# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=786 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 787 --- ## [Dividing buckets values](https://discuss.elastic.co/t/dividing-buckets-values/314938)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 2\ **Last updated:** [September 22, 2022, 3:13pm UTC](https://discuss.elastic.co/t/dividing-buckets-values/314938 "2022-09-22T15:13:33Z")
Hi Community, Below is my query. It is performing count no. of response\_code and total no. of response\_code using filters aggregation. I want to divide response\_code by total no of response\_code For dividing i used bu… --- ## [How to curl elastic or kibana api for alerts?](https://discuss.elastic.co/t/how-to-curl-elastic-or-kibana-api-for-alerts/314455)
**Author:** [@learningelastic](https://discuss.elastic.co/u/learningelastic)\ **Replies:** 2\ **Last updated:** [September 22, 2022, 3:11pm UTC](https://discuss.elastic.co/t/how-to-curl-elastic-or-kibana-api-for-alerts/314455 "2022-09-22T15:11:35Z")
I am learning to use the ELK stack. Both kibana and elasticsearch are installed on my localhost. I just learnt how to install metricbeat and how to set up alerts. When setting up the alerts, I used the index connector… --- ## [What is the default time-frame for a query ? where to configure the same?](https://discuss.elastic.co/t/what-is-the-default-time-frame-for-a-query-where-to-configure-the-same/314946)
**Author:** [@sriramb12](https://discuss.elastic.co/u/sriramb12)\ **Replies:** 1\ **Last updated:** [September 22, 2022, 3:00pm UTC](https://discuss.elastic.co/t/what-is-the-default-time-frame-for-a-query-where-to-configure-the-same/314946 "2022-09-22T15:00:01Z")
When the filebeat makes a query, it should be able to specify the time period (say last 1 day, 1hr etc) to get the logs. I am not able to find the config. parameter in the filebeat.yml (or in o365.yml) For instance when… --- ## [Logstash filter for records of nested json messages from eventhub](https://discuss.elastic.co/t/logstash-filter-for-records-of-nested-json-messages-from-eventhub/314930)
**Author:** [@Sivaramakrishhna\_Amb](https://discuss.elastic.co/u/Sivaramakrishhna_Amb)\ **Replies:** 2\ **Last updated:** [September 22, 2022, 2:50pm UTC](https://discuss.elastic.co/t/logstash-filter-for-records-of-nested-json-messages-from-eventhub/314930 "2022-09-22T14:50:03Z")
Input message looks like below { "records": \[ { "level": "Informational", "properties": { "Keywords": 0, "ProviderName": "Core.LogRecord", "Message": "2022-09-08 08:17:02,935 \[23\] INFO {"Message":"9/8/2022 8:17:0… --- ## [Data Storage](https://discuss.elastic.co/t/data-storage/314846)
**Author:** [@ibtissem\_Ben\_lafi](https://discuss.elastic.co/u/ibtissem_Ben_lafi)\ **Replies:** 12\ **Last updated:** [September 22, 2022, 2:01pm UTC](https://discuss.elastic.co/t/data-storage/314846 "2022-09-22T14:01:19Z")
Hello eveyone, I have an issue: The size of the data is not the same in MySQL and Elasticsearch . What can I do for this problem? Someone help me, please --- ## [Elastic Agent configuration for creating new index based on kubernetes namespace](https://discuss.elastic.co/t/elastic-agent-configuration-for-creating-new-index-based-on-kubernetes-namespace/314886)
**Author:** [@umesh2020](https://discuss.elastic.co/u/umesh2020)\ **Replies:** 4\ **Last updated:** [September 22, 2022, 1:57pm UTC](https://discuss.elastic.co/t/elastic-agent-configuration-for-creating-new-index-based-on-kubernetes-namespace/314886 "2022-09-22T13:57:22Z")
Hi In filebeat configuration, I could use the following config to create a separate index per kubernetes namespace. output.elasticsearch: indices: - index: '%{\[kubernetes.namespace\]}-%{\[agent.version\]… --- ## [Elasticsearch cluster doesn't work when docker on machine is installed](https://discuss.elastic.co/t/elasticsearch-cluster-doesnt-work-when-docker-on-machine-is-installed/314952)
