# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=799 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 800 --- ## [Canvas Batch elastic query or single query as data source for multiple elements](https://discuss.elastic.co/t/canvas-batch-elastic-query-or-single-query-as-data-source-for-multiple-elements/314060)
**Author:** [@Requium](https://discuss.elastic.co/u/Requium)\ **Replies:** 1\ **Last updated:** [September 9, 2022, 7:45pm UTC](https://discuss.elastic.co/t/canvas-batch-elastic-query-or-single-query-as-data-source-for-multiple-elements/314060 "2022-09-09T19:45:52Z")
im working with canvas right now and i really liked it, right now im doing a state dashboard and im working with 30 elements, every element with his own query, and i was wondering if there is a better way to do it becaus… --- ## [Can you filter on top ranked inner nested hit in same query](https://discuss.elastic.co/t/can-you-filter-on-top-ranked-inner-nested-hit-in-same-query/314085)
**Author:** [@chimauwah](https://discuss.elastic.co/u/chimauwah)\ **Replies:** 0\ **Last updated:** [September 9, 2022, 7:35pm UTC](https://discuss.elastic.co/t/can-you-filter-on-top-ranked-inner-nested-hit-in-same-query/314085 "2022-09-09T19:35:13Z")
Cheers all! Let's say I have a mapping with a nested object like this: { "APP\_APPLICATION\_ID": { "type": "long" }, "APP\_FNAME": { "type": "text", "fields": { "raw": { "type": "keyword" … --- ## [Kibana server is not ready yet](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet/313925)
**Author:** [@Boodle](https://discuss.elastic.co/u/Boodle)\ **Replies:** 8\ **Last updated:** [September 9, 2022, 7:07pm UTC](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet/313925 "2022-09-09T19:07:59Z")
Have a 3 node cluster for elasticsearch on docker server1(recently upgraded to 7.17.6), server2(On 7.10.1), server3(On 7.10.1) and a single Kibana(recently upgraded to 7.17.6) instance on server1. All 3 ES nodes & kib… --- ## [Parameters in some files not exposed?](https://discuss.elastic.co/t/parameters-in-some-files-not-exposed/313482)
**Author:** [@jmlucjav](https://discuss.elastic.co/u/jmlucjav)\ **Replies:** 4\ **Last updated:** [September 9, 2022, 6:13pm UTC](https://discuss.elastic.co/t/parameters-in-some-files-not-exposed/313482 "2022-09-09T18:13:52Z")
Hi, I am trying to use -track-params. My track is typical: { "version": 2, "description": "Tracker-generated track for track", "indices": \[ { "name": "{{p\_target\_index}}", "body": "{{… --- ## [Single quotes makes MySQL statement invalid using jdbc\_streaming filter](https://discuss.elastic.co/t/single-quotes-makes-mysql-statement-invalid-using-jdbc-streaming-filter/314078)
**Author:** [@roeeklinger](https://discuss.elastic.co/u/roeeklinger)\ **Replies:** 0\ **Last updated:** [September 9, 2022, 4:39pm UTC](https://discuss.elastic.co/t/single-quotes-makes-mysql-statement-invalid-using-jdbc-streaming-filter/314078 "2022-09-09T16:39:48Z")
Hello, I am trying to use the jdbc\_streaming filter with a regexp statement, like this: jdbc\_streaming { jdbc\_driver\_library =\> "/usr/share/logstash/jdbc\_drivers/mysql-connector-java-8.0.30.jar" jdbc\_driver\_… --- ## [IAS NPS radius parser with dissect on filebeat](https://discuss.elastic.co/t/ias-nps-radius-parser-with-dissect-on-filebeat/314076)
**Author:** [@florinsfetea](https://discuss.elastic.co/u/florinsfetea)\ **Replies:** 0\ **Last updated:** [September 9, 2022, 4:26pm UTC](https://discuss.elastic.co/t/ias-nps-radius-parser-with-dissect-on-filebeat/314076 "2022-09-09T16:26:39Z")
Hello People, I was searching for a solution to parse our NPS logs via filebeat and dissect and could not seems to find a related topic for this. I am using fleet and a custom log integration to collect the logs So he… --- ## [XML - Illegal Argument Exception](https://discuss.elastic.co/t/xml-illegal-argument-exception/313704)
