# Latest **URL:** https://discuss.elastic.co/latest.md?page=1020 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1021 --- ## [How to open my Alert queries in another window so I can see what it is counting](https://discuss.elastic.co/t/how-to-open-my-alert-queries-in-another-window-so-i-can-see-what-it-is-counting/311348)
**Author:** [@gabrsar](https://discuss.elastic.co/u/gabrsar)\ **Replies:** 0\ **Last updated:** [August 3, 2022, 9:22pm UTC](https://discuss.elastic.co/t/how-to-open-my-alert-queries-in-another-window-so-i-can-see-what-it-is-counting/311348 "2022-08-03T21:22:42Z")
Many times when I'm creating a query for my alarms, I see the window where it shows the number of events that matches that query. My question is: Is there any way I can open all that combined query in another window so I… --- ## [Index mappings for elastic security](https://discuss.elastic.co/t/index-mappings-for-elastic-security/311341)
**Author:** [@rjconroy](https://discuss.elastic.co/u/rjconroy)\ **Replies:** 0\ **Last updated:** [August 3, 2022, 8:18pm UTC](https://discuss.elastic.co/t/index-mappings-for-elastic-security/311341 "2022-08-03T20:18:09Z")
Long story short im working on a custom project that uses a graylog front end, and im trying to figure out how to either have elastic security read the existing indexes graylog has written, or to have graylog write them … --- ## [Watcher Rule](https://discuss.elastic.co/t/watcher-rule/311153)
**Author:** [@Elk\_huh](https://discuss.elastic.co/u/Elk_huh)\ **Replies:** 7\ **Last updated:** [August 3, 2022, 7:44pm UTC](https://discuss.elastic.co/t/watcher-rule/311153 "2022-08-03T19:44:29Z")
I want to do a universal Rule for if All indices fall below a certain threshold , then alert on specific index at question. How do i specify the Index name in the Body of this watcher request ? --- ## [Kibana issue with index and Life cycle policy](https://discuss.elastic.co/t/kibana-issue-with-index-and-life-cycle-policy/311315)
**Author:** [@tractor\_boy](https://discuss.elastic.co/u/tractor_boy)\ **Replies:** 1\ **Last updated:** [August 3, 2022, 6:27pm UTC](https://discuss.elastic.co/t/kibana-issue-with-index-and-life-cycle-policy/311315 "2022-08-03T18:27:02Z")
To help me with a different issue I have reverted to trying to us the kibana ui to complete some activities. Currently I have created an index using the put command and then in the ui added an ILM. However the ui is no… --- ## [Need help with enterprise search config](https://discuss.elastic.co/t/need-help-with-enterprise-search-config/310997)
**Author:** [@elastic\_user2](https://discuss.elastic.co/u/elastic_user2)\ **Replies:** 1\ **Last updated:** [August 3, 2022, 4:41pm UTC](https://discuss.elastic.co/t/need-help-with-enterprise-search-config/310997 "2022-08-03T16:41:05Z")
I have installed Elasticsearch, kibana, and enterprise. I followed the configuration instructions and I keep getting this error: We can’t establish a connection to Enterprise Search at the host URL http://localhost:3002 … --- ## [Create views on statuses with math](https://discuss.elastic.co/t/create-views-on-statuses-with-math/311327)
**Author:** [@Murali\_Y](https://discuss.elastic.co/u/Murali_Y)\ **Replies:** 1\ **Last updated:** [August 3, 2022, 4:06pm UTC](https://discuss.elastic.co/t/create-views-on-statuses-with-math/311327 "2022-08-03T16:06:07Z")
Hello all, I am newbie to Kibana. I am trying to create table or view for below condition: In our logs we are writing below info: "Status": 100 for pass "Status": 200 for fail "Status": 300 for stuck due to issue S… --- ## [Is Version 8 with Elastic Agent stable in medium to large environments?a](https://discuss.elastic.co/t/is-version-8-with-elastic-agent-stable-in-medium-to-large-environments-a/310536)
