# Latest **URL:** https://discuss.elastic.co/latest.md?page=1401 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1402 --- ## [No live logs coming in for Observability Engineers Module Lab 3.3/4.1](https://discuss.elastic.co/t/no-live-logs-coming-in-for-observability-engineers-module-lab-3-3-4-1/288487)
**Author:** [@Mark3](https://discuss.elastic.co/u/Mark3)\ **Replies:** 1\ **Last updated:** [November 5, 2021, 2:46pm UTC](https://discuss.elastic.co/t/no-live-logs-coming-in-for-observability-engineers-module-lab-3-3-4-1/288487 "2021-11-05T14:46:57Z")
Hi, cannot experience the value of Elastic Observability Engineer Training modules 3.3 or 4.1 as when I select "Logs" in the Kibana visualiser I am seeing no live logs appear? Is this a known fault as a colleague has ex… --- ## [Canvas and Dashboard show different values](https://discuss.elastic.co/t/canvas-and-dashboard-show-different-values/288418)
**Author:** [@r.pollak](https://discuss.elastic.co/u/r.pollak)\ **Replies:** 8\ **Last updated:** [November 5, 2021, 2:38pm UTC](https://discuss.elastic.co/t/canvas-and-dashboard-show-different-values/288418 "2021-11-05T14:38:24Z")
Hi together, I have created a metric visualization on a dashboard. The metric just counts the number of records (1.436) see picture below. I have created a metric visualization on a canvas (some index) and the metri… --- ## [SIEM network map states "Error loading map features" at all end points](https://discuss.elastic.co/t/siem-network-map-states-error-loading-map-features-at-all-end-points/288503)
**Author:** [@teamomni](https://discuss.elastic.co/u/teamomni)\ **Replies:** 0\ **Last updated:** [November 5, 2021, 2:33pm UTC](https://discuss.elastic.co/t/siem-network-map-states-error-loading-map-features-at-all-end-points/288503 "2021-11-05T14:33:47Z")
We currently are using Logstash to export all of our source, destination, and connection data from our network to our cloud, but the map states "Error loading map features" on all end points. All end points collected fr… --- ## [Avoid duplicates via node ingest pipelines](https://discuss.elastic.co/t/avoid-duplicates-via-node-ingest-pipelines/288408)
**Author:** [@omartinez](https://discuss.elastic.co/u/omartinez)\ **Replies:** 9\ **Last updated:** [November 5, 2021, 2:30pm UTC](https://discuss.elastic.co/t/avoid-duplicates-via-node-ingest-pipelines/288408 "2021-11-05T14:30:06Z")
Hi all, I need a solution on the elastic side to handle duplicate logs. I need to develop an elastic ingest node pipeline that can manage duplicates by replacing \_id with uuid, any other suggestions are welcome, but I d… --- ## [Elasticsearch Java Client (elasticsearch-java) ready for production use?](https://discuss.elastic.co/t/elasticsearch-java-client-elasticsearch-java-ready-for-production-use/284759)
**Author:** [@roytmana](https://discuss.elastic.co/u/roytmana)\ **Replies:** 5\ **Last updated:** [November 5, 2021, 2:16pm UTC](https://discuss.elastic.co/t/elasticsearch-java-client-elasticsearch-java-ready-for-production-use/284759 "2021-11-05T14:16:40Z")
Hello, We have been using low level rest client avoiding high level rest client because its dependencies on elastic server. I noticed that the high level client is being deprecated in favor of a new elasticsearch-java c… --- ## [Docker replication does not work - error - Master is not discoverable](https://discuss.elastic.co/t/docker-replication-does-not-work-error-master-is-not-discoverable/288455)