**Author:** [@hnf](https://discuss.elastic.co/u/hnf)\ **Replies:** 9\ **Last updated:** [September 9, 2022, 4:17pm UTC](https://discuss.elastic.co/t/xml-illegal-argument-exception/313704 "2022-09-09T16:17:40Z")
Hello Everyone, I'm unable to dissect my xml file. I'm getting some error of "error"=\>{"type"=\>"illegal\_argument\_exception", "reason"=\>"mapper \[CELL\] cannot be changed from type \[text\] to \[ObjectMapper\]"}. Please find b… --- ## [LogStash Next Step](https://discuss.elastic.co/t/logstash-next-step/313927)
**Author:** [@Technolust](https://discuss.elastic.co/u/Technolust)\ **Replies:** 11\ **Last updated:** [September 9, 2022, 4:01pm UTC](https://discuss.elastic.co/t/logstash-next-step/313927 "2022-09-09T16:01:17Z")
Team, I'm not sure what I'm missing or I have broken here. I have an Elastic Server, Kibana Server, and Logstash Server. Elastic and Kibana are working. I'v setup one cisco switch to send logs to logstash and setup logs… --- ## [Need to frequently change url-timestamp value within logstash input](https://discuss.elastic.co/t/need-to-frequently-change-url-timestamp-value-within-logstash-input/314026)
**Author:** [@Pukar](https://discuss.elastic.co/u/Pukar)\ **Replies:** 3\ **Last updated:** [September 9, 2022, 3:56pm UTC](https://discuss.elastic.co/t/need-to-frequently-change-url-timestamp-value-within-logstash-input/314026 "2022-09-09T15:56:39Z")
Hi, I'm parsing some json data from a website using rest api with start\_timestamp of 4 hours before current time period. Is there a way within logstash to write such code to get data from last 4 hours on every runtime o… --- ## [Watcher license does not allow action execution](https://discuss.elastic.co/t/watcher-license-does-not-allow-action-execution/312615)
**Author:** [@Nina\_Nikolaeva](https://discuss.elastic.co/u/Nina_Nikolaeva)\ **Replies:** 1\ **Last updated:** [September 9, 2022, 3:47pm UTC](https://discuss.elastic.co/t/watcher-license-does-not-allow-action-execution/312615 "2022-09-09T15:47:22Z")
Hello, my company is using a few environments with trial license and we are negotiating to sign a contract with you for a higher tier. We have configured some watchers (6), 5 of them work ok, however one of them gives t… --- ## [Multiple syslog messages in one event](https://discuss.elastic.co/t/multiple-syslog-messages-in-one-event/314071)
**Author:** [@simpleman](https://discuss.elastic.co/u/simpleman)\ **Replies:** 0\ **Last updated:** [September 9, 2022, 3:09pm UTC](https://discuss.elastic.co/t/multiple-syslog-messages-in-one-event/314071 "2022-09-09T15:09:41Z")
I am trying to send logs from Symantec Endpoint Protection to Logstash using syslog. Unfortunately, Beats is not an option for our setup. So I have SEP send syslogs over tcp at port 50000. At the moment, I simply print t… --- ## [Performance degradation in 7.16.3 when compared to 5.6.9](https://discuss.elastic.co/t/performance-degradation-in-7-16-3-when-compared-to-5-6-9/314070)
**Author:** [@chaitu0292](https://discuss.elastic.co/u/chaitu0292)\ **Replies:** 0\ **Last updated:** [September 9, 2022, 3:08pm UTC](https://discuss.elastic.co/t/performance-degradation-in-7-16-3-when-compared-to-5-6-9/314070 "2022-09-09T15:08:42Z")
Observed performance degradation in 7.16.3 when compared to 5.6.9 Run ES\_version AVG(ms) Max(ms) 1 7.16.3 294 913 2 7.16.3 434 1038 1 5.6.9 83 619 2 5.6.9 107 … --- ## [How to remove "Elastic Cloud agent policy" elastic agents that are Offline in Fleet](https://discuss.elastic.co/t/how-to-remove-elastic-cloud-agent-policy-elastic-agents-that-are-offline-in-fleet/313987)
