# Latest **URL:** https://discuss.elastic.co/latest.md?page=1166 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1167 --- ## [Error: fail to enroll: fail to execute request to fleet-server: status code: 400, fleet-server returned an error: BadRequest](https://discuss.elastic.co/t/error-fail-to-enroll-fail-to-execute-request-to-fleet-server-status-code-400-fleet-server-returned-an-error-badrequest/302402)
**Author:** [@tirelibirefe](https://discuss.elastic.co/u/tirelibirefe)\ **Replies:** 1\ **Last updated:** [April 19, 2022, 1:04pm UTC](https://discuss.elastic.co/t/error-fail-to-enroll-fail-to-execute-request-to-fleet-server-status-code-400-fleet-server-returned-an-error-badrequest/302402 "2022-04-19T13:04:11Z")
Hello, I am not able to run Fleet on Kubernetes. Here is my config: apiVersion: agent.k8s.elastic.co/v1alpha1 kind: Agent metadata: name: $FLEETSERVERNAME namespace: $NAMESPACE spec: version: 8.1.2 mode: fleet… --- ## [ECK operator podMonitor grafana dashboard](https://discuss.elastic.co/t/eck-operator-podmonitor-grafana-dashboard/301708)
**Author:** [@huntkalio](https://discuss.elastic.co/u/huntkalio)\ **Replies:** 1\ **Last updated:** [April 19, 2022, 12:18pm UTC](https://discuss.elastic.co/t/eck-operator-podmonitor-grafana-dashboard/301708 "2022-04-19T12:18:36Z")
Does ECK operator podmonitor have a default grafana dashboard config file to monitor elastic-operator in grafana? And would you add it to GitHub - elastic/cloud-on-k8s: Elastic Cloud on Kubernetes ? --- ## [How to access each value separately in ctx.payload.\_value](https://discuss.elastic.co/t/how-to-access-each-value-separately-in-ctx-payload-value/302450)
**Author:** [@700grm](https://discuss.elastic.co/u/700grm)\ **Replies:** 1\ **Last updated:** [April 19, 2022, 11:18am UTC](https://discuss.elastic.co/t/how-to-access-each-value-separately-in-ctx-payload-value/302450 "2022-04-19T11:18:52Z")
Hi, I have two values in payload the host name and IP Address, which I need to access separately: "transform" : { "type" : "script", "status" : "success", "payload" : { "\_value" :… --- ## [Multi index search](https://discuss.elastic.co/t/multi-index-search/302711)
**Author:** [@anime\_lover](https://discuss.elastic.co/u/anime_lover)\ **Replies:** 0\ **Last updated:** [April 19, 2022, 11:14am UTC](https://discuss.elastic.co/t/multi-index-search/302711 "2022-04-19T11:14:56Z")
Hi there , this query is interesting take a look and suggest me solution: suppose i have two indices . one is sales which contain cusId,productName,,,etc. another is custInfo which contain phonenumber,custId,...etc. … --- ## [Filtering duplicate fields in Error Watchers](https://discuss.elastic.co/t/filtering-duplicate-fields-in-error-watchers/302710)
**Author:** [@HughEvans](https://discuss.elastic.co/u/HughEvans)\ **Replies:** 0\ **Last updated:** [April 19, 2022, 11:10am UTC](https://discuss.elastic.co/t/filtering-duplicate-fields-in-error-watchers/302710 "2022-04-19T11:10:35Z")
I'm trying to filter out duplicates hits in the following error watcher. Currently when there are multiple hits in the same namespace the output looks like this: "body": "{\\"link\_names\\": \\"1\\", \\"username\\": \\"Kibana … --- ## [How to use filebeat to process file that is not log file](https://discuss.elastic.co/t/how-to-use-filebeat-to-process-file-that-is-not-log-file/302706)
