# Latest **URL:** https://discuss.elastic.co/latest.md?page=1021 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1022 --- ## [How to Create Kibana Visualization to show only highest 3 sum of values over a time period?](https://discuss.elastic.co/t/how-to-create-kibana-visualization-to-show-only-highest-3-sum-of-values-over-a-time-period/310000)
**Author:** [@rachana\_uday](https://discuss.elastic.co/u/rachana_uday)\ **Replies:** 3\ **Last updated:** [August 3, 2022, 9:12am UTC](https://discuss.elastic.co/t/how-to-create-kibana-visualization-to-show-only-highest-3-sum-of-values-over-a-time-period/310000 "2022-08-03T09:12:09Z")
Hey Guys, I have a task to create a kibana Visualization \[preferably a data table\] that shows the maximum 3 values of the sum of values over a time period. Basically I want the visualization to obtain below: calculat… --- ## [Threat Intel module for Filebeat : aging off and updating documents](https://discuss.elastic.co/t/threat-intel-module-for-filebeat-aging-off-and-updating-documents/311237)
**Author:** [@kossde](https://discuss.elastic.co/u/kossde)\ **Replies:** 1\ **Last updated:** [August 3, 2022, 8:59am UTC](https://discuss.elastic.co/t/threat-intel-module-for-filebeat-aging-off-and-updating-documents/311237 "2022-08-03T08:59:39Z")
Do any of you know whether or not Elasticsearch and the filebeat threat intel module age off old events or update events that have been modified? --- ## [How to run multiple indexing threads on a single machine?](https://discuss.elastic.co/t/how-to-run-multiple-indexing-threads-on-a-single-machine/311058)
**Author:** [@Niels\_Basjes](https://discuss.elastic.co/u/Niels_Basjes)\ **Replies:** 2\ **Last updated:** [August 3, 2022, 8:44am UTC](https://discuss.elastic.co/t/how-to-run-multiple-indexing-threads-on-a-single-machine/311058 "2022-08-03T08:44:54Z")
I have written an Elasticsearch plugin ( analyzes the UserAgent string ) that works the way I have in mind when I put it in a pipeline. (see Elastic Search | Yauaa - Yet Another UserAgent Analyzer ) Now on my laptop I w… --- ## [Is the elastic-agent 8.3.3 debian package broken?](https://discuss.elastic.co/t/is-the-elastic-agent-8-3-3-debian-package-broken/311143)
**Author:** [@hanna](https://discuss.elastic.co/u/hanna)\ **Replies:** 3\ **Last updated:** [August 3, 2022, 8:26am UTC](https://discuss.elastic.co/t/is-the-elastic-agent-8-3-3-debian-package-broken/311143 "2022-08-03T08:26:43Z")
Hello, last friday I updated all of my elastic agents from 8.3.2 to 8.3.3 and unfortunately this broke my elastic-agent installations on Ubuntu. I used the debian package from this link https://artifacts.elastic.co/do… --- ## [Elastic Search query with "+" prefix character escape not working](https://discuss.elastic.co/t/elastic-search-query-with-prefix-character-escape-not-working/311274)
**Author:** [@tobi\_owolawi](https://discuss.elastic.co/u/tobi_owolawi)\ **Replies:** 0\ **Last updated:** [August 3, 2022, 8:10am UTC](https://discuss.elastic.co/t/elastic-search-query-with-prefix-character-escape-not-working/311274 "2022-08-03T08:10:18Z")
I have this issue currently with my elastic search not working suddenly. trying either of the following shows no hits when they are escaped. GET /policies/\_search { "query" : { "simple\_query\_string" : { "que… --- ## [Problem with indexing Cisco Logfiles](https://discuss.elastic.co/t/problem-with-indexing-cisco-logfiles/309724)
**Author:** [@MADxHAWK](https://discuss.elastic.co/u/MADxHAWK)\ **Replies:** 5\ **Last updated:** [August 3, 2022, 7:40am UTC](https://discuss.elastic.co/t/problem-with-indexing-cisco-logfiles/309724 "2022-08-03T07:40:18Z")
Hello Community, i am quite new to ELK-Stack and i ran into some problems with indexing Cisco Logfiles to make them searchable in Kibana. Background informations: Server A: xx.xxx.xxx.102 (Loghost) Running syslog-ng… --- ## [Date Histogram aggregation](https://discuss.elastic.co/t/date-histogram-aggregation/311238)
