# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=732 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 733 --- ## [Elastic-agent not fond when running in Docker](https://discuss.elastic.co/t/elastic-agent-not-fond-when-running-in-docker/318948)
**Author:** [@Philip\_Davies1](https://discuss.elastic.co/u/Philip_Davies1)\ **Replies:** 0\ **Last updated:** [November 15, 2022, 10:44am UTC](https://discuss.elastic.co/t/elastic-agent-not-fond-when-running-in-docker/318948 "2022-11-15T10:44:29Z")
Hi All, I am running my ELK setup on a Docker Swarm cluster and I have Kibana, Elasticsearch, Metricbeats all up and running fine. I am trying to setup fleet and deploy my first elastic agent. The container for docker… --- ## [Get most recent hit by some field on Discover](https://discuss.elastic.co/t/get-most-recent-hit-by-some-field-on-discover/318824)
**Author:** [@liorh](https://discuss.elastic.co/u/liorh)\ **Replies:** 2\ **Last updated:** [November 15, 2022, 10:30am UTC](https://discuss.elastic.co/t/get-most-recent-hit-by-some-field-on-discover/318824 "2022-11-15T10:30:23Z")
Hi Attached is a screenshot of my Discover. How can I make it to show me only the most recent row per event.transactionId? I marked those rows. Thank you very much --- ## [Clean up Indices? ..... free some storage](https://discuss.elastic.co/t/clean-up-indices-free-some-storage/318925)
**Author:** [@theacodes](https://discuss.elastic.co/u/theacodes)\ **Replies:** 4\ **Last updated:** [November 15, 2022, 8:06am UTC](https://discuss.elastic.co/t/clean-up-indices-free-some-storage/318925 "2022-11-15T08:06:14Z")
storage utilised over 90% and until now I haven't cleaned up any indices. What would be the perfect way to clean up indices or delete some old index data ? I've searched a lot but there's too much confusion over the in… --- ## [Logstash Pipeline for Sql Server Varbinary Column](https://discuss.elastic.co/t/logstash-pipeline-for-sql-server-varbinary-column/318944)
**Author:** [@ArvindSarkania](https://discuss.elastic.co/u/ArvindSarkania)\ **Replies:** 0\ **Last updated:** [November 15, 2022, 9:25am UTC](https://discuss.elastic.co/t/logstash-pipeline-for-sql-server-varbinary-column/318944 "2022-11-15T09:25:49Z")
Hello Sir I am facing issue with Logstash Pipline WIth JDBC plug in I have a task to insert data into elasticsearch with varbinary input. This is my Conf file input { #columns\_charset =\> { "column0" =\> "UTF8" } jdbc… --- ## [Want to know stable latest elastic version](https://discuss.elastic.co/t/want-to-know-stable-latest-elastic-version/318939)
**Author:** [@priti](https://discuss.elastic.co/u/priti)\ **Replies:** 2\ **Last updated:** [November 15, 2022, 9:24am UTC](https://discuss.elastic.co/t/want-to-know-stable-latest-elastic-version/318939 "2022-11-15T09:24:18Z")
We are planning to build ELK cluster in our environment. Need to know which is the latest stable version is good to setup ? --- ## [Creating an enrich policy from collapsed data](https://discuss.elastic.co/t/creating-an-enrich-policy-from-collapsed-data/318629)
**Author:** [@cwe](https://discuss.elastic.co/u/cwe)\ **Replies:** 1\ **Last updated:** [November 15, 2022, 8:23am UTC](https://discuss.elastic.co/t/creating-an-enrich-policy-from-collapsed-data/318629 "2022-11-15T08:23:34Z")
Hi Elastic community I have an index containing many documents per host.id describing the currently running software. This information might change over time, due to software updates. I can use a collapse query to get … --- ## [How to query with GROUP BY and COUNT(\*)](https://discuss.elastic.co/t/how-to-query-with-group-by-and-count/318936)
