# Latest **URL:** https://discuss.elastic.co/latest.md?page=1201 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1202 --- ## [How to get the Greater or Last Value in a Document for doing filter](https://discuss.elastic.co/t/how-to-get-the-greater-or-last-value-in-a-document-for-doing-filter/300246)
**Author:** [@vthiyagarajan](https://discuss.elastic.co/u/vthiyagarajan)\ **Replies:** 2\ **Last updated:** [March 25, 2022, 4:53pm UTC](https://discuss.elastic.co/t/how-to-get-the-greater-or-last-value-in-a-document-for-doing-filter/300246 "2022-03-25T16:53:05Z")
I have a JSON document like this { "EmpDetails" : { "emplid" : "32444" "sickdays" : "3" "batch\_id": "22-04" }, "EmpDetails" : { "emplid" : "32445" "sickdays" : "3" "batch\_id": "22-04" }, "EmpDetails" : { "… --- ## [Not Able to See logs on kibana](https://discuss.elastic.co/t/not-able-to-see-logs-on-kibana/300678)
**Author:** [@wajihrehman](https://discuss.elastic.co/u/wajihrehman)\ **Replies:** 7\ **Last updated:** [March 25, 2022, 3:59pm UTC](https://discuss.elastic.co/t/not-able-to-see-logs-on-kibana/300678 "2022-03-25T15:59:55Z")
Kibana version: Latest Elasticsearch version: Latest APM Server version: Latest APM Agent language and version: English Browser version: Latest Original install method (e.g. download page, yum, deb, from source… --- ## [How to parse timestamp apache access.log](https://discuss.elastic.co/t/how-to-parse-timestamp-apache-access-log/300709)
**Author:** [@Roccof97](https://discuss.elastic.co/u/Roccof97)\ **Replies:** 2\ **Last updated:** [March 25, 2022, 3:39pm UTC](https://discuss.elastic.co/t/how-to-parse-timestamp-apache-access-log/300709 "2022-03-25T15:39:30Z")
Hi, how can i parse this timestamp using grok filter?: x.x.x.x - - \[24/Mar/2022:00:00:04 +0000\] do you have any advice? Thanks --- ## [Could not connect to a compatible version of Elasticsearch (elasticsearch 7.8.0 with logstash 7.17.1)](https://discuss.elastic.co/t/could-not-connect-to-a-compatible-version-of-elasticsearch-elasticsearch-7-8-0-with-logstash-7-17-1/300688)
**Author:** [@splash](https://discuss.elastic.co/u/splash)\ **Replies:** 2\ **Last updated:** [March 25, 2022, 3:35pm UTC](https://discuss.elastic.co/t/could-not-connect-to-a-compatible-version-of-elasticsearch-elasticsearch-7-8-0-with-logstash-7-17-1/300688 "2022-03-25T15:35:47Z")
Hi everyone, we are running a Robotic Process Automation software called "Automation Anywhere" which uses Elasticsearch 7.8.0: "version" : { "number" : "7.8.0", "build\_flavor" : "oss", "build\_type" : "zip",… --- ## [Metricbeat, Filebeat spawning lots of child procs](https://discuss.elastic.co/t/metricbeat-filebeat-spawning-lots-of-child-procs/300503)
**Author:** [@perfecto25](https://discuss.elastic.co/u/perfecto25)\ **Replies:** 2\ **Last updated:** [March 25, 2022, 3:31pm UTC](https://discuss.elastic.co/t/metricbeat-filebeat-spawning-lots-of-child-procs/300503 "2022-03-25T15:31:29Z")
Hello, Im running fbeat, mbeat 7.17 on centos 7 I see it spawning off tons of child procs, is there way to limit this? Whats the reason why so many procs are spawned? --- ## [Metricbeat add\_field from file?](https://discuss.elastic.co/t/metricbeat-add-field-from-file/300718)
**Author:** [@thech](https://discuss.elastic.co/u/thech)\ **Replies:** 0\ **Last updated:** [March 25, 2022, 3:31pm UTC](https://discuss.elastic.co/t/metricbeat-add-field-from-file/300718 "2022-03-25T15:31:15Z")
Hello, I have Metricbeat and my application running from different containers. The application starts and generates a UUID, storing it in a file app.uuid. I can mount this file to Metricbeat, but how can I add it as a f… --- ## [Kibana server is not ready yet](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet/300236)
