# Latest **URL:** https://discuss.elastic.co/latest.md?page=1172 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1173 --- ## [How parse mysql slow queries into elastic](https://discuss.elastic.co/t/how-parse-mysql-slow-queries-into-elastic/302364)
**Author:** [@David\_Oceans](https://discuss.elastic.co/u/David_Oceans)\ **Replies:** 0\ **Last updated:** [April 13, 2022, 4:01pm UTC](https://discuss.elastic.co/t/how-parse-mysql-slow-queries-into-elastic/302364 "2022-04-13T16:01:24Z")
Hi, I have a mysql in GCP to which I have already configured a sink to pubsub and from a VM with filebeat installed I am able to send the slow queries that reach me to the pubsub to elastic. My problem is that the slow… --- ## [Field format color](https://discuss.elastic.co/t/field-format-color/302106)
**Author:** [@Plachey](https://discuss.elastic.co/u/Plachey)\ **Replies:** 11\ **Last updated:** [April 13, 2022, 3:58pm UTC](https://discuss.elastic.co/t/field-format-color/302106 "2022-04-13T15:58:39Z")
Hello Who can help me with index color format request I found this api /api/saved\_objects/index-pattern/xxxxx/fields but i got problem with data for it request, I can't find how to do it (format and naming fields) m… --- ## [Azure Container Service metrics - Integration](https://discuss.elastic.co/t/azure-container-service-metrics-integration/299256)
**Author:** [@mgfeal](https://discuss.elastic.co/u/mgfeal)\ **Replies:** 1\ **Last updated:** [April 13, 2022, 3:22pm UTC](https://discuss.elastic.co/t/azure-container-service-metrics-integration/299256 "2022-04-13T15:22:48Z")
Hi, We are testing Elastic Cloud with the free trial. We created an user in Azure: And we assign Reader permission to one of our subscriptions. Now we want to add this integration: Azure Container Service Metrics So… --- ## [Heartbeat 8.1.0 Kubernetes Autodiscovery Memory Leak](https://discuss.elastic.co/t/heartbeat-8-1-0-kubernetes-autodiscovery-memory-leak/300543)
**Author:** [@Protopopys](https://discuss.elastic.co/u/Protopopys)\ **Replies:** 6\ **Last updated:** [April 13, 2022, 3:18pm UTC](https://discuss.elastic.co/t/heartbeat-8-1-0-kubernetes-autodiscovery-memory-leak/300543 "2022-04-13T15:18:24Z")
Hello Heartbeat 8.1.0 has a memory leak with enabled Kubernetes autodiscovery and Openshift kills the container on memory limit reached. We have the issue on all Openshift nodes. Heartbeat Version: 8.1.0 Openshif… --- ## [Changing Index on Aggregation based widgets after Copying it from another dashboard](https://discuss.elastic.co/t/changing-index-on-aggregation-based-widgets-after-copying-it-from-another-dashboard/302069)
**Author:** [@curious\_ands](https://discuss.elastic.co/u/curious_ands)\ **Replies:** 1\ **Last updated:** [April 13, 2022, 3:07pm UTC](https://discuss.elastic.co/t/changing-index-on-aggregation-based-widgets-after-copying-it-from-another-dashboard/302069 "2022-04-13T15:07:22Z")
Hi, I am having the dashboard1 which is created using index1 data. The dashboard contains all types of visualization but I want to talk about aggregation based widgets eg. Gauge, Goal, PI etc. When I copy the aggregati… --- ## [Error on import the Elasticsearch public GPG key into apt](https://discuss.elastic.co/t/error-on-import-the-elasticsearch-public-gpg-key-into-apt/302337)
