# Latest **URL:** https://discuss.elastic.co/latest.md?page=1259 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1260 --- ## [Separating HTTPJSON array to separate log entries](https://discuss.elastic.co/t/separating-httpjson-array-to-separate-log-entries/297030)
**Author:** [@isa\_slngr](https://discuss.elastic.co/u/isa_slngr)\ **Replies:** 3\ **Last updated:** [February 16, 2022, 12:37am UTC](https://discuss.elastic.co/t/separating-httpjson-array-to-separate-log-entries/297030 "2022-02-16T00:37:33Z")
Good evening all, Does anyone in the community know how I can create separate log entries using an ingest pipeline for JSON results pulled via the HTTPJSON integration? We are pulling events via an API and the results … --- ## [Reindex data is multiplying docs](https://discuss.elastic.co/t/reindex-data-is-multiplying-docs/296920)
**Author:** [@cris](https://discuss.elastic.co/u/cris)\ **Replies:** 13\ **Last updated:** [February 16, 2022, 12:21am UTC](https://discuss.elastic.co/t/reindex-data-is-multiplying-docs/296920 "2022-02-16T00:21:19Z")
Hello community! I am working with logstash to reindex some data, I have a problem when I run logstash.service the documents increase a lot in the new index, in the original index I have 3000 documents and I expect like… --- ## [Make Errors on OpenBSD 7.0 (Compiling Source)](https://discuss.elastic.co/t/make-errors-on-openbsd-7-0-compiling-source/296662)
**Author:** [@Jarbird](https://discuss.elastic.co/u/Jarbird)\ **Replies:** 1\ **Last updated:** [February 16, 2022, 12:08am UTC](https://discuss.elastic.co/t/make-errors-on-openbsd-7-0-compiling-source/296662 "2022-02-16T00:08:51Z")
Hello, I have perused the various OpenBSD topics regarding compiling beats (specifically filebeat) on OpenBSD, and have not found a solution to what I'm seeing. OpenBSD 7.0 currently ships a filebeat version which is b… --- ## [Filter last day documents in index](https://discuss.elastic.co/t/filter-last-day-documents-in-index/297302)
**Author:** [@nino](https://discuss.elastic.co/u/nino)\ **Replies:** 2\ **Last updated:** [February 15, 2022, 11:45pm UTC](https://discuss.elastic.co/t/filter-last-day-documents-in-index/297302 "2022-02-15T23:45:56Z")
Hello all, i have an index that recieves data from monday to friday, i need to retrieve the last day documents. Because of data is not recieving on saturday and sunday, 1 day ago filter is not wotking correctly. i would… --- ## [Metricbeat 7.16.1 is not available for download](https://discuss.elastic.co/t/metricbeat-7-16-1-is-not-available-for-download/297277)
**Author:** [@cgnusr01](https://discuss.elastic.co/u/cgnusr01)\ **Replies:** 1\ **Last updated:** [February 15, 2022, 11:42pm UTC](https://discuss.elastic.co/t/metricbeat-7-16-1-is-not-available-for-download/297277 "2022-02-15T23:42:39Z")
When visiting https://www.elastic.co/downloads/past-releases/metricbeat-7-16-1 we get 404 error. --- ## [Question about Reading Flattened Field from ES Index to Pyspark](https://discuss.elastic.co/t/question-about-reading-flattened-field-from-es-index-to-pyspark/297189)
**Author:** [@musku](https://discuss.elastic.co/u/musku)\ **Replies:** 2\ **Last updated:** [February 15, 2022, 11:37pm UTC](https://discuss.elastic.co/t/question-about-reading-flattened-field-from-es-index-to-pyspark/297189 "2022-02-15T23:37:14Z")
Hi , I am trying to read flattened Filed from Elasticsearch . I will be able to read all filed from Index except Flattened Datatype filed. Could you please let me know how to read that filed from Spark. Any option th… --- ## [Looking for guidance on how to add a map using GeoServer](https://discuss.elastic.co/t/looking-for-guidance-on-how-to-add-a-map-using-geoserver/296545)
**Author:** [@azulgrana](https://discuss.elastic.co/u/azulgrana)\ **Replies:** 3\ **Last updated:** [February 15, 2022, 11:35pm UTC](https://discuss.elastic.co/t/looking-for-guidance-on-how-to-add-a-map-using-geoserver/296545 "2022-02-15T23:35:34Z")
Hi there Elastic team, I'm looking for some guidance on how to add a custom map using a geoserver. I have went over the instructions on this blog Kibana and a Custom Tile Server for NHL Data | Elastic Blog and and I can… --- ## [Missing MISP docs?](https://discuss.elastic.co/t/missing-misp-docs/297301)
