# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=245 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 246 --- ## [Display log message in kibana alerting](https://discuss.elastic.co/t/display-log-message-in-kibana-alerting/358504)
**Author:** [@Roshan\_Joel](https://discuss.elastic.co/u/Roshan_Joel)\ **Replies:** 5\ **Last updated:** [May 8, 2024, 1:35pm UTC](https://discuss.elastic.co/t/display-log-message-in-kibana-alerting/358504 "2024-05-08T13:35:57Z")
how to display entire log message or log field in kibana alerting --- ## [Visualizations in Kibana to Display Last Updated Instance of Records](https://discuss.elastic.co/t/visualizations-in-kibana-to-display-last-updated-instance-of-records/358072)
**Author:** [@seanmb](https://discuss.elastic.co/u/seanmb)\ **Replies:** 3\ **Last updated:** [May 8, 2024, 1:35pm UTC](https://discuss.elastic.co/t/visualizations-in-kibana-to-display-last-updated-instance-of-records/358072 "2024-05-08T13:35:00Z")
Good day, I am relatively new to the ELK stack and still getting use to how things are done. I am working on a solution to provide ATM statuses (whether up or down) in the form of a dashboard. I have a csv file that l… --- ## [Http\_poller timezone is not being recognized](https://discuss.elastic.co/t/http-poller-timezone-is-not-being-recognized/358980)
**Author:** [@kishorkumar](https://discuss.elastic.co/u/kishorkumar)\ **Replies:** 3\ **Last updated:** [May 8, 2024, 1:31pm UTC](https://discuss.elastic.co/t/http-poller-timezone-is-not-being-recognized/358980 "2024-05-08T13:31:21Z")
I am trying to run http\_poller form logstash local machine input { http\_poller { urls =\> { test1 =\> "https://randomuser.me/api" } request\_timeout =\> 60 schedule =\> { cron =\> "\* \* \* \* \* UTC"} cod… --- ## [Error Issue:- Exiting: error connecting to Kibana: fail to get the Kibana version: fail to unmarshal the response from GET htttp://--/api/status](https://discuss.elastic.co/t/error-issue-exiting-error-connecting-to-kibana-fail-to-get-the-kibana-version-fail-to-unmarshal-the-response-from-get-htttp-api-status/359066)
**Author:** [@UditC](https://discuss.elastic.co/u/UditC)\ **Replies:** 0\ **Last updated:** [May 8, 2024, 1:10pm UTC](https://discuss.elastic.co/t/error-issue-exiting-error-connecting-to-kibana-fail-to-get-the-kibana-version-fail-to-unmarshal-the-response-from-get-htttp-api-status/359066 "2024-05-08T13:10:51Z")
Hello Everyone, I am new to Elastic Stack environment and trying to load some logs on the dashboard. While running the Elasticsearch via power shell, I am having the mentioned error. Does anyone know how could I deal wi… --- ## [Cluster rebalancing](https://discuss.elastic.co/t/cluster-rebalancing/359057)
**Author:** [@Atefeh](https://discuss.elastic.co/u/Atefeh)\ **Replies:** 2\ **Last updated:** [May 8, 2024, 1:06pm UTC](https://discuss.elastic.co/t/cluster-rebalancing/359057 "2024-05-08T13:06:34Z")
I have an issue with ES automatic rebalancing shards in my cluster: I’m using Elasticsearch 7.17.9 I have a cluster with 17 data nodes that all of them have data role Data nodes already have cluster.routing.allocation.… --- ## [Best practices to create dashboards with historical data indexes](https://discuss.elastic.co/t/best-practices-to-create-dashboards-with-historical-data-indexes/358641)
