# Latest **URL:** https://discuss.elastic.co/latest.md?page=1106 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1107 --- ## [Custom beat to monitor a file in a server folder is possible?](https://discuss.elastic.co/t/custom-beat-to-monitor-a-file-in-a-server-folder-is-possible/306142)
**Author:** [@dannie-ml](https://discuss.elastic.co/u/dannie-ml)\ **Replies:** 2\ **Last updated:** [June 2, 2022, 12:50am UTC](https://discuss.elastic.co/t/custom-beat-to-monitor-a-file-in-a-server-folder-is-possible/306142 "2022-06-02T00:50:17Z")
I have a doubt in making a custom beat that reads or monitors the state of a file, example: In a server, a file is within the Inbound folder if stays the file for more than 5 minutes in this folder and doesnt move to th… --- ## [Kibana alert | Custom interval](https://discuss.elastic.co/t/kibana-alert-custom-interval/306109)
**Author:** [@Thuunder7](https://discuss.elastic.co/u/Thuunder7)\ **Replies:** 0\ **Last updated:** [June 1, 2022, 10:28am UTC](https://discuss.elastic.co/t/kibana-alert-custom-interval/306109 "2022-06-01T10:28:28Z")
Hello guys, I have an alert created on Kibana that checks when a host is running or not. But i want to disallow that alert when the time is between 22:00PM and 9:30AM. During that time interval i will be shutting down m… --- ## [Watcherで各bucketのdoc\_countを集計したい](https://discuss.elastic.co/t/watcher-bucket-doc-count/305789)
**Author:** [@NikaidoKota](https://discuss.elastic.co/u/NikaidoKota)\ **Replies:** 14\ **Last updated:** [June 2, 2022, 12:03am UTC](https://discuss.elastic.co/t/watcher-bucket-doc-count/305789 "2022-06-02T00:03:53Z")
お世話になります。 異なるkeyの各bucketの件数を集計して、その件数に応じてアラートを発報したいのですが実装方法で悩んでおり、お知恵をお借りしたいです。 wacherで以下のようなaggsを作成して、stsCodeの値ごとにbucketを作成しています。 "aggs": { "sts\_success\_count": { "terms": { "field": "info.stsCode", … --- ## [Fleet Managed Pipelines and Indexes](https://discuss.elastic.co/t/fleet-managed-pipelines-and-indexes/306058)
**Author:** [@kinderrs](https://discuss.elastic.co/u/kinderrs)\ **Replies:** 0\ **Last updated:** [May 31, 2022, 5:44pm UTC](https://discuss.elastic.co/t/fleet-managed-pipelines-and-indexes/306058 "2022-05-31T17:44:54Z")
I have the integration for Nginx installed on my cloud deployment, monitoring and ingesting logs from a container deployment of the Nginx proxy. The integration for Nginx appears to be looking for an access log format t… --- ## [Transferred bytes Y-axis labels need to be more rounded up](https://discuss.elastic.co/t/transferred-bytes-y-axis-labels-need-to-be-more-rounded-up/306169)
**Author:** [@tee101](https://discuss.elastic.co/u/tee101)\ **Replies:** 1\ **Last updated:** [June 1, 2022, 11:28pm UTC](https://discuss.elastic.co/t/transferred-bytes-y-axis-labels-need-to-be-more-rounded-up/306169 "2022-06-01T23:28:44Z")
Here is a picture from Create your first dashboard | Kibana Guide \[8.2\] | Elastic The transferred bytes labels are 1.53MB, 1.34MB, 1.14MB, etc. The ask is to make them into more rounded numbers. Like, 100, 200, 300, 4… --- ## [Can't get text on a START\_OBJECT](https://discuss.elastic.co/t/cant-get-text-on-a-start-object/244340)
**Author:** [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Replies:** 1\ **Last updated:** [June 1, 2022, 11:18pm UTC](https://discuss.elastic.co/t/cant-get-text-on-a-start-object/244340 "2022-06-01T23:18:06Z")
This error will be logged when Elasticsearch tries to index data that is an object, into a field that is not mapped as one. Or in reverse, if you try to index something that isn't an object into a field that is mapped as… --- ## [Sort multi-index query by index name alphabetically](https://discuss.elastic.co/t/sort-multi-index-query-by-index-name-alphabetically/306171)
