# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=737 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 738 --- ## [Differentiate coursor and touch event stream](https://discuss.elastic.co/t/differentiate-coursor-and-touch-event-stream/318546)
**Author:** [@karlanakamura](https://discuss.elastic.co/u/karlanakamura)\ **Replies:** 3\ **Last updated:** [November 10, 2022, 8:19am UTC](https://discuss.elastic.co/t/differentiate-coursor-and-touch-event-stream/318546 "2022-11-10T08:19:03Z")
Hello, I'm using version 8.4.3 of elastic cloud. Is there any way to differentiate when the click is done with the cursor (mouse or touchpad) or with touch (ipad)? I developed some charts in vega, but when I open them … --- ## [Splitting a json array format with same fields name](https://discuss.elastic.co/t/splitting-a-json-array-format-with-same-fields-name/318509)
**Author:** [@Adabi\_Raihan](https://discuss.elastic.co/u/Adabi_Raihan)\ **Replies:** 3\ **Last updated:** [November 10, 2022, 7:44am UTC](https://discuss.elastic.co/t/splitting-a-json-array-format-with-same-fields-name/318509 "2022-11-10T07:44:06Z")
Hi Everyone, Currently, i have this kind of JSON array with the same field, what I wanted is to split this data into an independent field and the field name is based on a "name" field events.parameters (this is the fie… --- ## [Error: fail to enroll: error 400 fleet-server BadRequest](https://discuss.elastic.co/t/error-fail-to-enroll-error-400-fleet-server-badrequest/317329)
**Author:** [@Mouc](https://discuss.elastic.co/u/Mouc)\ **Replies:** 3\ **Last updated:** [November 10, 2022, 7:41am UTC](https://discuss.elastic.co/t/error-fail-to-enroll-error-400-fleet-server-badrequest/317329 "2022-11-10T07:41:25Z")
Hello, After reading all the topics linked to my problem, i still could not solve it. My Elastic-Agent was installed correctly but the enrollment doesn't work, at first i only read the warning saying that remote server… --- ## [Remote reindex with wildcard to multiple indices](https://discuss.elastic.co/t/remote-reindex-with-wildcard-to-multiple-indices/318552)
**Author:** [@lduvnjak](https://discuss.elastic.co/u/lduvnjak)\ **Replies:** 6\ **Last updated:** [November 10, 2022, 7:22am UTC](https://discuss.elastic.co/t/remote-reindex-with-wildcard-to-multiple-indices/318552 "2022-11-10T07:22:25Z")
Hey Everyone, I'm having some issues with running a remote reindex from cluster a to cluster b. The end goal I'm trying to achieve is having some index pattern that the user can provide, and the remote reindex will get … --- ## [Complete ELK Data migration between 2 clusters](https://discuss.elastic.co/t/complete-elk-data-migration-between-2-clusters/318610)
**Author:** [@Suraj\_Jannu](https://discuss.elastic.co/u/Suraj_Jannu)\ **Replies:** 1\ **Last updated:** [November 10, 2022, 7:20am UTC](https://discuss.elastic.co/t/complete-elk-data-migration-between-2-clusters/318610 "2022-11-10T07:20:07Z")
Hello, I have two ELK stack instances on my local machine with version \[7.5.1 and 8.4.3\]. Now I need to migrate the data from the old version cluster to the new version cluster. Question: What would be the right app… --- ## [Requirement to build a Multiple Input system in Logstash as given below, Can I build something like this?](https://discuss.elastic.co/t/requirement-to-build-a-multiple-input-system-in-logstash-as-given-below-can-i-build-something-like-this/318584)
