# Latest **URL:** https://discuss.elastic.co/latest.md?page=1002 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1003 --- ## [Controls on Dashboards not showing all the options](https://discuss.elastic.co/t/controls-on-dashboards-not-showing-all-the-options/312115)
**Author:** [@SamuelSMendes](https://discuss.elastic.co/u/SamuelSMendes)\ **Replies:** 4\ **Last updated:** [August 18, 2022, 2:02pm UTC](https://discuss.elastic.co/t/controls-on-dashboards-not-showing-all-the-options/312115 "2022-08-18T14:02:33Z")
I've been trying to make use of the Controls in the Kibana Dashboards but it keeps eliminating some information. It's saying to change the configuration on Kibana.yml but I'm using the Elastic Cloud so I'm not sure what … --- ## [Is there something to Filter metrics on Lens?](https://discuss.elastic.co/t/is-there-something-to-filter-metrics-on-lens/312319)
**Author:** [@SamuelSMendes](https://discuss.elastic.co/u/SamuelSMendes)\ **Replies:** 1\ **Last updated:** [August 18, 2022, 1:54pm UTC](https://discuss.elastic.co/t/is-there-something-to-filter-metrics-on-lens/312319 "2022-08-18T13:54:22Z")
I've been exploring some data on Lens and got to the point where negative values ended up showing up on my data, I just want to pick the ones with "1" on it. I know that in canvas a simple "WHERE" would work but I don't … --- ## [Controlling Elasticsearch hidden indices .kibana\*](https://discuss.elastic.co/t/controlling-elasticsearch-hidden-indices-kibana/312391)
**Author:** [@Mark\_S](https://discuss.elastic.co/u/Mark_S)\ **Replies:** 0\ **Last updated:** [August 18, 2022, 1:31pm UTC](https://discuss.elastic.co/t/controlling-elasticsearch-hidden-indices-kibana/312391 "2022-08-18T13:31:24Z")
Elasticsearch hidden indices .kibana\_task\_manager and .kibana\_event\_logs are periodically updated. How to change this frequency? Maybe it is some index setting e.g. translog {sync\_interval : "5s"}, or maybe "refresh\_int… --- ## [Grok formatting](https://discuss.elastic.co/t/grok-formatting/312312)
**Author:** [@Paulo\_Neto](https://discuss.elastic.co/u/Paulo_Neto)\ **Replies:** 6\ **Last updated:** [August 18, 2022, 1:17pm UTC](https://discuss.elastic.co/t/grok-formatting/312312 "2022-08-18T13:17:12Z")
I am trying to format the text according to the example below: %{TIMESTAMP\_ISO8601:time} %{WORD:method} %{URIPATH:uri\_requested} %{NUMBER:port} %{NOTSPACE:username} %{IPORHOST:client\_ip} %{NOTSPACE:http\_version} %{NOTSP… --- ## [\[7.10.1\] Elasticsearch java client InterruptedException](https://discuss.elastic.co/t/7-10-1-elasticsearch-java-client-interruptedexception/312389)
**Author:** [@thiago123789](https://discuss.elastic.co/u/thiago123789)\ **Replies:** 0\ **Last updated:** [August 18, 2022, 1:05pm UTC](https://discuss.elastic.co/t/7-10-1-elasticsearch-java-client-interruptedexception/312389 "2022-08-18T13:05:07Z")
I am using elasticsearch-rest-client version 7.10.1 with spring boot actuator to provide health check but sometimes elasticsearch is returning a null value with InterruptedException in a Future on RestClient. Caused by:… --- ## [\[Elastic Cloud\] Configuring trust with clusters in a self-managed environment](https://discuss.elastic.co/t/elastic-cloud-configuring-trust-with-clusters-in-a-self-managed-environment/311035)
