# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=694 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 695 --- ## [Agent doesn't see binary upgrades in air gapped env](https://discuss.elastic.co/t/agent-doesnt-see-binary-upgrades-in-air-gapped-env/321312)
**Author:** [@nkormakov](https://discuss.elastic.co/u/nkormakov)\ **Replies:** 1\ **Last updated:** [December 19, 2022, 7:23pm UTC](https://discuss.elastic.co/t/agent-doesnt-see-binary-upgrades-in-air-gapped-env/321312 "2022-12-19T19:23:15Z")
I'm trying to set up air gapped environment, but for some reason i cannot upgrade Agent I've put in the settings my local repo as default https://registry.smth.smth/downloads/ and for testing added second non-default … --- ## [Can't select issue type for jira connector](https://discuss.elastic.co/t/cant-select-issue-type-for-jira-connector/321583)
**Author:** [@christian4elastic](https://discuss.elastic.co/u/christian4elastic)\ **Replies:** 2\ **Last updated:** [December 19, 2022, 6:59pm UTC](https://discuss.elastic.co/t/cant-select-issue-type-for-jira-connector/321583 "2022-12-19T18:59:04Z")
I can not set the issue type in the connector when I try to test it without the type I get the error Support Boart: an error occurred while running the action: \[Action\]\[Jira\]: Unable to create incident. Error: Reque… --- ## [Custom ordering of graphics in portrait mode (short width page)](https://discuss.elastic.co/t/custom-ordering-of-graphics-in-portrait-mode-short-width-page/316002)
**Author:** [@victorhmorales](https://discuss.elastic.co/u/victorhmorales)\ **Replies:** 5\ **Last updated:** [December 19, 2022, 6:56pm UTC](https://discuss.elastic.co/t/custom-ordering-of-graphics-in-portrait-mode-short-width-page/316002 "2022-12-19T18:56:36Z")
Hello, When I reduce the page width during preview mode, the graphic reorder their position in a single column (portrait preview). The order in this column is determined by the graphic distribution when on wide page (or… --- ## [User login details - System integration](https://discuss.elastic.co/t/user-login-details-system-integration/321529)
**Author:** [@subash](https://discuss.elastic.co/u/subash)\ **Replies:** 0\ **Last updated:** [December 19, 2022, 7:51am UTC](https://discuss.elastic.co/t/user-login-details-system-integration/321529 "2022-12-19T07:51:22Z")
Hello, I am using Elastic agent 7.17.4 on windows PC to monitor the metrics and logs. One of the requirements is to visualize the users' login and logout time like the below table. Image 1 But what is possible usi… --- ## [Not displaying the custom visualization](https://discuss.elastic.co/t/not-displaying-the-custom-visualization/316218)
**Author:** [@Meghana\_Tatavolu](https://discuss.elastic.co/u/Meghana_Tatavolu)\ **Replies:** 1\ **Last updated:** [October 25, 2022, 3:26pm UTC](https://discuss.elastic.co/t/not-displaying-the-custom-visualization/316218 "2022-10-25T15:26:30Z")
Trying to make a custom word cloud visualization from the existing index. It is showing error as "Cannot read properties of undefined (reading 'datum')". { "$schema": "https://vega.github.io/schema/vega/v5.json", "t… --- ## [Fleet error kibana](https://discuss.elastic.co/t/fleet-error-kibana/321263)
**Author:** [@limitless](https://discuss.elastic.co/u/limitless)\ **Replies:** 0\ **Last updated:** [December 15, 2022, 7:14am UTC](https://discuss.elastic.co/t/fleet-error-kibana/321263 "2022-12-15T07:14:10Z")
// {"log.level":"info","@timestamp":"2022-12-15T11:42:25.572+0500","log.origin":{"file.name":"cmd/enroll\_cmd.go","file.line":403},"message":"Generating self-signed certificate for Fleet Server","ecs.version":"1.6.0"} Er… --- ## [Missing option on terms aggregation causes 500: "Type: array\_index\_out\_of\_bounds\_exception Reason: "Index -1 out of bounds for length 1""](https://discuss.elastic.co/t/missing-option-on-terms-aggregation-causes-500-type-array-index-out-of-bounds-exception-reason-index-1-out-of-bounds-for-length-1/321585)
