# Latest **URL:** https://discuss.elastic.co/latest.md?page=1317 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1318 --- ## [Convert YYYY-MM-DD-HH.MM.SS to date](https://discuss.elastic.co/t/convert-yyyy-mm-dd-hh-mm-ss-to-date/293820)
**Author:** [@Hooman24](https://discuss.elastic.co/u/Hooman24)\ **Replies:** 4\ **Last updated:** [January 10, 2022, 5:35am UTC](https://discuss.elastic.co/t/convert-yyyy-mm-dd-hh-mm-ss-to-date/293820 "2022-01-10T05:35:20Z")
Hi I have a dateTime field with the following format: yyyy-mm-dd-HH.mm.ss I want to use this field as a date time field in ELK. I don't know how to change 11th position of the string('-') to 'T' to convert this field … --- ## [APM Distributed Tracing in a non Kubernetes micro-services architecture](https://discuss.elastic.co/t/apm-distributed-tracing-in-a-non-kubernetes-micro-services-architecture/293679)
**Author:** [@byoungman](https://discuss.elastic.co/u/byoungman)\ **Replies:** 1\ **Last updated:** [January 10, 2022, 3:10am UTC](https://discuss.elastic.co/t/apm-distributed-tracing-in-a-non-kubernetes-micro-services-architecture/293679 "2022-01-10T03:10:14Z")
I have a quick question regarding APM Distributed Tracing. In the documentation I see references to micro-services but we are in a transition period going from a 'classic' non micro-service architecture to a kubernetes … --- ## [Kibana Vlookup Equivalent](https://discuss.elastic.co/t/kibana-vlookup-equivalent/293640)
**Author:** [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\ **Replies:** 5\ **Last updated:** [January 10, 2022, 4:25am UTC](https://discuss.elastic.co/t/kibana-vlookup-equivalent/293640 "2022-01-10T04:25:07Z")
Hi all, I have 2 indices in an index pattern. I want to see what are the documents which have the same fields values in both indices. Basically like vlookup in excel. I've tried a scripted field, but not getting appr… --- ## [Apm\_metrics\_dynamic\_template does not exist](https://discuss.elastic.co/t/apm-metrics-dynamic-template-does-not-exist/293539)
**Author:** [@ieuD](https://discuss.elastic.co/u/ieuD)\ **Replies:** 6\ **Last updated:** [January 10, 2022, 3:00am UTC](https://discuss.elastic.co/t/apm-metrics-dynamic-template-does-not-exist/293539 "2022-01-10T03:00:39Z")
Hi, I'm trying to setup apm server for tracing purposes. Kibana successfully detects APM server but when I run apm agent i'm getting error like this Jan 5 15:37:16 elasticapm-server apm-server: 2022-01-05T15:37:16.052+… --- ## [Search multiple data streams and indices - Permissions](https://discuss.elastic.co/t/search-multiple-data-streams-and-indices-permissions/293678)
**Author:** [@carlos.cilleruelo](https://discuss.elastic.co/u/carlos.cilleruelo)\ **Replies:** 1\ **Last updated:** [January 9, 2022, 11:11pm UTC](https://discuss.elastic.co/t/search-multiple-data-streams-and-indices-permissions/293678 "2022-01-09T23:11:43Z")
Hello, I am trying to perform some searches over multiple data streams and indices using a -\* pattern. Everything seems to be working when I search over a specific index, but if a tried the wildcard my client prompts an… --- ## [Anyone else have tried to monitor harbor?](https://discuss.elastic.co/t/anyone-else-have-tried-to-monitor-harbor/293795)
**Author:** [@dengyun19900722](https://discuss.elastic.co/u/dengyun19900722)\ **Replies:** 1\ **Last updated:** [January 9, 2022, 10:39pm UTC](https://discuss.elastic.co/t/anyone-else-have-tried-to-monitor-harbor/293795 "2022-01-09T22:39:45Z")
Anyone else have tried to monitor harbor? --- ## [What is a classic and recommanded ElasticSearch architecture?](https://discuss.elastic.co/t/what-is-a-classic-and-recommanded-elasticsearch-architecture/293727)
