# Latest **URL:** https://discuss.elastic.co/latest.md?page=1394 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1395 --- ## [Attempting to Install template](https://discuss.elastic.co/t/attempting-to-install-template/288899)
**Author:** [@MKirby](https://discuss.elastic.co/u/MKirby)\ **Replies:** 1\ **Last updated:** [November 10, 2021, 6:58pm UTC](https://discuss.elastic.co/t/attempting-to-install-template/288899 "2021-11-10T18:58:54Z")
Good Morning Logstash experts. As most of you know I have been working on injesting and being able to see the syslogs that are being sent directly to my logstash server. When I run a debug on my logstash I see the foll… --- ## [Elastic Engineer - Lab 4.3 Transforming data - target index empty](https://discuss.elastic.co/t/elastic-engineer-lab-4-3-transforming-data-target-index-empty/287912)
**Author:** [@micw](https://discuss.elastic.co/u/micw)\ **Replies:** 7\ **Last updated:** [November 10, 2021, 6:48pm UTC](https://discuss.elastic.co/t/elastic-engineer-lab-4-3-transforming-data-target-index-empty/287912 "2021-11-10T18:48:13Z")
My traffic\_stats index created by creating the pivot chart transform is empty. I've tried deleting the transform and following the steps in the answers again both in the UI and pasting commands in to the Console but no d… --- ## [Logstash-keystore.bat not using bundled JDK (Windows)](https://discuss.elastic.co/t/logstash-keystore-bat-not-using-bundled-jdk-windows/288719)
**Author:** [@Ryan\_Clark](https://discuss.elastic.co/u/Ryan_Clark)\ **Replies:** 4\ **Last updated:** [November 10, 2021, 6:05pm UTC](https://discuss.elastic.co/t/logstash-keystore-bat-not-using-bundled-jdk-windows/288719 "2021-11-10T18:05:44Z")
I was trying to setup a keystore and when running .\\logstash-keystore.bat I get a message saying "Using bundled JDK: "" then it says, No 'java.exe' executable found on PATH. I'm running version 7.15.1. The crazy thing is… --- ## [Logstash Filtering logs](https://discuss.elastic.co/t/logstash-filtering-logs/288521)
**Author:** [@John\_snow](https://discuss.elastic.co/u/John_snow)\ **Replies:** 5\ **Last updated:** [November 10, 2021, 5:46pm UTC](https://discuss.elastic.co/t/logstash-filtering-logs/288521 "2021-11-10T17:46:31Z")
I want to filter logs on base of account\_id and send to different output in logstash. Log1: {'account\_id': '1234567890', 'other data': "Some\_data"} Log2: {'account\_id': '0987654321', 'other data': "Some\_data"} i want … --- ## [Date (Snapshot) - Month name in English for snapshot policy](https://discuss.elastic.co/t/date-snapshot-month-name-in-english-for-snapshot-policy/288885)
**Author:** [@test\_tester](https://discuss.elastic.co/u/test_tester)\ **Replies:** 1\ **Last updated:** [November 10, 2021, 5:40pm UTC](https://discuss.elastic.co/t/date-snapshot-month-name-in-english-for-snapshot-policy/288885 "2021-11-10T17:40:52Z")
Hi, I want Elasticsearch snapshots named with date in english and date in numerals when they are created. With the following template snapshot\_MMYYYY\_foo Something like this: snapshot\_nov2021\_foo How this can be done… --- ## [Elasticsearch Query discard documents where sum of field is x](https://discuss.elastic.co/t/elasticsearch-query-discard-documents-where-sum-of-field-is-x/288916)
**Author:** [@jjammin92](https://discuss.elastic.co/u/jjammin92)\ **Replies:** 0\ **Last updated:** [November 10, 2021, 5:23pm UTC](https://discuss.elastic.co/t/elasticsearch-query-discard-documents-where-sum-of-field-is-x/288916 "2021-11-10T17:23:56Z")
Hello, I have documents that look like the following: "\_index": "test", "\_type": "\_doc", "\_id": "p767Cn0BpA6tOYGm9B\_P", "\_version": 1, "\_score": null, "\_source": { "path": "entry\_1", "elap\_t": 89, … --- ## [Canvas switch case not working after first case](https://discuss.elastic.co/t/canvas-switch-case-not-working-after-first-case/288627)