**Author:** [@sashasingle](https://discuss.elastic.co/u/sashasingle)\ **Replies:** 3\ **Last updated:** [April 13, 2022, 2:58pm UTC](https://discuss.elastic.co/t/error-on-import-the-elasticsearch-public-gpg-key-into-apt/302337 "2022-04-13T14:58:08Z")
Hi, cannot download GPG-KEY when i run this command wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo apt-key add -. System send answer - gpg: no valid OpenPGP data found --- ## [Installa elasticsearch in a different directory](https://discuss.elastic.co/t/installa-elasticsearch-in-a-different-directory/302226)
**Author:** [@gustavoluza](https://discuss.elastic.co/u/gustavoluza)\ **Replies:** 2\ **Last updated:** [April 13, 2022, 2:27pm UTC](https://discuss.elastic.co/t/installa-elasticsearch-in-a-different-directory/302226 "2022-04-13T14:27:17Z")
hi, by default Elasticsearch are installed in / directory (/etc/Elasticsearch). but i have an partition in my centos that is dedicated just for the database, how can change the default installing partition and install … --- ## [Elasticsearch downgrade / Restore](https://discuss.elastic.co/t/elasticsearch-downgrade-restore/302344)
**Author:** [@PAVK\_PRASAD](https://discuss.elastic.co/u/PAVK_PRASAD)\ **Replies:** 0\ **Last updated:** [April 13, 2022, 1:36pm UTC](https://discuss.elastic.co/t/elasticsearch-downgrade-restore/302344 "2022-04-13T13:36:59Z")
Hi Team, I have multiple queries on ES Restore / Downgrade on single node Currently we have elastic server(DEV) with 7.16.2 and we would like go back to 7.3.2 but we don't have any backup snapshot of 7.3.2. How to … --- ## [Problems with EST5EDT timezone in Kibana 7.17.0](https://discuss.elastic.co/t/problems-with-est5edt-timezone-in-kibana-7-17-0/300810)
**Author:** [@lifer](https://discuss.elastic.co/u/lifer)\ **Replies:** 17\ **Last updated:** [April 13, 2022, 1:32pm UTC](https://discuss.elastic.co/t/problems-with-est5edt-timezone-in-kibana-7-17-0/300810 "2022-04-13T13:32:52Z")
Hi team! I have some problems with EST5EDT timezone in Kibana v 7.17.0: So, when I set timezone to UTC on the "Slack Management -\> Advanced Settings" page - everything works fine and I see data with correct timezone. B… --- ## [Send security cases to Slack](https://discuss.elastic.co/t/send-security-cases-to-slack/301207)
**Author:** [@samuelD](https://discuss.elastic.co/u/samuelD)\ **Replies:** 4\ **Last updated:** [April 13, 2022, 1:32pm UTC](https://discuss.elastic.co/t/send-security-cases-to-slack/301207 "2022-04-13T13:32:21Z")
Hello, I have an automatic system that creates security cases in my Elastic stack using the Kibana Endpoint. This part is working perfectly. Once an alert is created, I would like to automatically send a message on a S… --- ## [Handling Logstash with RabbitMQ Input receiving basic.cancel](https://discuss.elastic.co/t/handling-logstash-with-rabbitmq-input-receiving-basic-cancel/302339)
**Author:** [@Ben-G](https://discuss.elastic.co/u/Ben-G)\ **Replies:** 0\ **Last updated:** [April 13, 2022, 1:29pm UTC](https://discuss.elastic.co/t/handling-logstash-with-rabbitmq-input-receiving-basic-cancel/302339 "2022-04-13T13:29:31Z")
I have deployed a logstash pod on our k8s cluster that reads from a RabbitMQ deployment. Recently we saw lag suddenly start to increase on RabbitMQ as the number of ready messages grew linearly without stopping. The Rab… --- ## [Does Java APM Agent supports Spring Graphql Resolver request tracking?](https://discuss.elastic.co/t/does-java-apm-agent-supports-spring-graphql-resolver-request-tracking/302336)