**Author:** [@corndog](https://discuss.elastic.co/u/corndog)\ **Replies:** 0\ **Last updated:** [June 1, 2022, 10:55pm UTC](https://discuss.elastic.co/t/sort-multi-index-query-by-index-name-alphabetically/306171 "2022-06-01T22:55:35Z")
In other words, how can I "boost" indices based on their alphabetical order? --- ## [Merging multiple queries](https://discuss.elastic.co/t/merging-multiple-queries/306099)
**Author:** [@Krishna\_Sai\_Nag\_G](https://discuss.elastic.co/u/Krishna_Sai_Nag_G)\ **Replies:** 1\ **Last updated:** [June 1, 2022, 9:49pm UTC](https://discuss.elastic.co/t/merging-multiple-queries/306099 "2022-06-01T21:49:49Z")
I have 3 queries as following First query gives us the file name of the content we search. First query GET all\_files/\_search?scroll=1m { "\_source": "file.filename", "query": { "match\_phrase": { "content": { "que… --- ## [FSCrawler - OCR not working anymore in 2.9 without Tesseract location in PATH](https://discuss.elastic.co/t/fscrawler-ocr-not-working-anymore-in-2-9-without-tesseract-location-in-path/306128)
**Author:** [@HaroldH](https://discuss.elastic.co/u/HaroldH)\ **Replies:** 1\ **Last updated:** [June 1, 2022, 9:46pm UTC](https://discuss.elastic.co/t/fscrawler-ocr-not-working-anymore-in-2-9-without-tesseract-location-in-path/306128 "2022-06-01T21:46:54Z")
Hello, Upgrading FSCrawler from 2.7 to 2.9 I noticed that with our configuration OCR wasn't working anymore. In our \_settings.yaml file we set the path to Tesseract we like below: ocr: language: "eng+nld" pat… --- ## [Type usage in libbeat/outputs/elasticsearch/client causes issue on OpenSearch 2.0+ engine](https://discuss.elastic.co/t/type-usage-in-libbeat-outputs-elasticsearch-client-causes-issue-on-opensearch-2-0-engine/306166)
**Author:** [@Suraj\_Singh](https://discuss.elastic.co/u/Suraj_Singh)\ **Replies:** 2\ **Last updated:** [June 1, 2022, 9:40pm UTC](https://discuss.elastic.co/t/type-usage-in-libbeat-outputs-elasticsearch-client-causes-issue-on-opensearch-2-0-engine/306166 "2022-06-01T21:40:44Z")
With \_type removal in OpenSearch 2.0+ (previously deprecated in Elasticsearch 7.x); beat still uses \_type as DocType while building BulkRequest meta data; resulting in illegal\_argument\_exception from OpenSearch engine. E… --- ## [Cannot import elastic RPM GPG key on EL9](https://discuss.elastic.co/t/cannot-import-elastic-rpm-gpg-key-on-el9/306164)
**Author:** [@opoplawski](https://discuss.elastic.co/u/opoplawski)\ **Replies:** 0\ **Last updated:** [June 1, 2022, 9:32pm UTC](https://discuss.elastic.co/t/cannot-import-elastic-rpm-gpg-key-on-el9/306164 "2022-06-01T21:32:14Z")
On AlmaLinux 9.0: # rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-elasticsearch error: /etc/pki/rpm-gpg/RPM-GPG-KEY-elasticsearch: key 1 import failed. I believe this is due to newer restrictions on RPM GPG keys in EL9. --- ## [Pipeline to ingest JSON files with old objects from old cluster](https://discuss.elastic.co/t/pipeline-to-ingest-json-files-with-old-objects-from-old-cluster/306163)
**Author:** [@Mary2022](https://discuss.elastic.co/u/Mary2022)\ **Replies:** 0\ **Last updated:** [June 1, 2022, 9:28pm UTC](https://discuss.elastic.co/t/pipeline-to-ingest-json-files-with-old-objects-from-old-cluster/306163 "2022-06-01T21:28:58Z")
Hi, I still very new to ELK and need help. We had an old cluster with 2 logstashs, 3 elasticsearchs, and 2 kibana. They are running version 6.23. We built a new cluster and install version 7.15. We want to configure a … --- ## [Index out of bound exception on aggregation](https://discuss.elastic.co/t/index-out-of-bound-exception-on-aggregation/303763)
