# Latest **URL:** https://discuss.elastic.co/latest.md?page=1048 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1049 --- ## [Connection refused in cluster configuration](https://discuss.elastic.co/t/connection-refused-in-cluster-configuration/309293)
**Author:** [@its-ogawa](https://discuss.elastic.co/u/its-ogawa)\ **Replies:** 1\ **Last updated:** [July 14, 2022, 9:03am UTC](https://discuss.elastic.co/t/connection-refused-in-cluster-configuration/309293 "2022-07-14T09:03:33Z")
I am using elasticsearch and have outgrown one server. Therefore, I would like to create a cluster configuration of two elasticsearch servers with the following manual. I have deployed elasticsearch on two servers, bu… --- ## [Pipeline - Create a delta field](https://discuss.elastic.co/t/pipeline-create-a-delta-field/309618)
**Author:** [@Ely\_96](https://discuss.elastic.co/u/Ely_96)\ **Replies:** 0\ **Last updated:** [July 14, 2022, 8:29am UTC](https://discuss.elastic.co/t/pipeline-create-a-delta-field/309618 "2022-07-14T08:29:50Z")
Hi Guys, I'm trying to study how to create a delta field: I mean a field that should contains a difference between 2 fields inside an existing index. So, I have 2 examples of CSVs: ID;Month;Date;Date\_string;Name;Surna… --- ## [Elastic Engineer (on-Demand) Training - Lab instructions Chapter 3.3 not displayed correctly](https://discuss.elastic.co/t/elastic-engineer-on-demand-training-lab-instructions-chapter-3-3-not-displayed-correctly/309617)
**Author:** [@bianca1](https://discuss.elastic.co/u/bianca1)\ **Replies:** 0\ **Last updated:** [July 14, 2022, 8:13am UTC](https://discuss.elastic.co/t/elastic-engineer-on-demand-training-lab-instructions-chapter-3-3-not-displayed-correctly/309617 "2022-07-14T08:13:48Z")
Hi there, I am currently doing the Elastic Engineer (on-Demand) Training. I now wanted to do the labs of Chapter 3.3 („Developing search applications“). However the page of the lab instructions for that chapter seems t… --- ## [Alternate to multi-terms aggregation in transform](https://discuss.elastic.co/t/alternate-to-multi-terms-aggregation-in-transform/309344)
**Author:** [@Robina\_Dhingra1](https://discuss.elastic.co/u/Robina_Dhingra1)\ **Replies:** 5\ **Last updated:** [July 14, 2022, 8:10am UTC](https://discuss.elastic.co/t/alternate-to-multi-terms-aggregation-in-transform/309344 "2022-07-14T08:10:46Z")
Hello Team ES, We have a use case where this transform works well for us.- PUT \_transform/tradebystatus { "source": { "index": \[ "latest-transactions" \] }, "pivot": { "group\_by": { "tradeD… --- ## [Deploy Elasticsearch in kubernetes using ECK](https://discuss.elastic.co/t/deploy-elasticsearch-in-kubernetes-using-eck/308900)
**Author:** [@Biplab](https://discuss.elastic.co/u/Biplab)\ **Replies:** 2\ **Last updated:** [July 14, 2022, 8:09am UTC](https://discuss.elastic.co/t/deploy-elasticsearch-in-kubernetes-using-eck/308900 "2022-07-14T08:09:47Z")
Hi, I want to deploy an Elasticsearch cluster using ECK with the following architecture : Kubernetes cluster details: 4 Nodes and each node have one POD. Elasticsearch cluster details: 4 Nodes. One Master, One data,… --- ## [Vector-Based search using cosineSimilarity](https://discuss.elastic.co/t/vector-based-search-using-cosinesimilarity/307672)
**Author:** [@Biplab](https://discuss.elastic.co/u/Biplab)\ **Replies:** 3\ **Last updated:** [July 14, 2022, 8:08am UTC](https://discuss.elastic.co/t/vector-based-search-using-cosinesimilarity/307672 "2022-07-14T08:08:46Z")
Hi, I am indexing text and vector in Elasticsearch, working on an use case where I am using cosineSimilarity to get the result. The query search is returning the list of documents with decreasing Confidence Scores with t… --- ## [How can I change timezone](https://discuss.elastic.co/t/how-can-i-change-timezone/309615)
