# Latest **URL:** https://discuss.elastic.co/latest.md?page=1284 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1285 --- ## [Runtime Fields in Detection Rule](https://discuss.elastic.co/t/runtime-fields-in-detection-rule/295669)
**Author:** [@beijo](https://discuss.elastic.co/u/beijo)\ **Replies:** 4\ **Last updated:** [January 31, 2022, 5:53pm UTC](https://discuss.elastic.co/t/runtime-fields-in-detection-rule/295669 "2022-01-31T17:53:07Z")
Hello, I created a runtime field which I need to use in a detection rule, but I get no alerts. For the detection rule I used "Custom Query" (KQL) and I made sure to use the correct index pattern (the one where the runti… --- ## [\[JAVA\] Unexpected JSON event 'VALUE\_TRUE' instead of '\[KEY\_NAME, VALUE\_STRING\]'](https://discuss.elastic.co/t/java-unexpected-json-event-value-true-instead-of-key-name-value-string/295740)
**Author:** [@wxh](https://discuss.elastic.co/u/wxh)\ **Replies:** 10\ **Last updated:** [January 31, 2022, 5:43pm UTC](https://discuss.elastic.co/t/java-unexpected-json-event-value-true-instead-of-key-name-value-string/295740 "2022-01-31T17:43:53Z")
I am writing some code to manage Elasticsearch templates. When running the code snippet below I am getting co.elastic.clients.json.UnexpectedJsonEventException: Unexpected JSON event 'VALUE\_FALSE' instead of '\[KEY\_NAME,… --- ## [Snapshots occasionally fail](https://discuss.elastic.co/t/snapshots-occasionally-fail/295866)
**Author:** [@AnotherCorpoDrone](https://discuss.elastic.co/u/AnotherCorpoDrone)\ **Replies:** 0\ **Last updated:** [January 31, 2022, 5:20pm UTC](https://discuss.elastic.co/t/snapshots-occasionally-fail/295866 "2022-01-31T17:20:24Z")
Hi all, We're having fairly frequent issues with our pre-prod environment snapshots failing. We're using Azure as our repo, all nodes can see it and it passes the normal validation steps. I can only see a couple of lin… --- ## [7.16 Java Client - UpdateRequest example](https://discuss.elastic.co/t/7-16-java-client-updaterequest-example/295846)
**Author:** [@ndtreviv](https://discuss.elastic.co/u/ndtreviv)\ **Replies:** 3\ **Last updated:** [January 31, 2022, 4:25pm UTC](https://discuss.elastic.co/t/7-16-java-client-updaterequest-example/295846 "2022-01-31T16:25:35Z")
Hi, I'm struggling to understand how to do an UpdateRequest with the latest java client. For example, this: client.update(new UpdateRequest.Builder\<\>() .index(index) .id(id) … --- ## [Threshold rule : how to?](https://discuss.elastic.co/t/threshold-rule-how-to/295568)
**Author:** [@jfs1](https://discuss.elastic.co/u/jfs1)\ **Replies:** 2\ **Last updated:** [January 31, 2022, 3:53pm UTC](https://discuss.elastic.co/t/threshold-rule-how-to/295568 "2022-01-31T15:53:12Z")
Maybe stupid newbie question here. I want to create a rule that triggers an alert when "count(distinct(source.ip))" is above a certain threshold. Hard time figuring out how the 'Group by" and "Count" fields must be ass… --- ## [Error restoring state from URL when Opening Dashboards](https://discuss.elastic.co/t/error-restoring-state-from-url-when-opening-dashboards/295471)
**Author:** [@chjimenez](https://discuss.elastic.co/u/chjimenez)\ **Replies:** 3\ **Last updated:** [January 31, 2022, 3:31pm UTC](https://discuss.elastic.co/t/error-restoring-state-from-url-when-opening-dashboards/295471 "2022-01-31T15:31:20Z")
Hello, Since I updated from 6.8.0 to 7.16,3 always get this error " Error restoring state from URL Unable to completely restore the URL, be sure to use the share functionality." when opening any Dashboard. BUT dashboard… --- ## [Elasticsearch warning logs while stopping tomcat](https://discuss.elastic.co/t/elasticsearch-warning-logs-while-stopping-tomcat/295845)
