# Latest **URL:** https://discuss.elastic.co/latest.md?page=1109 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1110 --- ## [Kibana: rule compares difference of two aggregations](https://discuss.elastic.co/t/kibana-rule-compares-difference-of-two-aggregations/305393)
**Author:** [@Johannnnnn](https://discuss.elastic.co/u/Johannnnnn)\ **Replies:** 1\ **Last updated:** [May 31, 2022, 4:44pm UTC](https://discuss.elastic.co/t/kibana-rule-compares-difference-of-two-aggregations/305393 "2022-05-31T16:44:08Z")
I got two aggregations, both calculating the run time of a test suite differentiating on the specific release. So the results are two long numbers (nanoseconds). I want to create an alert to send me an e-mail when the d… --- ## [Watcher alert for index sizes](https://discuss.elastic.co/t/watcher-alert-for-index-sizes/305633)
**Author:** [@venkatkumar229](https://discuss.elastic.co/u/venkatkumar229)\ **Replies:** 1\ **Last updated:** [May 31, 2022, 4:42pm UTC](https://discuss.elastic.co/t/watcher-alert-for-index-sizes/305633 "2022-05-31T16:42:35Z")
Hi Team, I am trying to create an alert when any one of the index size crosses 200GB. I have created a watcher like below but i am getting an compile error not sure what was wrong. Could you please help me with this. {… --- ## [Kibana Canvas: How can I use a filter to show data per project?](https://discuss.elastic.co/t/kibana-canvas-how-can-i-use-a-filter-to-show-data-per-project/305627)
**Author:** [@Linda\_T](https://discuss.elastic.co/u/Linda_T)\ **Replies:** 1\ **Last updated:** [May 31, 2022, 3:50pm UTC](https://discuss.elastic.co/t/kibana-canvas-how-can-i-use-a-filter-to-show-data-per-project/305627 "2022-05-31T15:50:19Z")
Hi everyone, I have a question regarding the use of filters in Canvas, because within my Canvas report I want to show programme data as well as filtered data per project. Situation: I have created a Kibana Dashboard f… --- ## [Kibana alerts and actions setup](https://discuss.elastic.co/t/kibana-alerts-and-actions-setup/305758)
**Author:** [@kyle\_che](https://discuss.elastic.co/u/kyle_che)\ **Replies:** 1\ **Last updated:** [May 31, 2022, 3:31pm UTC](https://discuss.elastic.co/t/kibana-alerts-and-actions-setup/305758 "2022-05-31T15:31:41Z")
i am trying to get alerting and actions working but it seems to be disabled. Kibana points me to Alerting and Actions | Kibana Guide \[7.10\] | Elastic I have security setup already in Elasticsearch for authentication. x… --- ## [String to table](https://discuss.elastic.co/t/string-to-table/305309)
**Author:** [@fredyfredburger](https://discuss.elastic.co/u/fredyfredburger)\ **Replies:** 1\ **Last updated:** [May 31, 2022, 3:25pm UTC](https://discuss.elastic.co/t/string-to-table/305309 "2022-05-31T15:25:44Z")
I have a data feed that provides the linux df command as a value in my Elasticsearch database. The df output is contianed as a string in a single field. I need to display this in Canvas as a table, but can't figure out… --- ## [Add a time field in elasticsearch and calculate time between two event](https://discuss.elastic.co/t/add-a-time-field-in-elasticsearch-and-calculate-time-between-two-event/305971)
**Author:** [@The-morpho](https://discuss.elastic.co/u/The-morpho)\ **Replies:** 3\ **Last updated:** [May 31, 2022, 2:48pm UTC](https://discuss.elastic.co/t/add-a-time-field-in-elasticsearch-and-calculate-time-between-two-event/305971 "2022-05-31T14:48:57Z")
I'm new to Elasticsearch. I’m working with log files stored in Elasticsearch, that contains information about some operations on differents levels, I have a field timestamp that represents the time when each operation h… --- ## [Elastic alerts get queued and never run thereafter](https://discuss.elastic.co/t/elastic-alerts-get-queued-and-never-run-thereafter/306049)