**Author:** [@alaine](https://discuss.elastic.co/u/alaine)\ **Replies:** 5\ **Last updated:** [August 3, 2022, 3:31pm UTC](https://discuss.elastic.co/t/is-version-8-with-elastic-agent-stable-in-medium-to-large-environments-a/310536 "2022-08-03T15:31:31Z")
Hi there, I am in charge of a couple clusters that are used for security and log retention. They are both on version 7.17.3 and both have about 5000 endpoints. We are going to have to upgrade to version 8.x at some poin… --- ## [Metricbeat 8.3.2 and mongo V5](https://discuss.elastic.co/t/metricbeat-8-3-2-and-mongo-v5/309912)
**Author:** [@rajsolanki](https://discuss.elastic.co/u/rajsolanki)\ **Replies:** 3\ **Last updated:** [August 3, 2022, 2:57pm UTC](https://discuss.elastic.co/t/metricbeat-8-3-2-and-mongo-v5/309912 "2022-08-03T14:57:11Z")
FYI Metricbeat 8.3.1+ now supports mongo V5. So i downloaded 8.3.2 and configured against my 3 server cluster with replica set. So if i add single server ( i have 3 server cluster with replica set in following template … --- ## [Removing square brackets from json key in http input](https://discuss.elastic.co/t/removing-square-brackets-from-json-key-in-http-input/311243)
**Author:** [@Felipe\_Fuller](https://discuss.elastic.co/u/Felipe_Fuller)\ **Replies:** 5\ **Last updated:** [August 3, 2022, 2:51pm UTC](https://discuss.elastic.co/t/removing-square-brackets-from-json-key-in-http-input/311243 "2022-08-03T14:51:09Z")
Hi Community! I've been having the following problem. I'm receiving, through http input filter, a JSON that has bracket square in the keys so Logstash isn't able to parse it, as result it returns a \_jsonparsefailure. A… --- ## [Installing Elastic License using Helm charts 7.x](https://discuss.elastic.co/t/installing-elastic-license-using-helm-charts-7-x/311319)
**Author:** [@AndreRosendo](https://discuss.elastic.co/u/AndreRosendo)\ **Replies:** 0\ **Last updated:** [August 3, 2022, 2:45pm UTC](https://discuss.elastic.co/t/installing-elastic-license-using-helm-charts-7-x/311319 "2022-08-03T14:45:16Z")
I've just acquired a license for the elastic stack and I'm trying to install it using helm charts. It is implied by the charts that you can install the license by mounting a secret but nowhere in the documentation I was… --- ## [Logstash overfilling Persistent Queue?](https://discuss.elastic.co/t/logstash-overfilling-persistent-queue/310197)
**Author:** [@timcorwin](https://discuss.elastic.co/u/timcorwin)\ **Replies:** 3\ **Last updated:** [August 3, 2022, 2:44pm UTC](https://discuss.elastic.co/t/logstash-overfilling-persistent-queue/310197 "2022-08-03T14:44:03Z")
I am running the logstash:7.17.4 docker image, and I've set queue.type: persisted in my logstash.yml, leaving all other queue settings at the default. Most of the time, I see the normal, expected behavior, where my even… --- ## [How to create multiple filebeats dashboard in Kibana](https://discuss.elastic.co/t/how-to-create-multiple-filebeats-dashboard-in-kibana/311225)
**Author:** [@huzaifa224](https://discuss.elastic.co/u/huzaifa224)\ **Replies:** 4\ **Last updated:** [August 3, 2022, 1:43pm UTC](https://discuss.elastic.co/t/how-to-create-multiple-filebeats-dashboard-in-kibana/311225 "2022-08-03T13:43:46Z")
Hi, I have multiple Filebeats are running in multiple systems with custom index name. Filebeat send data to Logstash then logstash send data to Elasticsearch. Every thing is working fine logs are showing in Discovery ta… --- ## [Enterprise Search connector feedback](https://discuss.elastic.co/t/enterprise-search-connector-feedback/311316)