**Author:** [@msjhbhh](https://discuss.elastic.co/u/msjhbhh)\ **Replies:** 0\ **Last updated:** [July 14, 2022, 8:02am UTC](https://discuss.elastic.co/t/how-can-i-change-timezone/309615 "2022-07-14T08:02:29Z")
how can I change timezone $ date -Is -d '2022-07-14 15:25:26.867' 2022-07-14T15:25:26.867+0200 --- ## [User Creation can do All users](https://discuss.elastic.co/t/user-creation-can-do-all-users/307840)
**Author:** [@Muhammed\_Ashique](https://discuss.elastic.co/u/Muhammed_Ashique)\ **Replies:** 3\ **Last updated:** [July 14, 2022, 7:56am UTC](https://discuss.elastic.co/t/user-creation-can-do-all-users/307840 "2022-07-14T07:56:12Z")
I have created a user and this user is login via SSO . But the users who login via sso all users can manage user and Role session under stack management. How can i restrict/disable User creation functionalities for a use… --- ## [Elastic did not load properly. Check the server output for more information](https://discuss.elastic.co/t/elastic-did-not-load-properly-check-the-server-output-for-more-information/309111)
**Author:** [@aacorreia](https://discuss.elastic.co/u/aacorreia)\ **Replies:** 2\ **Last updated:** [July 14, 2022, 7:53am UTC](https://discuss.elastic.co/t/elastic-did-not-load-properly-check-the-server-output-for-more-information/309111 "2022-07-14T07:53:19Z")
Hi, I'm new to the ELK stack. I was able to successfully deploy a functional ELK stack (version 8.2.3, Docker containerized) in my local virtual environment (VirtualBox - Vagrant VM). For development purposes, we have s… --- ## [How to access double nested data in Kibana/Vega](https://discuss.elastic.co/t/how-to-access-double-nested-data-in-kibana-vega/308806)
**Author:** [@InesCM](https://discuss.elastic.co/u/InesCM)\ **Replies:** 5\ **Last updated:** [July 14, 2022, 7:40am UTC](https://discuss.elastic.co/t/how-to-access-double-nested-data-in-kibana-vega/308806 "2022-07-14T07:40:07Z")
Hi! I'm trying to display an stacked bar with information in a double nested array in Vega. I know that people struggle with this and I've read other questions/responses, but I still cannot get this right. This is the … --- ## [Script painless inline Method too large: method\_too\_large\_exception compile error on update](https://discuss.elastic.co/t/script-painless-inline-method-too-large-method-too-large-exception-compile-error-on-update/309611)
**Author:** [@Gaganpreet\_Xornor](https://discuss.elastic.co/u/Gaganpreet_Xornor)\ **Replies:** 0\ **Last updated:** [July 14, 2022, 7:33am UTC](https://discuss.elastic.co/t/script-painless-inline-method-too-large-method-too-large-exception-compile-error-on-update/309611 "2022-07-14T07:33:23Z")
script painless inline Method too large: method\_too\_large\_exception compile error on update --- ## [How does pagination work with LTR plugin](https://discuss.elastic.co/t/how-does-pagination-work-with-ltr-plugin/309608)
**Author:** [@Mayank\_Tripathi](https://discuss.elastic.co/u/Mayank_Tripathi)\ **Replies:** 0\ **Last updated:** [July 14, 2022, 6:31am UTC](https://discuss.elastic.co/t/how-does-pagination-work-with-ltr-plugin/309608 "2022-07-14T06:31:07Z")
How does pagination work with LTR plugins ? as per my understanding ranking plugin executes after document fetching takes place. If we have specified the from and to parameter. will LTR model still rank all of the docume… --- ## [Can't create Visualize Library using span.db.statement field](https://discuss.elastic.co/t/cant-create-visualize-library-using-span-db-statement-field/309471)