**Author:** [@rravitech](https://discuss.elastic.co/u/rravitech)\ **Replies:** 2\ **Last updated:** [November 10, 2022, 6:56am UTC](https://discuss.elastic.co/t/requirement-to-build-a-multiple-input-system-in-logstash-as-given-below-can-i-build-something-like-this/318584 "2022-11-10T06:56:39Z")
I need to implement a UDP system in between the input and output patterns as mentioned below. inputs : beats, tcp output: elastic-search meanwhile i need to send all the data from the inputs like beats, tcp to an UDPO… --- ## [How to Monitor the process using metricbeat](https://discuss.elastic.co/t/how-to-monitor-the-process-using-metricbeat/318525)
**Author:** [@jisha](https://discuss.elastic.co/u/jisha)\ **Replies:** 5\ **Last updated:** [November 10, 2022, 6:32am UTC](https://discuss.elastic.co/t/how-to-monitor-the-process-using-metricbeat/318525 "2022-11-10T06:32:55Z")
How to Monitor the process using metricbeat in windows. Should we include the process details in the configuration yml of metricbeat? currently without mentioning any process details in config file its only showing proc… --- ## [Elasticsearch 8.5.0 docker fail elasticsearch-reset-password](https://discuss.elastic.co/t/elasticsearch-8-5-0-docker-fail-elasticsearch-reset-password/318575)
**Author:** [@abkrim](https://discuss.elastic.co/u/abkrim)\ **Replies:** 1\ **Last updated:** [November 10, 2022, 6:22am UTC](https://discuss.elastic.co/t/elasticsearch-8-5-0-docker-fail-elasticsearch-reset-password/318575 "2022-11-10T06:22:49Z")
Hi. Today I've update my develop single cluster from 8.4.X to 8.5.0 When I've tried to reset password get error (same from host that from terminal of docker desktop) ❯ docker exec -it sitelight-es01 /usr/share/elastic… --- ## [Elasticsearch Scroll Api](https://discuss.elastic.co/t/elasticsearch-scroll-api/318608)
**Author:** [@GOPAL\_GOTE](https://discuss.elastic.co/u/GOPAL_GOTE)\ **Replies:** 0\ **Last updated:** [November 10, 2022, 4:38am UTC](https://discuss.elastic.co/t/elasticsearch-scroll-api/318608 "2022-11-10T04:38:04Z")
Hi, I'm trying to fetch 10,000 records on each iteration using the scroll API, but I'm not getting a response from it. I increased max\_result\_window to 500000 but am not getting any response from the API. I wrote code a… --- ## [Trace capturing taking time after updating dynamic configuration](https://discuss.elastic.co/t/trace-capturing-taking-time-after-updating-dynamic-configuration/318612)
**Author:** [@sarthik](https://discuss.elastic.co/u/sarthik)\ **Replies:** 0\ **Last updated:** [November 10, 2022, 6:09am UTC](https://discuss.elastic.co/t/trace-capturing-taking-time-after-updating-dynamic-configuration/318612 "2022-11-10T06:09:36Z")
Trace capturing taking time after updating dynamic configuration. After I update instrumentation and recording both, there is a loss of trace data for some initial time. Is there a fixed span of time to wait after upda… --- ## [How to set https in beats agents configuration](https://discuss.elastic.co/t/how-to-set-https-in-beats-agents-configuration/318527)
**Author:** [@jisha](https://discuss.elastic.co/u/jisha)\ **Replies:** 2\ **Last updated:** [November 10, 2022, 5:32am UTC](https://discuss.elastic.co/t/how-to-set-https-in-beats-agents-configuration/318527 "2022-11-10T05:32:26Z")
how to set https in beats agents configuration ? i am using 7.17.3 v of elk. output is through logstash. --- ## [Index security in kibana](https://discuss.elastic.co/t/index-security-in-kibana/318428)
**Author:** [@Petr.Simik](https://discuss.elastic.co/u/Petr.Simik)\ **Replies:** 3\ **Last updated:** [November 10, 2022, 5:02am UTC](https://discuss.elastic.co/t/index-security-in-kibana/318428 "2022-11-10T05:02:06Z")
if the user does not have access to the index, no message is displayed (insufficient privileges). but just doesn't display any data which confuses my users, and they call me saying the data is missing. This is a situa… --- ## [How to divide a single field of a log in elasticsearch into multiple fields in a single event only using logstash filter plugin](https://discuss.elastic.co/t/how-to-divide-a-single-field-of-a-log-in-elasticsearch-into-multiple-fields-in-a-single-event-only-using-logstash-filter-plugin/318538)
