# Latest **URL:** https://discuss.elastic.co/latest.md?page=1331 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1332 --- ## [Metricbeat single run](https://discuss.elastic.co/t/metricbeat-single-run/292721)
**Author:** [@tobias\_c](https://discuss.elastic.co/u/tobias_c)\ **Replies:** 5\ **Last updated:** [December 24, 2021, 6:29pm UTC](https://discuss.elastic.co/t/metricbeat-single-run/292721 "2021-12-24T18:29:03Z")
Hi all Is it possible to let run metricbeat once and then terminate? So the service (everlasting process) is not wanted. Thanks Tobias --- ## [Logstash join (aggregate?) two aggregated maps (postfix)](https://discuss.elastic.co/t/logstash-join-aggregate-two-aggregated-maps-postfix/292820)
**Author:** [@rowra](https://discuss.elastic.co/u/rowra)\ **Replies:** 3\ **Last updated:** [December 24, 2021, 5:08pm UTC](https://discuss.elastic.co/t/logstash-join-aggregate-two-aggregated-maps-postfix/292820 "2021-12-24T17:08:02Z")
Hi, I have two postfix servers. Call one 'local' and the other 'dmz'. I collect log from each and I aggregate them with taskid being the queue id postfix gives to each process. All works fine so far, I get one aggregate… --- ## [Elastic APM OpenTelemetry Missing transaction.id on span. Not linking Stack Traces to Errors in Kibana UI](https://discuss.elastic.co/t/elastic-apm-opentelemetry-missing-transaction-id-on-span-not-linking-stack-traces-to-errors-in-kibana-ui/292904)
**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Replies:** 0\ **Last updated:** [December 24, 2021, 4:08pm UTC](https://discuss.elastic.co/t/elastic-apm-opentelemetry-missing-transaction-id-on-span-not-linking-stack-traces-to-errors-in-kibana-ui/292904 "2021-12-24T16:08:54Z")
Kibana version: 7.16.2 Elasticsearch version: 7.16.2 APM Server version: 7.16.2 APM Agent language and version: Jenkins OpenTelemetry Plugin 1.0.1 OpenTelemetry SDK to 1.7.1 Browser version: N/A Original install m… --- ## [Mapping null values](https://discuss.elastic.co/t/mapping-null-values/292900)
**Author:** [@Emile\_Plas](https://discuss.elastic.co/u/Emile_Plas)\ **Replies:** 1\ **Last updated:** [December 24, 2021, 4:02pm UTC](https://discuss.elastic.co/t/mapping-null-values/292900 "2021-12-24T16:02:17Z")
Hey everyone! I am quite new to Elasticsearch so feel free to criticize my work method. I am currently working on a project in which multiple pdf documents (a series of court decisions) need to be searched. The PDF docu… --- ## [How to divide and visualize two aggregated data？](https://discuss.elastic.co/t/how-to-divide-and-visualize-two-aggregated-data/292758)
**Author:** [@wsysx123](https://discuss.elastic.co/u/wsysx123)\ **Replies:** 4\ **Last updated:** [December 24, 2021, 3:50pm UTC](https://discuss.elastic.co/t/how-to-divide-and-visualize-two-aggregated-data/292758 "2021-12-24T15:50:25Z")
As a beginner of Kibana, I feel very powerful. However, there is a problem that cannot be realized at present, so I hereby ask for advice. Suppose I have two fields, named 'key1' and 'key2', and aggregation them by 1 mi… --- ## [Filebeat config check isn't reliable](https://discuss.elastic.co/t/filebeat-config-check-isnt-reliable/292807)
**Author:** [@javond](https://discuss.elastic.co/u/javond)\ **Replies:** 1\ **Last updated:** [December 24, 2021, 3:06pm UTC](https://discuss.elastic.co/t/filebeat-config-check-isnt-reliable/292807 "2021-12-24T15:06:27Z")
With that config fields: domain: XXXXXXXXX filebeat: config: inputs: enabled: true path: /etc/filebeat/inputs.d/\*.yaml reload: enabled: true period: 30s modules: path:… --- ## [GROK Filter not working as expected](https://discuss.elastic.co/t/grok-filter-not-working-as-expected/292796)