**Author:** [@Ram\_N](https://discuss.elastic.co/u/Ram_N)\ **Replies:** 1\ **Last updated:** [January 31, 2022, 3:21pm UTC](https://discuss.elastic.co/t/elasticsearch-warning-logs-while-stopping-tomcat/295845 "2022-01-31T15:21:39Z")
Hi Im using ELK 7.10.2 and uses below code to connect to Elasticsearch using java Settings settings = Settings.builder() .put("cluster.name", elkUtil.getClusterName(Constants.ELASTICSEARCH\_YAML\_PATH)).build(); … --- ## [Only String and Array types are splittable. field:\[array\]\[method\] is of type = NilClass"](https://discuss.elastic.co/t/only-string-and-array-types-are-splittable-field-array-method-is-of-type-nilclass/295861)
**Author:** [@rutika\_kamble](https://discuss.elastic.co/u/rutika_kamble)\ **Replies:** 0\ **Last updated:** [January 31, 2022, 3:21pm UTC](https://discuss.elastic.co/t/only-string-and-array-types-are-splittable-field-array-method-is-of-type-nilclass/295861 "2022-01-31T15:21:39Z")
I am trying to input JSON data from logs through logstash to Elasticsearch but I am getting this error field:\[array\]\[method\] is of type = NilClass" Preformatted text Please find my logstash conf file- input { http { … --- ## [Iptables module not working - filebeat or elastic?](https://discuss.elastic.co/t/iptables-module-not-working-filebeat-or-elastic/295788)
**Author:** [@mevan](https://discuss.elastic.co/u/mevan)\ **Replies:** 1\ **Last updated:** [January 31, 2022, 2:13pm UTC](https://discuss.elastic.co/t/iptables-module-not-working-filebeat-or-elastic/295788 "2022-01-31T14:13:50Z")
I'm using filebeat/elastic/kibana 7.16.3 all on the same Ubuntu 20.04.3. I am receiving logs from a number of clients using the filebeat nginx and system modules but I'm having trouble with the iptables module. \*\*\* I do … --- ## [APM jar inside k8s container taking more node memory](https://discuss.elastic.co/t/apm-jar-inside-k8s-container-taking-more-node-memory/295827)
**Author:** [@Chaitanya\_krishna\_ch](https://discuss.elastic.co/u/Chaitanya_krishna_ch)\ **Replies:** 1\ **Last updated:** [January 31, 2022, 1:35pm UTC](https://discuss.elastic.co/t/apm-jar-inside-k8s-container-taking-more-node-memory/295827 "2022-01-31T13:35:01Z")
APM Agent language and version: java, 1.28.4 APM jar running inside k8s pod taking more node memory. is that expected? How to debug this issue? --- ## [How to add field that is only present in some documents?](https://discuss.elastic.co/t/how-to-add-field-that-is-only-present-in-some-documents/295283)
**Author:** [@katja1](https://discuss.elastic.co/u/katja1)\ **Replies:** 8\ **Last updated:** [January 31, 2022, 12:38pm UTC](https://discuss.elastic.co/t/how-to-add-field-that-is-only-present-in-some-documents/295283 "2022-01-31T12:38:47Z")
Hi, I have the following situation: Logs with the same ID \[grouping ID\] and different fields. grouping ID: 1 organization: xyz message: abc grouping ID: 1 organization: xyz message: abc grouping ID: 1 … --- ## [Bulk API - can't add more than one row](https://discuss.elastic.co/t/bulk-api-cant-add-more-than-one-row/295718)
**Author:** [@yamaga](https://discuss.elastic.co/u/yamaga)\ **Replies:** 3\ **Last updated:** [January 31, 2022, 12:34pm UTC](https://discuss.elastic.co/t/bulk-api-cant-add-more-than-one-row/295718 "2022-01-31T12:34:35Z")
Hi I am trying to add some data with Bulk API, but it takes only the last record of my JSON input data. Here an example with 3 record: input data: \[ { "ID\_PROD": "15136", "UNIT": "UN", "RATE": 1 }, … --- ## [Elasticsearch deployment issue in ECK cluster](https://discuss.elastic.co/t/elasticsearch-deployment-issue-in-eck-cluster/295835)