**Author:** [@sebastienf](https://discuss.elastic.co/u/sebastienf)\ **Replies:** 1\ **Last updated:** [January 9, 2022, 9:57pm UTC](https://discuss.elastic.co/t/what-is-a-classic-and-recommanded-elasticsearch-architecture/293727 "2022-01-09T21:57:25Z")
Our former cluster ES was made of 40 data nodes. 4 of them were coordinators as well 3 of them were electable as a master (for one node, it gathers data, coordinator and master-electable role) We aim to create a new c… --- ## [Elastic Diagnostics and Log4j2 vulnerability](https://discuss.elastic.co/t/elastic-diagnostics-and-log4j2-vulnerability/293808)
**Author:** [@newschapmj1](https://discuss.elastic.co/u/newschapmj1)\ **Replies:** 1\ **Last updated:** [January 9, 2022, 9:31pm UTC](https://discuss.elastic.co/t/elastic-diagnostics-and-log4j2-vulnerability/293808 "2022-01-09T21:31:33Z")
Does upgrading to 8.2.6 fix all known Log4j2 issues with Elastic Diagnostics? Should it be on the Elastic list of software affected by Log4j2 to remind users to upgrade? --- ## [Spaces using roles](https://discuss.elastic.co/t/spaces-using-roles/293786)
**Author:** [@JACA](https://discuss.elastic.co/u/JACA)\ **Replies:** 1\ **Last updated:** [January 9, 2022, 9:13pm UTC](https://discuss.elastic.co/t/spaces-using-roles/293786 "2022-01-09T21:13:22Z")
I'm wanting to monitor by space groups. Perform the steps to create the spaces and when adding the agent, the line of space was placed: space.id: "name\_server" But when observing with the monitoring I enter the space a… --- ## [Aggregation numbers do not add up](https://discuss.elastic.co/t/aggregation-numbers-do-not-add-up/293825)
**Author:** [@Lark](https://discuss.elastic.co/u/Lark)\ **Replies:** 0\ **Last updated:** [January 9, 2022, 12:42pm UTC](https://discuss.elastic.co/t/aggregation-numbers-do-not-add-up/293825 "2022-01-09T12:42:01Z")
Hello friends! I'm trying to learn aggregations on Elastic for my company's backend. Our documents include a label field (which could be many different keywords), and I would like to aggregate and calculate certain thi… --- ## [Kibana dashboard creation issue](https://discuss.elastic.co/t/kibana-dashboard-creation-issue/293132)
**Author:** [@vipeen](https://discuss.elastic.co/u/vipeen)\ **Replies:** 19\ **Last updated:** [January 9, 2022, 12:38am UTC](https://discuss.elastic.co/t/kibana-dashboard-creation-issue/293132 "2022-01-09T00:38:50Z")
Hi, I am trying to move logs from a Gateway server to Syslog and then to Elasticsearch and finally build dashboards on Kibana. I am newbie and try to do my best to get this completed. I actually got this task from an ex-… --- ## [Output to different index based on field](https://discuss.elastic.co/t/output-to-different-index-based-on-field/293804)
**Author:** [@krsecurity](https://discuss.elastic.co/u/krsecurity)\ **Replies:** 11\ **Last updated:** [January 8, 2022, 11:01pm UTC](https://discuss.elastic.co/t/output-to-different-index-based-on-field/293804 "2022-01-08T23:01:30Z")
Hi there, I have a couple of use-cases where I want to ingest filebeat module data, send it through Logstash, and then put it into different indexes based on what filebeat module that it used. So for example, the two I… --- ## [Visualisation based of an aggregated search](https://discuss.elastic.co/t/visualisation-based-of-an-aggregated-search/293811)