**Author:** [@MTV](https://discuss.elastic.co/u/MTV)\ **Replies:** 1\ **Last updated:** [November 10, 2021, 5:03pm UTC](https://discuss.elastic.co/t/canvas-switch-case-not-working-after-first-case/288627 "2021-11-10T17:03:42Z")
Hi, I am trying to use switch cases in canvas kibana (7.14) but it's not working. I tried to use the demo data with the following code: demodata | mapColumn "project\_map" fn=${getCell "project" | switch {c… --- ## [How to count service-down with formula KQL](https://discuss.elastic.co/t/how-to-count-service-down-with-formula-kql/288887)
**Author:** [@rschirin](https://discuss.elastic.co/u/rschirin)\ **Replies:** 1\ **Last updated:** [November 10, 2021, 4:06pm UTC](https://discuss.elastic.co/t/how-to-count-service-down-with-formula-kql/288887 "2021-11-10T16:06:59Z")
Hey there, I am trying to collect monitor event with timeout reached. Heartbeat, according with official docs, will create a service-down. Is there a way to count them? Something like: count(kql='http.response.status… --- ## [ECK on GKE Ingress Health Checks not working](https://discuss.elastic.co/t/eck-on-gke-ingress-health-checks-not-working/288912)
**Author:** [@trudesea](https://discuss.elastic.co/u/trudesea)\ **Replies:** 0\ **Last updated:** [November 10, 2021, 4:03pm UTC](https://discuss.elastic.co/t/eck-on-gke-ingress-health-checks-not-working/288912 "2021-11-10T16:03:53Z")
Hi, So this is my first attempt in getting this working. I was able to get an ingress into Kibana just fine, but using the es-http service as the backend is showing unhealthy. I assume this is because of the path bein… --- ## [Convert duration ms to sec](https://discuss.elastic.co/t/convert-duration-ms-to-sec/288782)
**Author:** [@RickT](https://discuss.elastic.co/u/RickT)\ **Replies:** 3\ **Last updated:** [November 10, 2021, 3:24pm UTC](https://discuss.elastic.co/t/convert-duration-ms-to-sec/288782 "2021-11-10T15:24:25Z")
Today i'm searching how to convert a duration field from ms to sec into a line visualization. as i can't change the advanced params or create a scripted field, i'm trying with the "json input" field but i'm not sure it'… --- ## [Csv filter output splitting a row in two because of some special char](https://discuss.elastic.co/t/csv-filter-output-splitting-a-row-in-two-because-of-some-special-char/288710)
**Author:** [@stillfreem](https://discuss.elastic.co/u/stillfreem)\ **Replies:** 8\ **Last updated:** [November 10, 2021, 2:59pm UTC](https://discuss.elastic.co/t/csv-filter-output-splitting-a-row-in-two-because-of-some-special-char/288710 "2021-11-10T14:59:24Z")
I have a csv file with 7543 entries that I'd like to get to cloud SIEM. My config file is as follows input { file { … --- ## [Bar vertical percentage missing ranges](https://discuss.elastic.co/t/bar-vertical-percentage-missing-ranges/288660)
**Author:** [@adam3](https://discuss.elastic.co/u/adam3)\ **Replies:** 4\ **Last updated:** [November 10, 2021, 2:50pm UTC](https://discuss.elastic.co/t/bar-vertical-percentage-missing-ranges/288660 "2021-11-10T14:50:47Z")
I set up a bar vertical percentage graph with some ranges in it and sometimes the ranges are missing. If I add some filters to the top of my dash they start showing up. Is there a setting I can tweak so these graphs… --- ## ["bad\_certificate" error on elasticsearch input plugin](https://discuss.elastic.co/t/bad-certificate-error-on-elasticsearch-input-plugin/288812)