**Author:** [@Simone\_Scarduzio](https://discuss.elastic.co/u/Simone_Scarduzio)\ **Replies:** 8\ **Last updated:** [August 18, 2022, 12:52pm UTC](https://discuss.elastic.co/t/elastic-cloud-configuring-trust-with-clusters-in-a-self-managed-environment/311035 "2022-08-18T12:52:33Z")
I have two ES clusters: Elastic Cloud (all the data is here) Self-managed cluster (no data, will use for cross-cluster-search in Elastic Cloud) I want the cluster #1 to trust #2, so I can use CSS. So I'm following you… --- ## [Filebeat setup: 400 Bad Request no handler found for uri \[//\_ilm/policy/filebeat\]](https://discuss.elastic.co/t/filebeat-setup-400-bad-request-no-handler-found-for-uri-ilm-policy-filebeat/311900)
**Author:** [@Nick95](https://discuss.elastic.co/u/Nick95)\ **Replies:** 4\ **Last updated:** [August 18, 2022, 12:40pm UTC](https://discuss.elastic.co/t/filebeat-setup-400-bad-request-no-handler-found-for-uri-ilm-policy-filebeat/311900 "2022-08-18T12:40:45Z")
Hi, I try to run a filebeat on a server. Elastic and Kibana are installed on another server and are pushed on 443 port via a nginx reverse proxy. Kibana GUI is working on the IP I set up (https with self-generated certi… --- ## [What governs visibility of configured rules in Rules and Connectors tab?](https://discuss.elastic.co/t/what-governs-visibility-of-configured-rules-in-rules-and-connectors-tab/312297)
**Author:** [@Adriann](https://discuss.elastic.co/u/Adriann)\ **Replies:** 3\ **Last updated:** [August 18, 2022, 12:34pm UTC](https://discuss.elastic.co/t/what-governs-visibility-of-configured-rules-in-rules-and-connectors-tab/312297 "2022-08-18T12:34:03Z")
Hello, I wanted to allow low lvl user to see configured rules. The rules are configured in separated to user main dashboard so I had to start by adding rights to see the rules's dashboard. So I added the right to check … --- ## [Converting React JS website to Kibana plugin](https://discuss.elastic.co/t/converting-react-js-website-to-kibana-plugin/311793)
**Author:** [@Sheereen](https://discuss.elastic.co/u/Sheereen)\ **Replies:** 10\ **Last updated:** [August 18, 2022, 11:30am UTC](https://discuss.elastic.co/t/converting-react-js-website-to-kibana-plugin/311793 "2022-08-18T11:30:21Z")
I have developed a small dashboard and website in React JS. I want to insert it as a plugin into Kibana. I have some queries regarding the same. They are: Can I convert a website to a plugin? Or should I start coding … --- ## [Custom domain for deployment - TLS certificate](https://discuss.elastic.co/t/custom-domain-for-deployment-tls-certificate/312376)
**Author:** [@edweis](https://discuss.elastic.co/u/edweis)\ **Replies:** 0\ **Last updated:** [August 18, 2022, 11:26am UTC](https://discuss.elastic.co/t/custom-domain-for-deployment-tls-certificate/312376 "2022-08-18T11:26:58Z")
Hi, I want to have a custom endpoint es.mydomain.com that redirects conditionally to the closest Elasticsearch deployment to improve the latency of my Elasticsearch cluster in different regions. I have deployments in U… --- ## [How to add aggregions in KNN search?](https://discuss.elastic.co/t/how-to-add-aggregions-in-knn-search/310457)
**Author:** [@namespace-Pt](https://discuss.elastic.co/u/namespace-Pt)\ **Replies:** 4\ **Last updated:** [August 18, 2022, 11:21am UTC](https://discuss.elastic.co/t/how-to-add-aggregions-in-knn-search/310457 "2022-08-18T11:21:07Z")
I want to use aggregations over the search result of the knn\_search api (because I need facet search on the user interface), but I cannot pass the agg parameter as in the search api. Any suggestions? --- ## [Failed to deserialize response from handler](https://discuss.elastic.co/t/failed-to-deserialize-response-from-handler/312282)