**Author:** [@justintaylor9](https://discuss.elastic.co/u/justintaylor9)\ **Replies:** 8\ **Last updated:** [March 25, 2022, 2:52pm UTC](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet/300236 "2022-03-25T14:52:34Z")
I am getting this error in the browser. Here are my configs: Kibana.yml: \ server.host: 10.241.89.153 Elasticsearch.hosts: "http://10.241.89.144:9200" server.port: 80 Elasticsearch.ssl.verificationMode: certifica… --- ## [Winlogbeat "No results match your search criteria"](https://discuss.elastic.co/t/winlogbeat-no-results-match-your-search-criteria/300713)
**Author:** [@n.petrovic](https://discuss.elastic.co/u/n.petrovic)\ **Replies:** 0\ **Last updated:** [March 25, 2022, 2:19pm UTC](https://discuss.elastic.co/t/winlogbeat-no-results-match-your-search-criteria/300713 "2022-03-25T14:19:33Z")
winlogbeat "No results match your search criteria" Client setup done properly PS C:\\ProgramData\\Beats\\winlogbeat-7.15.0-windows-x86\_64\> .\\winlogbeat.exe setup Overwriting ILM policy is disabled. Set setup.ilm.overwrit… --- ## [How to update all docs with query that looks for a regex and update it incase found](https://discuss.elastic.co/t/how-to-update-all-docs-with-query-that-looks-for-a-regex-and-update-it-incase-found/299894)
**Author:** [@ShayWeizman](https://discuss.elastic.co/u/ShayWeizman)\ **Replies:** 12\ **Last updated:** [March 25, 2022, 1:52pm UTC](https://discuss.elastic.co/t/how-to-update-all-docs-with-query-that-looks-for-a-regex-and-update-it-incase-found/299894 "2022-03-25T13:52:07Z")
Hi, I'm using 7.16.2. I have a lot of records looks like this { "\_index" : "testcases", "\_type" : "\_doc", "\_id" : "Cv6z8HoBF-BJEaLQYGtU", "\_score" : 1.0, "\_source" : { … --- ## [Error Field \[data\] not present as part of path \[data\]](https://discuss.elastic.co/t/error-field-data-not-present-as-part-of-path-data/300642)
**Author:** [@Enxiad](https://discuss.elastic.co/u/Enxiad)\ **Replies:** 2\ **Last updated:** [March 25, 2022, 12:41pm UTC](https://discuss.elastic.co/t/error-field-data-not-present-as-part-of-path-data/300642 "2022-03-25T12:41:01Z")
(Redacted for improved clarity, please see next post on this thread) --- ## [ILM pattern is incrementing by two numbers instead of one](https://discuss.elastic.co/t/ilm-pattern-is-incrementing-by-two-numbers-instead-of-one/299882)
**Author:** [@adminunix](https://discuss.elastic.co/u/adminunix)\ **Replies:** 1\ **Last updated:** [March 25, 2022, 12:31pm UTC](https://discuss.elastic.co/t/ilm-pattern-is-incrementing-by-two-numbers-instead-of-one/299882 "2022-03-25T12:31:44Z")
Hi, I have a strange issue with new backing indices creates after rollover. Suffix number is incrementing by two numbers instead of one. Initially, ILM generated new indices with correct names incrementing only one… --- ## [How to return data that has particular columns in every \_source dictionary in Elasticsearch?](https://discuss.elastic.co/t/how-to-return-data-that-has-particular-columns-in-every-source-dictionary-in-elasticsearch/300680)
**Author:** [@Harish\_fragger](https://discuss.elastic.co/u/Harish_fragger)\ **Replies:** 1\ **Last updated:** [March 25, 2022, 10:41am UTC](https://discuss.elastic.co/t/how-to-return-data-that-has-particular-columns-in-every-source-dictionary-in-elasticsearch/300680 "2022-03-25T10:41:50Z")
I have an Elasticsearch query which is extracting data from the following fields "\_source": \["data.service","data.vpn","data.policyid","data.srccountry1"\] . While using the search function which gives only max hits of 10… --- ## [Multi level Transform with Elasticsearch](https://discuss.elastic.co/t/multi-level-transform-with-elasticsearch/300226)
