# Latest **URL:** https://discuss.elastic.co/latest.md?page=1005 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1006 --- ## [Splitting table based on text value](https://discuss.elastic.co/t/splitting-table-based-on-text-value/312208)
**Author:** [@Marius\_Kunauskas](https://discuss.elastic.co/u/Marius_Kunauskas)\ **Replies:** 1\ **Last updated:** [August 16, 2022, 6:37pm UTC](https://discuss.elastic.co/t/splitting-table-based-on-text-value/312208 "2022-08-16T18:37:16Z")
As a complete elastic-newbie, how could I split a column based on its text value? I.e. Instead of splitting rows on different Field values (e.g. country), I want to split it based on WHETHER a field starts with a certai… --- ## [Edit file using logstash](https://discuss.elastic.co/t/edit-file-using-logstash/312157)
**Author:** [@alex\_vermex](https://discuss.elastic.co/u/alex_vermex)\ **Replies:** 2\ **Last updated:** [August 16, 2022, 6:08pm UTC](https://discuss.elastic.co/t/edit-file-using-logstash/312157 "2022-08-16T18:08:55Z")
Hi, I have already created a topic here to add \[\] to the beginning and end of the file and I can't find the solution so I want to ask if I can edit the file using logstash now my file like this: {"field1": "value1","fi… --- ## [Add \[ \] to codec =\> json](https://discuss.elastic.co/t/add-to-codec-json/312104)
**Author:** [@alex\_vermex](https://discuss.elastic.co/u/alex_vermex)\ **Replies:** 4\ **Last updated:** [August 16, 2022, 5:49pm UTC](https://discuss.elastic.co/t/add-to-codec-json/312104 "2022-08-16T17:49:27Z")
Hi, can i add \[ \] to json file ? because output{ file { codec =\> json path =\> \["D:/elastic\_stack/test/temp.json"\] } } it gives me { 'a':'a','b':'b'}{'c':'c'} i want to add \[ \] so i wanted like this \[{ 'a' : 'a','b':'… --- ## [Logstash rabbitmq input plugin doesn't read "host" value](https://discuss.elastic.co/t/logstash-rabbitmq-input-plugin-doesnt-read-host-value/312204)
**Author:** [@thinkorhiking](https://discuss.elastic.co/u/thinkorhiking)\ **Replies:** 0\ **Last updated:** [August 16, 2022, 5:01pm UTC](https://discuss.elastic.co/t/logstash-rabbitmq-input-plugin-doesnt-read-host-value/312204 "2022-08-16T17:01:42Z")
I'm having trouble to setup logstash rabbitmq input plugin, to connect to the rabbitmq pod host name. Why it still tries to connect @localhost. logstash does not read the config correctly. Is this a bug or is there any … --- ## [Shards failed in kibana](https://discuss.elastic.co/t/shards-failed-in-kibana/310559)
**Author:** [@OoO](https://discuss.elastic.co/u/OoO)\ **Replies:** 3\ **Last updated:** [August 16, 2022, 4:27pm UTC](https://discuss.elastic.co/t/shards-failed-in-kibana/310559 "2022-08-16T16:27:34Z")
Hello world, Since I upgraded filebeat from 7.x to 8.x ( the version of my ELK and filebeat is 8.2.3 now), I can't see the dashboard anymore, I have encountered this problem on kibana: 1 of 8 shards failed The data y… --- ## [Connection Closed Error](https://discuss.elastic.co/t/connection-closed-error/310980)
**Author:** [@Reskun](https://discuss.elastic.co/u/Reskun)\ **Replies:** 7\ **Last updated:** [August 16, 2022, 4:22pm UTC](https://discuss.elastic.co/t/connection-closed-error/310980 "2022-08-16T16:22:50Z")
Hi I've successfully created a multinode elasticsearch cluster using a docker-compose.yml file by following the steps in the link: Install Elasticsearch with Docker | Elasticsearch Guide \[8.3\] | Elastic localhost:9200… --- ## [Alerts on derivatives in elastic](https://discuss.elastic.co/t/alerts-on-derivatives-in-elastic/312170)
