# Latest **URL:** https://discuss.elastic.co/latest.md?page=1029 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1030 --- ## [Drilldown without filtering possible?](https://discuss.elastic.co/t/drilldown-without-filtering-possible/310693)
**Author:** [@paolovalladolid](https://discuss.elastic.co/u/paolovalladolid)\ **Replies:** 1\ **Last updated:** [July 27, 2022, 4:34pm UTC](https://discuss.elastic.co/t/drilldown-without-filtering-possible/310693 "2022-07-27T16:34:40Z")
We're on Kibana 7.16.3 I have a dashboard with a panel that has a drilldown set up, to go to another dashboard. The panel is a table with two columns. When I hover the cursor over a cell to get the little blue icon (r… --- ## [Bug? Logstash Ouput & Initial Fleet Setup](https://discuss.elastic.co/t/bug-logstash-ouput-initial-fleet-setup/310751)
**Author:** [@DefensiveDepth](https://discuss.elastic.co/u/DefensiveDepth)\ **Replies:** 1\ **Last updated:** [July 27, 2022, 3:23pm UTC](https://discuss.elastic.co/t/bug-logstash-ouput-initial-fleet-setup/310751 "2022-07-27T15:23:14Z")
Fleet 8.3.2, fresh install. I have a Fleet Server Policy that uses a Logstash ouput: From the guided install/generated CLI text, it appears that it does not take into account the Logstash output as it sets the --fle… --- ## [Filebeat 7.11.0 multiples path and multiples index](https://discuss.elastic.co/t/filebeat-7-11-0-multiples-path-and-multiples-index/310761)
**Author:** [@pi314](https://discuss.elastic.co/u/pi314)\ **Replies:** 0\ **Last updated:** [July 27, 2022, 2:19pm UTC](https://discuss.elastic.co/t/filebeat-7-11-0-multiples-path-and-multiples-index/310761 "2022-07-27T14:19:11Z")
Hi, I need to create several indexes for different log files. I am using the following settings: setup.ilm: enabled: false setup.template: enabled: true name: "log\_dev\_testing pattern: "log\_dev\_testing-\*" set… --- ## [Issue while configuring metricbeat in logstash version 7.16.3](https://discuss.elastic.co/t/issue-while-configuring-metricbeat-in-logstash-version-7-16-3/310677)
**Author:** [@Subhanwita\_Mullick](https://discuss.elastic.co/u/Subhanwita_Mullick)\ **Replies:** 0\ **Last updated:** [July 26, 2022, 6:24pm UTC](https://discuss.elastic.co/t/issue-while-configuring-metricbeat-in-logstash-version-7-16-3/310677 "2022-07-26T18:24:02Z")
Hello, I am migrating the logstash to version 7.16.3 from 7.9.3. But there is some error while updating the metricbeat in logstash. Error: Class org.jruby.RubyFloat cannot be cast to class Java.lang.double PFA the scr… --- ## [Reset lab environment and progress](https://discuss.elastic.co/t/reset-lab-environment-and-progress/310721)
**Author:** [@mekberg](https://discuss.elastic.co/u/mekberg)\ **Replies:** 2\ **Last updated:** [July 27, 2022, 2:00pm UTC](https://discuss.elastic.co/t/reset-lab-environment-and-progress/310721 "2022-07-27T14:00:58Z")
I'm doing an on-demand Elastic Engineer course, which I have finished, but I'd like to run through the labs once more to refresh my knowledge before attempting a certification. I can't find anywhere to reset the complete… --- ## [Script query for child document not working](https://discuss.elastic.co/t/script-query-for-child-document-not-working/310752)
**Author:** [@Udayaprakash\_S\_10d](https://discuss.elastic.co/u/Udayaprakash_S_10d)\ **Replies:** 3\ **Last updated:** [July 27, 2022, 1:52pm UTC](https://discuss.elastic.co/t/script-query-for-child-document-not-working/310752 "2022-07-27T13:52:51Z")
{ "script": { "script": { "source": "doc\['tr\_billed'\].value == doc\['tr\_bill\_discount'\].value", "lang": "painless" }, "boost": 1 } … --- ## [Is there any way to reference the actual record from a graph created in Dashboard?](https://discuss.elastic.co/t/is-there-any-way-to-reference-the-actual-record-from-a-graph-created-in-dashboard/310738)
