# Latest

**URL:** https://discuss.elastic.co/latest.md?page=1423

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1424

---

## [Learning Modules that \*do not\* require cloud access?](https://discuss.elastic.co/t/learning-modules-that-do-not-require-cloud-access/287209)

<div class="topic-metadata">

**Author:** [@Mark3](https://discuss.elastic.co/u/Mark3)\
**Replies:** 5\
**Last updated:** [October 21, 2021, 2:03pm UTC](https://discuss.elastic.co/t/learning-modules-that-do-not-require-cloud-access/287209 "2021-10-21T14:03:49Z")

</div>

Hi, looking for some help, I can extend my Cloud access by 7 days but if possible would like to leave that towards the end of my learning slot, does anyone know which of these modules do not require Cloud access? Thanks…

---

## [Elasticsearch is not starting](https://discuss.elastic.co/t/elasticsearch-is-not-starting/287276)

<div class="topic-metadata">

**Author:** [@mangeshs](https://discuss.elastic.co/u/mangeshs)\
**Replies:** 5\
**Last updated:** [October 21, 2021, 1:42pm UTC](https://discuss.elastic.co/t/elasticsearch-is-not-starting/287276 "2021-10-21T13:42:32Z")

</div>

I want to start Elasticsearch on linux system and give command like below at bin path ./elasticsearch OpenJDK 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecated in version 9.0 and will likely be removed…

---

## [Return number of hits in field](https://discuss.elastic.co/t/return-number-of-hits-in-field/286101)

<div class="topic-metadata">

**Author:** [@LaySoft](https://discuss.elastic.co/u/LaySoft)\
**Replies:** 3\
**Last updated:** [October 21, 2021, 1:40pm UTC](https://discuss.elastic.co/t/return-number-of-hits-in-field/286101 "2021-10-21T13:40:28Z")

</div>

Hi! My mapping is: PUT /test { "mappings": { "properties": { "lufi": { "properties": { "duma": { "type": "keyword" …

---

## [Kibana dashboard feature](https://discuss.elastic.co/t/kibana-dashboard-feature/287128)

<div class="topic-metadata">

**Author:** [@SRIGURU\_VEL](https://discuss.elastic.co/u/SRIGURU_VEL)\
**Replies:** 2\
**Last updated:** [October 21, 2021, 1:27pm UTC](https://discuss.elastic.co/t/kibana-dashboard-feature/287128 "2021-10-21T13:27:06Z")

</div>

Hi Experts, During one of the training session with one customer. User came up with the query that - can we put security on the dashboard so it is not deleted. Scenario- Because we will have multiple dashboards for Wi…

---

## [Issue with Cisco Integration](https://discuss.elastic.co/t/issue-with-cisco-integration/287102)

<div class="topic-metadata">

**Author:** [@vdselastic](https://discuss.elastic.co/u/vdselastic)\
**Replies:** 2\
**Last updated:** [October 21, 2021, 12:55pm UTC](https://discuss.elastic.co/t/issue-with-cisco-integration/287102 "2021-10-21T12:55:02Z")

</div>

hi, I'm trying to make the cisco integration v0.11.5 works, but I have error with the ingest pipeline cisco.ios. Here's the error that I got when I put manually a document in the pipeline: { "root\_cause": \[ { …

---

## [Azure configuration for metricbeat](https://discuss.elastic.co/t/azure-configuration-for-metricbeat/287275)

<div class="topic-metadata">

**Author:** [@Nishant\_Saxena](https://discuss.elastic.co/u/Nishant_Saxena)\
**Replies:** 0\
**Last updated:** [October 21, 2021, 8:37am UTC](https://discuss.elastic.co/t/azure-configuration-for-metricbeat/287275 "2021-10-21T08:37:02Z")

</div>

I followed the instructions given on Azure Metricbeat But nowhere it is given that which Roles needs to be assigned in Azure to get the data. I'm facing this issue Not sure which permission needs to be given in azu…

---

## [Filebeat AWS module not fetching multi region logs](https://discuss.elastic.co/t/filebeat-aws-module-not-fetching-multi-region-logs/286711)

<div class="topic-metadata">

**Author:** [@ankitdevnalkar](https://discuss.elastic.co/u/ankitdevnalkar)\
**Replies:** 2\
**Last updated:** [October 21, 2021, 12:14pm UTC](https://discuss.elastic.co/t/filebeat-aws-module-not-fetching-multi-region-logs/286711 "2021-10-21T12:14:41Z")

