# Latest **URL:** https://discuss.elastic.co/latest.md?page=1246 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1247 --- ## [Get output value of powershell script](https://discuss.elastic.co/t/get-output-value-of-powershell-script/297768)
**Author:** [@ethical20](https://discuss.elastic.co/u/ethical20)\ **Replies:** 4\ **Last updated:** [February 23, 2022, 5:02pm UTC](https://discuss.elastic.co/t/get-output-value-of-powershell-script/297768 "2022-02-23T17:02:38Z")
Hi, In winlogbeat, I'm able to get the body of PowerShell script that is executed on device using: powershell.file.script\_block\_text: But is there a way to get the 'stdout' or return / output of the script? Regrdas, --- ## [Multiple Must queries not working inside a should query as expected](https://discuss.elastic.co/t/multiple-must-queries-not-working-inside-a-should-query-as-expected/298024)
**Author:** [@Venkat\_Pavan](https://discuss.elastic.co/u/Venkat_Pavan)\ **Replies:** 1\ **Last updated:** [February 23, 2022, 4:51pm UTC](https://discuss.elastic.co/t/multiple-must-queries-not-working-inside-a-should-query-as-expected/298024 "2022-02-23T16:51:41Z")
I am trying to write a query of the form A or B or C or D where condition A is of the form A11 and A12, similarly B = B11 and B12 and so on. I am using elastic version 6.8 and executing the queries in Kibana. I have add… --- ## [Database Management](https://discuss.elastic.co/t/database-management/298060)
**Author:** [@John\_Dever\_Rusiana](https://discuss.elastic.co/u/John_Dever_Rusiana)\ **Replies:** 1\ **Last updated:** [February 23, 2022, 4:49pm UTC](https://discuss.elastic.co/t/database-management/298060 "2022-02-23T16:49:57Z")
Hi All, good day! I just want to ask from someone who have experienced in Database Management. As a database designer or manager, which would you prefer doing, normalization or denormalization of database? Why? Any ide… --- ## [Run Elastic Agent and Auditbeat](https://discuss.elastic.co/t/run-elastic-agent-and-auditbeat/298061)
**Author:** [@lethalMango](https://discuss.elastic.co/u/lethalMango)\ **Replies:** 1\ **Last updated:** [February 23, 2022, 4:40pm UTC](https://discuss.elastic.co/t/run-elastic-agent-and-auditbeat/298061 "2022-02-23T16:40:08Z")
I am upgrading our environment to use Elastic Agent. Currently we use Auditbeat, Winglogbeat and Filebeat. From what I can see Winlog and Filebeat are implemented, Auditbeat (specifically around file integrity monitori… --- ## [Function rate\_counter not working properly when multiple dimensions](https://discuss.elastic.co/t/function-rate-counter-not-working-properly-when-multiple-dimensions/298062)
**Author:** [@Yves\_Blt](https://discuss.elastic.co/u/Yves_Blt)\ **Replies:** 0\ **Last updated:** [February 23, 2022, 4:19pm UTC](https://discuss.elastic.co/t/function-rate-counter-not-working-properly-when-multiple-dimensions/298062 "2022-02-23T16:19:20Z")
Hello everybody, I am currently using counter\_rate function in TSBV for my incremental counter, but I found out that this is not working properly when several dimensions are presents. I have a counter called "http\_serv… --- ## [Kibana Short URL Intended Use](https://discuss.elastic.co/t/kibana-short-url-intended-use/297619)
**Author:** [@Evesy](https://discuss.elastic.co/u/Evesy)\ **Replies:** 5\ **Last updated:** [February 23, 2022, 4:26pm UTC](https://discuss.elastic.co/t/kibana-short-url-intended-use/297619 "2022-02-23T16:26:21Z")
Hi, We've historically used Kibana's short URL feature to provide users with reliable links to predefined Kibana discover queries. This has been needed as we have Kibana behind a single sign-on flow which causes URL fr… --- ## [Shard Siem cause cluster red V2](https://discuss.elastic.co/t/shard-siem-cause-cluster-red-v2/296575)