**Author:** [@PMF](https://discuss.elastic.co/u/PMF)\ **Replies:** 3\ **Last updated:** [May 8, 2024, 12:13pm UTC](https://discuss.elastic.co/t/best-practices-to-create-dashboards-with-historical-data-indexes/358641 "2024-05-08T12:13:34Z")
Hi. First time posting here, I'm also quite newbie working with ELK so plz be patient. We are studying how to build some dashboards across an index where we are storing historical data of our notification system. Each … --- ## [Is there a way to combine scoring and highlighting from two separate (stemmer) fields?](https://discuss.elastic.co/t/is-there-a-way-to-combine-scoring-and-highlighting-from-two-separate-stemmer-fields/359044)
**Author:** [@mrodent](https://discuss.elastic.co/u/mrodent)\ **Replies:** 1\ **Last updated:** [May 8, 2024, 10:57am UTC](https://discuss.elastic.co/t/is-there-a-way-to-combine-scoring-and-highlighting-from-two-separate-stemmer-fields/359044 "2024-05-08T10:57:31Z")
I've indexed a whole load of .docx files: each file is split up into (overlapping) sequences of 10 paragraphs while parsing. So each LDoc (Lucene document) in the index consists of 10 paragraphs of text. In these docume… --- ## [Missing documents when using re-index API](https://discuss.elastic.co/t/missing-documents-when-using-re-index-api/358824)
**Author:** [@SamehSaeed](https://discuss.elastic.co/u/SamehSaeed)\ **Replies:** 10\ **Last updated:** [May 8, 2024, 10:34am UTC](https://discuss.elastic.co/t/missing-documents-when-using-re-index-api/358824 "2024-05-08T10:34:12Z")
Hello, I'm facing an issue while using re-index API. Currently we have 1 index per day of data which leaves is with just 100 days of data visible on the dashboard (cuz of the data view limitation) so I was trying to re… --- ## [Search rate and index latency is high and showing high response](https://discuss.elastic.co/t/search-rate-and-index-latency-is-high-and-showing-high-response/359046)
**Author:** [@sudhir\_singh](https://discuss.elastic.co/u/sudhir_singh)\ **Replies:** 0\ **Last updated:** [May 8, 2024, 10:15am UTC](https://discuss.elastic.co/t/search-rate-and-index-latency-is-high-and-showing-high-response/359046 "2024-05-08T10:15:08Z")
I'm using elasticsearch as database but I'm facing momentary surge in search rate and latency. Can anyone tell why there is a high search rate and latency observerd I have 10 nodes of cluster which are physical vms. It's… --- ## [Docker swarm multi-node ElasticSearch cluster error](https://discuss.elastic.co/t/docker-swarm-multi-node-elasticsearch-cluster-error/358978)
**Author:** [@taras\_volosheniuk](https://discuss.elastic.co/u/taras_volosheniuk)\ **Replies:** 0\ **Last updated:** [May 7, 2024, 5:41pm UTC](https://discuss.elastic.co/t/docker-swarm-multi-node-elasticsearch-cluster-error/358978 "2024-05-07T17:41:42Z")
I'm trying to setup docker swarm elasticsearch multi-node cluster. Here is my compose file: elasticsearch: image: elastic/elasticsearch:8.13.0 hostname: elasticsearch environment: - c… --- ## [What might be wrong with this attempt to highlight ES results?](https://discuss.elastic.co/t/what-might-be-wrong-with-this-attempt-to-highlight-es-results/356918)
**Author:** [@mrodent](https://discuss.elastic.co/u/mrodent)\ **Replies:** 5\ **Last updated:** [May 8, 2024, 9:55am UTC](https://discuss.elastic.co/t/what-might-be-wrong-with-this-attempt-to-highlight-es-results/356918 "2024-05-08T09:55:32Z")
I have a working version of an Elasticsearch 7.10.2 setup where the stemmed query results are highlighted in beautiful multiple colours. So if you have 4 words in your search query the results are delivered with the word… --- ## [Elasticsearch SAML problems](https://discuss.elastic.co/t/elasticsearch-saml-problems/358808)