**Author:** [@simo385](https://discuss.elastic.co/u/simo385)\ **Replies:** 0\ **Last updated:** [September 22, 2022, 1:57pm UTC](https://discuss.elastic.co/t/elasticsearch-cluster-doesnt-work-when-docker-on-machine-is-installed/314952 "2022-09-22T13:57:10Z")
Hi Everybody, I have setup an Elasticsearch\[8.4\] cluster (2 nodes) in my aws ec2 machines as follows: EC2\_1 (private IP: 172.31.1.1/32, docker-bridge range: 172.17.0.1/16) --\> in this ec2 I've installed Kubernetes mas… --- ## [Error fetching fields for data in Security Dashboard](https://discuss.elastic.co/t/error-fetching-fields-for-data-in-security-dashboard/313573)
**Author:** [@GustavoPires](https://discuss.elastic.co/u/GustavoPires)\ **Replies:** 13\ **Last updated:** [September 22, 2022, 1:12pm UTC](https://discuss.elastic.co/t/error-fetching-fields-for-data-in-security-dashboard/313573 "2022-09-22T13:12:16Z")
Hello guys, I am getting the error below when I go to the security dashboard overview: Error fetching fields for data view .alerts-security.alerts-default,apm--transaction,auditbeat-,endgame-,filebeat-,logs-,packetbeat… --- ## [Elasticsearch filter plugin for data enrichment](https://discuss.elastic.co/t/elasticsearch-filter-plugin-for-data-enrichment/314944)
**Author:** [@Hamza\_Khalid](https://discuss.elastic.co/u/Hamza_Khalid)\ **Replies:** 0\ **Last updated:** [September 22, 2022, 12:35pm UTC](https://discuss.elastic.co/t/elasticsearch-filter-plugin-for-data-enrichment/314944 "2022-09-22T12:35:27Z")
i have indexed 2 tables from mysql to elasticsearch: user\_index: { id : 1, name : user\_name, hobbies : 1,2 } hobbies\_index: { id : 1, name : hobby1 } id : 2, name : hobby2 } i want to enrich my document a… --- ## [Deep Hierarchy with Count](https://discuss.elastic.co/t/deep-hierarchy-with-count/314943)
**Author:** [@m-dot-jung](https://discuss.elastic.co/u/m-dot-jung)\ **Replies:** 0\ **Last updated:** [September 22, 2022, 12:28pm UTC](https://discuss.elastic.co/t/deep-hierarchy-with-count/314943 "2022-09-22T12:28:06Z")
Hi, I tried modelling a document hierarchy where each record might have a parent record. The maximum depth of this hierarchy is variable. Now, I want to query for certain documents by ID the number of children - best w… --- ## [Linux Auditd monitoring of file operations in mounted folder](https://discuss.elastic.co/t/linux-auditd-monitoring-of-file-operations-in-mounted-folder/314940)
**Author:** [@Lukas\_Hubl](https://discuss.elastic.co/u/Lukas_Hubl)\ **Replies:** 0\ **Last updated:** [September 22, 2022, 12:21pm UTC](https://discuss.elastic.co/t/linux-auditd-monitoring-of-file-operations-in-mounted-folder/314940 "2022-09-22T12:21:51Z")
I have multi node kubernetes cluster and I would like to monitor file operations that are made by containers in mounted persistent volume. I found the all PV data are located at nodes in /var/lib/kubelet/pods/\ **Author:** [@michalruszczyk](https://discuss.elastic.co/u/michalruszczyk)\ **Replies:** 2\ **Last updated:** [September 22, 2022, 10:08am UTC](https://discuss.elastic.co/t/subtracting-two-lines-in-vega-chart/314847 "2022-09-22T10:08:02Z") Hi, I am trying to create a chart which shows some kind of risk. The logic behind is that I have an index which has Dalue, startDate and endDate. I would like to show the line which is cumulative sum of value with startd… --- ## [Authentication failed for Elasticsearch and Kibana](https://discuss.elastic.co/t/authentication-failed-for-elasticsearch-and-kibana/314931)
