# Latest **URL:** https://discuss.elastic.co/latest.md?page=1397 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1398 --- ## [Missing Converter handling for full class name=org.jruby.ext.date.RubyDateTime](https://discuss.elastic.co/t/missing-converter-handling-for-full-class-name-org-jruby-ext-date-rubydatetime/288757)
**Author:** [@Miria\_Bernardes](https://discuss.elastic.co/u/Miria_Bernardes)\ **Replies:** 1\ **Last updated:** [November 9, 2021, 12:44pm UTC](https://discuss.elastic.co/t/missing-converter-handling-for-full-class-name-org-jruby-ext-date-rubydatetime/288757 "2021-11-09T12:44:22Z")
Hey guys, all right? I need help with an issue I've been experiencing when collecting data using jdbc\_streaming, running conf locally through docker the data collection by logstash is performed successfully, but when ap… --- ## [Http fields: inbound or outbound](https://discuss.elastic.co/t/http-fields-inbound-or-outbound/287723)
**Author:** [@Bert\_Vanpeteghem](https://discuss.elastic.co/u/Bert_Vanpeteghem)\ **Replies:** 2\ **Last updated:** [November 9, 2021, 12:28pm UTC](https://discuss.elastic.co/t/http-fields-inbound-or-outbound/287723 "2021-11-09T12:28:18Z")
Hi, in elastic ECS there's the http section. Is this section reserved for incoming or outgoing http activity? --- ## [How can I retrieve all user sessions connected to my Kibana, using API](https://discuss.elastic.co/t/how-can-i-retrieve-all-user-sessions-connected-to-my-kibana-using-api/288329)
**Author:** [@dicto](https://discuss.elastic.co/u/dicto)\ **Replies:** 3\ **Last updated:** [November 8, 2021, 10:21am UTC](https://discuss.elastic.co/t/how-can-i-retrieve-all-user-sessions-connected-to-my-kibana-using-api/288329 "2021-11-08T10:21:58Z")
Hi! How can I retrieve all user sessions connected to my Kibana, using API ? I will do a montoring sessions to delete duplicate access to my dashboard in Kibana. I saw that its is possible to DELETE sessions using the… --- ## [Alternative to ingest-convert.sh for YML](https://discuss.elastic.co/t/alternative-to-ingest-convert-sh-for-yml/288597)
**Author:** [@IsaacKr](https://discuss.elastic.co/u/IsaacKr)\ **Replies:** 4\ **Last updated:** [November 9, 2021, 11:42am UTC](https://discuss.elastic.co/t/alternative-to-ingest-convert-sh-for-yml/288597 "2021-11-09T11:42:27Z")
We are using Logstash to ship logs to a cloud based SIEM. We'd like to utilize Filebeat to assist in the parsing, however it seems that Filebeat only provides the ingest pipelines for Elasticsearch. The ingest-convert.sh… --- ## [ElasticSearch \_bulk and \_update got bad performance](https://discuss.elastic.co/t/elasticsearch-bulk-and-update-got-bad-performance/288746)
**Author:** [@Hunter\_Tr\_n](https://discuss.elastic.co/u/Hunter_Tr_n)\ **Replies:** 1\ **Last updated:** [November 9, 2021, 11:41am UTC](https://discuss.elastic.co/t/elasticsearch-bulk-and-update-got-bad-performance/288746 "2021-11-09T11:41:04Z")
I'm using \_bulk request and updating documents by doc. However, some complex cases need to apply script for updating. However, the performance in case script is very bad. It affects search side and index side latency. I… --- ## [Create a count of the total of desired metric](https://discuss.elastic.co/t/create-a-count-of-the-total-of-desired-metric/288594)
**Author:** [@Sugand](https://discuss.elastic.co/u/Sugand)\ **Replies:** 3\ **Last updated:** [November 9, 2021, 11:38am UTC](https://discuss.elastic.co/t/create-a-count-of-the-total-of-desired-metric/288594 "2021-11-09T11:38:15Z")
Hi, I have certain visualizations in dashboard based off condition's. Example: 1\> A metric of company numbers starting with number 1 and 2\> A metric of emails staring with alphabet "a". I want to create another visu… --- ## [Get current year from painless](https://discuss.elastic.co/t/get-current-year-from-painless/288738)