**Author:** [@Bob\_Strickland](https://discuss.elastic.co/u/Bob_Strickland)\ **Replies:** 1\ **Last updated:** [June 1, 2022, 9:23pm UTC](https://discuss.elastic.co/t/index-out-of-bound-exception-on-aggregation/303763 "2022-06-01T21:23:32Z")
Working on a small index that has 1556 documents. We are getting an exception when running the following: GET search\_stage\_jacked\_backup\_3/\_search?&error\_trace=true { "aggs": { "parentDealerName": { "terms"… --- ## [Graph elastic](https://discuss.elastic.co/t/graph-elastic/305968)
**Author:** [@Oscar\_V](https://discuss.elastic.co/u/Oscar_V)\ **Replies:** 2\ **Last updated:** [June 1, 2022, 8:21pm UTC](https://discuss.elastic.co/t/graph-elastic/305968 "2022-06-01T20:21:44Z")
Hi ! I am filtering some events by a specific id with Graph Elastic but the result doesn't filter it because I can see other differents ids in the graph. I don't understand which is the reason. Regards. Óscar --- ## [Need grok pattern for logstash](https://discuss.elastic.co/t/need-grok-pattern-for-logstash/305835)
**Author:** [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\ **Replies:** 6\ **Last updated:** [June 1, 2022, 6:09pm UTC](https://discuss.elastic.co/t/need-grok-pattern-for-logstash/305835 "2022-06-01T18:09:18Z")
Hi All, I need to use grok filter to parse the following log pattern: \[2022-05-24T02:15:20.979+0000\]\[info\]\[gc \] GC(187) Pause Full (G1 Evacuation Pause) 2559M-\>1698M(2560M) 724.899ms The idea is to capture… --- ## [Enterprise search unable to start](https://discuss.elastic.co/t/enterprise-search-unable-to-start/306151)
**Author:** [@francis826](https://discuss.elastic.co/u/francis826)\ **Replies:** 1\ **Last updated:** [June 1, 2022, 5:37pm UTC](https://discuss.elastic.co/t/enterprise-search-unable-to-start/306151 "2022-06-01T17:37:32Z")
Hello, I'm trying to follow the documentation to start up an enterprise search app found here: Download Elastic Enterprise Search | Elastic Note: I am using debian 10 and installed deb packages through the elastic repo … --- ## [Create Live Kibana Dashboard using UiPath logs](https://discuss.elastic.co/t/create-live-kibana-dashboard-using-uipath-logs/305931)
**Author:** [@risr](https://discuss.elastic.co/u/risr)\ **Replies:** 1\ **Last updated:** [June 1, 2022, 5:26pm UTC](https://discuss.elastic.co/t/create-live-kibana-dashboard-using-uipath-logs/305931 "2022-06-01T17:26:54Z")
Hello everyone, Need to create Live Dashboard in Kibana using the UiPath generated Logs. We are sending log fields for the email received statuses and corresponding data and need to create the live dashboard to track t… --- ## [Kibana -Canvas : Unable to access URL param value](https://discuss.elastic.co/t/kibana-canvas-unable-to-access-url-param-value/305665)
**Author:** [@shivani\_chavan](https://discuss.elastic.co/u/shivani_chavan)\ **Replies:** 2\ **Last updated:** [June 1, 2022, 5:23pm UTC](https://discuss.elastic.co/t/kibana-canvas-unable-to-access-url-param-value/305665 "2022-06-01T17:23:00Z")
Hi Team , I am trying to filter out values from my Drop down filter. I want to use URL Param for the same. I have specified url param and trying to get its value in my SQL query. But I am getting result as No documents… --- ## [Jitter Plot on Kibana](https://discuss.elastic.co/t/jitter-plot-on-kibana/306121)