**Author:** [@plubbs](https://discuss.elastic.co/u/plubbs)\ **Replies:** 5\ **Last updated:** [November 10, 2021, 2:40pm UTC](https://discuss.elastic.co/t/bad-certificate-error-on-elasticsearch-input-plugin/288812 "2021-11-10T14:40:22Z")
Hello, TLDR - Our certificate we use with the output-Elasticsearch plugin does not work on the input-Elasticsearch plugin despite being a valid certificate We are currently attempting to connect to an existing index in… --- ## [Missing socket metrics in 'System' integration in Fleet](https://discuss.elastic.co/t/missing-socket-metrics-in-system-integration-in-fleet/288865)
**Author:** [@dabo](https://discuss.elastic.co/u/dabo)\ **Replies:** 2\ **Last updated:** [November 10, 2021, 2:13pm UTC](https://discuss.elastic.co/t/missing-socket-metrics-in-system-integration-in-fleet/288865 "2021-11-10T14:13:43Z")
Hi, Can see that there is System socket\_summary metrics setting in System Integration in Fleet. Are there any plans to add system socket metrics to System integration as well? We are on 7.13.1. Is this maybe added in … --- ## [What are the possibilities of a Kibana plugin?](https://discuss.elastic.co/t/what-are-the-possibilities-of-a-kibana-plugin/287445)
**Author:** [@Joel\_Hansell](https://discuss.elastic.co/u/Joel_Hansell)\ **Replies:** 6\ **Last updated:** [November 10, 2021, 2:11pm UTC](https://discuss.elastic.co/t/what-are-the-possibilities-of-a-kibana-plugin/287445 "2021-11-10T14:11:15Z")
Hi, The context is Kibana 7.10.1 but I imagine the answer would be quite generic. I have run through a lot of the plugin developer docs but I'm not seeing the kind of overview docs I'm looking for, so please bear with … --- ## [Filtering on external syslog message.keyword for SRC=aaa.bbb.ccc.ddd IP address](https://discuss.elastic.co/t/filtering-on-external-syslog-message-keyword-for-src-aaa-bbb-ccc-ddd-ip-address/287216)
**Author:** [@Johnf](https://discuss.elastic.co/u/Johnf)\ **Replies:** 4\ **Last updated:** [November 10, 2021, 2:06pm UTC](https://discuss.elastic.co/t/filtering-on-external-syslog-message-keyword-for-src-aaa-bbb-ccc-ddd-ip-address/287216 "2021-11-10T14:06:07Z")
I am new to the list. Hopefully I am in the right thread location. I have a external remote syslog being ported to an internal Logstash syslog input and sent to Elasticsearch engine. Typically the message contains the d… --- ## [How to add new fields in ingest pipeline based on conditons?](https://discuss.elastic.co/t/how-to-add-new-fields-in-ingest-pipeline-based-on-conditons/288640)
**Author:** [@sidharth\_vijayakumar](https://discuss.elastic.co/u/sidharth_vijayakumar)\ **Replies:** 2\ **Last updated:** [November 10, 2021, 2:05pm UTC](https://discuss.elastic.co/t/how-to-add-new-fields-in-ingest-pipeline-based-on-conditons/288640 "2021-11-10T14:05:45Z")
Need to add a new field called app\_statuscode for in filebeat. The condition is that if message field contains 404 or 502 the value of app\_statuscode must be set to failed. If the Message field contains 200 OK then the … --- ## [Split a specific csv column into multiple fields](https://discuss.elastic.co/t/split-a-specific-csv-column-into-multiple-fields/288875)
**Author:** [@Greninja\_San](https://discuss.elastic.co/u/Greninja_San)\ **Replies:** 2\ **Last updated:** [November 10, 2021, 2:03pm UTC](https://discuss.elastic.co/t/split-a-specific-csv-column-into-multiple-fields/288875 "2021-11-10T14:03:33Z")
I have a csv file, with data like this : field1;field2;field3,field4\_1::field4\_2::field4\_3;field5;field6 The 4th field is composed of 3 values that I want to divide into 3 different fields in Elasticsearch. Is there a… --- ## [Maximum number of records per second in time series bar chart](https://discuss.elastic.co/t/maximum-number-of-records-per-second-in-time-series-bar-chart/288743)