**Author:** [@Raushan](https://discuss.elastic.co/u/Raushan)\ **Replies:** 1\ **Last updated:** [April 13, 2022, 1:20pm UTC](https://discuss.elastic.co/t/does-java-apm-agent-supports-spring-graphql-resolver-request-tracking/302336 "2022-04-13T13:20:46Z")
I have developed Java Graphql project which uses graphql-java-tools-11.1.2.jar We have GraphQLMutationResolver which handles the request. These request are not captured by APM. Is this not suported? I don't see in belo… --- ## [Watcher stopped triggering](https://discuss.elastic.co/t/watcher-stopped-triggering/302085)
**Author:** [@Jonathanfranzen](https://discuss.elastic.co/u/Jonathanfranzen)\ **Replies:** 4\ **Last updated:** [April 13, 2022, 1:20pm UTC](https://discuss.elastic.co/t/watcher-stopped-triggering/302085 "2022-04-13T13:20:04Z")
Hi, I put up two Kibana Watchers in two different deployments last week. Now, one of the watchers doesn't trigger. It randomly stopped last friday, even though I didn't edit anything around that time. Now, even if I del… --- ## [Need help how to remove unwanted fields logstash](https://discuss.elastic.co/t/need-help-how-to-remove-unwanted-fields-logstash/302315)
**Author:** [@holpa](https://discuss.elastic.co/u/holpa)\ **Replies:** 1\ **Last updated:** [April 13, 2022, 1:08pm UTC](https://discuss.elastic.co/t/need-help-how-to-remove-unwanted-fields-logstash/302315 "2022-04-13T13:08:40Z")
Please tell me how to remove unnecessary fields. Type: agent.ephemeral\_id agent.id winlog.provider\_guid I tried, But kibana stops showing logs at all drop\_fields: fields: \["date\_created", "ecs.version", "agent.version… --- ## [esrally.exceptions.LaunchError: Daemon startup failed with exit code \[1\]](https://discuss.elastic.co/t/esrally-exceptions-launcherror-daemon-startup-failed-with-exit-code-1/302323)
**Author:** [@likhith1995](https://discuss.elastic.co/u/likhith1995)\ **Replies:** 1\ **Last updated:** [April 13, 2022, 1:02pm UTC](https://discuss.elastic.co/t/esrally-exceptions-launcherror-daemon-startup-failed-with-exit-code-1/302323 "2022-04-13T13:02:54Z")
Hi Team, When we try to run esrally on linux server, we are getting an exception. Exception: esrally.exceptions.LaunchError: Daemon startup failed with exit code \[1\] Kindly help in resolving this error. Thanks and r… --- ## [Path.repo on ECK environment](https://discuss.elastic.co/t/path-repo-on-eck-environment/302255)
**Author:** [@Prabakar](https://discuss.elastic.co/u/Prabakar)\ **Replies:** 2\ **Last updated:** [April 13, 2022, 12:46pm UTC](https://discuss.elastic.co/t/path-repo-on-eck-environment/302255 "2022-04-13T12:46:54Z")
We set path.repo on YAML file like below. path: repo: - But we are unable to add this path into kibana--\> Snapshot --\> Register Repository, it throws below error Cannot register new repository \[test\] failed to cr… --- ## [Calculate difference between current and previous values](https://discuss.elastic.co/t/calculate-difference-between-current-and-previous-values/302237)
**Author:** [@700grm](https://discuss.elastic.co/u/700grm)\ **Replies:** 1\ **Last updated:** [April 13, 2022, 12:11pm UTC](https://discuss.elastic.co/t/calculate-difference-between-current-and-previous-values/302237 "2022-04-13T12:11:09Z")
Hi, I'm trying to create Watcher Alert for dropped packets system.network.in.dropped (the system metrics are shipped with Metricbeats) if more than 50 dropped packets are present alert should be generated. To do this I n… --- ## [Missing Datastreams in Fleet UI](https://discuss.elastic.co/t/missing-datastreams-in-fleet-ui/302326)
