# Latest **URL:** https://discuss.elastic.co/latest.md?page=1272 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1273 --- ## [Aggregating object keys to achieve a sum](https://discuss.elastic.co/t/aggregating-object-keys-to-achieve-a-sum/296193)
**Author:** [@hugomeloo](https://discuss.elastic.co/u/hugomeloo)\ **Replies:** 5\ **Last updated:** [February 8, 2022, 1:10pm UTC](https://discuss.elastic.co/t/aggregating-object-keys-to-achieve-a-sum/296193 "2022-02-08T13:10:32Z")
I am trying to make an aggregation in which I can sum a number from a specific key of an object. As an example: curl -XPUT "localhost:9200/products/\_mapping" -H 'Content-Type: application/json' -d' { "properties": { … --- ## [Elastic ITSM Connector shows CORS error](https://discuss.elastic.co/t/elastic-itsm-connector-shows-cors-error/296230)
**Author:** [@pindropviolence](https://discuss.elastic.co/u/pindropviolence)\ **Replies:** 2\ **Last updated:** [February 8, 2022, 1:08pm UTC](https://discuss.elastic.co/t/elastic-itsm-connector-shows-cors-error/296230 "2022-02-08T13:08:03Z")
Hello Folks, I have tried to configured Elastic ITSM connector in Kb instance, i get CORS error when i try to create a new connection or add a connection to a rule. When I disabled CORS on browser level , I was able to … --- ## [Kibana - maximum amount of values in the DSL terms search](https://discuss.elastic.co/t/kibana-maximum-amount-of-values-in-the-dsl-terms-search/296585)
**Author:** [@InesCM](https://discuss.elastic.co/u/InesCM)\ **Replies:** 2\ **Last updated:** [February 8, 2022, 12:45pm UTC](https://discuss.elastic.co/t/kibana-maximum-amount-of-values-in-the-dsl-terms-search/296585 "2022-02-08T12:45:55Z")
Hi! I'm trying to do a DSL filter in Kibana, in order to filter by a large amount of values on a specific field. For this, I'm using this syntax: { "query": { "bool": { "filter": { "terms": { … --- ## [With final\_pipeline and a pipeline specified, the final pipeline appears to be running twice with index date math processor](https://discuss.elastic.co/t/with-final-pipeline-and-a-pipeline-specified-the-final-pipeline-appears-to-be-running-twice-with-index-date-math-processor/296593)
**Author:** [@ed.yoo](https://discuss.elastic.co/u/ed.yoo)\ **Replies:** 0\ **Last updated:** [February 8, 2022, 12:20pm UTC](https://discuss.elastic.co/t/with-final-pipeline-and-a-pipeline-specified-the-final-pipeline-appears-to-be-running-twice-with-index-date-math-processor/296593 "2022-02-08T12:20:13Z")
Testing on 7.6.2, the following code works fine in using a final\_pipeline and a pipeline for the index. Using the same code and updated index template code, it actually appears to run twice on 7.15.2 (and 7.16.0). The … --- ## [Configuring aerospike metricbeat module with TLS](https://discuss.elastic.co/t/configuring-aerospike-metricbeat-module-with-tls/294729)
**Author:** [@sentient](https://discuss.elastic.co/u/sentient)\ **Replies:** 2\ **Last updated:** [February 8, 2022, 11:45am UTC](https://discuss.elastic.co/t/configuring-aerospike-metricbeat-module-with-tls/294729 "2022-02-08T11:45:19Z")
I am looking at the code and trying to figure out how I should configure TLS certificates to get access to the aerospike service endpoint with TLS configured. Does anybody have a successful module configuration exampl… --- ## [APM agent remote configuration access forbidden / unauthorized](https://discuss.elastic.co/t/apm-agent-remote-configuration-access-forbidden-unauthorized/296580)