**Author:** [@takridge](https://discuss.elastic.co/u/takridge)\ **Replies:** 0\ **Last updated:** [December 19, 2022, 6:31pm UTC](https://discuss.elastic.co/t/missing-option-on-terms-aggregation-causes-500-type-array-index-out-of-bounds-exception-reason-index-1-out-of-bounds-for-length-1/321585 "2022-12-19T18:31:29Z")
While running a query on an alias pointing to a single index, the query is to pull a single document. In the aggregations, we have a single aggs, a terms aggregation. We supply a missing value. This query returns a 50… --- ## [Set op\_type to "index" filebeat / elastic-agent](https://discuss.elastic.co/t/set-op-type-to-index-filebeat-elastic-agent/321562)
**Author:** [@beijo](https://discuss.elastic.co/u/beijo)\ **Replies:** 7\ **Last updated:** [December 19, 2022, 5:06pm UTC](https://discuss.elastic.co/t/set-op-type-to-index-filebeat-elastic-agent/321562 "2022-12-19T17:06:52Z")
Hi All, I'm ingesting documents into an index (not a data stream). As I need to update specific documents, I created an ingest pipline which sets the \_id field. However I can not see my documents being updated and I sus… --- ## [ElasticSearch Starting Issue](https://discuss.elastic.co/t/elasticsearch-starting-issue/321415)
**Author:** [@jrpayne30506](https://discuss.elastic.co/u/jrpayne30506)\ **Replies:** 9\ **Last updated:** [December 19, 2022, 4:19pm UTC](https://discuss.elastic.co/t/elasticsearch-starting-issue/321415 "2022-12-19T16:19:38Z")
Hell All, First of all, apologies if I am in the wrong place to post this and for any question that may seem trivial as I am not a linux admin and am basically feeling in the dark. Using a guide I found online, I inst… --- ## [Access in Kibana to a value of a flattened element](https://discuss.elastic.co/t/access-in-kibana-to-a-value-of-a-flattened-element/321578)
**Author:** [@rpc29y](https://discuss.elastic.co/u/rpc29y)\ **Replies:** 1\ **Last updated:** [December 19, 2022, 4:04pm UTC](https://discuss.elastic.co/t/access-in-kibana-to-a-value-of-a-flattened-element/321578 "2022-12-19T16:04:00Z")
Hello: I have in Elasticsearch 7.10 an index that includes an element of type Nested. I have seen that it could not be displayed in Kibana, so I have reindexed to a new index flattening the Trace element. The document… --- ## [Control Options List Mandatory Select](https://discuss.elastic.co/t/control-options-list-mandatory-select/321546)
**Author:** [@Amritha\_Patil](https://discuss.elastic.co/u/Amritha_Patil)\ **Replies:** 2\ **Last updated:** [December 19, 2022, 3:48pm UTC](https://discuss.elastic.co/t/control-options-list-mandatory-select/321546 "2022-12-19T15:48:24Z")
Hi, I have a requirement select atleast one value from the dropdown created using Controls visualization. In existing setup, I have hardcoded and set the default value of dropdown and whenever the dashboard is loaded f… --- ## [Logstash Mongo input error](https://discuss.elastic.co/t/logstash-mongo-input-error/321573)
**Author:** [@kmz161](https://discuss.elastic.co/u/kmz161)\ **Replies:** 0\ **Last updated:** [December 19, 2022, 2:59pm UTC](https://discuss.elastic.co/t/logstash-mongo-input-error/321573 "2022-12-19T14:59:59Z")
Hello! I need read info from MongoDB I use JDBC in Logstash input jdbc { jdbc\_driver\_library =\> "/usr/share/logstash/logstash-core/lib/jars/mongojdbc4.8.jar" jdbc\_driver\_class =\> "Java::com.dbschem… --- ## [Kibana Graph - Vertex color change and Arrows (Directed edges)](https://discuss.elastic.co/t/kibana-graph-vertex-color-change-and-arrows-directed-edges/321484)