</div>

I have configured multiple accounts of AWS with Filebeat AWS module(With help of this thread) to fetch Cloudtrail logs. However, I wonder I am getting only specific region logs. For example, I have configured an S3 noti…

---

## [Use converted timestamp from csv like index sufix](https://discuss.elastic.co/t/use-converted-timestamp-from-csv-like-index-sufix/287308)

<div class="topic-metadata">

**Author:** [@Alexey\_Nikolaev](https://discuss.elastic.co/u/Alexey_Nikolaev)\
**Replies:** 4\
**Last updated:** [October 21, 2021, 12:13pm UTC](https://discuss.elastic.co/t/use-converted-timestamp-from-csv-like-index-sufix/287308 "2021-10-21T12:13:14Z")

</div>

Hello! I have a lot of CISCO CDR files, about 500k. Its logs from clustef of CISCO CUCM, and I want to put it to indexes with name CUCM-CDR-{mm-yyyy}. Date I want to get from field named "dateTimeDisconnect". Can you he…

---

## [Matching documents with empty symbol in the end using regexp](https://discuss.elastic.co/t/matching-documents-with-empty-symbol-in-the-end-using-regexp/287023)

<div class="topic-metadata">

**Author:** [@111343](https://discuss.elastic.co/u/111343)\
**Replies:** 3\
**Last updated:** [October 21, 2021, 12:11pm UTC](https://discuss.elastic.co/t/matching-documents-with-empty-symbol-in-the-end-using-regexp/287023 "2021-10-21T12:11:47Z")

</div>

Hi I have an Elasticsearch document that can have various forms of the string "creative=". Logs that have good format look like "creative=xxx", and logs that have bad format look like "creative=". Example of bad log: h…

---

## [Capturing maximum unique count per second for each day](https://discuss.elastic.co/t/capturing-maximum-unique-count-per-second-for-each-day/287314)

<div class="topic-metadata">

**Author:** [@jevans78](https://discuss.elastic.co/u/jevans78)\
**Replies:** 0\
**Last updated:** [October 21, 2021, 12:07pm UTC](https://discuss.elastic.co/t/capturing-maximum-unique-count-per-second-for-each-day/287314 "2021-10-21T12:07:21Z")

</div>

Hi, I'm trying to get a representation of the number of unique events per second over a 3 month period. Default configuration auto-scales this to No. of events per 12 hours. Is there an easy way that I can display the …

---

## [Why only one of these queries returns a record?](https://discuss.elastic.co/t/why-only-one-of-these-queries-returns-a-record/287311)

<div class="topic-metadata">

**Author:** [@stexxen](https://discuss.elastic.co/u/stexxen)\
**Replies:** 1\
**Last updated:** [October 21, 2021, 12:02pm UTC](https://discuss.elastic.co/t/why-only-one-of-these-queries-returns-a-record/287311 "2021-10-21T12:02:56Z")

</div>

Could someone explain why these queries are not returning the same response? This first query using script returns no records GET /ind1/\_search { "query": { "bool": { "must": \[ { "script":…

---

## [Is Logstash beats input with multiline codec allowed or not?](https://discuss.elastic.co/t/is-logstash-beats-input-with-multiline-codec-allowed-or-not/287230)

<div class="topic-metadata">

**Author:** [@Rodrigo\_Jimenez](https://discuss.elastic.co/u/Rodrigo_Jimenez)\
**Replies:** 2\
**Last updated:** [October 21, 2021, 11:55am UTC](https://discuss.elastic.co/t/is-logstash-beats-input-with-multiline-codec-allowed-or-not/287230 "2021-10-21T11:55:33Z")

</div>

I know some of this might have been asked here before but Documentation and logs express differently. I want to fetch logs from AWS Cloudwatch. For that, i'm using filebeat's input. This input is not doing any kind of m…

---

## [Painless iterate over Nested Array](https://discuss.elastic.co/t/painless-iterate-over-nested-array/287312)

<div class="topic-metadata">

**Author:** [@Mandark1990](https://discuss.elastic.co/u/Mandark1990)\
**Replies:** 0\
**Last updated:** [October 21, 2021, 11:54am UTC](https://discuss.elastic.co/t/painless-iterate-over-nested-array/287312 "2021-10-21T11:54:51Z")

