# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=830 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 831 --- ## [Logstash match Thai timestamp](https://discuss.elastic.co/t/logstash-match-thai-timestamp/312077)
**Author:** [@Denis\_Smereka](https://discuss.elastic.co/u/Denis_Smereka)\ **Replies:** 0\ **Last updated:** [August 15, 2022, 8:22am UTC](https://discuss.elastic.co/t/logstash-match-thai-timestamp/312077 "2022-08-15T08:22:09Z")
I have certain logs which contain the following entries: 2022-08-10 12:55:58.535 Started. ๒๐๒๒-๐๘-๑๐ ๑๘:๓๔:๔๘.๒๗๑ Reader #0: ... The first line successfully matches using the pattern TIMESTAMP\_ISO8601. Second line als… --- ## [The \_ignored field not working?](https://discuss.elastic.co/t/the-ignored-field-not-working/310460)
**Author:** [@rokcarl](https://discuss.elastic.co/u/rokcarl)\ **Replies:** 4\ **Last updated:** [August 15, 2022, 8:16am UTC](https://discuss.elastic.co/t/the-ignored-field-not-working/310460 "2022-08-15T08:16:18Z")
Summary I'm using ignore\_malformed, but get no results when searching for the \_ignored field. Details I've isolated the problem to a small example. I: Create the index with ignore\_malformed set to true. Insert a cou… --- ## [Searchable snapshots](https://discuss.elastic.co/t/searchable-snapshots/310598)
**Author:** [@Morez](https://discuss.elastic.co/u/Morez)\ **Replies:** 6\ **Last updated:** [August 15, 2022, 5:49am UTC](https://discuss.elastic.co/t/searchable-snapshots/310598 "2022-08-15T05:49:36Z")
As mentioned in the Elasticsearch documentation, searchable snapshot is created typically by ILM, when index reaches to the cold or frozen data tier. Some times ago, it was mentioned that frozen data tier is deprecated … --- ## [HashMap\ to JsonData in new elasticsearch Java client API](https://discuss.elastic.co/t/hashmap-string-object-to-jsondata-in-new-elasticsearch-java-client-api/311357)
**Author:** [@ALX\_DM](https://discuss.elastic.co/u/ALX_DM)\ **Replies:** 2\ **Last updated:** [August 15, 2022, 1:58am UTC](https://discuss.elastic.co/t/hashmap-string-object-to-jsondata-in-new-elasticsearch-java-client-api/311357 "2022-08-15T01:58:38Z")
How to convert a hashmap to co.elastic.clients.json.JsonData in new elasticsearch Java client API? I am doing this conversion to provide the document to a IndexRequest.Builder. IndexRequest.Builder\ request = … --- ## [Secure specific indices from users manually updating documents](https://discuss.elastic.co/t/secure-specific-indices-from-users-manually-updating-documents/312042)
**Author:** [@Rakesh\_B](https://discuss.elastic.co/u/Rakesh_B)\ **Replies:** 2\ **Last updated:** [August 15, 2022, 1:54am UTC](https://discuss.elastic.co/t/secure-specific-indices-from-users-manually-updating-documents/312042 "2022-08-15T01:54:49Z")
Hi, Elasticsearch Version: 7.16.1 ECK version: 1.6.1 We use ELK to push audit logs from one of our applications and we'd like to know if there is a way to know if any HUMAN user manually updated any documents in that … --- ## [Layer dot found result](https://discuss.elastic.co/t/layer-dot-found-result/312028)
**Author:** [@5k\_pwc](https://discuss.elastic.co/u/5k_pwc)\ **Replies:** 28\ **Last updated:** [August 14, 2022, 6:37pm UTC](https://discuss.elastic.co/t/layer-dot-found-result/312028 "2022-08-14T18:37:57Z")
Hello everyone, I am having trouble viewing points in my kibana map, It says No results found , I have made sure the data is in geo.point format, so I have no clue what the problem could be. below is an image of the pr… --- ## [Ruby exception occurred: uninitialized constant when i am trying to devide a field value by 100](https://discuss.elastic.co/t/ruby-exception-occurred-uninitialized-constant-when-i-am-trying-to-devide-a-field-value-by-100/312058)
