# Latest **URL:** https://discuss.elastic.co/latest.md?page=1041 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1042 --- ## [Rules API Key](https://discuss.elastic.co/t/rules-api-key/309999)
**Author:** [@robdiluca](https://discuss.elastic.co/u/robdiluca)\ **Replies:** 9\ **Last updated:** [July 19, 2022, 7:20pm UTC](https://discuss.elastic.co/t/rules-api-key/309999 "2022-07-19T19:20:02Z")
Hi all, the Kibana Alerting doc (Alerting set up | Kibana Guide \[8.3\] | Elastic) says rules are authorized using an API Key created internally with the same privileges as the user creating/updating the rule. I wonder if… --- ## [Can I export the agent overview from Fleet](https://discuss.elastic.co/t/can-i-export-the-agent-overview-from-fleet/310059)
**Author:** [@stobbe99](https://discuss.elastic.co/u/stobbe99)\ **Replies:** 0\ **Last updated:** [July 19, 2022, 6:42pm UTC](https://discuss.elastic.co/t/can-i-export-the-agent-overview-from-fleet/310059 "2022-07-19T18:42:27Z")
Hello, Is there an easy way to export the list of agents like the one in the fleet overview? I assume this is not extracted from an index? KR Henk --- ## [ES response shows ~20 secs delay when observed from the browser network logs](https://discuss.elastic.co/t/es-response-shows-20-secs-delay-when-observed-from-the-browser-network-logs/310049)
**Author:** [@kkumar.e](https://discuss.elastic.co/u/kkumar.e)\ **Replies:** 2\ **Last updated:** [July 19, 2022, 6:10pm UTC](https://discuss.elastic.co/t/es-response-shows-20-secs-delay-when-observed-from-the-browser-network-logs/310049 "2022-07-19T18:10:00Z")
Hi All, We are observing a random ~20 sec delay on ES responses on an ES cluster with 2 nodes created on 2 AWS EC2 servers spread across 2 subnets. I followed the steps in the below ref link to generate CA and elastic-s… --- ## [Pushing log to elastic.co and splitting message](https://discuss.elastic.co/t/pushing-log-to-elastic-co-and-splitting-message/310053)
**Author:** [@milosz](https://discuss.elastic.co/u/milosz)\ **Replies:** 0\ **Last updated:** [July 19, 2022, 5:33pm UTC](https://discuss.elastic.co/t/pushing-log-to-elastic-co-and-splitting-message/310053 "2022-07-19T17:33:23Z")
Hi, I'm using elastic.co and filebeat. My config is: cloud.id: cloud.auth: filebeat.inputs: - type: log enabled: true paths: - /var/www/vhosts/doomain/logs/access\_ssl\_log tags: domain fields: log\_type:… --- ## [Traces for some transactions not being sampled despite 100% Sampling Rate](https://discuss.elastic.co/t/traces-for-some-transactions-not-being-sampled-despite-100-sampling-rate/308935)
**Author:** [@yagyanshskumar](https://discuss.elastic.co/u/yagyanshskumar)\ **Replies:** 5\ **Last updated:** [July 19, 2022, 4:34pm UTC](https://discuss.elastic.co/t/traces-for-some-transactions-not-being-sampled-despite-100-sampling-rate/308935 "2022-07-19T16:34:47Z")
Kibana version: 7.17 Elasticsearch version: 7.17 APM Server version: 7.17 APM Agent language and version: Java | 1.32.0 Original install method (e.g. download page, yum, deb, from source, etc.) and version: Everythin… --- ## [Incorrect Kibana Mappings From Winlogbeats Setup Command](https://discuss.elastic.co/t/incorrect-kibana-mappings-from-winlogbeats-setup-command/309953)
**Author:** [@Jared9922](https://discuss.elastic.co/u/Jared9922)\ **Replies:** 2\ **Last updated:** [July 19, 2022, 3:47pm UTC](https://discuss.elastic.co/t/incorrect-kibana-mappings-from-winlogbeats-setup-command/309953 "2022-07-19T15:47:24Z")
I have installed Winlogbeat on my computer and data seems to be flowing correctly. My data flows through my stack as shown Winlogbeat -\> logstash -\> elasticsearch I am trying to setup the index templates for Winlogbeat… --- ## [Problem with elasticsearch-certutil http and "ca certificate is not a CA" error](https://discuss.elastic.co/t/problem-with-elasticsearch-certutil-http-and-ca-certificate-is-not-a-ca-error/309949)
