# Latest **URL:** https://discuss.elastic.co/latest.md?page=1359 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1360 --- ## [Monitor Tags in Uptime not working correctly](https://discuss.elastic.co/t/monitor-tags-in-uptime-not-working-correctly/290742)
**Author:** [@dabo](https://discuss.elastic.co/u/dabo)\ **Replies:** 7\ **Last updated:** [December 7, 2021, 9:45am UTC](https://discuss.elastic.co/t/monitor-tags-in-uptime-not-working-correctly/290742 "2021-12-07T09:45:23Z")
Hello, We are on 7.13. and there is an issue with monitor tags in Uptime. Not all tags are shown when we expand the Tag filter (missing like 10-15 tags) If we search (in the Tag's search box) for a tag, missing tags w… --- ## [How to Build a Role with Java API for indices privileges](https://discuss.elastic.co/t/how-to-build-a-role-with-java-api-for-indices-privileges/290974)
**Author:** [@David\_Sheard](https://discuss.elastic.co/u/David_Sheard)\ **Replies:** 5\ **Last updated:** [December 7, 2021, 9:43am UTC](https://discuss.elastic.co/t/how-to-build-a-role-with-java-api-for-indices-privileges/290974 "2021-12-07T09:43:00Z")
Hi, I'm trying tp create an Indices Role using the Java API. Such as below: Role role = Role.builder() .name("testPutRole") .indicesPrivileges(???) .build(); The example in the doco shows it for a… --- ## [O365 module access through proxy](https://discuss.elastic.co/t/o365-module-access-through-proxy/291107)
**Author:** [@sadieshsanjivi](https://discuss.elastic.co/u/sadieshsanjivi)\ **Replies:** 0\ **Last updated:** [December 7, 2021, 9:40am UTC](https://discuss.elastic.co/t/o365-module-access-through-proxy/291107 "2021-12-07T09:40:13Z")
Hi all I have a problems with using the o365 module in filebeat. In our network in order to reach internet we need to go through a proxy server, and it is because of that the filebeat module cannot connect to the o365 … --- ## [About QueryContainerDescriptor function](https://discuss.elastic.co/t/about-querycontainerdescriptor-function/291103)
**Author:** [@Suki\_Yua](https://discuss.elastic.co/u/Suki_Yua)\ **Replies:** 0\ **Last updated:** [December 7, 2021, 9:22am UTC](https://discuss.elastic.co/t/about-querycontainerdescriptor-function/291103 "2021-12-07T09:22:42Z")
Hi I have a search document as below { "total": 1, "results": \[ { "id": 1346282, "studentname": "Casey", "studentnumber" :"YT2021" "favourbooks": \[ { "id": 1, … --- ## [Docker.network\_summary does not take hostfs into account](https://discuss.elastic.co/t/docker-network-summary-does-not-take-hostfs-into-account/290677)
**Author:** [@Julero](https://discuss.elastic.co/u/Julero)\ **Replies:** 3\ **Last updated:** [December 7, 2021, 9:22am UTC](https://discuss.elastic.co/t/docker-network-summary-does-not-take-hostfs-into-account/290677 "2021-12-07T09:22:32Z")
When using docker.network\_summary, I have the following error: 2021-12-01T13:56:00.159Z INFO module/wrapper.go:266 Error fetching data for metricset docker.network\_summary: error fetching namespace for PID 4… --- ## [Logstash service stopped without any specific error](https://discuss.elastic.co/t/logstash-service-stopped-without-any-specific-error/290504)
**Author:** [@alfianaf](https://discuss.elastic.co/u/alfianaf)\ **Replies:** 15\ **Last updated:** [December 7, 2021, 9:03am UTC](https://discuss.elastic.co/t/logstash-service-stopped-without-any-specific-error/290504 "2021-12-07T09:03:23Z")
Hello, I've been handling logstash this week, and the service always turned off at night (around 8pm-10pm), so I enabled the debug log, and I can't find any error log that lead to the stopped service here's the last log… --- ## [How to include some values and exclude some others on the same field?](https://discuss.elastic.co/t/how-to-include-some-values-and-exclude-some-others-on-the-same-field/291020)