**Author:** [@Faiz\_Shamri](https://discuss.elastic.co/u/Faiz_Shamri)\ **Replies:** 7\ **Last updated:** [August 14, 2022, 6:19pm UTC](https://discuss.elastic.co/t/ruby-exception-occurred-uninitialized-constant-when-i-am-trying-to-devide-a-field-value-by-100/312058 "2022-08-14T18:19:08Z")
I am trying to devide filed value by 100 but i am getting Pipelines running {:count=\>1, :running\_pipelines=\>\[:main\], :non\_running\_pipelines=\>\[\]} \[ERROR\] 2022-08-14 00:10:07.738 \[\[main\]\>worker2\] ruby - Ruby exception occu… --- ## [\[Logstash\] \[Filebeat\] Using codec Plain and JSON for the same input](https://discuss.elastic.co/t/logstash-filebeat-using-codec-plain-and-json-for-the-same-input/310836)
**Author:** [@hdryx](https://discuss.elastic.co/u/hdryx)\ **Replies:** 8\ **Last updated:** [August 14, 2022, 4:55pm UTC](https://discuss.elastic.co/t/logstash-filebeat-using-codec-plain-and-json-for-the-same-input/310836 "2022-08-14T16:55:46Z")
Hi, Actually we have this architecture : Filebeat --\> Kafaka --\> Logstash The Logstash is using this input config : file1.conf input { kafka { codec =\> json bootstrap\_servers =\> "....." topics\_pattern =\>… --- ## [\[Filebeat Threat Intel\] MISP doesnt show anything](https://discuss.elastic.co/t/filebeat-threat-intel-misp-doesnt-show-anything/311539)
**Author:** [@VitorBarroso](https://discuss.elastic.co/u/VitorBarroso)\ **Replies:** 2\ **Last updated:** [August 14, 2022, 3:18pm UTC](https://discuss.elastic.co/t/filebeat-threat-intel-misp-doesnt-show-anything/311539 "2022-08-14T15:18:45Z")
\[Filebeat Threat Intel\] MISP doesnt show any information. What can i do to resolve this problem? --- ## [Deploy Elastic Agent successful but has no data steams](https://discuss.elastic.co/t/deploy-elastic-agent-successful-but-has-no-data-steams/311955)
**Author:** [@Han\_Cloud\_Strife](https://discuss.elastic.co/u/Han_Cloud_Strife)\ **Replies:** 1\ **Last updated:** [August 14, 2022, 3:00pm UTC](https://discuss.elastic.co/t/deploy-elastic-agent-successful-but-has-no-data-steams/311955 "2022-08-14T15:00:11Z")
Hi there! I got a problem with Elastic Agent when using ELK on docker. I have two docker-compose files for creating certificate and deploying ELK purpose. I enrolled elastic agent successfull \[1\] however I got bad\_certi… --- ## [Logstatsh throws cluster - Exception in monitor thread while connecting to server](https://discuss.elastic.co/t/logstatsh-throws-cluster-exception-in-monitor-thread-while-connecting-to-server/312049)
**Author:** [@momarious](https://discuss.elastic.co/u/momarious)\ **Replies:** 4\ **Last updated:** [August 14, 2022, 2:10pm UTC](https://discuss.elastic.co/t/logstatsh-throws-cluster-exception-in-monitor-thread-while-connecting-to-server/312049 "2022-08-14T14:10:17Z")
Hello everyone this is my first post in this forum, well I would like to synchronize a MongoDB database with Elasticsearch thanks to Logstash, I used version 8.3.3 of ELK with a MongoDriver4.4. I have configured the pipe… --- ## [Version\_conflict\_engine\_exception，help me](https://discuss.elastic.co/t/version-conflict-engine-exception-help-me/312065)
**Author:** [@wangshouqi111](https://discuss.elastic.co/u/wangshouqi111)\ **Replies:** 1\ **Last updated:** [August 14, 2022, 12:29pm UTC](https://discuss.elastic.co/t/version-conflict-engine-exception-help-me/312065 "2022-08-14T12:29:17Z")
Elasticsearch Version 7.1.1 client: public void index(List\ promoSkuInfoEsEntries) throws IOException { BulkRequest request = new BulkRequest(); List\\> list… --- ## [java.lang.IllegalStateException: Unable to access 'path.repo'](https://discuss.elastic.co/t/java-lang-illegalstateexception-unable-to-access-path-repo/312009)