**Author:** [@Amphagory](https://discuss.elastic.co/u/Amphagory)\ **Replies:** 1\ **Last updated:** [August 3, 2022, 7:30am UTC](https://discuss.elastic.co/t/date-histogram-aggregation/311238 "2022-08-03T07:30:29Z")
Hello, I am using Kibana version 8.2.3 where I’m using Lens to create a table. I’m using the Date Histogram aggregation on the timestamp with a customize time interval of 1 hour. For some reason, the table is not crea… --- ## [Export rules into excel or CSV or PDF format](https://discuss.elastic.co/t/export-rules-into-excel-or-csv-or-pdf-format/311180)
**Author:** [@sunith](https://discuss.elastic.co/u/sunith)\ **Replies:** 2\ **Last updated:** [August 3, 2022, 6:29am UTC](https://discuss.elastic.co/t/export-rules-into-excel-or-csv-or-pdf-format/311180 "2022-08-03T06:29:54Z")
Hi, Kindly let me know is there a way to export all rules into readable CSV or excel or PDF format? Or is there a way to convert .ndjson export format to CSV or excel? Thanks in advance. --- ## [Enable/disable tracing dynamically](https://discuss.elastic.co/t/enable-disable-tracing-dynamically/311261)
**Author:** [@yahire](https://discuss.elastic.co/u/yahire)\ **Replies:** 0\ **Last updated:** [August 3, 2022, 6:17am UTC](https://discuss.elastic.co/t/enable-disable-tracing-dynamically/311261 "2022-08-03T06:17:47Z")
Hi team, Is it possible to enable/disable the tracing dynamically when the application is still running and agent is configured as well, without server restart. I wanted to enable the tracing and disable the tracing o… --- ## [Unable to start elasticsearch after upgrade 7.17 -\> 8.2 timeout was exceeded](https://discuss.elastic.co/t/unable-to-start-elasticsearch-after-upgrade-7-17-8-2-timeout-was-exceeded/310960)
**Author:** [@Petr.Simik](https://discuss.elastic.co/u/Petr.Simik)\ **Replies:** 13\ **Last updated:** [August 3, 2022, 6:02am UTC](https://discuss.elastic.co/t/unable-to-start-elasticsearch-after-upgrade-7-17-8-2-timeout-was-exceeded/310960 "2022-08-03T06:02:40Z")
Can you please direct me how to solve the problem when starting elasticsearch node after its upgrade to 8.2 system startup timeouts despite the fact that I adjusted the timeout to 3 minutes i followed this procedure i… --- ## [Jdbc\_driver\_library, file not readable (please check user and group permissions for the path)](https://discuss.elastic.co/t/jdbc-driver-library-file-not-readable-please-check-user-and-group-permissions-for-the-path/311260)
**Author:** [@Kannanmk](https://discuss.elastic.co/u/Kannanmk)\ **Replies:** 0\ **Last updated:** [August 3, 2022, 5:25am UTC](https://discuss.elastic.co/t/jdbc-driver-library-file-not-readable-please-check-user-and-group-permissions-for-the-path/311260 "2022-08-03T05:25:33Z")
hi @guyboertje here i am trying to update my config into AWS but it shows "Error: unable to load /home/ubuntu/Jebin/Corban\_Project\_Docker\_21\_06\_2022/Corban\_Elastic\_Logstash\_Kibana/ELK\_Files/postgresql-42.4.0.jar from… --- ## [Possible race condition causing Elasticsearch output plugin to overwrite supplied index with rollover alias](https://discuss.elastic.co/t/possible-race-condition-causing-elasticsearch-output-plugin-to-overwrite-supplied-index-with-rollover-alias/311174)
