# Latest **URL:** https://discuss.elastic.co/latest.md?page=1276 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1277 --- ## [Detecting anomalies on drop of throughput](https://discuss.elastic.co/t/detecting-anomalies-on-drop-of-throughput/296307)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 1\ **Last updated:** [February 4, 2022, 7:39pm UTC](https://discuss.elastic.co/t/detecting-anomalies-on-drop-of-throughput/296307 "2022-02-04T19:39:11Z")
Hi have data of throughput for multiple interfaces in a job, and I want to detect when the throughput drops abruptly, Im using the low\_mean function in the detector to do this, but sometimes there is an abrupt drop of t… --- ## [Infoblox module parsing](https://discuss.elastic.co/t/infoblox-module-parsing/296336)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 0\ **Last updated:** [February 4, 2022, 6:42pm UTC](https://discuss.elastic.co/t/infoblox-module-parsing/296336 "2022-02-04T18:42:28Z")
Hello, The Infoblox rsa module has 'a lot of room for improvement'.. Multiple fields are very badly parsed. For example a small extract of the network.interface.name field : As you can see there are multiple issues… --- ## [Issue with a conditional statement](https://discuss.elastic.co/t/issue-with-a-conditional-statement/296327)
**Author:** [@JeremyP](https://discuss.elastic.co/u/JeremyP)\ **Replies:** 11\ **Last updated:** [February 4, 2022, 6:19pm UTC](https://discuss.elastic.co/t/issue-with-a-conditional-statement/296327 "2022-02-04T18:19:35Z")
Hello, I'm debugging my configuration and I'm having an issue comparing two fields, both are date fields and one eventually will become a multi-valued field. All my data is static and once a record is updated, a time st… --- ## [Kibana errors](https://discuss.elastic.co/t/kibana-errors/296229)
**Author:** [@sukhsehaj](https://discuss.elastic.co/u/sukhsehaj)\ **Replies:** 5\ **Last updated:** [February 4, 2022, 5:21pm UTC](https://discuss.elastic.co/t/kibana-errors/296229 "2022-02-04T17:21:01Z")
Hello, can you plz help me troubleshoot these Kibana errors: Feb 03 19:49:32 prozokiba01.pinpointtech.com systemd\[1\]: Started Kibana. Feb 03 19:49:42 prozokiba01.pinpointtech.com kibana\[562\]: {"type":"log","@timestamp"… --- ## [Do I need a nested query or foreach or a create a new index?](https://discuss.elastic.co/t/do-i-need-a-nested-query-or-foreach-or-a-create-a-new-index/295968)
**Author:** [@clearbluelou](https://discuss.elastic.co/u/clearbluelou)\ **Replies:** 5\ **Last updated:** [February 3, 2022, 8:52pm UTC](https://discuss.elastic.co/t/do-i-need-a-nested-query-or-foreach-or-a-create-a-new-index/295968 "2022-02-03T20:52:06Z")
I'm new to Elasticsearch and Kibana. I haven't really gotten to a point of understanding of the JSON-like syntax. I've just been using the filters and some Lucene queries. Please be gentle. :blush: This is hard to e… --- ## [Capture method arguments and return value in Java](https://discuss.elastic.co/t/capture-method-arguments-and-return-value-in-java/296308)
**Author:** [@kkensy](https://discuss.elastic.co/u/kkensy)\ **Replies:** 1\ **Last updated:** [February 4, 2022, 3:18pm UTC](https://discuss.elastic.co/t/capture-method-arguments-and-return-value-in-java/296308 "2022-02-04T15:18:40Z")
Hello all, we are trying to evaluate the elastic apm solution. I want to understand whether i can capture any method arguments or return value (of selected methods) without touching the source code? A similar question … --- ## [Get list of installed packages with Elastic Agent](https://discuss.elastic.co/t/get-list-of-installed-packages-with-elastic-agent/296319)
