# Latest **URL:** https://discuss.elastic.co/latest.md?page=1142 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1143 --- ## [Push json array to elasticsearch](https://discuss.elastic.co/t/push-json-array-to-elasticsearch/304099)
**Author:** [@SnehaB](https://discuss.elastic.co/u/SnehaB)\ **Replies:** 1\ **Last updated:** [May 6, 2022, 1:59pm UTC](https://discuss.elastic.co/t/push-json-array-to-elasticsearch/304099 "2022-05-06T13:59:51Z")
Hi Team, I am trying to pushing the json array of data to Elasticsearch but its showing as error How to push below json array to Elasticsearch:- \[ { "operation": "create", "senderid": "jmbaxi001", "values": \[ { … --- ## [Log Flow/Stream](https://discuss.elastic.co/t/log-flow-stream/303605)
**Author:** [@Bo-Wyatt](https://discuss.elastic.co/u/Bo-Wyatt)\ **Replies:** 4\ **Last updated:** [May 6, 2022, 1:35pm UTC](https://discuss.elastic.co/t/log-flow-stream/303605 "2022-05-06T13:35:58Z")
Hello, I want to display a visualization of my log stream on my Dashboard. I only have a data view/index pattern matching my Index. I'm currently using a table but I can only show up to 1000 records (and it's represented… --- ## [Password cannot be changed because it contains quotes](https://discuss.elastic.co/t/password-cannot-be-changed-because-it-contains-quotes/304111)
**Author:** [@frankmehlhop](https://discuss.elastic.co/u/frankmehlhop)\ **Replies:** 4\ **Last updated:** [May 6, 2022, 12:59pm UTC](https://discuss.elastic.co/t/password-cannot-be-changed-because-it-contains-quotes/304111 "2022-05-06T12:59:26Z")
When I generate elastic I got a password which includes quotes. ( like 'xxxxx"xxxx' ) This is hard to use in code (C#) so I like to change the password. But there I get exception because the quotes too. How can I chan… --- ## [Logstash hangs before indexing the last log event](https://discuss.elastic.co/t/logstash-hangs-before-indexing-the-last-log-event/303725)
**Author:** [@aviral\_srivastava](https://discuss.elastic.co/u/aviral_srivastava)\ **Replies:** 6\ **Last updated:** [May 6, 2022, 12:24pm UTC](https://discuss.elastic.co/t/logstash-hangs-before-indexing-the-last-log-event/303725 "2022-05-06T12:24:51Z")
Hi, My setup: Elasticsearch 8.1.0, kibana 8.1.0, logstash 8.1.0 My logstash config: input{ file{ path =\> "C:/Users/avisriva/Documents/Logs/TDW\_9 Logs/logs\_14082020.txt" codec =\> multiline{ pattern =\> "Log Ent… --- ## [Winlogbeat dashboard missing fields](https://discuss.elastic.co/t/winlogbeat-dashboard-missing-fields/304123)
**Author:** [@CemG](https://discuss.elastic.co/u/CemG)\ **Replies:** 1\ **Last updated:** [May 6, 2022, 12:18pm UTC](https://discuss.elastic.co/t/winlogbeat-dashboard-missing-fields/304123 "2022-05-06T12:18:48Z")
Hello, I have an issue with winlogbeat output. When I am trying to see information with Winlogbeat dashboards in Kibana, it says that there is missing fields in my data when I output to kafka because my architecture is… --- ## [AWS Cloudwatch \> Logstash \> Elasticsearch](https://discuss.elastic.co/t/aws-cloudwatch-logstash-elasticsearch/302938)
**Author:** [@wallace84](https://discuss.elastic.co/u/wallace84)\ **Replies:** 3\ **Last updated:** [May 6, 2022, 11:39am UTC](https://discuss.elastic.co/t/aws-cloudwatch-logstash-elasticsearch/302938 "2022-05-06T11:39:20Z")
Hello community, I was designing a log filtering process and I would like to know if there is a way to send logs from AWS Cloudwatch to our logstash docker container in a server and from there being processed to be inde… --- ## [Traces-apm-default not create as data stream after migrate to APM integration](https://discuss.elastic.co/t/traces-apm-default-not-create-as-data-stream-after-migrate-to-apm-integration/302511)
