# Latest **URL:** https://discuss.elastic.co/latest.md?page=1377 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1378 --- ## [Elastic Agent, single custom log to multiple indices via ingest pipeline](https://discuss.elastic.co/t/elastic-agent-single-custom-log-to-multiple-indices-via-ingest-pipeline/290002)
**Author:** [@rappersdelight](https://discuss.elastic.co/u/rappersdelight)\ **Replies:** 6\ **Last updated:** [November 24, 2021, 3:06am UTC](https://discuss.elastic.co/t/elastic-agent-single-custom-log-to-multiple-indices-via-ingest-pipeline/290002 "2021-11-24T03:06:13Z")
I am using elastic agent to capture the custom log from a pihole server, but I would like to split out the dns logs and the dhcp logs that are both found in pihole.log into different indexes. Things are working well, pr… --- ## [Modify sourcecode to achieve dashboard only mode](https://discuss.elastic.co/t/modify-sourcecode-to-achieve-dashboard-only-mode/289936)
**Author:** [@laigood](https://discuss.elastic.co/u/laigood)\ **Replies:** 5\ **Last updated:** [November 24, 2021, 1:52am UTC](https://discuss.elastic.co/t/modify-sourcecode-to-achieve-dashboard-only-mode/289936 "2021-11-24T01:52:14Z")
I have an unsecurity es cluster，and i deploy a normal kibana for daily mangement and analysis data.then i want to deploy another kibana to achieve dashboard only mode,i want to modify source code to cut out other functio… --- ## [Index rollover and hot to warm node move](https://discuss.elastic.co/t/index-rollover-and-hot-to-warm-node-move/289982)
**Author:** [@keiransteele](https://discuss.elastic.co/u/keiransteele)\ **Replies:** 1\ **Last updated:** [November 24, 2021, 1:44am UTC](https://discuss.elastic.co/t/index-rollover-and-hot-to-warm-node-move/289982 "2021-11-24T01:44:05Z")
I'm trying to understand how ILM works with the default 50GB/30days policy if I also want to move indicies longer than 7 days to warm nodes and it takes longer than 7 days to fill an index. Should I actually be making th… --- ## [Is possible to listen index changes?](https://discuss.elastic.co/t/is-possible-to-listen-index-changes/289988)
**Author:** [@thewasta](https://discuss.elastic.co/u/thewasta)\ **Replies:** 2\ **Last updated:** [November 24, 2021, 1:25am UTC](https://discuss.elastic.co/t/is-possible-to-listen-index-changes/289988 "2021-11-24T01:25:31Z")
I need to 'listen' for changes on my index, at first I started by writing a script in nodejs which is executed every 5min. For now I think it works... But can I do it in realtime? When a new document is insert or update. … --- ## [Port number ECS field data type](https://discuss.elastic.co/t/port-number-ecs-field-data-type/289992)
**Author:** [@groth](https://discuss.elastic.co/u/groth)\ **Replies:** 2\ **Last updated:** [November 23, 2021, 11:42pm UTC](https://discuss.elastic.co/t/port-number-ecs-field-data-type/289992 "2021-11-23T23:42:38Z")
Can someone please explain to me why port number ECS fields like source.port, destination.port, etc. are defined as numerical type long? When would port numbers from logs ever need to be used in any kind of mathematical … --- ## [Fleet Server and Elastic Agents not working when adding nodeSelectors](https://discuss.elastic.co/t/fleet-server-and-elastic-agents-not-working-when-adding-nodeselectors/289996)
**Author:** [@GerardoManzo](https://discuss.elastic.co/u/GerardoManzo)\ **Replies:** 0\ **Last updated:** [November 23, 2021, 11:18pm UTC](https://discuss.elastic.co/t/fleet-server-and-elastic-agents-not-working-when-adding-nodeselectors/289996 "2021-11-23T23:18:34Z")
Hi, I'm trying to setup a cluster using the ECK operator 1.8.0 and a GKE cluster with dedicated node pools: 1 node pool for Elasticsearch masters in europe-west1-b 1 node pool in europe-west1-b and in europe-west1-d fo… --- ## [Full text search on both Parent and Child](https://discuss.elastic.co/t/full-text-search-on-both-parent-and-child/289990)
