.elastic.co/t/filebeat-gave-error/363002)
**Author:** [@Prabhath\_samarasingh](https://discuss.elastic.co/u/Prabhath_samarasingh)\ **Replies:** 0\ **Last updated:** [July 12, 2024, 7:30am UTC](https://discuss.elastic.co/t/filebeat-gave-error/363002 "2024-07-12T07:30:23Z")
I have Mailcow-dockerize envirment and need to send postfix container logs (Basically maillogs) to external host ELK stack. ELK stack is working fine. When I installed filebeat on my mailcow setup and create filebeat y… --- ## [Aggregation result from search query into a field](https://discuss.elastic.co/t/aggregation-result-from-search-query-into-a-field/363000)
**Author:** [@Debatri\_Ash](https://discuss.elastic.co/u/Debatri_Ash)\ **Replies:** 0\ **Last updated:** [July 12, 2024, 7:12am UTC](https://discuss.elastic.co/t/aggregation-result-from-search-query-into-a-field/363000 "2024-07-12T07:12:56Z")
Is there a way to convert aggregation query result into a field in the index used for the aggregation? My aggregation query result gives me values under an array name w.r.t the values in a field which already exists in t… --- ## [Metricbeat - Setup sample dashboards to the Kibana index failing](https://discuss.elastic.co/t/metricbeat-setup-sample-dashboards-to-the-kibana-index-failing/360480)
**Author:** [@dmingueza](https://discuss.elastic.co/u/dmingueza)\ **Replies:** 4\ **Last updated:** [July 12, 2024, 7:09am UTC](https://discuss.elastic.co/t/metricbeat-setup-sample-dashboards-to-the-kibana-index-failing/360480 "2024-07-12T07:09:51Z")
I have Metricbeat, Kibana and Elasticsearch running in different Docker containers in the same network. Metricbeat is sending information successfully to Elasticsearch. However, I have a problem when I want to load the … --- ## [Any way to access Metric value through JSON input field](https://discuss.elastic.co/t/any-way-to-access-metric-value-through-json-input-field/362690)
**Author:** [@ayushr](https://discuss.elastic.co/u/ayushr)\ **Replies:** 1\ **Last updated:** [July 12, 2024, 6:42am UTC](https://discuss.elastic.co/t/any-way-to-access-metric-value-through-json-input-field/362690 "2024-07-12T06:42:30Z")
Hi I am looking to apply a floor() method on the overall average of a field calculated in 'Metric' visualisation in Kibana. I cannot apply floor() on each value in document since it will give incorrect value. Is there a… --- ## [Accessing the metrics value in JSON input field](https://discuss.elastic.co/t/accessing-the-metrics-value-in-json-input-field/362689)
**Author:** [@ayushr](https://discuss.elastic.co/u/ayushr)\ **Replies:** 1\ **Last updated:** [July 12, 2024, 6:42am UTC](https://discuss.elastic.co/t/accessing-the-metrics-value-in-json-input-field/362689 "2024-07-12T06:42:00Z")
Hi I am storing run time of a task in Elastic and on Kibana, I wanted to display the average run time as a string metric in DD:HH:MM:SS format. Is there a way to do that? I have tried using the following in JSON input … --- ## [Aggregation on IP arrays](https://discuss.elastic.co/t/aggregation-on-ip-arrays/362851)
**Author:** [@blueren](https://discuss.elastic.co/u/blueren)\ **Replies:** 2\ **Last updated:** [July 12, 2024, 6:22am UTC](https://discuss.elastic.co/t/aggregation-on-ip-arrays/362851 "2024-07-12T06:22:28Z")
I have an index with a handful of docs. These docs contain an array "subnets" who's individual elements of of type IP. They contain individual IPs as well as subnets. Eg\> { ...., ...., subnets: \["192.168.0.0/24", "2… --- ## [Logstash Aggregate filter sometimes does not work](https://discuss.elastic.co/t/logstash-aggregate-filter-sometimes-does-not-work/362992)
