# Latest **URL:** https://discuss.elastic.co/latest.md?page=1229 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1230 --- ## [Filebeat: MISP automation](https://discuss.elastic.co/t/filebeat-misp-automation/298963)
**Author:** [@filip.wozniak](https://discuss.elastic.co/u/filip.wozniak)\ **Replies:** 0\ **Last updated:** [March 7, 2022, 12:08pm UTC](https://discuss.elastic.co/t/filebeat-misp-automation/298963 "2022-03-07T12:08:03Z")
Greetings! Is there any way to make MISP module update deleted entries from MISP so they will be deleted also in Elasticsearch? Yours, Filip --- ## [Flush syncing on rotated indicies](https://discuss.elastic.co/t/flush-syncing-on-rotated-indicies/298911)
**Author:** [@stefws](https://discuss.elastic.co/u/stefws)\ **Replies:** 4\ **Last updated:** [March 7, 2022, 11:30am UTC](https://discuss.elastic.co/t/flush-syncing-on-rotated-indicies/298911 "2022-03-07T11:30:48Z")
Thinking about running an operation procedure that should do flushed sync on daily 'rotated' indices and wondering... Would this be a feasible and good idea and what to avoid? If we after midnight do synced flush per i… --- ## [Two DC cluster setup](https://discuss.elastic.co/t/two-dc-cluster-setup/298912)
**Author:** [@stefws](https://discuss.elastic.co/u/stefws)\ **Replies:** 2\ **Last updated:** [March 7, 2022, 11:29am UTC](https://discuss.elastic.co/t/two-dc-cluster-setup/298912 "2022-03-07T11:29:34Z")
Have startedin a new position where we currently have a two Data Center cluster with 5 master/data nodes + 1 master-only node and indices having replication of 1. Wondering if we better ought to do few (+3) dedicated ma… --- ## [Elasticsearch-dsl python connection timeout](https://discuss.elastic.co/t/elasticsearch-dsl-python-connection-timeout/293762)
**Author:** [@maph](https://discuss.elastic.co/u/maph)\ **Replies:** 6\ **Last updated:** [March 7, 2022, 10:19am UTC](https://discuss.elastic.co/t/elasticsearch-dsl-python-connection-timeout/293762 "2022-03-07T10:19:42Z")
Hi all, Fairly new to Elasticsearch and hoping that some of you might be able to help me troubleshoot an attempt to use the python Elasticsearch-dsl to perform a search in a public database? I am able to access the dat… --- ## [Create a dashboard using two different Data stream index](https://discuss.elastic.co/t/create-a-dashboard-using-two-different-data-stream-index/298388)
**Author:** [@niveditakathal](https://discuss.elastic.co/u/niveditakathal)\ **Replies:** 3\ **Last updated:** [March 7, 2022, 9:57am UTC](https://discuss.elastic.co/t/create-a-dashboard-using-two-different-data-stream-index/298388 "2022-03-07T09:57:48Z")
Hi Experts, I want to create a dashboard using two different Data stream index {as mentioned below under notes}. when I checked the available options to do so , I read about \_aliases option; however in my use-case that … --- ## [\[Vega\] Function setMapView not recognized anymore](https://discuss.elastic.co/t/vega-function-setmapview-not-recognized-anymore/296983)
**Author:** [@Kayak007](https://discuss.elastic.co/u/Kayak007)\ **Replies:** 5\ **Last updated:** [March 7, 2022, 9:01am UTC](https://discuss.elastic.co/t/vega-function-setmapview-not-recognized-anymore/296983 "2022-03-07T09:01:29Z")
Hi, Some time ago, when using 7.10.x, I used to use (...) the function setMapView in Vega visualizations in order to modify signals latitude, longitude and zoom simultaneously. I hadn't looked at these in quite some ti… --- ## [Logstash Performance](https://discuss.elastic.co/t/logstash-performance/298942)
