# Latest **URL:** https://discuss.elastic.co/latest.md?page=1294 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1295 --- ## [Elasticsearch Engineer - Lab 2.4 - Error in instructions](https://discuss.elastic.co/t/elasticsearch-engineer-lab-2-4-error-in-instructions/295278)
**Author:** [@Irina\_Truong](https://discuss.elastic.co/u/Irina_Truong)\ **Replies:** 1\ **Last updated:** [January 24, 2022, 8:40pm UTC](https://discuss.elastic.co/t/elasticsearch-engineer-lab-2-4-error-in-instructions/295278 "2022-01-24T20:40:40Z")
Dear Elasticsearch training experts, I've been going through the Elasticsearch Engineer class. In the lab 2.4 "Advanced search" there is a task as follows: Write a script query that returns all blogs where the authors… --- ## [Total shards per node calculation](https://discuss.elastic.co/t/total-shards-per-node-calculation/294829)
**Author:** [@Ryan\_Downey](https://discuss.elastic.co/u/Ryan_Downey)\ **Replies:** 4\ **Last updated:** [January 24, 2022, 8:04pm UTC](https://discuss.elastic.co/t/total-shards-per-node-calculation/294829 "2022-01-24T20:04:57Z")
I've been working on Elastic for a while now but just wanted to do a quick check on learning that may also be useful to others. I've got a customer that would like 4 separate indices for logs. The only difference betwe… --- ## [Rally 2.3.1 released](https://discuss.elastic.co/t/rally-2-3-1-released/295277)
**Author:** [@json](https://discuss.elastic.co/u/json)\ **Replies:** 0\ **Last updated:** [January 24, 2022, 7:52pm UTC](https://discuss.elastic.co/t/rally-2-3-1-released/295277 "2022-01-24T19:52:47Z")
We have just released Rally 2.3.1. Highlights: Rally now supports Python 3.10. A new timeout parameter can be used for bulk operations. Bug fixes and docs changes have been included. For the full list of changes pleas… --- ## [Iterating over the same grok filter](https://discuss.elastic.co/t/iterating-over-the-same-grok-filter/295089)
**Author:** [@tfinan](https://discuss.elastic.co/u/tfinan)\ **Replies:** 4\ **Last updated:** [January 24, 2022, 7:09pm UTC](https://discuss.elastic.co/t/iterating-over-the-same-grok-filter/295089 "2022-01-24T19:09:23Z")
I am a new user here, and don't know if this is a trivial question or not (it certainly is not for me). What I want to do is create a filter that creates fields with names based on the data itself. I think I can do this… --- ## [Winlog beat set up returning the following error](https://discuss.elastic.co/t/winlog-beat-set-up-returning-the-following-error/294999)
**Author:** [@kgood517](https://discuss.elastic.co/u/kgood517)\ **Replies:** 1\ **Last updated:** [January 24, 2022, 6:46pm UTC](https://discuss.elastic.co/t/winlog-beat-set-up-returning-the-following-error/294999 "2022-01-24T18:46:27Z")
Hi all, I'm getting the following error trying to setup my winlogbeat following along the directions from Winlogbeat quick start: installation and configuration | Winlogbeat Reference \[7.16\] | Elastic. ERROR \[esclientle… --- ## [What happens to the original text field?](https://discuss.elastic.co/t/what-happens-to-the-original-text-field/295262)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 3\ **Last updated:** [January 24, 2022, 6:26pm UTC](https://discuss.elastic.co/t/what-happens-to-the-original-text-field/295262 "2022-01-24T18:26:49Z")
When we use custom or built-in analyzer in our mapping it just convert the stream of characters to stream of tokens. For example when we analyze the text like The QUICK brown foxes jumped over the dog!.Here i am using c… --- ## [How to change the External alert trend request](https://discuss.elastic.co/t/how-to-change-the-external-alert-trend-request/295094)
