# Latest **URL:** https://discuss.elastic.co/latest.md?page=1203 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1204 --- ## [What are the limitations of array size at document in elastic search?](https://discuss.elastic.co/t/what-are-the-limitations-of-array-size-at-document-in-elastic-search/300602)
**Author:** [@AhmadHamouda](https://discuss.elastic.co/u/AhmadHamouda)\ **Replies:** 0\ **Last updated:** [March 24, 2022, 4:02pm UTC](https://discuss.elastic.co/t/what-are-the-limitations-of-array-size-at-document-in-elastic-search/300602 "2022-03-24T16:02:17Z")
I have document which have array. { "id" :1, "UserIds":\[1,2,4\] } Given that UserIds is indexed field What are the performance implications of having several elements on UserIds Array on search? Also why when se… --- ## [End to end Testing](https://discuss.elastic.co/t/end-to-end-testing/300598)
**Author:** [@AliBaba](https://discuss.elastic.co/u/AliBaba)\ **Replies:** 0\ **Last updated:** [March 24, 2022, 3:28pm UTC](https://discuss.elastic.co/t/end-to-end-testing/300598 "2022-03-24T15:28:10Z")
Hi, A quick question relating the end to end testing using Nest in c#. I was able to setup an InMemoryConnection for Elasticsearch and be able to get a mock response when I do the search query. The problem is when I ru… --- ## [Log .NET Runtime source is not recovering](https://discuss.elastic.co/t/log-net-runtime-source-is-not-recovering/300463)
**Author:** [@lsbitri88](https://discuss.elastic.co/u/lsbitri88)\ **Replies:** 2\ **Last updated:** [March 24, 2022, 3:26pm UTC](https://discuss.elastic.co/t/log-net-runtime-source-is-not-recovering/300463 "2022-03-24T15:26:10Z")
Hi, the winlogs from the .Net Runtime source with the message below are not recovered \ **Author:** [@Sako](https://discuss.elastic.co/u/Sako)\ **Replies:** 4\ **Last updated:** [March 24, 2022, 3:24pm UTC](https://discuss.elastic.co/t/ecs-difference-between-event-id-and-event-code/299924 "2022-03-24T15:24:35Z") Hi, I have a question regarding the usage of the ECS fields event.id and event.code. What is the intended difference between these two fields? Is there any guidance on how to use them? The example for event.code refer… --- ## [How to understand translog stats](https://discuss.elastic.co/t/how-to-understand-translog-stats/300507)
**Author:** [@jthoni](https://discuss.elastic.co/u/jthoni)\ **Replies:** 2\ **Last updated:** [March 24, 2022, 3:12pm UTC](https://discuss.elastic.co/t/how-to-understand-translog-stats/300507 "2022-03-24T15:12:06Z")
We are seeing the situation where when we restart ES, there is a long recovery time for the shards. The service is down usually for only about 90 seconds, but the recovery can be an hour or so. During my investigation, I… --- ## [How to convert Date to specific format and string to amount conversion](https://discuss.elastic.co/t/how-to-convert-date-to-specific-format-and-string-to-amount-conversion/300591)
**Author:** [@slj](https://discuss.elastic.co/u/slj)\ **Replies:** 0\ **Last updated:** [March 24, 2022, 3:10pm UTC](https://discuss.elastic.co/t/how-to-convert-date-to-specific-format-and-string-to-amount-conversion/300591 "2022-03-24T15:10:46Z")
I am trying to create a aggregation query to filter data if 2 columns in same index is matching. My InputDate is '2022-03-02T03:33:34.000Z' format and exeDate in '2022-03-02'. if both dates are same then need to sum up t… --- ## [Unable to start filebeat getting Exiting: couldn't connect to any of the configured Elasticsearch hosts. Errors: \[error connecting to Elasticsearch at http://localhost:5601: Failed to parse JSON response: invalid character '\<' l](https://discuss.elastic.co/t/unable-to-start-filebeat-getting-exiting-couldnt-connect-to-any-of-the-configured-elasticsearch-hosts-errors-error-connecting-to-elasticsearch-at-http-localhost-failed-to-parse-json-response-invalid-character-l/300412)