**Author:** [@Serena\_Chou](https://discuss.elastic.co/u/Serena_Chou)\ **Replies:** 0\ **Last updated:** [August 3, 2022, 2:01pm UTC](https://discuss.elastic.co/t/enterprise-search-connector-feedback/311316 "2022-08-03T14:01:33Z")
Are you interested to know more about what connectors we plan to add in the future roadmap? Are you building a connector for something that is custom and unique to your organization? Come talk to the PM team and give us … --- ## [JSON indexing in kibana](https://discuss.elastic.co/t/json-indexing-in-kibana/311265)
**Author:** [@Ritikapawar](https://discuss.elastic.co/u/Ritikapawar)\ **Replies:** 1\ **Last updated:** [August 3, 2022, 2:01pm UTC](https://discuss.elastic.co/t/json-indexing-in-kibana/311265 "2022-08-03T14:01:02Z")
I have created a index using kibana console the sample JSON data format - \[{ "id":1, "Data":"{'patient\_name':'Amey','gender':'Male'}", "added\_on":"2021-09-28 17:58:16", "added\_by":0, "status":1 }, { "id":2, "Data":"{… --- ## [Detection rules hitting all data tiers](https://discuss.elastic.co/t/detection-rules-hitting-all-data-tiers/310922)
**Author:** [@pushkarsawant](https://discuss.elastic.co/u/pushkarsawant)\ **Replies:** 5\ **Last updated:** [August 3, 2022, 1:46pm UTC](https://discuss.elastic.co/t/detection-rules-hitting-all-data-tiers/310922 "2022-08-03T13:46:13Z")
Hi, We are using elasticsearch detection engine to run detections through logs data. Most of our detection rules are executed against logs-\* index pattern. These rules run every 5 minutes with a look back of 4 minutes. … --- ## [Ordering by percentile not working anymore](https://discuss.elastic.co/t/ordering-by-percentile-not-working-anymore/308995)
**Author:** [@VeraE](https://discuss.elastic.co/u/VeraE)\ **Replies:** 7\ **Last updated:** [August 3, 2022, 1:45pm UTC](https://discuss.elastic.co/t/ordering-by-percentile-not-working-anymore/308995 "2022-08-03T13:45:26Z")
Hi! I had a couple of Lens line graphs of some response times set up, ordered by the 95th percentile. In recent days I noticed they don't work anymore, although I didn't change anything (they were last changed in Januar… --- ## [求助kibana开发环境报错Error: No module factory available for dependency type: CssDependency](https://discuss.elastic.co/t/kibana-error-no-module-factory-available-for-dependency-type-cssdependency/311313)
**Author:** [@wwh2077](https://discuss.elastic.co/u/wwh2077)\ **Replies:** 0\ **Last updated:** [August 3, 2022, 1:32pm UTC](https://discuss.elastic.co/t/kibana-error-no-module-factory-available-for-dependency-type-cssdependency/311313 "2022-08-03T13:32:14Z")
求助我在搭建kibana开发环境时 运行命令 yarn kbn bootstrap报错了 请问如何解决 $ yarn kbn bootstrap yarn run v1.22.19 $ node scripts/kbn bootstrap succ \[bazel\_tools\] all bazel tools are correctly installed info \[bazel\] INFO: Invocation ID: 959… --- ## [Changing xpack monitoring index](https://discuss.elastic.co/t/changing-xpack-monitoring-index/309422)
**Author:** [@Adriann](https://discuss.elastic.co/u/Adriann)\ **Replies:** 2\ **Last updated:** [August 3, 2022, 1:27pm UTC](https://discuss.elastic.co/t/changing-xpack-monitoring-index/309422 "2022-08-03T13:27:10Z")
Hello, I want to lower the number of indices generated by monitoring modules from filebeat and metricbeat. That monitors logstash, beats, elasticserach and kibana. I would like these indices to be monthly indices. Whe… --- ## [Elasticsearch masters not discovering each other on Docker Swarm](https://discuss.elastic.co/t/elasticsearch-masters-not-discovering-each-other-on-docker-swarm/311230)
