# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=233 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 234 --- ## [In lens breakdown, the "others" is not an accumulated value](https://discuss.elastic.co/t/in-lens-breakdown-the-others-is-not-an-accumulated-value/360162)
**Author:** [@mekanix](https://discuss.elastic.co/u/mekanix)\ **Replies:** 1\ **Last updated:** [May 24, 2024, 1:46pm UTC](https://discuss.elastic.co/t/in-lens-breakdown-the-others-is-not-an-accumulated-value/360162 "2024-05-24T13:46:34Z")
Setup: set of servers that sends filesystem metrics with metricbeat. I'm creating a stacked area visualization in lens with @timestamp on horizontal axis and formula "Maximum" of system.filesystem.used.bytes. I then br… --- ## [Fleet APM and Synthetic Monitors](https://discuss.elastic.co/t/fleet-apm-and-synthetic-monitors/360067)
**Author:** [@catn0b0t](https://discuss.elastic.co/u/catn0b0t)\ **Replies:** 2\ **Last updated:** [May 24, 2024, 1:45pm UTC](https://discuss.elastic.co/t/fleet-apm-and-synthetic-monitors/360067 "2024-05-24T13:45:30Z")
We are looking into deploying APM throughout our fleet of agents (+300), but we are discovering some challenges. Context: These agents are running on appliances we have deployed at our customers. We are looking into usi… --- ## [Best practice about reindex](https://discuss.elastic.co/t/best-practice-about-reindex/360113)
**Author:** [@Frances\_Chu](https://discuss.elastic.co/u/Frances_Chu)\ **Replies:** 3\ **Last updated:** [May 24, 2024, 1:39pm UTC](https://discuss.elastic.co/t/best-practice-about-reindex/360113 "2024-05-24T13:39:35Z")
I got index\_A --\> hold the data 2022 index\_B\_Jan --\> hold the data of jan 2023 index\_B\_Feb --\> hold the data of Feb 2023 index\_B\_Mar --\> hold the data of Mar 2023 ..... index\_B\_Dec --\> hold the data of De… --- ## [Security Detection Rules ( SIEM )](https://discuss.elastic.co/t/security-detection-rules-siem/360163)
**Author:** [@Elk\_huh](https://discuss.elastic.co/u/Elk_huh)\ **Replies:** 0\ **Last updated:** [May 24, 2024, 1:34pm UTC](https://discuss.elastic.co/t/security-detection-rules-siem/360163 "2024-05-24T13:34:01Z")
For the Alerts , Detection rules Under Action when i am trying to output to an email Why doesn't the variable {{context.rule.investigation\_fields}} give me the values of the investigation fields, in the emails i just… --- ## [Lens Line Chart - Average of Sum of Fields Per Session](https://discuss.elastic.co/t/lens-line-chart-average-of-sum-of-fields-per-session/360028)
**Author:** [@sfageol](https://discuss.elastic.co/u/sfageol)\ **Replies:** 7\ **Last updated:** [May 24, 2024, 1:17pm UTC](https://discuss.elastic.co/t/lens-line-chart-average-of-sum-of-fields-per-session/360028 "2024-05-24T13:17:36Z")
I want a line chart that shows the average length of a web session. The issue is that we are logging the numeric value in 4 separate parts with no total logged. Here are my fields per log line: SessionID = 123 Resource… --- ## [Getting the last value from an ElasticSearch index](https://discuss.elastic.co/t/getting-the-last-value-from-an-elasticsearch-index/359800)
**Author:** [@Danyal\_Danish](https://discuss.elastic.co/u/Danyal_Danish)\ **Replies:** 7\ **Last updated:** [May 24, 2024, 1:05pm UTC](https://discuss.elastic.co/t/getting-the-last-value-from-an-elasticsearch-index/359800 "2024-05-24T13:05:05Z")
Hello, I'm trying to get the latest value from my Elasticsearch index but when I execute this, it prints everything in the index on the console. I have also tried doing it using the "DateTime" field but every time I get … --- ## [Kubernetes hints auto-discover: specify parser by stream (filestream input)](https://discuss.elastic.co/t/kubernetes-hints-auto-discover-specify-parser-by-stream-filestream-input/360080)