**Author:** [@rlatta](https://discuss.elastic.co/u/rlatta)\ **Replies:** 4\ **Last updated:** [July 19, 2022, 3:54pm UTC](https://discuss.elastic.co/t/problem-with-elasticsearch-certutil-http-and-ca-certificate-is-not-a-ca-error/309949 "2022-07-19T15:54:41Z")
Hello, I installed Elasticsearch and Kibana 7.17.5 (windows server 2019). I followed the directions in the "Set up basic security for the Elastic Stack" and didn't run into problems. However, when I move on to the set… --- ## [Painless script throws "illegal tree structure." when using literal with hexadecimal value](https://discuss.elastic.co/t/painless-script-throws-illegal-tree-structure-when-using-literal-with-hexadecimal-value/310007)
**Author:** [@Nimrod\_Karni](https://discuss.elastic.co/u/Nimrod_Karni)\ **Replies:** 1\ **Last updated:** [July 19, 2022, 2:42pm UTC](https://discuss.elastic.co/t/painless-script-throws-illegal-tree-structure-when-using-literal-with-hexadecimal-value/310007 "2022-07-19T14:42:00Z")
Elasticsearch 8.3 Using painless Lab (Kibana 8.3) byte i = 0xc; return i; Works fine - output 12 byte i = 0xd; return i; output - Unhandled Exception illegal\_state\_exception Illegal tree structure. should be … --- ## [Not able to recognize rsyslogs in SIEM](https://discuss.elastic.co/t/not-able-to-recognize-rsyslogs-in-siem/309750)
**Author:** [@Rao\_Nelakurti](https://discuss.elastic.co/u/Rao_Nelakurti)\ **Replies:** 5\ **Last updated:** [July 18, 2022, 2:59pm UTC](https://discuss.elastic.co/t/not-able-to-recognize-rsyslogs-in-siem/309750 "2022-07-18T14:59:08Z")
I'm trying to send rsyslogs to SIEM (rsyslog-\> filebeat-\> logstash-\> siem) filebeat.conf, filebeat.spool\_size: 2048 filebeat.idle\_timeout: 5s output.logstash: hosts: \['10.x.x.5:6045'\] - type: log paths: - /var/l… --- ## [How to update index to allow nested queries?](https://discuss.elastic.co/t/how-to-update-index-to-allow-nested-queries/310027)
**Author:** [@Migodden](https://discuss.elastic.co/u/Migodden)\ **Replies:** 0\ **Last updated:** [July 19, 2022, 1:17pm UTC](https://discuss.elastic.co/t/how-to-update-index-to-allow-nested-queries/310027 "2022-07-19T13:17:28Z")
We have an index with a property that stores an array of objects with properties of strings. I want to be able to query against these array of objects to find a document where the objects properties match certain conditi… --- ## [1 huge pipelines vs 2 medium ones](https://discuss.elastic.co/t/1-huge-pipelines-vs-2-medium-ones/309925)
**Author:** [@anon90868141](https://discuss.elastic.co/u/anon90868141)\ **Replies:** 5\ **Last updated:** [July 19, 2022, 12:28pm UTC](https://discuss.elastic.co/t/1-huge-pipelines-vs-2-medium-ones/309925 "2022-07-19T12:28:41Z")
Hello, let's say I've got a cluster with 10 machines a 12 cores and I see data not being collected fast enough, so I need to raise my threads which is already at 12. Is better to go with the same pipeline and raise the… --- ## [Sort based on specific string in Elastic AppSearch](https://discuss.elastic.co/t/sort-based-on-specific-string-in-elastic-appsearch/310020)
**Author:** [@Atul\_Diwedi](https://discuss.elastic.co/u/Atul_Diwedi)\ **Replies:** 1\ **Last updated:** [July 19, 2022, 12:38pm UTC](https://discuss.elastic.co/t/sort-based-on-specific-string-in-elastic-appsearch/310020 "2022-07-19T12:38:45Z")
Want sorted result base on string. Like I have rating {Good, average, bad}. And want sorted result according to average. How can this be achieved in AppSearch. --- ## [Creating a NOT EQUAL filter in Java Fluent API](https://discuss.elastic.co/t/creating-a-not-equal-filter-in-java-fluent-api/309859)