**Author:** [@sureshaws](https://discuss.elastic.co/u/sureshaws)\ **Replies:** 3\ **Last updated:** [March 24, 2022, 3:01pm UTC](https://discuss.elastic.co/t/unable-to-start-filebeat-getting-exiting-couldnt-connect-to-any-of-the-configured-elasticsearch-hosts-errors-error-connecting-to-elasticsearch-at-http-localhost-failed-to-parse-json-response-invalid-character-l/300412 "2022-03-24T15:01:14Z")
Getting the below error Exiting: couldn't connect to any of the configured Elasticsearch hosts. Errors: \[error connecting to Elasticsearch at http://localhost:5601: Failed to parse JSON response: invalid character '\<' l … --- ## [Need Some Advice Regarding Data Ingestion](https://discuss.elastic.co/t/need-some-advice-regarding-data-ingestion/299859)
**Author:** [@tthiry](https://discuss.elastic.co/u/tthiry)\ **Replies:** 1\ **Last updated:** [March 24, 2022, 2:58pm UTC](https://discuss.elastic.co/t/need-some-advice-regarding-data-ingestion/299859 "2022-03-24T14:58:19Z")
Hello, I am ingesting Windows certificate data via winlogbeat and the "Microsoft-Windows-CertificateServicesClient-Lifecycle-System/Operational" channel to I can track certificates that are expiring. I am using the "inc… --- ## [Filebeat 8.1 locks renamed rolling logs forever](https://discuss.elastic.co/t/filebeat-8-1-locks-renamed-rolling-logs-forever/300428)
**Author:** [@alytkowski](https://discuss.elastic.co/u/alytkowski)\ **Replies:** 1\ **Last updated:** [March 24, 2022, 2:58pm UTC](https://discuss.elastic.co/t/filebeat-8-1-locks-renamed-rolling-logs-forever/300428 "2022-03-24T14:58:11Z")
After switching from Filebeat 7.17 to Filebeat 8.1 and introducing type filestream into our configuration, it seems that Filebeat locks renamed logs forever, causing disk space issues. We have a log4j based logs that ro… --- ## [How configuration options Auditbeat in windows 10](https://discuss.elastic.co/t/how-configuration-options-auditbeat-in-windows-10/300455)
**Author:** [@nour41\_nour41](https://discuss.elastic.co/u/nour41_nour41)\ **Replies:** 1\ **Last updated:** [March 24, 2022, 2:55pm UTC](https://discuss.elastic.co/t/how-configuration-options-auditbeat-in-windows-10/300455 "2022-03-24T14:55:31Z")
how configuration options Auditbeat in windows 10 --- ## [Can't open ElasticSearch on browser from outside the server](https://discuss.elastic.co/t/cant-open-elasticsearch-on-browser-from-outside-the-server/229717)
**Author:** [@Hamza\_Dev](https://discuss.elastic.co/u/Hamza_Dev)\ **Replies:** 6\ **Last updated:** [March 24, 2022, 2:43pm UTC](https://discuss.elastic.co/t/cant-open-elasticsearch-on-browser-from-outside-the-server/229717 "2022-03-24T14:43:11Z")
Hi , I'm new with ES I've installed it from the official site on an Azure VM with Centos 7 System, it's successfully installed, when I start the service it started correctly, and when I check the availability of ES, usi… --- ## [How do I verify that packetbeat transmits data to Elasticsearch](https://discuss.elastic.co/t/how-do-i-verify-that-packetbeat-transmits-data-to-elasticsearch/300297)
**Author:** [@BlackFox](https://discuss.elastic.co/u/BlackFox)\ **Replies:** 1\ **Last updated:** [March 24, 2022, 2:22pm UTC](https://discuss.elastic.co/t/how-do-i-verify-that-packetbeat-transmits-data-to-elasticsearch/300297 "2022-03-24T14:22:59Z")
Now I have two hosts. ES and Kibana are deployed on host A (Ubuntu, single network card) and packetbeat is deployed on host B (Ubuntu, dual network card). Host B can open ports 9200 and 5601 of host A by using Firefox b… --- ## [Logstash 8.1.0 No appropriate protocol (protocol is disabled or cipher suites are inappropriate)](https://discuss.elastic.co/t/logstash-8-1-0-no-appropriate-protocol-protocol-is-disabled-or-cipher-suites-are-inappropriate/300582)
