# Latest **URL:** https://discuss.elastic.co/latest.md?page=1227 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1228 --- ## [Dropping specific container labels from fields](https://discuss.elastic.co/t/dropping-specific-container-labels-from-fields/298309)
**Author:** [@Dario\_Louzado](https://discuss.elastic.co/u/Dario_Louzado)\ **Replies:** 2\ **Last updated:** [March 8, 2022, 12:47pm UTC](https://discuss.elastic.co/t/dropping-specific-container-labels-from-fields/298309 "2022-03-08T12:47:13Z")
Hello. I'm trying to clean-up my logging events as much as possible in order to save bandwidth and disk space in Elasticsearch. I want to delete specific labels and preserve others. Below is my full YAML file: name: … --- ## [Create Pie Chart](https://discuss.elastic.co/t/create-pie-chart/298887)
**Author:** [@cris](https://discuss.elastic.co/u/cris)\ **Replies:** 1\ **Last updated:** [March 8, 2022, 12:30pm UTC](https://discuss.elastic.co/t/create-pie-chart/298887 "2022-03-08T12:30:34Z")
Hi Community! I want make a pie chart with some data but I don´t know how to do it. I have a doc that looks like: { Login: passed, Country: Spain, Logout: passed } I have diferent docs with diferent countries, lik… --- ## [Problem with metricbeat to monitor one cluster with security enabled and the other one without security enabled](https://discuss.elastic.co/t/problem-with-metricbeat-to-monitor-one-cluster-with-security-enabled-and-the-other-one-without-security-enabled/297903)
**Author:** [@AitorGomezSanz](https://discuss.elastic.co/u/AitorGomezSanz)\ **Replies:** 0\ **Last updated:** [February 22, 2022, 1:38pm UTC](https://discuss.elastic.co/t/problem-with-metricbeat-to-monitor-one-cluster-with-security-enabled-and-the-other-one-without-security-enabled/297903 "2022-02-22T13:38:35Z")
Hi, I have a problem, because I have two clusters, one of these clusters (cluster1) has xpack security enabled, and the other one doesn't have security enabled (cluster2). The problem is that I want to monitor cluster1 … --- ## [The aggregation series\_agg is not supported in entire\_time\_range mode](https://discuss.elastic.co/t/the-aggregation-series-agg-is-not-supported-in-entire-time-range-mode/298846)
**Author:** [@d71247](https://discuss.elastic.co/u/d71247)\ **Replies:** 1\ **Last updated:** [March 8, 2022, 12:25pm UTC](https://discuss.elastic.co/t/the-aggregation-series-agg-is-not-supported-in-entire-time-range-mode/298846 "2022-03-08T12:25:29Z")
After upgrading our kibana instance from 7.4 to 7.16.3 , we saw errors in our Visualizes tsvb "The aggregation series\_agg is not supported in entire\_time\_range mode" --- ## [Filebeat should omit timestamp in logs when ran via systemd](https://discuss.elastic.co/t/filebeat-should-omit-timestamp-in-logs-when-ran-via-systemd/299087)
**Author:** [@XANi](https://discuss.elastic.co/u/XANi)\ **Replies:** 0\ **Last updated:** [March 8, 2022, 12:20pm UTC](https://discuss.elastic.co/t/filebeat-should-omit-timestamp-in-logs-when-ran-via-systemd/299087 "2022-03-08T12:20:46Z")
Currently logs via systemd look like this: Mar 08 13:13:10 appserv1 filebeat\[22055\]: 2022-03-08T13:13:10.657+0100 INFO instance/beat.go:694 Beat ID: 70152ff2-5b2e-4c03-a60c-eedffb110c54 and the timestamp is doub… --- ## [Query on responded output](https://discuss.elastic.co/t/query-on-responded-output/298907)
**Author:** [@Tanvir\_Ahmmed](https://discuss.elastic.co/u/Tanvir_Ahmmed)\ **Replies:** 0\ **Last updated:** [March 6, 2022, 9:27am UTC](https://discuss.elastic.co/t/query-on-responded-output/298907 "2022-03-06T09:27:23Z")
How to write a conditional query on multiple fields? Explain: I have an index let say "case" and the fields are "title", "secondTitle(contain nested obj)", "source(contain nested obj)". Now I want to search on title and… --- ## [Hide "-" valued entries in predefined metricbeat dashboard](https://discuss.elastic.co/t/hide-valued-entries-in-predefined-metricbeat-dashboard/297524)