**Author:** [@its-ogawa](https://discuss.elastic.co/u/its-ogawa)\ **Replies:** 2\ **Last updated:** [July 27, 2022, 1:23pm UTC](https://discuss.elastic.co/t/is-there-any-way-to-reference-the-actual-record-from-a-graph-created-in-dashboard/310738 "2022-07-27T13:23:45Z")
I have created several graphs in Dashboard using Lens. This allows me to visually monitor the incidences. Now I would like to see the logs of the areas of interest in the graphs. Is it possible to see the logs around … --- ## [Long process notification](https://discuss.elastic.co/t/long-process-notification/310638)
**Author:** [@azv](https://discuss.elastic.co/u/azv)\ **Replies:** 2\ **Last updated:** [July 27, 2022, 1:01pm UTC](https://discuss.elastic.co/t/long-process-notification/310638 "2022-07-27T13:01:08Z")
Hi! There are processes in a console application we log spans. How can I create an alert to get a notification if a process takes too long to complete? I have the following example code. private static void Ex… --- ## [Can I reset the lab](https://discuss.elastic.co/t/can-i-reset-the-lab/310726)
**Author:** [@stepheng](https://discuss.elastic.co/u/stepheng)\ **Replies:** 1\ **Last updated:** [July 27, 2022, 12:54pm UTC](https://discuss.elastic.co/t/can-i-reset-the-lab/310726 "2022-07-27T12:54:03Z")
I'm new to ES as well as Linux. I just started the \[Elastic Observability Engineer\] courses. (Loading) On Lab 1.2: Heartbeat and Uptime, I somehow covered a executable file which stop me from going further. Then I delet… --- ## [How do the Endpoint preventions work?](https://discuss.elastic.co/t/how-do-the-endpoint-preventions-work/310179)
**Author:** [@tmahany419](https://discuss.elastic.co/u/tmahany419)\ **Replies:** 2\ **Last updated:** [July 27, 2022, 12:49pm UTC](https://discuss.elastic.co/t/how-do-the-endpoint-preventions-work/310179 "2022-07-27T12:49:12Z")
On this page under the policies: If click the link to "related detection rules" it just shows all the elastic rules. How do I know which rules will prevent traffic because it is ransomeware? --- ## [Apm Metrics are sent multiple times to APM](https://discuss.elastic.co/t/apm-metrics-are-sent-multiple-times-to-apm/310748)
**Author:** [@kbalys](https://discuss.elastic.co/u/kbalys)\ **Replies:** 0\ **Last updated:** [July 27, 2022, 12:41pm UTC](https://discuss.elastic.co/t/apm-metrics-are-sent-multiple-times-to-apm/310748 "2022-07-27T12:41:18Z")
There are multiple metrics being sent to Apm Server for a specific node per interval. The documents contain the same data and structure though are a bit different. Kibana version: 7.17.1 Elasticsearch version: 7.17.1 A… --- ## [Pattern analyzer regex help](https://discuss.elastic.co/t/pattern-analyzer-regex-help/310694)
**Author:** [@ansamHox](https://discuss.elastic.co/u/ansamHox)\ **Replies:** 2\ **Last updated:** [July 27, 2022, 12:31pm UTC](https://discuss.elastic.co/t/pattern-analyzer-regex-help/310694 "2022-07-27T12:31:10Z")
Got a question regarding the pattern analyzer. Example text: S6UlZgYCJaSIQcy03OOA==Ieuwc7Ix/CQfwoDSOVJl== 2oZjflRSRkcj4/OHcp78== It's encrypted (each letter is hashed to 20 characters ending with == sign). I would like… --- ## [Can't connect to remote cluster](https://discuss.elastic.co/t/cant-connect-to-remote-cluster/310468)
