# Latest **URL:** https://discuss.elastic.co/latest.md?page=1356 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1357 --- ## [Dashboard - Creating a complex graph with 3 metrics](https://discuss.elastic.co/t/dashboard-creating-a-complex-graph-with-3-metrics/291121)
**Author:** [@Alice\_S](https://discuss.elastic.co/u/Alice_S)\ **Replies:** 1\ **Last updated:** [December 8, 2021, 7:10pm UTC](https://discuss.elastic.co/t/dashboard-creating-a-complex-graph-with-3-metrics/291121 "2021-12-08T19:10:26Z")
Hi, I would really appreciate getting some help: I'm trying to visualize my data in a more convenient way and to combine 3 graphs into one. The graph should show distinct users and the sum of a specific column by time… --- ## [How to remove fields not required while sending log data from file beat](https://discuss.elastic.co/t/how-to-remove-fields-not-required-while-sending-log-data-from-file-beat/290484)
**Author:** [@shi](https://discuss.elastic.co/u/shi)\ **Replies:** 2\ **Last updated:** [December 8, 2021, 6:04pm UTC](https://discuss.elastic.co/t/how-to-remove-fields-not-required-while-sending-log-data-from-file-beat/290484 "2021-12-08T18:04:07Z")
While sending data from a logfile using file beat through ingest pipeline to index in Elasticsearch, some additional fields not present in the concerned log file is also getting populated. These data are mostly relate… --- ## [Exporting large number of objects from Kibana - errors](https://discuss.elastic.co/t/exporting-large-number-of-objects-from-kibana-errors/291158)
**Author:** [@vee](https://discuss.elastic.co/u/vee)\ **Replies:** 2\ **Last updated:** [December 8, 2021, 6:59pm UTC](https://discuss.elastic.co/t/exporting-large-number-of-objects-from-kibana-errors/291158 "2021-12-08T18:59:38Z")
Hi there, We have v7.5 Elasticsearch/Kibana. Trying to export Saved Objects in prod (~12,000 objects). But it's erroring with this reason in Kibana with this error: Unable to generate export. Here are the Kibana logs at… --- ## [How we can attach a document with the alert to teams action?](https://discuss.elastic.co/t/how-we-can-attach-a-document-with-the-alert-to-teams-action/289790)
**Author:** [@ranju](https://discuss.elastic.co/u/ranju)\ **Replies:** 3\ **Last updated:** [December 8, 2021, 6:34pm UTC](https://discuss.elastic.co/t/how-we-can-attach-a-document-with-the-alert-to-teams-action/289790 "2021-12-08T18:34:08Z")
Document means some dashboard as pdf likewise. Currently, We are using webhook for sending alerts to the team's channels from the watcher. same functionality we are able to perform in email action. eg: "actions": { … --- ## [Elasticsearch-PHP requires cURL, or a custom HTTP handler](https://discuss.elastic.co/t/elasticsearch-php-requires-curl-or-a-custom-http-handler/291250)
**Author:** [@tranha31](https://discuss.elastic.co/u/tranha31)\ **Replies:** 0\ **Last updated:** [December 8, 2021, 6:16pm UTC](https://discuss.elastic.co/t/elasticsearch-php-requires-curl-or-a-custom-http-handler/291250 "2021-12-08T18:16:58Z")
I try to connect Elasticsearch from php with Elasticsearch-php Library. But it notices 127.0.0.1:43202 \[500\]: GET /main.php?q=a - Uncaught RuntimeException: Elasticsearch-PHP requires cURL, or a custom HTTP handler. in… --- ## [SORTING, SUM, PAGINATION, and AGGREGATION all in one!](https://discuss.elastic.co/t/sorting-sum-pagination-and-aggregation-all-in-one/291248)
**Author:** [@michael\_jaskiewicz](https://discuss.elastic.co/u/michael_jaskiewicz)\ **Replies:** 0\ **Last updated:** [December 8, 2021, 6:04pm UTC](https://discuss.elastic.co/t/sorting-sum-pagination-and-aggregation-all-in-one/291248 "2021-12-08T18:04:42Z")
'm using Elasticsearch and I see questions now and then about doing some aggregations with sorting or aggregations with paging, but I never see anything GROUP\_BY, SUM, SORT, and PAGINATION together. If I were to write wh… --- ## [Imap input gives weird error](https://discuss.elastic.co/t/imap-input-gives-weird-error/290671)