**Author:** [@Jonas\_S](https://discuss.elastic.co/u/Jonas_S)\ **Replies:** 1\ **Last updated:** [March 8, 2022, 12:13pm UTC](https://discuss.elastic.co/t/hide-valued-entries-in-predefined-metricbeat-dashboard/297524 "2022-03-08T12:13:31Z")
Hello, i just set up metricbeat with the predefined kibana dashboards. Is it possible to hide all entries with a "-" value, that are on top and look like they have 100%? I tried a filter on the field with 0% to 100… --- ## [Pipeline error : java.lang.OutOfMemoryError: Java heap space](https://discuss.elastic.co/t/pipeline-error-java-lang-outofmemoryerror-java-heap-space/299081)
**Author:** [@Sara\_Chater](https://discuss.elastic.co/u/Sara_Chater)\ **Replies:** 0\ **Last updated:** [March 8, 2022, 11:32am UTC](https://discuss.elastic.co/t/pipeline-error-java-lang-outofmemoryerror-java-heap-space/299081 "2022-03-08T11:32:37Z")
Dear community, I have a log file that contains multiple entries per transaction id Entries are ordered in file, but not necessary one after each other I tried using logstash aggregate filter as follow : My idea is to… --- ## [Document table with duplicate records](https://discuss.elastic.co/t/document-table-with-duplicate-records/298066)
**Author:** [@rituzza](https://discuss.elastic.co/u/rituzza)\ **Replies:** 1\ **Last updated:** [March 8, 2022, 11:18am UTC](https://discuss.elastic.co/t/document-table-with-duplicate-records/298066 "2022-03-08T11:18:22Z")
I have a problem: when importing a document table created on kibana v7.7.1 on a kibana v7.14.1, I have duplicate records that determine me wrong totals on the metrics. Opening the visualization in edit, as if I wanted to… --- ## [Config directory location for token filter helper files](https://discuss.elastic.co/t/config-directory-location-for-token-filter-helper-files/299078)
**Author:** [@Gabor\_Gergely](https://discuss.elastic.co/u/Gabor_Gergely)\ **Replies:** 0\ **Last updated:** [March 8, 2022, 10:48am UTC](https://discuss.elastic.co/t/config-directory-location-for-token-filter-helper-files/299078 "2022-03-08T10:48:01Z")
I want to use token filters which require some helper files in the config directory (e.g. the hyphenation decompounder token filter, which requires an xml file in the hyphenation\_patterns\_path parameter). The docs says:… --- ## [How can I use standard SQL on text fields of elastic without using the specials SQL elasticSearch operators?](https://discuss.elastic.co/t/how-can-i-use-standard-sql-on-text-fields-of-elastic-without-using-the-specials-sql-elasticsearch-operators/299057)
**Author:** [@shiranOren](https://discuss.elastic.co/u/shiranOren)\ **Replies:** 0\ **Last updated:** [March 8, 2022, 8:47am UTC](https://discuss.elastic.co/t/how-can-i-use-standard-sql-on-text-fields-of-elastic-without-using-the-specials-sql-elasticsearch-operators/299057 "2022-03-08T08:47:36Z")
I would like to create SQL query on some text field (not keyword) for example "name" field and send that query to elastic server. my problem is that I need to use the standard SQL language (not the MATCH and QUERY opera… --- ## [ELK servers required for training](https://discuss.elastic.co/t/elk-servers-required-for-training/299047)