**Author:** [@jitendragupta2](https://discuss.elastic.co/u/jitendragupta2)\ **Replies:** 3\ **Last updated:** [November 5, 2021, 1:59pm UTC](https://discuss.elastic.co/t/docker-replication-does-not-work-error-master-is-not-discoverable/288455 "2021-11-05T13:59:27Z")
Docker replication does not work - error - Master is not discoverable Detailed Error - "master not discovered yet, this node has not previously joined a bootstrapped (v7+) cluster, and this node must discover master-eli… --- ## [Logstash is reloading the same documents again and again from elasticsearch index](https://discuss.elastic.co/t/logstash-is-reloading-the-same-documents-again-and-again-from-elasticsearch-index/288315)
**Author:** [@Husnain](https://discuss.elastic.co/u/Husnain)\ **Replies:** 5\ **Last updated:** [November 5, 2021, 1:47pm UTC](https://discuss.elastic.co/t/logstash-is-reloading-the-same-documents-again-and-again-from-elasticsearch-index/288315 "2021-11-05T13:47:20Z")
Hii.I am pulling documents from one Elasticsearch index into another Elasticsearch index using logstash.I am running logstash as a service by configuring "logstash.yml" file.The index from which I am pulling data,that in… --- ## [Query unique documents after my query](https://discuss.elastic.co/t/query-unique-documents-after-my-query/288496)
**Author:** [@Araf\_Shihab](https://discuss.elastic.co/u/Araf_Shihab)\ **Replies:** 0\ **Last updated:** [November 5, 2021, 1:41pm UTC](https://discuss.elastic.co/t/query-unique-documents-after-my-query/288496 "2021-11-05T13:41:02Z")
Hey stack overflow I have an Elasticsearch document that looks like below. I'm only interested in the 'tags' key. "\_index": "graph\_20211025t0909", "\_type": "\_doc", "\_id": "E12201A5-CC50-… --- ## [Upgrading Kibana from 7.14.2 to 7.15.X results in error TypeError: Cannot read property 'schema' of undefined](https://discuss.elastic.co/t/upgrading-kibana-from-7-14-2-to-7-15-x-results-in-error-typeerror-cannot-read-property-schema-of-undefined/288417)
**Author:** [@kking-biometrica](https://discuss.elastic.co/u/kking-biometrica)\ **Replies:** 7\ **Last updated:** [November 5, 2021, 1:38pm UTC](https://discuss.elastic.co/t/upgrading-kibana-from-7-14-2-to-7-15-x-results-in-error-typeerror-cannot-read-property-schema-of-undefined/288417 "2021-11-05T13:38:46Z")
I'm trying to upgrade Kibana on a Linux platform. When upgrading, I am performing the following actions: Download and extract linux tar.gz file to a temp location Stop Kibana Backup existing Kibana install: sudo cp -R… --- ## [Elastic App Search not searching suffix or wrong word](https://discuss.elastic.co/t/elastic-app-search-not-searching-suffix-or-wrong-word/287899)
**Author:** [@DILIP\_SHARMA](https://discuss.elastic.co/u/DILIP_SHARMA)\ **Replies:** 3\ **Last updated:** [November 5, 2021, 1:06pm UTC](https://discuss.elastic.co/t/elastic-app-search-not-searching-suffix-or-wrong-word/287899 "2021-11-05T13:06:04Z")
Hi i am using elastic app search -7.15.1 in ES Cloud , my test search engine contain following data - sun light sunlighting lightsun light sunlight sun i have below issue here - 1. if i search light its onl… --- ## [How to aggregate multiple events coming from different logs with slight different timestamp, when the only field is timestamp to combine those?](https://discuss.elastic.co/t/how-to-aggregate-multiple-events-coming-from-different-logs-with-slight-different-timestamp-when-the-only-field-is-timestamp-to-combine-those/287848)
**Author:** [@Indigo\_Star](https://discuss.elastic.co/u/Indigo_Star)\ **Replies:** 10\ **Last updated:** [November 5, 2021, 1:05pm UTC](https://discuss.elastic.co/t/how-to-aggregate-multiple-events-coming-from-different-logs-with-slight-different-timestamp-when-the-only-field-is-timestamp-to-combine-those/287848 "2021-11-05T13:05:14Z")
Hi, I have this situation: "How to aggregate multiple events coming from different logs with slight different timestamp, when the only common field could be the timesamp? I need to combine all data points into one dat… --- ## [Filebeat modules and inputs](https://discuss.elastic.co/t/filebeat-modules-and-inputs/288412)
