# Latest **URL:** https://discuss.elastic.co/latest.md?page=1318 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1319 --- ## [Discover stream in dashboard](https://discuss.elastic.co/t/discover-stream-in-dashboard/293772)
**Author:** [@Gforce](https://discuss.elastic.co/u/Gforce)\ **Replies:** 1\ **Last updated:** [January 7, 2022, 5:55pm UTC](https://discuss.elastic.co/t/discover-stream-in-dashboard/293772 "2022-01-07T17:55:31Z")
How can I get a "Discover-like" stream into a Dashboard? The Log Stream widget does not behave the same. The stream visible in the Discover section adds new items to the top and it does not completely blank-out during r… --- ## [Create Alert using connector Index](https://discuss.elastic.co/t/create-alert-using-connector-index/293324)
**Author:** [@alipujaistopo](https://discuss.elastic.co/u/alipujaistopo)\ **Replies:** 1\ **Last updated:** [January 7, 2022, 5:44pm UTC](https://discuss.elastic.co/t/create-alert-using-connector-index/293324 "2022-01-07T17:44:08Z")
hello everyone, i wanna create alert ssh bruteforce but using "index" connector. because i dunno what index i will use and i dunno how to test it. --- ## [Updating Elasticstack from 7.16.1 to 7.16.2](https://discuss.elastic.co/t/updating-elasticstack-from-7-16-1-to-7-16-2/293586)
**Author:** [@Akhil2](https://discuss.elastic.co/u/Akhil2)\ **Replies:** 1\ **Last updated:** [January 6, 2022, 2:41pm UTC](https://discuss.elastic.co/t/updating-elasticstack-from-7-16-1-to-7-16-2/293586 "2022-01-06T14:41:23Z")
Hello all, I am updating my elasticstack to 7.16.2. Elasticsearch cluster started fine but I see following in Kibana logs. These events are constantly appearing in Kibana logs. GET /\_nodes?filter\_path=nodes.\*.version%2… --- ## [Hints based autodiscovery not working as described in documentation](https://discuss.elastic.co/t/hints-based-autodiscovery-not-working-as-described-in-documentation/293150)
**Author:** [@gehgerds](https://discuss.elastic.co/u/gehgerds)\ **Replies:** 1\ **Last updated:** [January 7, 2022, 5:33pm UTC](https://discuss.elastic.co/t/hints-based-autodiscovery-not-working-as-described-in-documentation/293150 "2022-01-07T17:33:43Z")
I'm following documentation on hints based autodiscovery. I want to use annotations to control which pods logs are being discovered. When I use example config like this, then all containers in cluster gets discovered and… --- ## [Hardware server requirements for a fast ElasticSearch experience on one website with 900k entries](https://discuss.elastic.co/t/hardware-server-requirements-for-a-fast-elasticsearch-experience-on-one-website-with-900k-entries/293768)
**Author:** [@nbadmin](https://discuss.elastic.co/u/nbadmin)\ **Replies:** 1\ **Last updated:** [January 7, 2022, 5:12pm UTC](https://discuss.elastic.co/t/hardware-server-requirements-for-a-fast-elasticsearch-experience-on-one-website-with-900k-entries/293768 "2022-01-07T17:12:00Z")
Hello guys, I want to set up a dedicated vServer on which I want to run a single website. My question is what hardware server requirements do I need to implement a really fast Elasticsearch search and manage it with K… --- ## [Elastic Agent No upgrade option Available](https://discuss.elastic.co/t/elastic-agent-no-upgrade-option-available/293738)
**Author:** [@Anabella\_Cristaldi](https://discuss.elastic.co/u/Anabella_Cristaldi)\ **Replies:** 1\ **Last updated:** [January 7, 2022, 5:09pm UTC](https://discuss.elastic.co/t/elastic-agent-no-upgrade-option-available/293738 "2022-01-07T17:09:26Z")
Hi all, I have a problem with some agents. I'm in version 7.16.1, I was able to upgrade most of my agents, but for some I have no option to upgrade.. The target systems (were the agents are installed) are redhat linux … --- ## [Filebeat Kafka Input not able to process Messages](https://discuss.elastic.co/t/filebeat-kafka-input-not-able-to-process-messages/293255)