**Author:** [@Ahmad\_Arif](https://discuss.elastic.co/u/Ahmad_Arif)\ **Replies:** 3\ **Last updated:** [July 14, 2022, 2:45am UTC](https://discuss.elastic.co/t/cant-create-visualize-library-using-span-db-statement-field/309471 "2022-07-14T02:45:59Z")
Why I can't add field span.db.statement in Visualize Library? I want to show what query with long duration process, btw I'm using APM nodejs Agent. Thanks --- ## [Can kibana compare logs from different area and find the missing one?](https://discuss.elastic.co/t/can-kibana-compare-logs-from-different-area-and-find-the-missing-one/309509)
**Author:** [@josephLiu](https://discuss.elastic.co/u/josephLiu)\ **Replies:** 3\ **Last updated:** [July 14, 2022, 2:31am UTC](https://discuss.elastic.co/t/can-kibana-compare-logs-from-different-area-and-find-the-missing-one/309509 "2022-07-14T02:31:00Z")
I want to send some logs into elastic index continuous. When my program started logs will be sent into index1 . Finally some logs may lost and other logs will sent into index2 Can kibana compare 2 indexes and find the… --- ## [Add monitor name and URL on Uptime TLS Alert](https://discuss.elastic.co/t/add-monitor-name-and-url-on-uptime-tls-alert/309440)
**Author:** [@zvazquez](https://discuss.elastic.co/u/zvazquez)\ **Replies:** 1\ **Last updated:** [July 14, 2022, 1:41am UTC](https://discuss.elastic.co/t/add-monitor-name-and-url-on-uptime-tls-alert/309440 "2022-07-14T01:41:03Z")
Hi, Is there any rule variable to add monitor name and/or URL? We are setting Uptime TLS Alert and we would like to add more context information into the action. We were able to add information about the Common Name by… --- ## [How to run curl with Basic Security ( TLS / HTTPS )](https://discuss.elastic.co/t/how-to-run-curl-with-basic-security-tls-https/309479)
**Author:** [@Atul\_Chadha](https://discuss.elastic.co/u/Atul_Chadha)\ **Replies:** 2\ **Last updated:** [July 14, 2022, 1:38am UTC](https://discuss.elastic.co/t/how-to-run-curl-with-basic-security-tls-https/309479 "2022-07-14T01:38:17Z")
I have configured elasticsearch 7.17 to use TLS and HTTPS and trying to run curl commands to get index stats. The response i get is curl: (52) Empty reply from server. I am debugging an issue wherein post TLS implementa… --- ## [JAVA API Runtime mappings bug?](https://discuss.elastic.co/t/java-api-runtime-mappings-bug/309588)
**Author:** [@nicole.oresme](https://discuss.elastic.co/u/nicole.oresme)\ **Replies:** 0\ **Last updated:** [July 14, 2022, 12:29am UTC](https://discuss.elastic.co/t/java-api-runtime-mappings-bug/309588 "2022-07-14T00:29:48Z")
I'm trying to set runtime mappings using the java api. My setup is something like: new SearchRequest.Builder() .runtimeMappings("abc", java.util.Arrays.asList( new RuntimeField.Builder() … --- ## [Unenrolling multiple agents requires Gold License?!](https://discuss.elastic.co/t/unenrolling-multiple-agents-requires-gold-license/309518)
**Author:** [@nemhods](https://discuss.elastic.co/u/nemhods)\ **Replies:** 1\ **Last updated:** [July 13, 2022, 11:04pm UTC](https://discuss.elastic.co/t/unenrolling-multiple-agents-requires-gold-license/309518 "2022-07-13T23:04:49Z")
Hey, when selecting multiple agents to bulk-unenroll them, I get a popup that this requires a gold license. I want to question this decision - bulk-actions on fleet agents are not a "value-add" feature but a necessity … --- ## [Indicator Match Rule Failing from Rule Name](https://discuss.elastic.co/t/indicator-match-rule-failing-from-rule-name/309232)