**Author:** [@blumre](https://discuss.elastic.co/u/blumre)\ **Replies:** 1\ **Last updated:** [April 19, 2022, 11:07am UTC](https://discuss.elastic.co/t/how-to-use-filebeat-to-process-file-that-is-not-log-file/302706 "2022-04-19T11:07:03Z")
Hi, I want to collect by filebeat also specific configuration file structured as key=value lines so will be able to use it in Kibana dashboard. I managed to do it for the first time it reads the file but if the file cha… --- ## [Bulk index w/ new java-client](https://discuss.elastic.co/t/bulk-index-w-new-java-client/300111)
**Author:** [@divadpoc](https://discuss.elastic.co/u/divadpoc)\ **Replies:** 6\ **Last updated:** [April 19, 2022, 8:51am UTC](https://discuss.elastic.co/t/bulk-index-w-new-java-client/300111 "2022-04-19T08:51:51Z")
Hi, I'm looking for an example of how to do a bulk insert w/ the new java-client (8.1). Previously (w/ ES 7) I used the high level rest client and a BulkProcessor . Thanks --- ## [Can't see frozen index spans](https://discuss.elastic.co/t/cant-see-frozen-index-spans/302683)
**Author:** [@amcsi](https://discuss.elastic.co/u/amcsi)\ **Replies:** 1\ **Last updated:** [April 19, 2022, 8:50am UTC](https://discuss.elastic.co/t/cant-see-frozen-index-spans/302683 "2022-04-19T08:50:47Z")
I was logging transactions with spans to APM. After realizing that spans took up too much space, I decided to set up and apply an index lifecycle for spans to go cold after 11-15 days, then get deleted after 30 days. Bu… --- ## [Create timestamp as index in Elasticsearch Kibana](https://discuss.elastic.co/t/create-timestamp-as-index-in-elasticsearch-kibana/302681)
**Author:** [@Manish.gupta](https://discuss.elastic.co/u/Manish.gupta)\ **Replies:** 0\ **Last updated:** [April 19, 2022, 7:39am UTC](https://discuss.elastic.co/t/create-timestamp-as-index-in-elasticsearch-kibana/302681 "2022-04-19T07:39:29Z")
Hi, I am trying to change the default index in Elasticsearch with timestamp index. please let me know if there is a way for the same. --- ## [As the server hard disk no enough and I delete the file under /elasticsearch/nodes/0/indices](https://discuss.elastic.co/t/as-the-server-hard-disk-no-enough-and-i-delete-the-file-under-elasticsearch-nodes-0-indices/302605)
**Author:** [@Whybee](https://discuss.elastic.co/u/Whybee)\ **Replies:** 3\ **Last updated:** [April 19, 2022, 7:31am UTC](https://discuss.elastic.co/t/as-the-server-hard-disk-no-enough-and-i-delete-the-file-under-elasticsearch-nodes-0-indices/302605 "2022-04-19T07:31:54Z")
{"type": "server", "timestamp": "2022-04-18T16:40:26,280+08:00", "level": "WARN", "component": "o.e.c.s.MasterService", "cluster.name": "elasticsearch", "node.name": "jenkirsappu01", "message": "failing \[create-index \[it… --- ## [Cannot order by non-grouped column\[column name\]](https://discuss.elastic.co/t/cannot-order-by-non-grouped-column-column-name/302675)
**Author:** [@dido](https://discuss.elastic.co/u/dido)\ **Replies:** 0\ **Last updated:** [April 19, 2022, 7:20am UTC](https://discuss.elastic.co/t/cannot-order-by-non-grouped-column-column-name/302675 "2022-04-19T07:20:05Z")
select \* from (select street, count(street) as counts, min(grocery) as grocery, min(school) as school, (min(grocery) + min(school)) as score from geo\_address group by 1) t order by grocery I have geo\_address index and… --- ## [Logstash Monitoring not available in Kibana](https://discuss.elastic.co/t/logstash-monitoring-not-available-in-kibana/302572)
**Author:** [@mazahir.nazmi](https://discuss.elastic.co/u/mazahir.nazmi)\ **Replies:** 1\ **Last updated:** [April 19, 2022, 7:21am UTC](https://discuss.elastic.co/t/logstash-monitoring-not-available-in-kibana/302572 "2022-04-19T07:21:47Z")
Hi Guys! i have 2 logstash servers installed. i have enabled the xpack.monitoring for each one of the servers, when i use Kibana and go to "Monitoring" tab, i am not seeing any instance. Please advise Regards, Mazah… --- ## [Latency issue when cluster nodes are spread across data center](https://discuss.elastic.co/t/latency-issue-when-cluster-nodes-are-spread-across-data-center/302674)