**Author:** [@MalfuncEddie](https://discuss.elastic.co/u/MalfuncEddie)\ **Replies:** 1\ **Last updated:** [November 5, 2021, 12:27pm UTC](https://discuss.elastic.co/t/filebeat-modules-and-inputs/288412 "2021-11-05T12:27:16Z")
Hi, I'm a bit confused how modules work or if what I am trying to do is even possible. I got logs from a mssql instance that logs to an eventhub in azure. If I configure the filebeat agent to read the event hub it is s… --- ## [Metricbeat 7.15.1 Will Not Start](https://discuss.elastic.co/t/metricbeat-7-15-1-will-not-start/288429)
**Author:** [@ty9001](https://discuss.elastic.co/u/ty9001)\ **Replies:** 8\ **Last updated:** [November 5, 2021, 12:21pm UTC](https://discuss.elastic.co/t/metricbeat-7-15-1-will-not-start/288429 "2021-11-05T12:21:20Z")
Hello! I have noticed in the past few weeks my Metricbeat 7.15.1 monitoring doesn't seem to work. I finally figured out the service won't stay started properly. I was using Fedora 34 and have currently rolled out a new s… --- ## [Fleet + AWS Metrics IAM Visual Editor explanation](https://discuss.elastic.co/t/fleet-aws-metrics-iam-visual-editor-explanation/288491)
**Author:** [@zx8086](https://discuss.elastic.co/u/zx8086)\ **Replies:** 0\ **Last updated:** [November 5, 2021, 11:53am UTC](https://discuss.elastic.co/t/fleet-aws-metrics-iam-visual-editor-explanation/288491 "2021-11-05T11:53:38Z")
Can some give an explanation of usage of the visual editors and of we need this setup for the new Fleet-Managed AWS Integration as this is taken from the old Metricbeat AWS Module. Is the resource for VisualEditor1 & Vi… --- ## [Tsvb calculation](https://discuss.elastic.co/t/tsvb-calculation/288477)
**Author:** [@paigekim](https://discuss.elastic.co/u/paigekim)\ **Replies:** 1\ **Last updated:** [November 5, 2021, 10:47am UTC](https://discuss.elastic.co/t/tsvb-calculation/288477 "2021-11-05T10:47:40Z")
Hello, I have a question regards to tsvb calculation. I would like to get an accumulated Break Even Point(BEP) by using tsvb and you could see the attachment how I calculated. Currently, I divide accumulated revenue b… --- ## [Set custom event.category field to execute EQL in detection rules](https://discuss.elastic.co/t/set-custom-event-category-field-to-execute-eql-in-detection-rules/287986)
**Author:** [@Silver137](https://discuss.elastic.co/u/Silver137)\ **Replies:** 1\ **Last updated:** [November 5, 2021, 10:47am UTC](https://discuss.elastic.co/t/set-custom-event-category-field-to-execute-eql-in-detection-rules/287986 "2021-11-05T10:47:32Z")
I'm trying to set up a custom detection rule based in EQL sequence matching, with the trouble that the field that I chose for custom event.category in ECS It's really the ECS tags field in my indexed documents I'm in th… --- ## [Exporting data into HTML table](https://discuss.elastic.co/t/exporting-data-into-html-table/288485)
**Author:** [@AlessandroKP](https://discuss.elastic.co/u/AlessandroKP)\ **Replies:** 0\ **Last updated:** [November 5, 2021, 10:30am UTC](https://discuss.elastic.co/t/exporting-data-into-html-table/288485 "2021-11-05T10:30:02Z")
Hello, I am looking for a tool that lets you export data stored in Elasticsearch on a file in HTML format. I know that you can use Kibana to export the content of an index (or a subset) into CSV format. Do you know if… --- ## [Deprecation in Kibana 7.13.4](https://discuss.elastic.co/t/deprecation-in-kibana-7-13-4/284819)
**Author:** [@CatalinBinzari](https://discuss.elastic.co/u/CatalinBinzari)\ **Replies:** 3\ **Last updated:** [November 5, 2021, 10:26am UTC](https://discuss.elastic.co/t/deprecation-in-kibana-7-13-4/284819 "2021-11-05T10:26:28Z")
in kibana 7.13.4 i can not get rid of next deprecations: plugins.scanDirs is deprecated and is no longer used has been deprecated and will be removed in 8.0. To set the destination moving forward, you can use the "… --- ## [Fields missing in EQL sequence detection rule with building block alert as source](https://discuss.elastic.co/t/fields-missing-in-eql-sequence-detection-rule-with-building-block-alert-as-source/288483)