**Author:** [@Remon\_Andrew](https://discuss.elastic.co/u/Remon_Andrew)\ **Replies:** 0\ **Last updated:** [November 15, 2022, 8:20am UTC](https://discuss.elastic.co/t/how-to-query-with-group-by-and-count/318936 "2022-11-15T08:20:29Z")
Hi all, I have this query that I used to run on MySQL: SELECT from\_mobile\_number, event\_name, COUNT(\*) AS count FROM analytics\_events WHERE date \>= '2022-10-01 00:00:00' AND date \<= '2022-09-30 23:59:59' AND from\_mobil… --- ## [Fleet Agent - CEF Integration - Is there any way to listen on TCP?](https://discuss.elastic.co/t/fleet-agent-cef-integration-is-there-any-way-to-listen-on-tcp/318915)
**Author:** [@scanlan](https://discuss.elastic.co/u/scanlan)\ **Replies:** 3\ **Last updated:** [November 15, 2022, 7:57am UTC](https://discuss.elastic.co/t/fleet-agent-cef-integration-is-there-any-way-to-listen-on-tcp/318915 "2022-11-15T07:57:52Z")
I'm ingesting CEF based logs from another SIEM and utilizing the "Common Event Format (CEF)" integration. It is only able to receive CEF events via input file, or via UDP listener. There is no TCP listener option. A… --- ## [Watcher Email output](https://discuss.elastic.co/t/watcher-email-output/318793)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 1\ **Last updated:** [November 15, 2022, 7:27am UTC](https://discuss.elastic.co/t/watcher-email-output/318793 "2022-11-15T07:27:25Z")
{ "trigger": { "schedule": { "interval": "1m" } }, "input": { "search": { "request": { "search\_type": "query\_then\_fetch", "indices": \[ "metricbeat-\*" \], … --- ## [Elasticsearch](https://discuss.elastic.co/t/elasticsearch/318924)
**Author:** [@giri1](https://discuss.elastic.co/u/giri1)\ **Replies:** 1\ **Last updated:** [November 15, 2022, 7:10am UTC](https://discuss.elastic.co/t/elasticsearch/318924 "2022-11-15T07:10:12Z")
hey search\_as\_type is not working when i connect it through java. Completion is showing error when i used it with bool query --- ## [Index Pattern error in Kibana 7.10.2](https://discuss.elastic.co/t/index-pattern-error-in-kibana-7-10-2/316888)
**Author:** [@abhi474](https://discuss.elastic.co/u/abhi474)\ **Replies:** 2\ **Last updated:** [October 19, 2022, 4:39am UTC](https://discuss.elastic.co/t/index-pattern-error-in-kibana-7-10-2/316888 "2022-10-19T04:39:59Z")
while creating Index pattern for sample data, I am getting below error : {"type":"error","@timestamp":"2022-10-18T04:31:00Z","tags":\["connection","client","error"\],"pid":63727,"level":"error","error":{"message":"Parse E… --- ## [Generating metrics from documents present in index](https://discuss.elastic.co/t/generating-metrics-from-documents-present-in-index/318130)
**Author:** [@Vikash\_Kumar\_Sharma](https://discuss.elastic.co/u/Vikash_Kumar_Sharma)\ **Replies:** 1\ **Last updated:** [November 15, 2022, 6:14am UTC](https://discuss.elastic.co/t/generating-metrics-from-documents-present-in-index/318130 "2022-11-15T06:14:32Z")
Hi I have an index that has the following documents timestamp:t1, job:j1, status:started timestamp:t2, job:j1, status:completed timestamp:t1, job:j2, status:started timestamp:t2, job:j2, status:completed So from these… --- ## [Reindex api errors out while reindexing when documents in the index exceed 2147483519](https://discuss.elastic.co/t/reindex-api-errors-out-while-reindexing-when-documents-in-the-index-exceed-2147483519/318771)