**Author:** [@muhammadkholidb](https://discuss.elastic.co/u/muhammadkholidb)\ **Replies:** 0\ **Last updated:** [February 8, 2022, 11:22am UTC](https://discuss.elastic.co/t/apm-agent-remote-configuration-access-forbidden-unauthorized/296580 "2022-02-08T11:22:38Z")
Hi, I am working on Elastic APM on my project and saw an error on the logs when running with apm java agent: 2022-02-08 17:21:33,546 \[elastic-apm-remote-config-poller\] ERROR co.elastic.apm.agent.configuration.ApmServerC… --- ## [No soap web service traces from Jboss Fuse](https://discuss.elastic.co/t/no-soap-web-service-traces-from-jboss-fuse/296477)
**Author:** [@mybyte](https://discuss.elastic.co/u/mybyte)\ **Replies:** 7\ **Last updated:** [February 8, 2022, 10:44am UTC](https://discuss.elastic.co/t/no-soap-web-service-traces-from-jboss-fuse/296477 "2022-02-08T10:44:47Z")
We've got APM up and running for a few apps, but struggle to get any traces from our Jboss Fuse (6.2.1) servers. APM/Kibana/Elastic v. 7.16.2, most recent build of apm agent (tried older ones too) - 1.28.4. The applica… --- ## [Transforms on data older than a specific timestamp: checkpoints are not created](https://discuss.elastic.co/t/transforms-on-data-older-than-a-specific-timestamp-checkpoints-are-not-created/296483)
**Author:** [@paulov](https://discuss.elastic.co/u/paulov)\ **Replies:** 2\ **Last updated:** [February 8, 2022, 10:29am UTC](https://discuss.elastic.co/t/transforms-on-data-older-than-a-specific-timestamp-checkpoints-are-not-created/296483 "2022-02-08T10:29:09Z")
Continuing the discussion from ES Continuous Transforms Checkpoint not updating: Hi, I'm creating a transform job that transforms data in an index and takes all documents OLDER THAN 6 days (calculating averages etc). … --- ## [Why doesn't we run 'Basic' any longer, but 'Trial'?](https://discuss.elastic.co/t/why-doesnt-we-run-basic-any-longer-but-trial/296572)
**Author:** [@fribse](https://discuss.elastic.co/u/fribse)\ **Replies:** 0\ **Last updated:** [February 8, 2022, 10:10am UTC](https://discuss.elastic.co/t/why-doesnt-we-run-basic-any-longer-but-trial/296572 "2022-02-08T10:10:45Z")
I followed this guide (to set up Elasticsearch with ssl, which I understand is now required for 7.16.+): Encrypting communications in an Elasticsearch Docker Container | Elasticsearch Guide \[7.17\] | Elastic It sets it u… --- ## [Filebeat tail\_files in filestream input](https://discuss.elastic.co/t/filebeat-tail-files-in-filestream-input/296282)
**Author:** [@solnicki](https://discuss.elastic.co/u/solnicki)\ **Replies:** 2\ **Last updated:** [February 8, 2022, 10:04am UTC](https://discuss.elastic.co/t/filebeat-tail-files-in-filestream-input/296282 "2022-02-08T10:04:05Z")
Hi All, Starting from filebeat version 7.15 there is a recommendation to switch from log input type to filestream as log is deprecated. My problem is that filestream apparently does not includes tail\_files config optio… --- ## [The latch in BulkRequestHandler.execute is unnecessary](https://discuss.elastic.co/t/the-latch-in-bulkrequesthandler-execute-is-unnecessary/296570)
**Author:** [@asce0705](https://discuss.elastic.co/u/asce0705)\ **Replies:** 0\ **Last updated:** [February 8, 2022, 9:45am UTC](https://discuss.elastic.co/t/the-latch-in-bulkrequesthandler-execute-is-unnecessary/296570 "2022-02-08T09:45:15Z")
The latch in BulkRequestHandler is added before to ensure that the new handler executes a bulk request and awaits for the completion if the BulkProcessor was configured with a concurrentRequests setting of 0. The related… --- ## [Role of kafka between filebeat and logstash](https://discuss.elastic.co/t/role-of-kafka-between-filebeat-and-logstash/296566)