**Author:** [@masual](https://discuss.elastic.co/u/masual)\ **Replies:** 0\ **Last updated:** [November 5, 2021, 10:05am UTC](https://discuss.elastic.co/t/fields-missing-in-eql-sequence-detection-rule-with-building-block-alert-as-source/288483 "2021-11-05T10:05:41Z")
Hi everyone, I am implementing a set of Detection Rules to correlate events from different sources. I created a Threshold Rule and marked it as "building block" since I plan to use the alerts it generates as the source… --- ## [Logstash output creating error](https://discuss.elastic.co/t/logstash-output-creating-error/288161)
**Author:** [@BeMoore](https://discuss.elastic.co/u/BeMoore)\ **Replies:** 25\ **Last updated:** [November 5, 2021, 9:39am UTC](https://discuss.elastic.co/t/logstash-output-creating-error/288161 "2021-11-05T09:39:45Z")
Hi all, I have a weird error i can't nail down. Running 7.15.1 ES / Logstash I have a simple Logstash conf thats listening on a port for beats data and it should just push it to an index. input { beats { p… --- ## [Vizualize Netflow data in Kibana (used network trafic)](https://discuss.elastic.co/t/vizualize-netflow-data-in-kibana-used-network-trafic/287645)
**Author:** [@gmbynkrkrqz](https://discuss.elastic.co/u/gmbynkrkrqz)\ **Replies:** 3\ **Last updated:** [November 5, 2021, 8:03am UTC](https://discuss.elastic.co/t/vizualize-netflow-data-in-kibana-used-network-trafic/287645 "2021-11-05T08:03:18Z")
Hi, I would like to create a dashboard on Kibana using the OPNsense Netflow logs to vizualize the bandwith used per source IP. Here is my logstash config. input { # OPNsense netflow logs input udp { port =\> 1… --- ## [Create Aggregate field with separated by comma](https://discuss.elastic.co/t/create-aggregate-field-with-separated-by-comma/288463)
**Author:** [@ari\_wahyu\_nahar](https://discuss.elastic.co/u/ari_wahyu_nahar)\ **Replies:** 3\ **Last updated:** [November 5, 2021, 7:40am UTC](https://discuss.elastic.co/t/create-aggregate-field-with-separated-by-comma/288463 "2021-11-05T07:40:25Z")
Need Help. i have data like this: what steps should i take, to get results like this: A: 3 B: 3 C: 2 D: 3 E: 4 Thank you! --- ## [Dense\_vector in oss ES 7.6](https://discuss.elastic.co/t/dense-vector-in-oss-es-7-6/288471)
**Author:** [@gchakkalakkal](https://discuss.elastic.co/u/gchakkalakkal)\ **Replies:** 2\ **Last updated:** [November 5, 2021, 7:38am UTC](https://discuss.elastic.co/t/dense-vector-in-oss-es-7-6/288471 "2021-11-05T07:38:39Z")
hi All, Is dense\_vector available in OSS version of ES 7.6. As i getting below error while trying to create index using dense\_vector field type. "reason" : "No handler for type \[dense\_vector\] declared on field \[my\_vec… --- ## [APM Index Pattern is created automatically in Kibana](https://discuss.elastic.co/t/apm-index-pattern-is-created-automatically-in-kibana/288404)
**Author:** [@RdrgPorto](https://discuss.elastic.co/u/RdrgPorto)\ **Replies:** 4\ **Last updated:** [November 5, 2021, 7:33am UTC](https://discuss.elastic.co/t/apm-index-pattern-is-created-automatically-in-kibana/288404 "2021-11-05T07:33:34Z")
Kibana version: 7.14.2 Elasticsearch version: 7.14.2 APM Server version: 7.14.2 APM Agent language and version: NodeJS ^3.17.0 Browser version: Microsoft Edge 95.0.1020.40 Original install method (e.g. download pag… --- ## [Unable to enroll fleet server as assinged policy does not have fleet server input](https://discuss.elastic.co/t/unable-to-enroll-fleet-server-as-assinged-policy-does-not-have-fleet-server-input/277846)