**Author:** [@zx8086](https://discuss.elastic.co/u/zx8086)\ **Replies:** 0\ **Last updated:** [April 13, 2022, 12:04pm UTC](https://discuss.elastic.co/t/missing-datastreams-in-fleet-ui/302326 "2022-04-13T12:04:04Z")
Somehow my Fleet Managed Data Streams have gone missing in the UI, despite everything else working, the data exists. --- ## [Search for a text not working](https://discuss.elastic.co/t/search-for-a-text-not-working/302287)
**Author:** [@Shubham\_Singh](https://discuss.elastic.co/u/Shubham_Singh)\ **Replies:** 3\ **Last updated:** [April 13, 2022, 12:02pm UTC](https://discuss.elastic.co/t/search-for-a-text-not-working/302287 "2022-04-13T12:02:04Z")
When searching for a text in the field I'm not getting any data enough though the text is present in the logs query- message : error while getting meet audit data for customer When I search directly without putting th… --- ## [How to configure sendgrid api in elasticsearch.yml](https://discuss.elastic.co/t/how-to-configure-sendgrid-api-in-elasticsearch-yml/302113)
**Author:** [@kirankatkar](https://discuss.elastic.co/u/kirankatkar)\ **Replies:** 2\ **Last updated:** [April 13, 2022, 11:58am UTC](https://discuss.elastic.co/t/how-to-configure-sendgrid-api-in-elasticsearch-yml/302113 "2022-04-13T11:58:40Z")
Hello, Can any one please help me? Want to configure sendgrid api in Elasticsearch.yml to send and alert notification. Thanks & Regards, Kiran Katkar. --- ## [SAML Role mapping (Keycloak Idp)](https://discuss.elastic.co/t/saml-role-mapping-keycloak-idp/302270)
**Author:** [@Vitali\_Lushchyk](https://discuss.elastic.co/u/Vitali_Lushchyk)\ **Replies:** 3\ **Last updated:** [April 13, 2022, 11:49am UTC](https://discuss.elastic.co/t/saml-role-mapping-keycloak-idp/302270 "2022-04-13T11:49:47Z")
cluster elasticsearch configuration: xpack.security.authc.realms.saml.saml1: order: 2 idp.metadata.path: https://login-uat.exadel.com/auth/realms/exadel-uat/protocol/saml/descriptor idp.entity\_id: "https://login-u… --- ## [CCR procedure question](https://discuss.elastic.co/t/ccr-procedure-question/302325)
**Author:** [@Soren\_vdc](https://discuss.elastic.co/u/Soren_vdc)\ **Replies:** 0\ **Last updated:** [April 13, 2022, 11:47am UTC](https://discuss.elastic.co/t/ccr-procedure-question/302325 "2022-04-13T11:47:58Z")
Hi, I'm testing with cross cluster replication. Question: What if the leader index is unavailable, the follower index will not be updated. When the leader index is active again, CCR will be running again? No manual ta… --- ## [Logstash stopped processing because of an error](https://discuss.elastic.co/t/logstash-stopped-processing-because-of-an-error/302291)
**Author:** [@anushka1203](https://discuss.elastic.co/u/anushka1203)\ **Replies:** 1\ **Last updated:** [April 13, 2022, 11:39am UTC](https://discuss.elastic.co/t/logstash-stopped-processing-because-of-an-error/302291 "2022-04-13T11:39:23Z")
Hi, I am trying to send multiple log files to different ES indices. However, Logstash shuts down due to an error. I am a beginner and I could use some help with the same. here is my logstash conf file - input { beats… --- ## [Problem on Short Keywords](https://discuss.elastic.co/t/problem-on-short-keywords/302297)
**Author:** [@icgncl](https://discuss.elastic.co/u/icgncl)\ **Replies:** 1\ **Last updated:** [April 13, 2022, 11:25am UTC](https://discuss.elastic.co/t/problem-on-short-keywords/302297 "2022-04-13T11:25:46Z")
Hello everyone, I have an Elasticsearch index which includes more than 5 fields and my query searches on all these fields. However, today I have realized something wrong. Even though I set fuzziness as 0, when I search … --- ## [Separate file(Lookup file) for grok pattern](https://discuss.elastic.co/t/separate-file-lookup-file-for-grok-pattern/302320)
