# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=690 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 691 --- ## [Kibana alerts to notify only if the error persisted in the last 1 hour](https://discuss.elastic.co/t/kibana-alerts-to-notify-only-if-the-error-persisted-in-the-last-1-hour/315683)
**Author:** [@gadelkareem](https://discuss.elastic.co/u/gadelkareem)\ **Replies:** 1\ **Last updated:** [October 27, 2022, 11:33am UTC](https://discuss.elastic.co/t/kibana-alerts-to-notify-only-if-the-error-persisted-in-the-last-1-hour/315683 "2022-10-27T11:33:39Z")
I am scanning a time series index of logs and sending an alert every hour if an error occurred, the check is happening every min. But I would like to like to send the alerts only if the error was repeated in the last hou… --- ## [Centralized list for query filter in visualization](https://discuss.elastic.co/t/centralized-list-for-query-filter-in-visualization/317412)
**Author:** [@Volodymyr\_Komarynsky](https://discuss.elastic.co/u/Volodymyr_Komarynsky)\ **Replies:** 4\ **Last updated:** [October 27, 2022, 9:08am UTC](https://discuss.elastic.co/t/centralized-list-for-query-filter-in-visualization/317412 "2022-10-27T09:08:15Z")
Hello. Please help me with this task: I need to filter the list of IP addresses in different visualizations, in different dashboards and then correct this list, how can this be done with a centralized list so as not to … --- ## [What's the difference between s3 input in filebeat and s3 input in logstash](https://discuss.elastic.co/t/whats-the-difference-between-s3-input-in-filebeat-and-s3-input-in-logstash/321798)
**Author:** [@stwang](https://discuss.elastic.co/u/stwang)\ **Replies:** 1\ **Last updated:** [December 22, 2022, 12:05am UTC](https://discuss.elastic.co/t/whats-the-difference-between-s3-input-in-filebeat-and-s3-input-in-logstash/321798 "2022-12-22T00:05:43Z")
Hi There, We try to ingest data from s3 to Elasticsearch, and I know filebeat and logstash all support S3 input. Which one should I use, is there has any guidence, in which situation to use filebeat or logstash. Cheer… --- ## [How to ship app logs from multiple pods using filebeat](https://discuss.elastic.co/t/how-to-ship-app-logs-from-multiple-pods-using-filebeat/321800)
**Author:** [@SumitSingh](https://discuss.elastic.co/u/SumitSingh)\ **Replies:** 1\ **Last updated:** [December 21, 2022, 11:20pm UTC](https://discuss.elastic.co/t/how-to-ship-app-logs-from-multiple-pods-using-filebeat/321800 "2022-12-21T23:20:00Z")
Hi, I have installed a application using helm and it deployed in AKS. This application have multiples pods spread all over the nodes in AKS. Application logs saved at /opt/app-name/service-name/logs folder in containe… --- ## [Multi Query and Querying with Spaces](https://discuss.elastic.co/t/multi-query-and-querying-with-spaces/321704)
**Author:** [@Cal](https://discuss.elastic.co/u/Cal)\ **Replies:** 2\ **Last updated:** [December 21, 2022, 10:44pm UTC](https://discuss.elastic.co/t/multi-query-and-querying-with-spaces/321704 "2022-12-21T22:44:05Z")
Hello, I'm setting various visualizations to filter on Kibana and I need to be able to search by specific words in a text description. Let's say I have a paragraph description and I want to populate results when "Blue"… --- ## [Cisco ISE Netflow Error](https://discuss.elastic.co/t/cisco-ise-netflow-error/321510)