**Author:** [@codewriterguy](https://discuss.elastic.co/u/codewriterguy)\ **Replies:** 6\ **Last updated:** [July 13, 2022, 10:43pm UTC](https://discuss.elastic.co/t/indicator-match-rule-failing-from-rule-name/309232 "2022-07-13T22:43:54Z")
Hi, I created an indicator match rule using intel from the Recorded Future integration package v1.0.1. The match rule appears to be failing from the rule name itself. Here is the error output: Rule failure at Jul 8, 2… --- ## [OpenSSL failed to parse encrypted private key](https://discuss.elastic.co/t/openssl-failed-to-parse-encrypted-private-key/309584)
**Author:** [@jocha](https://discuss.elastic.co/u/jocha)\ **Replies:** 0\ **Last updated:** [July 13, 2022, 10:35pm UTC](https://discuss.elastic.co/t/openssl-failed-to-parse-encrypted-private-key/309584 "2022-07-13T22:35:13Z")
Hello, Is this issue from before still a problem with filebeats? Filebeat private key parse error - #6 by adrisr Also running on openssl version 1.x, when using encrypted pem key with key\_passphrase getting: Exiting: … --- ## [Using tcp plugin to parse logs from multiple sources](https://discuss.elastic.co/t/using-tcp-plugin-to-parse-logs-from-multiple-sources/309565)
**Author:** [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\ **Replies:** 3\ **Last updated:** [July 13, 2022, 9:16pm UTC](https://discuss.elastic.co/t/using-tcp-plugin-to-parse-logs-from-multiple-sources/309565 "2022-07-13T21:16:21Z")
We are using ELK 7.6.2 stack. I am trying to configure Logstash to parse inputs based on tcp plugin. My config looks like this: input { tcp { port =\> 6789 codec =\> json\_lines tags =\>… --- ## [NMON to JSON Converted Files Will Not Import](https://discuss.elastic.co/t/nmon-to-json-converted-files-will-not-import/309566)
**Author:** [@yoscar](https://discuss.elastic.co/u/yoscar)\ **Replies:** 1\ **Last updated:** [July 13, 2022, 8:14pm UTC](https://discuss.elastic.co/t/nmon-to-json-converted-files-will-not-import/309566 "2022-07-13T20:14:45Z")
We're trying to ingest nmon data that's recorded over a 24 hour timespan into Logstash. We first convert it to json usin nmon2json (I understand that njmon is an option, but we are trying to use existing nmon files for n… --- ## [Need to extract doc\_count value from ctx.payload.aggregations.by\_store.buckets\_doc\_count](https://discuss.elastic.co/t/need-to-extract-doc-count-value-from-ctx-payload-aggregations-by-store-buckets-doc-count/309577)
**Author:** [@dkumar89](https://discuss.elastic.co/u/dkumar89)\ **Replies:** 2\ **Last updated:** [July 13, 2022, 7:59pm UTC](https://discuss.elastic.co/t/need-to-extract-doc-count-value-from-ctx-payload-aggregations-by-store-buckets-doc-count/309577 "2022-07-13T19:59:38Z")
Need to extract doc\_count value from each key and do a watcher condition ctx.payload.aggregations.by\_store.buckets\_doc\_count \> 2. --- ## [Automatically create engine if not exist when ingest data to Elastic App Search with logstash](https://discuss.elastic.co/t/automatically-create-engine-if-not-exist-when-ingest-data-to-elastic-app-search-with-logstash/309575)
**Author:** [@Rustin\_Spencer](https://discuss.elastic.co/u/Rustin_Spencer)\ **Replies:** 1\ **Last updated:** [July 13, 2022, 7:50pm UTC](https://discuss.elastic.co/t/automatically-create-engine-if-not-exist-when-ingest-data-to-elastic-app-search-with-logstash/309575 "2022-07-13T19:50:24Z")
When I use logstash to ingest data, it said that engine not found. Is there anyway to automatically create engine if the engine does not exists. --- ## [How to imported file GEOJSON to kibana](https://discuss.elastic.co/t/how-to-imported-file-geojson-to-kibana/309456)