**Author:** [@Anmol\_Dubey](https://discuss.elastic.co/u/Anmol_Dubey)\ **Replies:** 1\ **Last updated:** [August 16, 2022, 4:03pm UTC](https://discuss.elastic.co/t/alerts-on-derivatives-in-elastic/312170 "2022-08-16T16:03:08Z")
I am trying to create an alert when average of my derivative data exceeds a threshold, but am not able to figure out how to do calculations on returned values in kibana Grafana graph of the data looks like this , i am t… --- ## [Could not index event to Elasticsearch](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch/312023)
**Author:** [@syedabdullah](https://discuss.elastic.co/u/syedabdullah)\ **Replies:** 6\ **Last updated:** [August 16, 2022, 3:57pm UTC](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch/312023 "2022-08-16T15:57:58Z")
Hi I am getting this error in Elasticsearch (Please look at the bolded statements), any sort of help will be welcome. Thank you so much in advance: \[2022-05-03T12:41:26,871\]\[WARN \]\[logstash.outputs.elasticsearch\]\[rtt\_kf… --- ## [Kibana Table visualization for different weeks,showing reports for current date](https://discuss.elastic.co/t/kibana-table-visualization-for-different-weeks-showing-reports-for-current-date/311485)
**Author:** [@PRASHANT\_MEHTA](https://discuss.elastic.co/u/PRASHANT_MEHTA)\ **Replies:** 2\ **Last updated:** [August 16, 2022, 2:34pm UTC](https://discuss.elastic.co/t/kibana-table-visualization-for-different-weeks-showing-reports-for-current-date/311485 "2022-08-16T14:34:45Z")
Hello All, I'm not sure how this can be achieved through kibana table visualization,I want to display the converter details in accordance to week wise and the date displayed should always be current date. KW-calendar … --- ## [Sorting a house number field](https://discuss.elastic.co/t/sorting-a-house-number-field/312194)
**Author:** [@Nicolai\_Jee](https://discuss.elastic.co/u/Nicolai_Jee)\ **Replies:** 1\ **Last updated:** [August 16, 2022, 3:05pm UTC](https://discuss.elastic.co/t/sorting-a-house-number-field/312194 "2022-08-16T15:05:18Z")
Hi I have a house number field that contains stringbased data like 1,2A,3,3B,10,100A. Right now it is a basic textfield and it does string sorting, which is not working for me. I need it to sort numerically and then a… --- ## [Fleet agent doesn't work](https://discuss.elastic.co/t/fleet-agent-doesnt-work/312068)
**Author:** [@VitorBarroso](https://discuss.elastic.co/u/VitorBarroso)\ **Replies:** 13\ **Last updated:** [August 16, 2022, 2:55pm UTC](https://discuss.elastic.co/t/fleet-agent-doesnt-work/312068 "2022-08-16T14:55:32Z")
I can't connect my elastic agent to the fleet server I already solved the syslink problem. --- ## [Client IP not traced](https://discuss.elastic.co/t/client-ip-not-traced/312159)
**Author:** [@yahire](https://discuss.elastic.co/u/yahire)\ **Replies:** 3\ **Last updated:** [August 16, 2022, 2:19pm UTC](https://discuss.elastic.co/t/client-ip-not-traced/312159 "2022-08-16T14:19:36Z")
Hi, I had installed the Agent, kibana, elasticsearch versioned 8.2.1. Observed that the client ip is not getting captured properly as it is visible as :1. any suggestions? --- ## [ActionNotFoundTransportException\[No handler for action \[indices:admin/exists\]](https://discuss.elastic.co/t/actionnotfoundtransportexception-no-handler-for-action-indices-admin-exists/312176)