**Author:** [@pspardeshi](https://discuss.elastic.co/u/pspardeshi)\ **Replies:** 2\ **Last updated:** [August 18, 2022, 10:32am UTC](https://discuss.elastic.co/t/failed-to-deserialize-response-from-handler/312282 "2022-08-18T10:32:17Z")
I am using scala+java application and running it on jdk 11 and calling Elasticsearch api for searching text. Recently upgraded from elasticsearch 5.5 to 7.17 and while search text getting below error. ERROR play.http.D… --- ## [Performance scaling for Logstash and Elasticsearch based solution](https://discuss.elastic.co/t/performance-scaling-for-logstash-and-elasticsearch-based-solution/312367)
**Author:** [@rakheshkumbi](https://discuss.elastic.co/u/rakheshkumbi)\ **Replies:** 0\ **Last updated:** [August 18, 2022, 9:54am UTC](https://discuss.elastic.co/t/performance-scaling-for-logstash-and-elasticsearch-based-solution/312367 "2022-08-18T09:54:39Z")
Hello everyone, we have a logstash and Elasticsearch-based solution to analyze network protocols, and I am trying to benchmark the whole solution. When I increase the number of Nodes for client/logstash and Elasticsearc… --- ## [Having trouble creating Elasticsearch Snapshot Repository](https://discuss.elastic.co/t/having-trouble-creating-elasticsearch-snapshot-repository/311868)
**Author:** [@yashverma](https://discuss.elastic.co/u/yashverma)\ **Replies:** 9\ **Last updated:** [August 18, 2022, 8:46am UTC](https://discuss.elastic.co/t/having-trouble-creating-elasticsearch-snapshot-repository/311868 "2022-08-18T08:46:44Z")
I want to create snapshot repository in order to backup elasticsearch indices locally. However I am getting error messages, I think I am not giving correct path in location. I have posted screenshots for better explanati… --- ## [What is the correct way to request /intake/v2/rum/events?](https://discuss.elastic.co/t/what-is-the-correct-way-to-request-intake-v2-rum-events/312362)
**Author:** [@wajika](https://discuss.elastic.co/u/wajika)\ **Replies:** 0\ **Last updated:** [August 18, 2022, 8:41am UTC](https://discuss.elastic.co/t/what-is-the-correct-way-to-request-intake-v2-rum-events/312362 "2022-08-18T08:41:56Z")
from locust import HttpLocust, TaskSet, task, HttpUser, run\_single\_user class QuickstartUser(HttpUser): host = "https://apmserver" @task() def user\_sign(self): payload = "{\\"metadata\\": {\\"service\\"… --- ## [Thread Intet MISP](https://discuss.elastic.co/t/thread-intet-misp/312361)
**Author:** [@VitorBarroso](https://discuss.elastic.co/u/VitorBarroso)\ **Replies:** 0\ **Last updated:** [August 18, 2022, 8:37am UTC](https://discuss.elastic.co/t/thread-intet-misp/312361 "2022-08-18T08:37:31Z")
I can't receive misp data on my dashboard but filebeat don't have any error. Any solution for this problem? --- ## [Data Transformation : Create Dynamic field using ruby for array](https://discuss.elastic.co/t/data-transformation-create-dynamic-field-using-ruby-for-array/312249)
**Author:** [@priyankamondalhcl](https://discuss.elastic.co/u/priyankamondalhcl)\ **Replies:** 2\ **Last updated:** [August 18, 2022, 8:11am UTC](https://discuss.elastic.co/t/data-transformation-create-dynamic-field-using-ruby-for-array/312249 "2022-08-18T08:11:25Z")
Hi Team, Hope you doing well! I am facing problem in creating dynamic field for an array in logstash. The list of array is below: \[{"usage\_start\_time": "2022-08-07T22:00:00Z", "usage\_end\_time": "2022-08-07T23:00:00Z… --- ## [Coordonating statistics for coordonating nodes](https://discuss.elastic.co/t/coordonating-statistics-for-coordonating-nodes/311834)
**Author:** [@Nicolaegis](https://discuss.elastic.co/u/Nicolaegis)\ **Replies:** 8\ **Last updated:** [August 18, 2022, 8:02am UTC](https://discuss.elastic.co/t/coordonating-statistics-for-coordonating-nodes/311834 "2022-08-18T08:02:29Z")
Hello, I know that all data nodes (role) have coordinating role as well. If I make a coordinating node in a cluster, how can I check it's statistics and performance from an ordinary data node? Thank you --- ## [What dose "realm\_authentication\_failed" really mean?](https://discuss.elastic.co/t/what-dose-realm-authentication-failed-really-mean/312334)
