# Latest **URL:** https://discuss.elastic.co/latest.md?page=1280 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1281 --- ## [Is it possible to use a (previously created) runtime field in a transform?](https://discuss.elastic.co/t/is-it-possible-to-use-a-previously-created-runtime-field-in-a-transform/296104)
**Author:** [@colin1](https://discuss.elastic.co/u/colin1)\ **Replies:** 2\ **Last updated:** [February 2, 2022, 6:13pm UTC](https://discuss.elastic.co/t/is-it-possible-to-use-a-previously-created-runtime-field-in-a-transform/296104 "2022-02-02T18:13:55Z")
Hi, I'm trying to use kibana's 'transform' gui to aggregate some data. One of the fields I'd like to aggregate is a runtime field that I created in the index mappings. This field is an integer whose value is set depen… --- ## [Failed to setup password in APM\_SYSTEM in 7.16](https://discuss.elastic.co/t/failed-to-setup-password-in-apm-system-in-7-16/293815)
**Author:** [@vijay\_kaali](https://discuss.elastic.co/u/vijay_kaali)\ **Replies:** 2\ **Last updated:** [February 2, 2022, 5:29pm UTC](https://discuss.elastic.co/t/failed-to-setup-password-in-apm-system-in-7-16/293815 "2022-02-02T17:29:16Z")
How to setup basic + tls security in Elasticsearch i am following Set up minimal security for Elasticsearch | Elasticsearch Guide \[7.16\] | Elastic my elk was in 7.12 with "xpack.security.enabled" to true and discovery… --- ## [Update Kibana Filter from Vega](https://discuss.elastic.co/t/update-kibana-filter-from-vega/295598)
**Author:** [@TUKTUK](https://discuss.elastic.co/u/TUKTUK)\ **Replies:** 3\ **Last updated:** [February 2, 2022, 5:12pm UTC](https://discuss.elastic.co/t/update-kibana-filter-from-vega/295598 "2022-02-02T17:12:46Z")
Hello all, I am quite new to the Vega world inside Kibana and would like to make a Vega visualization interactive so that the Kibana filters are updated on click. I have seen the following tutorial --\> \[Update Timefilt… --- ## [Elastic Ingest Pipeline Works with Test, but Fails on real usage](https://discuss.elastic.co/t/elastic-ingest-pipeline-works-with-test-but-fails-on-real-usage/295984)
**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Replies:** 16\ **Last updated:** [February 2, 2022, 4:57pm UTC](https://discuss.elastic.co/t/elastic-ingest-pipeline-works-with-test-but-fails-on-real-usage/295984 "2022-02-02T16:57:05Z")
Hi All, Elasticsearch: 7.16.2 Logstash: 7.16.2 I have an ingest pipeline which processes syslog messages: Example message: \<86\>Feb 1 18:38:07 ASDF1234 sudo: pam\_unix(sudo:session): session closed for user root The … --- ## [Metricbeat 7.16.3 error determining cgroups version: error reading /proc/\/cgroup:](https://discuss.elastic.co/t/metricbeat-7-16-3-error-determining-cgroups-version-error-reading-proc-pid-cgroup/296100)
**Author:** [@kbujold\_wr](https://discuss.elastic.co/u/kbujold_wr)\ **Replies:** 0\ **Last updated:** [February 2, 2022, 4:55pm UTC](https://discuss.elastic.co/t/metricbeat-7-16-3-error-determining-cgroups-version-error-reading-proc-pid-cgroup/296100 "2022-02-02T16:55:45Z")
These errors keep being generated in the metricbeat logs. 2022-02-02T16:11:02.411Z ERROR metrics/metrics.go:304 error determining cgroups version: error reading /proc/3950736/cgroup: open /proc/3950736/cgroup:… --- ## [Process custom logs format](https://discuss.elastic.co/t/process-custom-logs-format/296092)
**Author:** [@MHQurashi](https://discuss.elastic.co/u/MHQurashi)\ **Replies:** 0\ **Last updated:** [February 2, 2022, 4:28pm UTC](https://discuss.elastic.co/t/process-custom-logs-format/296092 "2022-02-02T16:28:49Z")
Hi I’m trying to ingest log files with custom format so the line looks like this: \[date and time\]\[tab\]\[info1\]\[tab\]\[info2\]\[pipe\]\[info3\]\[pipe\]\[info4\] So separators are mix of tabs and pipes. Not to mention that last inf… --- ## [Kibana how to hide panels and display them after filter](https://discuss.elastic.co/t/kibana-how-to-hide-panels-and-display-them-after-filter/295945)