**Author:** [@alex\_vermex](https://discuss.elastic.co/u/alex_vermex)\ **Replies:** 0\ **Last updated:** [February 8, 2022, 9:20am UTC](https://discuss.elastic.co/t/role-of-kafka-between-filebeat-and-logstash/296566 "2022-02-08T09:20:12Z")
Hi, I have a lot of log files in each hour it will be created a new file log so i get it and i filter it with this architecture : filebeat -\> logstash -\> Elasticsearch -\> kibana I would to know there is any avantage t… --- ## [Kibana is now available (was degraded)](https://discuss.elastic.co/t/kibana-is-now-available-was-degraded/296553)
**Author:** [@swchandu](https://discuss.elastic.co/u/swchandu)\ **Replies:** 2\ **Last updated:** [February 8, 2022, 9:05am UTC](https://discuss.elastic.co/t/kibana-is-now-available-was-degraded/296553 "2022-02-08T09:05:07Z")
Hi, I have installed a new 7.17.0 cluster and noticed that kibana is connecting to Elasticsearch. However it is not publishing on 5601. Noticed kibana is now available (was degraded) at the end. can some one tell me w… --- ## [Editing elasticsearch.yml file](https://discuss.elastic.co/t/editing-elasticsearch-yml-file/296561)
**Author:** [@Abhi\_Abhishek](https://discuss.elastic.co/u/Abhi_Abhishek)\ **Replies:** 1\ **Last updated:** [February 8, 2022, 9:00am UTC](https://discuss.elastic.co/t/editing-elasticsearch-yml-file/296561 "2022-02-08T09:00:50Z")
Hello Greetings of the day @Lisa\_Jung @warkolm @xeraa Is it possible to edit Elasticsearch.yml file through API in Kibana? If their is a way please help me. --- ## [Detect update in Elastic index and call an action](https://discuss.elastic.co/t/detect-update-in-elastic-index-and-call-an-action/296509)
**Author:** [@Laetitia\_RICHARD](https://discuss.elastic.co/u/Laetitia_RICHARD)\ **Replies:** 2\ **Last updated:** [February 8, 2022, 8:04am UTC](https://discuss.elastic.co/t/detect-update-in-elastic-index-and-call-an-action/296509 "2022-02-08T08:04:38Z")
Hello, I'd like to detect updates in my index (updated, created or deleted document) and call an Amazon API Gateway. First, I thought about using Watcher but it seems that I can't detect real time modifications in my ind… --- ## [Es7.16, two indexes have same field cost conflicting type?](https://discuss.elastic.co/t/es7-16-two-indexes-have-same-field-cost-conflicting-type/295667)
**Author:** [@zhanghaocai](https://discuss.elastic.co/u/zhanghaocai)\ **Replies:** 8\ **Last updated:** [February 8, 2022, 7:37am UTC](https://discuss.elastic.co/t/es7-16-two-indexes-have-same-field-cost-conflicting-type/295667 "2022-02-08T07:37:44Z")
I have two indexes. PUT /test1 { "settings": { "number\_of\_shards": 1, "number\_of\_replicas": 0 }, "mappings": { "properties": { "name": { "type": "text" } } } } PUT /test2 { "settings": {… --- ## [Logstash Scheduler](https://discuss.elastic.co/t/logstash-scheduler/296431)
**Author:** [@shharukh](https://discuss.elastic.co/u/shharukh)\ **Replies:** 4\ **Last updated:** [February 8, 2022, 6:12am UTC](https://discuss.elastic.co/t/logstash-scheduler/296431 "2022-02-08T06:12:28Z")
Hey Elasticworld, I'm current Logstash version 7.9 ,I have a encounter a problem in Logstash, in which have a 4 pipeline which are using "JBDC" driver for inserting data into Elasticsearch. \*\*Now I have to add another … --- ## [Logstash filter if conditional fails to match string ended with "\\u0000"](https://discuss.elastic.co/t/logstash-filter-if-conditional-fails-to-match-string-ended-with-u0000/296248)
**Author:** [@juowong](https://discuss.elastic.co/u/juowong)\ **Replies:** 3\ **Last updated:** [February 8, 2022, 5:49am UTC](https://discuss.elastic.co/t/logstash-filter-if-conditional-fails-to-match-string-ended-with-u0000/296248 "2022-02-08T05:49:39Z")
I am using logstash to receive network logs using syslog input module. I would like to drop the event if the log message is equal to A10. The pipeline is as follows: input { syslog { ecs\_compatibility =\> "v1" time… --- ## [Problem : Logstash filtering mutate/grok](https://discuss.elastic.co/t/problem-logstash-filtering-mutate-grok/296456)