**Author:** [@Juma](https://discuss.elastic.co/u/Juma)\ **Replies:** 2\ **Last updated:** [May 8, 2024, 9:36am UTC](https://discuss.elastic.co/t/elasticsearch-saml-problems/358808 "2024-05-08T09:36:53Z")
Hello, we are currently trying to integrate a SAML authentication with Azure Entra ID for one of our customers. We followed the guide from Set up SAML with Microsoft Entra ID The configuration is as follows (identifie… --- ## [Aggregate with bucket selector and sorting on data stream time series data](https://discuss.elastic.co/t/aggregate-with-bucket-selector-and-sorting-on-data-stream-time-series-data/359041)
**Author:** [@ahw](https://discuss.elastic.co/u/ahw)\ **Replies:** 0\ **Last updated:** [May 8, 2024, 9:20am UTC](https://discuss.elastic.co/t/aggregate-with-bucket-selector-and-sorting-on-data-stream-time-series-data/359041 "2024-05-08T09:20:36Z")
I have a data stream time series setup where i ingest metrics for different units. These metric was before in a postgres database, but now i try to move it into elasticsearch. One of my usecases is to answer questions li… --- ## [Elasticsearch Query Data](https://discuss.elastic.co/t/elasticsearch-query-data/358991)
**Author:** [@dp12345](https://discuss.elastic.co/u/dp12345)\ **Replies:** 1\ **Last updated:** [May 8, 2024, 8:59am UTC](https://discuss.elastic.co/t/elasticsearch-query-data/358991 "2024-05-08T08:59:37Z")
Hi Our client would like to analyze search queries that were processed by Elasticsearch. Is this data stored anywhere in Elasticsearch? If not are there any api's or plugins or extensions available that will allow us t… --- ## [Missing fields and value on Kibana runtime fields](https://discuss.elastic.co/t/missing-fields-and-value-on-kibana-runtime-fields/359034)
**Author:** [@imst](https://discuss.elastic.co/u/imst)\ **Replies:** 0\ **Last updated:** [May 8, 2024, 8:38am UTC](https://discuss.elastic.co/t/missing-fields-and-value-on-kibana-runtime-fields/359034 "2024-05-08T08:38:08Z")
Hi, I was attempting to creating field on fly in Kibana using runtime fields The following is my attempt try to temporarily label the value of the 'aws.waf.id' field as 'tmp' fields in Discover Both field and value… --- ## [No subject alternative names matching IP address 192.168.2.121 found](https://discuss.elastic.co/t/no-subject-alternative-names-matching-ip-address-192-168-2-121-found/359031)
**Author:** [@tine\_proens](https://discuss.elastic.co/u/tine_proens)\ **Replies:** 0\ **Last updated:** [May 8, 2024, 8:20am UTC](https://discuss.elastic.co/t/no-subject-alternative-names-matching-ip-address-192-168-2-121-found/359031 "2024-05-08T08:20:17Z")
I have a linux pc in my network running Elasticsearch 7.17 locally and not secured. There is already a lot of data indexed and now I want to perform searches from other pc's in the network so I decided I want to enable … --- ## [Visualize based on dates](https://discuss.elastic.co/t/visualize-based-on-dates/358859)
**Author:** [@tegerei](https://discuss.elastic.co/u/tegerei)\ **Replies:** 4\ **Last updated:** [May 8, 2024, 8:15am UTC](https://discuss.elastic.co/t/visualize-based-on-dates/358859 "2024-05-08T08:15:37Z")
Hello, I have a field that has the expiry date of an SSL certificate. The field is in form of a Date. I need to create a visualization with color to show when the date is nearing as follows: Show Yellow when the date… --- ## [Automation of Kibana User Creation](https://discuss.elastic.co/t/automation-of-kibana-user-creation/359020)
