# Latest **URL:** https://discuss.elastic.co/latest.md?page=1285 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1286 --- ## [How to use Grok for JSON parsing](https://discuss.elastic.co/t/how-to-use-grok-for-json-parsing/295794)
**Author:** [@Adabi\_Raihan](https://discuss.elastic.co/u/Adabi_Raihan)\ **Replies:** 2\ **Last updated:** [January 31, 2022, 4:58am UTC](https://discuss.elastic.co/t/how-to-use-grok-for-json-parsing/295794 "2022-01-31T04:58:59Z")
Hi, I want to parse this JSON object to ELK { "Format": "IDEA0", "ID": "2b03eb1f-fc4c-4f67-94e5-31c9fb32dccc", "DetectTime": "2022-01-31T08:16:12.600470+07:00", "EventTime": "2022-01-31T01:23:01.637438+00:00", "Categor… --- ## [Hi all, I want to Index data into elasticsearch using PHP. Can anyone guide me?](https://discuss.elastic.co/t/hi-all-i-want-to-index-data-into-elasticsearch-using-php-can-anyone-guide-me/295652)
**Author:** [@Chinmay\_Bhusate](https://discuss.elastic.co/u/Chinmay_Bhusate)\ **Replies:** 4\ **Last updated:** [January 31, 2022, 4:23am UTC](https://discuss.elastic.co/t/hi-all-i-want-to-index-data-into-elasticsearch-using-php-can-anyone-guide-me/295652 "2022-01-31T04:23:45Z")
I want to Index data Using PHP . But not able to configure the settings. --- ## [Cef message split](https://discuss.elastic.co/t/cef-message-split/295797)
**Author:** [@Rohit\_Mangotra](https://discuss.elastic.co/u/Rohit_Mangotra)\ **Replies:** 5\ **Last updated:** [January 31, 2022, 4:08am UTC](https://discuss.elastic.co/t/cef-message-split/295797 "2022-01-31T04:08:46Z")
Hi, I am new to ELK and learning it now as part of my job. I am getting .cef logs from imperva waf that needs to be split in to fields so that it can be uploaded to the Elastic. Please let me know how I can achieve thi… --- ## [Using document properties in alert index rule](https://discuss.elastic.co/t/using-document-properties-in-alert-index-rule/292972)
**Author:** [@tflorac](https://discuss.elastic.co/u/tflorac)\ **Replies:** 3\ **Last updated:** [January 30, 2022, 11:50pm UTC](https://discuss.elastic.co/t/using-document-properties-in-alert-index-rule/292972 "2022-01-30T23:50:40Z")
Hi, I'm using Elasticsearch and Kibana 7.16.2, and I'm trying to create custom alerts rules. I've created a rule which is using an index action and everything is nearly OK, but my question is: how can I include propert… --- ## [No iptables in elasticsearch](https://discuss.elastic.co/t/no-iptables-in-elasticsearch/295770)
**Author:** [@mevan](https://discuss.elastic.co/u/mevan)\ **Replies:** 1\ **Last updated:** [January 30, 2022, 9:38pm UTC](https://discuss.elastic.co/t/no-iptables-in-elasticsearch/295770 "2022-01-30T21:38:13Z")
I'm very new to filebeat/Elasticsearch so unsure how to debug this. I have filebeat, Elasticsearch and kibana working. I can see many of my logs being ingested from /var/log/syslog. However, although I have the iptables … --- ## [Return documents that matches : Filter nested record with Max Start date and match a keyword : Search for candidate having last job with a keyword](https://discuss.elastic.co/t/return-documents-that-matches-filter-nested-record-with-max-start-date-and-match-a-keyword-search-for-candidate-having-last-job-with-a-keyword/295786)
**Author:** [@aloksharma](https://discuss.elastic.co/u/aloksharma)\ **Replies:** 0\ **Last updated:** [January 30, 2022, 7:51pm UTC](https://discuss.elastic.co/t/return-documents-that-matches-filter-nested-record-with-max-start-date-and-match-a-keyword-search-for-candidate-having-last-job-with-a-keyword/295786 "2022-01-30T19:51:50Z")
Hi, After all tries I am here to seek help. I have following structure of the document: { "candidate\_id" : 1234, "location" : { "city" : "NY", "country" : "US" }, "age" : 32, "highest\_education" : "Graduate", "job\_his… --- ## [Query terms with dash in string?](https://discuss.elastic.co/t/query-terms-with-dash-in-string/295780)