**Author:** [@Fdsm](https://discuss.elastic.co/u/Fdsm)\ **Replies:** 0\ **Last updated:** [July 12, 2024, 4:30am UTC](https://discuss.elastic.co/t/logstash-aggregate-filter-sometimes-does-not-work/362992 "2024-07-12T04:30:34Z")
I have some integration logs coming from filebeat and I'm trying to use the aggregate filter to calculate the delta of the entire process. The code implemented seems to work properly, but looking at kibana some records a… --- ## [Adding AWS RDS Performance Insights metrics to rds metricset](https://discuss.elastic.co/t/adding-aws-rds-performance-insights-metrics-to-rds-metricset/362930)
**Author:** [@Steve\_Foster](https://discuss.elastic.co/u/Steve_Foster)\ **Replies:** 0\ **Last updated:** [July 11, 2024, 5:55am UTC](https://discuss.elastic.co/t/adding-aws-rds-performance-insights-metrics-to-rds-metricset/362930 "2024-07-11T05:55:38Z")
If an RDS instance has Performance insights enabled then there some additional metrics that are exposed. Is there any plan to add them to the RDS metric set? Or would a PR be the best approach to get this started? --- ## [Impact of frequency value for continuous transform](https://discuss.elastic.co/t/impact-of-frequency-value-for-continuous-transform/362903)
**Author:** [@gueri](https://discuss.elastic.co/u/gueri)\ **Replies:** 3\ **Last updated:** [July 11, 2024, 10:25pm UTC](https://discuss.elastic.co/t/impact-of-frequency-value-for-continuous-transform/362903 "2024-07-11T22:25:28Z")
Hi, I created a continuous transform job to run once a day and calculate aggregations about communications with IPs and protocole/port. This is the skeleton of my transform { "source": { "index": \[ "my\_sou… --- ## [Editing dynamic field name in logstash](https://discuss.elastic.co/t/editing-dynamic-field-name-in-logstash/362843)
**Author:** [@sahere37](https://discuss.elastic.co/u/sahere37)\ **Replies:** 1\ **Last updated:** [July 11, 2024, 9:22pm UTC](https://discuss.elastic.co/t/editing-dynamic-field-name-in-logstash/362843 "2024-07-11T21:22:07Z")
hi, I have a log in which each line has a field with different name like below. is it possible to change all of these field's names to just "day"? \<123\>day=.... ===\> day=.... \<678\>day=.... ===\> day=.... --- ## [Number of requests to cloud during an incremental snapshot](https://discuss.elastic.co/t/number-of-requests-to-cloud-during-an-incremental-snapshot/362981)
**Author:** [@aditya.pingale](https://discuss.elastic.co/u/aditya.pingale)\ **Replies:** 0\ **Last updated:** [July 11, 2024, 8:00pm UTC](https://discuss.elastic.co/t/number-of-requests-to-cloud-during-an-incremental-snapshot/362981 "2024-07-11T20:00:31Z")
Hi, I am trying to setup a snapshot repository with AWS or google cloud. There is a tradeoff between cost for requests and storage cost. I wanted to know whether there is a way I could guess the amount of requests elast… --- ## [Difference of Sets in ES](https://discuss.elastic.co/t/difference-of-sets-in-es/362924)
**Author:** [@Jader\_Gonzalez](https://discuss.elastic.co/u/Jader_Gonzalez)\ **Replies:** 1\ **Last updated:** [July 11, 2024, 6:51pm UTC](https://discuss.elastic.co/t/difference-of-sets-in-es/362924 "2024-07-11T18:51:51Z")
I have experience working with SQL and am familiar with performing set differences using SQL. Although I understand that Elasticsearch (ES) operates differently, I believe there must be an efficient method for achieving … --- ## [Parsing log multiline](https://discuss.elastic.co/t/parsing-log-multiline/362962)
