# Latest **URL:** https://discuss.elastic.co/latest.md?page=1147 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1148 --- ## [Logstash plugin 0.5 fraction on number field](https://discuss.elastic.co/t/logstash-plugin-0-5-fraction-on-number-field/303890)
**Author:** [@Altiano\_Gerung](https://discuss.elastic.co/u/Altiano_Gerung)\ **Replies:** 1\ **Last updated:** [May 4, 2022, 3:27am UTC](https://discuss.elastic.co/t/logstash-plugin-0-5-fraction-on-number-field/303890 "2022-05-04T03:27:46Z")
With logstash google pub/sub output plugin.. How do you set : delay\_threshold\_secs =\> "0.5" ? If I set to 1.x or 2.x, it'll work, but for 0.x it'll never work, so I guess it's just a matter of syntax error.. --- ## [Logstash filter out log lines](https://discuss.elastic.co/t/logstash-filter-out-log-lines/302230)
**Author:** [@shivendra95](https://discuss.elastic.co/u/shivendra95)\ **Replies:** 5\ **Last updated:** [May 4, 2022, 3:11am UTC](https://discuss.elastic.co/t/logstash-filter-out-log-lines/302230 "2022-05-04T03:11:35Z")
Hi, I have json logs that I want to filter based on the message field. {"@timestamp":"2022-04-05T01:20:50.917+00:00","severity":"INFO","service":"service","pid":"18245","thread":"http-nio-8102-exec-1","class":"class","… --- ## [Cannot show request body in errors page with Spring Boot 2.6.4 or later](https://discuss.elastic.co/t/cannot-show-request-body-in-errors-page-with-spring-boot-2-6-4-or-later/302016)
**Author:** [@David\_LEE1](https://discuss.elastic.co/u/David_LEE1)\ **Replies:** 10\ **Last updated:** [May 4, 2022, 3:02am UTC](https://discuss.elastic.co/t/cannot-show-request-body-in-errors-page-with-spring-boot-2-6-4-or-later/302016 "2022-05-04T03:02:06Z")
I am using Elasticsearch version 7.17.1 and APM agent version 1.28.4 When I use Spring Boot 2.6.3 with APM agent, the request body can be shown on the metadata tab of the error page. However, when I updated the Spring … --- ## [Transform --\> Default a pivot groupBy keyName is does not exist](https://discuss.elastic.co/t/transform-default-a-pivot-groupby-keyname-is-does-not-exist/303871)
**Author:** [@lupolo](https://discuss.elastic.co/u/lupolo)\ **Replies:** 2\ **Last updated:** [May 4, 2022, 1:47am UTC](https://discuss.elastic.co/t/transform-default-a-pivot-groupby-keyname-is-does-not-exist/303871 "2022-05-04T01:47:21Z")
In a transform under the section of "pivot": and "group\_by": I would like to default a value if keyName does not exist. Example: \ **Author:** [@inwoo1](https://discuss.elastic.co/u/inwoo1)\ **Replies:** 0\ **Last updated:** [May 4, 2022, 1:37am UTC](https://discuss.elastic.co/t/alert/303888 "2022-05-04T01:37:16Z") 안녕하세요 항상 감사합니다 커뮤니티에 생각보다 전문가 분들이 바쁘시거나 많이 없으신듯 하네요 ㅜㅜ 현재 metricbeat를 수집하는 DB가 약 20대 있습니다. 그 중에 disk 사용량이 가장 높은 것이 87.6%를 점유하고 있습니다. 그래서 host.name: db-\*로 필터를 걸었을 때, 데이터가 87.6%로 보여집니다. (전체 자산 중 가장 높은 것의 데이터로… --- ## [Revisiting "lookup table" concept](https://discuss.elastic.co/t/revisiting-lookup-table-concept/303791)
**Author:** [@erik\_n](https://discuss.elastic.co/u/erik_n)\ **Replies:** 8\ **Last updated:** [May 4, 2022, 12:13am UTC](https://discuss.elastic.co/t/revisiting-lookup-table-concept/303791 "2022-05-04T00:13:13Z")
I've read all of the previous topics about this and done some searching, but I can't figure it out, so I'll ask specifically about my situation. I have one cluster that is explicitly for reporting and visualizations. I'… --- ## [Restoring datastreams isn't working as planned](https://discuss.elastic.co/t/restoring-datastreams-isnt-working-as-planned/303870)