**Author:** [@mSaify](https://discuss.elastic.co/u/mSaify)\ **Replies:** 0\ **Last updated:** [April 19, 2022, 7:18am UTC](https://discuss.elastic.co/t/latency-issue-when-cluster-nodes-are-spread-across-data-center/302674 "2022-04-19T07:18:09Z")
All, one of my clients has a cluster configuration where the 3 nodes are spread across 2 data centers. For a while, they have been noticing the latency on search queries. Based on network logs and cluster configuration… --- ## [MongoDB Metricbeat Module](https://discuss.elastic.co/t/mongodb-metricbeat-module/301098)
**Author:** [@maltewhiite](https://discuss.elastic.co/u/maltewhiite)\ **Replies:** 1\ **Last updated:** [April 19, 2022, 6:29am UTC](https://discuss.elastic.co/t/mongodb-metricbeat-module/301098 "2022-04-19T06:29:26Z")
mongodb.collstats.insert.count How many X documents are we inserting per Y time in our MongoDB Cluster. And how do I visualize that? What does mongodb.collstats.insert.count show? The Documentation only says: Is i… --- ## [Elastic Agent Install - Proxy Header Syntax](https://discuss.elastic.co/t/elastic-agent-install-proxy-header-syntax/302667)
**Author:** [@sathishpal](https://discuss.elastic.co/u/sathishpal)\ **Replies:** 0\ **Last updated:** [April 19, 2022, 6:24am UTC](https://discuss.elastic.co/t/elastic-agent-install-proxy-header-syntax/302667 "2022-04-19T06:24:59Z")
Hi, We are connecting to fleet via proxy server, I am not sure how to send proxy certificates in the Proxy-Header CLI flag. Here is what I tried that did not work, Elastic Version: 8.1 Request: elastic-agent install … --- ## [Is there any APM instrumentation available for Couchbase and ActiveMQ](https://discuss.elastic.co/t/is-there-any-apm-instrumentation-available-for-couchbase-and-activemq/302664)
**Author:** [@Raushan](https://discuss.elastic.co/u/Raushan)\ **Replies:** 0\ **Last updated:** [April 19, 2022, 5:09am UTC](https://discuss.elastic.co/t/is-there-any-apm-instrumentation-available-for-couchbase-and-activemq/302664 "2022-04-19T05:09:46Z")
Hi, I'm adding APM agents in my microservices for which I don't find any APM instrumentation available for Couchbase and ActiveMQ. Please let us know, if any APM agent available or not? --- ## [Getting All records with doc\_count \>= 2](https://discuss.elastic.co/t/getting-all-records-with-doc-count-2/302407)
**Author:** [@minhaj\_shakeel](https://discuss.elastic.co/u/minhaj_shakeel)\ **Replies:** 14\ **Last updated:** [April 19, 2022, 5:03am UTC](https://discuss.elastic.co/t/getting-all-records-with-doc-count-2/302407 "2022-04-19T05:03:55Z")
I have 2 es indices. There are some records common in both the indices, I want to fetch them. My preliminary query is :- GET index1,index2/\_search { "size": 0, "aggs": { "duplicate record": { "terms": { … --- ## [Prometheus to Elasticsearch using remote\_write - server returned HTTP status 405 method not allowed](https://discuss.elastic.co/t/prometheus-to-elasticsearch-using-remote-write-server-returned-http-status-405-method-not-allowed/302661)
**Author:** [@r.ganeshbabu](https://discuss.elastic.co/u/r.ganeshbabu)\ **Replies:** 1\ **Last updated:** [April 19, 2022, 3:51am UTC](https://discuss.elastic.co/t/prometheus-to-elasticsearch-using-remote-write-server-returned-http-status-405-method-not-allowed/302661 "2022-04-19T03:51:30Z")
Hi All, I am working on sending data from prometheus to elasticsearch using remote\_write in k8s and I am using Prometheus 2.28 image. Below is the remote write configuration defined in configMap (k8s). --- kind: Confi… --- ## [Elastic 7.1.1 -\> 7.1.17 tar ball 업그레이 관련](https://discuss.elastic.co/t/elastic-7-1-1-7-1-17-tar-ball/297121)
