# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=243 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 244 --- ## [What does this logstash filter do?](https://discuss.elastic.co/t/what-does-this-logstash-filter-do/359229)
**Author:** [@moomoo21](https://discuss.elastic.co/u/moomoo21)\ **Replies:** 5\ **Last updated:** [May 10, 2024, 12:30pm UTC](https://discuss.elastic.co/t/what-does-this-logstash-filter-do/359229 "2024-05-10T12:30:10Z")
Im having trouble understanding what does this logstash filter do: if ("" in \[somefield1\]\[somefield2\]){ drop{} } what does "" in the field mean? --- ## [Unable to get the field value of context.group.agent.name while configuring the alerts to index connector](https://discuss.elastic.co/t/unable-to-get-the-field-value-of-context-group-agent-name-while-configuring-the-alerts-to-index-connector/359014)
**Author:** [@Subrahmanyam\_Veerank](https://discuss.elastic.co/u/Subrahmanyam_Veerank)\ **Replies:** 4\ **Last updated:** [May 10, 2024, 11:31am UTC](https://discuss.elastic.co/t/unable-to-get-the-field-value-of-context-group-agent-name-while-configuring-the-alerts-to-index-connector/359014 "2024-05-10T11:31:17Z")
While configuring the custom threshold rule in kibana with index connector im not able to get the value for field context.group.agent.name. As i want to use agent.name in another field/keyword. what is the syntax to get … --- ## [Why the slow query doesn't log in slowlog file](https://discuss.elastic.co/t/why-the-slow-query-doesnt-log-in-slowlog-file/359255)
**Author:** [@DJ\_Zhu](https://discuss.elastic.co/u/DJ_Zhu)\ **Replies:** 0\ **Last updated:** [May 10, 2024, 11:30am UTC](https://discuss.elastic.co/t/why-the-slow-query-doesnt-log-in-slowlog-file/359255 "2024-05-10T11:30:35Z")
Server Version: 6.8.6 On the client side, the response indicates that the query execution time was 394ms: {"took":394,"timed\_out":false,"\_shards":{"total":5,"successful":5,"failed":0},"hits": However, despite setting … --- ## [Search api returns no documents](https://discuss.elastic.co/t/search-api-returns-no-documents/359053)
**Author:** [@jgeek](https://discuss.elastic.co/u/jgeek)\ **Replies:** 4\ **Last updated:** [May 10, 2024, 11:22am UTC](https://discuss.elastic.co/t/search-api-returns-no-documents/359053 "2024-05-10T11:22:06Z")
We're encountering a delay in real-time data retrieval from Elasticsearch despite successfully inserting data through our Java Spring Boot producer application. Our consumer application relies on Elasticsearch's /\_searc… --- ## [Basic runtime fields to pull data from message field](https://discuss.elastic.co/t/basic-runtime-fields-to-pull-data-from-message-field/355372)
**Author:** [@randomnamegenerator](https://discuss.elastic.co/u/randomnamegenerator)\ **Replies:** 1\ **Last updated:** [May 10, 2024, 9:36am UTC](https://discuss.elastic.co/t/basic-runtime-fields-to-pull-data-from-message-field/355372 "2024-05-10T09:36:48Z")
Hello all, I am trying to create a series of runtime fields to extract additional data fields from the message field. If it makes any difference this is a EFK stack running in K8s. For example I want to create level fi… --- ## [Parse Kibana Saved Search Metadata and build elastic DSL to query elastic index](https://discuss.elastic.co/t/parse-kibana-saved-search-metadata-and-build-elastic-dsl-to-query-elastic-index/359242)
**Author:** [@yarramreddysasi](https://discuss.elastic.co/u/yarramreddysasi)\ **Replies:** 0\ **Last updated:** [May 10, 2024, 8:43am UTC](https://discuss.elastic.co/t/parse-kibana-saved-search-metadata-and-build-elastic-dsl-to-query-elastic-index/359242 "2024-05-10T08:43:52Z")
Hello there , I am working on a project where user are asked to create saved searches as per their requirement on the single elastic index available through discover page . Now I will have to download this saved search … --- ## [How to search in Kibana only indices in hot and warm phase?](https://discuss.elastic.co/t/how-to-search-in-kibana-only-indices-in-hot-and-warm-phase/359190)