**Author:** [@wsouza](https://discuss.elastic.co/u/wsouza)\ **Replies:** 4\ **Last updated:** [January 24, 2022, 6:18pm UTC](https://discuss.elastic.co/t/how-to-change-the-external-alert-trend-request/295094 "2022-01-24T18:18:31Z")
Guys, I need to change the information on the External alert trend dashboard, however, I can't find the place to change the requests. The image shows what I want to change. --- ## [Use Date Histogram to group data by day of the week](https://discuss.elastic.co/t/use-date-histogram-to-group-data-by-day-of-the-week/295255)
**Author:** [@TomTom](https://discuss.elastic.co/u/TomTom)\ **Replies:** 1\ **Last updated:** [January 24, 2022, 6:09pm UTC](https://discuss.elastic.co/t/use-date-histogram-to-group-data-by-day-of-the-week/295255 "2022-01-24T18:09:36Z")
My case is as follows, I am conducting a search for sales that occurred between 2021-12-23 to 2022-01-23, and I need to know the total sales by day of the week, regardless of the week and year. So I can theoretically kn… --- ## [How to improve below Logstash grok filters?](https://discuss.elastic.co/t/how-to-improve-below-logstash-grok-filters/295212)
**Author:** [@alytkowski](https://discuss.elastic.co/u/alytkowski)\ **Replies:** 3\ **Last updated:** [January 24, 2022, 5:55pm UTC](https://discuss.elastic.co/t/how-to-improve-below-logstash-grok-filters/295212 "2022-01-24T17:55:59Z")
Hi there. I have a problem with Logstash consuming most of the CPU resources all the time and events not being parsed in real time. Through Stack Monitoring in Kibana, I found that for one set of filters for a certain so… --- ## [Why does ClusterState class need need a data member named stateUUID?](https://discuss.elastic.co/t/why-does-clusterstate-class-need-need-a-data-member-named-stateuuid/295196)
**Author:** [@armsword](https://discuss.elastic.co/u/armsword)\ **Replies:** 1\ **Last updated:** [January 24, 2022, 5:48pm UTC](https://discuss.elastic.co/t/why-does-clusterstate-class-need-need-a-data-member-named-stateuuid/295196 "2022-01-24T17:48:05Z")
https://github.com/elastic/elasticsearch/blob/master/server/src/main/java/org/elasticsearch/cluster/ClusterState.java#L139 This class ClusterState has two data member, named stateUUID and version. The stateUUID is supp… --- ## [Kibana vs. Power BI](https://discuss.elastic.co/t/kibana-vs-power-bi/295240)
**Author:** [@Tim\_Mobley](https://discuss.elastic.co/u/Tim_Mobley)\ **Replies:** 3\ **Last updated:** [January 24, 2022, 5:33pm UTC](https://discuss.elastic.co/t/kibana-vs-power-bi/295240 "2022-01-24T17:33:52Z")
I have a use-case where end users need to be able to quickly and easily view data stored in a MS SQL database for devices, systems and hardware/software assets they own. This would just be a read-only dashboard where the… --- ## [Ruby script for deleting some elements recursively \[Q&A\]](https://discuss.elastic.co/t/ruby-script-for-deleting-some-elements-recursively-q-a/295253)
**Author:** [@SudoNova](https://discuss.elastic.co/u/SudoNova)\ **Replies:** 0\ **Last updated:** [January 24, 2022, 4:31pm UTC](https://discuss.elastic.co/t/ruby-script-for-deleting-some-elements-recursively-q-a/295253 "2022-01-24T16:31:24Z")
Hi Just because I had troubles to make it work,I decided to share it maybe some other folks can use it some time. Requirement: Delete all elements in a parsed json log where they are empty Note: Haproxy sends empty fi… --- ## [Conditionals in pipelines](https://discuss.elastic.co/t/conditionals-in-pipelines/294970)