**Author:** [@khushi](https://discuss.elastic.co/u/khushi)\ **Replies:** 3\ **Last updated:** [November 10, 2022, 4:32am UTC](https://discuss.elastic.co/t/how-to-divide-a-single-field-of-a-log-in-elasticsearch-into-multiple-fields-in-a-single-event-only-using-logstash-filter-plugin/318538 "2022-11-10T04:32:39Z")
I am sending emails from a mail service to elasticsearch. Now I want to have multiple fields of a single field. --- ## [Index suddenly reporting "Format version is not supported"](https://discuss.elastic.co/t/index-suddenly-reporting-format-version-is-not-supported/318605)
**Author:** [@theblindstagger](https://discuss.elastic.co/u/theblindstagger)\ **Replies:** 0\ **Last updated:** [November 10, 2022, 3:46am UTC](https://discuss.elastic.co/t/index-suddenly-reporting-format-version-is-not-supported/318605 "2022-11-10T03:46:50Z")
Hi, Our application uses elasticsearch v7.9.2. Each instance of the application creates three separate indexes for three different types of data. One customer instance was working fine until the weekend, when a schedu… --- ## [Best Practices for Saving and Maintaining Kibana Saved Objects (Index Patterns & Dashboards)](https://discuss.elastic.co/t/best-practices-for-saving-and-maintaining-kibana-saved-objects-index-patterns-dashboards/318603)
**Author:** [@dante10](https://discuss.elastic.co/u/dante10)\ **Replies:** 0\ **Last updated:** [November 10, 2022, 2:52am UTC](https://discuss.elastic.co/t/best-practices-for-saving-and-maintaining-kibana-saved-objects-index-patterns-dashboards/318603 "2022-11-10T02:52:17Z")
What is the best practice for maintaining kibana saved objects for index-patterns and dashboards in github? 1. Do you save index-patterns and dashboards in one file? Ex: saved\_objects.ndjson {"type":"index-pattern", … --- ## [Transform Vega Data](https://discuss.elastic.co/t/transform-vega-data/314480)
**Author:** [@Irwan\_Kurniawan](https://discuss.elastic.co/u/Irwan_Kurniawan)\ **Replies:** 1\ **Last updated:** [October 13, 2022, 4:19am UTC](https://discuss.elastic.co/t/transform-vega-data/314480 "2022-10-13T04:19:57Z")
How to transform data that I already get from index like this: Into the format like this: So the Type and Value can be separated in different column. I only know how to do this in Vega-Lite but not in Vega. --- ## [Installing Elasticsearch with third party CA certificates](https://discuss.elastic.co/t/installing-elasticsearch-with-third-party-ca-certificates/318440)
**Author:** [@a.gavric](https://discuss.elastic.co/u/a.gavric)\ **Replies:** 3\ **Last updated:** [November 10, 2022, 12:46am UTC](https://discuss.elastic.co/t/installing-elasticsearch-with-third-party-ca-certificates/318440 "2022-11-10T00:46:14Z")
Good afternoon, we are planning on deploying Elastic search with third party publicly signed certificates from Lets Encrypt and i have been trying to find a way of replacing the certificates that are provided by the Elas… --- ## [Not able to get more than 10 results in ANN search using ES 8.5.0 docker image](https://discuss.elastic.co/t/not-able-to-get-more-than-10-results-in-ann-search-using-es-8-5-0-docker-image/318429)
**Author:** [@wole](https://discuss.elastic.co/u/wole)\ **Replies:** 3\ **Last updated:** [November 9, 2022, 11:22pm UTC](https://discuss.elastic.co/t/not-able-to-get-more-than-10-results-in-ann-search-using-es-8-5-0-docker-image/318429 "2022-11-09T23:22:30Z")
Hi team, I am using the Elasticsearch 8.5.0 docker image (installed and started as explained here) to do some experimenting with ANN search. I followed this guide to perform approximate KNN search and use a POST comman… --- ## [Mac verify error: Invalid Password? while creating certificates](https://discuss.elastic.co/t/mac-verify-error-invalid-password-while-creating-certificates/318443)