**Author:** [@Tesla\_User](https://discuss.elastic.co/u/Tesla_User)\ **Replies:** 0\ **Last updated:** [May 31, 2022, 2:43pm UTC](https://discuss.elastic.co/t/elastic-alerts-get-queued-and-never-run-thereafter/306049 "2022-05-31T14:43:27Z")
Whenever I create and run an alert, the alert is getting queued but not running thereafter. Is there a way to clear the threadpool queue and make the alerts run faster. Error: { "\_id" : "log\_error\_watch1\_4730bca4-191… --- ## [Querying Nested Structure](https://discuss.elastic.co/t/querying-nested-structure/305960)
**Author:** [@obadaqaf](https://discuss.elastic.co/u/obadaqaf)\ **Replies:** 3\ **Last updated:** [May 31, 2022, 2:07pm UTC](https://discuss.elastic.co/t/querying-nested-structure/305960 "2022-05-31T14:07:40Z")
I try to query documents that have nested objects: { "name":"Adam", "cities":\[ { "name":"California", "activities":\[ { "name":"Hicking" … --- ## [Kibana - controal {No options found}](https://discuss.elastic.co/t/kibana-controal-no-options-found/305678)
**Author:** [@as\_dh](https://discuss.elastic.co/u/as_dh)\ **Replies:** 6\ **Last updated:** [May 31, 2022, 1:57pm UTC](https://discuss.elastic.co/t/kibana-controal-no-options-found/305678 "2022-05-31T13:57:21Z")
Hello when i create Controls in dashbord page i got No options found kibana and elastic virsion 8.2 please help :frowning: --- ## [Filebeat sending a json file to stdout but filebeat errors "Error decoding JSON: invalid character" for the stdout logs](https://discuss.elastic.co/t/filebeat-sending-a-json-file-to-stdout-but-filebeat-errors-error-decoding-json-invalid-character-for-the-stdout-logs/305989)
**Author:** [@Adrian\_Romero](https://discuss.elastic.co/u/Adrian_Romero)\ **Replies:** 1\ **Last updated:** [May 31, 2022, 1:54pm UTC](https://discuss.elastic.co/t/filebeat-sending-a-json-file-to-stdout-but-filebeat-errors-error-decoding-json-invalid-character-for-the-stdout-logs/305989 "2022-05-31T13:54:31Z")
Hi people! here is the deal, I using k8s, my apps write down thier logs into a json formatted file, so I decided to send this file to the stdout (with a soft link kind of how nginx does it), so now if you check the stdou… --- ## [Filebeat suricata](https://discuss.elastic.co/t/filebeat-suricata/305863)
**Author:** [@TARIK\_MAZOUZ](https://discuss.elastic.co/u/TARIK_MAZOUZ)\ **Replies:** 9\ **Last updated:** [May 31, 2022, 1:52pm UTC](https://discuss.elastic.co/t/filebeat-suricata/305863 "2022-05-31T13:52:44Z")
hey ELK STACK community, please i've installed filebeat , and i wanted to install suricata module, so i've did install it, the problem is i don't get any information in kibana from suricata ? did i've missed something or… --- ## [Individual visualization link](https://discuss.elastic.co/t/individual-visualization-link/306039)
**Author:** [@elknick](https://discuss.elastic.co/u/elknick)\ **Replies:** 2\ **Last updated:** [May 31, 2022, 1:45pm UTC](https://discuss.elastic.co/t/individual-visualization-link/306039 "2022-05-31T13:45:41Z")
Hi, I'm trying to use iFrame links to show my data elsewhere. I see that I can create a link to embed the entire dashboard. Is it possible to share a individual visualization out of the dashboard and not the whole thing… --- ## [SQL (Kibana Canvas) - How to drop all text to the left of a string pattern](https://discuss.elastic.co/t/sql-kibana-canvas-how-to-drop-all-text-to-the-left-of-a-string-pattern/305754)