**Author:** [@Tuckson](https://discuss.elastic.co/u/Tuckson)\ **Replies:** 11\ **Last updated:** [January 24, 2022, 4:17pm UTC](https://discuss.elastic.co/t/conditionals-in-pipelines/294970 "2022-01-24T16:17:49Z")
Hi, We are in the process of recreating our logstash pipelines in kibana/elk to use Elasticsearch pipelines instead of logstash. However the lack of documentation on how to do this in Kibana is overwhelming. See the ac… --- ## [OSQuery Manager Pack scheduled queries not executed on ELK 7.16.2 and 7.16.3?](https://discuss.elastic.co/t/osquery-manager-pack-scheduled-queries-not-executed-on-elk-7-16-2-and-7-16-3/295028)
**Author:** [@BSL](https://discuss.elastic.co/u/BSL)\ **Replies:** 1\ **Last updated:** [January 24, 2022, 3:41pm UTC](https://discuss.elastic.co/t/osquery-manager-pack-scheduled-queries-not-executed-on-elk-7-16-2-and-7-16-3/295028 "2022-01-24T15:41:33Z")
Scheduled OSQuery Manager Pack queries don't seem to work on fresh installs of ELK 7.16.2 and 7.16.3 (tried 2 completely separate ELK installations, one hosted on Ubuntu 20.04 with TLS+cert, one on Windows 11 unsecure, b… --- ## [Mongodb jdbc logstash no data output in my console](https://discuss.elastic.co/t/mongodb-jdbc-logstash-no-data-output-in-my-console/295245)
**Author:** [@Kermit\_Liu](https://discuss.elastic.co/u/Kermit_Liu)\ **Replies:** 0\ **Last updated:** [January 24, 2022, 3:23pm UTC](https://discuss.elastic.co/t/mongodb-jdbc-logstash-no-data-output-in-my-console/295245 "2022-01-24T15:23:37Z")
input { jdbc { jdbc\_driver\_library =\> "/usr/share/logstash/pipeline/driver/mongojdbc4.0.jar" jdbc\_driver\_class =\> "com.dbschema.MongoJdbcDriver" jdbc\_connection\_string =\> "jdbc:mongodb://172.17.0.1… --- ## [Beginner here](https://discuss.elastic.co/t/beginner-here/295241)
**Author:** [@Faraz\_Sidd](https://discuss.elastic.co/u/Faraz_Sidd)\ **Replies:** 0\ **Last updated:** [January 24, 2022, 2:37pm UTC](https://discuss.elastic.co/t/beginner-here/295241 "2022-01-24T14:37:13Z")
Hello Elastic community I am a newbie programmer. I want to contribute to this community as a open source contributor. Can someone point in the right direction as how can I get started with it. --- ## [Reporting option not available while adding Kibana privileges](https://discuss.elastic.co/t/reporting-option-not-available-while-adding-kibana-privileges/295223)
**Author:** [@pranay\_jain](https://discuss.elastic.co/u/pranay_jain)\ **Replies:** 2\ **Last updated:** [January 24, 2022, 2:29pm UTC](https://discuss.elastic.co/t/reporting-option-not-available-while-adding-kibana-privileges/295223 "2022-01-24T14:29:36Z")
Hi, I followed the document (Configure reporting in Kibana | Kibana Guide \[7.16\] | Elastic) which explains how to enable users generate reports and grant users access to the reporting features, and secure the reporting … --- ## [Elastic Search ILM implementation - Upsert issue](https://discuss.elastic.co/t/elastic-search-ilm-implementation-upsert-issue/295192)
**Author:** [@manikantavarma20](https://discuss.elastic.co/u/manikantavarma20)\ **Replies:** 1\ **Last updated:** [January 24, 2022, 2:23pm UTC](https://discuss.elastic.co/t/elastic-search-ilm-implementation-upsert-issue/295192 "2022-01-24T14:23:31Z")
We have 2 indices - "event" and "event-001" "event-001" is created by using ILM Both the indices have the same alias "event\_" It is used to fetch and update the data in the above 2 indices Query: GET event\_/alias R… --- ## [Filebeat Elastic Kibana - Json based Log Processing](https://discuss.elastic.co/t/filebeat-elastic-kibana-json-based-log-processing/295224)
