# Latest

**URL:** https://discuss.elastic.co/latest.md?page=1409

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1410

---

## [Add date and seconds to odd(?) ISO 8601-ish timestamp?](https://discuss.elastic.co/t/add-date-and-seconds-to-odd-iso-8601-ish-timestamp/288031)

<div class="topic-metadata">

**Author:** [@tjswe](https://discuss.elastic.co/u/tjswe)\
**Replies:** 2\
**Last updated:** [October 30, 2021, 6:47pm UTC](https://discuss.elastic.co/t/add-date-and-seconds-to-odd-iso-8601-ish-timestamp/288031 "2021-10-30T18:47:20Z")

</div>

Im logging AIS-data (ship positions) into Elasticsearch. The "timestamp" field from the receiver is 99% of the time a regular ISO8601 timestamp like "2021-10-29T17:55:30Z" which logstash takes in without issues. But som…

---

## [Logstash - Grok dynamic parsing including nested fields](https://discuss.elastic.co/t/logstash-grok-dynamic-parsing-including-nested-fields/287919)

<div class="topic-metadata">

**Author:** [@anandd4](https://discuss.elastic.co/u/anandd4)\
**Replies:** 2\
**Last updated:** [October 30, 2021, 11:21am UTC](https://discuss.elastic.co/t/logstash-grok-dynamic-parsing-including-nested-fields/287919 "2021-10-30T11:21:11Z")

</div>

Hello, We have the following pattern which includes dynamic fields nested inside a tag(tag3 in the example below) that needs to be parsed & grok seems to be the go-to-filter to achieve this. However, given fields inside…

---

## [Rule hits visible in preview, but no alerts triggered](https://discuss.elastic.co/t/rule-hits-visible-in-preview-but-no-alerts-triggered/287457)

<div class="topic-metadata">

**Author:** [@mcreedjr](https://discuss.elastic.co/u/mcreedjr)\
**Replies:** 4\
**Last updated:** [October 27, 2021, 4:10pm UTC](https://discuss.elastic.co/t/rule-hits-visible-in-preview-but-no-alerts-triggered/287457 "2021-10-27T16:10:02Z")

</div>

I've imported the default Elastic rules, and duplicated the 'whoami' rule. When I preview the rule, it shows hits, but there are no alerts raised. I feel that I'm missing something super obvious, but I would expect to se…

---

## [How to match spans near the beginning of a field](https://discuss.elastic.co/t/how-to-match-spans-near-the-beginning-of-a-field/288055)

<div class="topic-metadata">

**Author:** [@Kev86](https://discuss.elastic.co/u/Kev86)\
**Replies:** 0\
**Last updated:** [October 30, 2021, 6:55am UTC](https://discuss.elastic.co/t/how-to-match-spans-near-the-beginning-of-a-field/288055 "2021-10-30T06:55:47Z")

</div>

I have this query and want a span first in SearchField. So that ES shows the string that match closest to the beginning of the field first: { "query": { "bool": { "should": \[ { …

---

## [How to Improve Snapshot to S3 rate?](https://discuss.elastic.co/t/how-to-improve-snapshot-to-s3-rate/288048)

<div class="topic-metadata">

**Author:** [@iShiBin](https://discuss.elastic.co/u/iShiBin)\
**Replies:** 0\
**Last updated:** [October 30, 2021, 3:24am UTC](https://discuss.elastic.co/t/how-to-improve-snapshot-to-s3-rate/288048 "2021-10-30T03:24:11Z")

</div>

The archive rate is only around 60mb/s on a large cluster (72 warm nodes). How to improve the rate to around 100mb/s? What I have tried: Enable the S3-accelerate mode. However, ES doesn't support it per Enabling Tran…

---

## [Snapshot to S3 partially failed with error Unable to execute HTTP request: \<bucket\_name\>.s3.us-west-2.amazonaws.com](https://discuss.elastic.co/t/snapshot-to-s3-partially-failed-with-error-unable-to-execute-http-request-bucket-name-s3-us-west-2-amazonaws-com/287657)

<div class="topic-metadata">

**Author:** [@iShiBin](https://discuss.elastic.co/u/iShiBin)\
**Replies:** 7\
**Last updated:** [October 30, 2021, 3:14am UTC](https://discuss.elastic.co/t/snapshot-to-s3-partially-failed-with-error-unable-to-execute-http-request-bucket-name-s3-us-west-2-amazonaws-com/287657 "2021-10-30T03:14:32Z")