**Author:** [@Uvitha](https://discuss.elastic.co/u/Uvitha)\ **Replies:** 4\ **Last updated:** [December 19, 2022, 1:53pm UTC](https://discuss.elastic.co/t/kibana-graph-vertex-color-change-and-arrows-directed-edges/321484 "2022-12-19T13:53:44Z")
Is it feasible to display "direction edges" instead of lines, to demonstrate the relationship between node A and node B? Can the Vertex color between the nodes be changed? --- ## [Elastic SIEM Detection Rules + Windows Logs in French?](https://discuss.elastic.co/t/elastic-siem-detection-rules-windows-logs-in-french/321563)
**Author:** [@lamp123432](https://discuss.elastic.co/u/lamp123432)\ **Replies:** 0\ **Last updated:** [December 19, 2022, 1:26pm UTC](https://discuss.elastic.co/t/elastic-siem-detection-rules-windows-logs-in-french/321563 "2022-12-19T13:26:09Z")
Hello, I'm installing Elastic Agent on many endpoints, I also add the Windows Logs integration and enable Elastic Security detection rules for Windows. Some endpoints have French logs, and I see that the searches for th… --- ## [Expiring cerificates - Cluster still functional?](https://discuss.elastic.co/t/expiring-cerificates-cluster-still-functional/321528)
**Author:** [@smm](https://discuss.elastic.co/u/smm)\ **Replies:** 3\ **Last updated:** [December 19, 2022, 1:03pm UTC](https://discuss.elastic.co/t/expiring-cerificates-cluster-still-functional/321528 "2022-12-19T13:03:51Z")
Dear community, in 7x certificates secure the elasticsearch node to node communication, then the communication node to kibana and the client to kibana communication. What happens if such a secured cluster its certifica… --- ## [How to identify and delete invalid child IDs](https://discuss.elastic.co/t/how-to-identify-and-delete-invalid-child-ids/321512)
**Author:** [@kgeographer](https://discuss.elastic.co/u/kgeographer)\ **Replies:** 4\ **Last updated:** [December 19, 2022, 12:36pm UTC](https://discuss.elastic.co/t/how-to-identify-and-delete-invalid-child-ids/321512 "2022-12-19T12:36:44Z")
I have an index making extensive use of Parent/Child relations, and over time some Child docs have been deleted without removing reference to them in their Parent. This doesn't impact searches but I do use a count of Chi… --- ## [Data Stream Issue](https://discuss.elastic.co/t/data-stream-issue/321240)
**Author:** [@Claudio\_Ract\_Costa](https://discuss.elastic.co/u/Claudio_Ract_Costa)\ **Replies:** 2\ **Last updated:** [December 19, 2022, 12:09pm UTC](https://discuss.elastic.co/t/data-stream-issue/321240 "2022-12-19T12:09:27Z")
Hi Guys, I have two Elasticsearh cluster with different versions (7.15.1 and 8.2.2) I have other server running a packetbeat (during tests, a installed different version of packetbeat) Why when i set in packetbeat con… --- ## [Cant send sysmon logs via logstash output to apache nifi](https://discuss.elastic.co/t/cant-send-sysmon-logs-via-logstash-output-to-apache-nifi/321487)
**Author:** [@roie](https://discuss.elastic.co/u/roie)\ **Replies:** 6\ **Last updated:** [December 19, 2022, 12:00pm UTC](https://discuss.elastic.co/t/cant-send-sysmon-logs-via-logstash-output-to-apache-nifi/321487 "2022-12-19T12:00:42Z")
hi . im trying to send sysmon logs via logstash and there is no data getin , these are my logs error: {"log.level":"error","@timestamp":"2022-12-18T08:15:16.318Z","log.logger":"publisher\_pipeline\_output","log.origin":{… --- ## [Unable to load EMS boundaries for a specific region on map in Kibana 8.5](https://discuss.elastic.co/t/unable-to-load-ems-boundaries-for-a-specific-region-on-map-in-kibana-8-5/321402)