**Author:** [@Ahsan\_Yazdani](https://discuss.elastic.co/u/Ahsan_Yazdani)\ **Replies:** 0\ **Last updated:** [September 22, 2022, 9:45am UTC](https://discuss.elastic.co/t/authentication-failed-for-elasticsearch-and-kibana/314931 "2022-09-22T09:45:45Z")
I have download Kibana from git clone directory according to the instructions mentioned in a question on elastic.co like this: git clone https://github.com/\[YOUR\_USERNAME\]/kibana.git kibana cd kibana git fetch origin … --- ## [Elastic Search Not Reflecting Database Changes](https://discuss.elastic.co/t/elastic-search-not-reflecting-database-changes/314916)
**Author:** [@Binish\_Shams](https://discuss.elastic.co/u/Binish_Shams)\ **Replies:** 3\ **Last updated:** [September 22, 2022, 8:54am UTC](https://discuss.elastic.co/t/elastic-search-not-reflecting-database-changes/314916 "2022-09-22T08:54:12Z")
Hello we are using Elasticsearch version 7.16.2. We having synced our Elasticsearch with database using listeners. Usually the Elasticsearch reflects the database changes within no time but once it happened that it took … --- ## [Getting count using aggregation](https://discuss.elastic.co/t/getting-count-using-aggregation/314837)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 4\ **Last updated:** [September 22, 2022, 8:19am UTC](https://discuss.elastic.co/t/getting-count-using-aggregation/314837 "2022-09-22T08:19:59Z")
Hi Team, { "query": { "bool": { "filter": \[ { "bool": { "should":{ "range": { "@timestamp": { "gte": "now-15m" } } … --- ## [\`block in converge\_state' when setting up output to gelf host](https://discuss.elastic.co/t/block-in-converge-state-when-setting-up-output-to-gelf-host/314862)
**Author:** [@Heffie](https://discuss.elastic.co/u/Heffie)\ **Replies:** 1\ **Last updated:** [September 22, 2022, 8:14am UTC](https://discuss.elastic.co/t/block-in-converge-state-when-setting-up-output-to-gelf-host/314862 "2022-09-22T08:14:33Z")
Hi, Im getting this error: \[2022-09-21T11:32:55,738\]\[FATAL\]\[logstash.runner \] An unexpected error occurred! {:error=\>#\ **Author:** [@Pranjal\_Sett](https://discuss.elastic.co/u/Pranjal_Sett)\ **Replies:** 1\ **Last updated:** [September 22, 2022, 7:26am UTC](https://discuss.elastic.co/t/rdbms-query-transforms-to-elasticsearch-query-dsl/314907 "2022-09-22T07:26:48Z") Hi, I wanted to transform the RDBMS query into elasticsearch query DSL. So the RDBMS query is like below: sum(1) where \ = TODAY() and \ = ’K’ and \ \<\> 0 and \ = 0 And I have transformed that abov… --- ## [How to use offset in DateHistogram.Builder from new java api client](https://discuss.elastic.co/t/how-to-use-offset-in-datehistogram-builder-from-new-java-api-client/314921)
**Author:** [@Raghunandan](https://discuss.elastic.co/u/Raghunandan)\ **Replies:** 0\ **Last updated:** [September 22, 2022, 7:25am UTC](https://discuss.elastic.co/t/how-to-use-offset-in-datehistogram-builder-from-new-java-api-client/314921 "2022-09-22T07:25:35Z")
in old implementation of DateHistogramAggregationBuilder we could pass offset as string, dateHistogramAggregationBuilder.offset(configurationManagementProxy.getStartDayOfWeek() - 1) + "d"); now it requires the offset v… --- ## [Filtering data in Filebeat](https://discuss.elastic.co/t/filtering-data-in-filebeat/314918)
**Author:** [@Lynow](https://discuss.elastic.co/u/Lynow)\ **Replies:** 0\ **Last updated:** [September 22, 2022, 7:15am UTC](https://discuss.elastic.co/t/filtering-data-in-filebeat/314918 "2022-09-22T07:15:34Z")
Hello ! I work on a Proxmox server where I installed a Firewall PfSense router with three interfaces (LAN, DMZ, WAN) with different "user" VMs and as well as servers (web and bdd). So I installed Wazuh and Suricata to … --- ## [How to limit data from source index when rollup data at first time](https://discuss.elastic.co/t/how-to-limit-data-from-source-index-when-rollup-data-at-first-time/314917)