**Author:** [@Nasser](https://discuss.elastic.co/u/Nasser)\ **Replies:** 1\ **Last updated:** [March 8, 2022, 9:47am UTC](https://discuss.elastic.co/t/elk-servers-required-for-training/299047 "2022-03-08T09:47:53Z")
Hi i'm preparing for the elastic exam and i want to setup an env for training. what is the minimum space to run ELK stack without any issue ? and how many node required ? thanks --- ## [Use terms in events yesterday to for filter when documents appears the last week](https://discuss.elastic.co/t/use-terms-in-events-yesterday-to-for-filter-when-documents-appears-the-last-week/299063)
**Author:** [@Silver137](https://discuss.elastic.co/u/Silver137)\ **Replies:** 0\ **Last updated:** [March 8, 2022, 9:45am UTC](https://discuss.elastic.co/t/use-terms-in-events-yesterday-to-for-filter-when-documents-appears-the-last-week/299063 "2022-03-08T09:45:24Z")
My use case requires search when some documents appears in the last 7 days based on the terms present in the documents exactly yesterday. I want to avoid make two querys one for query the terms yesterday and another to … --- ## [Java way to analyze a field with two analyzers](https://discuss.elastic.co/t/java-way-to-analyze-a-field-with-two-analyzers/299050)
**Author:** [@dishant.sharma](https://discuss.elastic.co/u/dishant.sharma)\ **Replies:** 1\ **Last updated:** [March 8, 2022, 9:44am UTC](https://discuss.elastic.co/t/java-way-to-analyze-a-field-with-two-analyzers/299050 "2022-03-08T09:44:44Z")
I want to analyze an email with two different custom analyzers at the same time. One analyzer will extract the words from it and another one will extract the special characters from it. And, I want to return the result r… --- ## [How to count exact unique APM transactions](https://discuss.elastic.co/t/how-to-count-exact-unique-apm-transactions/298949)
**Author:** [@ZZ.IT](https://discuss.elastic.co/u/ZZ.IT)\ **Replies:** 3\ **Last updated:** [March 8, 2022, 9:32am UTC](https://discuss.elastic.co/t/how-to-count-exact-unique-apm-transactions/298949 "2022-03-08T09:32:38Z")
We are using ELK stack on windows server 2016. ELK stack has version 7.16.2. I want to count the number of transactions on this URL. I don't know if its possible. its because we want to know how many times this link wa… --- ## [Send custom data to Elastic](https://discuss.elastic.co/t/send-custom-data-to-elastic/299060)
**Author:** [@nfeliciano](https://discuss.elastic.co/u/nfeliciano)\ **Replies:** 0\ **Last updated:** [March 8, 2022, 9:31am UTC](https://discuss.elastic.co/t/send-custom-data-to-elastic/299060 "2022-03-08T09:31:41Z")
Hello, I've been using metricbeat to monitor machine standard values successfully, like cpu memory and io. I can plot the values on the Kibana dashboards. Now I also want to send application custom data. I can extract … --- ## [.NET Profiler does not trace/show MySQL transactions](https://discuss.elastic.co/t/net-profiler-does-not-trace-show-mysql-transactions/297591)
**Author:** [@Danny\_Stommen](https://discuss.elastic.co/u/Danny_Stommen)\ **Replies:** 13\ **Last updated:** [March 8, 2022, 9:29am UTC](https://discuss.elastic.co/t/net-profiler-does-not-trace-show-mysql-transactions/297591 "2022-03-08T09:29:47Z")
Hi, I'm trying to get insights in our MySQL queries in our APM transactions. I've been following this guide: Profiler Auto instrumentation | APM .NET Agent Reference \[master\] | Elastic Our application is containerized… --- ## [Parsing message field from CEF logs](https://discuss.elastic.co/t/parsing-message-field-from-cef-logs/298392)
**Author:** [@janis.cimins](https://discuss.elastic.co/u/janis.cimins)\ **Replies:** 4\ **Last updated:** [March 8, 2022, 8:54am UTC](https://discuss.elastic.co/t/parsing-message-field-from-cef-logs/298392 "2022-03-08T08:54:45Z")
Hello all! I am really new to this whole Elasticsearch field. I have come across problem. I have built my Elastic SIEM laboratory and I have logs from on of my other products - Secret Server. I\`m receiving the logs just… --- ## [Need for syntax and semantix - GROK filter](https://discuss.elastic.co/t/need-for-syntax-and-semantix-grok-filter/298404)