**Author:** [@bianca6](https://discuss.elastic.co/u/bianca6)\ **Replies:** 1\ **Last updated:** [March 25, 2022, 10:30am UTC](https://discuss.elastic.co/t/multi-level-transform-with-elasticsearch/300226 "2022-03-25T10:30:05Z")
Hi, I have different logs just like this: timestamp = A, group = B, objectCount= C timestamp = A, group = B, object = D, value = E timestamp = A, group = B, object = F, value = G I already use a Transform which group… --- ## [Concatenate / join values of tags into one field](https://discuss.elastic.co/t/concatenate-join-values-of-tags-into-one-field/300606)
**Author:** [@S-elk](https://discuss.elastic.co/u/S-elk)\ **Replies:** 2\ **Last updated:** [March 25, 2022, 10:29am UTC](https://discuss.elastic.co/t/concatenate-join-values-of-tags-into-one-field/300606 "2022-03-25T10:29:01Z")
hello! i want to join all the tags field values into one new field? can i do that with join mutate filter ? if not, how can i do that ? example : tags = \["1","2","3"\] new\_field = "123" thanks in advanced! p.d. is… --- ## [Unable to view namespace labels in report, only pod level labels work](https://discuss.elastic.co/t/unable-to-view-namespace-labels-in-report-only-pod-level-labels-work/300683)
**Author:** [@MChal](https://discuss.elastic.co/u/MChal)\ **Replies:** 1\ **Last updated:** [March 25, 2022, 10:01am UTC](https://discuss.elastic.co/t/unable-to-view-namespace-labels-in-report-only-pod-level-labels-work/300683 "2022-03-25T10:01:42Z")
Hey there, I'm looking to create a report that aggregates CPU and Memory usage based on a reporting label. I have labelled some namespaces as a test and my labels don't come up until I also label individual pods. Is the… --- ## [HTTP monitor and TLS connection in Heartbeat 7.17.0](https://discuss.elastic.co/t/http-monitor-and-tls-connection-in-heartbeat-7-17-0/300343)
**Author:** [@gigaset](https://discuss.elastic.co/u/gigaset)\ **Replies:** 5\ **Last updated:** [March 25, 2022, 9:59am UTC](https://discuss.elastic.co/t/http-monitor-and-tls-connection-in-heartbeat-7-17-0/300343 "2022-03-25T09:59:59Z")
Hi, I'm using Heartbeat v7.17.0, and it looks like there is a problem with establishing the TLS connection in the HTTP monitor. The first problem is that the config option ssl.verification\_mode: none seems not to work. … --- ## [Can we import one elastic search cluster data into another?](https://discuss.elastic.co/t/can-we-import-one-elastic-search-cluster-data-into-another/300529)
**Author:** [@Prashant\_Kamble](https://discuss.elastic.co/u/Prashant_Kamble)\ **Replies:** 14\ **Last updated:** [March 25, 2022, 9:14am UTC](https://discuss.elastic.co/t/can-we-import-one-elastic-search-cluster-data-into-another/300529 "2022-03-25T09:14:48Z")
We have two different clusters created on Elasticsearch server cluster 6.8 cluster 7.10 Just wanted to check is there any way to import data from one cluster to another? If yes, what are the ways to do it without re-i… --- ## [Modsecurity integrations vanished](https://discuss.elastic.co/t/modsecurity-integrations-vanished/299341)
**Author:** [@stefan.pinter](https://discuss.elastic.co/u/stefan.pinter)\ **Replies:** 1\ **Last updated:** [March 25, 2022, 8:55am UTC](https://discuss.elastic.co/t/modsecurity-integrations-vanished/299341 "2022-03-25T08:55:37Z")
hi! a few weeks ago I had the possibility to install the modsecurity integration from within kibana... but now it is gone - can this be an issue on my site? thanks! --- ## [Duplicate document ids when using rolling indices](https://discuss.elastic.co/t/duplicate-document-ids-when-using-rolling-indices/300666)