**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Replies:** 2\ **Last updated:** [May 31, 2022, 1:40pm UTC](https://discuss.elastic.co/t/sql-kibana-canvas-how-to-drop-all-text-to-the-left-of-a-string-pattern/305754 "2022-05-31T13:40:59Z")
Hi All, (Note: Asking under SQL even though the use-case is in Kibana Canvas, as the question pertains to ESSQL specifically.) I'm working on a Canvas setup and have the following query: SELECT kibana.alert.rule.name … --- ## [Embed Kibana Visualizations in HTML Page](https://discuss.elastic.co/t/embed-kibana-visualizations-in-html-page/306040)
**Author:** [@cawoodm](https://discuss.elastic.co/u/cawoodm)\ **Replies:** 0\ **Last updated:** [May 31, 2022, 1:34pm UTC](https://discuss.elastic.co/t/embed-kibana-visualizations-in-html-page/306040 "2022-05-31T13:34:16Z")
Similarly to this question we want to embed a vizualisation in an external web page. However, the solution given there, "use the iframe src from the dashboard" does not work. The dashboard does not use iframes and when w… --- ## [Fuzzy collapse](https://discuss.elastic.co/t/fuzzy-collapse/306037)
**Author:** [@Quentin\_Feuillade](https://discuss.elastic.co/u/Quentin_Feuillade)\ **Replies:** 0\ **Last updated:** [May 31, 2022, 12:55pm UTC](https://discuss.elastic.co/t/fuzzy-collapse/306037 "2022-05-31T12:55:53Z")
Hello :wave: , I am working on a deduplication project in O(n) time by using precomputed clusterIDs. It is working pretty well already but I found out that by collapsing id with a levenshtein distance between IDs, it i… --- ## [Need table format of ELK watcher](https://discuss.elastic.co/t/need-table-format-of-elk-watcher/306033)
**Author:** [@Sumanth\_Varma](https://discuss.elastic.co/u/Sumanth_Varma)\ **Replies:** 0\ **Last updated:** [May 31, 2022, 12:35pm UTC](https://discuss.elastic.co/t/need-table-format-of-elk-watcher/306033 "2022-05-31T12:35:06Z")
I am trying to get action of watcher output in a table format and the values will be added from aggr buckets. I am able to get it in table but all the values are getting printed in a single column. --- ## [Logstash - syslog output](https://discuss.elastic.co/t/logstash-syslog-output/305288)
**Author:** [@humartinez](https://discuss.elastic.co/u/humartinez)\ **Replies:** 8\ **Last updated:** [May 31, 2022, 12:33pm UTC](https://discuss.elastic.co/t/logstash-syslog-output/305288 "2022-05-31T12:33:53Z")
Hi, Im with some issues configuring the output to syslog. It may be some syntax that Im unaware of, but I can't use my document field values to map some of the plugin output fields. Im trying to use one of my records f… --- ## [How to filter options from a field selected](https://discuss.elastic.co/t/how-to-filter-options-from-a-field-selected/304480)
**Author:** [@Srikanth\_V](https://discuss.elastic.co/u/Srikanth_V)\ **Replies:** 4\ **Last updated:** [May 31, 2022, 12:23pm UTC](https://discuss.elastic.co/t/how-to-filter-options-from-a-field-selected/304480 "2022-05-31T12:23:53Z")
Hello, Is there a possibility to filter values from the field that has been selected? For example, my field A has 20 options. Scenario 1 - a) I want my field A to show only the necessary values - 8 of them Scenario 2… --- ## [Easy way to remove keywords mapping](https://discuss.elastic.co/t/easy-way-to-remove-keywords-mapping/305478)