**Author:** [@hk\_cloud](https://discuss.elastic.co/u/hk_cloud)\ **Replies:** 2\ **Last updated:** [April 19, 2022, 3:37am UTC](https://discuss.elastic.co/t/elastic-7-1-1-7-1-17-tar-ball/297121 "2022-04-19T03:37:09Z")
안녕하세요. Elasticsearch 7.1.1 -\> 7.1.17 tar ball 업그레이 하려고 하는데 궁금한 것이 있어서 문의 드립니다. 가. tar.gz을 이용하여 엘라스틱 설치 하여 사용 중입니다. 나. x-pack basic 버전으로 사용 중입니다. 문의1) ./bin/Elasticsearch-setup-passwords interactive, ./bin/Elasticse… --- ## [Updating field that is an empty string](https://discuss.elastic.co/t/updating-field-that-is-an-empty-string/302649)
**Author:** [@es\_beginner](https://discuss.elastic.co/u/es_beginner)\ **Replies:** 5\ **Last updated:** [April 19, 2022, 1:59am UTC](https://discuss.elastic.co/t/updating-field-that-is-an-empty-string/302649 "2022-04-19T01:59:49Z")
I currently have an elastic document with a field called grade. This field is an empty string. In Kibana, its registered as grade: (empty). Now when I try to update grade via: POST index/\_update/\_id { "doc": { … --- ## [Can't get Filebeat and Metricbeat DashBoard Setup](https://discuss.elastic.co/t/cant-get-filebeat-and-metricbeat-dashboard-setup/302655)
**Author:** [@asher-lab](https://discuss.elastic.co/u/asher-lab)\ **Replies:** 1\ **Last updated:** [April 19, 2022, 12:54am UTC](https://discuss.elastic.co/t/cant-get-filebeat-and-metricbeat-dashboard-setup/302655 "2022-04-19T00:54:30Z")
Hi, I have a problem setting up the dashboards for metricbeat and filebeat on my Kibana dashboard. I am using the OSS Version of ELK, MetricBeat and Filebeat 7.10.2 Here are the specs of my ELK Stack, MetricBeat and F… --- ## [Data Size and Shard Limits](https://discuss.elastic.co/t/data-size-and-shard-limits/302643)
**Author:** [@geena.rollins](https://discuss.elastic.co/u/geena.rollins)\ **Replies:** 1\ **Last updated:** [April 18, 2022, 11:30pm UTC](https://discuss.elastic.co/t/data-size-and-shard-limits/302643 "2022-04-18T23:30:11Z")
What is the maxium recommended data size per shard? What is the maxium recommended number of shards per cluster? --- ## [Filebeat 8.1.2 @timestamp off](https://discuss.elastic.co/t/filebeat-8-1-2-timestamp-off/302653)
**Author:** [@afmiller1](https://discuss.elastic.co/u/afmiller1)\ **Replies:** 0\ **Last updated:** [April 18, 2022, 11:00pm UTC](https://discuss.elastic.co/t/filebeat-8-1-2-timestamp-off/302653 "2022-04-18T23:00:39Z")
Looking at the discovery tab for my filebeat netflow ingestion, it is showing that it’s almost 2:30h behind my current local time. Tried restarting the service with no luck. How do I get the time to update properly? --- ## [Collect logs from Amazon CloudWatch with Elastic Agent](https://discuss.elastic.co/t/collect-logs-from-amazon-cloudwatch-with-elastic-agent/302648)
**Author:** [@spo](https://discuss.elastic.co/u/spo)\ **Replies:** 2\ **Last updated:** [April 18, 2022, 9:59pm UTC](https://discuss.elastic.co/t/collect-logs-from-amazon-cloudwatch-with-elastic-agent/302648 "2022-04-18T21:59:39Z")
Hi I am trying to pull cloudwatch logs with elastic agent. I have elastic agent running on a windows server. It has the default policy attached to it. To the default policy I have added AWS integration , iis-logs integ… --- ## [Ingest Pipeline Grok filter ignores first pattern and matches second pattern when second pattern exists](https://discuss.elastic.co/t/ingest-pipeline-grok-filter-ignores-first-pattern-and-matches-second-pattern-when-second-pattern-exists/302645)