**Author:** [@VannTen](https://discuss.elastic.co/u/VannTen)\ **Replies:** 1\ **Last updated:** [May 24, 2024, 12:54pm UTC](https://discuss.elastic.co/t/kubernetes-hints-auto-discover-specify-parser-by-stream-filestream-input/360080 "2024-05-24T12:54:39Z")
Hi. I'm trying to have filebeat use a different parser depending on stream of the event (stdout/stderr). This is for ingress-nginx, which has the ability to customize the access log into json, but not error logs, for so… --- ## [How to replace NEST class Attachment?](https://discuss.elastic.co/t/how-to-replace-nest-class-attachment/360074)
**Author:** [@frankmehlhop.com](https://discuss.elastic.co/u/frankmehlhop.com)\ **Replies:** 1\ **Last updated:** [May 24, 2024, 12:47pm UTC](https://discuss.elastic.co/t/how-to-replace-nest-class-attachment/360074 "2024-05-24T12:47:52Z")
I used to use the NEST library. This is now deprecated. I have implemented the recommended Elastic.Client.Elasticsearch. However, this library does not recognise the Attachment or ElasticClient class. How do I deal with… --- ## [Template migration from parent-child to nested give java heap memory issue](https://discuss.elastic.co/t/template-migration-from-parent-child-to-nested-give-java-heap-memory-issue/360147)
**Author:** [@swappy](https://discuss.elastic.co/u/swappy)\ **Replies:** 0\ **Last updated:** [May 24, 2024, 10:45am UTC](https://discuss.elastic.co/t/template-migration-from-parent-child-to-nested-give-java-heap-memory-issue/360147 "2024-05-24T10:45:25Z")
Hello, We are in a process of upgrading our elasticsearch version and for that we decided to convert existing parent-child template\_mapping to nested. During this process one of the scenario where more 10000 nested obje… --- ## [Formula reference documentation](https://discuss.elastic.co/t/formula-reference-documentation/360144)
**Author:** [@anpama](https://discuss.elastic.co/u/anpama)\ **Replies:** 1\ **Last updated:** [May 24, 2024, 10:27am UTC](https://discuss.elastic.co/t/formula-reference-documentation/360144 "2024-05-24T10:27:43Z")
Hello, Is it possible to display the “Formula reference” documentation in a dedicated tab, either on Kibana directly or in the doc? --- ## [SNMP Connecter Error](https://discuss.elastic.co/t/snmp-connecter-error/359967)
**Author:** [@anguri\_sudhakar](https://discuss.elastic.co/u/anguri_sudhakar)\ **Replies:** 6\ **Last updated:** [May 24, 2024, 10:02am UTC](https://discuss.elastic.co/t/snmp-connecter-error/359967 "2024-05-24T10:02:16Z")
Hello, I encountered after upgrading Docker\_elk-8.9.1 to Docker\_ELk\_8.13.1. I clone the latest version of ELK: Docker and Compose.\](GitHub - deviantony/docker-elk: The Elastic stack (ELK) powered by Docker and Compose… --- ## [Kibana search for multiple data views](https://discuss.elastic.co/t/kibana-search-for-multiple-data-views/360134)
**Author:** [@tapiojaa](https://discuss.elastic.co/u/tapiojaa)\ **Replies:** 2\ **Last updated:** [May 24, 2024, 9:34am UTC](https://discuss.elastic.co/t/kibana-search-for-multiple-data-views/360134 "2024-05-24T09:34:40Z")
I've configured spaces where are multiple data views. Is it possible to search from all or certain data views in that space? I've noticed that there is metafield "\_index", but users don't know index names. They only see … --- ## [Wildcard is not working as expected](https://discuss.elastic.co/t/wildcard-is-not-working-as-expected/360117)