**Author:** [@eagles40cnuh](https://discuss.elastic.co/u/eagles40cnuh)\ **Replies:** 1\ **Last updated:** [December 21, 2022, 10:00pm UTC](https://discuss.elastic.co/t/cisco-ise-netflow-error/321510 "2022-12-21T22:00:14Z")
I installed "Cisco Ise Integration" in Kibana And Elastic Agent setting + "Cisco Ise Netflow" Output is completed Cisco ise -\> ELK TCP Session Established (Also Sending Packet Check) But.... Kibana Dashboar… --- ## [Filebeat modules ECS 8.0 support plan](https://discuss.elastic.co/t/filebeat-modules-ecs-8-0-support-plan/321797)
**Author:** [@brsolomon](https://discuss.elastic.co/u/brsolomon)\ **Replies:** 0\ **Last updated:** [December 21, 2022, 9:19pm UTC](https://discuss.elastic.co/t/filebeat-modules-ecs-8-0-support-plan/321797 "2022-12-21T21:19:36Z")
It appears that all Filebeat modules currently export ECS version 1.12 fields. Running command from beats/x-pack/filebeat/module: $ ggrep -Fr 'ecs.version: 1.12' | wc -l 140 brsolomon ~/dev/3pty/beats/x-pack/file… --- ## [Missing records after bulk insert](https://discuss.elastic.co/t/missing-records-after-bulk-insert/321796)
**Author:** [@Ostr1969](https://discuss.elastic.co/u/Ostr1969)\ **Replies:** 0\ **Last updated:** [December 21, 2022, 8:51pm UTC](https://discuss.elastic.co/t/missing-records-after-bulk-insert/321796 "2022-12-21T20:51:21Z")
I have inserted with bulk 100milion records, but the count does not show the right number. the bulk insert had not shown errors. I have a field which is 1 to 100milion integer. how can I search for the missing record … --- ## [Filebeat is not reading logs](https://discuss.elastic.co/t/filebeat-is-not-reading-logs/321794)
**Author:** [@ant2ne](https://discuss.elastic.co/u/ant2ne)\ **Replies:** 2\ **Last updated:** [December 21, 2022, 8:43pm UTC](https://discuss.elastic.co/t/filebeat-is-not-reading-logs/321794 "2022-12-21T20:43:15Z")
root@ub2204elk:/etc/elasticsearch# grep -v "#" elasticsearch.yml |uniq path.data: /var/lib/elasticsearch path.logs: /var/log/elasticsearch network.host: localhost xpack.security.enabled: true xpack.security.enrollme… --- ## [Extracting Substrings Using Runtime Fileds](https://discuss.elastic.co/t/extracting-substrings-using-runtime-fileds/317547)
**Author:** [@hi\_xavier](https://discuss.elastic.co/u/hi_xavier)\ **Replies:** 1\ **Last updated:** [October 27, 2022, 8:51am UTC](https://discuss.elastic.co/t/extracting-substrings-using-runtime-fileds/317547 "2022-10-27T08:51:44Z")
Hello, With runtime fields, is it possible to extract a substring from a given field? For example, "url" : "https://hello.com/random?username" How would I create a runtime field to grab the "username" string ? --- ## [Log floods: error salvaging message / handle is invalid](https://discuss.elastic.co/t/log-floods-error-salvaging-message-handle-is-invalid/319974)
**Author:** [@psears](https://discuss.elastic.co/u/psears)\ **Replies:** 2\ **Last updated:** [December 21, 2022, 8:03pm UTC](https://discuss.elastic.co/t/log-floods-error-salvaging-message-handle-is-invalid/319974 "2022-12-21T20:03:04Z")
Winlogbeat 8.4.3, set to log about itself to eventlog logging.level: info logging.selectors: \["\*"\] logging.to\_eventlog: true logging.metrics.period: 5m Every now and then on startup, winlogbeat will go nuts on a host a… --- ## [Vulnerability ESA-2019-04](https://discuss.elastic.co/t/vulnerability-esa-2019-04/321670)
**Author:** [@test\_qweqwe](https://discuss.elastic.co/u/test_qweqwe)\ **Replies:** 4\ **Last updated:** [December 21, 2022, 7:56pm UTC](https://discuss.elastic.co/t/vulnerability-esa-2019-04/321670 "2022-12-21T19:56:44Z")
Hi, I have this vulnerability But we don't have xpack-security installed. Does it apply to me? --- ## [Delete index by query](https://discuss.elastic.co/t/delete-index-by-query/321789)