**Author:** [@andreastoom](https://discuss.elastic.co/u/andreastoom)\ **Replies:** 2\ **Last updated:** [August 3, 2022, 5:18am UTC](https://discuss.elastic.co/t/possible-race-condition-causing-elasticsearch-output-plugin-to-overwrite-supplied-index-with-rollover-alias/311174 "2022-08-03T05:18:41Z")
Hi, Since migrating to using data streams we have started to see that a subset of our data all of a sudden are being written to an index called "logstash" instead of the data stream. After a bit of digging around it see… --- ## [Filebeat not working for k8s ingress nginx controller](https://discuss.elastic.co/t/filebeat-not-working-for-k8s-ingress-nginx-controller/311259)
**Author:** [@SABER\_Ye](https://discuss.elastic.co/u/SABER_Ye)\ **Replies:** 0\ **Last updated:** [August 3, 2022, 5:17am UTC](https://discuss.elastic.co/t/filebeat-not-working-for-k8s-ingress-nginx-controller/311259 "2022-08-03T05:17:06Z")
filebeat config: --- apiVersion: v1 kind: ConfigMap metadata: name: filebeat-config namespace: kube-system labels: k8s-app: filebeat data: filebeat.yml: |- filebeat.inputs: - type: log en… --- ## [Error while parsing nested json on filebeat](https://discuss.elastic.co/t/error-while-parsing-nested-json-on-filebeat/311256)
**Author:** [@RaonyO](https://discuss.elastic.co/u/RaonyO)\ **Replies:** 0\ **Last updated:** [August 3, 2022, 4:15am UTC](https://discuss.elastic.co/t/error-while-parsing-nested-json-on-filebeat/311256 "2022-08-03T04:15:59Z")
I have the following error on logstash when trying to index json nested logs that are inside square brackets '' Error parsing json {:source=\>"message", :raw=\>"\]", :exception=\>#\ **Author:** [@grvGarg](https://discuss.elastic.co/u/grvGarg)\ **Replies:** 4\ **Last updated:** [August 3, 2022, 3:52am UTC](https://discuss.elastic.co/t/not-able-to-use-postgres-query-with-double-quotes-in-jdbc-streaming-plugin/311141 "2022-08-03T03:52:00Z") Hi I am using jdbc\_streaming plugin. I have a complex query and also my postgres required double quotes (") with each table/column name. I am also using Case When in my query, which requires apostrophe('). Plugin does… --- ## [Elastic APM Not accessible outside docker container](https://discuss.elastic.co/t/elastic-apm-not-accessible-outside-docker-container/311026)
**Author:** [@sathishsoundharajan](https://discuss.elastic.co/u/sathishsoundharajan)\ **Replies:** 8\ **Last updated:** [August 3, 2022, 1:27am UTC](https://discuss.elastic.co/t/elastic-apm-not-accessible-outside-docker-container/311026 "2022-08-03T01:27:39Z")
Describe the bug OTEL Collector not able to connect to elastic-apm Steps to reproduce Please follow the instructions here, it is simple App What did you expect to see? i'm expecting to see the tracing logs to be se… --- ## [Regexp with DSL query](https://discuss.elastic.co/t/regexp-with-dsl-query/311249)
**Author:** [@antonisnyc94](https://discuss.elastic.co/u/antonisnyc94)\ **Replies:** 0\ **Last updated:** [August 3, 2022, 12:44am UTC](https://discuss.elastic.co/t/regexp-with-dsl-query/311249 "2022-08-03T00:44:21Z")
Hello, Im trying to run a regexp query for the below string but I keep getting Bad String error.. Any ideas? Actual substring i want to match within a string is "verbs"=\>\["\*"\] { "query": { "regexp": { "dat… --- ## [ElasticSearch restart problem (Lucene Version mismatch)](https://discuss.elastic.co/t/elasticsearch-restart-problem-lucene-version-mismatch/310944)
**Author:** [@JUN\_HO\_CHOI\_KR\_SEL](https://discuss.elastic.co/u/JUN_HO_CHOI_KR_SEL)\ **Replies:** 6\ **Last updated:** [August 2, 2022, 11:55pm UTC](https://discuss.elastic.co/t/elasticsearch-restart-problem-lucene-version-mismatch/310944 "2022-08-02T23:55:50Z")
Hi I using Azure Vm and Elastic & Kibana I restart the vm and i Encounterd the error when i restart the Elasticsearch the error message is Job for elasticsearch.service failed because the control process exited with … --- ## [JDBC Plugin — Missing Converter handling for full class name=org.postgresql.util.PGobject, simple name=PGobject](https://discuss.elastic.co/t/jdbc-plugin-missing-converter-handling-for-full-class-name-org-postgresql-util-pgobject-simple-name-pgobject/311246)