**Author:** [@tofubeats](https://discuss.elastic.co/u/tofubeats)\ **Replies:** 0\ **Last updated:** [February 15, 2022, 10:44pm UTC](https://discuss.elastic.co/t/missing-misp-docs/297301 "2022-02-15T22:44:41Z")
I have set up a MISP instance and have configured filebeat to query the MISP server. However, I cannot find the actual docs in any indices in logstash. When running journalctl -fu logstash, I see this every few minutes: … --- ## [How to clear filters from the Dashboard?](https://discuss.elastic.co/t/how-to-clear-filters-from-the-dashboard/297235)
**Author:** [@m-amano](https://discuss.elastic.co/u/m-amano)\ **Replies:** 2\ **Last updated:** [February 15, 2022, 10:51pm UTC](https://discuss.elastic.co/t/how-to-clear-filters-from-the-dashboard/297235 "2022-02-15T22:51:46Z")
We upgraded Elastic Cloud version 7.13.2 to 7.15.2. In our web page, we have a button and embed Dashboard like this. The dashboard URL in iframe is saved object embed code what Kibana provides which is like below. h… --- ## [Can I query an App Search Index with ElasticSearch SQL](https://discuss.elastic.co/t/can-i-query-an-app-search-index-with-elasticsearch-sql/297291)
**Author:** [@David\_Robbins](https://discuss.elastic.co/u/David_Robbins)\ **Replies:** 3\ **Last updated:** [February 15, 2022, 10:42pm UTC](https://discuss.elastic.co/t/can-i-query-an-app-search-index-with-elasticsearch-sql/297291 "2022-02-15T22:42:40Z")
I have a long running import process for my App Search index and I'd like to get perform checkpoints and get various count. I see SQL for Elastic Search and wonder if something like "select count(\*) where state = 'MI'"… --- ## [Is it possible to call REST API call to elastic using JAVA](https://discuss.elastic.co/t/is-it-possible-to-call-rest-api-call-to-elastic-using-java/297278)
**Author:** [@ranju](https://discuss.elastic.co/u/ranju)\ **Replies:** 1\ **Last updated:** [February 15, 2022, 10:22pm UTC](https://discuss.elastic.co/t/is-it-possible-to-call-rest-api-call-to-elastic-using-java/297278 "2022-02-15T22:22:45Z")
Need to call this type of query via REST API String query = "{"bool": {"must": \[{"match\_phrase": {"countryName": "INDIA"}}\], "must\_not": \[\], "should": \[\]}}"; --- ## [How to use curl API curl -X GET -u elastic:elastic http://elasticsearchprd.vbox.com/\_cat/shards | grep -i "UNASSIGNED" from the REST client tool](https://discuss.elastic.co/t/how-to-use-curl-api-curl-x-get-u-elastic-elastic-http-elasticsearchprd-vbox-com-cat-shards-grep-i-unassigned-from-the-rest-client-tool/297052)
**Author:** [@chinmoy\_padhi](https://discuss.elastic.co/u/chinmoy_padhi)\ **Replies:** 1\ **Last updated:** [February 15, 2022, 10:05pm UTC](https://discuss.elastic.co/t/how-to-use-curl-api-curl-x-get-u-elastic-elastic-http-elasticsearchprd-vbox-com-cat-shards-grep-i-unassigned-from-the-rest-client-tool/297052 "2022-02-15T22:05:08Z")
Hi, How can I use this curl command curl -X GET -u elastic:elastic http://elasticsearchprd.vbox.com/\_cat/shards | grep -i "UNASSIGNED" in any of the REST client tool such as POSTMAN or anything else. If any one come acr… --- ## [Detecting beaconing malware](https://discuss.elastic.co/t/detecting-beaconing-malware/296559)
**Author:** [@zerojin63](https://discuss.elastic.co/u/zerojin63)\ **Replies:** 7\ **Last updated:** [February 15, 2022, 9:35pm UTC](https://discuss.elastic.co/t/detecting-beaconing-malware/296559 "2022-02-15T21:35:59Z")
Hello, I saw this post (link) and wanted to try on my network log, so i followed the github manual (link), uploaded all the required scripts and changed only the transform script, just to apply it to my already existin… --- ## [Stuck login anonymous embed](https://discuss.elastic.co/t/stuck-login-anonymous-embed/297252)
**Author:** [@Palaibada](https://discuss.elastic.co/u/Palaibada)\ **Replies:** 1\ **Last updated:** [February 15, 2022, 9:19pm UTC](https://discuss.elastic.co/t/stuck-login-anonymous-embed/297252 "2022-02-15T21:19:25Z")
why when i enable anonymous embed i can't enter the dashboard and loop login in the iframe? and when i input xpack.security.sameSiteCookies: "None" kibana not working. --- ## [New to Plugin Development](https://discuss.elastic.co/t/new-to-plugin-development/297271)