**Author:** [@Huseyin\_Tunctepe](https://discuss.elastic.co/u/Huseyin_Tunctepe)\ **Replies:** 4\ **Last updated:** [December 7, 2021, 8:10am UTC](https://discuss.elastic.co/t/how-to-include-some-values-and-exclude-some-others-on-the-same-field/291020 "2021-12-07T08:10:36Z")
I have written a Lucene query and a KQL to show "puppet-disabled" and exclude values that contain "CHG", "INC" and "EXC" in the message field. However, all returned results include "puppet-disabled" text and the supposed… --- ## [Dec 7th, 2021: \[en\] Seven tricks to building fast, reliable search data integrations](https://discuss.elastic.co/t/dec-7th-2021-en-seven-tricks-to-building-fast-reliable-search-data-integrations/289184)
**Author:** [@Jessica\_Taylor](https://discuss.elastic.co/u/Jessica_Taylor)\ **Replies:** 0\ **Last updated:** [December 7, 2021, 8:00am UTC](https://discuss.elastic.co/t/dec-7th-2021-en-seven-tricks-to-building-fast-reliable-search-data-integrations/289184 "2021-12-07T08:00:57Z")
Building fast, reliable search data integrations can make or break search experiences. Why? Because developers, like you, have high aspirations for search experiences. And end-users have high expectations for the results… --- ## [Junit test for High level rest client query](https://discuss.elastic.co/t/junit-test-for-high-level-rest-client-query/291099)
**Author:** [@111505](https://discuss.elastic.co/u/111505)\ **Replies:** 0\ **Last updated:** [December 7, 2021, 7:58am UTC](https://discuss.elastic.co/t/junit-test-for-high-level-rest-client-query/291099 "2021-12-07T07:58:56Z")
Hello. I want to test Elasticsearch query in java Junit. It seems to be possible to use a test container, but the Elasticsearch documentation does not seem to provide it officially. doc: https://www.elastic.co/guide/e… --- ## [rubyフィルターでのHashの扱いについて](https://discuss.elastic.co/t/ruby-hash/291005)
**Author:** [@t-nakata](https://discuss.elastic.co/u/t-nakata)\ **Replies:** 2\ **Last updated:** [December 7, 2021, 7:34am UTC](https://discuss.elastic.co/t/ruby-hash/291005 "2021-12-07T07:34:45Z")
logstashのrubyフィルターを使用しています。 ■inputデータ { "Records": \[ { "eventVersion": "1.03", "userIdentity": { "type": "Root", "principalId": "123456789012", "arn": "arn:aws:iam::123456789012:root", "account… --- ## [Does filebeat re-read the same .log file in a different directory?](https://discuss.elastic.co/t/does-filebeat-re-read-the-same-log-file-in-a-different-directory/290953)
**Author:** [@OAHstasy](https://discuss.elastic.co/u/OAHstasy)\ **Replies:** 2\ **Last updated:** [December 7, 2021, 7:06am UTC](https://discuss.elastic.co/t/does-filebeat-re-read-the-same-log-file-in-a-different-directory/290953 "2021-12-07T07:06:23Z")
Filebeat version: 7.15 OS: Windows 10 Hello everyone, Let me give you people a short description about my situtation: I configured my filebeat to read all .log files in "\\path\_to\_logs\\logs\\ \* \\ \*.log." My program tha… --- ## [Elasticsearch rescore plugin how to get query object from context?](https://discuss.elastic.co/t/elasticsearch-rescore-plugin-how-to-get-query-object-from-context/291094)
**Author:** [@oni7uka](https://discuss.elastic.co/u/oni7uka)\ **Replies:** 0\ **Last updated:** [December 7, 2021, 6:44am UTC](https://discuss.elastic.co/t/elasticsearch-rescore-plugin-how-to-get-query-object-from-context/291094 "2021-12-07T06:44:32Z")
I want to write a custom Elasticsearch rescore plugin, Similar to using Levenshtein algorithm to calculate the similarity between the original query string and the query result. But how do I get the query object? It seem… --- ## [Single word suggester or autocomplete single word](https://discuss.elastic.co/t/single-word-suggester-or-autocomplete-single-word/290754)