**Author:** [@labate](https://discuss.elastic.co/u/labate)\ **Replies:** 1\ **Last updated:** [February 23, 2022, 4:14pm UTC](https://discuss.elastic.co/t/shard-siem-cause-cluster-red-v2/296575 "2022-02-23T16:14:43Z")
Hello everyone, I have a problem with my .siem-signals-default index. The shard goes to red status and I can't reallocate the shard to another node. Because the shard seems to not be in my cluster and I can't get it bac… --- ## [Logstash array how to and filter](https://discuss.elastic.co/t/logstash-array-how-to-and-filter/298054)
**Author:** [@melorium](https://discuss.elastic.co/u/melorium)\ **Replies:** 4\ **Last updated:** [February 23, 2022, 4:11pm UTC](https://discuss.elastic.co/t/logstash-array-how-to-and-filter/298054 "2022-02-23T16:11:26Z")
Hi. I have a list of user name's with user ID 1-100 each user id case a name that contains to it. Exmaple 01 "user 1" 02 "user2" etc. I my log events I have user id known but not user name. How can I match user id … --- ## [Watcher error when force executing](https://discuss.elastic.co/t/watcher-error-when-force-executing/297648)
**Author:** [@vee](https://discuss.elastic.co/u/vee)\ **Replies:** 2\ **Last updated:** [February 23, 2022, 3:46pm UTC](https://discuss.elastic.co/t/watcher-error-when-force-executing/297648 "2022-02-23T15:46:54Z")
Hi - I noticed this error when attempting to force execute a watcher that triggers out the alert to our monitoring tool - Nagios. could not parse \[webhook\] action \[inlined/notify-nagios\]. failed parsing http request te… --- ## [Packetbeat Logstash and Elastic cloud](https://discuss.elastic.co/t/packetbeat-logstash-and-elastic-cloud/298034)
**Author:** [@kasuma](https://discuss.elastic.co/u/kasuma)\ **Replies:** 4\ **Last updated:** [February 23, 2022, 3:42pm UTC](https://discuss.elastic.co/t/packetbeat-logstash-and-elastic-cloud/298034 "2022-02-23T15:42:03Z")
Hello, I have a problem were my dashboard showing an "error" message when data are loaded from logstash, but if i load data directly from packetbeat to elastic cloud everything is working This is my setup: packetbeat.… --- ## [Cannot convert date to string by mutate](https://discuss.elastic.co/t/cannot-convert-date-to-string-by-mutate/298022)
**Author:** [@ivanhoe-dev](https://discuss.elastic.co/u/ivanhoe-dev)\ **Replies:** 4\ **Last updated:** [February 23, 2022, 3:25pm UTC](https://discuss.elastic.co/t/cannot-convert-date-to-string-by-mutate/298022 "2022-02-23T15:25:15Z")
I want to force my search\_varchar\_1 data type as string, but it always auto detect my data and parse as date type. Is there something I missed? My config filter { split {} csv { separator =\> "," skip\_header =\> "t… --- ## [What's the disk watermark actually applied while specified in both node configuration file and cluster settings?](https://discuss.elastic.co/t/whats-the-disk-watermark-actually-applied-while-specified-in-both-node-configuration-file-and-cluster-settings/297966)
**Author:** [@Hao\_Yellow](https://discuss.elastic.co/u/Hao_Yellow)\ **Replies:** 13\ **Last updated:** [February 23, 2022, 3:21pm UTC](https://discuss.elastic.co/t/whats-the-disk-watermark-actually-applied-while-specified-in-both-node-configuration-file-and-cluster-settings/297966 "2022-02-23T15:21:44Z")
Hello, I have a cluster of several nodes, where each node has the following configuration about the disk watermark: cluster.routing.allocation.disk.watermark.low=60gb cluster.routing.allocation.disk.watermark.high=50gb … --- ## [Filebeat not sending data to Elasticsearch, index\_not\_found\_exception](https://discuss.elastic.co/t/filebeat-not-sending-data-to-elasticsearch-index-not-found-exception/298047)