**Author:** [@Andrea\_Bozzano](https://discuss.elastic.co/u/Andrea_Bozzano)\ **Replies:** 2\ **Last updated:** [November 9, 2021, 11:11am UTC](https://discuss.elastic.co/t/get-current-year-from-painless/288738 "2021-11-09T11:11:17Z")
Hi everyone! In my application, I'm trying to retrieve the current year in a scripted field. The idea was (in pseudocode): calculated = currentYear - doc\['field'\].value return calculated; I tried with: Instant Curr… --- ## [Data are processing slowly from the Logstash persistent queue to ES](https://discuss.elastic.co/t/data-are-processing-slowly-from-the-logstash-persistent-queue-to-es/288741)
**Author:** [@jenifer\_raja](https://discuss.elastic.co/u/jenifer_raja)\ **Replies:** 0\ **Last updated:** [November 9, 2021, 10:14am UTC](https://discuss.elastic.co/t/data-are-processing-slowly-from-the-logstash-persistent-queue-to-es/288741 "2021-11-09T10:14:22Z")
We are facing an issue with Logstash parsing, Initially parsing speed is very high and then it decreases gradually, because of this we have around 10 gb of data in queue. We tried increasing swap size, increasing workers… --- ## [Where to find Fleet Integration new additions and changelogs](https://discuss.elastic.co/t/where-to-find-fleet-integration-new-additions-and-changelogs/286636)
**Author:** [@zx8086](https://discuss.elastic.co/u/zx8086)\ **Replies:** 3\ **Last updated:** [November 9, 2021, 9:52am UTC](https://discuss.elastic.co/t/where-to-find-fleet-integration-new-additions-and-changelogs/286636 "2021-11-09T09:52:51Z")
Is there a way to identify which new Fleet Integrations are added and also a changelog when they are upgraded? Is there a central location for this information? I can only tell right now (maybe incorrectly) via the Inte… --- ## [Heartbeat input plugin](https://discuss.elastic.co/t/heartbeat-input-plugin/288621)
**Author:** [@BeMoore](https://discuss.elastic.co/u/BeMoore)\ **Replies:** 2\ **Last updated:** [November 9, 2021, 9:50am UTC](https://discuss.elastic.co/t/heartbeat-input-plugin/288621 "2021-11-09T09:50:40Z")
Hiya all, if i want to change the input plugins listen port for heartbeat how can i do this? the guide doesn't list it as an option input { heartbeat { port =\> 2600 } } generates this error \[ERROR\]\[logstash.… --- ## [Specific retention duration for logs (Index Lifecycle Policy)](https://discuss.elastic.co/t/specific-retention-duration-for-logs-index-lifecycle-policy/288635)
**Author:** [@Sco](https://discuss.elastic.co/u/Sco)\ **Replies:** 1\ **Last updated:** [November 9, 2021, 9:48am UTC](https://discuss.elastic.co/t/specific-retention-duration-for-logs-index-lifecycle-policy/288635 "2021-11-09T09:48:27Z")
Hi guys, I would need some help with Index Lifecycle Policies, and it's setup. I need to set up winlogbeat to store data for X days and delete it afterward. Simple as that. Tried different configurations in ILM but I … --- ## [Filebest not reading log files whos names as numeric only](https://discuss.elastic.co/t/filebest-not-reading-log-files-whos-names-as-numeric-only/288672)
**Author:** [@Azfar](https://discuss.elastic.co/u/Azfar)\ **Replies:** 2\ **Last updated:** [November 9, 2021, 9:46am UTC](https://discuss.elastic.co/t/filebest-not-reading-log-files-whos-names-as-numeric-only/288672 "2021-11-09T09:46:15Z")
I have log files whose names are in numbers only like "34567854322", these are an application logs and I don't have control to append any extension. Blockquote ls -l total 12 -rw-rw-r-- 1 barakat barakat 1254 Nov 2… --- ## [Restore KQL time filter on Kibana Dashboard](https://discuss.elastic.co/t/restore-kql-time-filter-on-kibana-dashboard/287975)