**Author:** [@Emporea](https://discuss.elastic.co/u/Emporea)\ **Replies:** 3\ **Last updated:** [January 30, 2022, 4:01pm UTC](https://discuss.elastic.co/t/query-terms-with-dash-in-string/295780 "2022-01-30T16:01:38Z")
GET /\_search { "query": { "terms": { "user.id": \[ "kimchy", "elkbee-test" \], } } } Result will only include kimchy, because I guess the dash is interpretet as a bool operator. How to fix this? --- ## [Synthetics failing silently?](https://discuss.elastic.co/t/synthetics-failing-silently/295443)
**Author:** [@mybyte](https://discuss.elastic.co/u/mybyte)\ **Replies:** 10\ **Last updated:** [January 30, 2022, 3:43pm UTC](https://discuss.elastic.co/t/synthetics-failing-silently/295443 "2022-01-30T15:43:21Z")
I have a set-up that works perfectly when I run it locally (docker-compose), but is failing without any logs when running on the server. It's a synthetics test/journey. Configuration is as follows: mounted /monitors fo… --- ## [How to index anomalous documents in another index?](https://discuss.elastic.co/t/how-to-index-anomalous-documents-in-another-index/295458)
**Author:** [@Ilia](https://discuss.elastic.co/u/Ilia)\ **Replies:** 2\ **Last updated:** [January 30, 2022, 10:11am UTC](https://discuss.elastic.co/t/how-to-index-anomalous-documents-in-another-index/295458 "2022-01-30T10:11:42Z")
It is my first time working with Elasticsearch anomaly detection. I've read the concepts and create a sample index to test it. I've also created these job and datafeed by using kibana for the sample index: { "job\_id"… --- ## [Replacement of CircleBuilder/PolygonBuilder](https://discuss.elastic.co/t/replacement-of-circlebuilder-polygonbuilder/295676)
**Author:** [@UglyBarnacle](https://discuss.elastic.co/u/UglyBarnacle)\ **Replies:** 3\ **Last updated:** [January 30, 2022, 1:31am UTC](https://discuss.elastic.co/t/replacement-of-circlebuilder-polygonbuilder/295676 "2022-01-30T01:31:00Z")
Since the circle was not supported anymore (I think now it is, atleast on query execution), we approximated a circle with the PolygonBuilder from the main Elasticsearch package. Elasticsearch 7.16 did a cleanup, removin… --- ## [Enrich processor missing some documents](https://discuss.elastic.co/t/enrich-processor-missing-some-documents/295722)
**Author:** [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Replies:** 4\ **Last updated:** [January 30, 2022, 12:54am UTC](https://discuss.elastic.co/t/enrich-processor-missing-some-documents/295722 "2022-01-30T00:54:30Z")
Hello, I have an ingest pipeline that has a simple enrich processor, it basically adds a field named host.type based on the host.name. This enrich processor is part of a final\_pipeline that is set in the index, and I'm… --- ## [Filebeat send json data to Elasticsearch & Use file name as index](https://discuss.elastic.co/t/filebeat-send-json-data-to-elasticsearch-use-file-name-as-index/295763)
**Author:** [@Suat\_Bey](https://discuss.elastic.co/u/Suat_Bey)\ **Replies:** 0\ **Last updated:** [January 29, 2022, 8:51pm UTC](https://discuss.elastic.co/t/filebeat-send-json-data-to-elasticsearch-use-file-name-as-index/295763 "2022-01-29T20:51:51Z")
Is it possible to create a Elasticsearch index using a file name. I have the json file named as daily regex, and want to send this data day by day to elsaticsearch. On the Elasticsearch index I want to use file same as i… --- ## [Issues with apply filters](https://discuss.elastic.co/t/issues-with-apply-filters/295761)