**Author:** [@nspeaks](https://discuss.elastic.co/u/nspeaks)\ **Replies:** 1\ **Last updated:** [February 23, 2022, 3:03pm UTC](https://discuss.elastic.co/t/filebeat-not-sending-data-to-elasticsearch-index-not-found-exception/298047 "2022-02-23T15:03:45Z")
I am using this guide: How To Build A Security Information and Event Management (SIEM) System with Suricata and the Elastic Stack on Rocky Linux 8 | DigitalOcean to install Suricata along with ELK stack on a Rocky Linux… --- ## [Parse json data with logstash](https://discuss.elastic.co/t/parse-json-data-with-logstash/297792)
**Author:** [@sylar11](https://discuss.elastic.co/u/sylar11)\ **Replies:** 7\ **Last updated:** [February 23, 2022, 2:54pm UTC](https://discuss.elastic.co/t/parse-json-data-with-logstash/297792 "2022-02-23T14:54:12Z")
Hi all, I'm a newbie to logstash and I'm trying to parse a JSON data file like the following { "A001": { "X": 503744.7, "Y": 4726339.0, "Z": 458.84, "LON": -2.954286956913572, … --- ## [Heatmap will show success rate using vega-lite or vega](https://discuss.elastic.co/t/heatmap-will-show-success-rate-using-vega-lite-or-vega/297600)
**Author:** [@Souvik\_Das](https://discuss.elastic.co/u/Souvik_Das)\ **Replies:** 7\ **Last updated:** [February 23, 2022, 2:48pm UTC](https://discuss.elastic.co/t/heatmap-will-show-success-rate-using-vega-lite-or-vega/297600 "2022-02-23T14:48:50Z")
Hi Everyone, I need to create a heatmap that will show the success rate for the two Types of Partners. Now let me brief you about my requirement. We have transaction-level data for two types of partners, ex: Type A, … --- ## [Exists query problem](https://discuss.elastic.co/t/exists-query-problem/298037)
**Author:** [@Busra\_Duygu](https://discuss.elastic.co/u/Busra_Duygu)\ **Replies:** 1\ **Last updated:** [February 23, 2022, 2:45pm UTC](https://discuss.elastic.co/t/exists-query-problem/298037 "2022-02-23T14:45:37Z")
Hello friends, I need your help on a subject. There is a field with a nested type in an index and another field with a string type in this field. Any record has this field, but I would be very happy if you could help me … --- ## [Filebeat httpjson input](https://discuss.elastic.co/t/filebeat-httpjson-input/297730)
**Author:** [@humartinez](https://discuss.elastic.co/u/humartinez)\ **Replies:** 4\ **Last updated:** [February 23, 2022, 2:17pm UTC](https://discuss.elastic.co/t/filebeat-httpjson-input/297730 "2022-02-23T14:17:48Z")
Hi Im trying to use filebeat httpjson to ingest some mongodb atlas metrics but Im struggling with the authentication, Its looks by the way the examples in mongo atlas site that they use digest authentication example cu… --- ## [Why only elasticsearch container starts and kibana and filebeat containers are not getting up?](https://discuss.elastic.co/t/why-only-elasticsearch-container-starts-and-kibana-and-filebeat-containers-are-not-getting-up/298040)
**Author:** [@Mahesh\_Abnave](https://discuss.elastic.co/u/Mahesh_Abnave)\ **Replies:** 0\ **Last updated:** [February 23, 2022, 1:19pm UTC](https://discuss.elastic.co/t/why-only-elasticsearch-container-starts-and-kibana-and-filebeat-containers-are-not-getting-up/298040 "2022-02-23T13:19:41Z")
I have an application running on six services (or containers) running on an existing docker network. I have deployed them on my local machine using docker stack deploy command. I wanted to create another set of container… --- ## [Filebeat logging certificate error even when connection can be established](https://discuss.elastic.co/t/filebeat-logging-certificate-error-even-when-connection-can-be-established/297920)