**Author:** [@annasunny](https://discuss.elastic.co/u/annasunny)\ **Replies:** 0\ **Last updated:** [November 23, 2021, 10:20pm UTC](https://discuss.elastic.co/t/full-text-search-on-both-parent-and-child/289990 "2021-11-23T22:20:14Z")
Hi, I'm looking for a query ( or multiple queries) to do a full text search on both Parent and Child. Thank you in advance! I'm using the parent-child type. For example, my Parent documents will be a Choice, and its s… --- ## [Run logstash on windows -\>\> errors](https://discuss.elastic.co/t/run-logstash-on-windows-errors/289987)
**Author:** [@INS](https://discuss.elastic.co/u/INS)\ **Replies:** 2\ **Last updated:** [November 23, 2021, 9:39pm UTC](https://discuss.elastic.co/t/run-logstash-on-windows-errors/289987 "2021-11-23T21:39:53Z")
Hi I need to check the performance one of my logstash conf. Therefore I've decided to install logstash on windows the new one instance as standalone. After that I've set the variable env. At least I got the error. BTW. … --- ## [Wildcard search in field doesn't work as expected](https://discuss.elastic.co/t/wildcard-search-in-field-doesnt-work-as-expected/289365)
**Author:** [@lchan](https://discuss.elastic.co/u/lchan)\ **Replies:** 2\ **Last updated:** [November 23, 2021, 9:14pm UTC](https://discuss.elastic.co/t/wildcard-search-in-field-doesnt-work-as-expected/289365 "2021-11-23T21:14:42Z")
Hi all, I am on 7.13.1 on ElasticCloud. I mapped hostname via Logstash with syslog but for some reason the KQL search doesn't come out right. What am I doing wrong? search: hostname: cr1-ams1 Result: cr1-ams1 cr2-… --- ## [Is it possible to log apm messages to the console?](https://discuss.elastic.co/t/is-it-possible-to-log-apm-messages-to-the-console/289857)
**Author:** [@shawnstrickland](https://discuss.elastic.co/u/shawnstrickland)\ **Replies:** 1\ **Last updated:** [November 23, 2021, 8:15pm UTC](https://discuss.elastic.co/t/is-it-possible-to-log-apm-messages-to-the-console/289857 "2021-11-23T20:15:14Z")
While evaluating APM and Elastic, we came across some possible issues: Our current solutions pipes container logs to Elasticsearch, limiting outbound calls, and persisiting 100% of all logs created. We would like to ut… --- ## [How does the new (7.14+) GeoIP Processor Work?](https://discuss.elastic.co/t/how-does-the-new-7-14-geoip-processor-work/289957)
**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Replies:** 4\ **Last updated:** [November 23, 2021, 6:00pm UTC](https://discuss.elastic.co/t/how-does-the-new-7-14-geoip-processor-work/289957 "2021-11-23T18:00:24Z")
Hi, In 7.14+ Elasticsearch enabled the GeoIP downloader and made the DB reloadable. But I was wondering how does this actually work. Looking at the docs, it seems like all this process does now is download the DB file, … --- ## [Packetbeat - full URL on HTTPS traffic?](https://discuss.elastic.co/t/packetbeat-full-url-on-https-traffic/289945)
**Author:** [@EdgeSync](https://discuss.elastic.co/u/EdgeSync)\ **Replies:** 1\ **Last updated:** [November 23, 2021, 5:20pm UTC](https://discuss.elastic.co/t/packetbeat-full-url-on-https-traffic/289945 "2021-11-23T17:20:24Z")
Is it possible to get the full URL from HTTPS traffic. I would like to be able to view the full URI that a client is attempting to access. e.g. https://myserver.com/some\_part/this\_file.exe I have packetbeat monitoring… --- ## [Elastic-Agent healthy but sends no logs](https://discuss.elastic.co/t/elastic-agent-healthy-but-sends-no-logs/289742)