</div>

20 out of 90 shards failed to complete the snapshot with the following archive output. { "snapshot": { "snapshot": "exabeam-2021.08.10", "uuid": "fRjaWFFfQDK7bHbJRR0yHw", "version\_id": 608019…

---

## [Parse XML by Document not Element](https://discuss.elastic.co/t/parse-xml-by-document-not-element/288028)

<div class="topic-metadata">

**Author:** [@Tim\_Mobley](https://discuss.elastic.co/u/Tim_Mobley)\
**Replies:** 5\
**Last updated:** [October 29, 2021, 10:32pm UTC](https://discuss.elastic.co/t/parse-xml-by-document-not-element/288028 "2021-10-29T22:32:21Z")

</div>

As a test, I am trying to ingest the following simple XML file (the actual production file is huge). \<note\> \<to\>Tove\</to\> \<from\>Jani\</from\> \<heading\>Reminder\</heading\> \<body\>Don't forget me this weekend!\</body\> \</note\> …

---

## [Fleet-server installation error](https://discuss.elastic.co/t/fleet-server-installation-error/288033)

<div class="topic-metadata">

**Author:** [@Duane\_Wylie](https://discuss.elastic.co/u/Duane_Wylie)\
**Replies:** 0\
**Last updated:** [October 29, 2021, 7:37pm UTC](https://discuss.elastic.co/t/fleet-server-installation-error/288033 "2021-10-29T19:37:17Z")

</div>

I'm trying to stand up an on-prem Elasticstack deployment (Ubuntu 20.04 and Elastic 7.15). I have Elasticsearch and Kibana setup and working. I'm in the process of setting up the Fleet-server. I'm getting this message…

---

## [Rules folder location](https://discuss.elastic.co/t/rules-folder-location/288010)

<div class="topic-metadata">

**Author:** [@Dalador](https://discuss.elastic.co/u/Dalador)\
**Replies:** 1\
**Last updated:** [October 30, 2021, 12:00am UTC](https://discuss.elastic.co/t/rules-folder-location/288010 "2021-10-30T00:00:41Z")

</div>

Hello I am using Docker ELK and I keep Elasticsearch data permanently by using the following on .yml volumes: /path/to/storage:/usr/share/Elasticsearch/data But how can i save my EQL, KQL rules in security applicati…

---

## [How to save logs, charts, and reports after Kibana is uninstalled](https://discuss.elastic.co/t/how-to-save-logs-charts-and-reports-after-kibana-is-uninstalled/287880)

<div class="topic-metadata">

**Author:** [@li\_li](https://discuss.elastic.co/u/li_li)\
**Replies:** 1\
**Last updated:** [October 29, 2021, 11:46pm UTC](https://discuss.elastic.co/t/how-to-save-logs-charts-and-reports-after-kibana-is-uninstalled/287880 "2021-10-29T23:46:31Z")

</div>

Hello, I have a problem.Kibana Docker uninstall, how to save chart data and report data, the next installation docker can be directly into the display?

---

## [Not able to connect kibana to remote instance](https://discuss.elastic.co/t/not-able-to-connect-kibana-to-remote-instance/287859)

<div class="topic-metadata">

**Author:** [@Tingda\_Du](https://discuss.elastic.co/u/Tingda_Du)\
**Replies:** 8\
**Last updated:** [October 29, 2021, 11:36pm UTC](https://discuss.elastic.co/t/not-able-to-connect-kibana-to-remote-instance/287859 "2021-10-29T23:36:56Z")

</div>

Got this error not sure why. kibana\_1 | {"type":"log","@timestamp":"2021-10-27T22:59:48Z","tags":\["info","plugins-system"\],"pid":8,"message":"Setting up \[2\] plugins: \[inspector,data\]"} kibana\_1 | {"type":"log","@times…

---

## [Timefilter refresh issues on Chromium and edge browsers](https://discuss.elastic.co/t/timefilter-refresh-issues-on-chromium-and-edge-browsers/287933)

<div class="topic-metadata">

**Author:** [@susmeeta](https://discuss.elastic.co/u/susmeeta)\
**Replies:** 1\
**Last updated:** [October 29, 2021, 11:18pm UTC](https://discuss.elastic.co/t/timefilter-refresh-issues-on-chromium-and-edge-browsers/287933 "2021-10-29T23:18:21Z")