**Author:** [@bweston](https://discuss.elastic.co/u/bweston)\ **Replies:** 4\ **Last updated:** [July 19, 2022, 12:29pm UTC](https://discuss.elastic.co/t/creating-a-not-equal-filter-in-java-fluent-api/309859 "2022-07-19T12:29:37Z")
Hi, I'm trying to compose a NOT EQUAL filter with the new Java Fluent API, querying Elastic 8.2 and have drawn a blank. The query below returns all documents that have expired according to our company retention policy, … --- ## [Vega visualisation](https://discuss.elastic.co/t/vega-visualisation/309217)
**Author:** [@meyer1](https://discuss.elastic.co/u/meyer1)\ **Replies:** 5\ **Last updated:** [July 19, 2022, 12:22pm UTC](https://discuss.elastic.co/t/vega-visualisation/309217 "2022-07-19T12:22:01Z")
Hello everyone, I would like to make an online visualization using some fields of my document which looks like this: "otherFieldA" : "...", "otherFieldB" : "...", "otherFieldC" : "...", "mainField" : \[ { … --- ## [Java client: Jackson exception: Numeric value out of range of int](https://discuss.elastic.co/t/java-client-jackson-exception-numeric-value-out-of-range-of-int/309673)
**Author:** [@John16](https://discuss.elastic.co/u/John16)\ **Replies:** 3\ **Last updated:** [July 19, 2022, 12:14pm UTC](https://discuss.elastic.co/t/java-client-jackson-exception-numeric-value-out-of-range-of-int/309673 "2022-07-19T12:14:12Z")
Hello, I am using Java client version 7.17.4 (server is 7.17.0). Executing the following code ElasticsearchIndicesClient indicesClient = new ElasticsearchIndicesClient(transport); indicesClient.stats(b -\> b.index("nam… --- ## [Terminate after not working for elasticsearch count ? Count optimization issue](https://discuss.elastic.co/t/terminate-after-not-working-for-elasticsearch-count-count-optimization-issue/310016)
**Author:** [@mehdiz](https://discuss.elastic.co/u/mehdiz)\ **Replies:** 0\ **Last updated:** [July 19, 2022, 12:04pm UTC](https://discuss.elastic.co/t/terminate-after-not-working-for-elasticsearch-count-count-optimization-issue/310016 "2022-07-19T12:04:02Z")
I want to have the total count of documents matching a specific query using the count query api of Elasticsearch on Python. I'm using the count to have a check of maximum documents that we can fetch for one query, somet… --- ## [Kibana Server is not ready yet after deletion of indeces inside /var/lib/nodes/0/indeces](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet-after-deletion-of-indeces-inside-var-lib-nodes-0-indeces/309995)
**Author:** [@rrrrrrrrrrr](https://discuss.elastic.co/u/rrrrrrrrrrr)\ **Replies:** 3\ **Last updated:** [July 19, 2022, 11:58am UTC](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet-after-deletion-of-indeces-inside-var-lib-nodes-0-indeces/309995 "2022-07-19T11:58:45Z")
Hello, I'm unable to access my Kibana Dashboard after deleting some of the indeces directory inside /var/lib/nodes/0/indeces/. Before this I had an error regarding Low disk space that's preventing the elasticsearch to s… --- ## [Kibana doesn't start properly at upgrade from 7.17.1 to 8.3.2](https://discuss.elastic.co/t/kibana-doesnt-start-properly-at-upgrade-from-7-17-1-to-8-3-2/309586)
**Author:** [@gerib](https://discuss.elastic.co/u/gerib)\ **Replies:** 3\ **Last updated:** [July 19, 2022, 11:12am UTC](https://discuss.elastic.co/t/kibana-doesnt-start-properly-at-upgrade-from-7-17-1-to-8-3-2/309586 "2022-07-19T11:12:01Z")
Log message(s): ... ... \[ERROR\]\[savedobjects-service\] \[.kibana\] Action failed with 'security\_exception: \[security\_exception\] Reason: action \[indices:admin/create\] is unauthorized for user \[kibanaserver\] with roles \[… --- ## [\[8.3.2\] Message at Kibana's login page "Please upgrade your browser" when applying a Tampermonkey userscript](https://discuss.elastic.co/t/8-3-2-message-at-kibanas-login-page-please-upgrade-your-browser-when-applying-a-tampermonkey-userscript/309796)