**Author:** [@zozo6015](https://discuss.elastic.co/u/zozo6015)\ **Replies:** 6\ **Last updated:** [December 8, 2021, 5:16pm UTC](https://discuss.elastic.co/t/imap-input-gives-weird-error/290671 "2021-12-08T17:16:38Z")
Hello, I want to run imap plugin to load some reporting mails into Elasticsearch. I have it configured as the following: input { imap { check\_interval =\> "10" host =\> "host" port =\> "995" user =\> "em… --- ## [Importing saved objects. - broken index pattern IDs](https://discuss.elastic.co/t/importing-saved-objects-broken-index-pattern-ids/291160)
**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Replies:** 1\ **Last updated:** [December 8, 2021, 4:49pm UTC](https://discuss.elastic.co/t/importing-saved-objects-broken-index-pattern-ids/291160 "2021-12-08T16:49:45Z")
I recently moved some objects between kibana instances. I suspect this is the first time since I have done this since I upgraded to 7.14. When I imported them I was surprised not to be prompted to fix broken ids for in… --- ## [PySpark - How to read timestamp date\_nanos from ElasticSearch to Spark?](https://discuss.elastic.co/t/pyspark-how-to-read-timestamp-date-nanos-from-elasticsearch-to-spark/260020)
**Author:** [@ngocdangrby](https://discuss.elastic.co/u/ngocdangrby)\ **Replies:** 1\ **Last updated:** [December 8, 2021, 4:42pm UTC](https://discuss.elastic.co/t/pyspark-how-to-read-timestamp-date-nanos-from-elasticsearch-to-spark/260020 "2021-12-08T16:42:17Z")
Hi all, I need to read the timestamp from ElasticSearch to Spark RDD or DataFrame. I can read other fields (text, interger..) but timestamp i can not. Spark v2.4.7 Python: v3.6.11 ElasticSearch: v7.10.0 Here is my c… --- ## [Parsing issues](https://discuss.elastic.co/t/parsing-issues/291159)
**Author:** [@nickel43](https://discuss.elastic.co/u/nickel43)\ **Replies:** 6\ **Last updated:** [December 8, 2021, 4:32pm UTC](https://discuss.elastic.co/t/parsing-issues/291159 "2021-12-08T16:32:13Z")
Hello, I have an issue with parsing my data. Here is a sample of JSON: { "info": { "generated\_on": "2017-12-03 08:41:42.057563", "slice": "0-999", "version": "v1" }, "playlists":… --- ## [Setup hot-delete policy for Elastichsearch index without using templates](https://discuss.elastic.co/t/setup-hot-delete-policy-for-elastichsearch-index-without-using-templates/291242)
**Author:** [@obadakhalili](https://discuss.elastic.co/u/obadakhalili)\ **Replies:** 0\ **Last updated:** [December 8, 2021, 4:24pm UTC](https://discuss.elastic.co/t/setup-hot-delete-policy-for-elastichsearch-index-without-using-templates/291242 "2021-12-08T16:24:16Z")
I'm trying to setup an ILM policy that deletes my index every 3 days, and creates a new one. Here's my attempt for achieving that: const policyName = "hot\_delete\_twitter\_stream\_indexing\_policy" await ESClient.ilm.p… --- ## [APM Java Agent Security Update](https://discuss.elastic.co/t/apm-java-agent-security-update/289627)
**Author:** [@douglasday](https://discuss.elastic.co/u/douglasday)\ **Replies:** 0\ **Last updated:** [November 18, 2021, 5:41pm UTC](https://discuss.elastic.co/t/apm-java-agent-security-update/289627 "2021-11-18T17:41:52Z")
APM Java Agent Local Privilege Escalation issue (ESA-2021-29) A local privilege escalation issue was found with the APM Java agent, where a user on the system could attach a malicious file to an application running with… --- ## [Create an error log with an ingest pipeline when there is an indexing error](https://discuss.elastic.co/t/create-an-error-log-with-an-ingest-pipeline-when-there-is-an-indexing-error/291069)