**Author:** [@RashidKhan](https://discuss.elastic.co/u/RashidKhan)\ **Replies:** 4\ **Last updated:** [January 24, 2022, 1:25pm UTC](https://discuss.elastic.co/t/filebeat-elastic-kibana-json-based-log-processing/295224 "2022-01-24T13:25:51Z")
Hi Team, I have a log file that has mixed structure, some are multiple line json, some are single line json and some are plain text. My goal is to Parse Json and send to elastic, and ignore the plain text. I read thro… --- ## [Auditbeat 7.16.2 crashes servers due to memory issues](https://discuss.elastic.co/t/auditbeat-7-16-2-crashes-servers-due-to-memory-issues/295047)
**Author:** [@JensVanDeynse](https://discuss.elastic.co/u/JensVanDeynse)\ **Replies:** 1\ **Last updated:** [January 24, 2022, 2:06pm UTC](https://discuss.elastic.co/t/auditbeat-7-16-2-crashes-servers-due-to-memory-issues/295047 "2022-01-24T14:06:34Z")
Hello ELK version: 7.16.2 Auditbeat version: 7.16.2 I'm trying to set up an Elastic SIEM cluster which is as of now running the way it should but we are still experiencing a memory issue with auditbeat. It seems that… --- ## [Install filter-plugin failed](https://discuss.elastic.co/t/install-filter-plugin-failed/295237)
**Author:** [@dominbdg](https://discuss.elastic.co/u/dominbdg)\ **Replies:** 0\ **Last updated:** [January 24, 2022, 2:04pm UTC](https://discuss.elastic.co/t/install-filter-plugin-failed/295237 "2022-01-24T14:04:16Z")
Hello, Today I upgraded logstash to the latest version and needs to install logstash-filter-elapsed plugin. I'm receiving below error: ./logstash-plugin install logstash-filter-elapsed Using bundled JDK: /usr/share/lo… --- ## [Control phase transition timings in ILM](https://discuss.elastic.co/t/control-phase-transition-timings-in-ilm/294904)
**Author:** [@inhinyera16](https://discuss.elastic.co/u/inhinyera16)\ **Replies:** 1\ **Last updated:** [January 24, 2022, 1:48pm UTC](https://discuss.elastic.co/t/control-phase-transition-timings-in-ilm/294904 "2022-01-24T13:48:45Z")
I'm trying to implement an ilm policy where the index will rollover every month or if the size reached 50GB. And since by default, ilm based the age in index creation date, and creating the index mid december means, we … --- ## [Replace Log4j from 2.x to 2.17.0 or later](https://discuss.elastic.co/t/replace-log4j-from-2-x-to-2-17-0-or-later/292897)
**Author:** [@marisubu](https://discuss.elastic.co/u/marisubu)\ **Replies:** 4\ **Last updated:** [January 24, 2022, 1:16pm UTC](https://discuss.elastic.co/t/replace-log4j-from-2-x-to-2-17-0-or-later/292897 "2022-01-24T13:16:53Z")
Our oldest products includes Elastic stack versions 5.2, 6.2.2 and 7.10.2. We're in situation that we can not perform elastic versions uplift to the latest/fixed versions. Can we replace Log4j 2.x versions with 2.17.x o… --- ## [Filebeat: Kafka Input doesn't push the topic offset](https://discuss.elastic.co/t/filebeat-kafka-input-doesnt-push-the-topic-offset/292436)
**Author:** [@Giero](https://discuss.elastic.co/u/Giero)\ **Replies:** 6\ **Last updated:** [January 24, 2022, 12:54pm UTC](https://discuss.elastic.co/t/filebeat-kafka-input-doesnt-push-the-topic-offset/292436 "2022-01-24T12:54:07Z")
I'm using Filebeat 7.16.0 with Kafka Input and Elasticsearch Output. Previously I had java application to take care of this flow. I'm using the same consumer group as previous java application and messages appear in El… --- ## [Pre-built/Community Rules for Monitoring/Observability?](https://discuss.elastic.co/t/pre-built-community-rules-for-monitoring-observability/295165)