**Author:** [@cyber\_crab](https://discuss.elastic.co/u/cyber_crab)\ **Replies:** 4\ **Last updated:** [January 7, 2022, 5:07pm UTC](https://discuss.elastic.co/t/filebeat-kafka-input-not-able-to-process-messages/293255 "2022-01-07T17:07:06Z")
Hi everyone, I'm currently facing an issue with the Filebeat Kafka input. The event flow is Data Source \> Logstash \> Kafka \> Filebeat \> Logstash \> Elasticsearch. Kafka is used to handle event ingestion spikes and ES clu… --- ## [Elasticsearch issue: nested: NumberFormatException\[For input string:](https://discuss.elastic.co/t/elasticsearch-issue-nested-numberformatexception-for-input-string/293730)
**Author:** [@Kiran\_Chauhan](https://discuss.elastic.co/u/Kiran_Chauhan)\ **Replies:** 1\ **Last updated:** [January 7, 2022, 4:53pm UTC](https://discuss.elastic.co/t/elasticsearch-issue-nested-numberformatexception-for-input-string/293730 "2022-01-07T16:53:48Z")
Hello @all, I am new here and hope this is the right place to discuss the issue. Sorry if I am violating any community rule. I have Elasticsearch with open-edx. Currently, I am facing an issue with Elasticsearch. wh… --- ## [How to ingest access\_log with x-forwarded-for from oracle http server in elasticsearch](https://discuss.elastic.co/t/how-to-ingest-access-log-with-x-forwarded-for-from-oracle-http-server-in-elasticsearch/293770)
**Author:** [@Agarwal](https://discuss.elastic.co/u/Agarwal)\ **Replies:** 0\ **Last updated:** [January 7, 2022, 4:51pm UTC](https://discuss.elastic.co/t/how-to-ingest-access-log-with-x-forwarded-for-from-oracle-http-server-in-elasticsearch/293770 "2022-01-07T16:51:31Z")
I am new to Elastic and wanting to ingest Oracle http server access\_log in elastic. i used apache ingestion, it considers entry as error.message. i used filebeat it does the same. i dont understand how to format it for i… --- ## [Why my logstash aggregate sometimes works, sometimes not?](https://discuss.elastic.co/t/why-my-logstash-aggregate-sometimes-works-sometimes-not/293342)
**Author:** [@maoxuguang](https://discuss.elastic.co/u/maoxuguang)\ **Replies:** 7\ **Last updated:** [January 7, 2022, 4:46pm UTC](https://discuss.elastic.co/t/why-my-logstash-aggregate-sometimes-works-sometimes-not/293342 "2022-01-07T16:46:26Z")
for example, sometimes I can get the tag \[ "fordebug\_%{job\_name}" \], it indicates that the aggregate executed successfully, sometimes I can not get this tag. why? I struggled for days but no finding. I am exhausted. cou… --- ## [Updating podTemplate labels doesn't update pods](https://discuss.elastic.co/t/updating-podtemplate-labels-doesnt-update-pods/293769)
**Author:** [@whyvez](https://discuss.elastic.co/u/whyvez)\ **Replies:** 0\ **Last updated:** [January 7, 2022, 4:39pm UTC](https://discuss.elastic.co/t/updating-podtemplate-labels-doesnt-update-pods/293769 "2022-01-07T16:39:11Z")
I've updated the Elasticsearch podTemplate to add labels but the labels are not getting propagated to the pods. How can I force the pods to update? The added labels are not on the Statefulset either but are on the Elasti… --- ## [Filtering nested objects](https://discuss.elastic.co/t/filtering-nested-objects/291911)