**Author:** [@venkatesh\_aamanchi](https://discuss.elastic.co/u/venkatesh_aamanchi)\ **Replies:** 7\ **Last updated:** [May 24, 2024, 8:51am UTC](https://discuss.elastic.co/t/wildcard-is-not-working-as-expected/360117 "2024-05-24T08:51:33Z")
Hello, I am using "wildcard" for matching fields of type text with a specific pattern. "query": { "wildcard": { "description": { "value": "objective\*", "case\_inse… --- ## [Adding multiple conditions in a Kibana watcher](https://discuss.elastic.co/t/adding-multiple-conditions-in-a-kibana-watcher/359897)
**Author:** [@Neha2](https://discuss.elastic.co/u/Neha2)\ **Replies:** 2\ **Last updated:** [May 24, 2024, 8:11am UTC](https://discuss.elastic.co/t/adding-multiple-conditions-in-a-kibana-watcher/359897 "2024-05-24T08:11:49Z")
Hello everyone, I need to set up a watcher in Kibana with the following conditions: a. Trigger an alert when the threshold reaches 100 between 6 AM and 11 AM. b. Trigger an alert when the threshold reaches 400 during o… --- ## [Filebeat MQTT input not connecting to AWS iOT core](https://discuss.elastic.co/t/filebeat-mqtt-input-not-connecting-to-aws-iot-core/360137)
**Author:** [@neoaddix](https://discuss.elastic.co/u/neoaddix)\ **Replies:** 0\ **Last updated:** [May 24, 2024, 7:34am UTC](https://discuss.elastic.co/t/filebeat-mqtt-input-not-connecting-to-aws-iot-core/360137 "2024-05-24T07:34:23Z")
Hi, I'm trying to configure a filebeat setup that listens to MQTT topics and outputs them to Elasticsearch. As the MQTT server we are using AWS iOT core. Our software is able to connect to the MQTT server, I also have a… --- ## [Setting up ES multi-node on multiple hosts](https://discuss.elastic.co/t/setting-up-es-multi-node-on-multiple-hosts/360063)
**Author:** [@Hugo\_Perez\_Fernandez](https://discuss.elastic.co/u/Hugo_Perez_Fernandez)\ **Replies:** 2\ **Last updated:** [May 24, 2024, 6:58am UTC](https://discuss.elastic.co/t/setting-up-es-multi-node-on-multiple-hosts/360063 "2024-05-24T06:58:56Z")
Hi all, When creating an Elasticsearch cluster using Docker with multiple nodes, where each one runs on its own host, a problem arises when forming the cluster when the containers are raised, because it cannot be formed… --- ## [Elasticsearch missing authentication credentials for REST request and won't let me setup elasticsearch passwords](https://discuss.elastic.co/t/elasticsearch-missing-authentication-credentials-for-rest-request-and-wont-let-me-setup-elasticsearch-passwords/359887)
**Author:** [@daniela09](https://discuss.elastic.co/u/daniela09)\ **Replies:** 3\ **Last updated:** [May 24, 2024, 5:52am UTC](https://discuss.elastic.co/t/elasticsearch-missing-authentication-credentials-for-rest-request-and-wont-let-me-setup-elasticsearch-passwords/359887 "2024-05-24T05:52:40Z")
I deployed Elasticsearch on Kubernetes and its running but I get these errors in my logs: "message":"monitoring execution failed", "ecs.version": "1.2.0","service.name":"ES\_ECS","event.dataset":"elasticsearch.server","p… --- ## [EsIntegTestCase in es8 cannot be used to test with RHLC?](https://discuss.elastic.co/t/esintegtestcase-in-es8-cannot-be-used-to-test-with-rhlc/360030)
**Author:** [@buitcj](https://discuss.elastic.co/u/buitcj)\ **Replies:** 5\ **Last updated:** [May 24, 2024, 5:50am UTC](https://discuss.elastic.co/t/esintegtestcase-in-es8-cannot-be-used-to-test-with-rhlc/360030 "2024-05-24T05:50:48Z")
I have automated tests that make use of the Rest High Level Client (RHLC) to communicate with an HA Elasticsearch cluster created using EsIntegTestCase to run the cluster in the JVM/process. I was previously testing agai… --- ## [File input from a directory mounted with blobfuse](https://discuss.elastic.co/t/file-input-from-a-directory-mounted-with-blobfuse/360031)