**Author:** [@jobr97](https://discuss.elastic.co/u/jobr97)\ **Replies:** 2\ **Last updated:** [November 23, 2021, 5:04pm UTC](https://discuss.elastic.co/t/elastic-agent-healthy-but-sends-no-logs/289742 "2021-11-23T17:04:24Z")
Hi, Im trying to use Elastic Agent on my Windows 10 machine. I have sucessfully enrolled the machine and can see it marked as healty in the agent overview. However there is no log data delivered from the agent and also … --- ## [Complete DNS activity coverage in endpoint](https://discuss.elastic.co/t/complete-dns-activity-coverage-in-endpoint/288259)
**Author:** [@nemhods](https://discuss.elastic.co/u/nemhods)\ **Replies:** 1\ **Last updated:** [November 23, 2021, 5:00pm UTC](https://discuss.elastic.co/t/complete-dns-activity-coverage-in-endpoint/288259 "2021-11-23T17:00:16Z")
Hey, I've noticed that the rule DNS Activity to the Internet does not work with Elastic Endpoint data, even when I explicitly contact an external DNS server from my machines that are covered by Elastic Endpoint. I dug … --- ## [Kibana Field Formatting : Display Limited Decimal Points For Number Field Type](https://discuss.elastic.co/t/kibana-field-formatting-display-limited-decimal-points-for-number-field-type/289792)
**Author:** [@ankitdevnalkar](https://discuss.elastic.co/u/ankitdevnalkar)\ **Replies:** 2\ **Last updated:** [November 23, 2021, 4:30pm UTC](https://discuss.elastic.co/t/kibana-field-formatting-display-limited-decimal-points-for-number-field-type/289792 "2021-11-23T16:30:45Z")
I have a number field and I want to change the color of it. I am using Kibana field formatting. While changing color, I am unable to find a way to limit the decimal points to 5 digits. For example 2.62386 Can anyone h… --- ## [Canvas Timefilter not allowing me to select a time range](https://discuss.elastic.co/t/canvas-timefilter-not-allowing-me-to-select-a-time-range/287165)
**Author:** [@hNiven](https://discuss.elastic.co/u/hNiven)\ **Replies:** 8\ **Last updated:** [November 23, 2021, 4:05pm UTC](https://discuss.elastic.co/t/canvas-timefilter-not-allowing-me-to-select-a-time-range/287165 "2021-11-23T16:05:12Z")
Hi, This is an issue that has just happened recently and I am on v7.9.1. When I try and select a time range on my canvas workpad using the Timefilter, the dropdown with the range of values does not appear. All I can do … --- ## [Prometheus fields no longer available after enabling APM on Java process](https://discuss.elastic.co/t/prometheus-fields-no-longer-available-after-enabling-apm-on-java-process/285244)
**Author:** [@momalley](https://discuss.elastic.co/u/momalley)\ **Replies:** 7\ **Last updated:** [November 23, 2021, 4:02pm UTC](https://discuss.elastic.co/t/prometheus-fields-no-longer-available-after-enabling-apm-on-java-process/285244 "2021-11-23T16:02:38Z")
Prometheus fields no longer available after enabling APM on Java process We are using Kibana 7.10.1 APM Agent 1.24 Browser used Chrome Steps to reproduce: We have enabled APM on one of our Java processes -javaag… --- ## [Query a result set from another query](https://discuss.elastic.co/t/query-a-result-set-from-another-query/289964)
**Author:** [@antonkallenberg](https://discuss.elastic.co/u/antonkallenberg)\ **Replies:** 0\ **Last updated:** [November 23, 2021, 3:46pm UTC](https://discuss.elastic.co/t/query-a-result-set-from-another-query/289964 "2021-11-23T15:46:32Z")
Hi, Is it possible to query a result set from another query? Example List all employees by organization with ID #1 \> returns 10 employees. From those 10 employees \> List all employees working at department with ID #1 … --- ## [Unable to read two json](https://discuss.elastic.co/t/unable-to-read-two-json/289963)