**Author:** [@personal.riz](https://discuss.elastic.co/u/personal.riz)\ **Replies:** 5\ **Last updated:** [February 8, 2022, 5:00am UTC](https://discuss.elastic.co/t/problem-logstash-filtering-mutate-grok/296456 "2022-02-08T05:00:32Z")
Hi guys, iam new in elasticstack environment and i have some question below i have a problem with logstash filter parsing, i just config my firewall labs to sending json log to logstash using tcp port 5000. how to use … --- ## [CyberArk EPM (SaaS based) application integration with ELK](https://discuss.elastic.co/t/cyberark-epm-saas-based-application-integration-with-elk/296548)
**Author:** [@kirankatkar](https://discuss.elastic.co/u/kirankatkar)\ **Replies:** 0\ **Last updated:** [February 8, 2022, 4:53am UTC](https://discuss.elastic.co/t/cyberark-epm-saas-based-application-integration-with-elk/296548 "2022-02-08T04:53:30Z")
Hello Team, I am new to ELK, we are trying to integrate CyberArk EPM (SaaS based) application with ELK and vendor only provided APIs to pull the events / logs manually but hasn’t provided any script to automate the proc… --- ## [Failed to load plugin class \[org.elasticsearch.xpack.core.XPackPlugin\]](https://discuss.elastic.co/t/failed-to-load-plugin-class-org-elasticsearch-xpack-core-xpackplugin/296531)
**Author:** [@Ravi\_Bhushan](https://discuss.elastic.co/u/Ravi_Bhushan)\ **Replies:** 7\ **Last updated:** [February 8, 2022, 4:28am UTC](https://discuss.elastic.co/t/failed-to-load-plugin-class-org-elasticsearch-xpack-core-xpackplugin/296531 "2022-02-08T04:28:11Z")
Hi All, I am trying to install Elasticsearch 6.8.23 Opensource version in Docker swarm. What I understand from document i that xpack is available in free version to implement node & http communication. Please correct m… --- ## [Is there any way to exclude Windows Drive on the metricbeat configuration?](https://discuss.elastic.co/t/is-there-any-way-to-exclude-windows-drive-on-the-metricbeat-configuration/296547)
**Author:** [@Gustavo\_Garcia](https://discuss.elastic.co/u/Gustavo_Garcia)\ **Replies:** 0\ **Last updated:** [February 8, 2022, 4:28am UTC](https://discuss.elastic.co/t/is-there-any-way-to-exclude-windows-drive-on-the-metricbeat-configuration/296547 "2022-02-08T04:28:09Z")
Hello everyone, I have some Windows Servers that have SWAP (pagefile.sys) configured and located in a small disk. As this is a "Standard Configuration" there are lot of events related to this as the disk is almost full … --- ## [지난달 인덱스 생성하는 방법](https://discuss.elastic.co/t/topic/296539)
**Author:** [@m2seo81](https://discuss.elastic.co/u/m2seo81)\ **Replies:** 0\ **Last updated:** [February 8, 2022, 2:27am UTC](https://discuss.elastic.co/t/topic/296539 "2022-02-08T02:27:18Z")
filebeat 인덱스가 매일 하나씩 쌓여서 index limit 1000 오류가 발생하였습니다. 인덱스를 월별로 만들게 수정하였는데 2월달 데이터는 수집이 되었는데 1월달 인덱스가 생성이 되지 않는 문제가 발생했습니다. 지난달의 인덱스를 어떻게 생성해야 하나요? filebeat - logstash - Elasticsearch로 구성되어 있는 구조입니다. --- ## [Hope ilm Indices support environment](https://discuss.elastic.co/t/hope-ilm-indices-support-environment/296451)
**Author:** [@ddatsh](https://discuss.elastic.co/u/ddatsh)\ **Replies:** 1\ **Last updated:** [February 8, 2022, 2:01am UTC](https://discuss.elastic.co/t/hope-ilm-indices-support-environment/296451 "2022-02-08T02:01:05Z")
like apm-7.17.0-span-dev-000001 apm-7.17.0-span-prod-000001 --- ## [Errors Using Iptables Module](https://discuss.elastic.co/t/errors-using-iptables-module/296501)