**Author:** [@gerib](https://discuss.elastic.co/u/gerib)\ **Replies:** 2\ **Last updated:** [July 19, 2022, 10:51am UTC](https://discuss.elastic.co/t/8-3-2-message-at-kibanas-login-page-please-upgrade-your-browser-when-applying-a-tampermonkey-userscript/309796 "2022-07-19T10:51:49Z")
When applying the following userscript in Tampermonkey: // ==UserScript== // @name tab-size: 2 // @description Sets the tab (U+9) character's display size to 2. // @version 22.07.16-1645 // @author G… --- ## [\[metricbeat\] - Prometheus module - invalid escape sequence '\\"'](https://discuss.elastic.co/t/metricbeat-prometheus-module-invalid-escape-sequence/308421)
**Author:** [@harikvemula](https://discuss.elastic.co/u/harikvemula)\ **Replies:** 2\ **Last updated:** [July 19, 2022, 10:30am UTC](https://discuss.elastic.co/t/metricbeat-prometheus-module-invalid-escape-sequence/308421 "2022-07-19T10:30:41Z")
Hi, Metricbeat: 7.10.2 I am trying to use Metricbeat prometheus module to pull metrics from Spring boot application with micrometer prometheus format . It fails with the following error 2022-06-29T12:21:37.658 +0000 … --- ## [Logstash JDBC connection for 3000 databases](https://discuss.elastic.co/t/logstash-jdbc-connection-for-3000-databases/310004)
**Author:** [@Poojan](https://discuss.elastic.co/u/Poojan)\ **Replies:** 0\ **Last updated:** [July 19, 2022, 10:17am UTC](https://discuss.elastic.co/t/logstash-jdbc-connection-for-3000-databases/310004 "2022-07-19T10:17:54Z")
Hello guys, I want to connect to 3000 databases which are on the same host using logstash. how can I connect those dbs and push data to elasticsearch? --- ## [Kibana Alert variable declaration](https://discuss.elastic.co/t/kibana-alert-variable-declaration/309316)
**Author:** [@ilanchezhian](https://discuss.elastic.co/u/ilanchezhian)\ **Replies:** 4\ **Last updated:** [July 19, 2022, 10:28am UTC](https://discuss.elastic.co/t/kibana-alert-variable-declaration/309316 "2022-07-19T10:28:10Z")
Hi All, I'm creating a alert in kibana for IP monitoring, how can I pass the index field values as a parameter in alert body for easy identification @Simon\_Becker --- ## [Discovery.type : single-node but the new indexes are always : index.number\_of\_replicas" : "1"?](https://discuss.elastic.co/t/discovery-type-single-node-but-the-new-indexes-are-always-index-number-of-replicas-1/309318)
**Author:** [@PM75](https://discuss.elastic.co/u/PM75)\ **Replies:** 5\ **Last updated:** [July 19, 2022, 10:21am UTC](https://discuss.elastic.co/t/discovery-type-single-node-but-the-new-indexes-are-always-index-number-of-replicas-1/309318 "2022-07-19T10:21:43Z")
Hello, \[root@STL-SAS-025 ~\]# /usr/share/elasticsearch/bin/elasticsearch --version Version: 8.3.1, Build: rpm/b9a6b2867996ba92ceac66cb5bafc6db25e7910e/2022-06-29T18:39:55.731992798Z, JVM: 18.0.1.1 I'm having trouble und… --- ## [Creating Custom Field in Kibana and fetching the values from a particular line in message](https://discuss.elastic.co/t/creating-custom-field-in-kibana-and-fetching-the-values-from-a-particular-line-in-message/309889)
**Author:** [@Dhinesh\_Prabakaran](https://discuss.elastic.co/u/Dhinesh_Prabakaran)\ **Replies:** 1\ **Last updated:** [July 19, 2022, 10:19am UTC](https://discuss.elastic.co/t/creating-custom-field-in-kibana-and-fetching-the-values-from-a-particular-line-in-message/309889 "2022-07-19T10:19:34Z")
Hi All, We've been using ELK to monitor our network and infrastructure logs. We have a requirement. We need to create a custom field name in filebeat so that we can use it as a unique key to filter the log messages in … --- ## [Forbidden page in Elastic Cloud in Azure](https://discuss.elastic.co/t/forbidden-page-in-elastic-cloud-in-azure/309985)