</div>

Hello Everyone, Am trying to write an ingest pipeline which will help me normalize a nested array into individual fields for better visualization in Kibana. As my current event structure doesn't allow me to build the vi…

---

## [Issue with number of values being displayed for vertical and horizontal bars in kibana](https://discuss.elastic.co/t/issue-with-number-of-values-being-displayed-for-vertical-and-horizontal-bars-in-kibana/286222)

<div class="topic-metadata">

**Author:** [@revati-chawla](https://discuss.elastic.co/u/revati-chawla)\
**Replies:** 7\
**Last updated:** [October 21, 2021, 11:51am UTC](https://discuss.elastic.co/t/issue-with-number-of-values-being-displayed-for-vertical-and-horizontal-bars-in-kibana/286222 "2021-10-21T11:51:57Z")

</div>

Hello, We are facing issues while visualising using vertical bars where the number of values being displayed on the x-axis are exceeding the limit defined in the size parameter. Version: 7.14.2 PFB a screenshot for yo…

---

## [Logstash doesn't open files](https://discuss.elastic.co/t/logstash-doesnt-open-files/287100)

<div class="topic-metadata">

**Author:** [@mrdiogon](https://discuss.elastic.co/u/mrdiogon)\
**Replies:** 8\
**Last updated:** [October 21, 2021, 11:32am UTC](https://discuss.elastic.co/t/logstash-doesnt-open-files/287100 "2021-10-21T11:32:04Z")

</div>

Hi everyone, I tried to install filebeat on a windows server which send logs to a logstash server on docker. But no indexes are created and it seems logstash doesn't get any input from logstash. Here's my configuration …

---

## [Logstash Handling Filter Errors](https://discuss.elastic.co/t/logstash-handling-filter-errors/287309)

<div class="topic-metadata">

**Author:** [@maltewhiite](https://discuss.elastic.co/u/maltewhiite)\
**Replies:** 2\
**Last updated:** [October 21, 2021, 11:31am UTC](https://discuss.elastic.co/t/logstash-handling-filter-errors/287309 "2021-10-21T11:31:20Z")

</div>

I want to handle errors in my Logstash Filter. How do I do that? And more importantly, where is the documentation? I can see there is Documentation here for Elastic Pipeline Error Handling: Is there something similar…

---

## [Reindex API changed \_version of docs](https://discuss.elastic.co/t/reindex-api-changed-version-of-docs/287305)

<div class="topic-metadata">

**Author:** [@d.silwon](https://discuss.elastic.co/u/d.silwon)\
**Replies:** 2\
**Last updated:** [October 21, 2021, 11:19am UTC](https://discuss.elastic.co/t/reindex-api-changed-version-of-docs/287305 "2021-10-21T11:19:17Z")

</div>

Dears, Why reindex API does not copy original doc \_version to new index? Is there any trick to force it? query: GET test/\_search?version=true { "query": { "match\_all": {} } } result: { "took" : 1, "timed\_ou…

---

## [Yet another issue using Kibana API to import Dashboard](https://discuss.elastic.co/t/yet-another-issue-using-kibana-api-to-import-dashboard/287088)

<div class="topic-metadata">

**Author:** [@skiefer](https://discuss.elastic.co/u/skiefer)\
**Replies:** 6\
**Last updated:** [October 21, 2021, 11:10am UTC](https://discuss.elastic.co/t/yet-another-issue-using-kibana-api-to-import-dashboard/287088 "2021-10-21T11:10:04Z")

</div>

I've read thru all the previous posts on the subject, and every google result I can find, but still can't get this running. I was provided a json file of Dashboard configuration to load into my environment. Kibana vers…

---

## [Logstash-output-elasticsearch load balancing not working when one of the nodes is down](https://discuss.elastic.co/t/logstash-output-elasticsearch-load-balancing-not-working-when-one-of-the-nodes-is-down/287300)

<div class="topic-metadata">

**Author:** [@preetish\_P](https://discuss.elastic.co/u/preetish_P)\
**Replies:** 0\
**Last updated:** [October 21, 2021, 10:09am UTC](https://discuss.elastic.co/t/logstash-output-elasticsearch-load-balancing-not-working-when-one-of-the-nodes-is-down/287300 "2021-10-21T10:09:22Z")