**Author:** [@Clyton](https://discuss.elastic.co/u/Clyton)\ **Replies:** 1\ **Last updated:** [March 8, 2022, 8:27am UTC](https://discuss.elastic.co/t/need-for-syntax-and-semantix-grok-filter/298404 "2022-03-08T08:27:32Z")
Hi All, I would like to grep the below numeric value before the keyword "DEBUG" from the message field and map it to a new field called OrderID. Kindly let us know the pattern we can apply in order to achieve this conte… --- ## [Convert a dashboard from 7.16 to 7.14](https://discuss.elastic.co/t/convert-a-dashboard-from-7-16-to-7-14/298946)
**Author:** [@khouloud1](https://discuss.elastic.co/u/khouloud1)\ **Replies:** 1\ **Last updated:** [March 8, 2022, 8:05am UTC](https://discuss.elastic.co/t/convert-a-dashboard-from-7-16-to-7-14/298946 "2022-03-08T08:05:35Z")
Hello , i did import a dashboard 7.16 to my kibana 7.14 but it doesn't work because it isn't compatible. Can you help me please to convert this dashboard to be compatible with my EK 7.14 https://raw.githubusercon… --- ## [Some indices do not show datetime filter](https://discuss.elastic.co/t/some-indices-do-not-show-datetime-filter/299018)
**Author:** [@markand.bhatt](https://discuss.elastic.co/u/markand.bhatt)\ **Replies:** 2\ **Last updated:** [March 8, 2022, 7:59am UTC](https://discuss.elastic.co/t/some-indices-do-not-show-datetime-filter/299018 "2022-03-08T07:59:21Z")
I wonder some of my indices show datetime filter in KQL kibana, some not. Could someone please guide me, any setting in kibana or elastic to show datetime filter? --- ## [Query for IP External IP Addresses Only](https://discuss.elastic.co/t/query-for-ip-external-ip-addresses-only/299024)
**Author:** [@Wilks](https://discuss.elastic.co/u/Wilks)\ **Replies:** 1\ **Last updated:** [March 8, 2022, 7:55am UTC](https://discuss.elastic.co/t/query-for-ip-external-ip-addresses-only/299024 "2022-03-08T07:55:43Z")
Hi, I am trying to use a KQL query to search for non private (rfc1918) addresses. I am using the following query AND NOT destination.ip:10.0.0.0/8 OR NOT destination.ip:192.168.0.0/16 OR NOT destination.ip :172.16.0.0… --- ## [Apm server error logs-apm.error not found](https://discuss.elastic.co/t/apm-server-error-logs-apm-error-not-found/298766)
**Author:** [@swchandu](https://discuss.elastic.co/u/swchandu)\ **Replies:** 2\ **Last updated:** [March 8, 2022, 6:54am UTC](https://discuss.elastic.co/t/apm-server-error-logs-apm-error-not-found/298766 "2022-03-08T06:54:29Z")
Hi, I have done an upgrade to Elasticsearch 8 and after this, I am finding a strange message in the apm server (8.0.0) logs "precondition 'apm integration installed' failed: error querying Elasticsearch for integration… --- ## [Elasticsearch index](https://discuss.elastic.co/t/elasticsearch-index/298257)
**Author:** [@umangpatel](https://discuss.elastic.co/u/umangpatel)\ **Replies:** 29\ **Last updated:** [March 8, 2022, 5:42am UTC](https://discuss.elastic.co/t/elasticsearch-index/298257 "2022-03-08T05:42:10Z")
I have to remove old data of apiman-indices in Elasticsearch which contain .pos, .cf or any other extension. So how can we remove the old indices? --- ## [Elasticsearch bulk error - must be terminated by a newline](https://discuss.elastic.co/t/elasticsearch-bulk-error-must-be-terminated-by-a-newline/299037)