**Author:** [@Baygon](https://discuss.elastic.co/u/Baygon)\ **Replies:** 6\ **Last updated:** [July 27, 2022, 11:34am UTC](https://discuss.elastic.co/t/cant-connect-to-remote-cluster/310468 "2022-07-27T11:34:46Z")
Node 1: ES 7.14.0 (remote\_cluster\_client role is added to yml file) Node 2: ES 7.13.2 I've added my remote cluster via API: PUT /\_cluster/settings { "persistent" : { "cluster" : { "remote" : { "clu… --- ## [Script based conditional sorting for date fields inside nested object](https://discuss.elastic.co/t/script-based-conditional-sorting-for-date-fields-inside-nested-object/310432)
**Author:** [@M\_L](https://discuss.elastic.co/u/M_L)\ **Replies:** 9\ **Last updated:** [July 27, 2022, 12:00pm UTC](https://discuss.elastic.co/t/script-based-conditional-sorting-for-date-fields-inside-nested-object/310432 "2022-07-27T12:00:42Z")
Hello. I have the following property in my mapping: "attempts": { "type": "nested", "properties": { "type": { "type": "keyword" }, "reason": { "type": "keyword" }, "status": { … --- ## [High load at midnight caused by ES docker containers while no usage occurs](https://discuss.elastic.co/t/high-load-at-midnight-caused-by-es-docker-containers-while-no-usage-occurs/310663)
**Author:** [@tamaloa](https://discuss.elastic.co/u/tamaloa)\ **Replies:** 3\ **Last updated:** [July 27, 2022, 10:48am UTC](https://discuss.elastic.co/t/high-load-at-midnight-caused-by-es-docker-containers-while-no-usage-occurs/310663 "2022-07-27T10:48:21Z")
We are running a somewhat untypical setup (not your usual production elasticsearch usage) of around 40 very small (single node) elasticsearch docker instances (version 7.17.3) per server. Most instances contain very lit… --- ## [Remove/Prevent duplicates with rollover](https://discuss.elastic.co/t/remove-prevent-duplicates-with-rollover/310717)
**Author:** [@bianca6](https://discuss.elastic.co/u/bianca6)\ **Replies:** 14\ **Last updated:** [July 27, 2022, 9:49am UTC](https://discuss.elastic.co/t/remove-prevent-duplicates-with-rollover/310717 "2022-07-27T09:49:19Z")
Hi, One of my index has an ILM (index lifecycle management) with rollovers. The problem is, when the index receive data and rollover at the same time, the latest data are duplicated (present in both the new and old ind… --- ## [Date\_histogram interval versus fixed\_interval and calendar\_interval](https://discuss.elastic.co/t/date-histogram-interval-versus-fixed-interval-and-calendar-interval/310733)
**Author:** [@sbruinsje](https://discuss.elastic.co/u/sbruinsje)\ **Replies:** 0\ **Last updated:** [July 27, 2022, 9:35am UTC](https://discuss.elastic.co/t/date-histogram-interval-versus-fixed-interval-and-calendar-interval/310733 "2022-07-27T09:35:45Z")
I am upgrading to elasticsearch 8 which doesn't support the interval on date\_histogram anymore. Instead it expects a fixed\_interval or calendar\_interval. I am a bit confused about the old interval field. Does interval: … --- ## [Bug with legend when it's bottom](https://discuss.elastic.co/t/bug-with-legend-when-its-bottom/308663)
**Author:** [@franckfct](https://discuss.elastic.co/u/franckfct)\ **Replies:** 5\ **Last updated:** [July 27, 2022, 9:30am UTC](https://discuss.elastic.co/t/bug-with-legend-when-its-bottom/308663 "2022-07-27T09:30:09Z")
I've ugraded to V8 yesterday, and i have some bugs. When i modify a graph, if the legend is "bottom", when i save, i have a big white space under the graph between the legend and the bottom of the frame. The space i… --- ## [Accessing a flattened field in Kibana-VegaLite](https://discuss.elastic.co/t/accessing-a-flattened-field-in-kibana-vegalite/310253)