**Author:** [@GinkoLucas](https://discuss.elastic.co/u/GinkoLucas)\ **Replies:** 6\ **Last updated:** [December 8, 2021, 3:12pm UTC](https://discuss.elastic.co/t/create-an-error-log-with-an-ingest-pipeline-when-there-is-an-indexing-error/291069 "2021-12-08T15:12:48Z")
Hi, I would like to create an error log when a document is not suitable for my mapping. For example if I send a document containing an unknown field in my mapping (dynamic:false), I would like to be able to create an e… --- ## [Partial Legacy Monitoring](https://discuss.elastic.co/t/partial-legacy-monitoring/290967)
**Author:** [@gimpastic](https://discuss.elastic.co/u/gimpastic)\ **Replies:** 1\ **Last updated:** [December 8, 2021, 2:56pm UTC](https://discuss.elastic.co/t/partial-legacy-monitoring/290967 "2021-12-08T14:56:42Z")
I'm getting the notification window "Partial Legacy Monitoring " each time when I open https://kibana.x.com/app/monitoring I'm using metricbeats\\filebeats to monitor the stack Partial Legacy Monitoring Detected It app… --- ## [Event.dataset: login not present](https://discuss.elastic.co/t/event-dataset-login-not-present/291232)
**Author:** [@sadux](https://discuss.elastic.co/u/sadux)\ **Replies:** 0\ **Last updated:** [December 8, 2021, 2:50pm UTC](https://discuss.elastic.co/t/event-dataset-login-not-present/291232 "2021-12-08T14:50:19Z")
Hello! Just install Elaticsearch & Kibana & Auditbeat (Ubuntu Server 20.04). Also install auditbeat dashboard. But \[Auditbeat System\] Login Dashboard ECS is empty. I want to see user login count. Some browsing bring me t… --- ## [Can't put http\_endpoint messages to root](https://discuss.elastic.co/t/cant-put-http-endpoint-messages-to-root/290527)
**Author:** [@uhfath](https://discuss.elastic.co/u/uhfath)\ **Replies:** 5\ **Last updated:** [December 8, 2021, 2:38pm UTC](https://discuss.elastic.co/t/cant-put-http-endpoint-messages-to-root/290527 "2021-12-08T14:38:41Z")
Here is my config: filebeat.inputs: - type: http\_endpoint enabled: true listen\_address: 127.0.0.1 listen\_port: 20000 response\_code: 204 response\_body: null prefix: null fields: app\_name: "MedService.UI… --- ## [URGENT! Elastic search: Unable to perform jdbc query because of Exception when executing JDBC query](https://discuss.elastic.co/t/urgent-elastic-search-unable-to-perform-jdbc-query-because-of-exception-when-executing-jdbc-query/291181)
**Author:** [@Leo\_Baby\_Jacob](https://discuss.elastic.co/u/Leo_Baby_Jacob)\ **Replies:** 1\ **Last updated:** [December 8, 2021, 2:27pm UTC](https://discuss.elastic.co/t/urgent-elastic-search-unable-to-perform-jdbc-query-because-of-exception-when-executing-jdbc-query/291181 "2021-12-08T14:27:24Z")
I have a sample logstash conf file, However when I. run it I can see a logstash error caused Error is \[371de1f7cad8c35c02e4a3047ec831da42b9b5048183b45a3916162ab248f3f7\] Exception when executing JDBC query {:excepti… --- ## [ES Hadoop push down aggregations or not?](https://discuss.elastic.co/t/es-hadoop-push-down-aggregations-or-not/277514)
**Author:** [@priamai](https://discuss.elastic.co/u/priamai)\ **Replies:** 1\ **Last updated:** [December 8, 2021, 2:09pm UTC](https://discuss.elastic.co/t/es-hadoop-push-down-aggregations-or-not/277514 "2021-12-08T14:09:10Z")
I am on ELK 7.13.0 and I have a super very slow query: events\_df = es\_reader.load("priam\_unified\_host-{0}/unified-host".format(date)) counts\_df = events\_df.where('EventID == 4688').groupBy(col("LogHost"),col("ProcessNa… --- ## [Logs Do Not Appear In APM, Although Correlation Info Is Present](https://discuss.elastic.co/t/logs-do-not-appear-in-apm-although-correlation-info-is-present/289720)