</div>

Hi Team, Currently we are working on negative testing of Elasticsearch multi-node clustering. Out current setup is: node 1: Elasticsearch,logstash,kibana node 2: Elasticsearch node 3: Elasticsearch the logstash on n…

---

## [Issues related to embedding dashboards for public consumption](https://discuss.elastic.co/t/issues-related-to-embedding-dashboards-for-public-consumption/286695)

<div class="topic-metadata">

**Author:** [@twright8](https://discuss.elastic.co/u/twright8)\
**Replies:** 2\
**Last updated:** [October 21, 2021, 9:55am UTC](https://discuss.elastic.co/t/issues-related-to-embedding-dashboards-for-public-consumption/286695 "2021-10-21T09:55:15Z")

</div>

Hi everyone, I'm trying to publicly display a 7.14 dashboard via iframe on the same domain. I have set up security, use an API key and everything works with anonymous access. However, there are several issues related t…

---

## [Not able to run Heartbeat with monitorType browser in Kubernetes](https://discuss.elastic.co/t/not-able-to-run-heartbeat-with-monitortype-browser-in-kubernetes/286824)

<div class="topic-metadata">

**Author:** [@Ben\_Stucke](https://discuss.elastic.co/u/Ben_Stucke)\
**Replies:** 2\
**Last updated:** [October 21, 2021, 8:41am UTC](https://discuss.elastic.co/t/not-able-to-run-heartbeat-with-monitortype-browser-in-kubernetes/286824 "2021-10-21T08:41:25Z")

</div>

I want to use the Synthetic Monitoring feature from Elastic. I have deployed Heartbeat on Kubernetes (manifest: https://raw.githubusercontent.com/elastic/beats/7.15/deploy/kubernetes/heartbeat-kubernetes.yaml) and added…

---

## [Elasticsearch Bucket script aggregation is not working with filter aggregation](https://discuss.elastic.co/t/elasticsearch-bucket-script-aggregation-is-not-working-with-filter-aggregation/287273)

<div class="topic-metadata">

**Author:** [@r.ganeshbabu](https://discuss.elastic.co/u/r.ganeshbabu)\
**Replies:** 0\
**Last updated:** [October 21, 2021, 8:31am UTC](https://discuss.elastic.co/t/elasticsearch-bucket-script-aggregation-is-not-working-with-filter-aggregation/287273 "2021-10-21T08:31:17Z")

</div>

Hi All, I am trying to calculate the percentage in Elasticsearch using bucket script and below is the query I have tried it in kibana, { "size": 0, "aggs": { "Bits": { "filters": { "filters": { "ItemBi…

---

## [How to monitor funtions within an application runnign on pods](https://discuss.elastic.co/t/how-to-monitor-funtions-within-an-application-runnign-on-pods/287269)

<div class="topic-metadata">

**Author:** [@kaleelcsa](https://discuss.elastic.co/u/kaleelcsa)\
**Replies:** 1\
**Last updated:** [October 21, 2021, 8:01am UTC](https://discuss.elastic.co/t/how-to-monitor-funtions-within-an-application-runnign-on-pods/287269 "2021-10-21T08:01:32Z")

</div>

how to monitor funtions within an application runnign on pods

---

## [Webhdfs output plugin: store\_interval\_in\_secs not used](https://discuss.elastic.co/t/webhdfs-output-plugin-store-interval-in-secs-not-used/285974)

<div class="topic-metadata">

**Author:** [@dkhwangbo](https://discuss.elastic.co/u/dkhwangbo)\
**Replies:** 2\
**Last updated:** [October 21, 2021, 7:29am UTC](https://discuss.elastic.co/t/webhdfs-output-plugin-store-interval-in-secs-not-used/285974 "2021-10-21T07:29:23Z")

</div>

store\_interval\_in\_secs is introduced in this link. but cannot find this variable in any code base of logstash and webhdfs output plugin. is it correct?