**Author:** [@Bert\_Vanpeteghem](https://discuss.elastic.co/u/Bert_Vanpeteghem)\ **Replies:** 1\ **Last updated:** [November 10, 2021, 1:58pm UTC](https://discuss.elastic.co/t/maximum-number-of-records-per-second-in-time-series-bar-chart/288743 "2021-11-10T13:58:24Z")
Hi, how can i visualize the maximum number of records per second in a time series bar chart (that will choose interval automatically). So when the interval changes to eg hourly, I want to see the maximum number of recor… --- ## [Reset file offset once the harvester reaches end of file](https://discuss.elastic.co/t/reset-file-offset-once-the-harvester-reaches-end-of-file/288847)
**Author:** [@vasu01](https://discuss.elastic.co/u/vasu01)\ **Replies:** 1\ **Last updated:** [November 10, 2021, 1:46pm UTC](https://discuss.elastic.co/t/reset-file-offset-once-the-harvester-reaches-end-of-file/288847 "2021-11-10T13:46:11Z")
Is there a configuration property available in filebeat to start the harvester always from the beginning? The harvester should start from the beginning of the file irrespective of the update. We have specific logs (non-… --- ## [How to read the data displayed inside \[ERROR\]\[org.logstash.Logstash\]?](https://discuss.elastic.co/t/how-to-read-the-data-displayed-inside-error-org-logstash-logstash/288893)
**Author:** [@Robert\_Neagu](https://discuss.elastic.co/u/Robert_Neagu)\ **Replies:** 0\ **Last updated:** [November 10, 2021, 1:45pm UTC](https://discuss.elastic.co/t/how-to-read-the-data-displayed-inside-error-org-logstash-logstash/288893 "2021-11-10T13:45:30Z")
I want to read the data that is displayed inside the \[ERROR\]\[org.logstash.Logstash\] section inside the email plugin. --- ## [Prometheus via micrometer from spring](https://discuss.elastic.co/t/prometheus-via-micrometer-from-spring/288636)
**Author:** [@Ziemowit](https://discuss.elastic.co/u/Ziemowit)\ **Replies:** 1\ **Last updated:** [November 10, 2021, 1:23pm UTC](https://discuss.elastic.co/t/prometheus-via-micrometer-from-spring/288636 "2021-11-10T13:23:51Z")
I am exposing the memory metrics in Prometheus format from my spring application via micrometer. The response is following: # HELP jvm\_buffer\_count\_buffers An estimate of the number of buffers in the pool # TYPE jvm\_bu… --- ## [Suggest query does not work when used with script query?](https://discuss.elastic.co/t/suggest-query-does-not-work-when-used-with-script-query/288888)
**Author:** [@Ejaz\_Ahmed](https://discuss.elastic.co/u/Ejaz_Ahmed)\ **Replies:** 0\ **Last updated:** [November 10, 2021, 1:02pm UTC](https://discuss.elastic.co/t/suggest-query-does-not-work-when-used-with-script-query/288888 "2021-11-10T13:02:50Z")
Suggest query does not return anything when used with script \_score query {"\_source": {"excludes": \["tag", "document\_vector"\]}, "size": 1000, "query": { "script\_score": { "q… --- ## [Trying to rename all elements inside array](https://discuss.elastic.co/t/trying-to-rename-all-elements-inside-array/288884)
**Author:** [@Ankitkumar\_Ravidas](https://discuss.elastic.co/u/Ankitkumar_Ravidas)\ **Replies:** 1\ **Last updated:** [November 10, 2021, 12:36pm UTC](https://discuss.elastic.co/t/trying-to-rename-all-elements-inside-array/288884 "2021-11-10T12:36:23Z")
Hi team, i have tags array in my mongodb contacts collection, which contain mongodb ids, its store as "tags":\[{"$oid":"61822c908200c6b810bfee4d"},{"$oid":"61822c908200c6b810bfee4e"}\] i want to rename all element… --- ## [How cloud I build the filebeat image after change some code in beats/libbeat?](https://discuss.elastic.co/t/how-cloud-i-build-the-filebeat-image-after-change-some-code-in-beats-libbeat/288278)