**Author:** [@rathu\_buwa](https://discuss.elastic.co/u/rathu_buwa)\ **Replies:** 0\ **Last updated:** [January 31, 2022, 12:05pm UTC](https://discuss.elastic.co/t/elasticsearch-deployment-issue-in-eck-cluster/295835 "2022-01-31T12:05:11Z")
I Already deployed ECK cluster on our on premise servers. And try to deployed 3node Elasticsearch cluster (3 master data nodes). already firewall was disabled in our VMs. we faced below issue in after Elasticsearch deplo… --- ## [Getting separate values from single variable value in logstash](https://discuss.elastic.co/t/getting-separate-values-from-single-variable-value-in-logstash/295806)
**Author:** [@mangeshs](https://discuss.elastic.co/u/mangeshs)\ **Replies:** 4\ **Last updated:** [January 31, 2022, 11:50am UTC](https://discuss.elastic.co/t/getting-separate-values-from-single-variable-value-in-logstash/295806 "2022-01-31T11:50:16Z")
I have log line as follows file\_name,file\_id,size,file\_owner,folder\_id,folder\_name,path\_ids,folder\_owner,deleted,date\_modified,date\_uploaded,folder\_paths nash+animal models.docx,884054786846,20068,xyz@123.com,1499863948… --- ## [Store binary files in elastic search](https://discuss.elastic.co/t/store-binary-files-in-elastic-search/295805)
**Author:** [@Arpita11](https://discuss.elastic.co/u/Arpita11)\ **Replies:** 8\ **Last updated:** [January 31, 2022, 11:36am UTC](https://discuss.elastic.co/t/store-binary-files-in-elastic-search/295805 "2022-01-31T11:36:19Z")
For my project, we are storing the data in Elasticsearch. I have new requirement regarding documents (i.e. the actual binaries): Store documents and be able to search the text within the document binary. Allow the use… --- ## [How do I use match query inside a nested aggregation?](https://discuss.elastic.co/t/how-do-i-use-match-query-inside-a-nested-aggregation/295811)
**Author:** [@dotel](https://discuss.elastic.co/u/dotel)\ **Replies:** 2\ **Last updated:** [January 31, 2022, 11:17am UTC](https://discuss.elastic.co/t/how-do-i-use-match-query-inside-a-nested-aggregation/295811 "2022-01-31T11:17:06Z")
Is there a way to do a match query inside nested aggregation? The query below works fine for my use case but it uses a term filter instead of a match. So searching for "nursery" will result in 0 buckets. GET sushant-ten… --- ## [Filebeat as DaemonSet in k8s cluser](https://discuss.elastic.co/t/filebeat-as-daemonset-in-k8s-cluser/295821)
**Author:** [@morb](https://discuss.elastic.co/u/morb)\ **Replies:** 0\ **Last updated:** [January 31, 2022, 10:39am UTC](https://discuss.elastic.co/t/filebeat-as-daemonset-in-k8s-cluser/295821 "2022-01-31T10:39:39Z")
Hi So I'm using helm to deploy filebeat on k8s cluster. I using bitami helm chart daemonset: Annotations to apply to the daemonset annotations: {} additionals labels labels: {} affinity: {} Include the daemonset e… --- ## [Index Health often red](https://discuss.elastic.co/t/index-health-often-red/294367)
**Author:** [@it-dept](https://discuss.elastic.co/u/it-dept)\ **Replies:** 10\ **Last updated:** [January 31, 2022, 10:24am UTC](https://discuss.elastic.co/t/index-health-often-red/294367 "2022-01-31T10:24:17Z")
Good day. We have Elasticsearch version 7.13.3 on separated server, not a cluster. And often one of the indexes turns red. We are deleting it. But after a while it turns red again. May be there is a solution to how to … --- ## [How to convert String into JSon format?](https://discuss.elastic.co/t/how-to-convert-string-into-json-format/295703)