**Author:** [@Evgeny\_Barykin](https://discuss.elastic.co/u/Evgeny_Barykin)\ **Replies:** 4\ **Last updated:** [May 31, 2022, 11:42am UTC](https://discuss.elastic.co/t/easy-way-to-remove-keywords-mapping/305478 "2022-05-31T11:42:01Z")
Hello! I am looking for an easy way to remove any keywords mapping from my metricbeat index. Can you give me an example of how can I do it, please? --- ## [Minimum\_should\_match don´t return correctly](https://discuss.elastic.co/t/minimum-should-match-don-t-return-correctly/305967)
**Author:** [@eduardohmferreira](https://discuss.elastic.co/u/eduardohmferreira)\ **Replies:** 4\ **Last updated:** [May 31, 2022, 11:24am UTC](https://discuss.elastic.co/t/minimum-should-match-don-t-return-correctly/305967 "2022-05-31T11:24:39Z")
Hy everyone! I'm new to the elastic universe and I have a question about a query. I'll try to describe it here: I have a document called 'store' with several stores registered and within each store item a list of custo… --- ## [C# NEST - Elastic search \_Id mapping to DocumentId fails and results in duplicate results in ES](https://discuss.elastic.co/t/c-nest-elastic-search-id-mapping-to-documentid-fails-and-results-in-duplicate-results-in-es/306027)
**Author:** [@Sohaib\_Ameen](https://discuss.elastic.co/u/Sohaib_Ameen)\ **Replies:** 0\ **Last updated:** [May 31, 2022, 10:13am UTC](https://discuss.elastic.co/t/c-nest-elastic-search-id-mapping-to-documentid-fails-and-results-in-duplicate-results-in-es/306027 "2022-05-31T10:13:18Z")
Hello everyone, I am using C# NEST functions to create indexes in Elasticsearch and tried to map \_id field with a custom field of DocumentId but it does not work as it put some random string value in \_id instead of docu… --- ## [Elasticsearch does not start after rebooting my virtual machine](https://discuss.elastic.co/t/elasticsearch-does-not-start-after-rebooting-my-virtual-machine/305982)
**Author:** [@rockers](https://discuss.elastic.co/u/rockers)\ **Replies:** 6\ **Last updated:** [May 31, 2022, 9:59am UTC](https://discuss.elastic.co/t/elasticsearch-does-not-start-after-rebooting-my-virtual-machine/305982 "2022-05-31T09:59:48Z")
last day i shut down my virtual machine and next day i open my virtual machine and run Elasticsearch it is not running and it shows this error sudo service elasticsearch status × elasticsearch.service - Elasticsearch … --- ## [Unable to install plugin analysis-icu in elasticsearch/plugin](https://discuss.elastic.co/t/unable-to-install-plugin-analysis-icu-in-elasticsearch-plugin/305935)
**Author:** [@Sharad\_Jain](https://discuss.elastic.co/u/Sharad_Jain)\ **Replies:** 13\ **Last updated:** [May 31, 2022, 9:50am UTC](https://discuss.elastic.co/t/unable-to-install-plugin-analysis-icu-in-elasticsearch-plugin/305935 "2022-05-31T09:50:13Z")
\< '$ Elasticsearch-7.14.0/bin/Elasticsearch-plugin install' 'file:///scratch/fccs812/Elasticsearch-7.14.0/plugins/analysis-icu-7.14.0.zip' '-\> Installing file:///scratch/fccs812/Elasticsearch-7.14.0/plugins/analysis-ic… --- ## [.net agent log integration](https://discuss.elastic.co/t/net-agent-log-integration/305812)
**Author:** [@sarabu\_ps](https://discuss.elastic.co/u/sarabu_ps)\ **Replies:** 1\ **Last updated:** [May 31, 2022, 9:36am UTC](https://discuss.elastic.co/t/net-agent-log-integration/305812 "2022-05-31T09:36:20Z")
apm-agent-dotnet/log-correlation.asciidoc at main · elastic/apm-agent-dotnet · GitHub. The above link explains the steps to send logs to elastic apm, could you provide details how to send secret token for elastic cloud … --- ## [Sincedb file is being created empty](https://discuss.elastic.co/t/sincedb-file-is-being-created-empty/305912)