**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Replies:** 1\ **Last updated:** [January 8, 2022, 8:32pm UTC](https://discuss.elastic.co/t/visualisation-based-of-an-aggregated-search/293811 "2022-01-08T20:32:08Z")
Is there a way to base a visualisation on the results of an aggregation? For example: I have data on logins to our wireless network. It is trivial to get a pie chart that shows the proportion of success & failures ho… --- ## [Search template condition on paramters](https://discuss.elastic.co/t/search-template-condition-on-paramters/293809)
**Author:** [@ylasri](https://discuss.elastic.co/u/ylasri)\ **Replies:** 0\ **Last updated:** [January 8, 2022, 7:25pm UTC](https://discuss.elastic.co/t/search-template-condition-on-paramters/293809 "2022-01-08T19:25:37Z")
Hello Everybody, Happy new year 2022. I have a small use case that i want to implement using Elasticsearch search template The idea is to limit the parameter from so that it can't go more that a limit value. Do you ha… --- ## [Elasticsearch-keystore: not found during attempt to configure elasticsearch 7.16.2](https://discuss.elastic.co/t/elasticsearch-keystore-not-found-during-attempt-to-configure-elasticsearch-7-16-2/293805)
**Author:** [@Nicole\_Hirshler](https://discuss.elastic.co/u/Nicole_Hirshler)\ **Replies:** 1\ **Last updated:** [January 8, 2022, 6:04pm UTC](https://discuss.elastic.co/t/elasticsearch-keystore-not-found-during-attempt-to-configure-elasticsearch-7-16-2/293805 "2022-01-08T18:04:14Z")
I'm trying to upgrade to the latest version of elasticsearch 7.16.2 inside docker. During the setup I see the following error: docker logs -f emr\_cloud\_elasticsearch /usr/local/bin/docker-entrypoint.sh: line 14: exec… --- ## [APM server latest version (7.16.2) win 2019 support](https://discuss.elastic.co/t/apm-server-latest-version-7-16-2-win-2019-support/293569)
**Author:** [@ZZ.IT](https://discuss.elastic.co/u/ZZ.IT)\ **Replies:** 2\ **Last updated:** [January 8, 2022, 4:49pm UTC](https://discuss.elastic.co/t/apm-server-latest-version-7-16-2-win-2019-support/293569 "2022-01-08T16:49:14Z")
Hi, Is APM server v7.16.2 is supported on windows server 2019? I can't see here in supported OS matrix. Thanks --- ## [Ignore log record if log does not contain specific string "jenkins\_build\_number"](https://discuss.elastic.co/t/ignore-log-record-if-log-does-not-contain-specific-string-jenkins-build-number/293800)
**Author:** [@chandu.2035](https://discuss.elastic.co/u/chandu.2035)\ **Replies:** 2\ **Last updated:** [January 8, 2022, 4:10pm UTC](https://discuss.elastic.co/t/ignore-log-record-if-log-does-not-contain-specific-string-jenkins-build-number/293800 "2022-01-08T16:10:51Z")
Hi there, I would like to ignore inserting entry in Elasticsearch index if the parsed log pattern does not contain the specific string jenkins\_build\_number Here is my filebeat and logstash configs. filebeat.yml #=====… --- ## [Confluence (Server) Connector 302 Errors](https://discuss.elastic.co/t/confluence-server-connector-302-errors/258993)
**Author:** [@ekan](https://discuss.elastic.co/u/ekan)\ **Replies:** 7\ **Last updated:** [January 8, 2022, 10:21am UTC](https://discuss.elastic.co/t/confluence-server-connector-302-errors/258993 "2022-01-08T10:21:06Z")
We're having issues using the Confluence (Server) connector in Workplace Search. It starts indexing documents correctly, but at some point, it gets 302s in the form of: \[####-##-##T##:##:##.###+##:##\]\[######\]\[####\]\[conn… --- ## [How to parse AWS Cloudfront logs](https://discuss.elastic.co/t/how-to-parse-aws-cloudfront-logs/293690)