**Author:** [@pranjali\_dhumal](https://discuss.elastic.co/u/pranjali_dhumal)\ **Replies:** 8\ **Last updated:** [December 7, 2021, 6:27am UTC](https://discuss.elastic.co/t/single-word-suggester-or-autocomplete-single-word/290754 "2021-12-07T06:27:20Z")
Hello Everyone, Problem: Lets consider I have a index for books And I have following book documents with name "Manage your time" "Improvement management skills" "The making of manager" "How to manage people" "Man… --- ## [Saas hosting of AppSearch in AWS Gov Cloud](https://discuss.elastic.co/t/saas-hosting-of-appsearch-in-aws-gov-cloud/290752)
**Author:** [@Balaji\_Sudharsanam](https://discuss.elastic.co/u/Balaji_Sudharsanam)\ **Replies:** 2\ **Last updated:** [December 7, 2021, 5:59am UTC](https://discuss.elastic.co/t/saas-hosting-of-appsearch-in-aws-gov-cloud/290752 "2021-12-07T05:59:34Z")
Do we have the option to do SaaS based hosting of AppSearch in AWS Gov Cloud? Please help me with the documentations / links regarding that. --- ## [Pipeline/output.go:154 Failed to connect to backoff](https://discuss.elastic.co/t/pipeline-output-go-154-failed-to-connect-to-backoff/290767)
**Author:** [@abhi.logs](https://discuss.elastic.co/u/abhi.logs)\ **Replies:** 10\ **Last updated:** [December 7, 2021, 5:03am UTC](https://discuss.elastic.co/t/pipeline-output-go-154-failed-to-connect-to-backoff/290767 "2021-12-07T05:03:31Z")
Hello, I'm getting this error, does anyone knows how to solve this? ERROR \[publisher\_pipeline\_output\] pipeline/output.go:154 Failed to connect to backoff(elasticsearch(https://xxxxxx:9200)): Connection marked as failed… --- ## [Request without field - Case insensitive mystery](https://discuss.elastic.co/t/request-without-field-case-insensitive-mystery/290852)
**Author:** [@Florent\_Fauvin](https://discuss.elastic.co/u/Florent_Fauvin)\ **Replies:** 2\ **Last updated:** [December 7, 2021, 4:08am UTC](https://discuss.elastic.co/t/request-without-field-case-insensitive-mystery/290852 "2021-12-07T04:08:33Z")
Hello ! I have a mystery I can't explain. Request : process.name:calc.exe \> 9 hits Request : process.name:CALC.exe \> 0 hits Request : CALC.exe (just it) \> 11 hits (included the 9 previous hits ) When I do a request w… --- ## [Grok parsing in logstash for Windows DNS Debug Log](https://discuss.elastic.co/t/grok-parsing-in-logstash-for-windows-dns-debug-log/291085)
**Author:** [@craign30](https://discuss.elastic.co/u/craign30)\ **Replies:** 11\ **Last updated:** [December 7, 2021, 3:53am UTC](https://discuss.elastic.co/t/grok-parsing-in-logstash-for-windows-dns-debug-log/291085 "2021-12-07T03:53:17Z")
I'm using grok in Logstash (7.8.0) to parse data from a Windows Server (2019) DNS debug log (sent via filebeat) using the statement below. Most of the time, the data gets parsed correctly and fields are populated and vi… --- ## [Search\_phase\_execution\_error with script\_Score n cosine similarity ES 7.15.2](https://discuss.elastic.co/t/search-phase-execution-error-with-script-score-n-cosine-similarity-es-7-15-2/291068)