**Author:** [@padamrai](https://discuss.elastic.co/u/padamrai)\ **Replies:** 3\ **Last updated:** [January 31, 2022, 10:17am UTC](https://discuss.elastic.co/t/how-to-convert-string-into-json-format/295703 "2022-01-31T10:17:20Z")
Hello Friends, Need your help to parse string into Json format in logstash. { "id":"xxx", "MessageCreateDate":"2022-01-20", "Response":"{'Cardholder':{'cards':\[{'isPrimaryCard':'N','cardNumber':'xxxxxxxxxx','r… --- ## [How to make \_id available for aggs?](https://discuss.elastic.co/t/how-to-make-id-available-for-aggs/295814)
**Author:** [@Emporea](https://discuss.elastic.co/u/Emporea)\ **Replies:** 0\ **Last updated:** [January 31, 2022, 10:03am UTC](https://discuss.elastic.co/t/how-to-make-id-available-for-aggs/295814 "2022-01-31T10:03:42Z")
Upon indexing I overwrote \_id with my own unique \_id field filled with integers. How can I aggregate something like max on my \_id field? max\_id: { max: { field: "\_id" } } This only throws an error. Currently I am usi… --- ## [Copy complete event to a field of a new event](https://discuss.elastic.co/t/copy-complete-event-to-a-field-of-a-new-event/295583)
**Author:** [@HansPeterSloot](https://discuss.elastic.co/u/HansPeterSloot)\ **Replies:** 7\ **Last updated:** [January 31, 2022, 9:26am UTC](https://discuss.elastic.co/t/copy-complete-event-to-a-field-of-a-new-event/295583 "2022-01-31T09:26:52Z")
Hi, I want to copy all fields of an event to a field of a new event in a logstash filter This { " agent ": " Mozilla / 5.0(compatible; MSIE 9.0)", " ip ": " 192.168.24.44 ", " request ": " / in… --- ## [Transaction trace incomplete](https://discuss.elastic.co/t/transaction-trace-incomplete/295269)
**Author:** [@benjaminCDV](https://discuss.elastic.co/u/benjaminCDV)\ **Replies:** 2\ **Last updated:** [January 31, 2022, 9:02am UTC](https://discuss.elastic.co/t/transaction-trace-incomplete/295269 "2022-01-31T09:02:55Z")
Kibana version: 7.16 Elasticsearch version: 7.16 APM Server version: 7.16 APM Agent language and version: PHP v1.4 Browser version: Original install method (e.g. download page, yum, deb, from source, etc.) and versi… --- ## [Logstash cloud.id and proxies/LB](https://discuss.elastic.co/t/logstash-cloud-id-and-proxies-lb/294223)
**Author:** [@Gustavo\_Llermaly](https://discuss.elastic.co/u/Gustavo_Llermaly)\ **Replies:** 6\ **Last updated:** [January 31, 2022, 8:44am UTC](https://discuss.elastic.co/t/logstash-cloud-id-and-proxies-lb/294223 "2022-01-31T08:44:22Z")
Hello, I'm trying to understand the use of cloud.id in Logstash. Based on this typical diagram if I configure Logstash to use the cloud.id will hit the LB layer , the prox… --- ## [Search-ui - can we use signed keys without building a custom connector?](https://discuss.elastic.co/t/search-ui-can-we-use-signed-keys-without-building-a-custom-connector/295776)
**Author:** [@Adonis\_Panagidis](https://discuss.elastic.co/u/Adonis_Panagidis)\ **Replies:** 1\ **Last updated:** [January 31, 2022, 8:35am UTC](https://discuss.elastic.co/t/search-ui-can-we-use-signed-keys-without-building-a-custom-connector/295776 "2022-01-31T08:35:54Z")
What's the recommended way of avoiding to expose the searchKey in the front-end react code? I was thinking to build a service to return the searchKey but I think using the same searchKey for all end users is not ideal. … --- ## [Give User access to execute particular query](https://discuss.elastic.co/t/give-user-access-to-execute-particular-query/295742)