</div>

We use Canvas dashboards on Kibana 7.9.1 and use time filters to retrieve data for different time period. We have been using Chrome browsers, but recently found that time filters and browsers are not editable on Chrome v…

---

## [TSVB is not working after ELK up gradation from 7.10 to 7.11.2 with the epoch time field](https://discuss.elastic.co/t/tsvb-is-not-working-after-elk-up-gradation-from-7-10-to-7-11-2-with-the-epoch-time-field/287928)

<div class="topic-metadata">

**Author:** [@anjilinga](https://discuss.elastic.co/u/anjilinga)\
**Replies:** 1\
**Last updated:** [October 29, 2021, 10:28pm UTC](https://discuss.elastic.co/t/tsvb-is-not-working-after-elk-up-gradation-from-7-10-to-7-11-2-with-the-epoch-time-field/287928 "2021-10-29T22:28:48Z")

</div>

Hi, ELK is upgraded from 7.10 to 7.11.2, TSVB is working as expected. It is simple tsvb configuration. the aggrgation is count and group by everthing. The time stamp of the indexpattern is date but it is in epoch time…

---

## [Increase "ignore\_above" value for message.keyword](https://discuss.elastic.co/t/increase-ignore-above-value-for-message-keyword/287962)

<div class="topic-metadata">

**Author:** [@enryoku](https://discuss.elastic.co/u/enryoku)\
**Replies:** 1\
**Last updated:** [October 29, 2021, 10:04pm UTC](https://discuss.elastic.co/t/increase-ignore-above-value-for-message-keyword/287962 "2021-10-29T22:04:21Z")

</div>

Hello, I am trying to increase the default value for "ignore\_above" from 256 to 1024 for the message.keyword field by adding a component index template in Elasticsearch and apply it to the base index pattern. My index …

---

## [Metricbeat & Mongo 5](https://discuss.elastic.co/t/metricbeat-mongo-5/288037)

<div class="topic-metadata">

**Author:** [@Ziemowit](https://discuss.elastic.co/u/Ziemowit)\
**Replies:** 0\
**Last updated:** [October 29, 2021, 9:18pm UTC](https://discuss.elastic.co/t/metricbeat-mongo-5/288037 "2021-10-29T21:18:08Z")

</div>

Hey I have a pretty simple config of Metric Beat metricbeat.modules: - module: mongodb enabled: true hosts: \[ "mongodb://root:secret@mongo" \] I run it in docker (also mongo itself runs in docker). And it work…

---

## [New Kibana reposting job goes in Pending state instead of Processing](https://discuss.elastic.co/t/new-kibana-reposting-job-goes-in-pending-state-instead-of-processing/288036)

<div class="topic-metadata">

**Author:** [@asim\_np](https://discuss.elastic.co/u/asim_np)\
**Replies:** 0\
**Last updated:** [October 29, 2021, 9:14pm UTC](https://discuss.elastic.co/t/new-kibana-reposting-job-goes-in-pending-state-instead-of-processing/288036 "2021-10-29T21:14:32Z")

</div>

Using ELK Stack 7.12.1, After deleting pending jobs from Kibana reposting using the below querry, POST /.reporting\*/\_delete\_by\_query { "query": { "bool": { "must\_not": { "exists":…

---

## [Emulate region map max(field) in Maps](https://discuss.elastic.co/t/emulate-region-map-max-field-in-maps/287863)

<div class="topic-metadata">

**Author:** [@Gustavo\_Llermaly](https://discuss.elastic.co/u/Gustavo_Llermaly)\
**Replies:** 2\
**Last updated:** [October 29, 2021, 7:38pm UTC](https://discuss.elastic.co/t/emulate-region-map-max-field-in-maps/287863 "2021-10-29T19:38:32Z")

</div>

Hello, I want to emulate the region map on a min field value, not the document count, but I can not get it with the New Maps layout because is grouping by document count. How can I get this old functionality? I just wa…

---

## [Fleet server Installation error](https://discuss.elastic.co/t/fleet-server-installation-error/287443)

<div class="topic-metadata">

**Author:** [@Ashwin\_Patil1](https://discuss.elastic.co/u/Ashwin_Patil1)\
**Replies:** 3\
**Last updated:** [October 29, 2021, 7:27pm UTC](https://discuss.elastic.co/t/fleet-server-installation-error/287443 "2021-10-29T19:27:00Z")