**Author:** [@Abj\_Ins](https://discuss.elastic.co/u/Abj_Ins)\ **Replies:** 1\ **Last updated:** [December 19, 2022, 11:40am UTC](https://discuss.elastic.co/t/unable-to-load-ems-boundaries-for-a-specific-region-on-map-in-kibana-8-5/321402 "2022-12-19T11:40:51Z")
Hi Team, We are trying to import saved objects from 8.3 to 8.5, then getting error on map visual as below. Please share us the details to resolve this issue. Thanks in Advance. --- ## [Exclude\_lines in filebeat does not work?](https://discuss.elastic.co/t/exclude-lines-in-filebeat-does-not-work/321535)
**Author:** [@ddoroshenko](https://discuss.elastic.co/u/ddoroshenko)\ **Replies:** 8\ **Last updated:** [December 19, 2022, 11:22am UTC](https://discuss.elastic.co/t/exclude-lines-in-filebeat-does-not-work/321535 "2022-12-19T11:22:44Z")
Hi, I have log records like: 2022-12-12T07:07:07.007 \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* bla bla bla To exclude these line I use exclude\_lines: \['^\\n$','^\\\*+$'\] in my filebeat configuration. But anyway I get empty… --- ## [Increase in size of refresh queue size, increasing the write thread pool and queue on multiple data nodes](https://discuss.elastic.co/t/increase-in-size-of-refresh-queue-size-increasing-the-write-thread-pool-and-queue-on-multiple-data-nodes/320696)
**Author:** [@Divye](https://discuss.elastic.co/u/Divye)\ **Replies:** 5\ **Last updated:** [December 19, 2022, 10:57am UTC](https://discuss.elastic.co/t/increase-in-size-of-refresh-queue-size-increasing-the-write-thread-pool-and-queue-on-multiple-data-nodes/320696 "2022-12-19T10:57:44Z")
I am having multiple data nodes handling a large logging application elasticsearch running on 7.15.0 version. We are experiencing a massive increase in refresh thread pool and I am still unaware on why the same is happen… --- ## [Limited output from logstash](https://discuss.elastic.co/t/limited-output-from-logstash/321538)
**Author:** [@INS](https://discuss.elastic.co/u/INS)\ **Replies:** 4\ **Last updated:** [December 19, 2022, 10:35am UTC](https://discuss.elastic.co/t/limited-output-from-logstash/321538 "2022-12-19T10:35:26Z")
Hi I'm wondering if it's possible to limited output event form logstash? I've observed many of circuit\_breaking\_exception :error=\>{"type"=\>"circuit\_breaking\_exception", "reason"=\>"\[parent\] Data too large, data for \[in… --- ## [Heap of nodes](https://discuss.elastic.co/t/heap-of-nodes/321539)
**Author:** [@INS](https://discuss.elastic.co/u/INS)\ **Replies:** 0\ **Last updated:** [December 19, 2022, 10:00am UTC](https://discuss.elastic.co/t/heap-of-nodes/321539 "2022-12-19T10:00:55Z")
Hi Why from dev tool console I saw the diffrent value then I have from docker stats and deployed cluster GET /\_cat/nodes?v=true&h=name,node.role=c,heap\* name heap.current heap.percent heap.max es\_dat… --- ## [Dynamic email sending with logstash](https://discuss.elastic.co/t/dynamic-email-sending-with-logstash/321536)
**Author:** [@pramila\_niroshan](https://discuss.elastic.co/u/pramila_niroshan)\ **Replies:** 0\ **Last updated:** [December 19, 2022, 9:31am UTC](https://discuss.elastic.co/t/dynamic-email-sending-with-logstash/321536 "2022-12-19T09:31:45Z")
Is there a way to send a email from logs? That's meant whenever we found a email address from our log then we extract that email address and send to that address to mail. (We use log4j2 and MDC to write the log file) --- ## [Kibana Graph - Possiblity to display Tooltip over the graph nodes](https://discuss.elastic.co/t/kibana-graph-possiblity-to-display-tooltip-over-the-graph-nodes/321482)