**Author:** [@fionachan](https://discuss.elastic.co/u/fionachan)\ **Replies:** 6\ **Last updated:** [February 2, 2022, 4:16pm UTC](https://discuss.elastic.co/t/kibana-how-to-hide-panels-and-display-them-after-filter/295945 "2022-02-02T16:16:21Z")
Hi, I would like to ask a question about Kibana. I would like to hide some panels at the beginning and when I filter, the panels that are hidden show. How can I come true to it? Thanks. --- ## [Cluster Upgrade, Shard Allocation and null vs all](https://discuss.elastic.co/t/cluster-upgrade-shard-allocation-and-null-vs-all/295867)
**Author:** [@georgef](https://discuss.elastic.co/u/georgef)\ **Replies:** 6\ **Last updated:** [February 2, 2022, 4:08pm UTC](https://discuss.elastic.co/t/cluster-upgrade-shard-allocation-and-null-vs-all/295867 "2022-02-02T16:08:19Z")
Good Afternoon, I was conducting a rolling upgrade from 7.16.2 to 7.16.3 using the directions at Rolling upgrades | Elasticsearch Guide \[7.16\]. I stopped shard allocation with "cluster.routing.allocation.enable": prima… --- ## [Illegal\_argument\_exception when opening dashboard](https://discuss.elastic.co/t/illegal-argument-exception-when-opening-dashboard/295270)
**Author:** [@yelloyonder](https://discuss.elastic.co/u/yelloyonder)\ **Replies:** 2\ **Last updated:** [February 2, 2022, 3:03pm UTC](https://discuss.elastic.co/t/illegal-argument-exception-when-opening-dashboard/295270 "2022-02-02T15:03:58Z")
For ref we're using Elastic Cloud. When opening a particular dashboard we see a shard failure. The error reason is: Text fields are not optimised for operations that require per-document field data like aggregations a… --- ## [Ingest pipeline: weird behaviour in changing the order of the grok processor patterns](https://discuss.elastic.co/t/ingest-pipeline-weird-behaviour-in-changing-the-order-of-the-grok-processor-patterns/295918)
**Author:** [@jsteenkamp](https://discuss.elastic.co/u/jsteenkamp)\ **Replies:** 1\ **Last updated:** [February 2, 2022, 2:26pm UTC](https://discuss.elastic.co/t/ingest-pipeline-weird-behaviour-in-changing-the-order-of-the-grok-processor-patterns/295918 "2022-02-02T14:26:13Z")
Kibana 7.16.3 in latest Firefox and Brave (chromium) browsers steps to reproduce: go to app/management/ingest/ingest\_pipelines create pipeline name: any add processor: grok field: message first pattern: ^%{GREEDYDATA:… --- ## [New aggregation based visualisation line percentiles does not show y-axis labels anymore](https://discuss.elastic.co/t/new-aggregation-based-visualisation-line-percentiles-does-not-show-y-axis-labels-anymore/295914)
**Author:** [@jsteenkamp](https://discuss.elastic.co/u/jsteenkamp)\ **Replies:** 3\ **Last updated:** [February 2, 2022, 2:22pm UTC](https://discuss.elastic.co/t/new-aggregation-based-visualisation-line-percentiles-does-not-show-y-axis-labels-anymore/295914 "2022-02-02T14:22:26Z")
Kibana 7.16.3 in latest Firefox and Brave (chromium) browser Steps to reproduce: app/visualize create aggregation based line select a saved search aggregation: percentiles field: any number field bucket: add x-axis ag… --- ## [Logstash reading from .log file is not consistent](https://discuss.elastic.co/t/logstash-reading-from-log-file-is-not-consistent/295661)