**Author:** [@stenbot1](https://discuss.elastic.co/u/stenbot1)\ **Replies:** 0\ **Last updated:** [February 4, 2022, 2:53pm UTC](https://discuss.elastic.co/t/get-list-of-installed-packages-with-elastic-agent/296319 "2022-02-04T14:53:47Z")
I currently have an Elastic Stack that uses Auditbeats to ingest logs. I am able to use the Auditbeats to see which packages are installed in my environment looking at the Package fields. I am testing out moving from Aud… --- ## [How to decide on number of Master and data nodes between two data centers](https://discuss.elastic.co/t/how-to-decide-on-number-of-master-and-data-nodes-between-two-data-centers/295097)
**Author:** [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\ **Replies:** 8\ **Last updated:** [February 4, 2022, 2:32pm UTC](https://discuss.elastic.co/t/how-to-decide-on-number-of-master-and-data-nodes-between-two-data-centers/295097 "2022-02-04T14:32:51Z")
Hi All, We have a total of 8 servers (4 in each data center), running ELK 7.6.2 stack. How can we decide on the number of Master (or Master-eligible) nodes and data nodes? Please help --- ## [More\_like\_this not using nested fields?](https://discuss.elastic.co/t/more-like-this-not-using-nested-fields/296311)
**Author:** [@ndtreviv](https://discuss.elastic.co/u/ndtreviv)\ **Replies:** 0\ **Last updated:** [February 4, 2022, 2:27pm UTC](https://discuss.elastic.co/t/more-like-this-not-using-nested-fields/296311 "2022-02-04T14:27:47Z")
I want to use the more like this query type to find similar documents without having to construct a bool. I like the minimum\_should\_match as a percent to identify %-similar documents. My document has lots of nested fiel… --- ## [No results with larger time range](https://discuss.elastic.co/t/no-results-with-larger-time-range/296035)
**Author:** [@jukow](https://discuss.elastic.co/u/jukow)\ **Replies:** 1\ **Last updated:** [February 4, 2022, 2:22pm UTC](https://discuss.elastic.co/t/no-results-with-larger-time-range/296035 "2022-02-04T14:22:28Z")
When i do a terms aggregation with a count metric Kibana shows "No results found" for a time range of e.g. 3 days. When i lower the range to e.g. 1 day results are showing up. What kind of strange behavior is this? --- ## [Elasticsearch - monitoring query response times](https://discuss.elastic.co/t/elasticsearch-monitoring-query-response-times/296306)
**Author:** [@MSaneme](https://discuss.elastic.co/u/MSaneme)\ **Replies:** 0\ **Last updated:** [February 4, 2022, 2:00pm UTC](https://discuss.elastic.co/t/elasticsearch-monitoring-query-response-times/296306 "2022-02-04T14:00:57Z")
I would like to perform a study of the response time provided by Elasticsearch for different spatio-temporal queries. Is there any way to know the response times for each query executed on a given index? I am working w… --- ## [Configure Proxy Settings in Kibana to access Webhook](https://discuss.elastic.co/t/configure-proxy-settings-in-kibana-to-access-webhook/294604)
**Author:** [@mralladin](https://discuss.elastic.co/u/mralladin)\ **Replies:** 7\ **Last updated:** [February 4, 2022, 1:56pm UTC](https://discuss.elastic.co/t/configure-proxy-settings-in-kibana-to-access-webhook/294604 "2022-02-04T13:56:24Z")
Hello I want to send Alerts via Webhook to the Webex Api but the Kibana/Elastic Application ist behind our Company Proxy. I tried already with xpack.actions.proxyUrl: "http://TechnicalUser:Password@Proxy:Port" But it… --- ## [Elasticsearch authentication in Docker Swarm mode](https://discuss.elastic.co/t/elasticsearch-authentication-in-docker-swarm-mode/296293)