**Author:** [@Srikant\_Magdum](https://discuss.elastic.co/u/Srikant_Magdum)\ **Replies:** 1\ **Last updated:** [November 15, 2022, 6:06am UTC](https://discuss.elastic.co/t/reindex-api-errors-out-while-reindexing-when-documents-in-the-index-exceed-2147483519/318771 "2022-11-15T06:06:57Z")
One of my shard in the index is in red state as the documents in that shard exceeded 2147483519 as below : failed shard on node \[GK1he55KSJmqQXx-qDrPFQ\]: shard failure, reason \[no-op origin\[PRIMARY\] seq#\[350554097\] fail… --- ## [Unable to retrieve version information from Elasticsearch nodes. security\_exception](https://discuss.elastic.co/t/unable-to-retrieve-version-information-from-elasticsearch-nodes-security-exception/318919)
**Author:** [@Vivek\_Arumugam](https://discuss.elastic.co/u/Vivek_Arumugam)\ **Replies:** 1\ **Last updated:** [November 15, 2022, 6:01am UTC](https://discuss.elastic.co/t/unable-to-retrieve-version-information-from-elasticsearch-nodes-security-exception/318919 "2022-11-15T06:01:43Z")
Hi Team, I am getting the following error while installing kibana.please help on this issue. Unable to retrieve version information from Elasticsearch nodes. security\_exception: \[security\_exception\] Reason: missing aut… --- ## [Unable to start elastic search in AKS cluster, throwing bootstrap errors](https://discuss.elastic.co/t/unable-to-start-elastic-search-in-aks-cluster-throwing-bootstrap-errors/318921)
**Author:** [@sunil\_s](https://discuss.elastic.co/u/sunil_s)\ **Replies:** 0\ **Last updated:** [November 15, 2022, 5:14am UTC](https://discuss.elastic.co/t/unable-to-start-elastic-search-in-aks-cluster-throwing-bootstrap-errors/318921 "2022-11-15T05:14:51Z")
PFB errors {"@timestamp":"2022-11-15T05:06:07.108Z", "log.level": "INFO", "message":"Native controller process has stopped - no new native processes can be started", "ecs.version": "1.2.0","service.name":"ES\_ECS","event… --- ## [Vega - Force Directed - Indexe problem](https://discuss.elastic.co/t/vega-force-directed-indexe-problem/316670)
**Author:** [@Phildefer](https://discuss.elastic.co/u/Phildefer)\ **Replies:** 2\ **Last updated:** [October 18, 2022, 6:55pm UTC](https://discuss.elastic.co/t/vega-force-directed-indexe-problem/316670 "2022-10-18T18:55:49Z")
Hi all, I'm trying to make a force directed graph using this example ( vega code - Data ). until now I can't do it and I would like to know if the nodes and the links have to identified with a numerical index or if it'… --- ## [Kibana error in /app/security/manage](https://discuss.elastic.co/t/kibana-error-in-app-security-manage/317076)
**Author:** [@Nikolas1306](https://discuss.elastic.co/u/Nikolas1306)\ **Replies:** 1\ **Last updated:** [November 15, 2022, 1:08am UTC](https://discuss.elastic.co/t/kibana-error-in-app-security-manage/317076 "2022-11-15T01:08:33Z")
Error Error: Cannot read properties of undefined (reading 'includes') at i (http://172.16.14.193:5601/55572/bundles/plugin/securitySolution/8.0.0/securitySolution.chunk.0.js:3:15967) at http://172.16.14.193:5601… --- ## [Kibana process crashes - high memory usage](https://discuss.elastic.co/t/kibana-process-crashes-high-memory-usage/317132)
**Author:** [@dslavescu](https://discuss.elastic.co/u/dslavescu)\ **Replies:** 1\ **Last updated:** [November 15, 2022, 1:05am UTC](https://discuss.elastic.co/t/kibana-process-crashes-high-memory-usage/317132 "2022-11-15T01:05:01Z")
Hello, I am using ELK 7.12.1 and Kibana 7.12.1 in a production env. I am encountering an issue with my Kibana , the process keeps crashing. The app is hosted on 1 VM , having 8 GB of RAM. At first i did not do any modi… --- ## [Help with creating a search](https://discuss.elastic.co/t/help-with-creating-a-search/318450)