**Author:** [@seanziee](https://discuss.elastic.co/u/seanziee)\ **Replies:** 1\ **Last updated:** [May 4, 2022, 12:12am UTC](https://discuss.elastic.co/t/restoring-datastreams-isnt-working-as-planned/303870 "2022-05-04T00:12:32Z")
I'm getting to about the end of my wits with trying to restore a backing index to a datastream. Essentially I have a set up that I have a datastream-1 with backing indices .ds-datastream-1-2022-04.01 and .ds-datastream… --- ## [Spring4Shell ::Spring Framework Remote Code Execution Vulnerability](https://discuss.elastic.co/t/spring4shell-spring-framework-remote-code-execution-vulnerability/301229)
**Author:** [@Vishnu\_Vijay](https://discuss.elastic.co/u/Vishnu_Vijay)\ **Replies:** 5\ **Last updated:** [May 3, 2022, 11:55pm UTC](https://discuss.elastic.co/t/spring4shell-spring-framework-remote-code-execution-vulnerability/301229 "2022-05-03T23:55:49Z")
Hello, We are using Elasticsearch 6.3.2 & 6.8.23 Please let us know, whether ES is using spring boot war and whether Elasticsearch is impacted any way by the reported spring shell vulnerability. Please suggest, wheth… --- ## [The UI windows of ES ODBC Driver is too small](https://discuss.elastic.co/t/the-ui-windows-of-es-odbc-driver-is-too-small/303858)
**Author:** [@bhguo](https://discuss.elastic.co/u/bhguo)\ **Replies:** 0\ **Last updated:** [May 3, 2022, 4:33pm UTC](https://discuss.elastic.co/t/the-ui-windows-of-es-odbc-driver-is-too-small/303858 "2022-05-03T16:33:48Z")
Dear sirs, I want to use Elasticsearch ODBC Driver to access ES data, I have downloaded and installed it in my computer, I meet some troubles in using it. When I set ODBC DSN in control panel, I find the windows is too… --- ## [Add agent feedback](https://discuss.elastic.co/t/add-agent-feedback/303883)
**Author:** [@schapman](https://discuss.elastic.co/u/schapman)\ **Replies:** 0\ **Last updated:** [May 3, 2022, 10:26pm UTC](https://discuss.elastic.co/t/add-agent-feedback/303883 "2022-05-03T22:26:06Z")
Clicking on "Send Feedback" brings me here, so here I will leave my feed back. When adding an agent. step 2 is "Download the Elastic Agent to your host" and step 3 is "Enroll and start the Elastic Agent". The combinatio… --- ## [Unable to Delete Copied Dashboard Panel](https://discuss.elastic.co/t/unable-to-delete-copied-dashboard-panel/302677)
**Author:** [@Bartu\_Gokalp](https://discuss.elastic.co/u/Bartu_Gokalp)\ **Replies:** 14\ **Last updated:** [May 3, 2022, 10:15pm UTC](https://discuss.elastic.co/t/unable-to-delete-copied-dashboard-panel/302677 "2022-05-03T22:15:40Z")
I have copied a from one dashboard to another. Than I have deleted original panel from first dashboard. Options \> more \> Delete from dashboard is not visible in editing mode. So, I am unable to delete it. (see screensho… --- ## [Installing and running Docker plugin - help with syntax needed](https://discuss.elastic.co/t/installing-and-running-docker-plugin-help-with-syntax-needed/302529)
**Author:** [@paolovalladolid](https://discuss.elastic.co/u/paolovalladolid)\ **Replies:** 1\ **Last updated:** [May 3, 2022, 10:14pm UTC](https://discuss.elastic.co/t/installing-and-running-docker-plugin-help-with-syntax-needed/302529 "2022-05-03T22:14:38Z")
I get the error "docker run" requires at least 1 argument(s). when I run this command docker run --log-driver=elastic/elastic-logging-plugin:8.1.2 --log-opt hosts="thehost" I then tried to fix the error by adding wha… --- ## [Indices keep getting deleted automatically](https://discuss.elastic.co/t/indices-keep-getting-deleted-automatically/303555)