**Author:** [@mujtabah](https://discuss.elastic.co/u/mujtabah)\ **Replies:** 6\ **Last updated:** [August 14, 2022, 9:29am UTC](https://discuss.elastic.co/t/java-lang-illegalstateexception-unable-to-access-path-repo/312009 "2022-08-14T09:29:55Z")
Hi guys, I have a single node elastic setup o windows10. i tried to create repository on shared folder. the process i did was, i created a folder (Es\_backup) in shared drive then i mapped folder on my elastic local mach… --- ## [Kibana 7.17.1 -- can't find index pattern uuids?](https://discuss.elastic.co/t/kibana-7-17-1-cant-find-index-pattern-uuids/312059)
**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Replies:** 1\ **Last updated:** [August 13, 2022, 10:25pm UTC](https://discuss.elastic.co/t/kibana-7-17-1-cant-find-index-pattern-uuids/312059 "2022-08-13T22:25:23Z")
On several occasions with older release I have exported saved objects fiddled with the pattern uuid and then imported them back. I am now doing a major migration of dashboards where I need to change the index patterns, … --- ## [Help to parse date time](https://discuss.elastic.co/t/help-to-parse-date-time/312045)
**Author:** [@Claudio\_Ract\_Costa](https://discuss.elastic.co/u/Claudio_Ract_Costa)\ **Replies:** 1\ **Last updated:** [August 13, 2022, 4:15pm UTC](https://discuss.elastic.co/t/help-to-parse-date-time/312045 "2022-08-13T16:15:47Z")
Hi, I am trying to parse datetime bellow on logstash but i couldnt. The line is: "Aug 13, 2022 02:24:02.532177318 -03"|10.191.69.248|60542|10.110.62.45|3868|||PABLM01-SAECIS01-Gx-Openet;787252731;575065246;62f6e893-9… --- ## [When sorting by distance truncating the distance sort value for fallback sort criteria](https://discuss.elastic.co/t/when-sorting-by-distance-truncating-the-distance-sort-value-for-fallback-sort-criteria/312055)
**Author:** [@quesurifn](https://discuss.elastic.co/u/quesurifn)\ **Replies:** 0\ **Last updated:** [August 13, 2022, 2:50pm UTC](https://discuss.elastic.co/t/when-sorting-by-distance-truncating-the-distance-sort-value-for-fallback-sort-criteria/312055 "2022-08-13T14:50:21Z")
Hello all, We're sorting with elasticsearch like so: { "size": 300, "from": 0, "sort": \[ { "\_geo\_distance": { "geoLocation": { "lat": 29.7407, … --- ## [Remove Arguments from URI in kibana visualization](https://discuss.elastic.co/t/remove-arguments-from-uri-in-kibana-visualization/312053)
**Author:** [@Vaibhav\_Mathur1](https://discuss.elastic.co/u/Vaibhav_Mathur1)\ **Replies:** 0\ **Last updated:** [August 13, 2022, 12:37pm UTC](https://discuss.elastic.co/t/remove-arguments-from-uri-in-kibana-visualization/312053 "2022-08-13T12:37:09Z")
I am creating a visualisation with counting total urls hits I am able to get all urls and counts but i am getting url with arguments as below ur1?a=1. =\> count 100 url1?b=2 =\> count 100 what i want is url1 =\> co… --- ## [Getting exception while searching search as type field type](https://discuss.elastic.co/t/getting-exception-while-searching-search-as-type-field-type/310839)