**Author:** [@cdeblois](https://discuss.elastic.co/u/cdeblois)\ **Replies:** 2\ **Last updated:** [November 10, 2022, 6:59pm UTC](https://discuss.elastic.co/t/help-with-creating-a-search/318450 "2022-11-10T18:59:16Z")
Hello, I'm trying to see if there's a way to make an API call so we can know when an index or an indices has not been written to for a specific period of time. Is there a way to do this? I've been wracking my brain try… --- ## [Install Kibana with Debian package | Kibana Guide \[7.17\] | Elastic - Error Index out of range](https://discuss.elastic.co/t/install-kibana-with-debian-package-kibana-guide-7-17-elastic-error-index-out-of-range/317088)
**Author:** [@vojrao](https://discuss.elastic.co/u/vojrao)\ **Replies:** 1\ **Last updated:** [November 15, 2022, 12:59am UTC](https://discuss.elastic.co/t/install-kibana-with-debian-package-kibana-guide-7-17-elastic-error-index-out-of-range/317088 "2022-11-15T00:59:17Z")
Hi, When we try to install Kibana 7.17.6 on ubuntu 16.04 machine we got the following error: ubuntu@finn:~$ sudo apt-get install kibana Reading package lists... Done Building dependency tree Reading state info… --- ## [Kibana fieldFormatMap](https://discuss.elastic.co/t/kibana-fieldformatmap/318741)
**Author:** [@Santosh\_Sahu](https://discuss.elastic.co/u/Santosh_Sahu)\ **Replies:** 1\ **Last updated:** [November 15, 2022, 12:51am UTC](https://discuss.elastic.co/t/kibana-fieldformatmap/318741 "2022-11-15T00:51:53Z")
using kibana version 5.4 Can we use the How to use the fieldFormatMap in the mapping JSON for a index? Sample Mapping json. { "meshping": { "\_meta": { "class": "com.pluribus.maestro.data.MeshPingEntity", "version"… --- ## [Repository-azure for 7.17](https://discuss.elastic.co/t/repository-azure-for-7-17/318845)
**Author:** [@rwiker](https://discuss.elastic.co/u/rwiker)\ **Replies:** 1\ **Last updated:** [November 15, 2022, 12:42am UTC](https://discuss.elastic.co/t/repository-azure-for-7-17/318845 "2022-11-15T00:42:48Z")
Hi, We're using repository-azure with our 7.17 installation of Elasticsearch, running on Azure VMs. Last week, we got a notification from Microsoft that there are known issues with one of the packages used by the repos… --- ## [XContentType.Json not working](https://discuss.elastic.co/t/xcontenttype-json-not-working/318834)
**Author:** [@suresh\_chaudhari](https://discuss.elastic.co/u/suresh_chaudhari)\ **Replies:** 1\ **Last updated:** [November 15, 2022, 12:38am UTC](https://discuss.elastic.co/t/xcontenttype-json-not-working/318834 "2022-11-15T00:38:57Z")
IndexRequest iRequest = new IndexRequest(LoadBalancerVip+"9" , "\_doc"); iRequest.source(flattenedJson,XContentType.JSON); This innocent XContentType.Json cannot insert more than 150 records neither it shows any bug try… --- ## [Watcher with Json body](https://discuss.elastic.co/t/watcher-with-json-body/318847)
**Author:** [@sudheendra](https://discuss.elastic.co/u/sudheendra)\ **Replies:** 0\ **Last updated:** [November 14, 2022, 9:47am UTC](https://discuss.elastic.co/t/watcher-with-json-body/318847 "2022-11-14T09:47:01Z")
I am using the watcher to send post request to webhook listener ,but I am failing to convert output array into json object . "actions": { "send\_alert\_to\_jumpstart\_server": { "webhook": { "scheme": "http", "host": "\*\*\*\*\*… --- ## [Nested JSON data to Logstash](https://discuss.elastic.co/t/nested-json-data-to-logstash/318895)