**Author:** [@Jarbird](https://discuss.elastic.co/u/Jarbird)\ **Replies:** 1\ **Last updated:** [February 8, 2022, 1:50am UTC](https://discuss.elastic.co/t/errors-using-iptables-module/296501 "2022-02-08T01:50:11Z")
Hello, I have been on a journey trying to use the iptables module in filebeat 7.16.3. I suspected the distro I'm using was not installing something right, specifically missing the modules/iptables directory. I then trie… --- ## [Unable to Ship logs through Grafana Loki plugin](https://discuss.elastic.co/t/unable-to-ship-logs-through-grafana-loki-plugin/296535)
**Author:** [@JPablo1982](https://discuss.elastic.co/u/JPablo1982)\ **Replies:** 2\ **Last updated:** [February 8, 2022, 1:26am UTC](https://discuss.elastic.co/t/unable-to-ship-logs-through-grafana-loki-plugin/296535 "2022-02-08T01:26:25Z")
Hello I am trying to get to work the Grafana loki Plugin for Logstash but I am getting a runtime error, here is the detail. Grafana Loki plugin was installed successfully by executing the following command: sudo /usr/… --- ## [Logstash multiple pipelines failure with persistent queues](https://discuss.elastic.co/t/logstash-multiple-pipelines-failure-with-persistent-queues/296520)
**Author:** [@proton](https://discuss.elastic.co/u/proton)\ **Replies:** 4\ **Last updated:** [February 7, 2022, 10:01pm UTC](https://discuss.elastic.co/t/logstash-multiple-pipelines-failure-with-persistent-queues/296520 "2022-02-07T22:01:15Z")
Hello! I need some help understanding pipeline to pipeline communication in logstash. I'm reading the output isolator pattern documentation and it says below: If any of the persistent queues of the downstream pipelines… --- ## [Slow query for high frequency terms](https://discuss.elastic.co/t/slow-query-for-high-frequency-terms/296528)
**Author:** [@Brodin](https://discuss.elastic.co/u/Brodin)\ **Replies:** 0\ **Last updated:** [February 7, 2022, 9:55pm UTC](https://discuss.elastic.co/t/slow-query-for-high-frequency-terms/296528 "2022-02-07T21:55:12Z")
In a index with movie titles there area vast majority with the word “the” in them. Doing a match query for said word leads to a very slow operation due to the expensive ranking that has to be done on a large part or the… --- ## [Custom EQL Query where one event happened and another didnt](https://discuss.elastic.co/t/custom-eql-query-where-one-event-happened-and-another-didnt/296524)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 0\ **Last updated:** [February 7, 2022, 9:29pm UTC](https://discuss.elastic.co/t/custom-eql-query-where-one-event-happened-and-another-didnt/296524 "2022-02-07T21:29:46Z")
Hello, Just wondering if it's possible to write an EQL query where event x happenend and event y did not happen for the same host after 0-2 minutes? Use case =\> Detecting messing with Eventlog Service Event ID 1100 is… --- ## [Exist any limitations on how a \_id document field could be](https://discuss.elastic.co/t/exist-any-limitations-on-how-a-id-document-field-could-be/296344)
**Author:** [@Silver137](https://discuss.elastic.co/u/Silver137)\ **Replies:** 3\ **Last updated:** [February 7, 2022, 9:15pm UTC](https://discuss.elastic.co/t/exist-any-limitations-on-how-a-id-document-field-could-be/296344 "2022-02-07T21:15:18Z")
I always notice that the \_id field of any index created is normaly a uuid, hash value or a simple numeric sucession depending of the use case. My question is if there are any limitation in the form and aspect when choos… [Previous page](https://discuss.elastic.co/latest.md?page=1271) [Next page](https://discuss.elastic.co/latest.md?page=1273)