**Author:** [@Be-poz](https://discuss.elastic.co/u/Be-poz)\ **Replies:** 0\ **Last updated:** [September 22, 2022, 6:51am UTC](https://discuss.elastic.co/t/how-to-limit-data-from-source-index-when-rollup-data-at-first-time/314917 "2022-09-22T06:51:34Z")
hi, i'm now using rollup to summary my own data. problem is that the data i'm trying to rollup is too big. it takes a lot of time to rollup and also it affects the performance of es cluster. so i wonder if there is any… --- ## [Failing to get filebeat with suricata module to work](https://discuss.elastic.co/t/failing-to-get-filebeat-with-suricata-module-to-work/314835)
**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Replies:** 7\ **Last updated:** [September 22, 2022, 5:14am UTC](https://discuss.elastic.co/t/failing-to-get-filebeat-with-suricata-module-to-work/314835 "2022-09-22T05:14:29Z")
I have installed filebeat (7.17.1) on an ubuntu system. Run the setup stuff and loaded the dashboards into kibana. I have also "enabled" the suricata module, first by simply adding the appropriate stuff into /etc/fileb… --- ## [Unable connect to a .Net 5 project using cloudconnectionpool](https://discuss.elastic.co/t/unable-connect-to-a-net-5-project-using-cloudconnectionpool/314910)
**Author:** [@shrimdog](https://discuss.elastic.co/u/shrimdog)\ **Replies:** 0\ **Last updated:** [September 22, 2022, 4:33am UTC](https://discuss.elastic.co/t/unable-connect-to-a-net-5-project-using-cloudconnectionpool/314910 "2022-09-22T04:33:28Z")
Hi Everyone I wanted to use cloudconnectionpool to connect my local .Net 5 project using NEST API since I have deployed elastic cloud. I have posted some sample data into the Elasticsearch using postman and it works wh… --- ## [Search multiple fields using multiple text values](https://discuss.elastic.co/t/search-multiple-fields-using-multiple-text-values/314903)
**Author:** [@sadiki-dev](https://discuss.elastic.co/u/sadiki-dev)\ **Replies:** 2\ **Last updated:** [September 22, 2022, 1:28am UTC](https://discuss.elastic.co/t/search-multiple-fields-using-multiple-text-values/314903 "2022-09-22T01:28:50Z")
I work with address searching. and I want to search with two formats (multiple values) of an adress using multiple fields. adress is a text input not a keyword. For example : user\_address = 88 South East Street Raeford… --- ## [I have installed a Search guard Plugin in ELK 7.17.3 VERSION IN Windows, but the ELK Cluster is not starting up](https://discuss.elastic.co/t/i-have-installed-a-search-guard-plugin-in-elk-7-17-3-version-in-windows-but-the-elk-cluster-is-not-starting-up/314882)
**Author:** [@AKCG23](https://discuss.elastic.co/u/AKCG23)\ **Replies:** 3\ **Last updated:** [September 22, 2022, 12:15am UTC](https://discuss.elastic.co/t/i-have-installed-a-search-guard-plugin-in-elk-7-17-3-version-in-windows-but-the-elk-cluster-is-not-starting-up/314882 "2022-09-22T00:15:35Z")
I have the ELK Cluster(7.17.3)\* on the Windows 2019 Server. I have installed Search Guard Plugin. But after the plugin install the ELK Cluster nodes will not start up. It gives an error \`\`\` Javalang Illegalstateexcep… --- ## [Is it possible to format Logstash output in a way that it shows in Uptime?](https://discuss.elastic.co/t/is-it-possible-to-format-logstash-output-in-a-way-that-it-shows-in-uptime/314883)