**Author:** [@Boodle](https://discuss.elastic.co/u/Boodle)\ **Replies:** 1\ **Last updated:** [November 9, 2022, 11:14pm UTC](https://discuss.elastic.co/t/mac-verify-error-invalid-password-while-creating-certificates/318443 "2022-11-09T23:14:24Z")
Creating certificates for elasticSearch install via docker-compose. Gets an error 'Mac verify error: Invalid Password?' while running the command: sudo docker-compose -f create-certs.yml run --rm create\_certs I'm creati… --- ## [AWS CloudWatch integration with Elastic using Elastic Agent On-premise](https://discuss.elastic.co/t/aws-cloudwatch-integration-with-elastic-using-elastic-agent-on-premise/318453)
**Author:** [@Manikandan\_V](https://discuss.elastic.co/u/Manikandan_V)\ **Replies:** 0\ **Last updated:** [November 8, 2022, 4:07pm UTC](https://discuss.elastic.co/t/aws-cloudwatch-integration-with-elastic-using-elastic-agent-on-premise/318453 "2022-11-08T16:07:02Z")
I am in need of configuring the elastic agent in on-premise and connect with cloud watch logs for multiple AWS accounts and multiple Cloud watch log groups. Any idea how to configure multiple log groups or automatically… --- ## [How can i apply index template and ilm to existing index?](https://discuss.elastic.co/t/how-can-i-apply-index-template-and-ilm-to-existing-index/318529)
**Author:** [@hyungsun\_lim](https://discuss.elastic.co/u/hyungsun_lim)\ **Replies:** 1\ **Last updated:** [November 9, 2022, 11:03pm UTC](https://discuss.elastic.co/t/how-can-i-apply-index-template-and-ilm-to-existing-index/318529 "2022-11-09T23:03:48Z")
Now, i have 'test' index in elasticsearch. Documents are written in 'test' index every day, and every seconds. In this case, i want to apply index template to 'test' index. For example, 'test-0000001', 'test-0000002'.… --- ## [Restricting kibana access - iframe](https://discuss.elastic.co/t/restricting-kibana-access-iframe/315455)
**Author:** [@shivendra95](https://discuss.elastic.co/u/shivendra95)\ **Replies:** 12\ **Last updated:** [November 9, 2022, 9:32pm UTC](https://discuss.elastic.co/t/restricting-kibana-access-iframe/315455 "2022-11-09T21:32:02Z")
Hi, We have a kibana instance and we are using kibana iframe embedding into our application page. This is working fine, the problem that we are facing is that we have different clients and for every client we have creat… --- ## [Mapping Conflict with Several Types](https://discuss.elastic.co/t/mapping-conflict-with-several-types/318366)
**Author:** [@JakBains](https://discuss.elastic.co/u/JakBains)\ **Replies:** 2\ **Last updated:** [November 9, 2022, 8:44pm UTC](https://discuss.elastic.co/t/mapping-conflict-with-several-types/318366 "2022-11-09T20:44:37Z")
Hello - my organization recently had an issue where the latest index in our datastream from logstash has the wrong mappings. This has made our IP addresses and geopoints appear as text and keyword types, as a result many… --- ## [How to query documents than not include nested objects field](https://discuss.elastic.co/t/how-to-query-documents-than-not-include-nested-objects-field/318583)
**Author:** [@Volna13](https://discuss.elastic.co/u/Volna13)\ **Replies:** 1\ **Last updated:** [November 9, 2022, 8:41pm UTC](https://discuss.elastic.co/t/how-to-query-documents-than-not-include-nested-objects-field/318583 "2022-11-09T20:41:43Z")
I have a psaInfo field which is nested. It is optional and not available on all events, how can I write a query to get all events where there is no psaInfo field? Here is what I have tried The impression is that the … --- ## [Kibana Monitors (Private Location) APIs](https://discuss.elastic.co/t/kibana-monitors-private-location-apis/316470)