**Author:** [@Nicoletta](https://discuss.elastic.co/u/Nicoletta)\ **Replies:** 2\ **Last updated:** [May 10, 2024, 8:38am UTC](https://discuss.elastic.co/t/how-to-search-in-kibana-only-indices-in-hot-and-warm-phase/359190 "2024-05-10T08:38:22Z")
Hello, I would like to limit my search only on indices in hot and warm phase. I am aware of this metadata field but I can't see this field available in my Data View. Any suggestions? Thanks, Nicoletta --- ## [\[JAVA\] Client CreateIndexRequest is failing with dynamic templates](https://discuss.elastic.co/t/java-client-createindexrequest-is-failing-with-dynamic-templates/359217)
**Author:** [@nkachami](https://discuss.elastic.co/u/nkachami)\ **Replies:** 1\ **Last updated:** [May 10, 2024, 8:24am UTC](https://discuss.elastic.co/t/java-client-createindexrequest-is-failing-with-dynamic-templates/359217 "2024-05-10T08:24:23Z")
Using: \ \co.elastic.clients\ \elasticsearch-java\ \8.13.4\ \ When executing something like: CreateIndexRequest c… --- ## [Snapshot specific index/aliases elasticsearch version 8.12.0](https://discuss.elastic.co/t/snapshot-specific-index-aliases-elasticsearch-version-8-12-0/359147)
**Author:** [@Shashank\_Jain](https://discuss.elastic.co/u/Shashank_Jain)\ **Replies:** 1\ **Last updated:** [May 10, 2024, 7:00am UTC](https://discuss.elastic.co/t/snapshot-specific-index-aliases-elasticsearch-version-8-12-0/359147 "2024-05-10T07:00:30Z")
Hi all, I would like to take a snapshot of specific indexes containing certain aliases.Is it possible to do so, if yes, please can you advise? Thank you --- ## [Winlogbeat configuration for index rollover](https://discuss.elastic.co/t/winlogbeat-configuration-for-index-rollover/359163)
**Author:** [@a.gavric](https://discuss.elastic.co/u/a.gavric)\ **Replies:** 2\ **Last updated:** [May 9, 2024, 1:06pm UTC](https://discuss.elastic.co/t/winlogbeat-configuration-for-index-rollover/359163 "2024-05-09T13:06:45Z")
Hello Everyone we have been testing a configuration for Winlogbeat for windows event log ingestion and with the out of the box configuration of about 60 machines we have noticed that we have over 70GB of data per month n… --- ## [Update license API](https://discuss.elastic.co/t/update-license-api/359032)
**Author:** [@artechkey](https://discuss.elastic.co/u/artechkey)\ **Replies:** 3\ **Last updated:** [May 10, 2024, 6:23am UTC](https://discuss.elastic.co/t/update-license-api/359032 "2024-05-10T06:23:04Z")
Hi, We are trying to update the license on our cluster from "basic" to a higher one. We are planning on using the "update license" API to apply the new license. https://www.elastic.co/guide/en/elasticsearch/reference/7… --- ## [How do I renew my elasticsearch self signed certificate which will not have impact on logstash vms](https://discuss.elastic.co/t/how-do-i-renew-my-elasticsearch-self-signed-certificate-which-will-not-have-impact-on-logstash-vms/358096)
**Author:** [@sudhir\_singh](https://discuss.elastic.co/u/sudhir_singh)\ **Replies:** 10\ **Last updated:** [May 10, 2024, 6:04am UTC](https://discuss.elastic.co/t/how-do-i-renew-my-elasticsearch-self-signed-certificate-which-will-not-have-impact-on-logstash-vms/358096 "2024-05-10T06:04:47Z")
Hi Everyone. My elasticsearch self signed certificate is about to expire and I have More than thousands of logstash vms which I'm using for logstash data ingestion to elasticsearch and I'm using the elasticsearch credent… --- ## [ESET PROTECT syslog cannot be retrieved correctly](https://discuss.elastic.co/t/eset-protect-syslog-cannot-be-retrieved-correctly/359222)