**Author:** [@amjad](https://discuss.elastic.co/u/amjad)\ **Replies:** 0\ **Last updated:** [May 8, 2024, 6:51am UTC](https://discuss.elastic.co/t/automation-of-kibana-user-creation/359020 "2024-05-08T06:51:01Z")
Hi Elastic Community. Hope you are doing well. we are required to create the list of Kibana users as one time activity, Now we are creating users manually in Kibana or through curl command. Please suggest is there any… --- ## [Elasticsearch unreachable from any language client](https://discuss.elastic.co/t/elasticsearch-unreachable-from-any-language-client/359017)
**Author:** [@spino17](https://discuss.elastic.co/u/spino17)\ **Replies:** 0\ **Last updated:** [May 8, 2024, 6:20am UTC](https://discuss.elastic.co/t/elasticsearch-unreachable-from-any-language-client/359017 "2024-05-08T06:20:47Z")
I suddenly started facing issue where I can hit the elasticsearch from curl but no other language client or even plain http call. I tried this in python and go, and for both es is timing out the request, whereas curl wor… --- ## [Nested Field Check fails in if condition](https://discuss.elastic.co/t/nested-field-check-fails-in-if-condition/358908)
**Author:** [@tusharnemade](https://discuss.elastic.co/u/tusharnemade)\ **Replies:** 4\ **Last updated:** [May 8, 2024, 6:17am UTC](https://discuss.elastic.co/t/nested-field-check-fails-in-if-condition/358908 "2024-05-08T06:17:43Z")
Hello Team: I am using elasticsearch mapping as below : "mappings": { "properties": { "name": { "type": "text" }, "age": { "type": "integer" }, "department": { … --- ## [Elastic Load Balancer](https://discuss.elastic.co/t/elastic-load-balancer/358553)
**Author:** [@El-k](https://discuss.elastic.co/u/El-k)\ **Replies:** 4\ **Last updated:** [May 8, 2024, 5:28am UTC](https://discuss.elastic.co/t/elastic-load-balancer/358553 "2024-05-08T05:28:53Z")
Hi, I am new to elastic, trying to set up my cluster. I have 3 master nodes, 3 data nodes and 1 client node, each one of them runs on a different machine. My question is, is there a default load balancer that gets the… --- ## [Awareness configuration](https://discuss.elastic.co/t/awareness-configuration/358994)
**Author:** [@jhonsouza](https://discuss.elastic.co/u/jhonsouza)\ **Replies:** 1\ **Last updated:** [May 8, 2024, 5:27am UTC](https://discuss.elastic.co/t/awareness-configuration/358994 "2024-05-08T05:27:36Z")
ElasticSearch Version: 7.17.15 Kibana Version: 7.17.15 Hi, I'm trying to configure the awareness to try to reduce the AWS data transfer cost, but that isn't working. I configured the node.att.zone in each data node usin… --- ## [AWS WAF Log Processing header - nested JSON array](https://discuss.elastic.co/t/aws-waf-log-processing-header-nested-json-array/359013)
**Author:** [@imst](https://discuss.elastic.co/u/imst)\ **Replies:** 0\ **Last updated:** [May 8, 2024, 4:02am UTC](https://discuss.elastic.co/t/aws-waf-log-processing-header-nested-json-array/359013 "2024-05-08T04:02:39Z")
We encounter some difficulties in mapping the following JSON array { "docs": \[ { "\_source": { .... , "httpRequest": { "clientIp": "REDACTED", … --- ## [Custom Time field doesnot contain any data after create in grok pattern](https://discuss.elastic.co/t/custom-time-field-doesnot-contain-any-data-after-create-in-grok-pattern/358995)
**Author:** [@baber1223](https://discuss.elastic.co/u/baber1223)\ **Replies:** 1\ **Last updated:** [May 8, 2024, 4:00am UTC](https://discuss.elastic.co/t/custom-time-field-doesnot-contain-any-data-after-create-in-grok-pattern/358995 "2024-05-08T04:00:59Z")
I have written follow grok pattern in logstash filter{ grok{ match =\> { "message" =\> '%{IPORHOST:clientip} %{HTTPDUSER:ident} %{USER:auth} \\\[%{HTTPDATE:logtimestamp}\\\] "(?:%{WORD:verb} %{NOTSPACE:request}(?: HT… --- ## [About the Workplace Search content source synchronization](https://discuss.elastic.co/t/about-the-workplace-search-content-source-synchronization/359011)