**Author:** [@kossde](https://discuss.elastic.co/u/kossde)\ **Replies:** 0\ **Last updated:** [April 18, 2022, 9:03pm UTC](https://discuss.elastic.co/t/ingest-pipeline-grok-filter-ignores-first-pattern-and-matches-second-pattern-when-second-pattern-exists/302645 "2022-04-18T21:03:45Z")
Ingest Pipeline GROK filter: { "grok": { "field": "message", "patterns": \[ "\\\\s\*Workstation Name:(?!\\\\t-)\\\\s\*%{DATA:winlog.event\_data.WorkstationName}\\\\n\\\\t.\*", "%{GREEDYDATA:message}" … --- ## [Scroll context exceeding 500](https://discuss.elastic.co/t/scroll-context-exceeding-500/302641)
**Author:** [@Abi\_Blista](https://discuss.elastic.co/u/Abi_Blista)\ **Replies:** 1\ **Last updated:** [April 18, 2022, 8:01pm UTC](https://discuss.elastic.co/t/scroll-context-exceeding-500/302641 "2022-04-18T20:01:33Z")
Im using python to pull large data from ES. When I tried to pull the data, Im getting this partucular issue scroll context exceeding 500. is there way to resolve this issue --- ## [Is there a way to get the next item in a search](https://discuss.elastic.co/t/is-there-a-way-to-get-the-next-item-in-a-search/302638)
**Author:** [@Nessim\_Btesh](https://discuss.elastic.co/u/Nessim_Btesh)\ **Replies:** 0\ **Last updated:** [April 18, 2022, 7:15pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-get-the-next-item-in-a-search/302638 "2022-04-18T19:15:30Z")
I have a search with 400,000 products and I need a way to get the next product in a search. Right now I cant do that because a normal way to this with Elasticsearch is to filter products that have a score greater than th… --- ## [Nest - Routing for multi tenant application](https://discuss.elastic.co/t/nest-routing-for-multi-tenant-application/302606)
**Author:** [@adrian.serban](https://discuss.elastic.co/u/adrian.serban)\ **Replies:** 1\ **Last updated:** [April 18, 2022, 6:33pm UTC](https://discuss.elastic.co/t/nest-routing-for-multi-tenant-application/302606 "2022-04-18T18:33:12Z")
We try to index the data according to a Routing Key (which refers to the ID of a tenant, from a multi-tenant application) The data seems to be indexed as expected: However, searching by this Routing field does not w… --- ## [400 The plain HTTP request was sent to HTTPS port](https://discuss.elastic.co/t/400-the-plain-http-request-was-sent-to-https-port/302284)
**Author:** [@safarial.fatemeh](https://discuss.elastic.co/u/safarial.fatemeh)\ **Replies:** 3\ **Last updated:** [April 18, 2022, 6:23pm UTC](https://discuss.elastic.co/t/400-the-plain-http-request-was-sent-to-https-port/302284 "2022-04-18T18:23:46Z")
Hi, I'm using python client only (have not installed Elasticsearch on my machine) and I'm trying to query kibana and I get following error message: Elasticsearch.exceptions.RequestError: RequestError(400, '\\r\\n400 The p… --- ## [Faield to start elastic search](https://discuss.elastic.co/t/faield-to-start-elastic-search/302608)
**Author:** [@Paritosh\_Pandey](https://discuss.elastic.co/u/Paritosh_Pandey)\ **Replies:** 2\ **Last updated:** [April 18, 2022, 4:37pm UTC](https://discuss.elastic.co/t/faield-to-start-elastic-search/302608 "2022-04-18T16:37:24Z")
I am unable to start Elasticsearch, it shows code exited \ Elasticsearch.service - Elasticsearch Loaded: loaded (/usr/lib/systemd/system/Elasticsearch.service; enabled; vendor preset: disabled) Active: failed (Resu… [Previous page](https://discuss.elastic.co/latest.md?page=1165) [Next page](https://discuss.elastic.co/latest.md?page=1167)