**Author:** [@kagawa](https://discuss.elastic.co/u/kagawa)\ **Replies:** 0\ **Last updated:** [May 10, 2024, 2:24am UTC](https://discuss.elastic.co/t/eset-protect-syslog-cannot-be-retrieved-correctly/359222 "2024-05-10T02:24:12Z")
Hellow, I am currently trying to analyze the logs using ESET PROTECT Integrations. I can get the logs from the API, but syslog is giving me errors. "error": { "message": \[ "syslog failed to process field… --- ## [Issue with @timestamp field when importing data from SQL Server to Elasticsearch using Logstash](https://discuss.elastic.co/t/issue-with-timestamp-field-when-importing-data-from-sql-server-to-elasticsearch-using-logstash/359209)
**Author:** [@hcherry](https://discuss.elastic.co/u/hcherry)\ **Replies:** 6\ **Last updated:** [May 9, 2024, 11:04pm UTC](https://discuss.elastic.co/t/issue-with-timestamp-field-when-importing-data-from-sql-server-to-elasticsearch-using-logstash/359209 "2024-05-09T23:04:06Z")
Hello, I’m currently trying to import log data from a SQL Server database table into Elasticsearch using Logstash. The SQL table includes a field named “logDateTime” for the timestamp of the log entries. I want to use t… --- ## [Sort buckets by count in terms aggregation using java api client](https://discuss.elastic.co/t/sort-buckets-by-count-in-terms-aggregation-using-java-api-client/359215)
**Author:** [@Rohini1](https://discuss.elastic.co/u/Rohini1)\ **Replies:** 0\ **Last updated:** [May 9, 2024, 8:15pm UTC](https://discuss.elastic.co/t/sort-buckets-by-count-in-terms-aggregation-using-java-api-client/359215 "2024-05-09T20:15:14Z")
I want to sort buckets by doc count in terms aggregation and also sort buckets by sub aggregation --- ## [Import JSON Schema for ECS Events](https://discuss.elastic.co/t/import-json-schema-for-ecs-events/358883)
**Author:** [@vances](https://discuss.elastic.co/u/vances)\ **Replies:** 5\ **Last updated:** [May 9, 2024, 5:50pm UTC](https://discuss.elastic.co/t/import-json-schema-for-ecs-events/358883 "2024-05-09T17:50:03Z")
Having written meticulous JSON Schema files, using the Elastic Common Schema (ECS) guidelines, describing our events I am surprised to find no obvious way to import and use those schemas in Elastic Stack. Am I missing s… --- ## [Unable to install multi-node cluster - Skipping security auto configuration because this node is configured to bootstrap or to join a multi-node cluster, which is not supported., with exit code 80](https://discuss.elastic.co/t/unable-to-install-multi-node-cluster-skipping-security-auto-configuration-because-this-node-is-configured-to-bootstrap-or-to-join-a-multi-node-cluster-which-is-not-supported-with-exit-code-80/358229)
**Author:** [@jimmycricket](https://discuss.elastic.co/u/jimmycricket)\ **Replies:** 15\ **Last updated:** [May 9, 2024, 5:26pm UTC](https://discuss.elastic.co/t/unable-to-install-multi-node-cluster-skipping-security-auto-configuration-because-this-node-is-configured-to-bootstrap-or-to-join-a-multi-node-cluster-which-is-not-supported-with-exit-code-80/358229 "2024-05-09T17:26:40Z")
I am trying to perform the initial installation of a two node Elasticsearch cluster. This is on Ubuntu 22.04 with Elasticsearch version 8.13 installed via RPM. This is the contents of the file /etc/elasticsearch/elastic… --- ## [Why "knn\_query" doesn’t have a separate k parameter?](https://discuss.elastic.co/t/why-knn-query-doesn-t-have-a-separate-k-parameter/358727)