**Author:** [@Brandon\_Liles](https://discuss.elastic.co/u/Brandon_Liles)\ **Replies:** 13\ **Last updated:** [December 8, 2021, 1:55pm UTC](https://discuss.elastic.co/t/logs-do-not-appear-in-apm-although-correlation-info-is-present/289720 "2021-12-08T13:55:14Z")
Using version 7.15.2 of Elasticsearch, Kibana and APM. I have APM configured and can see transactions/traces. I have Serilog configured with the Elasticsearch sink and I am using the EcsTextFormatter. When I go to Logs \>… --- ## [Elastic Agents, ECK, and Kubernetes namespaces](https://discuss.elastic.co/t/elastic-agents-eck-and-kubernetes-namespaces/291218)
**Author:** [@nuvarov](https://discuss.elastic.co/u/nuvarov)\ **Replies:** 0\ **Last updated:** [December 8, 2021, 1:04pm UTC](https://discuss.elastic.co/t/elastic-agents-eck-and-kubernetes-namespaces/291218 "2021-12-08T13:04:52Z")
I'm setting up elastic stack on our kubernetes cluster using ECK. One of the ideas is to make sure teams have access to the logs and metrics of workloads only from their kubernetes namespace. This seem to map to the nam… --- ## [Logstash Cannot Listen Port 5044 after fresh install](https://discuss.elastic.co/t/logstash-cannot-listen-port-5044-after-fresh-install/291191)
**Author:** [@bropid](https://discuss.elastic.co/u/bropid)\ **Replies:** 2\ **Last updated:** [December 8, 2021, 12:33pm UTC](https://discuss.elastic.co/t/logstash-cannot-listen-port-5044-after-fresh-install/291191 "2021-12-08T12:33:23Z")
Hi, i'am freshly installed logstash but when i'm try to test connect with telnet \ 5044 it says connection refused. Then when i check my network in logstash machine with netstat -plntu | grep 5044 it did… --- ## [Unable to deploy Logstash .. " Unable to configure plugins: Cannot evaluate \`${ELASTIC\_CERTIFICATE}\`. Replacement variable \`ELASTIC\_CERTIFICATE\` is not defined in a Logstash secret store or an environment entry and there is no default value given."](https://discuss.elastic.co/t/unable-to-deploy-logstash-unable-to-configure-plugins-cannot-evaluate-elastic-certificate-replacement-variable-elastic-certificate-is-not-defined-in-a-logstash-secret-store-or-an-environment-entry-and-there-is-no-default-value-given/291216)
**Author:** [@vishnu\_rao](https://discuss.elastic.co/u/vishnu_rao)\ **Replies:** 0\ **Last updated:** [December 8, 2021, 12:29pm UTC](https://discuss.elastic.co/t/unable-to-deploy-logstash-unable-to-configure-plugins-cannot-evaluate-elastic-certificate-replacement-variable-elastic-certificate-is-not-defined-in-a-logstash-secret-store-or-an-environment-entry-and-there-is-no-default-value-given/291216 "2021-12-08T12:29:15Z")
Hello All I am trying to deploy logstash in our environment and I am seeing below error . I have created the secret with the Elastic Certificate ( .cer ) file .. but sill I am seeing the below error. Using bundled JD… --- ## [Filebeat add\_fields processor](https://discuss.elastic.co/t/filebeat-add-fields-processor/290990)
**Author:** [@fgjensen](https://discuss.elastic.co/u/fgjensen)\ **Replies:** 4\ **Last updated:** [December 8, 2021, 12:29pm UTC](https://discuss.elastic.co/t/filebeat-add-fields-processor/290990 "2021-12-08T12:29:04Z")
Hello colleagues; I am trying to add an ECS event.dataset with the add\_fields processor similar to several of the Filebeat modules e.g., the Apache module which add the event datasets apache.access and apache.error. I … --- ## [How to removes master-eligible nodes from elasticsearch cluster when master is not discovered](https://discuss.elastic.co/t/how-to-removes-master-eligible-nodes-from-elasticsearch-cluster-when-master-is-not-discovered/291210)