**Author:** [@leo-baltus](https://discuss.elastic.co/u/leo-baltus)\ **Replies:** 4\ **Last updated:** [January 8, 2022, 9:49am UTC](https://discuss.elastic.co/t/how-to-parse-aws-cloudfront-logs/293690 "2022-01-08T09:49:04Z")
Tring to get filebeat to parse AWS Cloudfront logs. SQS seem to work. but once in ES I see: Provided Grok expressions do not match field value: \[2022-01-06\\t20:06:28\\tFRA56-C2\\t1729\\t3.125.241.170\\tGET\\tdtc81dn1qkg0w.c… --- ## [In memory Indices on ES 7.x](https://discuss.elastic.co/t/in-memory-indices-on-es-7-x/293778)
**Author:** [@mario12](https://discuss.elastic.co/u/mario12)\ **Replies:** 2\ **Last updated:** [January 8, 2022, 12:06am UTC](https://discuss.elastic.co/t/in-memory-indices-on-es-7-x/293778 "2022-01-08T00:06:22Z")
We are planning to implement an indices on ES 7.x. Is there a way we can keep the indices on memory instead of disk? The total size of the indices will be 150 GB and shared across multiple data nodes. --- ## [Elastic Agent Crashes and Restarts Every Second on Windows 11](https://discuss.elastic.co/t/elastic-agent-crashes-and-restarts-every-second-on-windows-11/293789)
**Author:** [@res260](https://discuss.elastic.co/u/res260)\ **Replies:** 0\ **Last updated:** [January 7, 2022, 10:59pm UTC](https://discuss.elastic.co/t/elastic-agent-crashes-and-restarts-every-second-on-windows-11/293789 "2022-01-07T22:59:22Z")
Hey, I just setup the Elastic Stack to act as a SIEM and successfully deployed the Elastic Agent on 2 systems: my personnal laptop (running windows 10 pro) and my ubuntu 20 VPS. Both work fine. However, when trying to i… --- ## [Kibana Vega-lite xOffset is not a valid encoding channel](https://discuss.elastic.co/t/kibana-vega-lite-xoffset-is-not-a-valid-encoding-channel/292178)
**Author:** [@juliana\_cg](https://discuss.elastic.co/u/juliana_cg)\ **Replies:** 1\ **Last updated:** [January 7, 2022, 10:02pm UTC](https://discuss.elastic.co/t/kibana-vega-lite-xoffset-is-not-a-valid-encoding-channel/292178 "2022-01-07T22:02:28Z")
Hello, i've been trying to create a grouped bar chart in kibana with vega lite, as shown in this example, but i always get a warning "xOffset-encoding is dropped as xOffset is not a valid encoding channel". As a result,… --- ## [Elasticsearh Error : Pods not coming back up](https://discuss.elastic.co/t/elasticsearh-error-pods-not-coming-back-up/293380)
**Author:** [@tropically](https://discuss.elastic.co/u/tropically)\ **Replies:** 8\ **Last updated:** [January 7, 2022, 8:51pm UTC](https://discuss.elastic.co/t/elasticsearh-error-pods-not-coming-back-up/293380 "2022-01-07T20:51:24Z")
Hi We have Elasticsearch running on openshift. Image: docker.elastic.co/elasticsearch/elasticsearch:6.8.15 All of a sudden on the the pods went down and are not restarting. Trying to figure out what the cause is. Log… --- ## [Deleting Index kibana](https://discuss.elastic.co/t/deleting-index-kibana/293773)
**Author:** [@Akhil2](https://discuss.elastic.co/u/Akhil2)\ **Replies:** 2\ **Last updated:** [January 7, 2022, 8:09pm UTC](https://discuss.elastic.co/t/deleting-index-kibana/293773 "2022-01-07T20:09:46Z")
Hello there, Following log entry is appearing in kibana logs. I understand this is because of previous kibana versions. can I delete these indexes? Will deleting this affect my cluster? log \[15:17:55.850\] \[error\]\[eve… --- ## [Endgame Rules in cross cluster search](https://discuss.elastic.co/t/endgame-rules-in-cross-cluster-search/292199)