**Author:** [@KVerbeeck](https://discuss.elastic.co/u/KVerbeeck)\ **Replies:** 2\ **Last updated:** [December 24, 2021, 3:04pm UTC](https://discuss.elastic.co/t/grok-filter-not-working-as-expected/292796 "2021-12-24T15:04:56Z")
Hello, While applying custom GROK filters to my sample data, i get unexpected results. Sample Data: hotspot offering lease x.x.x.x for xx:xx:xx:xx:xx:xx without success Grok Pattern: %{WORD:network.name} (?\ **Author:** [@denizzengin](https://discuss.elastic.co/u/denizzengin)\ **Replies:** 0\ **Last updated:** [December 24, 2021, 1:29pm UTC](https://discuss.elastic.co/t/elastic-search-1-7-1-log4j2-vulnerability-fix/292899 "2021-12-24T13:29:07Z") Hi, How to fix security problem for 1.7.1 version without upgrade our Elasticsearch version ? --- ## [Cloudflare Logs via Logstash](https://discuss.elastic.co/t/cloudflare-logs-via-logstash/291743)
**Author:** [@ZiaulAfiq](https://discuss.elastic.co/u/ZiaulAfiq)\ **Replies:** 5\ **Last updated:** [December 24, 2021, 1:24pm UTC](https://discuss.elastic.co/t/cloudflare-logs-via-logstash/291743 "2021-12-24T13:24:43Z")
Hello & Greetings all! I'm doing some testing to retrieve Cloudflare logs using Logstash. My approach in retrieving the Cloudflare logs are by using Bash script to pull the logs from cloudflare then push them to logstas… --- ## [Parse json data](https://discuss.elastic.co/t/parse-json-data/292893)
**Author:** [@royalE](https://discuss.elastic.co/u/royalE)\ **Replies:** 0\ **Last updated:** [December 24, 2021, 12:57pm UTC](https://discuss.elastic.co/t/parse-json-data/292893 "2021-12-24T12:57:21Z")
Parsing nested json in Logstash below is a sample of my file , I am not able to read the json files in logstash since it has nested json field inside the message.I need to know what is the best way to read file in logst… --- ## [How to sort on second same (field) value](https://discuss.elastic.co/t/how-to-sort-on-second-same-field-value/292888)
**Author:** [@Wilco\_R](https://discuss.elastic.co/u/Wilco_R)\ **Replies:** 0\ **Last updated:** [December 24, 2021, 11:57am UTC](https://discuss.elastic.co/t/how-to-sort-on-second-same-field-value/292888 "2021-12-24T11:57:50Z")
Hi people, I ran into an sorting problem, which is very hard for me to find out how to do it. What i want to achieve is to query the data to sort it in a way that the second(or higher) of the same configuration\_id is a… --- ## [Elastic Agent is healthy but no datastream display in Fleet Server](https://discuss.elastic.co/t/elastic-agent-is-healthy-but-no-datastream-display-in-fleet-server/292879)
**Author:** [@ZiaulAfiq](https://discuss.elastic.co/u/ZiaulAfiq)\ **Replies:** 1\ **Last updated:** [December 24, 2021, 11:32am UTC](https://discuss.elastic.co/t/elastic-agent-is-healthy-but-no-datastream-display-in-fleet-server/292879 "2021-12-24T11:32:29Z")
Hello & Greetings all! I have successfully install Elastic agent (7.16.2) inside my Elasticsearch cluster but did not receive data stream output from the Elastic agent itself. After some troubleshooting for the install… --- ## [Load multiple tables data from oltp to elasticsearch using logstash](https://discuss.elastic.co/t/load-multiple-tables-data-from-oltp-to-elasticsearch-using-logstash/292886)