**Author:** [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\ **Replies:** 4\ **Last updated:** [May 3, 2022, 9:07pm UTC](https://discuss.elastic.co/t/indices-keep-getting-deleted-automatically/303555 "2022-05-03T21:07:30Z")
We are running ELK 7.6.2 stack. It seems that indices are getting deleted / cleaned automatically by ES. We have ILM policy of 2 days retention for the index, but somehow it deletes the current one too. After enabling… --- ## [Logstash- /var/log/logstash - has no files](https://discuss.elastic.co/t/logstash-var-log-logstash-has-no-files/303780)
**Author:** [@gurumu](https://discuss.elastic.co/u/gurumu)\ **Replies:** 7\ **Last updated:** [May 3, 2022, 8:46pm UTC](https://discuss.elastic.co/t/logstash-var-log-logstash-has-no-files/303780 "2022-05-03T20:46:35Z")
Hello- I have installed Elasticsearch, Kibana and Logstash version 8.1.0 on my ubuntu VM. I am trying to ingest auth.log into ES by passing it through logstash. attached is the configuration file screenshots. I am not se… --- ## [Logstash Permission denied - NUL error](https://discuss.elastic.co/t/logstash-permission-denied-nul-error/303686)
**Author:** [@Ersan](https://discuss.elastic.co/u/Ersan)\ **Replies:** 3\ **Last updated:** [May 3, 2022, 8:32pm UTC](https://discuss.elastic.co/t/logstash-permission-denied-nul-error/303686 "2022-05-03T20:32:57Z")
Hello I am new to EleasticSearch. I try to run logstash on Windows for the first time with different instrutions/Java versions/Logtash versions but always get the same error. I checked out the forms too but could not f… --- ## [🎉 Elastic Stack 8.2 released](https://discuss.elastic.co/t/elastic-stack-8-2-released/303876)
**Author:** [@elyssaemrich](https://discuss.elastic.co/u/elyssaemrich)\ **Replies:** 0\ **Last updated:** [May 3, 2022, 8:28pm UTC](https://discuss.elastic.co/t/elastic-stack-8-2-released/303876 "2022-05-03T20:28:54Z")
New in Elastic 8.2 Elastic 8.2 has arrived! This release enables you to build seamless search experiences, accelerate troubleshooting of cloud-native services, and enhance your security analysts’ investigative experience … --- ## [Error enrolling Fleet Server: FAILED: Missed two check-ins](https://discuss.elastic.co/t/error-enrolling-fleet-server-failed-missed-two-check-ins/303875)
**Author:** [@mhoward](https://discuss.elastic.co/u/mhoward)\ **Replies:** 0\ **Last updated:** [May 3, 2022, 8:12pm UTC](https://discuss.elastic.co/t/error-enrolling-fleet-server-failed-missed-two-check-ins/303875 "2022-05-03T20:12:44Z")
I am in the process of adding a Fleet server to a self-managed Elastic cluster in Production mode using my own generated certificates. I'm running into the following error of Elastic-agent failing to start when running … --- ## [How to start a elastic cluster 8.1 with three or more nodes](https://discuss.elastic.co/t/how-to-start-a-elastic-cluster-8-1-with-three-or-more-nodes/303540)
**Author:** [@Adrian\_Gtz](https://discuss.elastic.co/u/Adrian_Gtz)\ **Replies:** 8\ **Last updated:** [May 3, 2022, 8:10pm UTC](https://discuss.elastic.co/t/how-to-start-a-elastic-cluster-8-1-with-three-or-more-nodes/303540 "2022-05-03T20:10:59Z")
I have the first node, but I don't know what is next. What do I have to do to define the master and join new nodes to the cluster. Is there a guide or something explained ? Thanks in advanced. --- ## [ECE Installation Prerequisites - Max open files descriptors per process](https://discuss.elastic.co/t/ece-installation-prerequisites-max-open-files-descriptors-per-process/303325)