**Author:** [@Icedroid](https://discuss.elastic.co/u/Icedroid)\ **Replies:** 6\ **Last updated:** [November 10, 2021, 12:29pm UTC](https://discuss.elastic.co/t/how-cloud-i-build-the-filebeat-image-after-change-some-code-in-beats-libbeat/288278 "2021-11-10T12:29:06Z")
I have add following code in the file beats/libbeat/kafka/config.go: if config.EnableIdempotent { k.Producer.Idempotent = true k.Net.MaxOpenRequests = 1 k.Producer.RequiredAcks = sarama.WaitForAll } Now I don't k… --- ## [High cardinality aggregation questions](https://discuss.elastic.co/t/high-cardinality-aggregation-questions/287169)
**Author:** [@galambo](https://discuss.elastic.co/u/galambo)\ **Replies:** 5\ **Last updated:** [November 10, 2021, 12:15pm UTC](https://discuss.elastic.co/t/high-cardinality-aggregation-questions/287169 "2021-11-10T12:15:55Z")
Hello, I'm currently working on a use case with an extremely high cardinality (couple of million combinations) and I'm having trouble understanding how ES behaves with aggregations. Here are sample documents: { … --- ## [ElasticSearch when I index there is like a limit in which It stops indexing and increments the number of docs.deleted](https://discuss.elastic.co/t/elasticsearch-when-i-index-there-is-like-a-limit-in-which-it-stops-indexing-and-increments-the-number-of-docs-deleted/288797)
**Author:** [@Juliito19](https://discuss.elastic.co/u/Juliito19)\ **Replies:** 5\ **Last updated:** [November 10, 2021, 12:06pm UTC](https://discuss.elastic.co/t/elasticsearch-when-i-index-there-is-like-a-limit-in-which-it-stops-indexing-and-increments-the-number-of-docs-deleted/288797 "2021-11-10T12:06:27Z")
Hi, I have an Apliccation in which I have an Elasticsearch template and I Insert with the pattern of template+(yyyy-MM-dd), Well, So far, so good, I think, but for each Index I suppose that have like a Limit in which w… --- ## [Collapsing / Hiding stack traces in the log stream view?](https://discuss.elastic.co/t/collapsing-hiding-stack-traces-in-the-log-stream-view/288767)
**Author:** [@Matthias\_W](https://discuss.elastic.co/u/Matthias_W)\ **Replies:** 1\ **Last updated:** [November 10, 2021, 11:29am UTC](https://discuss.elastic.co/t/collapsing-hiding-stack-traces-in-the-log-stream-view/288767 "2021-11-10T11:29:42Z")
Hi, is there any way to collapse / hide stack traces in the "Observability - Logs - Stream" view? Large stack traces make scrolling quite unpleasant and usability really suffers (even when using small text and having a… --- ## [Add custom fields to my email alert](https://discuss.elastic.co/t/add-custom-fields-to-my-email-alert/288529)
**Author:** [@Trying2learn](https://discuss.elastic.co/u/Trying2learn)\ **Replies:** 1\ **Last updated:** [November 10, 2021, 11:27am UTC](https://discuss.elastic.co/t/add-custom-fields-to-my-email-alert/288529 "2021-11-10T11:27:35Z")
Hello, I am new to Elastic & I am slowly trying configure alerts . I have created a observability email alert. But I would like to add specific details about the alert into my email. I understand I need to use the {{Mus… --- ## [Could not read repository data from index blob](https://discuss.elastic.co/t/could-not-read-repository-data-from-index-blob/288880)
**Author:** [@vaclav1](https://discuss.elastic.co/u/vaclav1)\ **Replies:** 0\ **Last updated:** [November 10, 2021, 11:14am UTC](https://discuss.elastic.co/t/could-not-read-repository-data-from-index-blob/288880 "2021-11-10T11:14:20Z")
When trying to read all snaphots from the repository in s3 we are getting the error: \[user@adapt103:~\]$ curl 'http://localhost:9200/\_cat/snapshots/adapt-prod\_202111?pretty' { "error" : { "root\_cause" : \[ { … [Previous page](https://discuss.elastic.co/latest.md?page=1393) [Next page](https://discuss.elastic.co/latest.md?page=1395)