**Author:** [@Sathiya\_Kennady](https://discuss.elastic.co/u/Sathiya_Kennady)\ **Replies:** 1\ **Last updated:** [August 16, 2022, 2:17pm UTC](https://discuss.elastic.co/t/actionnotfoundtransportexception-no-handler-for-action-indices-admin-exists/312176 "2022-08-16T14:17:24Z")
While checking index is exists are not i am getting below error : ClusterConnectionManager:225 - transport connection to \[{lutw}{Bz3WvABkSsuCLyVoF3kDsg}{exNsn6r4TFGF4KrMm4aduw}{192.168.1.84}{192.168.1.84:9300}{cdfhilmrs… --- ## [Wildcard query on text field](https://discuss.elastic.co/t/wildcard-query-on-text-field/311676)
**Author:** [@maxfriz](https://discuss.elastic.co/u/maxfriz)\ **Replies:** 2\ **Last updated:** [August 16, 2022, 2:11pm UTC](https://discuss.elastic.co/t/wildcard-query-on-text-field/311676 "2022-08-16T14:11:41Z")
From a best practice and cautionary perspective, am I missing any other critical information I should be considering specific to a wildcard query on a text field? See bullets below. I have reviewed the documentation i… --- ## [AWS SQS Message how to read through filebeat7.0?](https://discuss.elastic.co/t/aws-sqs-message-how-to-read-through-filebeat7-0/311932)
**Author:** [@HariP](https://discuss.elastic.co/u/HariP)\ **Replies:** 1\ **Last updated:** [August 16, 2022, 2:02pm UTC](https://discuss.elastic.co/t/aws-sqs-message-how-to-read-through-filebeat7-0/311932 "2022-08-16T14:02:58Z")
I need to read AWS SQS or AWS SNS message through filebeat and pass to Elastic Search. Please note my message in JSON format text message .. I changed filebeat yml file below config type: s3 endpoint: https://sqs.us-ea… --- ## [Filter out (drop) a log sent to Logstash, based on the values of its fields](https://discuss.elastic.co/t/filter-out-drop-a-log-sent-to-logstash-based-on-the-values-of-its-fields/310664)
**Author:** [@zoug](https://discuss.elastic.co/u/zoug)\ **Replies:** 5\ **Last updated:** [July 28, 2022, 1:47pm UTC](https://discuss.elastic.co/t/filter-out-drop-a-log-sent-to-logstash-based-on-the-values-of-its-fields/310664 "2022-07-28T13:47:15Z")
Hello, I use a pipeline to ingest logs generated by suricata, everything set up with filebeat setup --pipelines --modules suricata,\. I don't want to ingest any "event" logs, only "alert" logs. So I added … --- ## [Problem with an implementation on my array in a Pie Chart](https://discuss.elastic.co/t/problem-with-an-implementation-on-my-array-in-a-pie-chart/311145)
**Author:** [@Dave23](https://discuss.elastic.co/u/Dave23)\ **Replies:** 2\ **Last updated:** [August 16, 2022, 1:33pm UTC](https://discuss.elastic.co/t/problem-with-an-implementation-on-my-array-in-a-pie-chart/311145 "2022-08-16T13:33:30Z")
Hello everyone, I have the following array and I want to make a pie chart with each of the "holders.address" and the "amount" of each of them, but I can't get that information, I don't know what calculation field to use … --- ## [Elasticsearch does not load ES\_PATH\_CONF or any values that are present in sysconfig](https://discuss.elastic.co/t/elasticsearch-does-not-load-es-path-conf-or-any-values-that-are-present-in-sysconfig/311411)
**Author:** [@nightwatch92](https://discuss.elastic.co/u/nightwatch92)\ **Replies:** 2\ **Last updated:** [August 16, 2022, 1:16pm UTC](https://discuss.elastic.co/t/elasticsearch-does-not-load-es-path-conf-or-any-values-that-are-present-in-sysconfig/311411 "2022-08-16T13:16:07Z")
Hi, ES version: 8.3.3 OS: CENTOS 8 We are using packages to distribute our config files in custom directory for the ES service. We can't replace /etc/sysconfig/elasticsearch, because it is owned by the elasticsearch p… --- ## [Any new possibilities to display raw, un-aggregated time series data in kibana?](https://discuss.elastic.co/t/any-new-possibilities-to-display-raw-un-aggregated-time-series-data-in-kibana/312158)