**Author:** [@syo04suke26](https://discuss.elastic.co/u/syo04suke26)\ **Replies:** 2\ **Last updated:** [May 24, 2024, 12:24am UTC](https://discuss.elastic.co/t/file-input-from-a-directory-mounted-with-blobfuse/360031 "2024-05-24T00:24:42Z")
\[background\] We are considering an architecture that imports external service log files stored in Azure Storage into Logstash. Log files are intermittently put to Storage, and once stored, the files are never updated. … --- ## [Elasticsearch 7.16.2 Snapshot Status Error: 'duration cannot be negative'](https://discuss.elastic.co/t/elasticsearch-7-16-2-snapshot-status-error-duration-cannot-be-negative/359721)
**Author:** [@Anastasia\_Kornienko](https://discuss.elastic.co/u/Anastasia_Kornienko)\ **Replies:** 2\ **Last updated:** [May 23, 2024, 9:30pm UTC](https://discuss.elastic.co/t/elasticsearch-7-16-2-snapshot-status-error-duration-cannot-be-negative/359721 "2024-05-23T21:30:26Z")
Hello, I'm encountering an error when trying to check the status of a snapshot. The situation is as follows: I have an Elasticsearch 7.16.2 cluster consisting of 5 nodes. One node is currently unavailable while a snaps… --- ## [Enabling/Disabling Elastic agents remotely after they have been added to a fleet](https://discuss.elastic.co/t/enabling-disabling-elastic-agents-remotely-after-they-have-been-added-to-a-fleet/360089)
**Author:** [@JayAskrenPureStorage](https://discuss.elastic.co/u/JayAskrenPureStorage)\ **Replies:** 1\ **Last updated:** [May 23, 2024, 8:13pm UTC](https://discuss.elastic.co/t/enabling-disabling-elastic-agents-remotely-after-they-have-been-added-to-a-fleet/360089 "2024-05-23T20:13:29Z")
We want to install the Elastic Agent on our OS image so all servers have the agent by default. We want to have these agents not report metrics by default but have the ability to turn them on remotely and report to the f… --- ## [Duplicate message field in Syslog parsing logs](https://discuss.elastic.co/t/duplicate-message-field-in-syslog-parsing-logs/360101)
**Author:** [@mcambria](https://discuss.elastic.co/u/mcambria)\ **Replies:** 0\ **Last updated:** [May 23, 2024, 6:26pm UTC](https://discuss.elastic.co/t/duplicate-message-field-in-syslog-parsing-logs/360101 "2024-05-23T18:26:54Z")
We are using Filebeat 8.8.2 to parse syslogs. When it fails to parse a syslog, it logs a json error message that has duplicate "message" keys, making it invalid json - I believe this is a bug. This occurs with multiple… --- ## [Elastic is failing to start with error Failed to parse mappings for index](https://discuss.elastic.co/t/elastic-is-failing-to-start-with-error-failed-to-parse-mappings-for-index/360012)
**Author:** [@ermisma](https://discuss.elastic.co/u/ermisma)\ **Replies:** 1\ **Last updated:** [May 23, 2024, 5:31pm UTC](https://discuss.elastic.co/t/elastic-is-failing-to-start-with-error-failed-to-parse-mappings-for-index/360012 "2024-05-23T17:31:53Z")
Elasticsearch fail to start with following error Error1 : Failed to parse mappings for index \[\[atlaslog\_latest/CwYSy1IAT9upXlq7inaeJg\]\] Error2: unexpected exception while waiting for http server to close I see root d… --- ## [Lowercase host.name FQDN Beta Fleet policy setting](https://discuss.elastic.co/t/lowercase-host-name-fqdn-beta-fleet-policy-setting/360047)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 3\ **Last updated:** [May 23, 2024, 3:37pm UTC](https://discuss.elastic.co/t/lowercase-host-name-fqdn-beta-fleet-policy-setting/360047 "2024-05-23T15:37:51Z")
Hello, We are working through an effort to make sure host.name is indexed as lowercase fqdn everywhere. We put the original hostname in host.hostname. Considering we have multiple domains, this is not only necessary to… --- ## [Index documents with out type](https://discuss.elastic.co/t/index-documents-with-out-type/360087)