**Author:** [@automation\_learner](https://discuss.elastic.co/u/automation_learner)\ **Replies:** 17\ **Last updated:** [May 31, 2022, 9:29am UTC](https://discuss.elastic.co/t/sincedb-file-is-being-created-empty/305912 "2022-05-31T09:29:19Z")
when i am trying to use file input plugin to created index it is not working as sincedb file is being created empty and in logs it says discovered files count =0 also when using disable sincedb it says open file /dev/nu… --- ## [Kibana maintenance mode](https://discuss.elastic.co/t/kibana-maintenance-mode/305909)
**Author:** [@andresf](https://discuss.elastic.co/u/andresf)\ **Replies:** 4\ **Last updated:** [May 31, 2022, 9:01am UTC](https://discuss.elastic.co/t/kibana-maintenance-mode/305909 "2022-05-31T09:01:34Z")
Hi, Currently at our office, we have maintenance schedule every night for the next couple of month. How can we ignore alert that happen from 7 PM to 7 AM? In other monitoring solution we have maintenance mode to tackle… --- ## [Index don't want deleted automatically](https://discuss.elastic.co/t/index-dont-want-deleted-automatically/305554)
**Author:** [@yuswanul](https://discuss.elastic.co/u/yuswanul)\ **Replies:** 14\ **Last updated:** [May 31, 2022, 9:00am UTC](https://discuss.elastic.co/t/index-dont-want-deleted-automatically/305554 "2022-05-31T09:00:42Z")
Hi there, i wanna ask about index and retention. so here is the question in my Elasticsearch i have created index automatically and give them policy to go away after 5 days. the problem is they don't want to be deleted… --- ## [Create new indices on each Beats update](https://discuss.elastic.co/t/create-new-indices-on-each-beats-update/306016)
**Author:** [@queried1](https://discuss.elastic.co/u/queried1)\ **Replies:** 0\ **Last updated:** [May 31, 2022, 8:59am UTC](https://discuss.elastic.co/t/create-new-indices-on-each-beats-update/306016 "2022-05-31T08:59:08Z")
Hello! I have an ELK cluster, the topology is quite simple: Linux\_host -\> Logstash\_node -\> Elasticsearch\_nde Each Linux\_host has filebeat+auditbeat installed and sends data to the Logstash\_node. The Logstash\_node rec… --- ## [BYTE Code instrumentation](https://discuss.elastic.co/t/byte-code-instrumentation/305977)
**Author:** [@stobbe99](https://discuss.elastic.co/u/stobbe99)\ **Replies:** 1\ **Last updated:** [May 31, 2022, 8:26am UTC](https://discuss.elastic.co/t/byte-code-instrumentation/305977 "2022-05-31T08:26:36Z")
Hello, Most APM vendors make there tool more fancy by offering byte code instrumentation at the hands of the user, is there a way in elastic to get the same info/result? Or is there a reason why this is not a part o… --- ## [Geoip setup failure](https://discuss.elastic.co/t/geoip-setup-failure/306011)
**Author:** [@kalev](https://discuss.elastic.co/u/kalev)\ **Replies:** 0\ **Last updated:** [May 31, 2022, 7:52am UTC](https://discuss.elastic.co/t/geoip-setup-failure/306011 "2022-05-31T07:52:32Z")
Hi, I'm trying to setup logstash (ver 7.16) with offline geoip update based on Geoip filter plugin | Logstash Reference \[7.16\] | Elastic , but it fails on step 4: ./bin/elasticsearch-geoip -s /usr/share/GeoIP A CLI to… [Previous page](https://discuss.elastic.co/latest.md?page=1108) [Next page](https://discuss.elastic.co/latest.md?page=1110)