**Author:** [@ITzhangqiang](https://discuss.elastic.co/u/ITzhangqiang)\ **Replies:** 6\ **Last updated:** [August 18, 2022, 7:59am UTC](https://discuss.elastic.co/t/what-dose-realm-authentication-failed-really-mean/312334 "2022-08-18T07:59:08Z")
In auditlog,I saw the log below, what dose "realm\_authentication\_failed" really mean, this query was normal，why "realm\_authentication\_failed"? { "type":"audit", "timestamp":"2022-08-18T02:35:15,041+0000", "n… --- ## [Upgrade from 5.3.1 to 6.8.23](https://discuss.elastic.co/t/upgrade-from-5-3-1-to-6-8-23/312339)
**Author:** [@Andrey\_Tyutyunov](https://discuss.elastic.co/u/Andrey_Tyutyunov)\ **Replies:** 1\ **Last updated:** [August 18, 2022, 7:53am UTC](https://discuss.elastic.co/t/upgrade-from-5-3-1-to-6-8-23/312339 "2022-08-18T07:53:52Z")
Good day! I have 3 nodes on 5.3.1 (index"es created in 5" version) and I need to upgrade to 6.8.23 without downtime. My plan is 5.3.1 -\> 5.6.16, 5.6.16 -\> 6.8.23. Can I upgrade according to this scheme? 5.3.1 + 5.3.1… --- ## [Searching array for empty string causes tab lockup and shows garbage](https://discuss.elastic.co/t/searching-array-for-empty-string-causes-tab-lockup-and-shows-garbage/312149)
**Author:** [@nisow95612](https://discuss.elastic.co/u/nisow95612)\ **Replies:** 4\ **Last updated:** [August 18, 2022, 7:52am UTC](https://discuss.elastic.co/t/searching-array-for-empty-string-causes-tab-lockup-and-shows-garbage/312149 "2022-08-18T07:52:35Z")
Hello. I have a keyword field in elastic. I index arrays of string into it. I usually search with KQL like field: value and it works. But how I search for empty string? I tried field:, but that gives Search Error. … --- ## [Elastic Agent - Tagging](https://discuss.elastic.co/t/elastic-agent-tagging/312348)
**Author:** [@praveen\_raju](https://discuss.elastic.co/u/praveen_raju)\ **Replies:** 0\ **Last updated:** [August 18, 2022, 7:00am UTC](https://discuss.elastic.co/t/elastic-agent-tagging/312348 "2022-08-18T07:00:41Z")
Hi, We have 3000 virtual machines where we have installed elastic agent and they are sending metrics. Now we want to tag around 500 VM's as PROD so that we can build dashboards only for this prod vm;s. What is the best… --- ## [关于RestHighLevelClient的DeleteRequest的问题。](https://discuss.elastic.co/t/resthighlevelclient-deleterequest/312351)
**Author:** [@17661977890](https://discuss.elastic.co/u/17661977890)\ **Replies:** 0\ **Last updated:** [August 18, 2022, 7:18am UTC](https://discuss.elastic.co/t/resthighlevelclient-deleterequest/312351 "2022-08-18T07:18:51Z")
删除执行结果返回成功 DeleteResponse\[index=awaitz-prod-goods,type=\_doc,id=712810048943927296,version=1435,result=deleted,shards=ShardInfo{total=1, successful=1, failures=}\] 但是实际数据仍然在es中存在，并且可以查询到。此问题偶现，频率不高。 相关执行代码块：（主体方法是使用异步@A… --- ## [AWS WAF: Further parsing of http\_request in logstash](https://discuss.elastic.co/t/aws-waf-further-parsing-of-http-request-in-logstash/312347)
**Author:** [@kelk](https://discuss.elastic.co/u/kelk)\ **Replies:** 0\ **Last updated:** [August 18, 2022, 7:00am UTC](https://discuss.elastic.co/t/aws-waf-further-parsing-of-http-request-in-logstash/312347 "2022-08-18T07:00:24Z")
Further to the query: Writing multiline grok The raw data comes in json, so the NEW line is technically new line but \\r\\n in the json payload. "GET /myapp/health HTTP/1.1\\\\r\\\\nHost: 52.123.133.46\\\\r\\\\nUser-Agent: Mozil… --- ## [Value Mapping in Kibana](https://discuss.elastic.co/t/value-mapping-in-kibana/311902)