**Author:** [@kobalt](https://discuss.elastic.co/u/kobalt)\ **Replies:** 1\ **Last updated:** [March 8, 2022, 5:20am UTC](https://discuss.elastic.co/t/elasticsearch-bulk-error-must-be-terminated-by-a-newline/299037 "2022-03-08T05:20:41Z")
trying to use a elasticsearch bulk api. e.g. the following bulk request succeeds $ curl -X POST "localhost:9200/test/\_bulk?pretty" -H 'Content-Type: application/json' -d ' {"index":{"\_id":1}} {"foo":"foo"} {"index":{"\_i… --- ## [Elasticsearch Log deletion not happening as per defined days in log4j.pproperties file](https://discuss.elastic.co/t/elasticsearch-log-deletion-not-happening-as-per-defined-days-in-log4j-pproperties-file/299038)
**Author:** [@pratikshatiwari](https://discuss.elastic.co/u/pratikshatiwari)\ **Replies:** 0\ **Last updated:** [March 8, 2022, 5:07am UTC](https://discuss.elastic.co/t/elasticsearch-log-deletion-not-happening-as-per-defined-days-in-log4j-pproperties-file/299038 "2022-03-08T05:07:12Z")
Dear Team, We are facing an issue where Elasticsearch logging with log4j2.properties not performing the log rotation on the basis of lfLastmodified age condition, we want to rotate the logs every after 7days but it is n… --- ## [How to Properly Use The Roles in values.yaml?](https://discuss.elastic.co/t/how-to-properly-use-the-roles-in-values-yaml/298962)
**Author:** [@lloyd01sanchez12](https://discuss.elastic.co/u/lloyd01sanchez12)\ **Replies:** 3\ **Last updated:** [March 8, 2022, 4:43am UTC](https://discuss.elastic.co/t/how-to-properly-use-the-roles-in-values-yaml/298962 "2022-03-08T04:43:58Z")
Hi Team, I've been having a problem correcting the deprecation warnings related to node.roles: "message": "legacy role settings \[node.data, node.remote\_cluster\_client, node.ingest, node.master, node.ml\] are deprecated,… --- ## [Strange data type error after upgraded ELK to 8.0 - "failed to parse date field \[...\]"](https://discuss.elastic.co/t/strange-data-type-error-after-upgraded-elk-to-8-0-failed-to-parse-date-field/299031)
**Author:** [@pinehk](https://discuss.elastic.co/u/pinehk)\ **Replies:** 0\ **Last updated:** [March 8, 2022, 3:07am UTC](https://discuss.elastic.co/t/strange-data-type-error-after-upgraded-elk-to-8-0-failed-to-parse-date-field/299031 "2022-03-08T03:07:12Z")
Upgraded ELK from 7.15 to 8.0, basic configurations are unchanged. But in 8.0, a CSV filter suddenly broke at unit test, failing to process a line that worked perfectly fine in 7. The error is "caused\_by"=\>{"type"=\>"i… --- ## [Kibana logstash Snapshot Storage Size continuously growing its size](https://discuss.elastic.co/t/kibana-logstash-snapshot-storage-size-continuously-growing-its-size/299023)
**Author:** [@renatoa12](https://discuss.elastic.co/u/renatoa12)\ **Replies:** 3\ **Last updated:** [March 8, 2022, 2:08am UTC](https://discuss.elastic.co/t/kibana-logstash-snapshot-storage-size-continuously-growing-its-size/299023 "2022-03-08T02:08:24Z")
Hi Community, Does anyone here experience that their Snapshot storage size continuously growing, currently i have 200gb snapshot size and still growing for march 3 logs, normally the size per day of snapshot ranging 50-… --- ## [Certificate doesn't match any of the subject alternative names](https://discuss.elastic.co/t/certificate-doesnt-match-any-of-the-subject-alternative-names/298091)
**Author:** [@cyberzlo](https://discuss.elastic.co/u/cyberzlo)\ **Replies:** 2\ **Last updated:** [March 8, 2022, 1:20am UTC](https://discuss.elastic.co/t/certificate-doesnt-match-any-of-the-subject-alternative-names/298091 "2022-03-08T01:20:38Z")
Since update to ELK 8 there is following problem: \[2022-02-23T23:18:41,619\]\[WARN \]\[logstash.outputs.elasticsearch\]\[main\] Failed to perform request {:message=\>"Certificate for \ doesn't match any of the sub… [Previous page](https://discuss.elastic.co/latest.md?page=1226) [Next page](https://discuss.elastic.co/latest.md?page=1228)