**Author:** [@umang\_t](https://discuss.elastic.co/u/umang_t)\ **Replies:** 0\ **Last updated:** [December 24, 2021, 11:17am UTC](https://discuss.elastic.co/t/load-multiple-tables-data-from-oltp-to-elasticsearch-using-logstash/292886 "2021-12-24T11:17:19Z")
What is the efficient way to load data from multiple tables (e.g. 10 to 15 tables from RDBMS) in to Elasticsearch . Note the RDBMS has records in millions so idea is to flatten the resultset and load in Elasticsearch . H… --- ## [Auditbeat обновление document\_id](https://discuss.elastic.co/t/auditbeat-document-id/291900)
**Author:** [@cva](https://discuss.elastic.co/u/cva)\ **Replies:** 1\ **Last updated:** [December 24, 2021, 9:42am UTC](https://discuss.elastic.co/t/auditbeat-document-id/291900 "2021-12-24T09:42:07Z")
Добрый день! Отправляю логи auditbeat в elasticserch через logstash. В logstash output добавил параметр document\_id для обновления id документа в elasticserch: if "xml" in \[tags\] { elasticsearch { hosts =\> … --- ## [KIBANA Visualization](https://discuss.elastic.co/t/kibana-visualization/292859)
**Author:** [@vikram\_singh](https://discuss.elastic.co/u/vikram_singh)\ **Replies:** 1\ **Last updated:** [December 24, 2021, 7:09am UTC](https://discuss.elastic.co/t/kibana-visualization/292859 "2021-12-24T07:09:31Z")
Hi, I am visualizing dat in kibana bar Chart ( Horizontal and vertical). I showed data (numeric value) in stack view on a bar. I am getting all values of that bar on hover. I Also want to show sum of stack values on … --- ## [How to use painless BigDecimal in java code?](https://discuss.elastic.co/t/how-to-use-painless-bigdecimal-in-java-code/292780)
**Author:** [@xiaozhiliaoo](https://discuss.elastic.co/u/xiaozhiliaoo)\ **Replies:** 1\ **Last updated:** [December 24, 2021, 6:20am UTC](https://discuss.elastic.co/t/how-to-use-painless-bigdecimal-in-java-code/292780 "2021-12-24T06:20:58Z")
I use painless to update doc. how to use BigDecimal to finish it ? Using Elasticsearch 6.8.1. Script JavaDoc Script construtor is: public Script (ScriptType type, java.lang.String lang, ja… --- ## [Unit logstash.service entered failed state](https://discuss.elastic.co/t/unit-logstash-service-entered-failed-state/292865)
**Author:** [@cva](https://discuss.elastic.co/u/cva)\ **Replies:** 0\ **Last updated:** [December 24, 2021, 6:02am UTC](https://discuss.elastic.co/t/unit-logstash-service-entered-failed-state/292865 "2021-12-24T06:02:28Z")
Hi! OS Centos 7, java -version openjdk version "1.8.0\_252" Updated the version of logstash to 7.16.2, now at startup I get the following systemctl status logstash: Dec 24 01:27:08 elk systemd\[1\]: Unit logstash.servic… --- ## [Some vulnerabilities in Elasticsearch v7.10.0 x-pack, Elasticsearch sql cli 7.10.0, plugin cli, security cli](https://discuss.elastic.co/t/some-vulnerabilities-in-elasticsearch-v7-10-0-x-pack-elasticsearch-sql-cli-7-10-0-plugin-cli-security-cli/292745)
**Author:** [@Sagarika\_Mahalik](https://discuss.elastic.co/u/Sagarika_Mahalik)\ **Replies:** 1\ **Last updated:** [December 24, 2021, 5:30am UTC](https://discuss.elastic.co/t/some-vulnerabilities-in-elasticsearch-v7-10-0-x-pack-elasticsearch-sql-cli-7-10-0-plugin-cli-security-cli/292745 "2021-12-24T05:30:22Z")
Hi, There are some Vulnerabilities in Elasticsearch 7.10.0 version. Some vulnerabilities in Elasticsearch v7.10.0 x-pack, Elasticsearch sql cli 7.10.0, plugin cli, security cli. While installing Elasticsearch all of t… --- ## [Track frontend application UI events? Better way?](https://discuss.elastic.co/t/track-frontend-application-ui-events-better-way/292861)