**Author:** [@mani1](https://discuss.elastic.co/u/mani1)\ **Replies:** 0\ **Last updated:** [March 7, 2022, 8:46am UTC](https://discuss.elastic.co/t/logstash-performance/298942 "2022-03-07T08:46:41Z")
Hello , We have maximize the Logstash performance in terms of processed events per sec, by tuning vcpus, Heap, pipeline workers, Consumer Threads, N/w bandwidth, Batch size etc. There is no scarcity of resources assigne… --- ## [Elasticsearch automatic reindex](https://discuss.elastic.co/t/elasticsearch-automatic-reindex/298847)
**Author:** [@bianca6](https://discuss.elastic.co/u/bianca6)\ **Replies:** 3\ **Last updated:** [March 7, 2022, 8:25am UTC](https://discuss.elastic.co/t/elasticsearch-automatic-reindex/298847 "2022-03-07T08:25:38Z")
Hello, I am using a pipeline with Filebeat / Logstash / Elasticsearch / Kibana version 8 to deal with logs. One of the field is a nano second timestamp. Long story, I can't send it as a 'date\_nanos', so, what I'm doin… --- ## [Winlogbeat - Footprint as a shipper?](https://discuss.elastic.co/t/winlogbeat-footprint-as-a-shipper/298937)
**Author:** [@arunhk3](https://discuss.elastic.co/u/arunhk3)\ **Replies:** 0\ **Last updated:** [March 7, 2022, 7:41am UTC](https://discuss.elastic.co/t/winlogbeat-footprint-as-a-shipper/298937 "2022-03-07T07:41:17Z")
Hi All, I have a question where I would like to know the footprint (resource usage) when Winlogbeat is operating on a Windows Server when collecting and shipping logs. Also I would like to know as to what would happen … --- ## [Elasticsearch startup problemse](https://discuss.elastic.co/t/elasticsearch-startup-problemse/298831)
**Author:** [@zx\_emo](https://discuss.elastic.co/u/zx_emo)\ **Replies:** 5\ **Last updated:** [March 7, 2022, 7:20am UTC](https://discuss.elastic.co/t/elasticsearch-startup-problemse/298831 "2022-03-07T07:20:59Z")
Hello, my Yml file looks like this #xpack.license.self\_generated.type: basic xpack.security.enabled: true #xpack.security.enrollment.enabled: true #xpack.security.enrollment.enabled: true # Enable encryption for HTTP … --- ## [Alerts in kibana](https://discuss.elastic.co/t/alerts-in-kibana/298696)
**Author:** [@tharunkumar](https://discuss.elastic.co/u/tharunkumar)\ **Replies:** 4\ **Last updated:** [March 7, 2022, 6:19am UTC](https://discuss.elastic.co/t/alerts-in-kibana/298696 "2022-03-07T06:19:14Z")
log \[10:06:16.242\] \[error\]\[alerting\]\[alerts\]\[plugins\]\[plugins\] Executing Alert "34af2110-24f6-11ec-8071-63a4b456f636" has resulted in Error: Unable to create alerts client because the Encrypted Saved Objects plugin is … --- ## [Timepicker sync using mustache template kibana](https://discuss.elastic.co/t/timepicker-sync-using-mustache-template-kibana/298752)
**Author:** [@yangesh4u1](https://discuss.elastic.co/u/yangesh4u1)\ **Replies:** 1\ **Last updated:** [March 7, 2022, 4:40am UTC](https://discuss.elastic.co/t/timepicker-sync-using-mustache-template-kibana/298752 "2022-03-07T04:40:43Z")
Hi Team, I created a redirection link in kibana TSVB visualization using Mustache Template like below. I am wondering if Last selected timeframe in current page of Kibana can be synced if i am navigating to another… --- ## [Fetch specific data](https://discuss.elastic.co/t/fetch-specific-data/298927)