**Author:** [@Ammar\_Khan1](https://discuss.elastic.co/u/Ammar_Khan1)\ **Replies:** 1\ **Last updated:** [December 21, 2022, 7:55pm UTC](https://discuss.elastic.co/t/delete-index-by-query/321789 "2022-12-21T19:55:41Z")
I want to delete indexes that are older than 7 days old and also possess 0 docs in it by DSL query. if anybody know, kindly let me know Thanks --- ## [Nested array field in ES](https://discuss.elastic.co/t/nested-array-field-in-es/321745)
**Author:** [@Ali5](https://discuss.elastic.co/u/Ali5)\ **Replies:** 0\ **Last updated:** [December 21, 2022, 10:04am UTC](https://discuss.elastic.co/t/nested-array-field-in-es/321745 "2022-12-21T10:04:48Z")
GET feeds/\_search { "query": { "nested": { "path": "comment", "query": { "multi\_match": { "query": "ali", "fields": \["body","title","comment.c\_text"\] } } … --- ## [Error creating index with mappings and dynamic\_templates using java ElasticsearchClient 8.5.3el](https://discuss.elastic.co/t/error-creating-index-with-mappings-and-dynamic-templates-using-java-elasticsearchclient-8-5-3el/321785)
**Author:** [@massimiliano.ruffolo](https://discuss.elastic.co/u/massimiliano.ruffolo)\ **Replies:** 0\ **Last updated:** [December 21, 2022, 4:15pm UTC](https://discuss.elastic.co/t/error-creating-index-with-mappings-and-dynamic-templates-using-java-elasticsearchclient-8-5-3el/321785 "2022-12-21T16:15:06Z")
Hi all, i tried to create an index with mappings and dynamic\_templates using Java ElasticsearchClient. My maven-dependency is the following: \ \co.elastic.clients\ \elasti… --- ## [Custom machine learning rule](https://discuss.elastic.co/t/custom-machine-learning-rule/319944)
**Author:** [@sachinmestry](https://discuss.elastic.co/u/sachinmestry)\ **Replies:** 8\ **Last updated:** [December 21, 2022, 6:43pm UTC](https://discuss.elastic.co/t/custom-machine-learning-rule/319944 "2022-12-21T18:43:32Z")
HI Everyone, I want to create rule where if any change in the user's location is observed i should get an alert for the same. I am using VPN geo location for tracking the same with respect to user. I am trying o achiev… --- ## [How can i insert multiple records through 1 querry in elasticsearch](https://discuss.elastic.co/t/how-can-i-insert-multiple-records-through-1-querry-in-elasticsearch/321615)
**Author:** [@Ali5](https://discuss.elastic.co/u/Ali5)\ **Replies:** 2\ **Last updated:** [December 21, 2022, 6:20pm UTC](https://discuss.elastic.co/t/how-can-i-insert-multiple-records-through-1-querry-in-elasticsearch/321615 "2022-12-21T18:20:23Z")
my index name is "products" that have fields of name,description,id,price it has 40 records i want to create automatically add 1000 records in it can anyone help i am new to it --- ## [Anomaly Detection Using Advanced Configuration](https://discuss.elastic.co/t/anomaly-detection-using-advanced-configuration/321637)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 1\ **Last updated:** [December 21, 2022, 6:15pm UTC](https://discuss.elastic.co/t/anomaly-detection-using-advanced-configuration/321637 "2022-12-21T18:15:09Z")
Hi team, I am using ELK platinum version. Few days back i created a ML job which detect max value for a particular string field value Here i can see cross symbol and dot cross symbol denote multi bucket i don't w… --- ## [Create Watcher Elastic](https://discuss.elastic.co/t/create-watcher-elastic/321728)