---

## [Health check of \[/usr/share/elasticsearch/data/nodes/0\] took \[10146ms\] which is above the warn threshold of \[5s\]](https://discuss.elastic.co/t/health-check-of-usr-share-elasticsearch-data-nodes-0-took-10146ms-which-is-above-the-warn-threshold-of-5s/287255)

<div class="topic-metadata">

**Author:** [@Farzad\_Ebrahimi](https://discuss.elastic.co/u/Farzad_Ebrahimi)\
**Replies:** 1\
**Last updated:** [October 21, 2021, 7:23am UTC](https://discuss.elastic.co/t/health-check-of-usr-share-elasticsearch-data-nodes-0-took-10146ms-which-is-above-the-warn-threshold-of-5s/287255 "2021-10-21T07:23:11Z")

</div>

Hi everyone, every day we faced to this log with level WARN: {"type": "server", "timestamp": "2021-10-20T03:13:18,747Z", "level": "WARN", "component": "o.e.m.f.FsHealthService", "cluster.name": "elasticsearch\_cluster",…

---

## [Add new button to visualizations' top navbar](https://discuss.elastic.co/t/add-new-button-to-visualizations-top-navbar/286931)

<div class="topic-metadata">

**Author:** [@aza-zil](https://discuss.elastic.co/u/aza-zil)\
**Replies:** 2\
**Last updated:** [October 21, 2021, 7:08am UTC](https://discuss.elastic.co/t/add-new-button-to-visualizations-top-navbar/286931 "2021-10-21T07:08:07Z")

</div>

I am creating a Kibana plugin, and I want to add a new plugin, so I need to add a button on the top navbar of the visualization pages. I have two questions: 1- how do I add the button? 2- how can I access the data/requ…

---

## [Filebeat crashed when processing messages from sqs queue](https://discuss.elastic.co/t/filebeat-crashed-when-processing-messages-from-sqs-queue/285145)

<div class="topic-metadata">

**Author:** [@pingz](https://discuss.elastic.co/u/pingz)\
**Replies:** 2\
**Last updated:** [October 21, 2021, 6:43am UTC](https://discuss.elastic.co/t/filebeat-crashed-when-processing-messages-from-sqs-queue/285145 "2021-10-21T06:43:57Z")

</div>

Hi: I am running filebeat 7.15.0 to process S3 object creation event messages from AWS SQS. The queue is configured to receive AWS ELB log files. After a few minutes, filebeat 7.15.0 crashed with the following error. T…

---

## [Timestamp filter logstash](https://discuss.elastic.co/t/timestamp-filter-logstash/287199)

<div class="topic-metadata">

**Author:** [@Paveltest](https://discuss.elastic.co/u/Paveltest)\
**Replies:** 4\
**Last updated:** [October 21, 2021, 6:07am UTC](https://discuss.elastic.co/t/timestamp-filter-logstash/287199 "2021-10-21T06:07:10Z")

</div>

I am trying to display the time from the message log, but the load time from logstash is coming out. The message looks like this: 9.17.20.121 - - \[11/Oct/2021:00:00:24 +0300\] 0.474 0.072 "POST /api/?AppType=1&AppVersi…

---

## [CentOS 7: Failed to Update Elasticsearch 7 with yum](https://discuss.elastic.co/t/centos-7-failed-to-update-elasticsearch-7-with-yum/287197)

<div class="topic-metadata">

**Author:** [@obi134](https://discuss.elastic.co/u/obi134)\
**Replies:** 2\
**Last updated:** [October 21, 2021, 5:40am UTC](https://discuss.elastic.co/t/centos-7-failed-to-update-elasticsearch-7-with-yum/287197 "2021-10-21T05:40:12Z")

</div>

Elasticsearch version ( bin/elasticsearch --version ): Version: 7.10.0, Build: default/rpm/51e9d6f22758d0374a0f3f5c6e8f3a7997850f96/2020-11-09T21:30:33.964949Z, JVM: 15.0.1 JVM version ( java -version ): openjdk versi…

---

## [Does http\_poller input plugin respond to backpressure from Logstash?](https://discuss.elastic.co/t/does-http-poller-input-plugin-respond-to-backpressure-from-logstash/287241)

<div class="topic-metadata">

**Author:** [@jhettich](https://discuss.elastic.co/u/jhettich)\
**Replies:** 0\
**Last updated:** [October 21, 2021, 2:10am UTC](https://discuss.elastic.co/t/does-http-poller-input-plugin-respond-to-backpressure-from-logstash/287241 "2021-10-21T02:10:54Z")

</div>

When using Logstash with a persistent queue, will the http\_poller input plugin pause polling for new data if the Logstash queue is blocked?

[Previous page](https://discuss.elastic.co/latest.md?page=1422)

[Next page](https://discuss.elastic.co/latest.md?page=1424)