**Author:** [@dominbdg](https://discuss.elastic.co/u/dominbdg)\ **Replies:** 0\ **Last updated:** [January 29, 2022, 7:51pm UTC](https://discuss.elastic.co/t/issues-with-apply-filters/295761 "2022-01-29T19:51:11Z")
Hello, I upgraded logstash to the latest version 7.16.3 and I have issues with apply required filters, Maybe this is related with specific ports closed, As output I'm receiving below: ./logstash-plugin install logsta… --- ## [Kibana 7.16.3 issues with connecting to elasticsearch](https://discuss.elastic.co/t/kibana-7-16-3-issues-with-connecting-to-elasticsearch/295715)
**Author:** [@dominbdg](https://discuss.elastic.co/u/dominbdg)\ **Replies:** 2\ **Last updated:** [January 29, 2022, 6:17pm UTC](https://discuss.elastic.co/t/kibana-7-16-3-issues-with-connecting-to-elasticsearch/295715 "2022-01-29T18:17:11Z")
Hello, today I upgraded ES to the latest version and kibana, I see in logs that ES cannot be detected: "message":"Error \[ProductNotSupportedSecurityError\]: The client is unable to verify that the server is Elasticsea… --- ## [Date histogram aggregation issue for arrays fields](https://discuss.elastic.co/t/date-histogram-aggregation-issue-for-arrays-fields/294965)
**Author:** [@Marek\_Siwiec](https://discuss.elastic.co/u/Marek_Siwiec)\ **Replies:** 1\ **Last updated:** [January 29, 2022, 5:13pm UTC](https://discuss.elastic.co/t/date-histogram-aggregation-issue-for-arrays-fields/294965 "2022-01-29T17:13:57Z")
Hello! I trying to update ES from 7.10.2 to 7.16.3 and I encounter an issue with Date histogram aggregation. When I have a document with a date field as an array with date aggregation by month on that field, then I expe… --- ## [Delete registry on fleet filebeat](https://discuss.elastic.co/t/delete-registry-on-fleet-filebeat/295756)
**Author:** [@Gustavo\_Llermaly](https://discuss.elastic.co/u/Gustavo_Llermaly)\ **Replies:** 0\ **Last updated:** [January 29, 2022, 3:44pm UTC](https://discuss.elastic.co/t/delete-registry-on-fleet-filebeat/295756 "2022-01-29T15:44:09Z")
Hello, how can I delete the registry to re-index the same log files again? Deleting the integration didnt work. Thanks --- ## [Help on script score query with filter script](https://discuss.elastic.co/t/help-on-script-score-query-with-filter-script/295751)
**Author:** [@scharom16](https://discuss.elastic.co/u/scharom16)\ **Replies:** 7\ **Last updated:** [January 29, 2022, 3:30pm UTC](https://discuss.elastic.co/t/help-on-script-score-query-with-filter-script/295751 "2022-01-29T15:30:57Z")
Hi elastic community, I need some guidance on the following query. I am using the Python Elasticsearch client and when executing the query it returns a 'search\_phase\_execution\_exception' with no further guidance. Can yo… --- ## [Can't use method ensureCapacity for ArrayList](https://discuss.elastic.co/t/cant-use-method-ensurecapacity-for-arraylist/295695)
**Author:** [@arnautov\_evgeny](https://discuss.elastic.co/u/arnautov_evgeny)\ **Replies:** 3\ **Last updated:** [January 29, 2022, 3:08pm UTC](https://discuss.elastic.co/t/cant-use-method-ensurecapacity-for-arraylist/295695 "2022-01-29T15:08:28Z")
Hello. I'm using a script on painless language, and I can't get it working with the ArrayList object. Even example from docs isn't working for me. I've tested it on 7.13.2 and 7.16.3. Thanks in advance for your answer. … --- ## [Filebeat filestream input parsers multiline fails](https://discuss.elastic.co/t/filebeat-filestream-input-parsers-multiline-fails/290543)