**Author:** [@boosterino](https://discuss.elastic.co/u/boosterino)\ **Replies:** 1\ **Last updated:** [July 11, 2024, 6:18pm UTC](https://discuss.elastic.co/t/parsing-log-multiline/362962 "2024-07-11T18:18:36Z")
Hi i need help with parsing my logs with logstash and grok. I have a log like this: 141\>1 2024-07-11T11:12:03.213953+02:00 TACP-VD-RDSH039.tac.priv takeinfo\_reglog\_CSV.ps1 14128 - - \[2024-07-11 11:12:02.621\]\[4465141\]\[N… --- ## [Trouble Visualizing API Response Times in Percentiles with Prometheus Data in Elasticsearch](https://discuss.elastic.co/t/trouble-visualizing-api-response-times-in-percentiles-with-prometheus-data-in-elasticsearch/362958)
**Author:** [@KKarjee](https://discuss.elastic.co/u/KKarjee)\ **Replies:** 4\ **Last updated:** [July 11, 2024, 5:58pm UTC](https://discuss.elastic.co/t/trouble-visualizing-api-response-times-in-percentiles-with-prometheus-data-in-elasticsearch/362958 "2024-07-11T17:58:59Z")
Issue: I am trying to visualize API response times in percentiles using Prometheus histogram data stored in Elasticsearch. Despite sending data from Prometheus to Elasticsearch, I am encountering difficulties in creati… --- ## [Problems creating a scripted field for Date only from a datetime field](https://discuss.elastic.co/t/problems-creating-a-scripted-field-for-date-only-from-a-datetime-field/362969)
**Author:** [@levitoh123](https://discuss.elastic.co/u/levitoh123)\ **Replies:** 0\ **Last updated:** [July 11, 2024, 4:59pm UTC](https://discuss.elastic.co/t/problems-creating-a-scripted-field-for-date-only-from-a-datetime-field/362969 "2024-07-11T16:59:16Z")
This shouldn't be too complex but yet Painless is pretty painful. What I am trying to do is to get only the date from a datetime field in a format of "MMM D, YYYY" or simply "YYYY-MM-DD", so I can use it to make unique c… --- ## [Field data type unknown even with mapping](https://discuss.elastic.co/t/field-data-type-unknown-even-with-mapping/362918)
**Author:** [@chsing](https://discuss.elastic.co/u/chsing)\ **Replies:** 3\ **Last updated:** [July 11, 2024, 4:24pm UTC](https://discuss.elastic.co/t/field-data-type-unknown-even-with-mapping/362918 "2024-07-11T16:24:29Z")
Hi, I'm using an agent policy with a Custom Logs integration to send my logs to Elastic. The logs are coming in fine except for one thing: a couple of the fields are coming in as unknown data types. I have tried to add … --- ## [Implement TTL for "dynamic" documents](https://discuss.elastic.co/t/implement-ttl-for-dynamic-documents/362822)
**Author:** [@timetolive](https://discuss.elastic.co/u/timetolive)\ **Replies:** 5\ **Last updated:** [July 11, 2024, 1:07pm UTC](https://discuss.elastic.co/t/implement-ttl-for-dynamic-documents/362822 "2024-07-11T13:07:31Z")
Current situation I have an Elasticsearch workflow equivalent to the following: I have tons of "animal sighting stations", each occasionally sending a "sighting event" of a specific animal species to the backend. The b… --- ## [Changing the key of kv outout](https://discuss.elastic.co/t/changing-the-key-of-kv-outout/362932)
**Author:** [@sahere37](https://discuss.elastic.co/u/sahere37)\ **Replies:** 1\ **Last updated:** [July 11, 2024, 12:39pm UTC](https://discuss.elastic.co/t/changing-the-key-of-kv-outout/362932 "2024-07-11T12:39:52Z")
hi , I have below kv filter in my logstash conf file kv { field\_split =\> " " value\_split =\> "="" } and my data is as bellow: \<12\>d=2024-07 T=12:13 P=h c=12 \<13\>d=2024-07 T=12:15 P=l c=17 \<102\>d=2024… --- ## [How to send an SNMP trap to opennms when any node in the cluster has bad health?](https://discuss.elastic.co/t/how-to-send-an-snmp-trap-to-opennms-when-any-node-in-the-cluster-has-bad-health/362959)