**Author:** [@squa](https://discuss.elastic.co/u/squa)\ **Replies:** 4\ **Last updated:** [June 1, 2022, 5:17pm UTC](https://discuss.elastic.co/t/jitter-plot-on-kibana/306121 "2022-06-01T17:17:57Z")
Hi there, I'm evaluating Kibana for a project. Is it possible to have the following chart style in Kibana? Thank you everyone for helping out. https://datavizproject.com/data-type/jitter-plot/jitter1/ Thank you --- ## [Logstash output file plugin adds automatically hostname](https://discuss.elastic.co/t/logstash-output-file-plugin-adds-automatically-hostname/306113)
**Author:** [@tusharnemade](https://discuss.elastic.co/u/tusharnemade)\ **Replies:** 2\ **Last updated:** [June 1, 2022, 4:51pm UTC](https://discuss.elastic.co/t/logstash-output-file-plugin-adds-automatically-hostname/306113 "2022-06-01T16:51:31Z")
Hello I am using Logstash version 7.8.0. I am having my configuration as input is logstash-plain.log file which is its logfile. It does not contain hostname , on its line, while logstash when processing data to output… --- ## [Has\_parent query performance](https://discuss.elastic.co/t/has-parent-query-performance/306107)
**Author:** [@maariolopezz](https://discuss.elastic.co/u/maariolopezz)\ **Replies:** 0\ **Last updated:** [June 1, 2022, 10:00am UTC](https://discuss.elastic.co/t/has-parent-query-performance/306107 "2022-06-01T10:00:01Z")
Hello everyone, I have a case where I have two types of documents (Doc1 & Doc2). There are about 100 Doc1 (parent) and 2000000 Doc2 (child) and in the case of Doc1 they have duplicated data from other Doc1s and this dat… --- ## [Endpoint Security Not Working](https://discuss.elastic.co/t/endpoint-security-not-working/304755)
**Author:** [@Reda-BELHAJ](https://discuss.elastic.co/u/Reda-BELHAJ)\ **Replies:** 3\ **Last updated:** [June 1, 2022, 4:31pm UTC](https://discuss.elastic.co/t/endpoint-security-not-working/304755 "2022-06-01T16:31:06Z")
Hey everyone, I am using an agent that have a personalised policy with: Endpoint Security Windows System And my issue is when I test a malicious behavior (with MITRE ATT&CK Techniques) I can't see the alerts and in m… --- ## [Compare two large indexes with transform preview](https://discuss.elastic.co/t/compare-two-large-indexes-with-transform-preview/306149)
**Author:** [@szaby20](https://discuss.elastic.co/u/szaby20)\ **Replies:** 0\ **Last updated:** [June 1, 2022, 4:30pm UTC](https://discuss.elastic.co/t/compare-two-large-indexes-with-transform-preview/306149 "2022-06-01T16:30:52Z")
Hi, I'm pretty new to Elastic so please bear with me. I'm trying to compare two large indexes (1.7 million and 400k) for regression testing purposes, which should contain exactly the same data once the larger index is fi… --- ## [Logstash container shut down + error creating action from filter](https://discuss.elastic.co/t/logstash-container-shut-down-error-creating-action-from-filter/306140)
**Author:** [@The-morpho](https://discuss.elastic.co/u/The-morpho)\ **Replies:** 1\ **Last updated:** [June 1, 2022, 4:23pm UTC](https://discuss.elastic.co/t/logstash-container-shut-down-error-creating-action-from-filter/306140 "2022-06-01T16:23:18Z")
Hello I'm new to Elasticsearch I'm working with log files comming from filebeat and logstash and I'm trying to add a field "response\_time", and then affect the difference between timestamps to It. So I create a logstash… --- ## [Mark a as closed an Alert take long time](https://discuss.elastic.co/t/mark-a-as-closed-an-alert-take-long-time/303777)