**Author:** [@saif.khan](https://discuss.elastic.co/u/saif.khan)\ **Replies:** 17\ **Last updated:** [August 18, 2022, 6:52am UTC](https://discuss.elastic.co/t/value-mapping-in-kibana/311902 "2022-08-18T06:52:42Z")
Hi, I'm setting up a dashboard and receiving data from prometheus through metricbeat, I'm facing problem when it comes to value mapping, in my case for "DoorStatus" i want to map the default integer values in 0 and 1 to… --- ## [Logstash Reading Same Data](https://discuss.elastic.co/t/logstash-reading-same-data/312251)
**Author:** [@mehmetalix](https://discuss.elastic.co/u/mehmetalix)\ **Replies:** 1\ **Last updated:** [August 18, 2022, 6:49am UTC](https://discuss.elastic.co/t/logstash-reading-same-data/312251 "2022-08-18T06:49:22Z")
Hi, I have a logstash .conf: input { jdbc { jdbc\_driver\_library =\> "${LOGSTASH\_JDBC\_DRIVER\_JAR\_LOCATION}" jdbc\_driver\_class =\> "${LOGSTASH\_JDBC\_DRIVER}" jdbc\_connection\_string =\> "${LOGSTASH… --- ## [\[Filebeat\] AWS CloudTrail Processor parses incorrect AWS region from logs](https://discuss.elastic.co/t/filebeat-aws-cloudtrail-processor-parses-incorrect-aws-region-from-logs/312150)
**Author:** [@styks90](https://discuss.elastic.co/u/styks90)\ **Replies:** 3\ **Last updated:** [August 18, 2022, 6:31am UTC](https://discuss.elastic.co/t/filebeat-aws-cloudtrail-processor-parses-incorrect-aws-region-from-logs/312150 "2022-08-18T06:31:48Z")
When processing AWS CloudTrail logs, we noticed a discrepancy in the parsed AWS region compared to the region a log file originated. CloudTrail is not region specific , but monitors all configured regions and stuffs the … --- ## [Value not greater 20% of the average value of the same job](https://discuss.elastic.co/t/value-not-greater-20-of-the-average-value-of-the-same-job/310832)
**Author:** [@eddieyee](https://discuss.elastic.co/u/eddieyee)\ **Replies:** 2\ **Last updated:** [August 18, 2022, 6:23am UTC](https://discuss.elastic.co/t/value-not-greater-20-of-the-average-value-of-the-same-job/310832 "2022-08-18T06:23:11Z")
Hi I'm trying to create a data table as seem in the screenshot below. Basically I need to compare the current document duration field value not higher than 20% of the average duration of the same job. Have tried using … --- ## [Resthighlevel client unit test is not working](https://discuss.elastic.co/t/resthighlevel-client-unit-test-is-not-working/311897)
**Author:** [@Apurba](https://discuss.elastic.co/u/Apurba)\ **Replies:** 2\ **Last updated:** [August 18, 2022, 6:05am UTC](https://discuss.elastic.co/t/resthighlevel-client-unit-test-is-not-working/311897 "2022-08-18T06:05:23Z")
I have written a method, below @Inject private RestHighLevelClient esClient; public SearchResponse getData(SearchRequest searchRequest) { try { SearchResponse searchResponse = esClient.s… --- ## [Timezone problem when output to Elasticsearch](https://discuss.elastic.co/t/timezone-problem-when-output-to-elasticsearch/312252)
**Author:** [@kent010341](https://discuss.elastic.co/u/kent010341)\ **Replies:** 10\ **Last updated:** [August 18, 2022, 4:36am UTC](https://discuss.elastic.co/t/timezone-problem-when-output-to-elasticsearch/312252 "2022-08-18T04:36:14Z")
I have multiple log files with the date on their file name, and I want to read them with the file input plugin and send them to an Elasticsearch index (the index name contains the date). However, I have some logs being … [Previous page](https://discuss.elastic.co/latest.md?page=1001) [Next page](https://discuss.elastic.co/latest.md?page=1003)