**Author:** [@BOYO](https://discuss.elastic.co/u/BOYO)\ **Replies:** 0\ **Last updated:** [July 11, 2024, 12:28pm UTC](https://discuss.elastic.co/t/how-to-send-an-snmp-trap-to-opennms-when-any-node-in-the-cluster-has-bad-health/362959 "2024-07-11T12:28:25Z")
We want to monitor out elasticsearch cluster and send an snmp trap to opennms if the health of any node in the cluster becomes bad. Is there any way to integrate the two without implementing a custom module ? --- ## [Want to do partial match without using wildcards](https://discuss.elastic.co/t/want-to-do-partial-match-without-using-wildcards/362928)
**Author:** [@PratikStar](https://discuss.elastic.co/u/PratikStar)\ **Replies:** 5\ **Last updated:** [July 11, 2024, 10:33am UTC](https://discuss.elastic.co/t/want-to-do-partial-match-without-using-wildcards/362928 "2024-07-11T10:33:00Z")
I want to do a partial match on text fields (these fields include Japanese text data, but more on that later, I want to nail the core functionality correctly before going into Japanese.) without using wildcards. Here ar… --- ## [Is ECK operator is compatible with elastic-search version 8.10.3 on EKS?](https://discuss.elastic.co/t/is-eck-operator-is-compatible-with-elastic-search-version-8-10-3-on-eks/362882)
**Author:** [@Omar\_Khaled](https://discuss.elastic.co/u/Omar_Khaled)\ **Replies:** 1\ **Last updated:** [July 11, 2024, 10:04am UTC](https://discuss.elastic.co/t/is-eck-operator-is-compatible-with-elastic-search-version-8-10-3-on-eks/362882 "2024-07-11T10:04:47Z")
Is ECK operator is compatible with elastic-search version 8.10.3 on EKS? thanks for the support! --- ## [Access to nested fields' values in logstash](https://discuss.elastic.co/t/access-to-nested-fields-values-in-logstash/362845)
**Author:** [@sahere37](https://discuss.elastic.co/u/sahere37)\ **Replies:** 3\ **Last updated:** [July 11, 2024, 10:04am UTC](https://discuss.elastic.co/t/access-to-nested-fields-values-in-logstash/362845 "2024-07-11T10:04:31Z")
Hi, I have these fields and values in my log in differnet lines:: line 1: date ==\> "z\_ac" z\_ac ==\> "2024-07" line 2: date ==\> "z\_bc" z\_bc ==\> "2024-07" line 3: date ==\> "z\_dc" z\_dc ==\> "2024-07" ...............… --- ## [Tracking document updates and deletions with Audit Logging](https://discuss.elastic.co/t/tracking-document-updates-and-deletions-with-audit-logging/362931)
**Author:** [@yago82](https://discuss.elastic.co/u/yago82)\ **Replies:** 0\ **Last updated:** [July 11, 2024, 7:10am UTC](https://discuss.elastic.co/t/tracking-document-updates-and-deletions-with-audit-logging/362931 "2024-07-11T07:10:32Z")
Hi, I would like to know if it is possible to use the audit logging feature in Elasticsearch to track when a user updates or deletes a document in a specific index. Specifically, I need to determine if there are records… --- ## [How do i show a list of last search value (a.k.a. recent picks) in my global search bar](https://discuss.elastic.co/t/how-do-i-show-a-list-of-last-search-value-a-k-a-recent-picks-in-my-global-search-bar/362833)
**Author:** [@9d224d4833094bd482cf](https://discuss.elastic.co/u/9d224d4833094bd482cf)\ **Replies:** 2\ **Last updated:** [July 11, 2024, 7:01am UTC](https://discuss.elastic.co/t/how-do-i-show-a-list-of-last-search-value-a-k-a-recent-picks-in-my-global-search-bar/362833 "2024-07-11T07:01:30Z")
I am developing global search bar in UI. We have 20 odd indices in elasticsearch and we search across those indices. I want to add one more feature called 'Recent Picks' which will list last search terms. What is a best … --- ## [7.10.0 elasticsearch period crash by stackoverflow](https://discuss.elastic.co/t/7-10-0-elasticsearch-period-crash-by-stackoverflow/362864)