**Author:** [@morariu](https://discuss.elastic.co/u/morariu)\ **Replies:** 0\ **Last updated:** [April 26, 2022, 8:11pm UTC](https://discuss.elastic.co/t/ece-installation-prerequisites-max-open-files-descriptors-per-process/303325 "2022-04-26T20:11:31Z")
I am trying to install ECE but the prerequisites fail with the following: OS settings for max open file descriptors per process should be \>= 65536, currently 32768 That's what I get when I exec in the container and run… --- ## [ECE Fully Private Installation on AWS - no public endpoints](https://discuss.elastic.co/t/ece-fully-private-installation-on-aws-no-public-endpoints/303263)
**Author:** [@morariu](https://discuss.elastic.co/u/morariu)\ **Replies:** 0\ **Last updated:** [April 26, 2022, 10:41am UTC](https://discuss.elastic.co/t/ece-fully-private-installation-on-aws-no-public-endpoints/303263 "2022-04-26T10:41:19Z")
I have installed ECE on AWS EC2 and while the (latest) installation docs are pretty straightforward it stops there. There are no specifics as to what is required after the installation. I hope someone can help as I can'… --- ## [Issues with winlogbeat set up](https://discuss.elastic.co/t/issues-with-winlogbeat-set-up/303793)
**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Replies:** 1\ **Last updated:** [May 3, 2022, 6:59pm UTC](https://discuss.elastic.co/t/issues-with-winlogbeat-set-up/303793 "2022-05-03T18:59:07Z")
ES version 7.16.2, winlogbeat 7.16.1 Trying to get winlogbeat working on a new cluster. We seem to have got thought the setup phase and started to send data. Each event gets a warning (status=400): {"type":"illegal\_a… --- ## [Elasticsearch Upgrade from 2.x to 6.x](https://discuss.elastic.co/t/elasticsearch-upgrade-from-2-x-to-6-x/301590)
**Author:** [@veenarvg](https://discuss.elastic.co/u/veenarvg)\ **Replies:** 0\ **Last updated:** [April 5, 2022, 6:24am UTC](https://discuss.elastic.co/t/elasticsearch-upgrade-from-2-x-to-6-x/301590 "2022-04-05T06:24:33Z")
This category relates to the Enterprise Search set of products - App Search, Site Search and Workplace Search. If your question relates to core Elasticsearch functionality, please head over to the #elastic-stack:elastic… --- ## [If else query on elastic search](https://discuss.elastic.co/t/if-else-query-on-elastic-search/302663)
**Author:** [@anime\_lover](https://discuss.elastic.co/u/anime_lover)\ **Replies:** 0\ **Last updated:** [April 19, 2022, 4:48am UTC](https://discuss.elastic.co/t/if-else-query-on-elastic-search/302663 "2022-04-19T04:48:08Z")
Hi there , i am facing some problem on searching . My problem is : Suppose i have three field A,B and C . If i search for certain text then it should search on field A first if found ,stop searching and return result i… --- ## [Kibana lens formula distinct by rows](https://discuss.elastic.co/t/kibana-lens-formula-distinct-by-rows/303847)
**Author:** [@wiwinagtor](https://discuss.elastic.co/u/wiwinagtor)\ **Replies:** 2\ **Last updated:** [May 3, 2022, 6:31pm UTC](https://discuss.elastic.co/t/kibana-lens-formula-distinct-by-rows/303847 "2022-05-03T18:31:00Z")
Is there a way to perform using kibana lens a calculated fields table where the formulas changes by row? For example: Or there is another way to do it, Thanks everyone --- ## [Unable to connect | 502 Bad Gateway on Enterprise Search](https://discuss.elastic.co/t/unable-to-connect-502-bad-gateway-on-enterprise-search/303355)
**Author:** [@auasad](https://discuss.elastic.co/u/auasad)\ **Replies:** 1\ **Last updated:** [May 3, 2022, 6:30pm UTC](https://discuss.elastic.co/t/unable-to-connect-502-bad-gateway-on-enterprise-search/303355 "2022-05-03T18:30:42Z")
Hello community, this morning I was trying to setup Enterprise Search(Appsearch) with docker, following the URL, https://www.elastic.co/guide/en/enterprise-search/8.1/docker.html, nothing changed just copied and pasted t… --- ## [Fortinet Logs Integration](https://discuss.elastic.co/t/fortinet-logs-integration/303788)