**Author:** [@FleaLes](https://discuss.elastic.co/u/FleaLes)\ **Replies:** 7\ **Last updated:** [February 4, 2022, 1:55pm UTC](https://discuss.elastic.co/t/elasticsearch-authentication-in-docker-swarm-mode/296293 "2022-02-04T13:55:28Z")
I have upgraded my Dev environment ELK stack to v 7.10.2 and I have authentication issues with connecting Kibana to Elasticsearch. Scenario The ELK stack is in Docker containers deployed in Swarm mode via a docker-comp… --- ## [创建新beat的时候卡住了](https://discuss.elastic.co/t/beat/296302)
**Author:** [@YUAN\_YE](https://discuss.elastic.co/u/YUAN_YE)\ **Replies:** 0\ **Last updated:** [February 4, 2022, 1:47pm UTC](https://discuss.elastic.co/t/beat/296302 "2022-02-04T13:47:13Z")
我把beat的版本退回到7.15打算自己创建个新的beat，但是在执行mage GenerateCustomBeat时候卡住，创建时选的版本7.15和master都会卡住，不过卡的地方不一样。有大佬知道怎么解决吗 --- ## [Elastic migration](https://discuss.elastic.co/t/elastic-migration/296298)
**Author:** [@Petr\_Bucek](https://discuss.elastic.co/u/Petr_Bucek)\ **Replies:** 0\ **Last updated:** [February 4, 2022, 1:21pm UTC](https://discuss.elastic.co/t/elastic-migration/296298 "2022-02-04T13:21:47Z")
Hello, I have general question. I have elastic on-prem solution in old DC. (that DC will be decommissioned and we cannot move the physical servers) I need to migrate from one DC (on-prem solution) to another DC (virtu… --- ## [Unable to set "defaultRoute" in kibana configuration file in kibana 7.10.2](https://discuss.elastic.co/t/unable-to-set-defaultroute-in-kibana-configuration-file-in-kibana-7-10-2/296231)
**Author:** [@Usman18](https://discuss.elastic.co/u/Usman18)\ **Replies:** 1\ **Last updated:** [February 4, 2022, 1:15pm UTC](https://discuss.elastic.co/t/unable-to-set-defaultroute-in-kibana-configuration-file-in-kibana-7-10-2/296231 "2022-02-04T13:15:43Z")
I want to remove all deprecation warnings from the kibana. In the logs, I have seen that kibana.defaultAppId has been deprecated and it has been suggested that defaultRoute should be used. But when i set this option in k… --- ## [Input tcp codec fluent: invalid byte sequence in UTF-8 in regex](https://discuss.elastic.co/t/input-tcp-codec-fluent-invalid-byte-sequence-in-utf-8-in-regex/296290)
**Author:** [@Samuel\_Lima1](https://discuss.elastic.co/u/Samuel_Lima1)\ **Replies:** 0\ **Last updated:** [February 4, 2022, 12:45pm UTC](https://discuss.elastic.co/t/input-tcp-codec-fluent-invalid-byte-sequence-in-utf-8-in-regex/296290 "2022-02-04T12:45:40Z")
Hi folks, I'm using input tcp codec fluent and getting error " invalid byte sequence in UTF-8" when doing regex. It seems there is an invalid character in the message. Any idea how to solve it? Is there a way to simpl… --- ## [Filebeat as sidecar best practices](https://discuss.elastic.co/t/filebeat-as-sidecar-best-practices/296289)
**Author:** [@rpetre](https://discuss.elastic.co/u/rpetre)\ **Replies:** 0\ **Last updated:** [February 4, 2022, 12:04pm UTC](https://discuss.elastic.co/t/filebeat-as-sidecar-best-practices/296289 "2022-02-04T12:04:06Z")
I'm using filebeat inside of kubernetes both as daemonset (to capture stdout of all containers), but also as sidecar in specific pods, to ship application logs that are written to shared volumes. The documentation is som… --- ## [Local Storage Full](https://discuss.elastic.co/t/local-storage-full/296078)