**Author:** [@Khadija\_BOUDINAR1](https://discuss.elastic.co/u/Khadija_BOUDINAR1)\ **Replies:** 10\ **Last updated:** [July 13, 2022, 7:11pm UTC](https://discuss.elastic.co/t/how-to-imported-file-geojson-to-kibana/309456 "2022-07-13T19:11:49Z")
hi all, i have created new layers in kibana maps and i upload my file geojson but I can't visualize the file have you any suggestion please --- ## [Elasticsearch symlink does not start the service if installed from archive](https://discuss.elastic.co/t/elasticsearch-symlink-does-not-start-the-service-if-installed-from-archive/309574)
**Author:** [@marius03](https://discuss.elastic.co/u/marius03)\ **Replies:** 1\ **Last updated:** [July 13, 2022, 7:10pm UTC](https://discuss.elastic.co/t/elasticsearch-symlink-does-not-start-the-service-if-installed-from-archive/309574 "2022-07-13T19:10:56Z")
I installed Elasticsearch & Kibana in Linux Mint 20.3 localhost with archive option because installation from Debian Package does not work as expected: Install Elasticsearch from archive on Linux or MacOS | Elasticsearch… --- ## [Grok for data](https://discuss.elastic.co/t/grok-for-data/309093)
**Author:** [@INS](https://discuss.elastic.co/u/INS)\ **Replies:** 17\ **Last updated:** [July 13, 2022, 11:57am UTC](https://discuss.elastic.co/t/grok-for-data/309093 "2022-07-13T11:57:35Z")
Can anyone try to build grok for below data it's important that timestamp should be took from the first line of document 20220704061503 and interesting columns number: 0000080 data1:abort 0 type: onlist yes input of … --- ## [Logstash Nested Fields - Cloudtrail logs - No root field](https://discuss.elastic.co/t/logstash-nested-fields-cloudtrail-logs-no-root-field/309568)
**Author:** [@Pedro\_Cabral](https://discuss.elastic.co/u/Pedro_Cabral)\ **Replies:** 0\ **Last updated:** [July 13, 2022, 6:01pm UTC](https://discuss.elastic.co/t/logstash-nested-fields-cloudtrail-logs-no-root-field/309568 "2022-07-13T18:01:00Z")
Hello all, First of all I'm running version 7.10.2 on a docker. I have some cloudtrail logs stored as .gz that I'm reading and after parsing I'm renaming the Records fields and build the different nested fields. When I… --- ## [Authentication of \[kibana\_system\] was terminated by realm \[reserved\] - failed to authenticate user \[kibana\_system\]](https://discuss.elastic.co/t/authentication-of-kibana-system-was-terminated-by-realm-reserved-failed-to-authenticate-user-kibana-system/309395)
**Author:** [@grillo](https://discuss.elastic.co/u/grillo)\ **Replies:** 5\ **Last updated:** [July 13, 2022, 5:33pm UTC](https://discuss.elastic.co/t/authentication-of-kibana-system-was-terminated-by-realm-reserved-failed-to-authenticate-user-kibana-system/309395 "2022-07-13T17:33:42Z")
Hello everyone, I have my two node cluster (8.3.2.1) - working. I generated the certificates of each element (elastic-vm-1, elastic-vm2, kibana, logstash) including DNS and IP for each certificate. Kibana - that when I… --- ## [Got permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock](https://discuss.elastic.co/t/got-permission-denied-while-trying-to-connect-to-the-docker-daemon-socket-at-unix-var-run-docker-sock/307692)
**Author:** [@alexus](https://discuss.elastic.co/u/alexus)\ **Replies:** 1\ **Last updated:** [July 13, 2022, 5:31pm UTC](https://discuss.elastic.co/t/got-permission-denied-while-trying-to-connect-to-the-docker-daemon-socket-at-unix-var-run-docker-sock/307692 "2022-07-13T17:31:03Z")
Hello World! I'm trying to Run Filebeat on Docker | Filebeat Reference \[7.17\] | Elastic yet running into following issue: % docker-compose logs --tail 2 filebeat filebeat | 2022-06-20T19:05:12.965Z ERROR instance… [Previous page](https://discuss.elastic.co/latest.md?page=1047) [Next page](https://discuss.elastic.co/latest.md?page=1049)