**Author:** [@alvaro\_ing](https://discuss.elastic.co/u/alvaro_ing)\ **Replies:** 1\ **Last updated:** [December 21, 2022, 3:56pm UTC](https://discuss.elastic.co/t/create-watcher-elastic/321728 "2022-12-21T15:56:27Z")
Good morning, I would like to create a watcher in elasticsearch. I have a python function that needs two input parameters. The goal is that every time a new document arrives at an index, this watcher automatically exec… --- ## [Kibana dashboard using Html or React](https://discuss.elastic.co/t/kibana-dashboard-using-html-or-react/317494)
**Author:** [@Shashank02](https://discuss.elastic.co/u/Shashank02)\ **Replies:** 2\ **Last updated:** [October 27, 2022, 6:18am UTC](https://discuss.elastic.co/t/kibana-dashboard-using-html-or-react/317494 "2022-10-27T06:18:04Z")
So, I'm new to this and I want some help regarding KIBANA. So, in Kibana I've built a dashboard and now, I'm creating a webpage using react. So, by this, I want to ask whether we can connect the Kibana dashboard to the R… --- ## [Index\_not\_found\_exception error](https://discuss.elastic.co/t/index-not-found-exception-error/321581)
**Author:** [@Reg\_Dancy](https://discuss.elastic.co/u/Reg_Dancy)\ **Replies:** 2\ **Last updated:** [December 21, 2022, 3:13pm UTC](https://discuss.elastic.co/t/index-not-found-exception-error/321581 "2022-12-21T15:13:02Z")
Hello all, I'm working on removing nodes from my cluster to drain and I'm getting the errors {"error":{"root\_cause":\[{"type":"index\_not\_found\_exception","reason":"no such index and \[action.auto\_create\_index\] (\[.monitori… --- ## [Watcher - Write painless script for looping aggregated buckets](https://discuss.elastic.co/t/watcher-write-painless-script-for-looping-aggregated-buckets/321763)
**Author:** [@Divyank\_Mahalle](https://discuss.elastic.co/u/Divyank_Mahalle)\ **Replies:** 2\ **Last updated:** [December 21, 2022, 3:01pm UTC](https://discuss.elastic.co/t/watcher-write-painless-script-for-looping-aggregated-buckets/321763 "2022-12-21T15:01:10Z")
Hi, My Watcher condition is giving output as below: Watcher condition Output: { "\_shards": { "total": 1, "failed": 0, "successful": 1, "skipped": 0 }, "hits": { "hit… --- ## [Average calculations not consistent](https://discuss.elastic.co/t/average-calculations-not-consistent/321739)
**Author:** [@Wpq](https://discuss.elastic.co/u/Wpq)\ **Replies:** 9\ **Last updated:** [December 21, 2022, 2:58pm UTC](https://discuss.elastic.co/t/average-calculations-not-consistent/321739 "2022-12-21T14:58:43Z")
I have data of the type { "user": "john", "country": "japan", "applied": 1 }, { "user": "mary", "country": "japan", "applied": 1 }, { "user": "paul", "country": "japan", "applied": 0 }, { "user": "fr… --- ## [Elasticsearch install error on MAC](https://discuss.elastic.co/t/elasticsearch-install-error-on-mac/321693)
**Author:** [@mail2shanth](https://discuss.elastic.co/u/mail2shanth)\ **Replies:** 6\ **Last updated:** [December 21, 2022, 2:31pm UTC](https://discuss.elastic.co/t/elasticsearch-install-error-on-mac/321693 "2022-12-21T14:31:23Z")
Hi, I am new to Elasticsearch, tried to install, when I try to hit the URL "http://localhost:9200/", it works fine. However when I need to reset a password it gives an error. ./elasticsearch-reset-password -u kibana\_sy… --- ## [Update existing record in elasticsearch while ingesting data through logstash pipeline](https://discuss.elastic.co/t/update-existing-record-in-elasticsearch-while-ingesting-data-through-logstash-pipeline/321769)