**Author:** [@vlasami](https://discuss.elastic.co/u/vlasami)\ **Replies:** 0\ **Last updated:** [March 25, 2022, 7:46am UTC](https://discuss.elastic.co/t/duplicate-document-ids-when-using-rolling-indices/300666 "2022-03-25T07:46:27Z")
Hi, We have ES v7.17 and started to use index rolling with ILM (with 40G size limit on index) and faced a document duplication issue that was described in the ILM updating record with existing Id on older index creates… --- ## [Unable to run localhost:9200](https://discuss.elastic.co/t/unable-to-run-localhost-9200/300656)
**Author:** [@sureshaws](https://discuss.elastic.co/u/sureshaws)\ **Replies:** 3\ **Last updated:** [March 25, 2022, 8:14am UTC](https://discuss.elastic.co/t/unable-to-run-localhost-9200/300656 "2022-03-25T08:14:10Z")
Installed elastic but do not see localhost:9200 loading # ====================Preformatted text==== Elasticsearch Configuration ========================= # # NOTE: Elasticsearch comes with reasonable defaults for most s… --- ## [Problem adding apm integration in Fleet (on-prem+no-internet) version 8.1.0](https://discuss.elastic.co/t/problem-adding-apm-integration-in-fleet-on-prem-no-internet-version-8-1-0/300616)
**Author:** [@bpawan](https://discuss.elastic.co/u/bpawan)\ **Replies:** 4\ **Last updated:** [March 25, 2022, 7:56am UTC](https://discuss.elastic.co/t/problem-adding-apm-integration-in-fleet-on-prem-no-internet-version-8-1-0/300616 "2022-03-25T07:56:41Z")
I am trying to install elk stack on my own servers. I am able to install and configure Elasticsearch, kibana with air-gapped package registry as well fleet server. So far so good. Next stop I am trying to install APM se… --- ## [Couldn't Harvest log file from Docker](https://discuss.elastic.co/t/couldnt-harvest-log-file-from-docker/300667)
**Author:** [@chathuwadev\_dev](https://discuss.elastic.co/u/chathuwadev_dev)\ **Replies:** 0\ **Last updated:** [March 25, 2022, 7:47am UTC](https://discuss.elastic.co/t/couldnt-harvest-log-file-from-docker/300667 "2022-03-25T07:47:09Z")
Hi All, I am beginner for ELK stack, Below my work scenario I am going to centralize logs from my Microservices Also i used ELK stack and i already config it in docker-compose.yml Kibana,Elasticsearch and Logs… --- ## [Terms aggregation bucket Sorting is not working when using with partition](https://discuss.elastic.co/t/terms-aggregation-bucket-sorting-is-not-working-when-using-with-partition/298502)
**Author:** [@truptir](https://discuss.elastic.co/u/truptir)\ **Replies:** 12\ **Last updated:** [March 25, 2022, 7:47am UTC](https://discuss.elastic.co/t/terms-aggregation-bucket-sorting-is-not-working-when-using-with-partition/298502 "2022-03-25T07:47:04Z")
I am trying to do TermAggregation + Sort order(by \_count) + pagination(using partition). But resulting bucket partitions are not sorted properly. Without using partitions, sorting is working properly. Here is my elasti… --- ## [Need assistance with creating daily winlogbeat indices that follow an ILM policy](https://discuss.elastic.co/t/need-assistance-with-creating-daily-winlogbeat-indices-that-follow-an-ilm-policy/300665)
**Author:** [@roman-tasi](https://discuss.elastic.co/u/roman-tasi)\ **Replies:** 0\ **Last updated:** [March 25, 2022, 7:25am UTC](https://discuss.elastic.co/t/need-assistance-with-creating-daily-winlogbeat-indices-that-follow-an-ilm-policy/300665 "2022-03-25T07:25:43Z")
I created a winlogbeat index with a PUT request as so : PUT /%3Cwinlogbeat-%7Bnow%2Fd%7D-000001%3E { "aliases": { "winlogbeat": { "is\_write\_index": true } } } It then asked me to select a rollover alias from a dropdown… --- ## [How to get results from another results field value](https://discuss.elastic.co/t/how-to-get-results-from-another-results-field-value/300014)