**Author:** [@Munish\_Bhardwaj](https://discuss.elastic.co/u/Munish_Bhardwaj)\ **Replies:** 1\ **Last updated:** [August 13, 2022, 2:04am UTC](https://discuss.elastic.co/t/getting-exception-while-searching-search-as-type-field-type/310839 "2022-08-13T02:04:16Z")
I have a requirement where I need to implement search recommendations and I have opted for the search as you type field. My existing mapping for the field was "text" and now I have changed it to "search\_as\_you\_type" and … --- ## [\_meta: Root mapping definition has unsupported parameters](https://discuss.elastic.co/t/meta-root-mapping-definition-has-unsupported-parameters/311024)
**Author:** [@NLSVTN](https://discuss.elastic.co/u/NLSVTN)\ **Replies:** 5\ **Last updated:** [August 13, 2022, 12:00am UTC](https://discuss.elastic.co/t/meta-root-mapping-definition-has-unsupported-parameters/311024 "2022-08-13T00:00:27Z")
I have ES7. Currently the mapping looks like: { 'mappings': { 'properties': { 'aIndex': {'type': 'integer'}, 'AC': {'type': 'integer'}, 'AF': {'type': 'double'}, ... … --- ## [How to remove brackets on grok patterns?](https://discuss.elastic.co/t/how-to-remove-brackets-on-grok-patterns/310547)
**Author:** [@SamuelSMendes](https://discuss.elastic.co/u/SamuelSMendes)\ **Replies:** 1\ **Last updated:** [August 12, 2022, 11:34pm UTC](https://discuss.elastic.co/t/how-to-remove-brackets-on-grok-patterns/310547 "2022-08-12T23:34:44Z")
Continuing the discussion from Remove characters in grok: On the previous post is an example of how to remove "," in grok. I was wondering if there is something to remove the "\[,\]" as well. I still don't know if is it'… --- ## [Upgrading from 7.16.1 to 7.17.5 Broke Kibana Monitoring Tab](https://discuss.elastic.co/t/upgrading-from-7-16-1-to-7-17-5-broke-kibana-monitoring-tab/311460)
**Author:** [@jouellette](https://discuss.elastic.co/u/jouellette)\ **Replies:** 2\ **Last updated:** [August 12, 2022, 10:39pm UTC](https://discuss.elastic.co/t/upgrading-from-7-16-1-to-7-17-5-broke-kibana-monitoring-tab/311460 "2022-08-12T22:39:09Z")
Earlier this week I upgraded from ES/Kibana 7.16.2 to 7.17.5. My setup consisted of a Production ES cluster and a separate single server as the monitoring cluster. The production cluster would push info to the monitoring… --- ## [Report of Total Inventory](https://discuss.elastic.co/t/report-of-total-inventory/310496)
**Author:** [@Ashish10195](https://discuss.elastic.co/u/Ashish10195)\ **Replies:** 0\ **Last updated:** [July 25, 2022, 4:57am UTC](https://discuss.elastic.co/t/report-of-total-inventory/310496 "2022-07-25T04:57:43Z")
Hi ,How can we download/Export total devices inventory on which Agent is installed . --- ## [How enable syntax error](https://discuss.elastic.co/t/how-enable-syntax-error/311270)
**Author:** [@tomASZ1](https://discuss.elastic.co/u/tomASZ1)\ **Replies:** 1\ **Last updated:** [August 12, 2022, 10:30pm UTC](https://discuss.elastic.co/t/how-enable-syntax-error/311270 "2022-08-12T22:30:36Z")
hi i use ace in kibana but hi dont show my syntax in ace is this option \ **Author:** [@gabrsar](https://discuss.elastic.co/u/gabrsar)\ **Replies:** 1\ **Last updated:** [August 12, 2022, 10:24pm UTC](https://discuss.elastic.co/t/simple-query-giving-error-query-contains-too-many-nested-clauses/310779 "2022-08-12T22:24:31Z") Hi! A few weeks ago I started noticing that any query I made with more than one word give me the error "Query contains too many nested clauses; maxClauseCount is set to 1024". I'm doing something wrong? Example of quer… --- ## [Kibana drill-down Single click vs Context menu trigger on maps](https://discuss.elastic.co/t/kibana-drill-down-single-click-vs-context-menu-trigger-on-maps/311379)