**Author:** [@nandatibco](https://discuss.elastic.co/u/nandatibco)\ **Replies:** 0\ **Last updated:** [March 24, 2022, 2:18pm UTC](https://discuss.elastic.co/t/logstash-8-1-0-no-appropriate-protocol-protocol-is-disabled-or-cipher-suites-are-inappropriate/300582 "2022-03-24T14:18:14Z")
Hello team, I'm using Logstash 8.1.0 with plugin: logstash-input-websocket, when I start Logstash getting below error: \[WARN \]\[logstash.inputs.websocket\]\[main\]\[a0cd44e8c7bfa2705bff3d19091209cb115076d1199fdf41b74beb730f… --- ## [Faceted Search-Navigation where counts should not be updated for the siblings of a group when it is active](https://discuss.elastic.co/t/faceted-search-navigation-where-counts-should-not-be-updated-for-the-siblings-of-a-group-when-it-is-active/300107)
**Author:** [@droplet](https://discuss.elastic.co/u/droplet)\ **Replies:** 5\ **Last updated:** [March 24, 2022, 1:46pm UTC](https://discuss.elastic.co/t/faceted-search-navigation-where-counts-should-not-be-updated-for-the-siblings-of-a-group-when-it-is-active/300107 "2022-03-24T13:46:59Z")
Hello, (data to play, at the end) I've been reading about faceted navigation and filtering and how it can be applied to ecommerce apps. So far I've managed to get the bellow example working. Facet Group 1 Facet Opti… --- ## [Installation problems - Public key not available](https://discuss.elastic.co/t/installation-problems-public-key-not-available/300571)
**Author:** [@user111](https://discuss.elastic.co/u/user111)\ **Replies:** 2\ **Last updated:** [March 24, 2022, 1:12pm UTC](https://discuss.elastic.co/t/installation-problems-public-key-not-available/300571 "2022-03-24T13:12:43Z")
Dear community, I´m trying to install the ELK Stack as explained in the official documentation here: I´m running a Ubuntu 18.04 machine and I´m getting the following error while executing sudo apt-get update && sudo a… --- ## [Issues trying to enable FIPS 140-2 on Centos 8](https://discuss.elastic.co/t/issues-trying-to-enable-fips-140-2-on-centos-8/300505)
**Author:** [@ryann](https://discuss.elastic.co/u/ryann)\ **Replies:** 2\ **Last updated:** [March 24, 2022, 1:16pm UTC](https://discuss.elastic.co/t/issues-trying-to-enable-fips-140-2-on-centos-8/300505 "2022-03-24T13:16:27Z")
Trying to enable FIPS mode in Elasticsearch and running into issues. When using default bundled JVM with FIPS mode enabled configuration passes bootstrap checks. Enabled fips globally in Centos and pointed systemd file t… --- ## [How to create advanced visualization in Kibana?](https://discuss.elastic.co/t/how-to-create-advanced-visualization-in-kibana/300534)
**Author:** [@ninamarie0](https://discuss.elastic.co/u/ninamarie0)\ **Replies:** 2\ **Last updated:** [March 24, 2022, 12:38pm UTC](https://discuss.elastic.co/t/how-to-create-advanced-visualization-in-kibana/300534 "2022-03-24T12:38:38Z")
Hi. I am new to Kibana and are struggling to find out how to create more "advanced" visualizations. I have already created a dashboard of more simple metrics and charts, but now i want to take the next step. My data c… --- ## [Sum of all values in table visual kibana](https://discuss.elastic.co/t/sum-of-all-values-in-table-visual-kibana/300522)