**Author:** [@Tanvi07](https://discuss.elastic.co/u/Tanvi07)\ **Replies:** 0\ **Last updated:** [December 21, 2022, 1:10pm UTC](https://discuss.elastic.co/t/update-existing-record-in-elasticsearch-while-ingesting-data-through-logstash-pipeline/321769 "2022-12-21T13:10:24Z")
Hi, I have a requirement where I need to ingest data from mysql db into elasticsearch, for this i have made use of logstash jdbc input plugin. My data is in large volume and i need to implement incremental ingestion now… --- ## [Kibana is unable to Query Elasticsearch after restoring ELK stack](https://discuss.elastic.co/t/kibana-is-unable-to-query-elasticsearch-after-restoring-elk-stack/321692)
**Author:** [@dwalker](https://discuss.elastic.co/u/dwalker)\ **Replies:** 4\ **Last updated:** [December 21, 2022, 1:01pm UTC](https://discuss.elastic.co/t/kibana-is-unable-to-query-elasticsearch-after-restoring-elk-stack/321692 "2022-12-21T13:01:23Z")
Hello everyone, I have came across an issue where Kibana appears to be unable to query Elasticsearch at all no matter the query. It is at the point now where it will not even finish executing a query inside of 10 minutes… --- ## [Aggregation with additional document fields? (Like a SQL inner join to nested group by)](https://discuss.elastic.co/t/aggregation-with-additional-document-fields-like-a-sql-inner-join-to-nested-group-by/321767)
**Author:** [@rd8388](https://discuss.elastic.co/u/rd8388)\ **Replies:** 0\ **Last updated:** [December 21, 2022, 12:43pm UTC](https://discuss.elastic.co/t/aggregation-with-additional-document-fields-like-a-sql-inner-join-to-nested-group-by/321767 "2022-12-21T12:43:23Z")
Thanks in advance for any help with achieving our goal or on the terminology I may use to find an example in Elasticsearch documentation and/or forum. When performing a Max Terms aggregation to get the date of the newes… --- ## [Elastic Agent for Android devices](https://discuss.elastic.co/t/elastic-agent-for-android-devices/321766)
**Author:** [@Jesus\_Arellano](https://discuss.elastic.co/u/Jesus_Arellano)\ **Replies:** 0\ **Last updated:** [December 21, 2022, 12:41pm UTC](https://discuss.elastic.co/t/elastic-agent-for-android-devices/321766 "2022-12-21T12:41:15Z")
Hi, I was wondering if there is an Elastic agent for Android devices. The idea would be an agent similar to metricbeat that would allow to monitor CPU, RAM, processes, battery usage... Do you know any alternative? I f… --- ## [Stack Monitoring](https://discuss.elastic.co/t/stack-monitoring/321760)
**Author:** [@tejal\_kubde](https://discuss.elastic.co/u/tejal_kubde)\ **Replies:** 4\ **Last updated:** [December 21, 2022, 12:40pm UTC](https://discuss.elastic.co/t/stack-monitoring/321760 "2022-12-21T12:40:08Z")
Hi, I'm new to elasticsearch. I'm currently trying to enable stack monitoring on my dev setup. Hence, can someone tell me which is the best possible way to enable it. --- ## [Elasticsearch shard allocation, uneven distribution of shards among nodes](https://discuss.elastic.co/t/elasticsearch-shard-allocation-uneven-distribution-of-shards-among-nodes/321621)
**Author:** [@Petr.Simik](https://discuss.elastic.co/u/Petr.Simik)\ **Replies:** 2\ **Last updated:** [December 21, 2022, 12:35pm UTC](https://discuss.elastic.co/t/elasticsearch-shard-allocation-uneven-distribution-of-shards-among-nodes/321621 "2022-12-21T12:35:53Z")
Hi, May I ask you for help with The problem with uneven allocation of shards on the elatsic cluster is repeated again. This condition is causes the full nodes consumes 90% CPUs and the whole cluster starts to refuse th… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=689) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=691)