**Author:** [@mahmoudmaani](https://discuss.elastic.co/u/mahmoudmaani)\ **Replies:** 0\ **Last updated:** [March 7, 2022, 2:35am UTC](https://discuss.elastic.co/t/fetch-specific-data/298927 "2022-03-07T02:35:12Z")
Guys I am trying to fetch some data from the alert's index ".siem-signals-default-\*" I am trying to retrieve just the "alert id", "alert name", "ancestor index", "ancestor ID", and "group index" I used the below query: … --- ## [How to use field-value-factor when mapping missing field in java?](https://discuss.elastic.co/t/how-to-use-field-value-factor-when-mapping-missing-field-in-java/298930)
**Author:** [@ifree-zm](https://discuss.elastic.co/u/ifree-zm)\ **Replies:** 1\ **Last updated:** [March 7, 2022, 2:56am UTC](https://discuss.elastic.co/t/how-to-use-field-value-factor-when-mapping-missing-field-in-java/298930 "2022-03-07T02:56:38Z")
If mapping does not have a field, field-value-factor is used; otherwise, field-value-factor is not used --- ## [False positive submit - Driver Genius](https://discuss.elastic.co/t/false-positive-submit-driver-genius/298928)
**Author:** [@Driver-Soft](https://discuss.elastic.co/u/Driver-Soft)\ **Replies:** 0\ **Last updated:** [March 7, 2022, 2:38am UTC](https://discuss.elastic.co/t/false-positive-submit-driver-genius/298928 "2022-03-07T02:38:09Z")
I followed your instruction and sent a false positive report to fp\_reports@elastic.co, but I haven't gotten a reply after a few days, please fix this false positive issue, thanks. Hello, Please fix the false positive… --- ## [Migration data from a cluster to another cluster](https://discuss.elastic.co/t/migration-data-from-a-cluster-to-another-cluster/298915)
**Author:** [@alicango](https://discuss.elastic.co/u/alicango)\ **Replies:** 6\ **Last updated:** [March 6, 2022, 11:41pm UTC](https://discuss.elastic.co/t/migration-data-from-a-cluster-to-another-cluster/298915 "2022-03-06T23:41:53Z")
Hello, dear community, Assume that I have got 2 different clusters(Cluster-A and Cluster-B). Each cluster has 3 master nodes, 2 hot nodes, 2 warm nodes, and 2 cold nodes. My goal is to migrate all data from Cluster-A t… --- ## [ElasticSearch to Analysis Services](https://discuss.elastic.co/t/elasticsearch-to-analysis-services/298727)
**Author:** [@LSCZZ](https://discuss.elastic.co/u/LSCZZ)\ **Replies:** 0\ **Last updated:** [March 3, 2022, 11:07am UTC](https://discuss.elastic.co/t/elasticsearch-to-analysis-services/298727 "2022-03-03T11:07:52Z")
is it possible to connect Elasticsearch to Analysis Services? I already got a ODBC Elastic Driver installed which is working fine because I'm able to pull data into Power BI, however I'd like to connect on Analysis Serv… --- ## [General question about Elasticsearch cluster](https://discuss.elastic.co/t/general-question-about-elasticsearch-cluster/298913)
**Author:** [@cyberzlo](https://discuss.elastic.co/u/cyberzlo)\ **Replies:** 1\ **Last updated:** [March 6, 2022, 10:19pm UTC](https://discuss.elastic.co/t/general-question-about-elasticsearch-cluster/298913 "2022-03-06T22:19:02Z")
Hi, I am using ELK 8, if I have 4 servers with Logstash and one of them have also additionally Elasticsearch and Kibana... ..and if I will create Elasticsearch cluster, can each of Logstash report to local Elasticsearch… --- ## [Sample data](https://discuss.elastic.co/t/sample-data/298340)
**Author:** [@cyberzlo](https://discuss.elastic.co/u/cyberzlo)\ **Replies:** 5\ **Last updated:** [March 6, 2022, 4:07pm UTC](https://discuss.elastic.co/t/sample-data/298340 "2022-03-06T16:07:39Z")
I have a lot sample/example/automatic data after install ELK, sometimes it is loaded again. Can I delete it somehow? or I need do it always manually :(? --- ## [Enterprise Search 8.x - Docker Compose example](https://discuss.elastic.co/t/enterprise-search-8-x-docker-compose-example/284811)