**Author:** [@alliswell](https://discuss.elastic.co/u/alliswell)\ **Replies:** 13\ **Last updated:** [May 9, 2024, 5:00pm UTC](https://discuss.elastic.co/t/why-knn-query-doesn-t-have-a-separate-k-parameter/358727 "2024-05-09T17:00:08Z")
Thanks elastic team, for adding knn\_query. Now with knn\_query it is possible to use function\_score or script\_score and influence the rank of vector search result and not solely rely on the cosine similarity score. This w… --- ## [Math Calculation in Elastic Watcher not working](https://discuss.elastic.co/t/math-calculation-in-elastic-watcher-not-working/359178)
**Author:** [@Santosh\_G](https://discuss.elastic.co/u/Santosh_G)\ **Replies:** 3\ **Last updated:** [May 9, 2024, 4:57pm UTC](https://discuss.elastic.co/t/math-calculation-in-elastic-watcher-not-working/359178 "2024-05-09T16:57:02Z")
I had the below response I am receiving from Elastic dev tools and I need to calculate the % difference increase/decrease between the 2 aggregation count. { "alternative\_input": { "hits": { "total": { "value": 3390… --- ## [Customize Permission Denied Message](https://discuss.elastic.co/t/customize-permission-denied-message/359204)
**Author:** [@zach.stanfill4627](https://discuss.elastic.co/u/zach.stanfill4627)\ **Replies:** 0\ **Last updated:** [May 9, 2024, 4:41pm UTC](https://discuss.elastic.co/t/customize-permission-denied-message/359204 "2024-05-09T16:41:39Z")
Is there any way to customize the Kibana Permission to access the requested page message? We would like something along the lines of "If you need to request access, please contact John.Doe at 000-000-0000 or john.doe… --- ## [Alerts not showing up in Kibana](https://discuss.elastic.co/t/alerts-not-showing-up-in-kibana/359199)
**Author:** [@vector1one](https://discuss.elastic.co/u/vector1one)\ **Replies:** 0\ **Last updated:** [May 9, 2024, 4:01pm UTC](https://discuss.elastic.co/t/alerts-not-showing-up-in-kibana/359199 "2024-05-09T16:01:59Z")
Looking for some help on this one, read the docs but just cant figure out what I'm missing. I have set up elasticsearch, kibana, fleet and security with all the rules but nothing is showing up in Security \> alerts, how… --- ## [Elasticsearch s3 snapshots](https://discuss.elastic.co/t/elasticsearch-s3-snapshots/359115)
**Author:** [@kannan\_raj](https://discuss.elastic.co/u/kannan_raj)\ **Replies:** 3\ **Last updated:** [May 9, 2024, 4:00pm UTC](https://discuss.elastic.co/t/elasticsearch-s3-snapshots/359115 "2024-05-09T16:00:04Z")
Hello Team, Is it possible to configure or change the medata service or sts service endpoint when creating s3 snapshot with InstanceProfileCredentialsProvider authentication method. I have tried with setting the env bu… --- ## [Frequent shards failure remediation](https://discuss.elastic.co/t/frequent-shards-failure-remediation/358746)
**Author:** [@Jhankar\_jha](https://discuss.elastic.co/u/Jhankar_jha)\ **Replies:** 4\ **Last updated:** [May 9, 2024, 3:18pm UTC](https://discuss.elastic.co/t/frequent-shards-failure-remediation/358746 "2024-05-09T15:18:17Z")
Hii Folks, Does anyone can help if there exists an api command to get the number of used, unused and total shards of my elasticsearch cluster? Additionally, How can i increase the total number of shards of my multi nod… --- ## [EsRejectedExecutionException - Need suggestions to overcome](https://discuss.elastic.co/t/esrejectedexecutionexception-need-suggestions-to-overcome/359173)
**Author:** [@navaneethan](https://discuss.elastic.co/u/navaneethan)\ **Replies:** 4\ **Last updated:** [May 9, 2024, 2:53pm UTC](https://discuss.elastic.co/t/esrejectedexecutionexception-need-suggestions-to-overcome/359173 "2024-05-09T14:53:35Z")
Hi Team, In our production env cluster we are getting EsRejectedExecutionException for some requests. We have observed that there is a recurring thread running by a particular customer which are doing indexing and occu… --- ## [Sequence Number Generation](https://discuss.elastic.co/t/sequence-number-generation/358563)