**Author:** [@amelieBoond](https://discuss.elastic.co/u/amelieBoond)\ **Replies:** 3\ **Last updated:** [May 6, 2022, 11:24am UTC](https://discuss.elastic.co/t/traces-apm-default-not-create-as-data-stream-after-migrate-to-apm-integration/302511 "2022-05-06T11:24:31Z")
Hello, We have a problem after upgrade elastic/apm from version 7 to 8 and migrating to APM integration. We followed the guide and didn't missed any step. After the upgrade, a new index appear : trace-apm-default but… --- ## [Logstash Multiple input missbehaving](https://discuss.elastic.co/t/logstash-multiple-input-missbehaving/304092)
**Author:** [@dharminfadia](https://discuss.elastic.co/u/dharminfadia)\ **Replies:** 2\ **Last updated:** [May 6, 2022, 8:57am UTC](https://discuss.elastic.co/t/logstash-multiple-input-missbehaving/304092 "2022-05-06T08:57:33Z")
Hello Every One I m using logstash http input and tcp inout in multiple conf file in single logstash machine while I start machin I am getting tcp input DATA in to http input this is ODD how can I fix this please sugg… --- ## [Audit logging](https://discuss.elastic.co/t/audit-logging/304091)
**Author:** [@kartika23](https://discuss.elastic.co/u/kartika23)\ **Replies:** 5\ **Last updated:** [May 6, 2022, 7:16am UTC](https://discuss.elastic.co/t/audit-logging/304091 "2022-05-06T07:16:06Z")
Hi everyone, i am having issue in enabling audit logs in kibana server i am running kibana server with wazuh ,i have tried multiple options but it is not working --- ## [S3 snapshot and restore](https://discuss.elastic.co/t/s3-snapshot-and-restore/303988)
**Author:** [@askadityav](https://discuss.elastic.co/u/askadityav)\ **Replies:** 5\ **Last updated:** [May 6, 2022, 7:04am UTC](https://discuss.elastic.co/t/s3-snapshot-and-restore/303988 "2022-05-06T07:04:37Z")
Hello All, I am making use of Elasticsearch version 7.10.2 and i did install the s3-client plugin and provided the credentials as mentioned in the documentations and i am able to take the snapshots, restore it as well. … --- ## [Heartbeat HTTP monitor evaluate a Date JSON response Field](https://discuss.elastic.co/t/heartbeat-http-monitor-evaluate-a-date-json-response-field/303999)
**Author:** [@mktbec](https://discuss.elastic.co/u/mktbec)\ **Replies:** 4\ **Last updated:** [May 6, 2022, 6:58am UTC](https://discuss.elastic.co/t/heartbeat-http-monitor-evaluate-a-date-json-response-field/303999 "2022-05-06T06:58:21Z")
Hi everyone I need to evaluate a Date field in a JSON response with a heartbeat monitor. it look like there is a date() option using gval, but I can't make it work. the HTTP response looks like this. { "syncTables" … --- ## [Unable to authenticate to Strigo lab for Observability Fundamentals course (ID: E-5VNZ9V)](https://discuss.elastic.co/t/unable-to-authenticate-to-strigo-lab-for-observability-fundamentals-course-id-e-5vnz9v/303936)
**Author:** [@Kundan\_kumar1](https://discuss.elastic.co/u/Kundan_kumar1)\ **Replies:** 2\ **Last updated:** [May 6, 2022, 6:24am UTC](https://discuss.elastic.co/t/unable-to-authenticate-to-strigo-lab-for-observability-fundamentals-course-id-e-5vnz9v/303936 "2022-05-06T06:24:21Z")
Strigo requests for an email as username, while the Observability Fundamentals course (ID: E-5VNZ9V) provides a non-email username ('training'). Am unable to log-on to Strigo. --- ## [Output elasticsearch of filebeat](https://discuss.elastic.co/t/output-elasticsearch-of-filebeat/304075)