**Author:** [@eprop-marc](https://discuss.elastic.co/u/eprop-marc)\ **Replies:** 6\ **Last updated:** [February 4, 2022, 11:43am UTC](https://discuss.elastic.co/t/local-storage-full/296078 "2022-02-04T11:43:18Z")
Hi, the local storage on my ELK stack is 95% full and I can no longer see logs in Elastic. I just wanted some advice on how best to reduce the storage on the local disk please and start using Elastic again. I don't reall… --- ## [Date Histogram Visualization](https://discuss.elastic.co/t/date-histogram-visualization/296199)
**Author:** [@kibanauser4](https://discuss.elastic.co/u/kibanauser4)\ **Replies:** 3\ **Last updated:** [February 4, 2022, 11:40am UTC](https://discuss.elastic.co/t/date-histogram-visualization/296199 "2022-02-04T11:40:41Z")
I have a Datetime field in my index and I want to show a visualization where I will be able to see in which hours my records are the most frequent. But when I use the Date Histogram and choose to show "per 2 hours" for e… --- ## [Haystack US 2022 - The Search Relevance Conference 27/28 April - Call for Papers is Open](https://discuss.elastic.co/t/haystack-us-2022-the-search-relevance-conference-27-28-april-call-for-papers-is-open/296284)
**Author:** [@flaxsearch](https://discuss.elastic.co/u/flaxsearch)\ **Replies:** 0\ **Last updated:** [February 4, 2022, 11:34am UTC](https://discuss.elastic.co/t/haystack-us-2022-the-search-relevance-conference-27-28-april-call-for-papers-is-open/296284 "2022-02-04T11:34:37Z")
Save the Dates - Haystack US 2022 will return to Charlottesville, Virginia on 27th & 28th April 2022. Haystack is the conference for organizations where search, matching, and relevance really matters to the bottom line.… --- ## [Unable see document fields in "Add Field" selector in Kibana / Graph](https://discuss.elastic.co/t/unable-see-document-fields-in-add-field-selector-in-kibana-graph/295601)
**Author:** [@blackge](https://discuss.elastic.co/u/blackge)\ **Replies:** 2\ **Last updated:** [February 4, 2022, 10:48am UTC](https://discuss.elastic.co/t/unable-see-document-fields-in-add-field-selector-in-kibana-graph/295601 "2022-02-04T10:48:55Z")
Hi, I've just started experimenting with Graphs in Kibana and I'm only seeing a subset of the fields in my documents available to select for the graph. When I click on the add fields, I see 9 fields in the "Add Fields"… --- ## [Converting Null values to Zero](https://discuss.elastic.co/t/converting-null-values-to-zero/295707)
**Author:** [@AmyMCollins](https://discuss.elastic.co/u/AmyMCollins)\ **Replies:** 1\ **Last updated:** [February 4, 2022, 10:30am UTC](https://discuss.elastic.co/t/converting-null-values-to-zero/295707 "2022-02-04T10:30:49Z")
Hi, I am trying to get the cumulative sum of the columns 'Loaded' and 'Worked' in Canvas. I can do it with the below query but when I remove the limit statement it fails. I believe this is because the pivot creates null… --- ## [How do I apply Elastic.Apm.StackExchange.Redis to Microsoft's IDistributedCache?](https://discuss.elastic.co/t/how-do-i-apply-elastic-apm-stackexchange-redis-to-microsofts-idistributedcache/292324)
**Author:** [@skuc-fp](https://discuss.elastic.co/u/skuc-fp)\ **Replies:** 1\ **Last updated:** [February 4, 2022, 10:29am UTC](https://discuss.elastic.co/t/how-do-i-apply-elastic-apm-stackexchange-redis-to-microsofts-idistributedcache/292324 "2022-02-04T10:29:09Z")
Like the title says, how do I apply Elastic.Apm.StackExchange.Redis to Microsoft's IDistributedCache? The package exposes an UseElasticApm extension method to IConnectionMultiplexer, but the IDistributedCache creates it… --- ## [Lens visualisation doesn't sort on formula result](https://discuss.elastic.co/t/lens-visualisation-doesnt-sort-on-formula-result/296258)