**Author:** [@dabo](https://discuss.elastic.co/u/dabo)\ **Replies:** 1\ **Last updated:** [September 9, 2022, 3:07pm UTC](https://discuss.elastic.co/t/how-to-remove-elastic-cloud-agent-policy-elastic-agents-that-are-offline-in-fleet/313987 "2022-09-09T15:07:37Z")
Hi, We are using Elastic Cloud 8.3.3 version now and currently have 264 offline elastic agent assigned to this \[Elastic Cloud agent policy\]. Are they still only removable via API? The number of agents is increasing … --- ## [\_bulk\_create / index-pattern / saved object name](https://discuss.elastic.co/t/bulk-create-index-pattern-saved-object-name/314066)
**Author:** [@orcema](https://discuss.elastic.co/u/orcema)\ **Replies:** 0\ **Last updated:** [September 9, 2022, 2:31pm UTC](https://discuss.elastic.co/t/bulk-create-index-pattern-saved-object-name/314066 "2022-09-09T14:31:57Z")
According to \_bulk\_create example here i have to specify an id and a title as an attribute. The created object has as name and index-pattern the value of the title from the request. How can i setup a different n… --- ## [Question about email notification alert](https://discuss.elastic.co/t/question-about-email-notification-alert/314044)
**Author:** [@morad\_della3](https://discuss.elastic.co/u/morad_della3)\ **Replies:** 8\ **Last updated:** [September 9, 2022, 2:30pm UTC](https://discuss.elastic.co/t/question-about-email-notification-alert/314044 "2022-09-09T14:30:53Z")
does elasticsearch SIEM email notification alert is free in the current version of elastic stack 8.4.1 ?? I heard that this tool is gold or somethinglike that i don't know more about it. or i will use elasticalert? --- ## [Rounding up values in extraction queries](https://discuss.elastic.co/t/rounding-up-values-in-extraction-queries/313981)
**Author:** [@Marius\_Kunauskas](https://discuss.elastic.co/u/Marius_Kunauskas)\ **Replies:** 1\ **Last updated:** [September 9, 2022, 2:14pm UTC](https://discuss.elastic.co/t/rounding-up-values-in-extraction-queries/313981 "2022-09-09T14:14:44Z")
When setting up an alert and defining by using an extraction query, how do I make the response come out as a rounded value? What is the general syntax and where do I specify this? Example: { "aggs": { "2": { … --- ## [How to use If else condition in script fields](https://discuss.elastic.co/t/how-to-use-if-else-condition-in-script-fields/313947)
**Author:** [@Krishna\_Sai\_Nag\_G](https://discuss.elastic.co/u/Krishna_Sai_Nag_G)\ **Replies:** 1\ **Last updated:** [September 9, 2022, 1:27pm UTC](https://discuss.elastic.co/t/how-to-use-if-else-condition-in-script-fields/313947 "2022-09-09T13:27:08Z")
Hi i have a query as following, i am getting the result when the "field\_5" in script field have some data and when it is empty, it is not returning and is showing error. And i want to check with if else condition in bot… --- ## [Time Difference between two logs](https://discuss.elastic.co/t/time-difference-between-two-logs/314028)
**Author:** [@Anil\_Alapati](https://discuss.elastic.co/u/Anil_Alapati)\ **Replies:** 6\ **Last updated:** [September 9, 2022, 1:11pm UTC](https://discuss.elastic.co/t/time-difference-between-two-logs/314028 "2022-09-09T13:11:05Z")
I have two logs. log1 is the start of the process and log2 is the end of the process. How can I get the time taken to complete the process. that is the difference between log2 and log 1. And also I have log3 , now how … --- ## [File transfer error from logstash to elasticsearch](https://discuss.elastic.co/t/file-transfer-error-from-logstash-to-elasticsearch/313950)