**Author:** [@zfx](https://discuss.elastic.co/u/zfx)\ **Replies:** 6\ **Last updated:** [May 6, 2022, 5:42am UTC](https://discuss.elastic.co/t/output-elasticsearch-of-filebeat/304075 "2022-05-06T05:42:58Z")
If I want to use filebeat of metadata fields to instead of es of document id. What should i d --- ## [Dictionary decompounder: only longest match doesn't work](https://discuss.elastic.co/t/dictionary-decompounder-only-longest-match-doesnt-work/303598)
**Author:** [@Arisara\_Pornwattanav](https://discuss.elastic.co/u/Arisara_Pornwattanav)\ **Replies:** 2\ **Last updated:** [May 6, 2022, 5:29am UTC](https://discuss.elastic.co/t/dictionary-decompounder-only-longest-match-doesnt-work/303598 "2022-05-06T05:29:34Z")
Hi I have problem with analyzer: dictionary decompounder. I need the analyzer output as the longest word that match the dictionary. So, I set the word\_list: theredapple, redapple, apple and I also set only\_longest\_matc… --- ## [Connectivity issue in Filebeat and kafka server](https://discuss.elastic.co/t/connectivity-issue-in-filebeat-and-kafka-server/304037)
**Author:** [@shivendra95](https://discuss.elastic.co/u/shivendra95)\ **Replies:** 2\ **Last updated:** [May 6, 2022, 5:17am UTC](https://discuss.elastic.co/t/connectivity-issue-in-filebeat-and-kafka-server/304037 "2022-05-06T05:17:25Z")
Hi, I'm using filebeat to send logs to Kafka topic. The source system is a server with an IP that is not static and it's an on-prem server. The destination server is a AWS Ec2 instance. Currently I'm not able to make co… --- ## [Prometheus module URL encoding](https://discuss.elastic.co/t/prometheus-module-url-encoding/304083)
**Author:** [@Yuvaraj1](https://discuss.elastic.co/u/Yuvaraj1)\ **Replies:** 0\ **Last updated:** [May 6, 2022, 4:12am UTC](https://discuss.elastic.co/t/prometheus-module-url-encoding/304083 "2022-05-06T04:12:40Z")
Version: 8.2.0 docker image The problem faced is that the url https://api.telemetry.confluent.cloud/v2/metrics/cloud/export?resource.kafka.id=AAABBBCCC when encoded ? as %3F causing a 404 error. How to pass query param… --- ## [Logs are not in correct order and timestamp mismatch](https://discuss.elastic.co/t/logs-are-not-in-correct-order-and-timestamp-mismatch/303715)
**Author:** [@yasar](https://discuss.elastic.co/u/yasar)\ **Replies:** 2\ **Last updated:** [May 6, 2022, 4:55am UTC](https://discuss.elastic.co/t/logs-are-not-in-correct-order-and-timestamp-mismatch/303715 "2022-05-06T04:55:23Z")
Hello team, We could see the logs flowing in kibana are not in correct order if the multiple logs are having same timestamp. In below mentioned case, the timestamp of three logs were in same timestamp as "14:40:13,117" … --- ## [OCR highlighter for Alto or hOCR formats](https://discuss.elastic.co/t/ocr-highlighter-for-alto-or-hocr-formats/304051)
**Author:** [@evelix](https://discuss.elastic.co/u/evelix)\ **Replies:** 1\ **Last updated:** [May 6, 2022, 4:49am UTC](https://discuss.elastic.co/t/ocr-highlighter-for-alto-or-hocr-formats/304051 "2022-05-06T04:49:31Z")
We use an OCR software to extract the fulltext from scanned images in Alto or hOCR format. These formats basically know the coordinates of each word on the scanned image. When doing a search against the fulltext, a requ… --- ## [Get events of an specific rule](https://discuss.elastic.co/t/get-events-of-an-specific-rule/304073)