**Author:** [@Fosco](https://discuss.elastic.co/u/Fosco)\ **Replies:** 0\ **Last updated:** [November 23, 2021, 3:34pm UTC](https://discuss.elastic.co/t/unable-to-read-two-json/289963 "2021-11-23T15:34:40Z")
Hello, I have a python file that is executed by logstash and which prints a json composed of two different data sources, the problem is that logstash only reads the first part. I tried to change the order and nothing cha… --- ## [Highlights not matching between annotated\_text and other fields](https://discuss.elastic.co/t/highlights-not-matching-between-annotated-text-and-other-fields/289937)
**Author:** [@evoluc](https://discuss.elastic.co/u/evoluc)\ **Replies:** 4\ **Last updated:** [November 23, 2021, 3:26pm UTC](https://discuss.elastic.co/t/highlights-not-matching-between-annotated-text-and-other-fields/289937 "2021-11-23T15:26:06Z")
Executing a query\_string search on an index the returned matched highlights sometimes don't really match (this is needed to get the annotated metadata). From what I've seen there is not much support for this kind of feat… --- ## [Groupby Unique values in Kibana KQL](https://discuss.elastic.co/t/groupby-unique-values-in-kibana-kql/289915)
**Author:** [@Hamzah](https://discuss.elastic.co/u/Hamzah)\ **Replies:** 3\ **Last updated:** [November 23, 2021, 2:33pm UTC](https://discuss.elastic.co/t/groupby-unique-values-in-kibana-kql/289915 "2021-11-23T14:33:10Z")
Hi, I was just wondering if we can use kibana KQL to groupby a certain field. Let say we applied a search in which we want to see who is trying to communicate with gooogel.com and we need to extract local IP address of … --- ## [How to use multiple inddexes in a dashboard](https://discuss.elastic.co/t/how-to-use-multiple-inddexes-in-a-dashboard/288706)
**Author:** [@nandatibco](https://discuss.elastic.co/u/nandatibco)\ **Replies:** 4\ **Last updated:** [November 23, 2021, 2:25pm UTC](https://discuss.elastic.co/t/how-to-use-multiple-inddexes-in-a-dashboard/288706 "2021-11-23T14:25:18Z")
How to configure 2 or more indexes with similar structure in a kibana dashboard? Tried with Index pattern, if the index names are not having similar naming patterns how to create an index pattern with different index na… --- ## [Unable to start elasticsearch on windows "The system cannot find the path specified."](https://discuss.elastic.co/t/unable-to-start-elasticsearch-on-windows-the-system-cannot-find-the-path-specified/289914)
**Author:** [@tahseen\_fatima](https://discuss.elastic.co/u/tahseen_fatima)\ **Replies:** 1\ **Last updated:** [November 23, 2021, 2:17pm UTC](https://discuss.elastic.co/t/unable-to-start-elasticsearch-on-windows-the-system-cannot-find-the-path-specified/289914 "2021-11-23T14:17:20Z")
Hi, Use case : I have to perform an upgrade activity in production environment. Upgrade from 7.7.1 version to 7.15.0 on windows 2016 64 bit OS. Before performing I am doing a testing in a lower environment. Where I h… --- ## [Best practices on multiple syslog sources](https://discuss.elastic.co/t/best-practices-on-multiple-syslog-sources/289951)
**Author:** [@eleong](https://discuss.elastic.co/u/eleong)\ **Replies:** 1\ **Last updated:** [November 23, 2021, 2:13pm UTC](https://discuss.elastic.co/t/best-practices-on-multiple-syslog-sources/289951 "2021-11-23T14:13:14Z")
Hi all, Just asking some expert opinions here, my main objective currently is to ingest syslogs from multiple sources (assuming there are 10 different brands and syslog streams). I understand that there are ways to add… --- ## [Syslogging Struggle - newbie alert](https://discuss.elastic.co/t/syslogging-struggle-newbie-alert/289861)