**Author:** [@petersedivec](https://discuss.elastic.co/u/petersedivec)\ **Replies:** 1\ **Last updated:** [August 12, 2022, 10:18pm UTC](https://discuss.elastic.co/t/kibana-drill-down-single-click-vs-context-menu-trigger-on-maps/311379 "2022-08-12T22:18:20Z")
We're using 7.17 and I'm trying to understand in Kibana drilldowns the option between Single click and Context menu when creating a drill-down. I am using drill-downs on maps and I have a working "Go to URL" drill down … --- ## [Configuring Correct Monitor Schedule in Kibana: Have Schedule Set as 24 Hours or Throttle Action for 24 Hours?](https://discuss.elastic.co/t/configuring-correct-monitor-schedule-in-kibana-have-schedule-set-as-24-hours-or-throttle-action-for-24-hours/311157)
**Author:** [@ccsisko](https://discuss.elastic.co/u/ccsisko)\ **Replies:** 1\ **Last updated:** [August 12, 2022, 10:09pm UTC](https://discuss.elastic.co/t/configuring-correct-monitor-schedule-in-kibana-have-schedule-set-as-24-hours-or-throttle-action-for-24-hours/311157 "2022-08-12T22:09:34Z")
Hello! I have a simple question that I can't seem to find the answer to. If I select 24 hours as the Kibana monitor schedule, when the extraction query for the alert is run, will it catch everything that met the conditi… --- ## [Need a customize scale for showing colors & labels in Heat Map](https://discuss.elastic.co/t/need-a-customize-scale-for-showing-colors-labels-in-heat-map/311365)
**Author:** [@SunderRajan](https://discuss.elastic.co/u/SunderRajan)\ **Replies:** 1\ **Last updated:** [August 12, 2022, 10:02pm UTC](https://discuss.elastic.co/t/need-a-customize-scale-for-showing-colors-labels-in-heat-map/311365 "2022-08-12T22:02:20Z")
Hi Team, We're exploring the possibilities for using ELK for one of our requirement. We need the heat map visualization as part of our Dashboard. Currently in HeatMap, Labels are displayed based on Data Aggregation and… --- ## [Drill-down URLs don't appear to work without protocol](https://discuss.elastic.co/t/drill-down-urls-dont-appear-to-work-without-protocol/311388)
**Author:** [@petersedivec](https://discuss.elastic.co/u/petersedivec)\ **Replies:** 1\ **Last updated:** [August 12, 2022, 10:00pm UTC](https://discuss.elastic.co/t/drill-down-urls-dont-appear-to-work-without-protocol/311388 "2022-08-12T22:00:07Z")
We have a field in our dataset that contains a full URL (e.g. https:\\\\example.com). Unfortunately using "Go To URL" drill-down doesn't work if we specify it as {{event.value}}. I've managed to work around this by using… --- ## [Link in markdown to a different page on same Canvas, strange behavior](https://discuss.elastic.co/t/link-in-markdown-to-a-different-page-on-same-canvas-strange-behavior/310666)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 1\ **Last updated:** [August 12, 2022, 9:41pm UTC](https://discuss.elastic.co/t/link-in-markdown-to-a-different-page-on-same-canvas-strange-behavior/310666 "2022-08-12T21:41:45Z")
Hi this is my markdown: \[Test\](https://my-site/s/my-client/app/canvas/workpad/workpad-d362ae7b-7f31-4ca8-9e66-0eb02759b566/page/2?\_\_fullScreen=true) When I click a link to go to another page in the same Canvas, it seem… --- ## [Canvas timeline](https://discuss.elastic.co/t/canvas-timeline/311403)
**Author:** [@79g](https://discuss.elastic.co/u/79g)\ **Replies:** 1\ **Last updated:** [August 12, 2022, 9:38pm UTC](https://discuss.elastic.co/t/canvas-timeline/311403 "2022-08-12T21:38:36Z")
Hello, I'm working on a canvas now, and I see that the data represented on it is not complete. As you can see in the screenshot, in the graph there are more than 500 users, but in the right side the counter counts only… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=829) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=831)