**Author:** [@Felipe\_Fuller](https://discuss.elastic.co/u/Felipe_Fuller)\ **Replies:** 3\ **Last updated:** [May 6, 2022, 2:43am UTC](https://discuss.elastic.co/t/get-events-of-an-specific-rule/304073 "2022-05-06T02:43:16Z")
Hi Community! I'm trying to obtain all the events of a specific rule. Since I didn't find an API that does the job, I inspected the Chome Network Dev tool. During the inspection, I saw a request done to /internal/bsearc… --- ## [Index Lifecycle Rollover Alias is Empty in Winlogbeat Indices](https://discuss.elastic.co/t/index-lifecycle-rollover-alias-is-empty-in-winlogbeat-indices/302415)
**Author:** [@wcpoon](https://discuss.elastic.co/u/wcpoon)\ **Replies:** 5\ **Last updated:** [May 6, 2022, 2:11am UTC](https://discuss.elastic.co/t/index-lifecycle-rollover-alias-is-empty-in-winlogbeat-indices/302415 "2022-05-06T02:11:54Z")
Hi, I'm having below errors "index.lifecycle.rollover\_alias" in winlogbeats indices. Index lifecycle error illegal\_argument\_exception: setting \[index.lifecycle.rollover\_alias\] for index \[winlogbeat-8.1.2-2022.04.14\] is… --- ## [False Positive Report - DriverGenius.exe](https://discuss.elastic.co/t/false-positive-report-drivergenius-exe/302615)
**Author:** [@Driver-Soft](https://discuss.elastic.co/u/Driver-Soft)\ **Replies:** 2\ **Last updated:** [May 6, 2022, 1:16am UTC](https://discuss.elastic.co/t/false-positive-report-drivergenius-exe/302615 "2022-05-06T01:16:25Z")
We followed your instruction to submitted a false positive report to fp\_reports@elastic.co 30 days ago but not get any reply. Hash: 2ceac1bdcc3718a4f824e41d62e690d089e84d284b37b6efef2cdbd5f545a80d Filename (Optional): D… --- ## [What does this alert mean and how to prevent it?](https://discuss.elastic.co/t/what-does-this-alert-mean-and-how-to-prevent-it/304060)
**Author:** [@rgelb](https://discuss.elastic.co/u/rgelb)\ **Replies:** 2\ **Last updated:** [May 6, 2022, 12:46am UTC](https://discuss.elastic.co/t/what-does-this-alert-mean-and-how-to-prevent-it/304060 "2022-05-06T00:46:54Z")
Every day there is this alert: I then click on the Allocate missing replica shards which takes me to the Indices view (e.g. Monitoring/Indices). It says Unassigned Shards: 0, which makes sense since the alert says th… --- ## [Filebeat on RHEL7: Docker input not showing up in Kibana](https://discuss.elastic.co/t/filebeat-on-rhel7-docker-input-not-showing-up-in-kibana/303869)
**Author:** [@paolovalladolid](https://discuss.elastic.co/u/paolovalladolid)\ **Replies:** 3\ **Last updated:** [May 5, 2022, 10:56pm UTC](https://discuss.elastic.co/t/filebeat-on-rhel7-docker-input-not-showing-up-in-kibana/303869 "2022-05-05T22:56:53Z")
I first set up and installed Filebeat, using RPM, on a Red Hat Linux VM with a plain filestream input, with path set to /var/log/redist\_6379.log. I then ran sudo service filebeat start and verified I can see log output … --- ## [Adding a AWS Lambda between API Gateway and Spring boot](https://discuss.elastic.co/t/adding-a-aws-lambda-between-api-gateway-and-spring-boot/304034)
**Author:** [@ramakrishnahkr](https://discuss.elastic.co/u/ramakrishnahkr)\ **Replies:** 1\ **Last updated:** [May 5, 2022, 10:50pm UTC](https://discuss.elastic.co/t/adding-a-aws-lambda-between-api-gateway-and-spring-boot/304034 "2022-05-05T22:50:54Z")
I have a team that has built everything using NodeJS/Typescript. They have specific libraries that are written in typescript that can read the headers the upstream services pass. However, my service is in Spring boot wh… --- ## [Upgrade to Version 8](https://discuss.elastic.co/t/upgrade-to-version-8/304052)