**Author:** [@defalt](https://discuss.elastic.co/u/defalt)\ **Replies:** 3\ **Last updated:** [August 16, 2022, 1:07pm UTC](https://discuss.elastic.co/t/any-new-possibilities-to-display-raw-un-aggregated-time-series-data-in-kibana/312158 "2022-08-16T13:07:38Z")
Hello :wave:, I asked the same question about 2 years ago and only found the same questions (and answers) in the forum from around 2018-2019 so I want to ask if something changed with the new Kibana and Elastic versions… --- ## [Kibana 7.16.3 Create Index patter API doesn't recognize field](https://discuss.elastic.co/t/kibana-7-16-3-create-index-patter-api-doesnt-recognize-field/312185)
**Author:** [@Enrique\_Flores](https://discuss.elastic.co/u/Enrique_Flores)\ **Replies:** 0\ **Last updated:** [August 16, 2022, 12:56pm UTC](https://discuss.elastic.co/t/kibana-7-16-3-create-index-patter-api-doesnt-recognize-field/312185 "2022-08-16T12:56:33Z")
Im trying to create a index pattern via POST /api/index\_patterns/index\_pattern using a json already parsed, that json was generate with a kibana used in PRO via GET /api/index\_patterns/index\_pattern/, i don't know what i… --- ## [Elastic Search - QueryBuilder JAVA](https://discuss.elastic.co/t/elastic-search-querybuilder-java/312148)
**Author:** [@Parva\_Gurav](https://discuss.elastic.co/u/Parva_Gurav)\ **Replies:** 1\ **Last updated:** [August 16, 2022, 12:27pm UTC](https://discuss.elastic.co/t/elastic-search-querybuilder-java/312148 "2022-08-16T12:27:24Z")
I'm currently working on elasticsearch where I've created a query : "query": { "bool": { "must": \[ {"match": { "companyId": 35 }}, { "multi\_match": { "q… --- ## [ECK Kibana tls certificate not updated](https://discuss.elastic.co/t/eck-kibana-tls-certificate-not-updated/309664)
**Author:** [@ragmel](https://discuss.elastic.co/u/ragmel)\ **Replies:** 7\ **Last updated:** [August 16, 2022, 10:59am UTC](https://discuss.elastic.co/t/eck-kibana-tls-certificate-not-updated/309664 "2022-08-16T10:59:10Z")
Our kibana TLS certificate for HTTP layer it's about to expire. This was setup through the guide below We already have the new certificate and the idea was just to create a new k8s secret, and redeploy kibana (we use … --- ## [Kibana - aggregation in graphs (average number of things per bucket)](https://discuss.elastic.co/t/kibana-aggregation-in-graphs-average-number-of-things-per-bucket/311291)
**Author:** [@RonGros](https://discuss.elastic.co/u/RonGros)\ **Replies:** 7\ **Last updated:** [August 16, 2022, 10:57am UTC](https://discuss.elastic.co/t/kibana-aggregation-in-graphs-average-number-of-things-per-bucket/311291 "2022-08-16T10:57:53Z")
Hi, I have a situation and I am stuck, I think what I want to do is not currently achievable but I hope I'm wrong. Let's assume I have the following data about people going to the movies: Name of person Which movies … --- ## [Percolator query fields migration from version 6 to version 8 using reindex](https://discuss.elastic.co/t/percolator-query-fields-migration-from-version-6-to-version-8-using-reindex/312168)
**Author:** [@CamiloPDL](https://discuss.elastic.co/u/CamiloPDL)\ **Replies:** 0\ **Last updated:** [August 16, 2022, 10:22am UTC](https://discuss.elastic.co/t/percolator-query-fields-migration-from-version-6-to-version-8-using-reindex/312168 "2022-08-16T10:22:11Z")
Hello community I would like to use reindex functionality from elasticsearch to move data from a version 6 cluster to a version 8 cluster. The reindex is working well, the issue is the migration of percolator query fiel… --- ## [Sort data in sub level](https://discuss.elastic.co/t/sort-data-in-sub-level/312166)