**Author:** [@InesCM](https://discuss.elastic.co/u/InesCM)\ **Replies:** 7\ **Last updated:** [July 27, 2022, 9:27am UTC](https://discuss.elastic.co/t/accessing-a-flattened-field-in-kibana-vegalite/310253 "2022-07-27T09:27:46Z")
Hi there! I'm successfully being able to flatten a nested field in VegaLite (several nestings, by the way). However, even if the flattened field is recognized, I get undefined when accessing the fields. Any ideas why … --- ## [Creating \`Query\` with multi-query clauses, is \`boost\` value required?](https://discuss.elastic.co/t/creating-query-with-multi-query-clauses-is-boost-value-required/310729)
**Author:** [@ALX\_DM](https://discuss.elastic.co/u/ALX_DM)\ **Replies:** 0\ **Last updated:** [July 27, 2022, 9:17am UTC](https://discuss.elastic.co/t/creating-query-with-multi-query-clauses-is-boost-value-required/310729 "2022-07-27T09:17:24Z")
In the new elasticsearch java client api, when creating a Query object, do we need to explicitly provide boost value for multi-query clauses? If not provided, what is the default boost value. Anybody had an idea? --- ## [Can we search the documents from multiple index by specifying the index with wildcard character like "test\*"?](https://discuss.elastic.co/t/can-we-search-the-documents-from-multiple-index-by-specifying-the-index-with-wildcard-character-like-test/310645)
**Author:** [@Aurovindo\_Sahu](https://discuss.elastic.co/u/Aurovindo_Sahu)\ **Replies:** 1\ **Last updated:** [July 27, 2022, 8:55am UTC](https://discuss.elastic.co/t/can-we-search-the-documents-from-multiple-index-by-specifying-the-index-with-wildcard-character-like-test/310645 "2022-07-27T08:55:12Z")
I want to search data from multiple indices and all the indices prefix is test. Is this possible to have the index name in the get request like test\* --- ## [Canvas TSVB time filter control](https://discuss.elastic.co/t/canvas-tsvb-time-filter-control/310548)
**Author:** [@Mark\_Rodman](https://discuss.elastic.co/u/Mark_Rodman)\ **Replies:** 1\ **Last updated:** [July 27, 2022, 8:28am UTC](https://discuss.elastic.co/t/canvas-tsvb-time-filter-control/310548 "2022-07-27T08:28:45Z")
Hi, I'm attempting to build a canvas visualisation of some time series data, using a line on the left hand y axis, and bar on the right hand y axis, and @timestamp across the x. This is a simple setup in TSVB. Replica… --- ## [Aggregate exception occurred {:ERROR=\>#\](https://discuss.elastic.co/t/aggregate-exception-occurred-error-nomethoderror-undefined-method-for-nil-nilclass/308435)
**Author:** [@The-morpho](https://discuss.elastic.co/u/The-morpho)\ **Replies:** 6\ **Last updated:** [July 27, 2022, 8:13am UTC](https://discuss.elastic.co/t/aggregate-exception-occurred-error-nomethoderror-undefined-method-for-nil-nilclass/308435 "2022-07-27T08:13:39Z")
Hello, I'm new with elastic, I'm working with logs, I want to process from them a new fields based on aggregation. This the my configuration file input { beats { port =\> 5044 } } filter { json { source =\>… --- ## [My Macos elastic-endpoint process CPU is too high, up to 103%](https://discuss.elastic.co/t/my-macos-elastic-endpoint-process-cpu-is-too-high-up-to-103/310640)
**Author:** [@xqaiviwjxzw](https://discuss.elastic.co/u/xqaiviwjxzw)\ **Replies:** 3\ **Last updated:** [July 27, 2022, 7:55am UTC](https://discuss.elastic.co/t/my-macos-elastic-endpoint-process-cpu-is-too-high-up-to-103/310640 "2022-07-27T07:55:11Z")
My Macos elastic-endpoint process CPU is too high, up to 103%，It causes the computer to heat up badly, how can I solve this problem： --- ## [ECK setup crashes on Raspberry Pi ARM64 with Ubuntu 20.04 and microk8s](https://discuss.elastic.co/t/eck-setup-crashes-on-raspberry-pi-arm64-with-ubuntu-20-04-and-microk8s/309826)