**Author:** [@Naga\_Prudhvi](https://discuss.elastic.co/u/Naga_Prudhvi)\ **Replies:** 2\ **Last updated:** [March 24, 2022, 12:33pm UTC](https://discuss.elastic.co/t/sum-of-all-values-in-table-visual-kibana/300522 "2022-03-24T12:33:24Z")
Hi all, I need to add a table view in my kibana dashboard with a sum for all columns like Excel. (see the picture. Is there any idea. --- ## [Get sequential relation of keys in a json file in ruby logstash](https://discuss.elastic.co/t/get-sequential-relation-of-keys-in-a-json-file-in-ruby-logstash/300566)
**Author:** [@zubair\_aftab](https://discuss.elastic.co/u/zubair_aftab)\ **Replies:** 0\ **Last updated:** [March 24, 2022, 11:44am UTC](https://discuss.elastic.co/t/get-sequential-relation-of-keys-in-a-json-file-in-ruby-logstash/300566 "2022-03-24T11:44:38Z")
I have a json file of a packet capture. It has multiple layers in 1 message as shown in below example. block 1: mtp3 = 1 map = 1 block 2: mtp3 =2 bicc =2 When i process the file in logstash it combines the similar… --- ## [Migration HLRC PutIndexTemplateRequest to ES 8.1.0](https://discuss.elastic.co/t/migration-hlrc-putindextemplaterequest-to-es-8-1-0/300491)
**Author:** [@Raushan](https://discuss.elastic.co/u/Raushan)\ **Replies:** 2\ **Last updated:** [March 24, 2022, 11:07am UTC](https://discuss.elastic.co/t/migration-hlrc-putindextemplaterequest-to-es-8-1-0/300491 "2022-03-24T11:07:32Z")
Hi, I'm migrating from HLRC to ES8.1. We used to pass json data for settings and mappings in source. HLRC Code PutIndexTemplateRequest request = new PutIndexTemplateRequest(templateName); reques… --- ## [Kibana deprecation issues: Source configuration field "host name" is deprecated](https://discuss.elastic.co/t/kibana-deprecation-issues-source-configuration-field-host-name-is-deprecated/299997)
**Author:** [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Replies:** 9\ **Last updated:** [March 24, 2022, 10:44am UTC](https://discuss.elastic.co/t/kibana-deprecation-issues-source-configuration-field-host-name-is-deprecated/299997 "2022-03-24T10:44:03Z")
Hi all, I am trying to prepare to upgrade my elastic cluster to 8.1. On the Upgrade Assistant tab i've fixed most of the issue but then there is an issue that said: Source configuration field "host name" is deprecated.… --- ## [Why does a kibana lens pretend my fields have no data, when they clearly do?](https://discuss.elastic.co/t/why-does-a-kibana-lens-pretend-my-fields-have-no-data-when-they-clearly-do/300506)
**Author:** [@gcanyon](https://discuss.elastic.co/u/gcanyon)\ **Replies:** 9\ **Last updated:** [March 24, 2022, 10:43am UTC](https://discuss.elastic.co/t/why-does-a-kibana-lens-pretend-my-fields-have-no-data-when-they-clearly-do/300506 "2022-03-24T10:43:11Z")
I click on kibana I click on visualize I click on Create visualization I click on Lens The left column, under "Individual fields" says: "Looks like you don't have any data. Try extending the time range" I see that I am … --- ## [Name dependencies so not all are called mssql](https://discuss.elastic.co/t/name-dependencies-so-not-all-are-called-mssql/300350)
**Author:** [@AThomsen](https://discuss.elastic.co/u/AThomsen)\ **Replies:** 1\ **Last updated:** [March 24, 2022, 10:35am UTC](https://discuss.elastic.co/t/name-dependencies-so-not-all-are-called-mssql/300350 "2022-03-24T10:35:53Z")
.NET 6, using apm-agent-dotnet. My app is calling different SQL-Servers. In Dependencies and Service Maps, they show up as a single "mssql"-service. Is it possible to have them shown as different services with separate… --- ## [Event severity cisco for logstash](https://discuss.elastic.co/t/event-severity-cisco-for-logstash/300312)