**Author:** [@Sagar\_Shrestha](https://discuss.elastic.co/u/Sagar_Shrestha)\ **Replies:** 9\ **Last updated:** [September 9, 2022, 12:54pm UTC](https://discuss.elastic.co/t/file-transfer-error-from-logstash-to-elasticsearch/313950 "2022-09-09T12:54:41Z")
In my windows machine. My Logstash is working fine as administrator. When I input any raw data in the console (when input is stdin { } ) it is indexed into the Elasticsearch. But when any file format document is executed… --- ## [Logstash to logstash](https://discuss.elastic.co/t/logstash-to-logstash/314051)
**Author:** [@alaine](https://discuss.elastic.co/u/alaine)\ **Replies:** 1\ **Last updated:** [September 9, 2022, 11:59am UTC](https://discuss.elastic.co/t/logstash-to-logstash/314051 "2022-09-09T11:59:20Z")
Hello, I am trying to add another output to some of our logstashes to output beats data to another logstash. I am attempting to use the lumberjack protocol and have been following the elastic documentation to do so. I h… --- ## [How to send only error logs path from filebeat to logstash](https://discuss.elastic.co/t/how-to-send-only-error-logs-path-from-filebeat-to-logstash/314050)
**Author:** [@poojitha0812](https://discuss.elastic.co/u/poojitha0812)\ **Replies:** 0\ **Last updated:** [September 9, 2022, 10:55am UTC](https://discuss.elastic.co/t/how-to-send-only-error-logs-path-from-filebeat-to-logstash/314050 "2022-09-09T10:55:07Z")
Hi , I am able to send logs from filebeat to logstash but i enabled logging level and given path to save under /var/log/filebeat to save the error files . filebeat is connected to logstash and now i am want logstash to … --- ## [Refer highlight fields in webhook message](https://discuss.elastic.co/t/refer-highlight-fields-in-webhook-message/314049)
**Author:** [@Ananya\_Chowdhury](https://discuss.elastic.co/u/Ananya_Chowdhury)\ **Replies:** 0\ **Last updated:** [September 9, 2022, 10:28am UTC](https://discuss.elastic.co/t/refer-highlight-fields-in-webhook-message/314049 "2022-09-09T10:28:43Z")
In my elastic query where i have highlight fields as shortmessage to custom the length of short message and i want to refere that in webhook message. But when i am referring under contexthits as highlight.short\_message i… --- ## [Elasticsearch script weak at handle string change while use for loop?](https://discuss.elastic.co/t/elasticsearch-script-weak-at-handle-string-change-while-use-for-loop/313936)
**Author:** [@robocon20x](https://discuss.elastic.co/u/robocon20x)\ **Replies:** 4\ **Last updated:** [September 9, 2022, 10:26am UTC](https://discuss.elastic.co/t/elasticsearch-script-weak-at-handle-string-change-while-use-for-loop/313936 "2022-09-09T10:26:19Z")
Elasticsearch really weak at handle string change. i have a script like this def newSegment; if(params.data !=null){ for (entry in params.data.entrySet()){ if (entry.getValue() != null) { ctx.\_source\[entry.g… --- ## [Kibana visualizations changed to No result found when select one visualization from dashboard](https://discuss.elastic.co/t/kibana-visualizations-changed-to-no-result-found-when-select-one-visualization-from-dashboard/312582)
**Author:** [@Mary2022](https://discuss.elastic.co/u/Mary2022)\ **Replies:** 2\ **Last updated:** [September 9, 2022, 9:17am UTC](https://discuss.elastic.co/t/kibana-visualizations-changed-to-no-result-found-when-select-one-visualization-from-dashboard/312582 "2022-09-09T09:17:41Z")
I am running Kibana 7.17.1. I created a dashboard in kibana with multiple visualizations on it. I noticed that when I select/click on one of the visualizations the other ones changed to "No results found". How can I st… --- ## [Force merge is taking long time](https://discuss.elastic.co/t/force-merge-is-taking-long-time/312574)