**Author:** [@gjahagir](https://discuss.elastic.co/u/gjahagir)\ **Replies:** 0\ **Last updated:** [May 23, 2024, 3:23pm UTC](https://discuss.elastic.co/t/index-documents-with-out-type/360087 "2024-05-23T15:23:13Z")
Hi, We have legacy code that utilizes NEST to index documents that are not backed by POCO. It builds JSON and calls lowlevel bulk index api to index the documents. The reason for this is that we do not know the propert… --- ## [How remove the red cross "Fields were not found](https://discuss.elastic.co/t/how-remove-the-red-cross-fields-were-not-found/359991)
**Author:** [@jeromeguillaume](https://discuss.elastic.co/u/jeromeguillaume)\ **Replies:** 4\ **Last updated:** [May 23, 2024, 3:02pm UTC](https://discuss.elastic.co/t/how-remove-the-red-cross-fields-were-not-found/359991 "2024-05-23T15:02:12Z")
When sometimes some fields are not there there is a red cross icon saying: "Fields a.b.c, d.e.f were not found." Can we disable this message? I found some blogs referring to "Hide missing fields" option but I was not ab… --- ## [Missing application roles. API required roles: Incident.Read.All,Incident.ReadWrite.All, application roles](https://discuss.elastic.co/t/missing-application-roles-api-required-roles-incident-read-all-incident-readwrite-all-application-roles/360019)
**Author:** [@Van\_Howell](https://discuss.elastic.co/u/Van_Howell)\ **Replies:** 2\ **Last updated:** [May 23, 2024, 1:14pm UTC](https://discuss.elastic.co/t/missing-application-roles-api-required-roles-incident-read-all-incident-readwrite-all-application-roles/360019 "2024-05-23T13:14:55Z")
I am using the Filebeat Microsoft module to ingest Defender Endpoint logs. I have setup an App on the Azure AD site and added the documented permissions. I am getting a message that indicates I do not have the required r… --- ## [Concatenate message header and content, parse message content](https://discuss.elastic.co/t/concatenate-message-header-and-content-parse-message-content/360077)
**Author:** [@tohkoecalo](https://discuss.elastic.co/u/tohkoecalo)\ **Replies:** 0\ **Last updated:** [May 23, 2024, 1:01pm UTC](https://discuss.elastic.co/t/concatenate-message-header-and-content-parse-message-content/360077 "2024-05-23T13:01:03Z")
I setup filebeat to send logs to elasticsearch but for now I have two problems. First, I receive my message header and content in two separate records. In Kibana interface they are shown like this: But in source fil… --- ## [Kibana VIP](https://discuss.elastic.co/t/kibana-vip/360073)
**Author:** [@Manal\_A](https://discuss.elastic.co/u/Manal_A)\ **Replies:** 5\ **Last updated:** [May 23, 2024, 1:03pm UTC](https://discuss.elastic.co/t/kibana-vip/360073 "2024-05-23T13:03:41Z")
Hello, My Elasticsearch is sending data to two distinct Kibana instances, and it works with two different URLs. Now, I want to use a VIP (Virtual IP) for these two Kibana instances. Do I need to modify my kibana.yml c… --- ## [Kibana 8.11.1 Dev and IPV6](https://discuss.elastic.co/t/kibana-8-11-1-dev-and-ipv6/359560)
**Author:** [@kbujold\_wr](https://discuss.elastic.co/u/kbujold_wr)\ **Replies:** 1\ **Last updated:** [May 23, 2024, 1:00pm UTC](https://discuss.elastic.co/t/kibana-8-11-1-dev-and-ipv6/359560 "2024-05-23T13:00:00Z")
Hi I am trying to use Kibana 8.11.1 in a dev environment with an IPV6 system using this config below elasticsearch.hosts: - https://\[2400:10a:a001:aa0c::89\]:31001/mon-elasticsearch-client elasticsearch.ssl.verificatio… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=232) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=234)