**Author:** [@HungNV](https://discuss.elastic.co/u/HungNV)\ **Replies:** 5\ **Last updated:** [February 2, 2022, 2:03pm UTC](https://discuss.elastic.co/t/logstash-reading-from-log-file-is-not-consistent/295661 "2022-02-02T14:03:21Z")
I got some error when logstash reading from .log file. Some time it cannot read whole content in a line. Im using logstash version 7.16.1 Here the input config: input { file { path =\> "${LOG\_PATH}" codec =\> json … --- ## [\[AWS Lambda java Agent\] Tool agent requires sharing to be disabled](https://discuss.elastic.co/t/aws-lambda-java-agent-tool-agent-requires-sharing-to-be-disabled/295726)
**Author:** [@miltonhit](https://discuss.elastic.co/u/miltonhit)\ **Replies:** 1\ **Last updated:** [February 2, 2022, 12:45pm UTC](https://discuss.elastic.co/t/aws-lambda-java-agent-tool-agent-requires-sharing-to-be-disabled/295726 "2022-02-02T12:45:46Z")
Kibana version: 7.16.3 Elasticsearch version: 7.16.3 APM Server version: 7.16.3 APM Agent language and version: elastic-apm-java-aws-lambda-layer-1.28.4.zip Original install method: Steps to reproduce: Creat… --- ## [Body optimisation with nested objects / filter](https://discuss.elastic.co/t/body-optimisation-with-nested-objects-filter/295964)
**Author:** [@Emporea](https://discuss.elastic.co/u/Emporea)\ **Replies:** 5\ **Last updated:** [February 2, 2022, 12:09pm UTC](https://discuss.elastic.co/t/body-optimisation-with-nested-objects-filter/295964 "2022-02-02T12:09:22Z")
I have a working query, what I am asking is if there is a more simple way for my query. I dont understand why using filter has to be so complicated. Am I missing something? I have such a terribly nested body. I have an… --- ## [Repo register issue](https://discuss.elastic.co/t/repo-register-issue/296016)
**Author:** [@Levan\_Medoshvili](https://discuss.elastic.co/u/Levan_Medoshvili)\ **Replies:** 5\ **Last updated:** [February 2, 2022, 11:41am UTC](https://discuss.elastic.co/t/repo-register-issue/296016 "2022-02-02T11:41:26Z")
Hello I have Elasticsearch installed in Windows Server. I want to take snapshot and restore it in another server. I have added in Elasticsearch.yml file path.repo and location path.repo: "D:\\ES\_Backup" When I am try… --- ## [Filebeat filtering, drop event processor script](https://discuss.elastic.co/t/filebeat-filtering-drop-event-processor-script/295538)
**Author:** [@finiteAutomate](https://discuss.elastic.co/u/finiteAutomate)\ **Replies:** 11\ **Last updated:** [February 2, 2022, 10:58am UTC](https://discuss.elastic.co/t/filebeat-filtering-drop-event-processor-script/295538 "2022-02-02T10:58:57Z")
Hello team, Im new on filebeat and i want to ask about processor script on filebeat. I have a log file that contains some event.code. i want to exclude 3 event code based on this condition below from my log event.code… --- ## [Split and get part of a long string in painless](https://discuss.elastic.co/t/split-and-get-part-of-a-long-string-in-painless/295575)
**Author:** [@auato](https://discuss.elastic.co/u/auato)\ **Replies:** 17\ **Last updated:** [February 2, 2022, 10:36am UTC](https://discuss.elastic.co/t/split-and-get-part-of-a-long-string-in-painless/295575 "2022-02-02T10:36:49Z")
Hi, I would like to get from the following examples of string a specific part (in bold) in painless script in Kibana: APAC42\_OM/VM:Virtual machine name=APAC42\_ELETYPE\_\*\*CSBBU\*\*\_0 APAC42\_OM/VM:Virtual machine name=APAC42… --- ## [Elasticsearch upgrade 7.16.2](https://discuss.elastic.co/t/elasticsearch-upgrade-7-16-2/296042)
**Author:** [@Vaibhav\_Yadav](https://discuss.elastic.co/u/Vaibhav_Yadav)\ **Replies:** 3\ **Last updated:** [February 2, 2022, 10:31am UTC](https://discuss.elastic.co/t/elasticsearch-upgrade-7-16-2/296042 "2022-02-02T10:31:53Z")
How to upgrade Elasticsearch 7.10 to Elasticsearch 7.16.2 on the Windows platform? --- ## [Filebeat: Exiting: Error while initializing input: Error creating input. No such input type exist: 'aws-cloudwatch'](https://discuss.elastic.co/t/filebeat-exiting-error-while-initializing-input-error-creating-input-no-such-input-type-exist-aws-cloudwatch/295942)