**Author:** [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Replies:** 0\ **Last updated:** [September 22, 2021, 7:39am UTC](https://discuss.elastic.co/t/enterprise-search-8-x-docker-compose-example/284811 "2021-09-22T07:39:07Z")
Here is a simple way to start Enterprise Search (App Search and Workplace Search) with docker-compose . File: docker-compose.yml --- version: "2.2" services: setup: image: docker.elastic.co/elasticsearch/elastic… --- ## [After upgrading to Kibana 7.16.2 I cannot create aggregation in Kibana based on nested fields](https://discuss.elastic.co/t/after-upgrading-to-kibana-7-16-2-i-cannot-create-aggregation-in-kibana-based-on-nested-fields/298910)
**Author:** [@Nicole\_Hirshler](https://discuss.elastic.co/u/Nicole_Hirshler)\ **Replies:** 0\ **Last updated:** [March 6, 2022, 10:57am UTC](https://discuss.elastic.co/t/after-upgrading-to-kibana-7-16-2-i-cannot-create-aggregation-in-kibana-based-on-nested-fields/298910 "2022-03-06T10:57:59Z")
Using Kibana 7.16.2 I'm trying to create new simple visualization as table, using aggregation based on nested field and it is not available for selection. Using Dev Tools I can search nested fields. I use the simplest e… --- ## [Slow search in Kibana / ElasticSearch](https://discuss.elastic.co/t/slow-search-in-kibana-elasticsearch/297368)
**Author:** [@notgurev](https://discuss.elastic.co/u/notgurev)\ **Replies:** 14\ **Last updated:** [March 6, 2022, 10:44am UTC](https://discuss.elastic.co/t/slow-search-in-kibana-elasticsearch/297368 "2022-03-06T10:44:29Z")
When trying to visualize data, it takes a lot of time to get even the most recent data. I'm trying to figure out what's wrong with our setup that causes this: 3 nodes (1 hot, 2 cold) Hourly indices, 1 shard per index (… --- ## [ElasticSearch aggregate on a scripted nested field](https://discuss.elastic.co/t/elasticsearch-aggregate-on-a-scripted-nested-field/298841)
**Author:** [@doogyatnesta](https://discuss.elastic.co/u/doogyatnesta)\ **Replies:** 2\ **Last updated:** [March 6, 2022, 10:32am UTC](https://discuss.elastic.co/t/elasticsearch-aggregate-on-a-scripted-nested-field/298841 "2022-03-06T10:32:30Z")
I have the following mapping in my Elasticsearch index (simplified as the other fields are irrelevant: { "test": { "mappings": { "properties": { "name": { "type": "keyword" }, … --- ## [How to create a index from \_security\\user so nonpriv user could view](https://discuss.elastic.co/t/how-to-create-a-index-from-security-user-so-nonpriv-user-could-view/298908)
**Author:** [@stobbe99](https://discuss.elastic.co/u/stobbe99)\ **Replies:** 0\ **Last updated:** [March 6, 2022, 9:52am UTC](https://discuss.elastic.co/t/how-to-create-a-index-from-security-user-so-nonpriv-user-could-view/298908 "2022-03-06T09:52:41Z")
Hello, To access \_security\\user you need full priv. I found \_reindex does not work on this. Does anybody know what the best way is to create an index that contains the native users so that it becomes accessable for non … --- ## [ELK6.8 vs Search on object/array elements](https://discuss.elastic.co/t/elk6-8-vs-search-on-object-array-elements/298291)