**Author:** [@Nikkie](https://discuss.elastic.co/u/Nikkie)\ **Replies:** 0\ **Last updated:** [December 6, 2021, 3:53pm UTC](https://discuss.elastic.co/t/search-phase-execution-error-with-script-score-n-cosine-similarity-es-7-15-2/291068 "2021-12-06T15:53:11Z")
Greetings! I had started with my Elasticsearch journey with 7.10.1 and could successfully run script\_score queries with cosine\_similarity earlier. But now when I am using 7.15 I get stuck with this error "Elasticsearch.e… --- ## [A question on throttling the alerts](https://discuss.elastic.co/t/a-question-on-throttling-the-alerts/288833)
**Author:** [@pk.241011](https://discuss.elastic.co/u/pk.241011)\ **Replies:** 3\ **Last updated:** [December 6, 2021, 11:51pm UTC](https://discuss.elastic.co/t/a-question-on-throttling-the-alerts/288833 "2021-12-06T23:51:20Z")
Hi, Right now I have an alert configured which triggers every 5 mins. However it monitors if an error of a particular type has occured over last 24 hours. It sends emails and in ideal case the throttle period will be 2… --- ## [Zendesk to elastic](https://discuss.elastic.co/t/zendesk-to-elastic/291026)
**Author:** [@travlest](https://discuss.elastic.co/u/travlest)\ **Replies:** 1\ **Last updated:** [December 6, 2021, 9:59pm UTC](https://discuss.elastic.co/t/zendesk-to-elastic/291026 "2021-12-06T21:59:17Z")
Hi, is there any documentation on how to send data from zendesk to elastic? what I mean is, I want to display every ticket that has been closed/open from zendesk into kibana. thank you --- ## [Fast copy indexes between two deployments](https://discuss.elastic.co/t/fast-copy-indexes-between-two-deployments/291051)
**Author:** [@INS](https://discuss.elastic.co/u/INS)\ **Replies:** 1\ **Last updated:** [December 6, 2021, 9:58pm UTC](https://discuss.elastic.co/t/fast-copy-indexes-between-two-deployments/291051 "2021-12-06T21:58:22Z")
Hi I've tried to copy in the fast way indexes (of count 25 per ~40GB each of them) I see that copy it over elasticdump it goes too very slow. How can I increase performance??? another thing is how to use a wildcard f… --- ## [Elastic access via PHP](https://discuss.elastic.co/t/elastic-access-via-php/291083)
**Author:** [@Franke2u](https://discuss.elastic.co/u/Franke2u)\ **Replies:** 0\ **Last updated:** [December 6, 2021, 8:53pm UTC](https://discuss.elastic.co/t/elastic-access-via-php/291083 "2021-12-06T20:53:38Z")
Using PHP I can search and find data using the below command: $obj = $client-\>search($params); I add data using Logstash. But unable to use other commands like get and update: $obj = $client-\>get($params2); $obj = $… --- ## [Not able to login into the Kibana](https://discuss.elastic.co/t/not-able-to-login-into-the-kibana/291014)
**Author:** [@wizard](https://discuss.elastic.co/u/wizard)\ **Replies:** 4\ **Last updated:** [December 6, 2021, 8:46pm UTC](https://discuss.elastic.co/t/not-able-to-login-into-the-kibana/291014 "2021-12-06T20:46:23Z")
Hello, When I am trying to login into the kibana, it's sending me an error "Oops! Error. Try again.". I have checked my storage also it's only 92% in use. Please suggest me. --- ## [Search\_after performance compared to querying with \_search](https://discuss.elastic.co/t/search-after-performance-compared-to-querying-with-search/291080)
**Author:** [@Praveen\_Balaji](https://discuss.elastic.co/u/Praveen_Balaji)\ **Replies:** 0\ **Last updated:** [December 6, 2021, 8:24pm UTC](https://discuss.elastic.co/t/search-after-performance-compared-to-querying-with-search/291080 "2021-12-06T20:24:39Z")
Our code switches over to search\_after past a threshold (10\_000). I'm considering switching to using search\_after always, irrespective of the size. Is there a loss in performance between plain search and search\_after? P… --- ## [Error on index template creation: "composable template \[...\] template after composition is invalid"](https://discuss.elastic.co/t/error-on-index-template-creation-composable-template-template-after-composition-is-invalid/291076)