</div>

How do I trouble shoot this error? localhost:~/elastic-agent-7.15.0-linux-x86\_64 # sudo ./elastic-agent install --url=https://172.16.12.18:8220 \\ \> -f \\ \> --fleet-server-es=https://172.16.12.11:9200 \\ \> --fleet-serve…

---

## [Filebeat to rsyslog, it's possible?](https://discuss.elastic.co/t/filebeat-to-rsyslog-its-possible/288030)

<div class="topic-metadata">

**Author:** [@pi314](https://discuss.elastic.co/u/pi314)\
**Replies:** 1\
**Last updated:** [October 29, 2021, 7:05pm UTC](https://discuss.elastic.co/t/filebeat-to-rsyslog-its-possible/288030 "2021-10-29T19:05:25Z")

</div>

I need to know if it is possible to send a log from filebeat to rsyslog, if possible, can you tell me how? Regards,

---

## [Logstash not able to start with multiple pipelines](https://discuss.elastic.co/t/logstash-not-able-to-start-with-multiple-pipelines/288029)

<div class="topic-metadata">

**Author:** [@dyadav](https://discuss.elastic.co/u/dyadav)\
**Replies:** 0\
**Last updated:** [October 29, 2021, 6:04pm UTC](https://discuss.elastic.co/t/logstash-not-able-to-start-with-multiple-pipelines/288029 "2021-10-29T18:04:28Z")

</div>

I have setup logstash on EKS in AWS. Now, I am trying to setup multiple pipelines in it but it is not able to pick up my pipeline or just picks the main pipeline. Below are my configurations: ConfigMap apiVersion: v1 …

---

## [Unable to view Reporting section in Kibana Privileges](https://discuss.elastic.co/t/unable-to-view-reporting-section-in-kibana-privileges/287932)

<div class="topic-metadata">

**Author:** [@nate\_d](https://discuss.elastic.co/u/nate_d)\
**Replies:** 3\
**Last updated:** [October 29, 2021, 4:56pm UTC](https://discuss.elastic.co/t/unable-to-view-reporting-section-in-kibana-privileges/287932 "2021-10-29T16:56:58Z")

</div>

I'm having an issue where I want to provide reporting access to a role. I followed the steps given here - Configure reporting in Kibana | Kibana Guide \[7.15\] | Elastic - which says to disable reporting roles But then I…

---

## [How can I use query\_string to match both nested and non-nested fields at the same time?](https://discuss.elastic.co/t/how-can-i-use-query-string-to-match-both-nested-and-non-nested-fields-at-the-same-time/288023)

<div class="topic-metadata">

**Author:** [@Max\_Carey](https://discuss.elastic.co/u/Max_Carey)\
**Replies:** 0\
**Last updated:** [October 29, 2021, 4:43pm UTC](https://discuss.elastic.co/t/how-can-i-use-query-string-to-match-both-nested-and-non-nested-fields-at-the-same-time/288023 "2021-10-29T16:43:43Z")

</div>

I have an index with a mapping something like this: "email" : { "type" : "nested", "properties" : { "from" : { "type" : "text", "analyzer" : "lowercase\_keyword", "fielddata" : true }, "…

---

## [Version of elastic db and elastic API are different](https://discuss.elastic.co/t/version-of-elastic-db-and-elastic-api-are-different/288020)

<div class="topic-metadata">

**Author:** [@kathirnk2](https://discuss.elastic.co/u/kathirnk2)\
**Replies:** 1\
**Last updated:** [October 29, 2021, 4:38pm UTC](https://discuss.elastic.co/t/version-of-elastic-db-and-elastic-api-are-different/288020 "2021-10-29T16:38:56Z")

</div>

We are using elastic db version 6.3.1. In our spring boot application also, we have put the elastic api version as 6.3.1 in our build.gradle file. We recently upgraded our spring boot version from 2.1 to 2.4 We remove…

---

## [Adding a synthetic field to documents generated by Transforms](https://discuss.elastic.co/t/adding-a-synthetic-field-to-documents-generated-by-transforms/288014)

<div class="topic-metadata">

**Author:** [@romainneutron](https://discuss.elastic.co/u/romainneutron)\
**Replies:** 0\
**Last updated:** [October 29, 2021, 3:29pm UTC](https://discuss.elastic.co/t/adding-a-synthetic-field-to-documents-generated-by-transforms/288014 "2021-10-29T15:29:36Z")