**Author:** [@stefws](https://discuss.elastic.co/u/stefws)\ **Replies:** 6\ **Last updated:** [March 6, 2022, 9:18am UTC](https://discuss.elastic.co/t/elk6-8-vs-search-on-object-array-elements/298291 "2022-03-06T09:18:39Z")
Got doc.s in a v.6.8 cluster looking like these: and are wondering how to discover/search for doc.s, which has a specific array element value. Say logContext.processingIds\[\*\]="some value" as simple string search li… --- ## [Elastic upgrade results in spikes of IOPS](https://discuss.elastic.co/t/elastic-upgrade-results-in-spikes-of-iops/298874)
**Author:** [@Idan\_Koch](https://discuss.elastic.co/u/Idan_Koch)\ **Replies:** 2\ **Last updated:** [March 6, 2022, 9:11am UTC](https://discuss.elastic.co/t/elastic-upgrade-results-in-spikes-of-iops/298874 "2022-03-06T09:11:47Z")
Hi, We recently upgraded from v6 to v7. We hold 400M documents. in the processor the upgrade we: reduced document size by half made schema strict increased number of shards from 20 to 30 in v6 we used elastic4s clie… --- ## [Getting no error but data not saved in ES](https://discuss.elastic.co/t/getting-no-error-but-data-not-saved-in-es/298905)
**Author:** [@AkAmit](https://discuss.elastic.co/u/AkAmit)\ **Replies:** 0\ **Last updated:** [March 6, 2022, 7:24am UTC](https://discuss.elastic.co/t/getting-no-error-but-data-not-saved-in-es/298905 "2022-03-06T07:24:46Z")
Using bundled JDK: /usr/share/logstash/jdk OpenJDK 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecated in version 9.0 and will likely be removed in a future release. Sending Logstash logs to /var/log/log… --- ## [Logstash 8.1, Protobuf error - add\_file](https://discuss.elastic.co/t/logstash-8-1-protobuf-error-add-file/298894)
**Author:** [@pdoten](https://discuss.elastic.co/u/pdoten)\ **Replies:** 2\ **Last updated:** [March 6, 2022, 4:06am UTC](https://discuss.elastic.co/t/logstash-8-1-protobuf-error-add-file/298894 "2022-03-06T04:06:57Z")
Long time user here, love Elasticstack but cant get over this problem. Trying to create input for protobuf. Input stanza below. LS stops after throwing java exception, cant get pass this -tried to get this to work in 7.… --- ## [Field Available in Discovery, but Not in Visualization](https://discuss.elastic.co/t/field-available-in-discovery-but-not-in-visualization/298903)
**Author:** [@cyberphor](https://discuss.elastic.co/u/cyberphor)\ **Replies:** 0\ **Last updated:** [March 6, 2022, 3:56am UTC](https://discuss.elastic.co/t/field-available-in-discovery-but-not-in-visualization/298903 "2022-03-06T03:56:39Z")
Hello, I'm running Elasticsearch, Kibana, and Winlogbeat (all of which are version 8.0.1) on a Windows 10 desktop. When I query for event.code:4104 using the "Discovery" tab, one of the available fields is powershell.f… --- ## [Rejecting mapping update to \[xxx\] as the final mapping would have more than 1 type: \[\_doc, xxx\]](https://discuss.elastic.co/t/rejecting-mapping-update-to-xxx-as-the-final-mapping-would-have-more-than-1-type-doc-xxx/298839)
**Author:** [@Ramesh\_balasubramani](https://discuss.elastic.co/u/Ramesh_balasubramani)\ **Replies:** 11\ **Last updated:** [March 5, 2022, 6:57pm UTC](https://discuss.elastic.co/t/rejecting-mapping-update-to-xxx-as-the-final-mapping-would-have-more-than-1-type-doc-xxx/298839 "2022-03-05T18:57:31Z")
I am using Elasticsearch 7.10.2 version. I need to create one index, Index name = device \_type name = device But I am not able to create getting error. POST device/device/169062 { "device\_name": "DESK… [Previous page](https://discuss.elastic.co/latest.md?page=1228) [Next page](https://discuss.elastic.co/latest.md?page=1230)