**Author:** [@Richard\_L\_Nichols](https://discuss.elastic.co/u/Richard_L_Nichols)\ **Replies:** 1\ **Last updated:** [February 15, 2022, 9:14pm UTC](https://discuss.elastic.co/t/new-to-plugin-development/297271 "2022-02-15T21:14:22Z")
I am struggling getting started and even after contacting support I can not seem to find a good source for documentation. For example I can create a label and update the time every second but when it comes to visualizati… --- ## [Filebeat failing to parse docker json-file logs](https://discuss.elastic.co/t/filebeat-failing-to-parse-docker-json-file-logs/297287)
**Author:** [@rectalogic](https://discuss.elastic.co/u/rectalogic)\ **Replies:** 1\ **Last updated:** [February 15, 2022, 8:48pm UTC](https://discuss.elastic.co/t/filebeat-failing-to-parse-docker-json-file-logs/297287 "2022-02-15T20:48:35Z")
I'm using filebeat 7.12.0 to ingest docker logs using the container input. Log entries in the docker json-file format look like: {"log":"{\\"@timestamp\\":\\"2022-02-15T17:45:26.742Z\\",\\"log.level\\":\\"info\\",\\"message\\":\\"… --- ## [Multimetric ML job Question](https://discuss.elastic.co/t/multimetric-ml-job-question/297292)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 1\ **Last updated:** [February 15, 2022, 8:41pm UTC](https://discuss.elastic.co/t/multimetric-ml-job-question/297292 "2022-02-15T20:41:49Z")
I have an index with data of throughput of multiples interfaces, those interfaces have different capacities: 1Gbps, 800Mbps, 500Mbps, 50Mbps. It will be allright if I mix all those interfaces in a single multimetric ML … --- ## [Escape single quotes in URL field](https://discuss.elastic.co/t/escape-single-quotes-in-url-field/297120)
**Author:** [@thenotoriousciu](https://discuss.elastic.co/u/thenotoriousciu)\ **Replies:** 1\ **Last updated:** [February 15, 2022, 8:32pm UTC](https://discuss.elastic.co/t/escape-single-quotes-in-url-field/297120 "2022-02-15T20:32:31Z")
Hello, I am trying to create a URL field which redirects to a different dashboard. The values in this field have the following format: 'Application': Create (notice the single quotes). The problem is that when the link … --- ## [How to create field that can get input?](https://discuss.elastic.co/t/how-to-create-field-that-can-get-input/297249)
**Author:** [@paz\_Ben\_Netanel](https://discuss.elastic.co/u/paz_Ben_Netanel)\ **Replies:** 1\ **Last updated:** [February 15, 2022, 8:13pm UTC](https://discuss.elastic.co/t/how-to-create-field-that-can-get-input/297249 "2022-02-15T20:13:46Z")
I want to create a field that can get input and the output will be accordingly --- ## [Forecasts on a dashboard](https://discuss.elastic.co/t/forecasts-on-a-dashboard/153788)
**Author:** [@Kult](https://discuss.elastic.co/u/Kult)\ **Replies:** 2\ **Last updated:** [February 15, 2022, 8:12pm UTC](https://discuss.elastic.co/t/forecasts-on-a-dashboard/153788 "2022-02-15T20:12:16Z")
ML's Forecast feature is great, but is there any way to incorporate forecasts into visualisations (traditional, Timelion or otherwise)? If not, can regular visualisations, Timelion or some another plugin you'd recommend … --- ## [Elasticsearch: Create API Key based on role?](https://discuss.elastic.co/t/elasticsearch-create-api-key-based-on-role/297188)
**Author:** [@DougR](https://discuss.elastic.co/u/DougR)\ **Replies:** 2\ **Last updated:** [February 15, 2022, 3:31pm UTC](https://discuss.elastic.co/t/elasticsearch-create-api-key-based-on-role/297188 "2022-02-15T15:31:46Z")
In the Create API key API documentation, it shows the complete role definition for the API key being included in the /\_security/api\_key request. However, in the example shown, supposed I already have role-a and role-b d… --- ## [Same action for every SIEM detection rule](https://discuss.elastic.co/t/same-action-for-every-siem-detection-rule/297056)
**Author:** [@maof97](https://discuss.elastic.co/u/maof97)\ **Replies:** 2\ **Last updated:** [February 15, 2022, 7:08pm UTC](https://discuss.elastic.co/t/same-action-for-every-siem-detection-rule/297056 "2022-02-15T19:08:44Z")
Hello, I am testing the Gold license and I thought it would be a good idea to send an E-Mail for every alert detected by the SIEM ("Alert" tab). I generally found out how to do that. I created a connector i.e. Mail conn… --- ## [Inconsistent API Response "error: no handler found for uri"](https://discuss.elastic.co/t/inconsistent-api-response-error-no-handler-found-for-uri/297086)