**Author:** [@dev\_test](https://discuss.elastic.co/u/dev_test)\ **Replies:** 11\ **Last updated:** [January 7, 2022, 3:45pm UTC](https://discuss.elastic.co/t/filtering-nested-objects/291911 "2022-01-07T15:45:10Z")
Hi, I'm trying to build a system that will have a user's phone book in nested field and this will have user\_id and user\_gender. I am trying to filter over gender in search result but i'm only getting the whole nested obj… --- ## [How to combine results from 2 elasticsearch indexes with different layouts](https://discuss.elastic.co/t/how-to-combine-results-from-2-elasticsearch-indexes-with-different-layouts/293659)
**Author:** [@jan499](https://discuss.elastic.co/u/jan499)\ **Replies:** 2\ **Last updated:** [January 7, 2022, 3:22pm UTC](https://discuss.elastic.co/t/how-to-combine-results-from-2-elasticsearch-indexes-with-different-layouts/293659 "2022-01-07T15:22:29Z")
We have an Elasticsearch with 2 different indexes. In one index there is a field called physical\_location which contains a lat en lon subfield. in the other index there is a field called program\_run.geolocation with the … --- ## [Unable to Start Elastic Search from Windows Service : Using MSI](https://discuss.elastic.co/t/unable-to-start-elastic-search-from-windows-service-using-msi/293752)
**Author:** [@dkris1](https://discuss.elastic.co/u/dkris1)\ **Replies:** 0\ **Last updated:** [January 7, 2022, 2:37pm UTC](https://discuss.elastic.co/t/unable-to-start-elastic-search-from-windows-service-using-msi/293752 "2022-01-07T14:37:57Z")
Hi All, Unable to start windows Elasticsearch service. Event viewer shows below. Using Version 7.16.1 Service cannot be started. Elastic.ProcessHosts.Process.StartupException: Could not evaluate jvm.options file. result… --- ## [Filebeat HAProxy module exported fields](https://discuss.elastic.co/t/filebeat-haproxy-module-exported-fields/293749)
**Author:** [@dicko](https://discuss.elastic.co/u/dicko)\ **Replies:** 0\ **Last updated:** [January 7, 2022, 2:26pm UTC](https://discuss.elastic.co/t/filebeat-haproxy-module-exported-fields/293749 "2022-01-07T14:26:00Z")
I've set up the HAProxy module as per the manuals on the Elastic site and on this site. Can I view the HAProxy exported fields under Discover? How would I go about that? There's also mention of sample and predefined d… --- ## [How to read log files from remote location](https://discuss.elastic.co/t/how-to-read-log-files-from-remote-location/293746)
**Author:** [@Aamir\_Sheraz](https://discuss.elastic.co/u/Aamir_Sheraz)\ **Replies:** 1\ **Last updated:** [January 7, 2022, 1:58pm UTC](https://discuss.elastic.co/t/how-to-read-log-files-from-remote-location/293746 "2022-01-07T13:58:43Z")
I want to read log files from different location/systems. I am able to read multiple files on the same system but there is requirement to read files from another location/system remotely as well without installing fileb… --- ## [.NET Core API Log correlation not showing in transactions](https://discuss.elastic.co/t/net-core-api-log-correlation-not-showing-in-transactions/293747)
**Author:** [@gonzaloluna](https://discuss.elastic.co/u/gonzaloluna)\ **Replies:** 0\ **Last updated:** [January 7, 2022, 1:21pm UTC](https://discuss.elastic.co/t/net-core-api-log-correlation-not-showing-in-transactions/293747 "2022-01-07T13:21:48Z")
Hi I'm trying to make log correlation work on my NET Core API. I'm using NLog following the documentation. I'm getting the traceID and transactionID in the logs in my console and logfile but I have zero logs in any APM … --- ## [Watcher which tries 2 times before alerting](https://discuss.elastic.co/t/watcher-which-tries-2-times-before-alerting/293128)