**Author:** [@prasath\_s](https://discuss.elastic.co/u/prasath_s)\ **Replies:** 6\ **Last updated:** [September 9, 2022, 8:14am UTC](https://discuss.elastic.co/t/force-merge-is-taking-long-time/312574 "2022-09-09T08:14:21Z")
After migrating from elastic version 5.2 to 7.16.2 force merge for few indices are taking long time. These indices are around 120GB. In the force merge step we are making total segement as 1. Any help here --- ## [Customising built-in ILM policies](https://discuss.elastic.co/t/customising-built-in-ilm-policies/314037)
**Author:** [@praveen\_raju](https://discuss.elastic.co/u/praveen_raju)\ **Replies:** 0\ **Last updated:** [September 9, 2022, 8:03am UTC](https://discuss.elastic.co/t/customising-built-in-ilm-policies/314037 "2022-09-09T08:03:26Z")
Following are the ILM policies i see which are created by default/ logs metrics synthetics I would like to delete the data after 90 days from the above ILM policies, is it recommended to update the current ILM policie… --- ## [Elasticsearch async search very slow](https://discuss.elastic.co/t/elasticsearch-async-search-very-slow/314016)
**Author:** [@bonyolult](https://discuss.elastic.co/u/bonyolult)\ **Replies:** 6\ **Last updated:** [September 9, 2022, 7:54am UTC](https://discuss.elastic.co/t/elasticsearch-async-search-very-slow/314016 "2022-09-09T07:54:52Z")
I'm running queries on a 3 node cluster. Simple query\_string query with some wildcards. When i use \_search, it takes about 10-15 ms to execute the query but when using \_async\_search query time goes up to around 300 000 m… --- ## [UDP input codec](https://discuss.elastic.co/t/udp-input-codec/313740)
**Author:** [@Laurent\_DEGEN](https://discuss.elastic.co/u/Laurent_DEGEN)\ **Replies:** 7\ **Last updated:** [September 9, 2022, 7:48am UTC](https://discuss.elastic.co/t/udp-input-codec/313740 "2022-09-09T07:48:54Z")
Hi, I have an NB-IOT sensor that outputs UDP packets containing some data. I used the default UDP input plugin and default plain codec but It does not decode the packet's UDP payload the way I want it to (headers work … --- ## [Unable to configure Elastic , Kibana tool in new environment](https://discuss.elastic.co/t/unable-to-configure-elastic-kibana-tool-in-new-environment/313938)
**Author:** [@Infratech](https://discuss.elastic.co/u/Infratech)\ **Replies:** 10\ **Last updated:** [September 9, 2022, 7:37am UTC](https://discuss.elastic.co/t/unable-to-configure-elastic-kibana-tool-in-new-environment/313938 "2022-09-09T07:37:14Z")
I have logged in but showing below error. I have already assigned Admin, PowerUser role to user.. Please look in to this…. --- ## [Logstash process killed and as a result the ingestion stopped](https://discuss.elastic.co/t/logstash-process-killed-and-as-a-result-the-ingestion-stopped/314032)
**Author:** [@stillfreem](https://discuss.elastic.co/u/stillfreem)\ **Replies:** 0\ **Last updated:** [September 9, 2022, 6:59am UTC](https://discuss.elastic.co/t/logstash-process-killed-and-as-a-result-the-ingestion-stopped/314032 "2022-09-09T06:59:14Z")
Hi All, I had a perfectly fine working configuration of Logstash. I colleague of mine tried to troubleshoote and killed the Logstash process thought. After Logstash restarted the ingestion stopped and in the log file … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=798) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=800)