**Author:** [@norgro2601](https://discuss.elastic.co/u/norgro2601)\ **Replies:** 1\ **Last updated:** [May 5, 2022, 10:47pm UTC](https://discuss.elastic.co/t/upgrade-to-version-8/304052 "2022-05-05T22:47:59Z")
Hello, I want to upgrade the Elastic Stack to Version 8. Because we have some AIX Servers in our environment, I used the Beats that were made available by Bull Freeware some years ago and are running version 7.5.x. As … --- ## [Is it possible to bulk edit all rules for certain fields?](https://discuss.elastic.co/t/is-it-possible-to-bulk-edit-all-rules-for-certain-fields/302686)
**Author:** [@Esha](https://discuss.elastic.co/u/Esha)\ **Replies:** 1\ **Last updated:** [May 5, 2022, 10:20pm UTC](https://discuss.elastic.co/t/is-it-possible-to-bulk-edit-all-rules-for-certain-fields/302686 "2022-05-05T22:20:03Z")
Hi Team, Is it possible to bulk edit all rules for timestamp override field to use the event.ingested field? What is the recommended maximum search duration for a rule if there is any? --- ## [How to extract rules and connector using elastic API](https://discuss.elastic.co/t/how-to-extract-rules-and-connector-using-elastic-api/303477)
**Author:** [@waelboss](https://discuss.elastic.co/u/waelboss)\ **Replies:** 1\ **Last updated:** [May 5, 2022, 9:53pm UTC](https://discuss.elastic.co/t/how-to-extract-rules-and-connector-using-elastic-api/303477 "2022-05-05T21:53:40Z")
i want to export rules and connector from elastic using API i created this request : curl -X POST -u elastic:pass https://myHOST:9243/api/detection\_engine/rules/\_export?exclude\_export\_details=true -H 'kbn-xsrf: true' -… --- ## [Logstash s3 error Failed to open TCP connection](https://discuss.elastic.co/t/logstash-s3-error-failed-to-open-tcp-connection/304068)
**Author:** [@swev](https://discuss.elastic.co/u/swev)\ **Replies:** 0\ **Last updated:** [May 5, 2022, 9:01pm UTC](https://discuss.elastic.co/t/logstash-s3-error-failed-to-open-tcp-connection/304068 "2022-05-05T21:01:27Z")
I have been trying to get the s3 plugin to work have been running into issues connecting to the url. The interest part is the url it reports in the error message is missing the region, which was referenced in the endpo… --- ## [Get consolidated schema of multiple indices in ES](https://discuss.elastic.co/t/get-consolidated-schema-of-multiple-indices-in-es/304061)
**Author:** [@newelastic](https://discuss.elastic.co/u/newelastic)\ **Replies:** 1\ **Last updated:** [May 5, 2022, 8:25pm UTC](https://discuss.elastic.co/t/get-consolidated-schema-of-multiple-indices-in-es/304061 "2022-05-05T20:25:38Z")
Hello, I've multiple indices in Elasticsearch that has similar data. But, each index has new properties added/removed over the period of time. Is there any way to fetch union of all indices schema using KQL? For exampl… --- ## [Document contains at least one immense term error](https://discuss.elastic.co/t/document-contains-at-least-one-immense-term-error/304057)
**Author:** [@VV1002](https://discuss.elastic.co/u/VV1002)\ **Replies:** 2\ **Last updated:** [May 5, 2022, 8:25pm UTC](https://discuss.elastic.co/t/document-contains-at-least-one-immense-term-error/304057 "2022-05-05T20:25:25Z")
Hi, I am trying to add some data to ES using javascript client, I am getting this error ResponseError: illegal\_argument\_exception: \[illegal\_argument\_exception\] Reason: Document contains at least one immense term in fi… [Previous page](https://discuss.elastic.co/latest.md?page=1141) [Next page](https://discuss.elastic.co/latest.md?page=1143)