**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Replies:** 1\ **Last updated:** [December 6, 2021, 8:07pm UTC](https://discuss.elastic.co/t/error-on-index-template-creation-composable-template-template-after-composition-is-invalid/291076 "2021-12-06T20:07:57Z")
Subject really says it all. version 7.14 The cluster is new and has just one node for testing and this is the first datastream I have tried to create. One thing that is puzzling me is what does it mean by "composable … --- ## [Integration: security\_detection\_engine-1](https://discuss.elastic.co/t/integration-security-detection-engine-1/291053)
**Author:** [@lamp123432](https://discuss.elastic.co/u/lamp123432)\ **Replies:** 5\ **Last updated:** [December 6, 2021, 8:02pm UTC](https://discuss.elastic.co/t/integration-security-detection-engine-1/291053 "2021-12-06T20:02:45Z")
Is this needed? Elastic Endpoint seems to be working great without it, so I'm wondering why it's there and why should I assign is as an integration to my agents? --- ## [Syslog filter issue with timestamp](https://discuss.elastic.co/t/syslog-filter-issue-with-timestamp/290468)
**Author:** [@mylvestre](https://discuss.elastic.co/u/mylvestre)\ **Replies:** 12\ **Last updated:** [December 6, 2021, 6:54pm UTC](https://discuss.elastic.co/t/syslog-filter-issue-with-timestamp/290468 "2021-12-06T18:54:22Z")
Greetings, I'm having an issue where my syslog is parsing the wrong date format. I get the following in Elastic: yyyy-11-Mo 11:37:17, while I get the following error in logstash: \[2021-11-29T11:34:43,644\]\[WARN \]\[logsta… --- ## [Filter basic file with Logstash](https://discuss.elastic.co/t/filter-basic-file-with-logstash/290991)
**Author:** [@algira37](https://discuss.elastic.co/u/algira37)\ **Replies:** 3\ **Last updated:** [December 6, 2021, 6:21pm UTC](https://discuss.elastic.co/t/filter-basic-file-with-logstash/290991 "2021-12-06T18:21:16Z")
Hello, I have a blocklist.txt which contains IP address in the following structure: 192.168.100.77 192.168.100.66 How can I create JSON with Logstash with a similar output: { IP: 192.168.100.77, IP: 192.168.100.66 … --- ## [org.elasticsearch.ElasticsearchStatusException: Unable to parse response body](https://discuss.elastic.co/t/org-elasticsearch-elasticsearchstatusexception-unable-to-parse-response-body/291075)
**Author:** [@ksmamta](https://discuss.elastic.co/u/ksmamta)\ **Replies:** 0\ **Last updated:** [December 6, 2021, 6:07pm UTC](https://discuss.elastic.co/t/org-elasticsearch-elasticsearchstatusexception-unable-to-parse-response-body/291075 "2021-12-06T18:07:02Z")
Hi, Facing the below error quite frequently with Rest High level client. version of rest client and Elasticsearch jar is 7.3.2 and ES cluster version is 7.5.2. Any clue to find the root cause? why this error comes? o… --- ## [Day of the week with non UTC timestamps](https://discuss.elastic.co/t/day-of-the-week-with-non-utc-timestamps/291066)
**Author:** [@Malec](https://discuss.elastic.co/u/Malec)\ **Replies:** 1\ **Last updated:** [December 6, 2021, 5:51pm UTC](https://discuss.elastic.co/t/day-of-the-week-with-non-utc-timestamps/291066 "2021-12-06T17:51:46Z")
Hi everyone, I have logs in a dd/MM/YYYY HH:mm:ss format using the CET timezone, and I am trying to extract the Day of the week for CET and not UTC. We used this at first date { match =\> \[ "date", "dd/MM/YYYY HH:mm:… [Previous page](https://discuss.elastic.co/latest.md?page=1358) [Next page](https://discuss.elastic.co/latest.md?page=1360)