**Author:** [@Dimitri2](https://discuss.elastic.co/u/Dimitri2)\ **Replies:** 4\ **Last updated:** [January 7, 2022, 1:08pm UTC](https://discuss.elastic.co/t/watcher-which-tries-2-times-before-alerting/293128 "2022-01-07T13:08:45Z")
Hello everyone, I'm new to Elastic and I'm having trouble. I'm trying to get my Watcher to not return an alert right away but wait a moment to confirm or deny the problem. So instead of sending an alert directly, I wa… --- ## [Is there a way to show nested fields when showing highlight results?](https://discuss.elastic.co/t/is-there-a-way-to-show-nested-fields-when-showing-highlight-results/293740)
**Author:** [@munkyu](https://discuss.elastic.co/u/munkyu)\ **Replies:** 0\ **Last updated:** [January 7, 2022, 12:51pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-show-nested-fields-when-showing-highlight-results/293740 "2022-01-07T12:51:46Z")
nested fields like below. "comments" : \[ { "content" : "apple computer", "votes\_count" : 1 }, { "content" : "apple computer is good", … --- ## [7.16.2 API problem](https://discuss.elastic.co/t/7-16-2-api-problem/293722)
**Author:** [@mengben](https://discuss.elastic.co/u/mengben)\ **Replies:** 1\ **Last updated:** [January 7, 2022, 11:12am UTC](https://discuss.elastic.co/t/7-16-2-api-problem/293722 "2022-01-07T11:12:10Z")
first：how to use SQL query second:How does the new API return some fields --- ## [Error: cannot touch an object that is not persisted at](https://discuss.elastic.co/t/error-cannot-touch-an-object-that-is-not-persisted-at/293293)
**Author:** [@cdwmhcc](https://discuss.elastic.co/u/cdwmhcc)\ **Replies:** 9\ **Last updated:** [January 7, 2022, 10:38am UTC](https://discuss.elastic.co/t/error-cannot-touch-an-object-that-is-not-persisted-at/293293 "2022-01-07T10:38:46Z")
\[2022-01-02T14:26:21.029+00:00\]\[95838\]\[2000\]\[app-server\]\[INFO\]: \[db\_lock\] \[installation\] Status: \[Starting\] Creating a default Workplace Search organization \[2022-01-02T14:26:22.023+00:00\]\[95838\]\[2000\]\[app-server\]\[IN… --- ## [ILM failing for rollover for Wazuh module / data](https://discuss.elastic.co/t/ilm-failing-for-rollover-for-wazuh-module-data/291781)
**Author:** [@Atul\_Chadha](https://discuss.elastic.co/u/Atul_Chadha)\ **Replies:** 38\ **Last updated:** [January 7, 2022, 9:34am UTC](https://discuss.elastic.co/t/ilm-failing-for-rollover-for-wazuh-module-data/291781 "2022-01-07T09:34:34Z")
I have setup a rollover policy for wazuh index with the below policy defination { "policy": "Wazuh", "phase\_definition": { "min\_age": "0ms", "actions": { "rollover": { "max\_size": "20gb", … --- ## [Kibana server.publicBaseUrl](https://discuss.elastic.co/t/kibana-server-publicbaseurl/293661)
**Author:** [@maltewhiite](https://discuss.elastic.co/u/maltewhiite)\ **Replies:** 3\ **Last updated:** [January 7, 2022, 8:38am UTC](https://discuss.elastic.co/t/kibana-server-publicbaseurl/293661 "2022-01-07T08:38:27Z")
I am seeing this error on my Kibana I have several questions Where do I configure that setting? in kibana.yml ? in Elasticsearch.yml ? What should I set the setting to? Kibana.yml # File managed by Puppet. ---… --- ## [Elasticsearch Script Query - Returning multiple values on aggregation](https://discuss.elastic.co/t/elasticsearch-script-query-returning-multiple-values-on-aggregation/293716)
**Author:** [@hyun](https://discuss.elastic.co/u/hyun)\ **Replies:** 0\ **Last updated:** [January 7, 2022, 8:26am UTC](https://discuss.elastic.co/t/elasticsearch-script-query-returning-multiple-values-on-aggregation/293716 "2022-01-07T08:26:07Z")
Aggregation Result "aggregations": { "649": { "doc\_count\_error\_upper\_bound": 0, "sum\_other\_doc\_count": 0, "buckets": \[ { "key": "ALLOGENE THERAPEUTICS", … --- ## [ML datafeed altering - convert text field to integer](https://discuss.elastic.co/t/ml-datafeed-altering-convert-text-field-to-integer/293713)