**Author:** [@Orpheus](https://discuss.elastic.co/u/Orpheus)\ **Replies:** 4\ **Last updated:** [November 23, 2021, 2:07pm UTC](https://discuss.elastic.co/t/syslogging-struggle-newbie-alert/289861 "2021-11-23T14:07:45Z")
Hi, I'm just getting familiar with Elastic Stack, and implementing ELK with Filebeat to a syslog server that receives the syslogs from various routers on a network. The routers are running RouterOS on mikrotik routers, … --- ## [Multiget (mget) API performance](https://discuss.elastic.co/t/multiget-mget-api-performance/289813)
**Author:** [@jon\_cabrera](https://discuss.elastic.co/u/jon_cabrera)\ **Replies:** 4\ **Last updated:** [November 23, 2021, 2:02pm UTC](https://discuss.elastic.co/t/multiget-mget-api-performance/289813 "2021-11-23T14:02:22Z")
Hello! I am working on a search engine and I have introduced the use of the mget API to obtain a series of documents from a series of ids. My question is related to a series of issues that I have been able to observe i… --- ## [Filebeat on RHEL not sending to Logstash from all managed servers](https://discuss.elastic.co/t/filebeat-on-rhel-not-sending-to-logstash-from-all-managed-servers/289952)
**Author:** [@MKirby](https://discuss.elastic.co/u/MKirby)\ **Replies:** 0\ **Last updated:** [November 23, 2021, 1:36pm UTC](https://discuss.elastic.co/t/filebeat-on-rhel-not-sending-to-logstash-from-all-managed-servers/289952 "2021-11-23T13:36:30Z")
Good Morning; I have an odd situation with regards to my Filebeat installation. I have it installed on all of my RHEL v.8, and out of the 5 I have it installed on, only 2 are sending the information to logstash, where … --- ## [Multiline Filebeat suppresses lines](https://discuss.elastic.co/t/multiline-filebeat-suppresses-lines/289609)
**Author:** [@Tornis](https://discuss.elastic.co/u/Tornis)\ **Replies:** 1\ **Last updated:** [November 23, 2021, 12:58pm UTC](https://discuss.elastic.co/t/multiline-filebeat-suppresses-lines/289609 "2021-11-23T12:58:10Z")
Hey guys, I have a problem in the filbeat multline that is not concatenating correctly with the defined pattern. When I look at the result using it through the output.console I see that it suppresses part of the line th… --- ## [How to send alert to zabbix](https://discuss.elastic.co/t/how-to-send-alert-to-zabbix/289928)
**Author:** [@ciment](https://discuss.elastic.co/u/ciment)\ **Replies:** 1\ **Last updated:** [November 23, 2021, 12:53pm UTC](https://discuss.elastic.co/t/how-to-send-alert-to-zabbix/289928 "2021-11-23T12:53:14Z")
Hi, I would like to send some event/alert from kibana to zabbix, when machine learning detects critical problem on my services (default APM job, ML can tag services with tag healthy,warning, critical..) What is the pr… --- ## [Synchronize Vega colors with other visualisations](https://discuss.elastic.co/t/synchronize-vega-colors-with-other-visualisations/289321)
**Author:** [@Brolantor](https://discuss.elastic.co/u/Brolantor)\ **Replies:** 1\ **Last updated:** [November 23, 2021, 12:06pm UTC](https://discuss.elastic.co/t/synchronize-vega-colors-with-other-visualisations/289321 "2021-11-23T12:06:02Z")
Hello there! I'm facing a problem with a Kibana Dashboard including a Vega Senkey visualisation (Originated from the popular blog entry Sankey Visualization with Vega in Kibana 6.2 | Elastic Blog). The dashboard also in… [Previous page](https://discuss.elastic.co/latest.md?page=1376) [Next page](https://discuss.elastic.co/latest.md?page=1378)