**Author:** [@Zeeshan\_Alam](https://discuss.elastic.co/u/Zeeshan_Alam)\ **Replies:** 1\ **Last updated:** [December 8, 2021, 11:34am UTC](https://discuss.elastic.co/t/how-to-removes-master-eligible-nodes-from-elasticsearch-cluster-when-master-is-not-discovered/291210 "2021-12-08T11:34:46Z")
I have an Elasticsearch cluster with three master nodes. Two of my master nodes VM's got corrupted so I am trying to remove them so that I can add newly created master node but I am unable to do so using the Voting confi… --- ## [Question about permission for file input \[Linux\]](https://discuss.elastic.co/t/question-about-permission-for-file-input-linux/291108)
**Author:** [@Fosco](https://discuss.elastic.co/u/Fosco)\ **Replies:** 4\ **Last updated:** [December 8, 2021, 11:20am UTC](https://discuss.elastic.co/t/question-about-permission-for-file-input-linux/291108 "2021-12-08T11:20:04Z")
Hi, I have some scripts which download files and need to be read and deleted by logstash afterwards Regarding the permission, the files must be logstash:logstash or only the folder containing the files? Thanks ! --- ## [Elasticsearch Watcher scheduler](https://discuss.elastic.co/t/elasticsearch-watcher-scheduler/291135)
**Author:** [@Bigbad](https://discuss.elastic.co/u/Bigbad)\ **Replies:** 2\ **Last updated:** [December 8, 2021, 11:13am UTC](https://discuss.elastic.co/t/elasticsearch-watcher-scheduler/291135 "2021-12-08T11:13:17Z")
Hello, Is it possible to configure watcher for business days and hours I have have watcher and I want it to run every 30mn from monday to friday and from 7h to 19h. The next expression don't work "cron":"\*/30 7-19 \* … --- ## [Multiple inputs to multiple indices](https://discuss.elastic.co/t/multiple-inputs-to-multiple-indices/290171)
**Author:** [@Katgust](https://discuss.elastic.co/u/Katgust)\ **Replies:** 3\ **Last updated:** [December 8, 2021, 10:37am UTC](https://discuss.elastic.co/t/multiple-inputs-to-multiple-indices/290171 "2021-12-08T10:37:17Z")
Hi! I'm new to the Elastic stack but have tried to learn to use it the last couple of weeks. I have Elasticsearch and Kibana running (I can at least use the DevTools) and I'm using Logstash to retrieve data from an MSSQ… --- ## [User session duration calculation](https://discuss.elastic.co/t/user-session-duration-calculation/290993)
**Author:** [@ramous-tun](https://discuss.elastic.co/u/ramous-tun)\ **Replies:** 2\ **Last updated:** [December 8, 2021, 10:20am UTC](https://discuss.elastic.co/t/user-session-duration-calculation/290993 "2021-12-08T10:20:46Z")
Hi, I'm trying to get user session duration by day for the last 30 days from windows logs, so I used Transform but something wrong in my script, I always get duration for all period recorded: from the first login to the… --- ## [Click on metric visualisation to filter](https://discuss.elastic.co/t/click-on-metric-visualisation-to-filter/291142)
**Author:** [@lisajb](https://discuss.elastic.co/u/lisajb)\ **Replies:** 2\ **Last updated:** [December 8, 2021, 10:19am UTC](https://discuss.elastic.co/t/click-on-metric-visualisation-to-filter/291142 "2021-12-08T10:19:58Z")
Hi all, very basic question but want to check I'm not going mad here - When using a dashboard to monitor logs, most types of visualisation can be clicked to set up a filter, filtering to just the part of the visualisati… --- ## [Defying synonyms for roman numbers doesn't seem to work](https://discuss.elastic.co/t/defying-synonyms-for-roman-numbers-doesnt-seem-to-work/291126)
**Author:** [@eliezra236](https://discuss.elastic.co/u/eliezra236)\ **Replies:** 2\ **Last updated:** [December 8, 2021, 10:18am UTC](https://discuss.elastic.co/t/defying-synonyms-for-roman-numbers-doesnt-seem-to-work/291126 "2021-12-08T10:18:09Z")
Hi, I've been trying to set up roman numbers synonyms the following way: PUT testing\_index { "settings": { "analysis": { "analyzer": { "my\_custome\_analyzer": { "type": "custom", … [Previous page](https://discuss.elastic.co/latest.md?page=1355) [Next page](https://discuss.elastic.co/latest.md?page=1357)