**Author:** [@cheapsupps](https://discuss.elastic.co/u/cheapsupps)\ **Replies:** 26\ **Last updated:** [November 5, 2021, 7:26am UTC](https://discuss.elastic.co/t/unable-to-enroll-fleet-server-as-assinged-policy-does-not-have-fleet-server-input/277846 "2021-11-05T07:26:27Z")
Hi, I am setting up fleet-server in air-gap environment. However, I am unable to enroll the fleet-server to elasticsearch. I am having the below error. 2021-07-05T22:37:11.552+0800 INFO cmd/enroll\_cmd.go:300 Ge… --- ## [Manage system indices with Curator \[Elasticsearch 7.14.2\]](https://discuss.elastic.co/t/manage-system-indices-with-curator-elasticsearch-7-14-2/288410)
**Author:** [@RdrgPorto](https://discuss.elastic.co/u/RdrgPorto)\ **Replies:** 2\ **Last updated:** [November 5, 2021, 6:41am UTC](https://discuss.elastic.co/t/manage-system-indices-with-curator-elasticsearch-7-14-2/288410 "2021-11-05T06:41:07Z")
Elasticsearch version: 7.14.2 Curator version: 5.8.4 Hi, everyone I have seen a warning message in Curator in which Elasticsearch reports that in a future major version direct access to system indices will be prevente… --- ## [Is there a way to get the key of the current aggregation bucket in script？](https://discuss.elastic.co/t/is-there-a-way-to-get-the-key-of-the-current-aggregation-bucket-in-script/288466)
**Author:** [@jakey](https://discuss.elastic.co/u/jakey)\ **Replies:** 0\ **Last updated:** [November 5, 2021, 5:27am UTC](https://discuss.elastic.co/t/is-there-a-way-to-get-the-key-of-the-current-aggregation-bucket-in-script/288466 "2021-11-05T05:27:36Z")
For example: how to get the key (country) of the current bucket in the script after aggregating countries? Hope to give a solution, thank you！ "aggs"{ "country\_group":{ "terms":{ "field":"country", "size":1000 … --- ## [Need to configure message timestamp as timestamp in elastic stack](https://discuss.elastic.co/t/need-to-configure-message-timestamp-as-timestamp-in-elastic-stack/288191)
**Author:** [@Mobin](https://discuss.elastic.co/u/Mobin)\ **Replies:** 6\ **Last updated:** [November 5, 2021, 5:06am UTC](https://discuss.elastic.co/t/need-to-configure-message-timestamp-as-timestamp-in-elastic-stack/288191 "2021-11-05T05:06:26Z")
We have created an elastic stack to monitor logs from the Linux clients. On Linux clients, filebeat is configured to ship the logs to the elastic stack. When we are searching for the logs using elastic discover option @… --- ## [Error i\_o\_exception on s3 repository](https://discuss.elastic.co/t/error-i-o-exception-on-s3-repository/288128)
**Author:** [@alfianaf](https://discuss.elastic.co/u/alfianaf)\ **Replies:** 15\ **Last updated:** [November 5, 2021, 3:10am UTC](https://discuss.elastic.co/t/error-i-o-exception-on-s3-repository/288128 "2021-11-05T03:10:53Z")
Hello, I make a repository that connect to storage with s3 protocol, after I declare the proxy.host, proxy.port, protocol, endpoint on Elasticsearch.yml, I also declare the access\_key and secret key on Elasticsearch keys… --- ## [Logstash Logging setting to output rubydebug info for running service](https://discuss.elastic.co/t/logstash-logging-setting-to-output-rubydebug-info-for-running-service/288435)
**Author:** [@teebu](https://discuss.elastic.co/u/teebu)\ **Replies:** 11\ **Last updated:** [November 5, 2021, 2:23am UTC](https://discuss.elastic.co/t/logstash-logging-setting-to-output-rubydebug-info-for-running-service/288435 "2021-11-05T02:23:28Z")
I'm using the default settings. When I run LS as a service, the logging in the plain.log file doesn't have any of the rubydebug output. When I run it with the -f flag, I see all the output normally. What setting file d… [Previous page](https://discuss.elastic.co/latest.md?page=1400) [Next page](https://discuss.elastic.co/latest.md?page=1402)