**Author:** [@pranay\_jain](https://discuss.elastic.co/u/pranay_jain)\ **Replies:** 4\ **Last updated:** [November 9, 2021, 9:42am UTC](https://discuss.elastic.co/t/restore-kql-time-filter-on-kibana-dashboard/287975 "2021-11-09T09:42:27Z")
Is there a way to restore time filter selection on Kibana dashboard. Use case : We have menu button on our web page from where we open Kibana dashboard by using tokens with the endpoint /internal/security/login for log… --- ## [Functionbeat throwing the error add\_cloud\_metadata: hosting provider type not detected](https://discuss.elastic.co/t/functionbeat-throwing-the-error-add-cloud-metadata-hosting-provider-type-not-detected/288675)
**Author:** [@Jijo\_Johny](https://discuss.elastic.co/u/Jijo_Johny)\ **Replies:** 1\ **Last updated:** [November 9, 2021, 9:38am UTC](https://discuss.elastic.co/t/functionbeat-throwing-the-error-add-cloud-metadata-hosting-provider-type-not-detected/288675 "2021-11-09T09:38:21Z")
I am trying to connect to the Elasticsearch and Kibana 7.10.2, launched from AWS under open source licence. I am trying to stream the logs from AWS CLoudwatch log group to Kibana, I have finished the set up of functionbe… --- ## [Capturing all JMX attributes for an object (wildcard support in attribute)?](https://discuss.elastic.co/t/capturing-all-jmx-attributes-for-an-object-wildcard-support-in-attribute/288610)
**Author:** [@Matthias\_W](https://discuss.elastic.co/u/Matthias_W)\ **Replies:** 1\ **Last updated:** [November 9, 2021, 8:26am UTC](https://discuss.elastic.co/t/capturing-all-jmx-attributes-for-an-object-wildcard-support-in-attribute/288610 "2021-11-09T08:26:37Z")
I am trying to use the Elastic APM Java agent to capture JMX metrics for a JBoss application server. If I set the capture\_jmx\_metrics property to object\_name\[jboss.as:subsystem=datasources,xa-data-source=myDb, statisti… --- ## [Coordinate converting issue!](https://discuss.elastic.co/t/coordinate-converting-issue/288733)
**Author:** [@FURKAN\_KURT](https://discuss.elastic.co/u/FURKAN_KURT)\ **Replies:** 0\ **Last updated:** [November 9, 2021, 9:26am UTC](https://discuss.elastic.co/t/coordinate-converting-issue/288733 "2021-11-09T09:26:56Z")
Hello. I am stuck in this issue for days. I send the bounding box and get this response: { "took": 2, "timed\_out": false, "\_shards": { "total": 5, "successful": 5, "skipped": 0, "failed": 0 }, … --- ## [Is an issue with AD](https://discuss.elastic.co/t/is-an-issue-with-ad/288558)
**Author:** [@tbs575](https://discuss.elastic.co/u/tbs575)\ **Replies:** 2\ **Last updated:** [November 9, 2021, 9:10am UTC](https://discuss.elastic.co/t/is-an-issue-with-ad/288558 "2021-11-09T09:10:26Z")
set Elasticsearch 7.15 using Windows AD to verify account, and mapping AD group into xinc\_user role, and it is working, but now I met problem, not sure if it is issue. login with AD account by kibana check account pr… --- ## [Is there any way to change the precision\_threshold when use es-sql?](https://discuss.elastic.co/t/is-there-any-way-to-change-the-precision-threshold-when-use-es-sql/288729)
**Author:** [@danielduan](https://discuss.elastic.co/u/danielduan)\ **Replies:** 0\ **Last updated:** [November 9, 2021, 9:08am UTC](https://discuss.elastic.co/t/is-there-any-way-to-change-the-precision-threshold-when-use-es-sql/288729 "2021-11-09T09:08:09Z")
We know that when use es api we can setting the value of precision\_threshold , is there any way to overwrite the default value when use es-sql? if the answer is no , could you please tell us how to modify the default v… --- ## [\_bulk request with routing parameter](https://discuss.elastic.co/t/bulk-request-with-routing-parameter/288723)