**Author:** [@Rainiur](https://discuss.elastic.co/u/Rainiur)\ **Replies:** 1\ **Last updated:** [January 7, 2022, 7:55pm UTC](https://discuss.elastic.co/t/endgame-rules-in-cross-cluster-search/292199 "2022-01-07T19:55:14Z")
I am trying to create a rule using the endgame metadata in a cross cluster search. Unfortunately I get the following error. This rule is attempting to query data from Elasticsearch indices listed in the "Index pattern" … --- ## [Set length limit and bottom scroll bar in Exceptions table](https://discuss.elastic.co/t/set-length-limit-and-bottom-scroll-bar-in-exceptions-table/292713)
**Author:** [@RdrgPorto](https://discuss.elastic.co/u/RdrgPorto)\ **Replies:** 1\ **Last updated:** [January 7, 2022, 7:36pm UTC](https://discuss.elastic.co/t/set-length-limit-and-bottom-scroll-bar-in-exceptions-table/292713 "2022-01-07T19:36:41Z")
Version: Elasticsearch 7.16.2 & Kibana 7.16.2 Hi, everyone In the case of creating a rule with a long name may hinder exceptions workflow. For instance, if I create a rule with the name: Lorem Ipsum is simply dummy … --- ## [Threshold Rule type - not able to send more than three field values in email action](https://discuss.elastic.co/t/threshold-rule-type-not-able-to-send-more-than-three-field-values-in-email-action/292870)
**Author:** [@jancodenew](https://discuss.elastic.co/u/jancodenew)\ **Replies:** 1\ **Last updated:** [January 7, 2022, 7:25pm UTC](https://discuss.elastic.co/t/threshold-rule-type-not-able-to-send-more-than-three-field-values-in-email-action/292870 "2022-01-07T19:25:45Z")
Continuing the discussion from Threshold Rule type - not able to send more than three field values in email action: --- ## [Exact match](https://discuss.elastic.co/t/exact-match/293761)
**Author:** [@shafouz](https://discuss.elastic.co/u/shafouz)\ **Replies:** 3\ **Last updated:** [January 7, 2022, 7:19pm UTC](https://discuss.elastic.co/t/exact-match/293761 "2022-01-07T19:19:19Z")
Hi, I need to search in a big text field for a exact match. I tried with different analyzers but in a lot of them i run on the lucerne size limit and i haven't found any that exact matches. Are there any way to do that… --- ## [Request body is required when updating an index template using the Dev console](https://discuss.elastic.co/t/request-body-is-required-when-updating-an-index-template-using-the-dev-console/293775)
**Author:** [@dev9](https://discuss.elastic.co/u/dev9)\ **Replies:** 5\ **Last updated:** [January 7, 2022, 6:49pm UTC](https://discuss.elastic.co/t/request-body-is-required-when-updating-an-index-template-using-the-dev-console/293775 "2022-01-07T18:49:41Z")
Hi, How do I update an index template using the Dev Console? when I tried the below, I got a parse exception request body is required. I am using the latest version of elastic PUT \_index\_template/test/ { "… --- ## [Wazuh SIEM + Winlogbeat](https://discuss.elastic.co/t/wazuh-siem-winlogbeat/292490)
**Author:** [@IvanYboa](https://discuss.elastic.co/u/IvanYboa)\ **Replies:** 2\ **Last updated:** [January 7, 2022, 6:21pm UTC](https://discuss.elastic.co/t/wazuh-siem-winlogbeat/292490 "2022-01-07T18:21:08Z")
Hi! I'm new at Elasticsearch and I'm implementing the SIEM Wazuh. The team of wazuh has their own agent to collect the logs, but in the company where I'm working want that some machines run the Wazuh agents and other ma… [Previous page](https://discuss.elastic.co/latest.md?page=1316) [Next page](https://discuss.elastic.co/latest.md?page=1318)