**Author:** [@5k\_pwc](https://discuss.elastic.co/u/5k_pwc)\ **Replies:** 0\ **Last updated:** [August 2, 2022, 10:30pm UTC](https://discuss.elastic.co/t/jdbc-plugin-missing-converter-handling-for-full-class-name-org-postgresql-util-pgobject-simple-name-pgobject/311246 "2022-08-02T22:30:21Z")
hi, my table geometry, JSONB, i get the below exception. Exception when executing JDBC query {:exception=\>Sequel::DatabaseError, :message=\>"Java::OrgLogstash::MissingConverterException: Missing Converter handling for f… --- ## [Geo Location sorting doesn't seem to work](https://discuss.elastic.co/t/geo-location-sorting-doesnt-seem-to-work/311023)
**Author:** [@Woland](https://discuss.elastic.co/u/Woland)\ **Replies:** 3\ **Last updated:** [August 2, 2022, 8:40pm UTC](https://discuss.elastic.co/t/geo-location-sorting-doesnt-seem-to-work/311023 "2022-08-02T20:40:36Z")
Hi, I'm trying to sort by location. Similar data and tests work correctly in Elastic Search but fail using Elastic App Search (latest 8.3 version). The results should be in the following order "Item-2, Item-3, Item-1", i… --- ## [Action:ReadOnly appears to set index.blocks.write not index.blocks.read\_only](https://discuss.elastic.co/t/action-readonly-appears-to-set-index-blocks-write-not-index-blocks-read-only/311070)
**Author:** [@Stef\_Nestor](https://discuss.elastic.co/u/Stef_Nestor)\ **Replies:** 1\ **Last updated:** [August 2, 2022, 8:30pm UTC](https://discuss.elastic.co/t/action-readonly-appears-to-set-index-blocks-write-not-index-blocks-read-only/311070 "2022-08-02T20:30:00Z")
:wave: howdy! I think I'm reading the doc poorly but can't tell intended intended action to request a doc update. Can y'all check this for me, please? ILM ReadOnly states Makes the index read-only; writes and metadata… --- ## [Winlogbeat 8.2.3, loadbalance: true](https://discuss.elastic.co/t/winlogbeat-8-2-3-loadbalance-true/311212)
**Author:** [@Helmut](https://discuss.elastic.co/u/Helmut)\ **Replies:** 7\ **Last updated:** [August 2, 2022, 7:59pm UTC](https://discuss.elastic.co/t/winlogbeat-8-2-3-loadbalance-true/311212 "2022-08-02T19:59:23Z")
Hi, in winlogbeat.yaml I have: output.logstash: hosts: \["logstashA:5044", "logstashB:5044"\] loadbalance: true When either of those hosts is down the other one also does not get events forwarded anymore. Is this a misc… --- ## [Logstash Output doesnt have grok fields but Event.original only](https://discuss.elastic.co/t/logstash-output-doesnt-have-grok-fields-but-event-original-only/311220)
**Author:** [@vsudula](https://discuss.elastic.co/u/vsudula)\ **Replies:** 7\ **Last updated:** [August 2, 2022, 6:30pm UTC](https://discuss.elastic.co/t/logstash-output-doesnt-have-grok-fields-but-event-original-only/311220 "2022-08-02T18:30:18Z")
I am using Logstash 8.3 and i have provided my logs below . When logstsh ingests the data to elastic its ingesting data as whole line as text instead of individual values that i defined in grok pattern. //My Code here. … --- ## [Optimize the latency for 1k OR clauses](https://discuss.elastic.co/t/optimize-the-latency-for-1k-or-clauses/311084)
**Author:** [@Aditya\_Verma2](https://discuss.elastic.co/u/Aditya_Verma2)\ **Replies:** 3\ **Last updated:** [August 2, 2022, 5:21pm UTC](https://discuss.elastic.co/t/optimize-the-latency-for-1k-or-clauses/311084 "2022-08-02T17:21:53Z")
Hey, i want to query on a specific field with 1000 clauses separated by OR. But the latencies that i am getting are very high. Is there any setting in elastic to set cache policy for values of a field so that the values … --- ## [Unable to setup Elasticsearch python instance on https](https://discuss.elastic.co/t/unable-to-setup-elasticsearch-python-instance-on-https/311018)