**Author:** [@Hunter\_Tr\_n](https://discuss.elastic.co/u/Hunter_Tr_n)\ **Replies:** 2\ **Last updated:** [November 9, 2021, 9:00am UTC](https://discuss.elastic.co/t/bulk-request-with-routing-parameter/288723 "2021-11-09T09:00:01Z")
Currently, I am applying \_bulk requests for reindexing. Each \_bulk request contains a ton of reindex requests ( creating, updating, or deleting). Each document already has its own routing. I wonder if I apply routing on… --- ## [Apm-agent-attach 1.26.0 Cannot Resolve](https://discuss.elastic.co/t/apm-agent-attach-1-26-0-cannot-resolve/288679)
**Author:** [@spratke](https://discuss.elastic.co/u/spratke)\ **Replies:** 1\ **Last updated:** [November 9, 2021, 8:43am UTC](https://discuss.elastic.co/t/apm-agent-attach-1-26-0-cannot-resolve/288679 "2021-11-09T08:43:04Z")
I am adding Elastic APM to my Springboot project. I have added apm-opentracing & apm-agent-attach. If I try to use version 1.26.0 I have no problem with apm-opentracing, but apm-agent-attach will not resolve dependencie… --- ## [Feedback for 100Gbit/s Elastic SIEM design (which includes Suricata)](https://discuss.elastic.co/t/feedback-for-100gbit-s-elastic-siem-design-which-includes-suricata/288724)
**Author:** [@UPPERCASE](https://discuss.elastic.co/u/UPPERCASE)\ **Replies:** 0\ **Last updated:** [November 9, 2021, 8:43am UTC](https://discuss.elastic.co/t/feedback-for-100gbit-s-elastic-siem-design-which-includes-suricata/288724 "2021-11-09T08:43:01Z")
Is cross-posting allowed here? If so, then I would like to hear some feedback on the topic below. You may reply on this Discourse instance, or the Suricata one of course. --- ## [Elasticsearch can't restart and join the cluster](https://discuss.elastic.co/t/elasticsearch-cant-restart-and-join-the-cluster/288630)
**Author:** [@songfj](https://discuss.elastic.co/u/songfj)\ **Replies:** 3\ **Last updated:** [November 9, 2021, 8:22am UTC](https://discuss.elastic.co/t/elasticsearch-cant-restart-and-join-the-cluster/288630 "2021-11-09T08:22:02Z")
Hello everyone, when I restart one node from Elasticsearch cluster, the node can't join cluster,I 'm sure I have config the security.I can't start my node, when I start it , my kibana can't login in with my old username … --- ## [Elasticsearch filter in logstash = random results](https://discuss.elastic.co/t/elasticsearch-filter-in-logstash-random-results/288718)
**Author:** [@Rnx](https://discuss.elastic.co/u/Rnx)\ **Replies:** 0\ **Last updated:** [November 9, 2021, 7:52am UTC](https://discuss.elastic.co/t/elasticsearch-filter-in-logstash-random-results/288718 "2021-11-09T07:52:23Z")
Hi, I'm using Elasticsearch filter plugin in logstash to enrich records and calculate time difference between two events from different logs. It works, but randomly - it returns search results for some records, but not … --- ## [Log on workstation hostname](https://discuss.elastic.co/t/log-on-workstation-hostname/288652)
**Author:** [@insurin](https://discuss.elastic.co/u/insurin)\ **Replies:** 2\ **Last updated:** [November 9, 2021, 7:46am UTC](https://discuss.elastic.co/t/log-on-workstation-hostname/288652 "2021-11-09T07:46:23Z")
I am using ELK 7.12.1 mainly to log AD events at the minute. I have had a device go missing and I want to track down the last time it was logged on. I have been using user.name.text to locate user logons but I don't thin… --- ## [ML: difference between partition\_field\_name and by\_field\_name in a population job?](https://discuss.elastic.co/t/ml-difference-between-partition-field-name-and-by-field-name-in-a-population-job/287792)