**Author:** [@Dominik11](https://discuss.elastic.co/u/Dominik11)\ **Replies:** 3\ **Last updated:** [February 4, 2022, 10:25am UTC](https://discuss.elastic.co/t/lens-visualisation-doesnt-sort-on-formula-result/296258 "2022-02-04T10:25:19Z")
Hi all, I have been recreating some of my dashboards using Lens visualisations but I stumbled on a seemingly illogical limitation. The concept of one visualisation is like this : I have 50+ API's running and I want to … --- ## [Query on Elasticsearch license updates](https://discuss.elastic.co/t/query-on-elasticsearch-license-updates/294900)
**Author:** [@mohammed.sabil](https://discuss.elastic.co/u/mohammed.sabil)\ **Replies:** 4\ **Last updated:** [February 4, 2022, 10:13am UTC](https://discuss.elastic.co/t/query-on-elasticsearch-license-updates/294900 "2022-02-04T10:13:16Z")
Hello Team, I would like to know about the licencing changes in Elasticsearch. Currently I am using Elasticsearch 7.16.2 along with Filebeat. I heard that there some changes in lincencing of Elasticsearch. We are comp… --- ## [Using multiple similarity metrics on an existing index](https://discuss.elastic.co/t/using-multiple-similarity-metrics-on-an-existing-index/296274)
**Author:** [@mkaze](https://discuss.elastic.co/u/mkaze)\ **Replies:** 0\ **Last updated:** [February 4, 2022, 10:03am UTC](https://discuss.elastic.co/t/using-multiple-similarity-metrics-on-an-existing-index/296274 "2022-02-04T10:03:55Z")
I was wondering if it's possible to use multiple similarity metrics for an index in Elasticsearch. Let's assume I have already defined an index with a customized BM25 similarity metric (say, with b=1), and now I would li… --- ## [ドキュメントAPIにて、インデックス名に動的に日付を設定する方法](https://discuss.elastic.co/t/api/293513)
**Author:** [@t-nakata](https://discuss.elastic.co/u/t-nakata)\ **Replies:** 10\ **Last updated:** [February 4, 2022, 9:45am UTC](https://discuss.elastic.co/t/api/293513 "2022-02-04T09:45:41Z")
以下のドキュメントに示されるAPIにて、インデックス名に現在月を付与したいです PUT my-index-000001/\_doc/1?timeout=5m { "@timestamp": "2099-11-15T13:12:00", "message": "GET /search HTTP/1.1 200 1070000", "user": { "id": "kimchy" } } 上記APIにて、インデ… --- ## [Split document in mongodb with logstash](https://discuss.elastic.co/t/split-document-in-mongodb-with-logstash/296271)
**Author:** [@alex\_vermex](https://discuss.elastic.co/u/alex_vermex)\ **Replies:** 0\ **Last updated:** [February 4, 2022, 9:43am UTC](https://discuss.elastic.co/t/split-document-in-mongodb-with-logstash/296271 "2022-02-04T09:43:45Z")
Hi, I would to know how to split document in mongodb with logstash because i send data from logstash to mongodb automtically so i want to split some document automatically so i think it's possible in bloc filter in logs… --- ## [Docker pull Fleet Elastic Package Registry 7.17.0 failing](https://discuss.elastic.co/t/docker-pull-fleet-elastic-package-registry-7-17-0-failing/296222)
**Author:** [@dyltay](https://discuss.elastic.co/u/dyltay)\ **Replies:** 1\ **Last updated:** [February 4, 2022, 9:41am UTC](https://discuss.elastic.co/t/docker-pull-fleet-elastic-package-registry-7-17-0-failing/296222 "2022-02-04T09:41:42Z")
Hello, Trying to pull down the latest Fleet Package-Registry to host in an air-gapped environment: https://www.elastic.co/guide/en/fleet/current/air-gapped.html The command for the latest version (currently 7.17.0) is… [Previous page](https://discuss.elastic.co/latest.md?page=1275) [Next page](https://discuss.elastic.co/latest.md?page=1277)