**Author:** [@fgjensen](https://discuss.elastic.co/u/fgjensen)\ **Replies:** 18\ **Last updated:** [January 29, 2022, 2:31pm UTC](https://discuss.elastic.co/t/filebeat-filestream-input-parsers-multiline-fails/290543 "2022-01-29T14:31:30Z")
Hello This is filebeat 7.15.0. I have configured several filebeat log inputs with multiline patterns and it works. Next I change the input type to filestream, while following the documentation. However, when starting t… --- ## [Write data that have failed in Logstash filter transforms to file](https://discuss.elastic.co/t/write-data-that-have-failed-in-logstash-filter-transforms-to-file/295649)
**Author:** [@GitSpree23](https://discuss.elastic.co/u/GitSpree23)\ **Replies:** 4\ **Last updated:** [January 29, 2022, 12:38pm UTC](https://discuss.elastic.co/t/write-data-that-have-failed-in-logstash-filter-transforms-to-file/295649 "2022-01-29T12:38:33Z")
My logstash config has a filter performing several transformations. But I see many records failing to get processed because of incorrect format/encoding in source data. I want Logstash to write these failed inputs to a … --- ## [Minimum number of replica shard ? (do we need 2 replica for recovery?)](https://discuss.elastic.co/t/minimum-number-of-replica-shard-do-we-need-2-replica-for-recovery/295741)
**Author:** [@dan\_kim](https://discuss.elastic.co/u/dan_kim)\ **Replies:** 2\ **Last updated:** [January 29, 2022, 7:54am UTC](https://discuss.elastic.co/t/minimum-number-of-replica-shard-do-we-need-2-replica-for-recovery/295741 "2022-01-29T07:54:12Z")
Hello ! our company is trying to building a new Elasticsearch for service and We are studying ES for a proper service . And I have a question about replica shard. Should we set our replica shard more than 2? Here is… --- ## [Include Friend relations in user search](https://discuss.elastic.co/t/include-friend-relations-in-user-search/295632)
**Author:** [@JonasLevin](https://discuss.elastic.co/u/JonasLevin)\ **Replies:** 1\ **Last updated:** [January 29, 2022, 3:17am UTC](https://discuss.elastic.co/t/include-friend-relations-in-user-search/295632 "2022-01-29T03:17:45Z")
I'm working on creating a search feature for a social network like Mobile App. Users can follow each other and search by username, lastname or firstname. Currently we are just indexing username, lastname and firstname i… --- ## [APM Agent not working with Nodejs](https://discuss.elastic.co/t/apm-agent-not-working-with-nodejs/295638)
**Author:** [@Mayderson\_Santos](https://discuss.elastic.co/u/Mayderson_Santos)\ **Replies:** 2\ **Last updated:** [January 29, 2022, 2:51am UTC](https://discuss.elastic.co/t/apm-agent-not-working-with-nodejs/295638 "2022-01-29T02:51:55Z")
Guys, I'm trying to use APM in a NodeJS API I have, every environment is local using Docker. The APM Server normally connects to the Kibana check, but the problem is that my Agent in this check returns the message "No d… --- ## [Filebeat with Large Registry/State File Causes \`runtime: program exceeds 10000-thread limit\` on Startup](https://discuss.elastic.co/t/filebeat-with-large-registry-state-file-causes-runtime-program-exceeds-10000-thread-limit-on-startup/295738)
**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Replies:** 1\ **Last updated:** [January 29, 2022, 1:29am UTC](https://discuss.elastic.co/t/filebeat-with-large-registry-state-file-causes-runtime-program-exceeds-10000-thread-limit-on-startup/295738 "2022-01-29T01:29:55Z")
Hi All, I'm seeing an issue, where a Filebeat instead with a large registrar (~33k entries). {"level":"info","timestamp":"2022-01-29T00:32:41.799Z","logger":"registrar","caller":"registrar/registrar.go:109","message":"… --- ## [Assign timestamp value to field in filebeat](https://discuss.elastic.co/t/assign-timestamp-value-to-field-in-filebeat/295734)