**Author:** [@bushwhacker](https://discuss.elastic.co/u/bushwhacker)\ **Replies:** 5\ **Last updated:** [August 3, 2022, 1:12pm UTC](https://discuss.elastic.co/t/elasticsearch-masters-not-discovering-each-other-on-docker-swarm/311230 "2022-08-03T13:12:36Z")
I am trying to set up an elasticsearch stack using docker swarm (Don't really need swarm functionality, but the .yml has been written now) The problem I seem to be getting is that when i start up the stack, the two mast… --- ## [Error: fail to enroll : connection timed out](https://discuss.elastic.co/t/error-fail-to-enroll-connection-timed-out/310036)
**Author:** [@koubach](https://discuss.elastic.co/u/koubach)\ **Replies:** 1\ **Last updated:** [August 3, 2022, 12:49pm UTC](https://discuss.elastic.co/t/error-fail-to-enroll-connection-timed-out/310036 "2022-08-03T12:49:57Z")
Hi, I'm using Elastic Cloud and I'm can't seem to be able to install the elastic agent, and I get the error : Error: fail to enroll: fail to execute request to fleet-server: dial tcp IP-adress:443: connect: connection … --- ## [Hardening elasticsearch using certificate from sectigo](https://discuss.elastic.co/t/hardening-elasticsearch-using-certificate-from-sectigo/311296)
**Author:** [@xalastoi](https://discuss.elastic.co/u/xalastoi)\ **Replies:** 3\ **Last updated:** [August 3, 2022, 11:47am UTC](https://discuss.elastic.co/t/hardening-elasticsearch-using-certificate-from-sectigo/311296 "2022-08-03T11:47:04Z")
0 Due to auditing requirements, it is necessary to encrypt all connections between the application and the elasticsearch cluster after a little googling, I realized that the elasticsearch cluster protection looks like t… --- ## [Cut off matching content and write to field](https://discuss.elastic.co/t/cut-off-matching-content-and-write-to-field/311197)
**Author:** [@anon90868141](https://discuss.elastic.co/u/anon90868141)\ **Replies:** 3\ **Last updated:** [August 3, 2022, 11:44am UTC](https://discuss.elastic.co/t/cut-off-matching-content-and-write-to-field/311197 "2022-08-03T11:44:02Z")
Hi, is there any way to match a pattern inside a log and just write a port of it to a field? Here's a abstraction of my log: elapsedTimeMs=41 I'd wrap it in () because it's sporadic and want the 41 to be written into … --- ## [Custom log4j2.propoerties for Elasticsearch in docker](https://discuss.elastic.co/t/custom-log4j2-propoerties-for-elasticsearch-in-docker/310321)
**Author:** [@ylasri](https://discuss.elastic.co/u/ylasri)\ **Replies:** 3\ **Last updated:** [August 3, 2022, 11:38am UTC](https://discuss.elastic.co/t/custom-log4j2-propoerties-for-elasticsearch-in-docker/310321 "2022-08-03T11:38:51Z")
Hello, On docker, log messages go to the console and are handled by the configured Docker logging driver. To access logs we need to run docker logs $container\_name. I would like to change this behavior, and ask Elastic… --- ## [Elasticsearch data nodes](https://discuss.elastic.co/t/elasticsearch-data-nodes/311206)
**Author:** [@Farah\_Bhr](https://discuss.elastic.co/u/Farah_Bhr)\ **Replies:** 1\ **Last updated:** [August 3, 2022, 11:11am UTC](https://discuss.elastic.co/t/elasticsearch-data-nodes/311206 "2022-08-03T11:11:49Z")
Hello I am a beginner at elastic , I want to ask you what is the criteria to add another elasticsearch data node , meaning how to know if my elasticsearch node needs another node to perform better , is there a percentage… --- ## [Fleet Server Docker Failing to Start no Error message](https://discuss.elastic.co/t/fleet-server-docker-failing-to-start-no-error-message/311294)