</div>

Hello, I'm playing with Elastic Transforms (Create transform API | Elasticsearch Guide \[7.15\] | Elastic) I have questions about those: I've created a transform like this: PUT \_transform/transform\_test\_2s { "source"…

---

## [Bug when aggregating histogram fields](https://discuss.elastic.co/t/bug-when-aggregating-histogram-fields/288013)

<div class="topic-metadata">

**Author:** [@romainneutron](https://discuss.elastic.co/u/romainneutron)\
**Replies:** 0\
**Last updated:** [October 29, 2021, 3:24pm UTC](https://discuss.elastic.co/t/bug-when-aggregating-histogram-fields/288013 "2021-10-29T15:24:43Z")

</div>

Hello, I encounter an issue with some particular values using histogram aggregations: Here's a reproducer: PUT test-index { "mappings" : { "properties" : { "my\_histogram" : { "type" : "histogram" …

---

## [Kafka-logstash-elastic disaster resistant](https://discuss.elastic.co/t/kafka-logstash-elastic-disaster-resistant/287994)

<div class="topic-metadata">

**Author:** [@Mamol27](https://discuss.elastic.co/u/Mamol27)\
**Replies:** 2\
**Last updated:** [October 29, 2021, 2:45pm UTC](https://discuss.elastic.co/t/kafka-logstash-elastic-disaster-resistant/287994 "2021-10-29T14:45:47Z")

</div>

Hi! I am testing disaster resistant of pipeline kafka-\>logstash-\>elastic Logstash config input { kafka { bootstrap\_servers =\> "172.29.39.115:9093, 172.29.39.116:9093" topics =\> "test-test" #consumer\_thre…

---

## [Failed to parse a date field in Logstash](https://discuss.elastic.co/t/failed-to-parse-a-date-field-in-logstash/288008)

<div class="topic-metadata">

**Author:** [@dedi27](https://discuss.elastic.co/u/dedi27)\
**Replies:** 2\
**Last updated:** [October 29, 2021, 2:36pm UTC](https://discuss.elastic.co/t/failed-to-parse-a-date-field-in-logstash/288008 "2021-10-29T14:36:00Z")

</div>

Fail to parse a date field in Logstash Hello, I'm trying to parse a date field from a log file coming from an Exim Mail Server where I have a date string like this "2021-10-28 15:44:40". In my filter in Logstash, firs…

---

## [Logstash performance and jdbc\_streaming](https://discuss.elastic.co/t/logstash-performance-and-jdbc-streaming/288009)

<div class="topic-metadata">

**Author:** [@Roberto\_B](https://discuss.elastic.co/u/Roberto_B)\
**Replies:** 0\
**Last updated:** [October 29, 2021, 2:00pm UTC](https://discuss.elastic.co/t/logstash-performance-and-jdbc-streaming/288009 "2021-10-29T14:00:16Z")

</div>

Hi all, i'm using in this days Logstash (I love logstash if I could I would use it to make coffee too :upside\_down\_face: ), like an ETL get the data from mysql transform it enriching the data with multiple jdbc\_stream…

---

## [Kibana date format mapping](https://discuss.elastic.co/t/kibana-date-format-mapping/287597)

<div class="topic-metadata">

**Author:** [@mohsin106](https://discuss.elastic.co/u/mohsin106)\
**Replies:** 5\
**Last updated:** [October 29, 2021, 1:58pm UTC](https://discuss.elastic.co/t/kibana-date-format-mapping/287597 "2021-10-29T13:58:54Z")

</div>

Hi, I'm trying to configure a template inside Kibana for a date field but I don't see a date format that matches it. My date field looks like this: 2021-05-05 09:38:47 +0000 UTC If I map the date field as "text" insid…

---

## [Elastic Search Aggregations Slow](https://discuss.elastic.co/t/elastic-search-aggregations-slow/286701)

<div class="topic-metadata">

**Author:** [@Srini12](https://discuss.elastic.co/u/Srini12)\
**Replies:** 20\
**Last updated:** [October 29, 2021, 1:55pm UTC](https://discuss.elastic.co/t/elastic-search-aggregations-slow/286701 "2021-10-29T13:55:16Z")

</div>

Good day I have an Elasticsearch index with 50 million records in it. This is working as expected. If I add aggregations to my query it is taking quite a long time to get the results. Any advise ? Thanks in advance. K…

[Previous page](https://discuss.elastic.co/latest.md?page=1408)

[Next page](https://discuss.elastic.co/latest.md?page=1410)