**Author:** [@aneesh](https://discuss.elastic.co/u/aneesh)\ **Replies:** 0\ **Last updated:** [August 16, 2022, 10:11am UTC](https://discuss.elastic.co/t/sort-data-in-sub-level/312166 "2022-08-16T10:11:04Z")
i am doing a sorting for a column that is in sub level. The issue there is , the sub level contains an array and i want to sort the data depending on the condition. My data looks like below I need to do sorting on colu… --- ## [SSL Connection in watcher using Teams](https://discuss.elastic.co/t/ssl-connection-in-watcher-using-teams/250129)
**Author:** [@Kirtash](https://discuss.elastic.co/u/Kirtash)\ **Replies:** 7\ **Last updated:** [August 16, 2022, 9:51am UTC](https://discuss.elastic.co/t/ssl-connection-in-watcher-using-teams/250129 "2022-08-16T09:51:15Z")
Good morning, I'm using watcher to send messages using the application "TEAMS" connected by a webhook, but when if I execute the action run perfectly, but when it is fire I have the next message: "actions": \[ { … --- ## [Sudo docker-compose up -d ERROR: Invalid interpolation format for "environment" option in service "setup": "${KIBANA\_SYSTEM\_PASSWORD:-}"](https://discuss.elastic.co/t/sudo-docker-compose-up-d-error-invalid-interpolation-format-for-environment-option-in-service-setup-kibana-system-password/312156)
**Author:** [@Alex\_Trasias](https://discuss.elastic.co/u/Alex_Trasias)\ **Replies:** 0\ **Last updated:** [August 16, 2022, 9:28am UTC](https://discuss.elastic.co/t/sudo-docker-compose-up-d-error-invalid-interpolation-format-for-environment-option-in-service-setup-kibana-system-password/312156 "2022-08-16T09:28:09Z")
I'm using GitHub - deviantony/docker-elk: The Elastic stack (ELK) powered by Docker and Compose. but when I type sudo docker-compose up -d i get this error mefssage ERROR: Invalid interpolation format for "environme… --- ## [Ability to search ES based on the result of previous search in the query](https://discuss.elastic.co/t/ability-to-search-es-based-on-the-result-of-previous-search-in-the-query/312093)
**Author:** [@Ananya\_Chowdhury](https://discuss.elastic.co/u/Ananya_Chowdhury)\ **Replies:** 4\ **Last updated:** [August 16, 2022, 8:36am UTC](https://discuss.elastic.co/t/ability-to-search-es-based-on-the-result-of-previous-search-in-the-query/312093 "2022-08-16T08:36:14Z")
Hi, We want to build a query which will search for a particular string and then it will perform a search based on the result that we have received from previous result. Can any one help us how we can achieve this. How … --- ## [Filebeat error](https://discuss.elastic.co/t/filebeat-error/311946)
**Author:** [@VitorBarroso](https://discuss.elastic.co/u/VitorBarroso)\ **Replies:** 6\ **Last updated:** [August 16, 2022, 9:04am UTC](https://discuss.elastic.co/t/filebeat-error/311946 "2022-08-16T09:04:00Z")
Can you help me resolve this problem? Only Threat Intel activated is misp. --- ## [Deleted Docs - SQL SYNC](https://discuss.elastic.co/t/deleted-docs-sql-sync/312153)
**Author:** [@Berat\_Demirci](https://discuss.elastic.co/u/Berat_Demirci)\ **Replies:** 0\ **Last updated:** [August 16, 2022, 8:57am UTC](https://discuss.elastic.co/t/deleted-docs-sql-sync/312153 "2022-08-16T08:57:41Z")
I will sync data from sql to elastic. My config was running a few tries but now It is deleting my docs. Sync is successful and I dont see any error. My config input { jdbc { jdbc\_driver\_library =\> "C:\\Program Files\\… [Previous page](https://discuss.elastic.co/latest.md?page=1004) [Next page](https://discuss.elastic.co/latest.md?page=1006)