**Author:** [@widhalmt](https://discuss.elastic.co/u/widhalmt)\ **Replies:** 1\ **Last updated:** [February 23, 2022, 1:13pm UTC](https://discuss.elastic.co/t/filebeat-logging-certificate-error-even-when-connection-can-be-established/297920 "2022-02-23T13:13:05Z")
Hi, I searched the board and other sources but all I found didn't match my case or did not receive a reply. So sorry if I missed something but at least I tried. :slight\_smile: I have beats that connect to two Logstash … --- ## [Uploading Images in kibana Dashboard](https://discuss.elastic.co/t/uploading-images-in-kibana-dashboard/27999)
**Author:** [@Suganthi\_Thangavel](https://discuss.elastic.co/u/Suganthi_Thangavel)\ **Replies:** 10\ **Last updated:** [February 23, 2022, 12:54pm UTC](https://discuss.elastic.co/t/uploading-images-in-kibana-dashboard/27999 "2022-02-23T12:54:53Z")
Hi, I have requirement to add some images to the Kibana Dashboard. Is there any plugin for kibana so that i can browse the image and upload to the panel. we are using kibana 3 Thanks Suganthi --- ## [How to use APM with php](https://discuss.elastic.co/t/how-to-use-apm-with-php/297799)
**Author:** [@tronje85](https://discuss.elastic.co/u/tronje85)\ **Replies:** 1\ **Last updated:** [February 23, 2022, 12:27pm UTC](https://discuss.elastic.co/t/how-to-use-apm-with-php/297799 "2022-02-23T12:27:05Z")
Hi After reading the documentation for the PHP APM Agent 3 times, I still don't understand how it works. Initial situation: one has written a web page in PHP and uses for example the monolog handler. (1) Is the workflo… --- ## [Kibana limit number of alerts](https://discuss.elastic.co/t/kibana-limit-number-of-alerts/297243)
**Author:** [@siginigin](https://discuss.elastic.co/u/siginigin)\ **Replies:** 4\ **Last updated:** [February 23, 2022, 12:21pm UTC](https://discuss.elastic.co/t/kibana-limit-number-of-alerts/297243 "2022-02-23T12:21:51Z")
Hello, Is it possible to limit number of alerts on rule match? I created custom query to that matches ~ 100 events per one hour, but I want to have only one alert for this and all the events shoud be connected to this a… --- ## [No\_viable\_alt\_exception in painless script field](https://discuss.elastic.co/t/no-viable-alt-exception-in-painless-script-field/298018)
**Author:** [@niveditakathal](https://discuss.elastic.co/u/niveditakathal)\ **Replies:** 2\ **Last updated:** [February 23, 2022, 12:18pm UTC](https://discuss.elastic.co/t/no-viable-alt-exception-in-painless-script-field/298018 "2022-02-23T12:18:03Z")
Hi All, I want to calculate a substring of a string field (starting from 0 till either a fixed position or till - symbol ) under kibana index pattern . However when I am trying to create a scripted field I am getting "S… --- ## [Logstash plugin for Azure storage](https://discuss.elastic.co/t/logstash-plugin-for-azure-storage/297733)
**Author:** [@akpratiek](https://discuss.elastic.co/u/akpratiek)\ **Replies:** 10\ **Last updated:** [February 23, 2022, 12:17pm UTC](https://discuss.elastic.co/t/logstash-plugin-for-azure-storage/297733 "2022-02-23T12:17:12Z")
Hi Team , I am trying to access and retrieve files from Azure storage. I am getting the following error when I run the config file. Any help is appreciated. \< \[2022-02-21T12:07:37,177\]\[ERROR\]\[logstash.inputs.azureblobst… --- ## [Assigning Shards in ElasticSearch Cluster](https://discuss.elastic.co/t/assigning-shards-in-elasticsearch-cluster/298021)