**Author:** [@jojodd](https://discuss.elastic.co/u/jojodd)\ **Replies:** 2\ **Last updated:** [March 24, 2022, 10:20am UTC](https://discuss.elastic.co/t/event-severity-cisco-for-logstash/300312 "2022-03-24T10:20:56Z")
hello, if \[event\]\[severity\] == 7 - \> does not work in a pipeline to create a new index with do you have any idea how to make it work? infra with filebeat -\> logstash -\> Elasticsearch --- ## [Kafka with ELK](https://discuss.elastic.co/t/kafka-with-elk/300477)
**Author:** [@jojodd](https://discuss.elastic.co/u/jojodd)\ **Replies:** 2\ **Last updated:** [March 24, 2022, 10:17am UTC](https://discuss.elastic.co/t/kafka-with-elk/300477 "2022-03-24T10:17:08Z")
When installing kafka with the ELK suite, is it mandatory to install zookeeper if you take the latest version? help --- ## [Logstash Metricbeat field calculation](https://discuss.elastic.co/t/logstash-metricbeat-field-calculation/300242)
**Author:** [@PRASHANT\_MEHTA](https://discuss.elastic.co/u/PRASHANT_MEHTA)\ **Replies:** 2\ **Last updated:** [March 24, 2022, 9:58am UTC](https://discuss.elastic.co/t/logstash-metricbeat-field-calculation/300242 "2022-03-24T09:58:54Z")
I'm implementing ruby code through logstash pipeline,Unable to get desired fields created in kibana,what would be right approach to code in order to get desired result? Want to get CPU % by adding two fileds and divide … --- ## [Elasticsearch can't hanlde space after add analyzer](https://discuss.elastic.co/t/elasticsearch-cant-hanlde-space-after-add-analyzer/300509)
**Author:** [@Muhammad\_Fhadli](https://discuss.elastic.co/u/Muhammad_Fhadli)\ **Replies:** 2\ **Last updated:** [March 24, 2022, 9:35am UTC](https://discuss.elastic.co/t/elasticsearch-cant-hanlde-space-after-add-analyzer/300509 "2022-03-24T09:35:48Z")
I created an index called my\_index by this command { "settings": { "number\_of\_shards": 1, "analysis": { "filter": { "synonym": { "type": "synonym", … --- ## [Rules don't trigger and preview window is empty](https://discuss.elastic.co/t/rules-dont-trigger-and-preview-window-is-empty/300137)
**Author:** [@Alex\_Bailey](https://discuss.elastic.co/u/Alex_Bailey)\ **Replies:** 6\ **Last updated:** [March 24, 2022, 9:26am UTC](https://discuss.elastic.co/t/rules-dont-trigger-and-preview-window-is-empty/300137 "2022-03-24T09:26:19Z")
Working with Elastic 8.1 stack and I can't seem to get rules to work for me no matter what I try. I have a rule defined as so: When I run the preview, this brings back no results: The request generated in this q… --- ## [Logs not arriving with docker-compose](https://discuss.elastic.co/t/logs-not-arriving-with-docker-compose/300524)
**Author:** [@Arraso26](https://discuss.elastic.co/u/Arraso26)\ **Replies:** 0\ **Last updated:** [March 24, 2022, 6:44am UTC](https://discuss.elastic.co/t/logs-not-arriving-with-docker-compose/300524 "2022-03-24T06:44:04Z")
Good, a couple of days ago I set up ELK and everything worked fine, but now that I have set it up in docker-compose and after configuring it I can't get the logs that I want to send from another machine to mine, I show y… --- ## [How to understand the error of reindex (request body is required)?](https://discuss.elastic.co/t/how-to-understand-the-error-of-reindex-request-body-is-required/300278)
**Author:** [@wajika](https://discuss.elastic.co/u/wajika)\ **Replies:** 7\ **Last updated:** [March 24, 2022, 9:02am UTC](https://discuss.elastic.co/t/how-to-understand-the-error-of-reindex-request-body-is-required/300278 "2022-03-24T09:02:05Z")
use reindex and want to rename iotmessages-000001 to iot\_prd\_iotmessage-000001. There are so many raw data. POST \_reindex?slices=5&refresh { "conflicts": "proceed", "source": { "index": "iotmessages-000001" … [Previous page](https://discuss.elastic.co/latest.md?page=1202) [Next page](https://discuss.elastic.co/latest.md?page=1204)