**Author:** [@INS](https://discuss.elastic.co/u/INS)\ **Replies:** 7\ **Last updated:** [November 14, 2022, 11:38pm UTC](https://discuss.elastic.co/t/nested-json-data-to-logstash/318895 "2022-11-14T23:38:06Z")
Hi Can You point me out how to use data filter to making correct timestamp from file, below data (already prepared in JSON format) timestamp should be taken from "collectionBeginTime" field. Thanks for help { "meas… --- ## [ElasticSearch TASKS API - Task is given to a different node after 1 minute](https://discuss.elastic.co/t/elasticsearch-tasks-api-task-is-given-to-a-different-node-after-1-minute/318600)
**Author:** [@vedalas21](https://discuss.elastic.co/u/vedalas21)\ **Replies:** 1\ **Last updated:** [November 15, 2022, 12:20am UTC](https://discuss.elastic.co/t/elasticsearch-tasks-api-task-is-given-to-a-different-node-after-1-minute/318600 "2022-11-15T00:20:20Z")
Hi Team, I had a weird observation in our Elasticsearch Cluster. We have an ES Query that will be executed from a python script. When the Query is being fired from python, right away a task will get created under GET /… --- ## [Zeek monitoring using filebeats](https://discuss.elastic.co/t/zeek-monitoring-using-filebeats/318760)
**Author:** [@PSFletchTheTek](https://discuss.elastic.co/u/PSFletchTheTek)\ **Replies:** 6\ **Last updated:** [November 15, 2022, 12:16am UTC](https://discuss.elastic.co/t/zeek-monitoring-using-filebeats/318760 "2022-11-15T00:16:24Z")
Hi, I'm using filebeats to monitor or try to monitor zeek. But I can't see any of the zeek files content in elastic, I've also enabled the system module and that burst straight into life. So I know the module config i… --- ## [Direct link to a session ID](https://discuss.elastic.co/t/direct-link-to-a-session-id/318890)
**Author:** [@emacri](https://discuss.elastic.co/u/emacri)\ **Replies:** 1\ **Last updated:** [November 15, 2022, 12:09am UTC](https://discuss.elastic.co/t/direct-link-to-a-session-id/318890 "2022-11-15T00:09:25Z")
Hi everyone, I am looking for a way to get a Kibana URL / link that points directly to a session ID. So, the idea is to get this link clicked and that it goes straight to the log details of each session, an example belo… --- ## [Unable to login in kibana](https://discuss.elastic.co/t/unable-to-login-in-kibana/318893)
**Author:** [@AnkitaP](https://discuss.elastic.co/u/AnkitaP)\ **Replies:** 1\ **Last updated:** [November 14, 2022, 10:32pm UTC](https://discuss.elastic.co/t/unable-to-login-in-kibana/318893 "2022-11-14T22:32:52Z")
Hello, I am unable to login into kibana. I am getting error as incorrect username/Password even after entering correct credentials. Please find attached screenshots of the Logs. Note--ELK stack version--7.16 Kindly he… --- ## [Filebeat Logstash Elasticsearch Kibana](https://discuss.elastic.co/t/filebeat-logstash-elasticsearch-kibana/318905)
**Author:** [@sharbich](https://discuss.elastic.co/u/sharbich)\ **Replies:** 1\ **Last updated:** [November 14, 2022, 10:30pm UTC](https://discuss.elastic.co/t/filebeat-logstash-elasticsearch-kibana/318905 "2022-11-14T22:30:06Z")
Hello, from a Linux machine, the syslog information is displayed via filebeat - logstash - elasticsearch in Kibana via Discover. How do I get the syslog information from another Linux server in the same index under Kib… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=731) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=733)