**Author:** [@casabre](https://discuss.elastic.co/u/casabre)\ **Replies:** 1\ **Last updated:** [July 27, 2022, 7:42am UTC](https://discuss.elastic.co/t/eck-setup-crashes-on-raspberry-pi-arm64-with-ubuntu-20-04-and-microk8s/309826 "2022-07-27T07:42:01Z")
Hey elastic community, I am trying to deploy an ECK setup on my Raspberry Pi (Ubuntu 20.04) microk8s cluster (3 nodes). I followed the Quickstart tutorial and deploying the operator went fine. But creating now a cluste… --- ## [Filebeat zeek module shows no data](https://discuss.elastic.co/t/filebeat-zeek-module-shows-no-data/310707)
**Author:** [@Bakhtawar](https://discuss.elastic.co/u/Bakhtawar)\ **Replies:** 0\ **Last updated:** [July 27, 2022, 5:05am UTC](https://discuss.elastic.co/t/filebeat-zeek-module-shows-no-data/310707 "2022-07-27T05:05:15Z")
Hi, I followed the steps mentioned in your blog to send zeek logs to elastic. I installed zeek version 4.0.7 and filebeat version 7.17.5. Elasticsearch and kibana version is 7.15.0. Filebeats is unable to send zeek logs … --- ## [Kibana lens display one line with multiple values](https://discuss.elastic.co/t/kibana-lens-display-one-line-with-multiple-values/310602)
**Author:** [@rkidev](https://discuss.elastic.co/u/rkidev)\ **Replies:** 2\ **Last updated:** [July 27, 2022, 3:23am UTC](https://discuss.elastic.co/t/kibana-lens-display-one-line-with-multiple-values/310602 "2022-07-27T03:23:56Z")
I am trying to create time series graph using Kibana(version 8.3) lens. In my document I have following fields - {"timestamp":"2019-06-02T10:16:44", "byte":17, "tName":"Group 1", "reg":"4"} I am able to show byte on th… --- ## [ERR"reason"Unable to Tessellate shape Possible malformed shape detected](https://discuss.elastic.co/t/err-reason-unable-to-tessellate-shape-possible-malformed-shape-detected/309989)
**Author:** [@baiwenbo1997](https://discuss.elastic.co/u/baiwenbo1997)\ **Replies:** 4\ **Last updated:** [July 27, 2022, 2:07am UTC](https://discuss.elastic.co/t/err-reason-unable-to-tessellate-shape-possible-malformed-shape-detected/309989 "2022-07-27T02:07:55Z")
I want to know why it failed, because of accuracy?Why does this polygon be judged as a self -intersecting graph, which causes storage POLYGON((38628095.0171 3322658.2041,38628095.2386 3322662.567299999,38628095.1811 332… --- ## [Whats best practices to apply elastic search on Kubernetes unmanaged cluster](https://discuss.elastic.co/t/whats-best-practices-to-apply-elastic-search-on-kubernetes-unmanaged-cluster/310636)
**Author:** [@ahmad\_ins](https://discuss.elastic.co/u/ahmad_ins)\ **Replies:** 1\ **Last updated:** [July 27, 2022, 1:42am UTC](https://discuss.elastic.co/t/whats-best-practices-to-apply-elastic-search-on-kubernetes-unmanaged-cluster/310636 "2022-07-27T01:42:50Z")
what's best practices to apply Elasticsearch on Kubernetes unmanaged cluster? --- ## [\[Aggregation Query\] Recreate kibana dashboards in asp.net core](https://discuss.elastic.co/t/aggregation-query-recreate-kibana-dashboards-in-asp-net-core/310373)
**Author:** [@charlene](https://discuss.elastic.co/u/charlene)\ **Replies:** 1\ **Last updated:** [July 27, 2022, 1:36am UTC](https://discuss.elastic.co/t/aggregation-query-recreate-kibana-dashboards-in-asp-net-core/310373 "2022-07-27T01:36:56Z")
Hi all, I am looking for ways to recreate my kibana dashboards on my own website (wanna do a little more one the visuals) , thus I have to get data from elasticsearch and query them and then visualize them. I am using t… [Previous page](https://discuss.elastic.co/latest.md?page=1028) [Next page](https://discuss.elastic.co/latest.md?page=1030)