**Author:** [@Adityadgr8](https://discuss.elastic.co/u/Adityadgr8)\ **Replies:** 2\ **Last updated:** [January 31, 2022, 8:35am UTC](https://discuss.elastic.co/t/give-user-access-to-execute-particular-query/295742 "2022-01-31T08:35:30Z")
Index Name : sampleindex@timestamp Everyday new index is being created with current date I made one user in kibana and assigned a particular role to the user: I already added sampleindex\* with privilages: monitor, … --- ## [Change default Page size of 50 in dashboard form saved search](https://discuss.elastic.co/t/change-default-page-size-of-50-in-dashboard-form-saved-search/294555)
**Author:** [@Moni](https://discuss.elastic.co/u/Moni)\ **Replies:** 3\ **Last updated:** [January 31, 2022, 8:27am UTC](https://discuss.elastic.co/t/change-default-page-size-of-50-in-dashboard-form-saved-search/294555 "2022-01-31T08:27:40Z")
When I try to create a dashboard from an existing saved search result (from discover) the default page size is 50 and there is no option to change this in the dashboard/panel. Atleast I could not locate. Do let me know i… --- ## [Docker logstash keeps heapdumping](https://discuss.elastic.co/t/docker-logstash-keeps-heapdumping/295801)
**Author:** [@RandomRobbie](https://discuss.elastic.co/u/RandomRobbie)\ **Replies:** 3\ **Last updated:** [January 31, 2022, 7:12am UTC](https://discuss.elastic.co/t/docker-logstash-keeps-heapdumping/295801 "2022-01-31T07:12:43Z")
Hey, I am using logstash to load a Elasticsearch full of data from text files that i wish to keep the files afterwards as well. Current Logstash Config. input { beats { port =\> 5044 } tcp { port =\> 5001 } … --- ## [Why Agent Configuration always not aplied](https://discuss.elastic.co/t/why-agent-configuration-always-not-aplied/293846)
**Author:** [@wo7387196](https://discuss.elastic.co/u/wo7387196)\ **Replies:** 10\ **Last updated:** [January 31, 2022, 6:29am UTC](https://discuss.elastic.co/t/why-agent-configuration-always-not-aplied/293846 "2022-01-31T06:29:04Z")
how to apply the config ? my agent is alive --- ## [Filtering setup for docker containers not working](https://discuss.elastic.co/t/filtering-setup-for-docker-containers-not-working/295573)
**Author:** [@mitlonik](https://discuss.elastic.co/u/mitlonik)\ **Replies:** 3\ **Last updated:** [January 31, 2022, 6:27am UTC](https://discuss.elastic.co/t/filtering-setup-for-docker-containers-not-working/295573 "2022-01-31T06:27:14Z")
filtering setup for docker containers not working. I started Elastic Stack without anybody additional settings. And here are my filebeat settings: filebeat.yml filebeat.autodiscover: providers: - type: docker … --- ## [Can I use a filebeat server for centralize log collected data from many different devices?](https://discuss.elastic.co/t/can-i-use-a-filebeat-server-for-centralize-log-collected-data-from-many-different-devices/295541)
**Author:** [@siranee.ja](https://discuss.elastic.co/u/siranee.ja)\ **Replies:** 4\ **Last updated:** [January 31, 2022, 6:16am UTC](https://discuss.elastic.co/t/can-i-use-a-filebeat-server-for-centralize-log-collected-data-from-many-different-devices/295541 "2022-01-31T06:16:54Z")
This is my example infra as the question. Fortinet device Haproxy Server Apache Server A filebeat server An ELK stack server device a filebeat server … [Previous page](https://discuss.elastic.co/latest.md?page=1283) [Next page](https://discuss.elastic.co/latest.md?page=1285)