**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 3\ **Last updated:** [May 9, 2024, 2:39pm UTC](https://discuss.elastic.co/t/sequence-number-generation/358563 "2024-05-09T14:39:13Z")
We would like to annotate our inbound log messages with sequence numbers which we can then use to detect and measure message loss. What is the best way to go about this? Use in-line ruby code to generate sequence number… --- ## [How to create columns instead rows in Logstash with aggregate or other plugin](https://discuss.elastic.co/t/how-to-create-columns-instead-rows-in-logstash-with-aggregate-or-other-plugin/359124)
**Author:** [@epreciado](https://discuss.elastic.co/u/epreciado)\ **Replies:** 0\ **Last updated:** [May 9, 2024, 4:26am UTC](https://discuss.elastic.co/t/how-to-create-columns-instead-rows-in-logstash-with-aggregate-or-other-plugin/359124 "2024-05-09T04:26:56Z")
I have a log similar to this and I need to get these lines and upload in kibana: \[03/07/2024 00:00:31.306\]\[123456\]\[newRequest\]\[Request\]\[Company|signature|L|id|123456789|0987654321\] \[03/07/2024 00:00:31.634\]\[123456\]\[Comp… --- ## [How to monitor udp protocol (new protocol)](https://discuss.elastic.co/t/how-to-monitor-udp-protocol-new-protocol/359184)
**Author:** [@Alisher\_Nabiev](https://discuss.elastic.co/u/Alisher_Nabiev)\ **Replies:** 1\ **Last updated:** [May 9, 2024, 2:00pm UTC](https://discuss.elastic.co/t/how-to-monitor-udp-protocol-new-protocol/359184 "2024-05-09T14:00:31Z")
hi, i need to sniff traffic from udp custom port. i tried this conf but no success: " - type: udp include\_fields: \["total\_length", "protocol", "source.ip", "destination.ip", "source.port", "destination.port"\] incl… --- ## [Create a role with only privileges to create new kibana space](https://discuss.elastic.co/t/create-a-role-with-only-privileges-to-create-new-kibana-space/359078)
**Author:** [@Pavani\_Reddy](https://discuss.elastic.co/u/Pavani_Reddy)\ **Replies:** 3\ **Last updated:** [May 9, 2024, 1:54pm UTC](https://discuss.elastic.co/t/create-a-role-with-only-privileges-to-create-new-kibana-space/359078 "2024-05-09T13:54:53Z")
Hello Team, I need to a role with min privileges, such that user will be able to create new space on kibana. inbuilt roles will have more privileges than our requirement, I cannot use that. So please help with creatin… --- ## [There's a nasty issue with filtering the aggregation results for nested documents](https://discuss.elastic.co/t/theres-a-nasty-issue-with-filtering-the-aggregation-results-for-nested-documents/359192)
**Author:** [@young\_karl](https://discuss.elastic.co/u/young_karl)\ **Replies:** 0\ **Last updated:** [May 9, 2024, 1:33pm UTC](https://discuss.elastic.co/t/theres-a-nasty-issue-with-filtering-the-aggregation-results-for-nested-documents/359192 "2024-05-09T13:33:41Z")
Regarding the following index: For each document's nested sub-document tradeRecords, internally group them and count the number of tradeRecords where tradeRecords.tradeDate falls between \[1647273600000, 1674144000000\],… --- ## [Setup Elasticsearch for In-Memory Usage: Configuration and Index Size Estimation](https://discuss.elastic.co/t/setup-elasticsearch-for-in-memory-usage-configuration-and-index-size-estimation/359054)
**Author:** [@M.S.S](https://discuss.elastic.co/u/M.S.S)\ **Replies:** 5\ **Last updated:** [May 9, 2024, 1:12pm UTC](https://discuss.elastic.co/t/setup-elasticsearch-for-in-memory-usage-configuration-and-index-size-estimation/359054 "2024-05-09T13:12:44Z")
Hey everyone, We're looking into maximizing Elasticsearch's performance by leveraging memory usage to its fullest potential. We hypothesize that reducing disk I/O by running Elasticsearch entirely in memory could lead t… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=242) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=244)