**Author:** [@h4rdl0ck](https://discuss.elastic.co/u/h4rdl0ck)\ **Replies:** 7\ **Last updated:** [February 2, 2022, 10:24am UTC](https://discuss.elastic.co/t/filebeat-exiting-error-while-initializing-input-error-creating-input-no-such-input-type-exist-aws-cloudwatch/295942 "2022-02-02T10:24:30Z")
Hello everyone, filebeat stopped because it supposedly doesn't exist for the input type aws-cloudwatch. That's the error-messsage: 2022-02-01T11:02:36.673Z ERROR instance/beat.go:933 Exiting: Error while initializing i… --- ## [Upgrading NGINX for Elasticsearch server vulnerability](https://discuss.elastic.co/t/upgrading-nginx-for-elasticsearch-server-vulnerability/296046)
**Author:** [@Jane\_Garcia](https://discuss.elastic.co/u/Jane_Garcia)\ **Replies:** 1\ **Last updated:** [February 2, 2022, 9:57am UTC](https://discuss.elastic.co/t/upgrading-nginx-for-elasticsearch-server-vulnerability/296046 "2022-02-02T09:57:47Z")
We have nginx 0.6.x \< 1.20.1 1-Byte Memory Overwrite RCE vulnerability for Elasticsearch server (v. 2.4.6) as mentioned in nginx 0.6.x \< 1.20.1 1-Byte Memory Overwrite RCE | Tenable® we need to upgrade to 1.20.1 or late… --- ## [Split chart order by not working anymore?](https://discuss.elastic.co/t/split-chart-order-by-not-working-anymore/295868)
**Author:** [@ncasaux](https://discuss.elastic.co/u/ncasaux)\ **Replies:** 2\ **Last updated:** [February 2, 2022, 9:50am UTC](https://discuss.elastic.co/t/split-chart-order-by-not-working-anymore/295868 "2022-02-02T09:50:33Z")
Hello, I'm using the 7.16.3 versions of Kibana and Elasticsearch. The "order by" of the "split chart" bucket in a bar chart does not seem to work properly anymore. In my usecase, I'm using a "Custom metric" to do the… --- ## [Elastic-agent - Elasticsearch node monitoring with Elasticsearch integration](https://discuss.elastic.co/t/elastic-agent-elasticsearch-node-monitoring-with-elasticsearch-integration/295081)
**Author:** [@fselim](https://discuss.elastic.co/u/fselim)\ **Replies:** 2\ **Last updated:** [February 2, 2022, 9:34am UTC](https://discuss.elastic.co/t/elastic-agent-elasticsearch-node-monitoring-with-elasticsearch-integration/295081 "2022-02-02T09:34:24Z")
Hello, I'm new to the concept of the elastic-agent and I've read through the documentation. With that I've spinned up a fleet server with functioning APM integration and system logs/metrics collection. Now I'm coming t… --- ## [Reset password api is not working](https://discuss.elastic.co/t/reset-password-api-is-not-working/296028)
**Author:** [@Sunil\_Bhakar](https://discuss.elastic.co/u/Sunil_Bhakar)\ **Replies:** 3\ **Last updated:** [February 2, 2022, 9:12am UTC](https://discuss.elastic.co/t/reset-password-api-is-not-working/296028 "2022-02-02T09:12:27Z")
{ "error" : { "root\_cause" : \[ { "type" : "status\_exception", "reason" : "Cluster state has not been recovered yet, cannot write to the \[null\] index" } \], "type" : "status\_exception", "reason" : "Cluster state h… --- ## [Reading existing indexes not created by beats/agents](https://discuss.elastic.co/t/reading-existing-indexes-not-created-by-beats-agents/295098)
**Author:** [@rjconroy](https://discuss.elastic.co/u/rjconroy)\ **Replies:** 5\ **Last updated:** [February 2, 2022, 8:59am UTC](https://discuss.elastic.co/t/reading-existing-indexes-not-created-by-beats-agents/295098 "2022-02-02T08:59:22Z")
Im circling back to a past issue after getting pulled in another direction. Long story short what im trying to do is get elastic security to read existing elastic indexes that were not created by any beats or elastic sec… --- ## [How to create grok/json filter to parse the below json format](https://discuss.elastic.co/t/how-to-create-grok-json-filter-to-parse-the-below-json-format/296022)