**Author:** [@shabnam](https://discuss.elastic.co/u/shabnam)\ **Replies:** 8\ **Last updated:** [November 9, 2021, 7:29am UTC](https://discuss.elastic.co/t/ml-difference-between-partition-field-name-and-by-field-name-in-a-population-job/287792 "2021-11-09T07:29:35Z")
Hi, I want to know the difference of this two ml advance jobs: a. func(x), by\_field(y), over\_field(z), partition\_field(-) b. func(x), by\_field(-), over\_field(z), partition\_field(y) , two tests performed: I created… --- ## [Likely root cause: ElasticsearchSecurityException\[Cannot find metadata for entity http://xxx.xxx.xx\]](https://discuss.elastic.co/t/likely-root-cause-elasticsearchsecurityexception-cannot-find-metadata-for-entity-http-xxx-xxx-xx/288639)
**Author:** [@slashlinux](https://discuss.elastic.co/u/slashlinux)\ **Replies:** 2\ **Last updated:** [November 9, 2021, 7:13am UTC](https://discuss.elastic.co/t/likely-root-cause-elasticsearchsecurityexception-cannot-find-metadata-for-entity-http-xxx-xxx-xx/288639 "2021-11-09T07:13:45Z")
Hello, I'm trying to integrate ELK with Keycloak and I've encountered some problems, I'm not expert on elk side so I did some configuration on Kibana/Elasticsearch YML: Elasticsearch.yml xpack.security.enabled: true x… --- ## [How do I get Enterprise search to use my existing indexes?](https://discuss.elastic.co/t/how-do-i-get-enterprise-search-to-use-my-existing-indexes/288583)
**Author:** [@neergttocsdivad](https://discuss.elastic.co/u/neergttocsdivad)\ **Replies:** 10\ **Last updated:** [November 9, 2021, 6:38am UTC](https://discuss.elastic.co/t/how-do-i-get-enterprise-search-to-use-my-existing-indexes/288583 "2021-11-09T06:38:43Z")
Elasticsearch + Kibana + Enterprise Search (7.15.1) all running in a docker container on a Synology NAS. /volume2/docker I used FSCrawler-some months ago to generated indexes which are stored in /volume4/Elasticsearch/… --- ## [From which version will "Workplace Search settings" for FSCrawler not be needed?](https://discuss.elastic.co/t/from-which-version-will-workplace-search-settings-for-fscrawler-not-be-needed/288688)
**Author:** [@neergttocsdivad](https://discuss.elastic.co/u/neergttocsdivad)\ **Replies:** 1\ **Last updated:** [November 9, 2021, 6:27am UTC](https://discuss.elastic.co/t/from-which-version-will-workplace-search-settings-for-fscrawler-not-be-needed/288688 "2021-11-09T06:27:15Z")
This FSCrawler page includes "Note - Although this won’t be needed in the future, . . . ." --- ## [Space saving for index=false](https://discuss.elastic.co/t/space-saving-for-index-false/288184)
**Author:** [@anon17386273](https://discuss.elastic.co/u/anon17386273)\ **Replies:** 5\ **Last updated:** [November 9, 2021, 6:14am UTC](https://discuss.elastic.co/t/space-saving-for-index-false/288184 "2021-11-09T06:14:40Z")
Hi I have an index that is 300gb in size with all 30 fields index=true. I tried setting 15 of the fields with index=false on another index and did a reindexing to compare the size. The end result is that there seems to… --- ## [Python Elasticsearch : Index mapping inconsistencies between 'es.index' and 'es.indices.create'](https://discuss.elastic.co/t/python-elasticsearch-index-mapping-inconsistencies-between-es-index-and-es-indices-create/288584)
**Author:** [@corndog](https://discuss.elastic.co/u/corndog)\ **Replies:** 5\ **Last updated:** [November 9, 2021, 5:31am UTC](https://discuss.elastic.co/t/python-elasticsearch-index-mapping-inconsistencies-between-es-index-and-es-indices-create/288584 "2021-11-09T05:31:57Z")
I'm trying to implement a custom index mapping (my\_mapping) in Python, BUT, I do not get the expected index mapping after the python file is run! file.py ---------- my\_mapping = """ { "settings": { "number\_… [Previous page](https://discuss.elastic.co/latest.md?page=1396) [Next page](https://discuss.elastic.co/latest.md?page=1398)