**Author:** [@marron](https://discuss.elastic.co/u/marron)\ **Replies:** 0\ **Last updated:** [May 8, 2024, 3:32am UTC](https://discuss.elastic.co/t/about-the-workplace-search-content-source-synchronization/359011 "2024-05-08T03:32:59Z")
This site has an API to perform synchronization, but is there an API to check the synchronization status (synchronization in progress or synchronization complete etc...)? We need to know what the status of the sync is. n… --- ## [\[K8S\]Can not enroll elastic-agent: API KEY INVALID!](https://discuss.elastic.co/t/k8s-can-not-enroll-elastic-agent-api-key-invalid/359006)
**Author:** [@hcnhcn321](https://discuss.elastic.co/u/hcnhcn321)\ **Replies:** 0\ **Last updated:** [May 8, 2024, 1:59am UTC](https://discuss.elastic.co/t/k8s-can-not-enroll-elastic-agent-api-key-invalid/359006 "2024-05-08T01:59:47Z")
error log in elastic-agent pod: {"log.level":"error","@timestamp":"2024-05-08T01:51:37.250Z","message":"Failed to connect to backoff(elasticsearch(https://172.19.29.57:9200)): 401 Unauthorized: {\\"error\\":{\\"root\_cause\\… --- ## [Kibana unique count more that number of records](https://discuss.elastic.co/t/kibana-unique-count-more-that-number-of-records/357826)
**Author:** [@erickhillo](https://discuss.elastic.co/u/erickhillo)\ **Replies:** 5\ **Last updated:** [May 8, 2024, 1:02am UTC](https://discuss.elastic.co/t/kibana-unique-count-more-that-number-of-records/357826 "2024-05-08T01:02:57Z")
hi everyone I´m using kibana dashboards, and when I try to add a metric with unique count to select all uniques the number of uniques is not the same that the number of records that I have, for example in my index I've … --- ## [I have installed ECK operator, how can i forward the logs to kibana from openshift](https://discuss.elastic.co/t/i-have-installed-eck-operator-how-can-i-forward-the-logs-to-kibana-from-openshift/359001)
**Author:** [@rhowin](https://discuss.elastic.co/u/rhowin)\ **Replies:** 0\ **Last updated:** [May 7, 2024, 11:56pm UTC](https://discuss.elastic.co/t/i-have-installed-eck-operator-how-can-i-forward-the-logs-to-kibana-from-openshift/359001 "2024-05-07T23:56:25Z")
I have installed ECK operator in openshift and how can I forward the logs to kibana in ECK? --- ## [Why can't we rename indices?](https://discuss.elastic.co/t/why-cant-we-rename-indices/357011)
**Author:** [@jerrac](https://discuss.elastic.co/u/jerrac)\ **Replies:** 6\ **Last updated:** [May 7, 2024, 8:19pm UTC](https://discuss.elastic.co/t/why-cant-we-rename-indices/357011 "2024-05-07T20:19:09Z")
Ok, so, I ran into a situation where I really needed to be able to rename my index. Somehow it was created before my template was applied and as a result it was a normal index instead of an alias. Which turned into a gia… --- ## [ILM slows down node recovery/rolling upgrade process](https://discuss.elastic.co/t/ilm-slows-down-node-recovery-rolling-upgrade-process/356476)
**Author:** [@jerrac](https://discuss.elastic.co/u/jerrac)\ **Replies:** 13\ **Last updated:** [May 7, 2024, 8:04pm UTC](https://discuss.elastic.co/t/ilm-slows-down-node-recovery-rolling-upgrade-process/356476 "2024-05-07T20:04:36Z")
On my test cluster, I started a rolling upgrade. It's a 3 node cluster, so the cluster state went promptly to red. Once my upgraded node started up, I found that the index reallocation/recovery process was taking a lot l… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=244) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=246)