**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Replies:** 2\ **Last updated:** [January 24, 2022, 12:53pm UTC](https://discuss.elastic.co/t/pre-built-community-rules-for-monitoring-observability/295165 "2022-01-24T12:53:11Z")
Hello All, I was wonder if Elastic has any plans to offer a repo/project similar to GitHub - elastic/detection-rules: Rules for Elastic Security's detection engine, but more for Metrics/Logging/Observability? While I kn… --- ## [How to create new Elastic search engine](https://discuss.elastic.co/t/how-to-create-new-elastic-search-engine/294513)
**Author:** [@shahabj13](https://discuss.elastic.co/u/shahabj13)\ **Replies:** 3\ **Last updated:** [January 24, 2022, 12:50pm UTC](https://discuss.elastic.co/t/how-to-create-new-elastic-search-engine/294513 "2022-01-24T12:50:55Z")
I'm trying to create a search engine and I'm following the documentation here . this is the POST request I sent through the Postman: https://\[my-index-id\].ent-search.ap-southeast-2.aws.cloud.es.io:443/api/as/v1/engines … --- ## [Multiple Index](https://discuss.elastic.co/t/multiple-index/294012)
**Author:** [@graimato](https://discuss.elastic.co/u/graimato)\ **Replies:** 2\ **Last updated:** [January 24, 2022, 12:43pm UTC](https://discuss.elastic.co/t/multiple-index/294012 "2022-01-24T12:43:13Z")
Dear all I have a problem with filebeat configuration. I enable two different module and I need to write log in two different index , myindex-module1-data myindex-module2-data Is it possible? I read about filebeat.p… --- ## [Upgrade fleet server to 7.16.2 - failing](https://discuss.elastic.co/t/upgrade-fleet-server-to-7-16-2-failing/294889)
**Author:** [@Ross\_Wakelin](https://discuss.elastic.co/u/Ross_Wakelin)\ **Replies:** 3\ **Last updated:** [January 24, 2022, 12:02pm UTC](https://discuss.elastic.co/t/upgrade-fleet-server-to-7-16-2-failing/294889 "2022-01-24T12:02:20Z")
We have been running fleet for a couple of months, starting with a stack running 7.15.0. We have upgraded our stack (including Kibana) to 7.16.2, and now want to upgrade our elastic-agents. On the fleet console, our ag… --- ## [CA generated without key using instances.yml](https://discuss.elastic.co/t/ca-generated-without-key-using-instances-yml/295221)
**Author:** [@Mamol27](https://discuss.elastic.co/u/Mamol27)\ **Replies:** 0\ **Last updated:** [January 24, 2022, 11:39am UTC](https://discuss.elastic.co/t/ca-generated-without-key-using-instances-yml/295221 "2022-01-24T11:39:34Z")
Hi! I tried to generate certificates like this How to Secure Elasticsearch Clusters - Completely and Effectively, but in folder ca I have got only ca.crt without key. It could be a problem if I need to add some certifica… --- ## [Update ELK 7.14 at 7.16](https://discuss.elastic.co/t/update-elk-7-14-at-7-16/295195)
**Author:** [@marc0069urca](https://discuss.elastic.co/u/marc0069urca)\ **Replies:** 1\ **Last updated:** [January 24, 2022, 10:16am UTC](https://discuss.elastic.co/t/update-elk-7-14-at-7-16/295195 "2022-01-24T10:16:34Z")
Hello, I wanted to know step by step in the order of the Elasticsearch machine to Kibana the implementation of a complete upgrade of an ELK , can you tell me the procedure to upgrade from our tool 7.14 to the current ve… [Previous page](https://discuss.elastic.co/latest.md?page=1293) [Next page](https://discuss.elastic.co/latest.md?page=1295)