**Author:** [@rainierwolf](https://discuss.elastic.co/u/rainierwolf)\ **Replies:** 6\ **Last updated:** [June 1, 2022, 4:12pm UTC](https://discuss.elastic.co/t/mark-a-as-closed-an-alert-take-long-time/303777 "2022-06-01T16:12:50Z")
Hi team, I'm having a strange problem changing alert states in the security module. When I mark an alert as closed, it takes several minutes waiting until the system displays an error ("Failed to retrieve"). If I change… --- ## [The indices which match this index pattern don't contain any time fields](https://discuss.elastic.co/t/the-indices-which-match-this-index-pattern-dont-contain-any-time-fields/306146)
**Author:** [@danconcru](https://discuss.elastic.co/u/danconcru)\ **Replies:** 0\ **Last updated:** [June 1, 2022, 4:12pm UTC](https://discuss.elastic.co/t/the-indices-which-match-this-index-pattern-dont-contain-any-time-fields/306146 "2022-06-01T16:12:23Z")
Hi everywhere, I know that this error is posted in another post, but I am tried everything without success. I have a fluentbit that create document reading differents logs from kubernet and send it's to elastcisearch. … --- ## [Can not get run Elasticsearch 6 on my MAC](https://discuss.elastic.co/t/can-not-get-run-elasticsearch-6-on-my-mac/301707)
**Author:** [@Sajjad\_Murtaza](https://discuss.elastic.co/u/Sajjad_Murtaza)\ **Replies:** 16\ **Last updated:** [June 1, 2022, 3:50pm UTC](https://discuss.elastic.co/t/can-not-get-run-elasticsearch-6-on-my-mac/301707 "2022-06-01T15:50:55Z")
Hi all, I can not get run Elasticsearch 6 on my MAC ➜ ~ brew services list Name Status User File dbus none … --- ## [ElasticSearch pagination - from/size vs Search After for number of hits less than 10k](https://discuss.elastic.co/t/elasticsearch-pagination-from-size-vs-search-after-for-number-of-hits-less-than-10k/305855)
**Author:** [@ano](https://discuss.elastic.co/u/ano)\ **Replies:** 4\ **Last updated:** [June 1, 2022, 3:16pm UTC](https://discuss.elastic.co/t/elasticsearch-pagination-from-size-vs-search-after-for-number-of-hits-less-than-10k/305855 "2022-06-01T15:16:52Z")
Hi, I'm using Elasticsearch, and for paginating the search results, should I use the simple from/size, or should I go with search after. I've read that if the number of hits is less than 10k, then from/size is acceptabl… --- ## [Open Source Java Client XPack Security SSL Example](https://discuss.elastic.co/t/open-source-java-client-xpack-security-ssl-example/306075)
**Author:** [@nek4life](https://discuss.elastic.co/u/nek4life)\ **Replies:** 3\ **Last updated:** [June 1, 2022, 1:24pm UTC](https://discuss.elastic.co/t/open-source-java-client-xpack-security-ssl-example/306075 "2022-06-01T13:24:08Z")
I'm trying to use the new Java Client and running into issues when trying to connect to Elasticsearch running in a docker container now that xpack security is turned on by default. I'm getting the following error here. … --- ## [Use metricbeat to monitor elasticsearch/kibana/beats](https://discuss.elastic.co/t/use-metricbeat-to-monitor-elasticsearch-kibana-beats/304828)
**Author:** [@Kay\_Khan](https://discuss.elastic.co/u/Kay_Khan)\ **Replies:** 13\ **Last updated:** [June 1, 2022, 2:20pm UTC](https://discuss.elastic.co/t/use-metricbeat-to-monitor-elasticsearch-kibana-beats/304828 "2022-06-01T14:20:47Z")
Hi i am trying to get metricbeats to monitor the status of my Elasticsearch cluster. If i go to Stack Monitoring page it tells me taht metricbeat has not been setup. I'm confused what im doing wrong here, i don't see… [Previous page](https://discuss.elastic.co/latest.md?page=1105) [Next page](https://discuss.elastic.co/latest.md?page=1107)