**Author:** [@zerojin63](https://discuss.elastic.co/u/zerojin63)\ **Replies:** 0\ **Last updated:** [January 7, 2022, 8:03am UTC](https://discuss.elastic.co/t/ml-datafeed-altering-convert-text-field-to-integer/293713 "2022-01-07T08:03:56Z")
Hi, I want to convert keyword format field to integer in runtime mapping. I've tried these code but none of them worked. "runtime\_mappings": { "my\_field.keyword": { "type": "keyword", "script": { … --- ## [Using functionbeat environment variables](https://discuss.elastic.co/t/using-functionbeat-environment-variables/293707)
**Author:** [@Sultan](https://discuss.elastic.co/u/Sultan)\ **Replies:** 0\ **Last updated:** [January 7, 2022, 6:12am UTC](https://discuss.elastic.co/t/using-functionbeat-environment-variables/293707 "2022-01-07T06:12:03Z")
Hi, We are trying to use functionbeat to deploy a lambda function in AWS which eventually would ship kinesis logs to our elastic cloud. We do not want to keep the elastic credentials (ie. cloud.auth, cloud.id etc) in th… --- ## [Error listing bucket contents: Error getting access token for service account: oauth2.googleapis.com](https://discuss.elastic.co/t/error-listing-bucket-contents-error-getting-access-token-for-service-account-oauth2-googleapis-com/293704)
**Author:** [@parmarX](https://discuss.elastic.co/u/parmarX)\ **Replies:** 0\ **Last updated:** [January 7, 2022, 4:56am UTC](https://discuss.elastic.co/t/error-listing-bucket-contents-error-getting-access-token-for-service-account-oauth2-googleapis-com/293704 "2022-01-07T04:56:14Z")
Hello , I am facing this issue while running my pipeline using configmap and deployment in docker. my plugin is unable to get access token for service accound . i am using plugin input\_google\_cloud\_storage to get file… --- ## [Logstash Date Format Failure](https://discuss.elastic.co/t/logstash-date-format-failure/293702)
**Author:** [@insu0929](https://discuss.elastic.co/u/insu0929)\ **Replies:** 2\ **Last updated:** [January 7, 2022, 4:17am UTC](https://discuss.elastic.co/t/logstash-date-format-failure/293702 "2022-01-07T04:17:53Z")
Hi I'm using filebeat to send some session count data to Logstash. The file type is csv and the data looks like this: ... "01/02/2022 00:00:27.837", "0.99961" "01/02/2022 00:00:28.853", "0" "01/02/2022 00:00:29.240", "1… --- ## [Failed to create elasticsearch client, connection refused while running fscrawler pod](https://discuss.elastic.co/t/failed-to-create-elasticsearch-client-connection-refused-while-running-fscrawler-pod/293663)
**Author:** [@Adityadgr8](https://discuss.elastic.co/u/Adityadgr8)\ **Replies:** 0\ **Last updated:** [January 6, 2022, 3:14pm UTC](https://discuss.elastic.co/t/failed-to-create-elasticsearch-client-connection-refused-while-running-fscrawler-pod/293663 "2022-01-06T15:14:08Z")
Hello, our fscrawler is unable to make a connection with Elasticsearch in the linux server. Previously with the same configuration, it was working fine but don't know why suddenly we starts to face this issue -- we ar… --- ## [Continuously read from .evtx logfile?](https://discuss.elastic.co/t/continuously-read-from-evtx-logfile/293658)
**Author:** [@Andreas\_Falk](https://discuss.elastic.co/u/Andreas_Falk)\ **Replies:** 3\ **Last updated:** [January 7, 2022, 3:06am UTC](https://discuss.elastic.co/t/continuously-read-from-evtx-logfile/293658 "2022-01-07T03:06:38Z")
(crosspost from slack) Hi, We are trying to get the logs from our netapp cifs shares. Netapp exports their logs to a smb share and writes .evtx files there. And with the help of mounting and pointing winlogbeat to th… [Previous page](https://discuss.elastic.co/latest.md?page=1317) [Next page](https://discuss.elastic.co/latest.md?page=1319)