**Author:** [@nagendrahk](https://discuss.elastic.co/u/nagendrahk)\ **Replies:** 2\ **Last updated:** [December 24, 2021, 4:58am UTC](https://discuss.elastic.co/t/track-frontend-application-ui-events-better-way/292861 "2021-12-24T04:58:05Z")
I want to build ELK application to track frontend events from my react application. I having two approaches in mind Store events in log file using winston package and later push it to logstash and elastic with filebeat… --- ## [elasticsearchに入っているデータがKibanaから参照できない](https://discuss.elastic.co/t/elasticsearch-kibana/292756)
**Author:** [@snowman\_1114](https://discuss.elastic.co/u/snowman_1114)\ **Replies:** 2\ **Last updated:** [December 24, 2021, 3:36am UTC](https://discuss.elastic.co/t/elasticsearch-kibana/292756 "2021-12-24T03:36:09Z")
こんにちは Elasticsearchにはデータが入っており、Index patternも対象のindexを含む形で行っているのですが、Discoverなどでデータを見ることができません。 filebeatのmodule(panw)からElasticsearchにデータ登録を行っています。（バージョンは7.16.1です） APIをたたくとドキュメントは登録されている GET /filebeat-panos-2021.12.23… --- ## [Hello elastic team, I want to get some help on dapr + apmserver](https://discuss.elastic.co/t/hello-elastic-team-i-want-to-get-some-help-on-dapr-apmserver/290736)
**Author:** [@wajika](https://discuss.elastic.co/u/wajika)\ **Replies:** 5\ **Last updated:** [December 24, 2021, 12:39am UTC](https://discuss.elastic.co/t/hello-elastic-team-i-want-to-get-some-help-on-dapr-apmserver/290736 "2021-12-24T00:39:37Z")
Our service is based on dapr framework, dapr includes tracing function (based on opentelemetry implementation). I want to replace the dapr sidecar with the elastic apm agent, and then still use the apm server for storage… --- ## [Unit logstash.service entered failed state](https://discuss.elastic.co/t/unit-logstash-service-entered-failed-state/292848)
**Author:** [@cva](https://discuss.elastic.co/u/cva)\ **Replies:** 2\ **Last updated:** [December 23, 2021, 11:36pm UTC](https://discuss.elastic.co/t/unit-logstash-service-entered-failed-state/292848 "2021-12-23T23:36:15Z")
OS Centos 7. Обновил версию logstash до 7.16.2, теперь при запуске получаю следующее systemctl status logstash: Dec 24 01:27:08 elk systemd\[1\]: Unit logstash.service entered failed state. Dec 24 01:27:08 elk systemd\[1… --- ## [7.16.2 triggering Google Cloud security alert](https://discuss.elastic.co/t/7-16-2-triggering-google-cloud-security-alert/292618)
**Author:** [@gehgerds](https://discuss.elastic.co/u/gehgerds)\ **Replies:** 7\ **Last updated:** [December 23, 2021, 11:16pm UTC](https://discuss.elastic.co/t/7-16-2-triggering-google-cloud-security-alert/292618 "2021-12-23T23:16:53Z")
After bumping the docker image version to elasticsearch:7.16.2 in GKE, whenever I start elasticsearch pod, it immediately triggers a security alert Added Library Loaded Added\_Library\_Fullpath: /tmp/twIW2T (deleted) de… --- ## [Backup to s3 repo from elasticsearch 6.8.22](https://discuss.elastic.co/t/backup-to-s3-repo-from-elasticsearch-6-8-22/292836)
**Author:** [@zorruch](https://discuss.elastic.co/u/zorruch)\ **Replies:** 2\ **Last updated:** [December 23, 2021, 9:33pm UTC](https://discuss.elastic.co/t/backup-to-s3-repo-from-elasticsearch-6-8-22/292836 "2021-12-23T21:33:05Z")
hi I am using elasticsearch 6.8.22 with plugin repository-s3 I also use ceph s3 storage running on rook(k8s) I'm trying to set up a snapshot backup for it: I create a repository command: curl -sk -X PUT "https://lo… --- ## [Elastic Observability: cannot start in Strigo because of login page](https://discuss.elastic.co/t/elastic-observability-cannot-start-in-strigo-because-of-login-page/292840)