**Author:** [@Edinpain](https://discuss.elastic.co/u/Edinpain)\ **Replies:** 7\ **Last updated:** [August 2, 2022, 5:05pm UTC](https://discuss.elastic.co/t/unable-to-setup-elasticsearch-python-instance-on-https/311018 "2022-08-02T17:05:27Z")
Sweet lord it's been a long day. Ubuntu newb, ~0 zero knowledge in cryptography certificates. Creating a flask project and want to follow this tutorial to use elastic to index my postgres + sqlalchemy database. Python: … --- ## [Missing RSS Items](https://discuss.elastic.co/t/missing-rss-items/311199)
**Author:** [@pdziumla](https://discuss.elastic.co/u/pdziumla)\ **Replies:** 1\ **Last updated:** [August 2, 2022, 4:48pm UTC](https://discuss.elastic.co/t/missing-rss-items/311199 "2022-08-02T16:48:17Z")
Hello Guys, I'm completely new to RSS, XML and that stuff so I might overlook something quite simple here. So, here ist my problem: I succesfully setup the RSS-Plugin and it's working fine. Except it seem to miss out … --- ## [Extract time from txt file and date from file name and add them to @timestamp field](https://discuss.elastic.co/t/extract-time-from-txt-file-and-date-from-file-name-and-add-them-to-timestamp-field/311196)
**Author:** [@Faiz\_Shamri](https://discuss.elastic.co/u/Faiz_Shamri)\ **Replies:** 1\ **Last updated:** [August 2, 2022, 4:35pm UTC](https://discuss.elastic.co/t/extract-time-from-txt-file-and-date-from-file-name-and-add-them-to-timestamp-field/311196 "2022-08-02T16:35:30Z")
I am trying to extract time field from txt file which looks like: 14:39:38 someName clientName 968112300 1008008000 39895700 also tyring to extract date from file name /path/to/file/name/filename\_2… --- ## [Error when generating reports](https://discuss.elastic.co/t/error-when-generating-reports/310791)
**Author:** [@tcapp24](https://discuss.elastic.co/u/tcapp24)\ **Replies:** 5\ **Last updated:** [August 2, 2022, 3:55pm UTC](https://discuss.elastic.co/t/error-when-generating-reports/310791 "2022-08-02T15:55:42Z")
Hello, Currently we are trying to generate a report but keep getting the error message below: Error: Failed to decrypt report job data. Please ensure that xpack.reporting.encryptionKey is set and re-generate this repo… --- ## [Ingest Response to different address for error handling of fire-and-forget bulk ingesting](https://discuss.elastic.co/t/ingest-response-to-different-address-for-error-handling-of-fire-and-forget-bulk-ingesting/311229)
**Author:** [@RoelandWu](https://discuss.elastic.co/u/RoelandWu)\ **Replies:** 1\ **Last updated:** [August 2, 2022, 3:16pm UTC](https://discuss.elastic.co/t/ingest-response-to-different-address-for-error-handling-of-fire-and-forget-bulk-ingesting/311229 "2022-08-02T15:16:28Z")
Hi there, I'm trying to figure out if there is a way to use fire-and-forget ingesting with ElasticSearch. I am developing an application that (among other things) ingests data into Elasticsearch via the bulk api. What … --- ## [Overwrite @timestamp filed by date and time filed in the CSV file](https://discuss.elastic.co/t/overwrite-timestamp-filed-by-date-and-time-filed-in-the-csv-file/311142)
**Author:** [@Faiz\_Shamri](https://discuss.elastic.co/u/Faiz_Shamri)\ **Replies:** 7\ **Last updated:** [August 2, 2022, 2:42pm UTC](https://discuss.elastic.co/t/overwrite-timestamp-filed-by-date-and-time-filed-in-the-csv-file/311142 "2022-08-02T14:42:43Z")
My logstash conf. file is like the below: input { file { path =\> "/somepath/balance\_20220731.csv" start\_position =\> "beginning" sincedb\_path =\> "/dev/null" } } filter { csv { separator =\> ";" … [Previous page](https://discuss.elastic.co/latest.md?page=1020) [Next page](https://discuss.elastic.co/latest.md?page=1022)