**Author:** [@maof97](https://discuss.elastic.co/u/maof97)\ **Replies:** 4\ **Last updated:** [February 15, 2022, 7:07pm UTC](https://discuss.elastic.co/t/inconsistent-api-response-error-no-handler-found-for-uri/297086 "2022-02-15T19:07:50Z")
Hey, doing API POST Requests via Python (on MacOS) I did: elastic\_client.update(index='.internal.alerts-security.alerts-default-000001',id='a9136c19ccfd95123cb2cf5697affbbdeb5a35c785ced06071f2777881aa33f7', body={"doc":… --- ## [Match only?](https://discuss.elastic.co/t/match-only/296888)
**Author:** [@ntak](https://discuss.elastic.co/u/ntak)\ **Replies:** 2\ **Last updated:** [February 15, 2022, 6:40pm UTC](https://discuss.elastic.co/t/match-only/296888 "2022-02-15T18:40:58Z")
Hello! I'm new to ES and I'm trying to figure out how to make a query which asserts the following: All given tokens are present in the field - regardless of the order No other token are present. Ideally, I'd also be … --- ## [Precision tuning does not affect prefixing](https://discuss.elastic.co/t/precision-tuning-does-not-affect-prefixing/295291)
**Author:** [@Meaveryway](https://discuss.elastic.co/u/Meaveryway)\ **Replies:** 1\ **Last updated:** [February 15, 2022, 6:05pm UTC](https://discuss.elastic.co/t/precision-tuning-does-not-affect-prefixing/295291 "2022-02-15T18:05:56Z")
Hello dear community, While doing search through AppSearch, we notice some aggressive matching patterns that end up highlighting irrelevant words on the search results. The relevant parts of the results are still correc… --- ## [Logstatsh Time Zone issue](https://discuss.elastic.co/t/logstatsh-time-zone-issue/297280)
**Author:** [@hanumant](https://discuss.elastic.co/u/hanumant)\ **Replies:** 1\ **Last updated:** [February 15, 2022, 5:55pm UTC](https://discuss.elastic.co/t/logstatsh-time-zone-issue/297280 "2022-02-15T17:55:39Z")
Hi Team, environment logstatsh and elastic server are running in IST System DataBase is in UTC time zone I'm using JDBC logstatsh to push the information I'm seeing the date related all columns values are getting alter… --- ## [Error Querying Windows System using Osquery Manager on Kibana](https://discuss.elastic.co/t/error-querying-windows-system-using-osquery-manager-on-kibana/296354)
**Author:** [@mibeyki](https://discuss.elastic.co/u/mibeyki)\ **Replies:** 13\ **Last updated:** [February 15, 2022, 5:01pm UTC](https://discuss.elastic.co/t/error-querying-windows-system-using-osquery-manager-on-kibana/296354 "2022-02-15T17:01:17Z")
Hello there, I have successfully setup and ELK stack v7.17.0 fully integrated with Fleet and Osquery manager. When I try to query the remote windows agent using osquery live queries, i get the error below; TypeError: … --- ## [Get List of Curations from Swiftype](https://discuss.elastic.co/t/get-list-of-curations-from-swiftype/296899)
**Author:** [@avidnewmedia](https://discuss.elastic.co/u/avidnewmedia)\ **Replies:** 6\ **Last updated:** [February 15, 2022, 5:40pm UTC](https://discuss.elastic.co/t/get-list-of-curations-from-swiftype/296899 "2022-02-15T17:40:28Z")
Hello! I have a question for anyone familiar with Swiftype / Search UI and curation implementations. We are wanting to utilize curations however we have some custom logic in beforeSearchCall hooks. Essentially I'd lik… --- ## [Self-managed App Search with SSL enabled](https://discuss.elastic.co/t/self-managed-app-search-with-ssl-enabled/297245)
**Author:** [@Amine27](https://discuss.elastic.co/u/Amine27)\ **Replies:** 0\ **Last updated:** [February 15, 2022, 1:06pm UTC](https://discuss.elastic.co/t/self-managed-app-search-with-ssl-enabled/297245 "2022-02-15T13:06:28Z")
Hello, I am trying to connect Logstash to App Search output with SSL enabled. I am getting this error: Pipeline error {:pipeline\_id=\>"main", :exception=\>#\ **Author:** [@Wonder\_Garance](https://discuss.elastic.co/u/Wonder_Garance)\ **Replies:** 4\ **Last updated:** [February 15, 2022, 5:13pm UTC](https://discuss.elastic.co/t/how-to-add-optional-json-field-in-logstash/296650 "2022-02-15T17:13:47Z") Hi, I wrote a Logstash pipeline to modify some fields of json input files. The keys introduction.text, introduction.html and body in json are optional, I don't want to create empty fields in json output files. How to add… [Previous page](https://discuss.elastic.co/latest.md?page=1258) [Next page](https://discuss.elastic.co/latest.md?page=1260)