**Author:** [@jpfreyen](https://discuss.elastic.co/u/jpfreyen)\ **Replies:** 0\ **Last updated:** [January 29, 2022, 12:08am UTC](https://discuss.elastic.co/t/assign-timestamp-value-to-field-in-filebeat/295734 "2022-01-29T00:08:11Z")
Hello, Is there a way for me to assign the timestamp value to an add\_field? Like for example: processors: - add\_fields: fields: collectiontime: "@timestamp" This example doesn't work because when I check th… --- ## [Configure Filebeat to input a specific logs of my app pods in AKS](https://discuss.elastic.co/t/configure-filebeat-to-input-a-specific-logs-of-my-app-pods-in-aks/295737)
**Author:** [@amgmdz](https://discuss.elastic.co/u/amgmdz)\ **Replies:** 0\ **Last updated:** [January 29, 2022, 12:37am UTC](https://discuss.elastic.co/t/configure-filebeat-to-input-a-specific-logs-of-my-app-pods-in-aks/295737 "2022-01-29T00:37:52Z")
I have an application in a kubernetes (AKS) this app generates logs in /logs/\*.log, my problem is that I do not know what configuration to do in Filebeat (this is deployed on AKS nodes) to recognize the logs and send the… --- ## [rollupSearch with new Java Api Client](https://discuss.elastic.co/t/rollupsearch-with-new-java-api-client/295736)
**Author:** [@rfox](https://discuss.elastic.co/u/rfox)\ **Replies:** 0\ **Last updated:** [January 29, 2022, 12:32am UTC](https://discuss.elastic.co/t/rollupsearch-with-new-java-api-client/295736 "2022-01-29T00:32:45Z")
I am struggling to use the new rollupSearch API. I am trying to map this query: GET count\_rollup/\_rollup\_search { "size": 0, "aggregations": { "timeline": { "date\_histogram": { "field": "datetime"… --- ## [ILM Warm Phase Executes on Hot Node](https://discuss.elastic.co/t/ilm-warm-phase-executes-on-hot-node/295727)
**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Replies:** 4\ **Last updated:** [January 29, 2022, 12:12am UTC](https://discuss.elastic.co/t/ilm-warm-phase-executes-on-hot-node/295727 "2022-01-29T00:12:46Z")
Hi All, I recently noticed some CPU usage issues on my hot data nodes. When looking at the hot threads (GET /\_nodes/\/hot\_threads). I noticed that the main cause was force merging during rollover from hot -\> war… --- ## [Master not Discovered yet](https://discuss.elastic.co/t/master-not-discovered-yet/295699)
**Author:** [@auasad](https://discuss.elastic.co/u/auasad)\ **Replies:** 3\ **Last updated:** [January 28, 2022, 11:01pm UTC](https://discuss.elastic.co/t/master-not-discovered-yet/295699 "2022-01-28T23:01:40Z")
Hello community, I am facing an issue, I have a cluster consisting 3 nodes in NZ(Master-Data), one node in PK(Data Node) everything is up and running over the public IPs. Now the issue comes when I try to join my new IR… --- ## [Search in Array Field](https://discuss.elastic.co/t/search-in-array-field/295732)
**Author:** [@Sahil5](https://discuss.elastic.co/u/Sahil5)\ **Replies:** 0\ **Last updated:** [January 28, 2022, 8:36pm UTC](https://discuss.elastic.co/t/search-in-array-field/295732 "2022-01-28T20:36:11Z")
Hi Team, I want to enable search on array field but only want to retrieve the value from an array that matches the search query. Example Document 1 - \[A,B\] Document 2 - \[A,C\] Below is the Query { "query": { "… [Previous page](https://discuss.elastic.co/latest.md?page=1284) [Next page](https://discuss.elastic.co/latest.md?page=1286)