**Author:** [@Shushil\_Shankar](https://discuss.elastic.co/u/Shushil_Shankar)\ **Replies:** 3\ **Last updated:** [March 25, 2022, 7:04am UTC](https://discuss.elastic.co/t/how-to-get-results-from-another-results-field-value/300014 "2022-03-25T07:04:41Z")
Hi Everyone, I need to implement a query when the results are returned, from that I need to take one field value then need to get another result from the field, From the above screenshot, I got some results based on … --- ## [Group by and having max field](https://discuss.elastic.co/t/group-by-and-having-max-field/300519)
**Author:** [@brknlpr](https://discuss.elastic.co/u/brknlpr)\ **Replies:** 2\ **Last updated:** [March 25, 2022, 6:05am UTC](https://discuss.elastic.co/t/group-by-and-having-max-field/300519 "2022-03-25T06:05:20Z")
Hi I have a data in kibana as below What I am trying to do is to get the only journeyId.keyword 's which has max IndexInEntry for example this is the response I want to get c4ca5cfaedbfa3f6de4feb1590002c50 3 c9f6d… --- ## [How to Export to CSV of APM Log](https://discuss.elastic.co/t/how-to-export-to-csv-of-apm-log/300301)
**Author:** [@Sharma3007](https://discuss.elastic.co/u/Sharma3007)\ **Replies:** 1\ **Last updated:** [March 25, 2022, 4:25am UTC](https://discuss.elastic.co/t/how-to-export-to-csv-of-apm-log/300301 "2022-03-25T04:25:12Z")
Hi Team, We are successfully able to configure APM transection log in Kibana & we are able to see all the APM logs related information on Kibana. But our requirement is to export all those logs in one excel or pdf repo… --- ## [Sort before pagination](https://discuss.elastic.co/t/sort-before-pagination/300617)
**Author:** [@Rushil\_Patel](https://discuss.elastic.co/u/Rushil_Patel)\ **Replies:** 1\ **Last updated:** [March 25, 2022, 4:17am UTC](https://discuss.elastic.co/t/sort-before-pagination/300617 "2022-03-25T04:17:14Z")
Hey I am trying to sort and paginate the result simultaneously, but I am not getting the expected result. NOTE: we are using 6.1 version Example: data = \[ { level : 0 time: some date ... other fields } , { level: 1 t… --- ## [Is there a way to automatically apply a mapping?](https://discuss.elastic.co/t/is-there-a-way-to-automatically-apply-a-mapping/300632)
**Author:** [@johnrodey](https://discuss.elastic.co/u/johnrodey)\ **Replies:** 1\ **Last updated:** [March 25, 2022, 4:04am UTC](https://discuss.elastic.co/t/is-there-a-way-to-automatically-apply-a-mapping/300632 "2022-03-25T04:04:11Z")
Currently I have an API that on initialization checks if my index exists, if not it creates it and applies my mapping, then allows the client to index documents. By and large this works well however sometimes we run int… --- ## [How to complete a common word from bunch of docs](https://discuss.elastic.co/t/how-to-complete-a-common-word-from-bunch-of-docs/300549)
**Author:** [@casparxu](https://discuss.elastic.co/u/casparxu)\ **Replies:** 2\ **Last updated:** [March 25, 2022, 2:47am UTC](https://discuss.elastic.co/t/how-to-complete-a-common-word-from-bunch-of-docs/300549 "2022-03-25T02:47:12Z")
Hi there, I'm trying to use 'search\_as\_you\_type' for auto complete. I got the idea of how this works, but stuck with a basic scneario. for exmaple I have a field with type 'search\_as\_you\_type' { "mappings": { "p… [Previous page](https://discuss.elastic.co/latest.md?page=1200) [Next page](https://discuss.elastic.co/latest.md?page=1202)