**Author:** [@subham](https://discuss.elastic.co/u/subham)\ **Replies:** 1\ **Last updated:** [February 23, 2022, 11:59am UTC](https://discuss.elastic.co/t/assigning-shards-in-elasticsearch-cluster/298021 "2022-02-23T11:59:49Z")
Hi All, I have 8 nodes in my ES cluster. I want to de-provision 2 of the servers. When i stop the Elasticsearch process in 2 of my nodes, the 430 shards which are assigned to these 2 nodes gets unassigned. Is there any … --- ## [Aggregations on Unique Documents by field per day](https://discuss.elastic.co/t/aggregations-on-unique-documents-by-field-per-day/297999)
**Author:** [@baahubali](https://discuss.elastic.co/u/baahubali)\ **Replies:** 3\ **Last updated:** [February 23, 2022, 11:38am UTC](https://discuss.elastic.co/t/aggregations-on-unique-documents-by-field-per-day/297999 "2022-02-23T11:38:29Z")
We can find the Average of fields of all of the docs by using simple Metric. Great! We can find the Average of Averages per day using Average Bucket. Great! But how do we find Average of fields in single unique documen… --- ## [Block time filter in a Visualization](https://discuss.elastic.co/t/block-time-filter-in-a-visualization/298015)
**Author:** [@carlos\_gomez\_gomez](https://discuss.elastic.co/u/carlos_gomez_gomez)\ **Replies:** 1\ **Last updated:** [February 23, 2022, 11:37am UTC](https://discuss.elastic.co/t/block-time-filter-in-a-visualization/298015 "2022-02-23T11:37:15Z")
Hi everyone, I'm trying to a dashboard to compare the data of two different months, for instance January and February. It is possible to save the graph with a static time filter? If This is possible, I could make a das… --- ## [Error when config logstash to connect to elasticsearch with TLS basic security](https://discuss.elastic.co/t/error-when-config-logstash-to-connect-to-elasticsearch-with-tls-basic-security/298020)
**Author:** [@joko](https://discuss.elastic.co/u/joko)\ **Replies:** 0\ **Last updated:** [February 23, 2022, 11:34am UTC](https://discuss.elastic.co/t/error-when-config-logstash-to-connect-to-elasticsearch-with-tls-basic-security/298020 "2022-02-23T11:34:05Z")
Hi, anyone can help me? I have elasticsearch cluster with basic security enabled, and i want to send some csv data through logstash which i installed it later after elasticsearch. so i followed this instruction Configuri… --- ## [Regression: Client 7.16.x IndicesClient.exists indicesOptions are not present in request anymore](https://discuss.elastic.co/t/regression-client-7-16-x-indicesclient-exists-indicesoptions-are-not-present-in-request-anymore/298017)
**Author:** [@Sebastian\_Bathke](https://discuss.elastic.co/u/Sebastian_Bathke)\ **Replies:** 0\ **Last updated:** [February 23, 2022, 11:25am UTC](https://discuss.elastic.co/t/regression-client-7-16-x-indicesclient-exists-indicesoptions-are-not-present-in-request-anymore/298017 "2022-02-23T11:25:56Z")
Hey folks, we encountered a regression when updating to the latest 7.16.3 Java client, still making use of the RestHighLevelClient. The main cause for the issue is that actually the GetIndexRequest.DEFAULT\_INDICES\_OPTI… --- ## [Real minimal hardware requirements](https://discuss.elastic.co/t/real-minimal-hardware-requirements/298008)
**Author:** [@jfs1](https://discuss.elastic.co/u/jfs1)\ **Replies:** 1\ **Last updated:** [February 23, 2022, 10:49am UTC](https://discuss.elastic.co/t/real-minimal-hardware-requirements/298008 "2022-02-23T10:49:53Z")
What are the real minimal requirements for a lab Elastic stack deployment ? I mean : no production data. Only functionnal testing in the lab. So how much RAM/CPU/Disk to run Elastic + Kibana + Logstash on a single node… [Previous page](https://discuss.elastic.co/latest.md?page=1245) [Next page](https://discuss.elastic.co/latest.md?page=1247)