**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Replies:** 3\ **Last updated:** [October 12, 2022, 9:47pm UTC](https://discuss.elastic.co/t/kibana-monitors-private-location-apis/316470 "2022-10-12T21:47:25Z")
Hi All, I was wondering if anyone knows where I can find any Kibana API docs (if they exist) for setting up lightweight private location monitors? The docs mention how to use the push command to setup browser monitors, … --- ## [No data straming](https://discuss.elastic.co/t/no-data-straming/318581)
**Author:** [@mustafa.husny](https://discuss.elastic.co/u/mustafa.husny)\ **Replies:** 0\ **Last updated:** [November 9, 2022, 6:38pm UTC](https://discuss.elastic.co/t/no-data-straming/318581 "2022-11-09T18:38:24Z")
I am trying to install elastic agent to ship logs and metrics from linux machine to Elastic (fleet server) Elastic version : 8.5 kibana version : 8.5 Elastic-agent version : 8.5 After logging in to kibana and navigati… --- ## [Circuit Breaker Exception](https://discuss.elastic.co/t/circuit-breaker-exception/318572)
**Author:** [@Somya\_Sharma](https://discuss.elastic.co/u/Somya_Sharma)\ **Replies:** 4\ **Last updated:** [November 9, 2022, 6:01pm UTC](https://discuss.elastic.co/t/circuit-breaker-exception/318572 "2022-11-09T18:01:24Z")
{ 'error': { 'type': 'circuit\_breaking\_exception', 'reason': '\[parent\] Data too large, data for \[\\] would be \[123848638/118.1mb\], which is larger than the limit of \[123273216/117.5mb\], real usage: … --- ## [Logstash input json splitted by newline "\\n"](https://discuss.elastic.co/t/logstash-input-json-splitted-by-newline-n/318146)
**Author:** [@dmrlixos](https://discuss.elastic.co/u/dmrlixos)\ **Replies:** 7\ **Last updated:** [November 9, 2022, 4:49pm UTC](https://discuss.elastic.co/t/logstash-input-json-splitted-by-newline-n/318146 "2022-11-09T16:49:45Z")
Hi I have a logstash pipeline running on tcp port 8080, that receive a log from another application. These application send logs with header "application/json;charset=UTF-8" and maybe send 1 json line or many json sppl… --- ## [\`Provided Grok expressions do not match field value:\` for logs ingested using nginx elastic agent integration](https://discuss.elastic.co/t/provided-grok-expressions-do-not-match-field-value-for-logs-ingested-using-nginx-elastic-agent-integration/318565)
**Author:** [@jolt](https://discuss.elastic.co/u/jolt)\ **Replies:** 0\ **Last updated:** [November 9, 2022, 4:24pm UTC](https://discuss.elastic.co/t/provided-grok-expressions-do-not-match-field-value-for-logs-ingested-using-nginx-elastic-agent-integration/318565 "2022-11-09T16:24:53Z")
We are seeing GROK errors when ingesting nginx logs using the elastic agent nginx integration. The nginx access & error logs are by default written out to stdout and stderr respectively. K8s picks these up and funnels … --- ## [ILM Hot Tier Searchable Snapshots](https://discuss.elastic.co/t/ilm-hot-tier-searchable-snapshots/318043)
**Author:** [@Safty](https://discuss.elastic.co/u/Safty)\ **Replies:** 4\ **Last updated:** [November 9, 2022, 4:18pm UTC](https://discuss.elastic.co/t/ilm-hot-tier-searchable-snapshots/318043 "2022-11-09T16:18:06Z")
What is the use case around Hot Tier Searchable Snapshots in ILM? I was thinking maybe... if you have an s3 repository available, do you need Cold/Frozen at all? Response time and replica requirements notwithstanding, … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=736) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=738)