**Author:** [@Adabi\_Raihan](https://discuss.elastic.co/u/Adabi_Raihan)\ **Replies:** 9\ **Last updated:** [February 2, 2022, 8:49am UTC](https://discuss.elastic.co/t/how-to-create-grok-json-filter-to-parse-the-below-json-format/296022 "2022-02-02T08:49:28Z")
Hi Guys, I want to parse this JSON to Kibana using Logstash { "Format": "IDEA0", "ID": "2b03eb1f-fc4c-4f67-94e5-31c9fb32dccc", "DetectTime": "2022-01-31T08:16:12.600470+07:00", "EventTime": "2022-01-31T01:23:01.637438+… --- ## [Kibana Lens Dashboard new headline with other values/filter](https://discuss.elastic.co/t/kibana-lens-dashboard-new-headline-with-other-values-filter/295950)
**Author:** [@zangero98](https://discuss.elastic.co/u/zangero98)\ **Replies:** 2\ **Last updated:** [February 2, 2022, 8:04am UTC](https://discuss.elastic.co/t/kibana-lens-dashboard-new-headline-with-other-values-filter/295950 "2022-02-02T08:04:58Z")
Hello, i want to add a new headline here, where i can check other fields. But i don't want a new column on the right but a new headline that is independent so I can place customs counts... in it. It should look like… --- ## [Fallback value for a bucket aggregation](https://discuss.elastic.co/t/fallback-value-for-a-bucket-aggregation/295983)
**Author:** [@Andrew\_Graham-Yooll](https://discuss.elastic.co/u/Andrew_Graham-Yooll)\ **Replies:** 4\ **Last updated:** [February 2, 2022, 7:51am UTC](https://discuss.elastic.co/t/fallback-value-for-a-bucket-aggregation/295983 "2022-02-02T07:51:22Z")
I know this query works. However it does not work when the value of either "failed" or "declined" is not present. GET /metrics-\*/\_search { "size": 0, "query": { "bool": { "filter": \[ { "t… --- ## [Split fields in different docs](https://discuss.elastic.co/t/split-fields-in-different-docs/295895)
**Author:** [@cris](https://discuss.elastic.co/u/cris)\ **Replies:** 8\ **Last updated:** [February 2, 2022, 6:23am UTC](https://discuss.elastic.co/t/split-fields-in-different-docs/295895 "2022-02-02T06:23:54Z")
Hello friends. I am trying to reindex some data to another index but with a little differences. In the first index I have this kind of hit: { "France": { "Testing": { "status": "passed" } }, "Spain"… --- ## [Logstash is terminating with EACCES Permission denied](https://discuss.elastic.co/t/logstash-is-terminating-with-eacces-permission-denied/296032)
**Author:** [@HELIXInternational](https://discuss.elastic.co/u/HELIXInternational)\ **Replies:** 0\ **Last updated:** [February 2, 2022, 6:48am UTC](https://discuss.elastic.co/t/logstash-is-terminating-with-eacces-permission-denied/296032 "2022-02-02T06:48:00Z")
Hi All, logstash javapipeline is terminating Please can anyone help on this issue, It will be much helpful for us. logstash-plain \[2022-02-01T08:06:01,333\]\[INFO \]\[logstash.runner \] Log4j configuration path u… --- ## [Same IPs are showing in stack monitoring](https://discuss.elastic.co/t/same-ips-are-showing-in-stack-monitoring/295803)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 3\ **Last updated:** [February 2, 2022, 5:37am UTC](https://discuss.elastic.co/t/same-ips-are-showing-in-stack-monitoring/295803 "2022-02-02T05:37:09Z")
Running ELK stack 7.15.2 version I have 3 master node and 3 data nodes and 2 warm nodes.Metricbeat is running in all master nodes.Metricbeat version is 7.15.2. /etc/metricbeat/metricbeat.yml file #####################… [Previous page](https://discuss.elastic.co/latest.md?page=1279) [Next page](https://discuss.elastic.co/latest.md?page=1281)