**Author:** [@SamuelSMendes](https://discuss.elastic.co/u/SamuelSMendes)\ **Replies:** 3\ **Last updated:** [September 21, 2022, 8:50pm UTC](https://discuss.elastic.co/t/is-it-possible-to-format-logstash-output-in-a-way-that-it-shows-in-uptime/314883 "2022-09-21T20:50:25Z")
I was thinking if, by using mutate in the output of my pipeline on logstash in a way that "mimics" the heartbeat output, I could have an uptime application to see the return of my pseudo-heartbeat (generated by the logst… --- ## [ElasticsearchStatusException\[Unable to parse response body\] \[HTTP/1.1 301 Moved Permanently\]](https://discuss.elastic.co/t/elasticsearchstatusexception-unable-to-parse-response-body-http-1-1-301-moved-permanently/314888)
**Author:** [@Jai\_Tripathi](https://discuss.elastic.co/u/Jai_Tripathi)\ **Replies:** 3\ **Last updated:** [September 21, 2022, 8:13pm UTC](https://discuss.elastic.co/t/elasticsearchstatusexception-unable-to-parse-response-body-http-1-1-301-moved-permanently/314888 "2022-09-21T20:13:59Z")
Hello Everyone, Key Points: I am able to get response from Elastic search (deployed on AWS) using postman at my machine. However when I am trying to use elasticsearch API to get the response, I am getting Elasticsearc… --- ## [Tips on mirroring Elasticsearch plugin repos?](https://discuss.elastic.co/t/tips-on-mirroring-elasticsearch-plugin-repos/314893)
**Author:** [@clueless\_chris](https://discuss.elastic.co/u/clueless_chris)\ **Replies:** 0\ **Last updated:** [September 21, 2022, 7:45pm UTC](https://discuss.elastic.co/t/tips-on-mirroring-elasticsearch-plugin-repos/314893 "2022-09-21T19:45:25Z")
Hello, I've seen some similar questions on the forum, but wanted to see if I could get any official input on this. Is there any way to properly mirror the Elasticsearch plugins that are in: https://artifacts.elastic.co/… --- ## [Error migrating legacy index templates to composable](https://discuss.elastic.co/t/error-migrating-legacy-index-templates-to-composable/314885)
**Author:** [@Bob\_Penrod](https://discuss.elastic.co/u/Bob_Penrod)\ **Replies:** 0\ **Last updated:** [September 21, 2022, 5:15pm UTC](https://discuss.elastic.co/t/error-migrating-legacy-index-templates-to-composable/314885 "2022-09-21T17:15:16Z")
I'm running into errors on ES 7.17 migrating "legacy" index templates to the new composable style. Given the following two templates, creating the 2nd gets an error: PUT \_index\_template/test\_template\_1 { "index\_patte… --- ## [Avoid Timestamp and host from the logstash file output](https://discuss.elastic.co/t/avoid-timestamp-and-host-from-the-logstash-file-output/314870)
**Author:** [@evgrajesh](https://discuss.elastic.co/u/evgrajesh)\ **Replies:** 4\ **Last updated:** [September 21, 2022, 4:38pm UTC](https://discuss.elastic.co/t/avoid-timestamp-and-host-from-the-logstash-file-output/314870 "2022-09-21T16:38:35Z")
Hi I am using very simple configuration. Receive strings from TCP input and write to a file Sent string This is new string 8 Written in to file 2022-09-21T12:36:28.278922Z %{host} This is new string 8 I want to avo… --- ## [Environment variable in if condition is not working](https://discuss.elastic.co/t/environment-variable-in-if-condition-is-not-working/314863)
**Author:** [@seb.sch](https://discuss.elastic.co/u/seb.sch)\ **Replies:** 4\ **Last updated:** [September 21, 2022, 4:18pm UTC](https://discuss.elastic.co/t/environment-variable-in-if-condition-is-not-working/314863 "2022-09-21T16:18:36Z")
Hello there, I have the following pipeline output configuration: output { if ("${ELASTICSEARCH\_HOSTS:}" == "http://elasticsearch:9200") { elasticsearch { action =\> "index" index =\> "street" host… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=785) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=787)