**Author:** [@luye19870406](https://discuss.elastic.co/u/luye19870406)\ **Replies:** 2\ **Last updated:** [July 11, 2024, 5:28am UTC](https://discuss.elastic.co/t/7-10-0-elasticsearch-period-crash-by-stackoverflow/362864 "2024-07-11T05:28:43Z")
hello..recentlly I got a weird elasticsearch crash problem and it lasts nearly one month .since I reindex some of my index to enlarge the shards from 1 to 6..and the error like following \[o.e.b.ElasticsearchUncaughtExce… --- ## [Elastic-agent \>= 8.13.x - Apt upgrade not copying state.enc to new installation dir](https://discuss.elastic.co/t/elastic-agent-8-13-x-apt-upgrade-not-copying-state-enc-to-new-installation-dir/362752)
**Author:** [@ceekay](https://discuss.elastic.co/u/ceekay)\ **Replies:** 2\ **Last updated:** [July 10, 2024, 10:16pm UTC](https://discuss.elastic.co/t/elastic-agent-8-13-x-apt-upgrade-not-copying-state-enc-to-new-installation-dir/362752 "2024-07-10T22:16:48Z")
Hi there, It's taken me a while to get to the bottom of this. We're in an airgapped environment and upgrade agents from our local apt mirror of artifacts.elastic.co. Recently, any agents that are upgraded via apt have… --- ## [Isolation level](https://discuss.elastic.co/t/isolation-level/362818)
**Author:** [@Raul\_Uria](https://discuss.elastic.co/u/Raul_Uria)\ **Replies:** 2\ **Last updated:** [July 10, 2024, 8:40pm UTC](https://discuss.elastic.co/t/isolation-level/362818 "2024-07-10T20:40:54Z")
Hi, I´m trying to execute my queries against sql server using "read uncommitted" or "snapshot" isolation level cause I don´t want to lock others while long queries. I think there is no other way to do that but insert it… --- ## [Looking for guidance on how to create a DSL query](https://discuss.elastic.co/t/looking-for-guidance-on-how-to-create-a-dsl-query/362663)
**Author:** [@RobertBM](https://discuss.elastic.co/u/RobertBM)\ **Replies:** 3\ **Last updated:** [July 10, 2024, 7:35pm UTC](https://discuss.elastic.co/t/looking-for-guidance-on-how-to-create-a-dsl-query/362663 "2024-07-10T19:35:44Z")
Hello, please, I am looking for guidance on how to perform a simple search. I have the following set of data: POST /processing\_records/\_bulk {"index":{}} {"processing\_id":"1234","file\_name":"file1.xls","start\_processing… --- ## [Using HTTPS on Elastic Agent](https://discuss.elastic.co/t/using-https-on-elastic-agent/362816)
**Author:** [@Victor\_Santana](https://discuss.elastic.co/u/Victor_Santana)\ **Replies:** 1\ **Last updated:** [July 10, 2024, 5:47pm UTC](https://discuss.elastic.co/t/using-https-on-elastic-agent/362816 "2024-07-10T17:47:19Z")
Hello, I tried to enable SSL on my Elastic Agent communications to use HTTPS like in the doc bellow, but, it didn't worked for me and after trying a lot of things I don't now what else to do. Any help? --- ## [How to sync the timefilter of embeddable visualization with canvas in kibana](https://discuss.elastic.co/t/how-to-sync-the-timefilter-of-embeddable-visualization-with-canvas-in-kibana/362794)
**Author:** [@vijay117](https://discuss.elastic.co/u/vijay117)\ **Replies:** 1\ **Last updated:** [July 10, 2024, 5:36pm UTC](https://discuss.elastic.co/t/how-to-sync-the-timefilter-of-embeddable-visualization-with-canvas-in-kibana/362794 "2024-07-10T17:36:44Z")
I have added a visualization in canvas dashboard, but im unbale to sync the timefilter of the added visualization with canvas time filter [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=204) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=206)