**Author:** [@arks](https://discuss.elastic.co/u/arks)\ **Replies:** 2\ **Last updated:** [July 19, 2022, 9:50am UTC](https://discuss.elastic.co/t/forbidden-page-in-elastic-cloud-in-azure/309985 "2022-07-19T09:50:24Z")
Hello there, First of all let me start by saying that I feel silly posting a problem like this, because it feels like something particularly easy to solve, but somehow we struggle to find a way of doing it. We have a E… --- ## [Phrase\_query for multiple should and must](https://discuss.elastic.co/t/phrase-query-for-multiple-should-and-must/309998)
**Author:** [@puff2fakie](https://discuss.elastic.co/u/puff2fakie)\ **Replies:** 0\ **Last updated:** [July 19, 2022, 9:44am UTC](https://discuss.elastic.co/t/phrase-query-for-multiple-should-and-must/309998 "2022-07-19T09:44:57Z")
I've indexed my documents as follows: doc = { "\_index": index\_name, "\_source": { "field": "bm25", "passage": passage, "passage\_id": pid, "level1": level1, "level2": level2… --- ## [Upgrading elasticsearch from 5.6 to 6.7 error: The Upgrade API must be run for 6.x nodes to join the cluster](https://discuss.elastic.co/t/upgrading-elasticsearch-from-5-6-to-6-7-error-the-upgrade-api-must-be-run-for-6-x-nodes-to-join-the-cluster/309667)
**Author:** [@Gerardo\_Padierna](https://discuss.elastic.co/u/Gerardo_Padierna)\ **Replies:** 2\ **Last updated:** [July 19, 2022, 9:41am UTC](https://discuss.elastic.co/t/upgrading-elasticsearch-from-5-6-to-6-7-error-the-upgrade-api-must-be-run-for-6-x-nodes-to-join-the-cluster/309667 "2022-07-19T09:41:05Z")
Hello, I'm following the instructions to run an rolling update from a 3-node cluster (elasticsearch, logstash & kibana) as described here. I had just 1 index that was in version 2.3.3 and I have reindexed that one befo… --- ## [Facing Issue while running queries on ElasticSearch](https://discuss.elastic.co/t/facing-issue-while-running-queries-on-elasticsearch/309997)
**Author:** [@painless\_elastic](https://discuss.elastic.co/u/painless_elastic)\ **Replies:** 0\ **Last updated:** [July 19, 2022, 9:37am UTC](https://discuss.elastic.co/t/facing-issue-while-running-queries-on-elasticsearch/309997 "2022-07-19T09:37:26Z")
Hi All, When we are making 100TPS queries to elastic and parallelly documents are getting indexed, the response time is good. But when the query rate to our elastic is close to zero and documents are getting indexed pa… --- ## [ESQL for Current Month](https://discuss.elastic.co/t/esql-for-current-month/309915)
**Author:** [@karnamonkster](https://discuss.elastic.co/u/karnamonkster)\ **Replies:** 2\ **Last updated:** [July 19, 2022, 9:33am UTC](https://discuss.elastic.co/t/esql-for-current-month/309915 "2022-07-19T09:33:58Z")
Hi, I need to get data on the Canvas for current month only. Can someone help with the SQL query on Canvas similar to the KQL below. @timestamp \> "now/M" and @timestamp \<= "now" --- ## [How to make logstash filter multiple grok pattern](https://discuss.elastic.co/t/how-to-make-logstash-filter-multiple-grok-pattern/309810)
**Author:** [@lzold\_z](https://discuss.elastic.co/u/lzold_z)\ **Replies:** 2\ **Last updated:** [July 19, 2022, 9:17am UTC](https://discuss.elastic.co/t/how-to-make-logstash-filter-multiple-grok-pattern/309810 "2022-07-19T09:17:56Z")
Hello, im new to the logstash and i want to know how to make logstash filter multiple grok pattern for example from httpd error logs and access logs, im already have those pattern but logstash seem didnt catch the logs, … [Previous page](https://discuss.elastic.co/latest.md?page=1040) [Next page](https://discuss.elastic.co/latest.md?page=1042)