**Author:** [@vikas.maske](https://discuss.elastic.co/u/vikas.maske)\ **Replies:** 0\ **Last updated:** [April 13, 2022, 11:15am UTC](https://discuss.elastic.co/t/separate-file-lookup-file-for-grok-pattern/302320 "2022-04-13T11:15:40Z")
Hello Team, Thanks for your valuable time. In my entire current ELK setup everyday some new changes needs to be performed on grok patterns and to avoid any human mistakes during changes , I want to use lookup file whi… --- ## [Anomaly detection job severity score change](https://discuss.elastic.co/t/anomaly-detection-job-severity-score-change/302290)
**Author:** [@zerojin63](https://discuss.elastic.co/u/zerojin63)\ **Replies:** 1\ **Last updated:** [April 13, 2022, 10:55am UTC](https://discuss.elastic.co/t/anomaly-detection-job-severity-score-change/302290 "2022-04-13T10:55:08Z")
Hi I've been running an ML job to detect high amount of data stream. Here's specific configuration of the job. Detectors: high\_count partition\_field\_name=src\_ip bucket\_span: 1d So the thing is that the 'severity' of … --- ## [Unable to get new field with mutate filter](https://discuss.elastic.co/t/unable-to-get-new-field-with-mutate-filter/302228)
**Author:** [@zubair\_aftab](https://discuss.elastic.co/u/zubair_aftab)\ **Replies:** 4\ **Last updated:** [April 13, 2022, 10:35am UTC](https://discuss.elastic.co/t/unable-to-get-new-field-with-mutate-filter/302228 "2022-04-13T10:35:10Z")
i split my array temp as below if \[temp\] { split { field =\> "\[temp\]" } } i get different fields, one of the is : temp.isup\_isup\_message\_type Then i want to add a new field based on values in this field : temp.isup… --- ## [How to implement advanced search?](https://discuss.elastic.co/t/how-to-implement-advanced-search/301188)
**Author:** [@TS1997](https://discuss.elastic.co/u/TS1997)\ **Replies:** 2\ **Last updated:** [April 13, 2022, 10:29am UTC](https://discuss.elastic.co/t/how-to-implement-advanced-search/301188 "2022-04-13T10:29:10Z")
Hello, I'm currently developing a site using Pimcore and their Advanced Object Search addon for Elasticsearch but am having issues getting hits on the correct words. A stripped down version of the index itself looks lik… --- ## [QUESTION ABOUT ELK SIEM](https://discuss.elastic.co/t/question-about-elk-siem/301633)
**Author:** [@Firas\_Bougrine](https://discuss.elastic.co/u/Firas_Bougrine)\ **Replies:** 25\ **Last updated:** [April 13, 2022, 10:24am UTC](https://discuss.elastic.co/t/question-about-elk-siem/301633 "2022-04-13T10:24:44Z")
how i can fix this error permanently when i fix it it shows for me again --- ## [Creating visualization that expands log data when clicking on dashboard object](https://discuss.elastic.co/t/creating-visualization-that-expands-log-data-when-clicking-on-dashboard-object/301916)
**Author:** [@Kenneth\_Rodriguez](https://discuss.elastic.co/u/Kenneth_Rodriguez)\ **Replies:** 2\ **Last updated:** [April 13, 2022, 9:39am UTC](https://discuss.elastic.co/t/creating-visualization-that-expands-log-data-when-clicking-on-dashboard-object/301916 "2022-04-13T09:39:32Z")
Is it possible to create a visualization that expands all relevant log data when clicking on a value in dashboard object? For example, I have a pie chart in a dashboard that that tells me the country of origin from traff… [Previous page](https://discuss.elastic.co/latest.md?page=1171) [Next page](https://discuss.elastic.co/latest.md?page=1173)