**Author:** [@jumpie](https://discuss.elastic.co/u/jumpie)\ **Replies:** 8\ **Last updated:** [May 3, 2022, 6:27pm UTC](https://discuss.elastic.co/t/fortinet-logs-integration/303788 "2022-05-03T18:27:15Z")
Hello, I've installed the Fortinet Logs Integration and configured the Fortigate to send syslogs for 9004. I was able to test that the Fortigate is sending logs but nothing shows up in Elastic. Is there something I am m… --- ## [Packetbeat on windows 10 : error connecting to kibana, fail to get the kibana version : HTTP GET request to http://192.168.217.128:5601](https://discuss.elastic.co/t/packetbeat-on-windows-10-error-connecting-to-kibana-fail-to-get-the-kibana-version-http-get-request-to-http-192-168-217-128-5601/303655)
**Author:** [@TARIK\_MAZOUZ](https://discuss.elastic.co/u/TARIK_MAZOUZ)\ **Replies:** 21\ **Last updated:** [May 3, 2022, 5:17pm UTC](https://discuss.elastic.co/t/packetbeat-on-windows-10-error-connecting-to-kibana-fail-to-get-the-kibana-version-http-get-request-to-http-192-168-217-128-5601/303655 "2022-05-03T17:17:34Z")
hey everybody, so i do have a problem with packetbeat in my windows 10 VM, so when i execute the command is powershell as an administrator , .\\packetbeat.exe setup -e , the error i get is : Exiting: error connecting to … --- ## [How to update a plugin to a newer yet unsupported Kibana version?](https://discuss.elastic.co/t/how-to-update-a-plugin-to-a-newer-yet-unsupported-kibana-version/303560)
**Author:** [@pritster5](https://discuss.elastic.co/u/pritster5)\ **Replies:** 1\ **Last updated:** [May 3, 2022, 4:59pm UTC](https://discuss.elastic.co/t/how-to-update-a-plugin-to-a-newer-yet-unsupported-kibana-version/303560 "2022-05-03T16:59:22Z")
I am trying to update a plugin (SigmaUI by SOC Prime) written for an older version of Kibana (confirmed working on ELK 7.5). The plugin does not work on ELK 8.X+ (because the way plugins are handled was changed in ELK 7… --- ## [Logstash Conf | Extracting Filename from Path](https://discuss.elastic.co/t/logstash-conf-extracting-filename-from-path/303818)
**Author:** [@srii](https://discuss.elastic.co/u/srii)\ **Replies:** 2\ **Last updated:** [May 3, 2022, 4:36pm UTC](https://discuss.elastic.co/t/logstash-conf-extracting-filename-from-path/303818 "2022-05-03T16:36:14Z")
I am trying to setup Logstash to feed Elasticsearch. In course, I've created the following conf file that seem to work nicely: input { beats { port =\> 5044 } file { path =\> "C:/f1/f2/Logs/f3/LocalHost#b… --- ## [Is there any tool which will create dummy document based on index mapping for testing?](https://discuss.elastic.co/t/is-there-any-tool-which-will-create-dummy-document-based-on-index-mapping-for-testing/279935)
**Author:** [@Nishikant\_Tayade](https://discuss.elastic.co/u/Nishikant_Tayade)\ **Replies:** 1\ **Last updated:** [May 3, 2022, 4:30pm UTC](https://discuss.elastic.co/t/is-there-any-tool-which-will-create-dummy-document-based-on-index-mapping-for-testing/279935 "2022-05-03T16:30:12Z")
I have created a wrapper around ES index bulk document API, I need to test the performance of it. I want to create at least, 1000 documents based on my index mapping, so that I can test the performance of my API. Is th… [Previous page](https://discuss.elastic.co/latest.md?page=1146) [Next page](https://discuss.elastic.co/latest.md?page=1148)