**Author:** [@maehue](https://discuss.elastic.co/u/maehue)\ **Replies:** 0\ **Last updated:** [August 3, 2022, 11:00am UTC](https://discuss.elastic.co/t/fleet-server-docker-failing-to-start-no-error-message/311294 "2022-08-03T11:00:12Z")
I am having a hard time getting the Elastic Agent running as Server for Fleet in docker. I apologize I have to retype my environment here on my personal account as I am not yet on the enterprise support so its difficult… --- ## [Can't load some Security pages](https://discuss.elastic.co/t/cant-load-some-security-pages/311126)
**Author:** [@kotvmrc](https://discuss.elastic.co/u/kotvmrc)\ **Replies:** 3\ **Last updated:** [August 3, 2022, 10:51am UTC](https://discuss.elastic.co/t/cant-load-some-security-pages/311126 "2022-08-03T10:51:27Z")
Hello all, I'm experiencing some issues when loading pages from "Security" section. Pages "Overview", "Timelines", "Cases", "Hosts" and "Network" show the following: "Alerts" page is loading correctly and all the p… --- ## [date.toString() doesn't work after upgrading to ES 8.3](https://discuss.elastic.co/t/date-tostring-doesnt-work-after-upgrading-to-es-8-3/311290)
**Author:** [@Joao\_Silva](https://discuss.elastic.co/u/Joao_Silva)\ **Replies:** 1\ **Last updated:** [August 3, 2022, 10:50am UTC](https://discuss.elastic.co/t/date-tostring-doesnt-work-after-upgrading-to-es-8-3/311290 "2022-08-03T10:50:55Z")
After updating the ES to the newest version some of my runtime fields stop working, basically, the date.toString() doesn't work anymore to convert a date to a string. Is there any option for this? I have been searching … --- ## [Logstash 8.3.3 removes entries from sincedb](https://discuss.elastic.co/t/logstash-8-3-3-removes-entries-from-sincedb/311293)
**Author:** [@ylasri](https://discuss.elastic.co/u/ylasri)\ **Replies:** 0\ **Last updated:** [August 3, 2022, 10:37am UTC](https://discuss.elastic.co/t/logstash-8-3-3-removes-entries-from-sincedb/311293 "2022-08-03T10:37:24Z")
Hello, I have a pipeline using Logstash 8.3.3 The pipeline is consuming csv file from an input folder using file input The csv files are produced by an other system on the flight This my input input { file { p… --- ## [How to sort buckets in Elasticsearch on their first occurrence in a search?](https://discuss.elastic.co/t/how-to-sort-buckets-in-elasticsearch-on-their-first-occurrence-in-a-search/311288)
**Author:** [@Peter\_Dewachtere](https://discuss.elastic.co/u/Peter_Dewachtere)\ **Replies:** 0\ **Last updated:** [August 3, 2022, 10:08am UTC](https://discuss.elastic.co/t/how-to-sort-buckets-in-elasticsearch-on-their-first-occurrence-in-a-search/311288 "2022-08-03T10:08:33Z")
I have an Elasticsearch query (version 7) that returns a paged result of products. The query has a specific sort on multiple fields: Product A - image 1 Product B - image 1 Product C - image 2 Product D - image 2 Prod… --- ## [What is the best practice for multiple table? Multiple logstash config or single config?](https://discuss.elastic.co/t/what-is-the-best-practice-for-multiple-table-multiple-logstash-config-or-single-config/311277)
**Author:** [@myx](https://discuss.elastic.co/u/myx)\ **Replies:** 0\ **Last updated:** [August 3, 2022, 8:38am UTC](https://discuss.elastic.co/t/what-is-the-best-practice-for-multiple-table-multiple-logstash-config-or-single-config/311277 "2022-08-03T08:38:52Z")
Hi, I just learned ELK and I'm confused about this use case for its Logstash implementation for a project that has quite a bad DB design... So I have index in Elasticsearch called book. Inside it, there's a short infor… [Previous page](https://discuss.elastic.co/latest.md?page=1019) [Next page](https://discuss.elastic.co/latest.md?page=1021)