**Author:** [@swainstead](https://discuss.elastic.co/u/swainstead)\ **Replies:** 1\ **Last updated:** [December 23, 2021, 6:20pm UTC](https://discuss.elastic.co/t/elastic-observability-cannot-start-in-strigo-because-of-login-page/292840 "2021-12-23T18:20:33Z")
When I click the "Lab" button I get a new tab with Strigo, but it wants either a Google account or an email/password for a Strigo account. This doesn't work with the username/password the course materials provide. Did S… --- ## [Index alias](https://discuss.elastic.co/t/index-alias/292829)
**Author:** [@iamtheschmitzer](https://discuss.elastic.co/u/iamtheschmitzer)\ **Replies:** 1\ **Last updated:** [December 23, 2021, 4:13pm UTC](https://discuss.elastic.co/t/index-alias/292829 "2021-12-23T16:13:03Z")
If I have a rollover index foo-000001, which rolls over to foo-N and alias index foo for them, is foo equivalent to the "latest" of those rollovers or the "union" of them? Thanks --- ## [Multiple Conditions in Elastic Watcher](https://discuss.elastic.co/t/multiple-conditions-in-elastic-watcher/292716)
**Author:** [@ishyherts](https://discuss.elastic.co/u/ishyherts)\ **Replies:** 3\ **Last updated:** [December 23, 2021, 4:11pm UTC](https://discuss.elastic.co/t/multiple-conditions-in-elastic-watcher/292716 "2021-12-23T16:11:42Z")
Hi, I am using a watcher to alert via email if "tracking.softQuota.percentageUsed" \> 50(%) - this record (hit) also comes with a field meta.application which identifies a certain client or customer. This watcher runs m… --- ## [High CPU utilization on two nodes due to DSL Queries and slower query response](https://discuss.elastic.co/t/high-cpu-utilization-on-two-nodes-due-to-dsl-queries-and-slower-query-response/292535)
**Author:** [@Divyank\_Mahalle](https://discuss.elastic.co/u/Divyank_Mahalle)\ **Replies:** 5\ **Last updated:** [December 23, 2021, 3:45pm UTC](https://discuss.elastic.co/t/high-cpu-utilization-on-two-nodes-due-to-dsl-queries-and-slower-query-response/292535 "2021-12-23T15:45:41Z")
Hi, I am using elastic version 7.11.2. I am observing that two nodes that contain an index of 102Gb (51+51), multiple DSL queries are running in the background resulting in high CPU utilization. Enabled autoscaling on … --- ## [Disable specific deprecation warnings](https://discuss.elastic.co/t/disable-specific-deprecation-warnings/292678)
**Author:** [@joschi](https://discuss.elastic.co/u/joschi)\ **Replies:** 8\ **Last updated:** [December 23, 2021, 3:16pm UTC](https://discuss.elastic.co/t/disable-specific-deprecation-warnings/292678 "2021-12-23T15:16:24Z")
Hey folks, after upgrading to Elasticsearch 7.16.2, we receive the following deprecation warning in our clients (Java High-Level REST client): org.elasticsearch.client.RestClient - request \[POST http://example.com:9200… --- ## [Performance issues even with only text TSBV](https://discuss.elastic.co/t/performance-issues-even-with-only-text-tsbv/292815)
**Author:** [@mdgdeveloper](https://discuss.elastic.co/u/mdgdeveloper)\ **Replies:** 0\ **Last updated:** [December 23, 2021, 2:49pm UTC](https://discuss.elastic.co/t/performance-issues-even-with-only-text-tsbv/292815 "2021-12-23T14:49:33Z")
We have been facing several performance issues with dashboards in Kibana 7.13 Multiple data requests to /api/metrics/vis/data stay in "pending" status and the dashboard takes more than 30/40 seconds to render. Even in … [Previous page](https://discuss.elastic.co/latest.md?page=1330) [Next page](https://discuss.elastic.co/latest.md?page=1332)