**Author:** [@Uvitha](https://discuss.elastic.co/u/Uvitha)\ **Replies:** 2\ **Last updated:** [December 19, 2022, 9:23am UTC](https://discuss.elastic.co/t/kibana-graph-possiblity-to-display-tooltip-over-the-graph-nodes/321482 "2022-12-19T09:23:51Z")
Is it possible to display a customised tooltip to appear when we hover over graph nodes? --- ## [How to show percentage drop (change) in funnel chart using vega lite?](https://discuss.elastic.co/t/how-to-show-percentage-drop-change-in-funnel-chart-using-vega-lite/318504)
**Author:** [@Souvik\_Das](https://discuss.elastic.co/u/Souvik_Das)\ **Replies:** 3\ **Last updated:** [December 19, 2022, 9:19am UTC](https://discuss.elastic.co/t/how-to-show-percentage-drop-change-in-funnel-chart-using-vega-lite/318504 "2022-12-19T09:19:11Z")
Hi, I have created a similar funnel chart like the below example -- Now I want to show % drop (change) between each step. How to do that? Below is the script for the chart -- { "data": { "values": \[ {"… --- ## [Binding API response in Kibana graph. Is it possible to bind API response in Kibana Graph to dynamically bind the data?](https://discuss.elastic.co/t/binding-api-response-in-kibana-graph-is-it-possible-to-bind-api-response-in-kibana-graph-to-dynamically-bind-the-data/321483)
**Author:** [@Uvitha](https://discuss.elastic.co/u/Uvitha)\ **Replies:** 1\ **Last updated:** [December 19, 2022, 9:00am UTC](https://discuss.elastic.co/t/binding-api-response-in-kibana-graph-is-it-possible-to-bind-api-response-in-kibana-graph-to-dynamically-bind-the-data/321483 "2022-12-19T09:00:54Z")
Is it possible to bind API response in Kibana Graph to dynamically bind the data? --- ## [Hierarchical topology in Kibana Graph - Is it possible to construct a hierarchical topology?](https://discuss.elastic.co/t/hierarchical-topology-in-kibana-graph-is-it-possible-to-construct-a-hierarchical-topology/321522)
**Author:** [@Dimple.P](https://discuss.elastic.co/u/Dimple.P)\ **Replies:** 2\ **Last updated:** [December 19, 2022, 8:46am UTC](https://discuss.elastic.co/t/hierarchical-topology-in-kibana-graph-is-it-possible-to-construct-a-hierarchical-topology/321522 "2022-12-19T08:46:35Z")
Is it possible to construct a hierarchical topology, and if so, how do users pass data for that? --- ## [\_source sorting while retrieving the data from es](https://discuss.elastic.co/t/source-sorting-while-retrieving-the-data-from-es/321189)
**Author:** [@Gojo](https://discuss.elastic.co/u/Gojo)\ **Replies:** 2\ **Last updated:** [December 19, 2022, 8:40am UTC](https://discuss.elastic.co/t/source-sorting-while-retrieving-the-data-from-es/321189 "2022-12-19T08:40:36Z")
hi if iam a query like this query = {"query":{"bool":{"must":\[{ "range":{ "timestamp":{ from\_time\_key:from\_time, to\_time\_key:to\_time … --- ## [0 hits in preview result with custom query](https://discuss.elastic.co/t/0-hits-in-preview-result-with-custom-query/315484)
**Author:** [@irivas95](https://discuss.elastic.co/u/irivas95)\ **Replies:** 2\ **Last updated:** [October 25, 2022, 2:15pm UTC](https://discuss.elastic.co/t/0-hits-in-preview-result-with-custom-query/315484 "2022-10-25T14:15:09Z")
Hi, I am trying to create a custom query detection rule in kibana 7.16, the query is as simple as this: dstcountry.keyword : "Spain" when i click on preview results it returns 0 hits, but in the discover i get almos… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=693) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=695)