# Latest **URL:** https://discuss.elastic.co/latest.md?page=1434 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1435 --- ## [If else return scripted field date field](https://discuss.elastic.co/t/if-else-return-scripted-field-date-field/286646)
**Author:** [@Surya\_Raviraj](https://discuss.elastic.co/u/Surya_Raviraj)\ **Replies:** 1\ **Last updated:** [October 14, 2021, 12:29pm UTC](https://discuss.elastic.co/t/if-else-return-scripted-field-date-field/286646 "2021-10-14T12:29:36Z")
Is it possible to do an if else return statement with dates? For example, if the date in the date column is 1/1/21 I want it to return Week 1. I tried doing that below but I am getting the error shown in the screenshot. … --- ## [Create an index rate alert](https://discuss.elastic.co/t/create-an-index-rate-alert/286564)
**Author:** [@pingz](https://discuss.elastic.co/u/pingz)\ **Replies:** 1\ **Last updated:** [October 14, 2021, 12:04pm UTC](https://discuss.elastic.co/t/create-an-index-rate-alert/286564 "2021-10-14T12:04:44Z")
Hi there: I would like to create a rule to send alert if there is an index in the system with index rate in the last 10 min exceeds a threshold value. I can see index rate from stack monitoring for each index, but how … --- ## [Unable to access Kibana in T-Pot](https://discuss.elastic.co/t/unable-to-access-kibana-in-t-pot/286409)
**Author:** [@paulap2](https://discuss.elastic.co/u/paulap2)\ **Replies:** 3\ **Last updated:** [October 14, 2021, 11:46am UTC](https://discuss.elastic.co/t/unable-to-access-kibana-in-t-pot/286409 "2021-10-14T11:46:25Z")
Hi, I am setting up T-POT for a uni project. I followed this tutorial step by step: Setup a T-POT Honeypot on Azure in less than 30 minutes - YouTube It worked for me over the weekend but today my kibana was giving me … --- ## [Elasticsearch and Strapi: How to create "geo\_point" type fields using Strapi cms](https://discuss.elastic.co/t/elasticsearch-and-strapi-how-to-create-geo-point-type-fields-using-strapi-cms/286714)
**Author:** [@GuiPerim](https://discuss.elastic.co/u/GuiPerim)\ **Replies:** 0\ **Last updated:** [October 14, 2021, 11:25am UTC](https://discuss.elastic.co/t/elasticsearch-and-strapi-how-to-create-geo-point-type-fields-using-strapi-cms/286714 "2021-10-14T11:25:12Z")
Hello! I'm pretty new on the React/NodeJs world. That being said, i'm working on an application that is using Strapi (v3.6.7) as the CMS and we are also using Elasticsearch (v7.15). And i'm using the following puglin to… --- ## [Link to trace no longer working if trace occurred more than 15 minutes ago after upgrade from 7.12.1 to 7.15.0](https://discuss.elastic.co/t/link-to-trace-no-longer-working-if-trace-occurred-more-than-15-minutes-ago-after-upgrade-from-7-12-1-to-7-15-0/286659)
**Author:** [@rrupp\_mgp](https://discuss.elastic.co/u/rrupp_mgp)\ **Replies:** 4\ **Last updated:** [October 14, 2021, 9:21am UTC](https://discuss.elastic.co/t/link-to-trace-no-longer-working-if-trace-occurred-more-than-15-minutes-ago-after-upgrade-from-7-12-1-to-7-15-0/286659 "2021-10-14T09:21:31Z")
Kibana version: 7.15.0 Elasticsearch version: 7.15.0 APM Server version: 7.15.0 APM Agent language and version: OpenTelemetry Java Agent Browser version: OSX Chrome 93.0.4577.82 Original install method (e.g. do… --- ## [Since we moved 7.15 "Pushing flush onto pipeline." and files are not parsed](https://discuss.elastic.co/t/since-we-moved-7-15-pushing-flush-onto-pipeline-and-files-are-not-parsed/286605)
**Author:** [@fabeau](https://discuss.elastic.co/u/fabeau)\ **Replies:** 2\ **Last updated:** [October 14, 2021, 9:14am UTC](https://discuss.elastic.co/t/since-we-moved-7-15-pushing-flush-onto-pipeline-and-files-are-not-parsed/286605 "2021-10-14T09:14:30Z")
We deployed logstash config files on a new server running 7.15 from a 7.11 server working perfectly . We validated .conf files in command line and everything is fine. we parse some log files locally on the server and … --- ## [\[Help\] Display Concurrency between 2 date-type](https://discuss.elastic.co/t/help-display-concurrency-between-2-date-type/286351)
**Author:** [@hoaf13](https://discuss.elastic.co/u/hoaf13)\ **Replies:** 2\ **Last updated:** [October 14, 2021, 8:27am UTC](https://discuss.elastic.co/t/help-display-concurrency-between-2-date-type/286351 "2021-10-14T08:27:07Z")
I have 2 date-type: "timestamp\_pickup\_at" : "2021-09-06T04:10:28.070Z", "timestamp\_hangup\_at" : "2021-09-06T04:10:36.022Z" I want to visualize that as a conccurency date histogram. I refer to this topic but not work. … --- ## [Problems with Shard allocation](https://discuss.elastic.co/t/problems-with-shard-allocation/286687)
**Author:** [@Olakunle\_Oladimeji](https://discuss.elastic.co/u/Olakunle_Oladimeji)\ **Replies:** 2\ **Last updated:** [October 14, 2021, 8:09am UTC](https://discuss.elastic.co/t/problems-with-shard-allocation/286687 "2021-10-14T08:09:25Z")
We currently run Elasticsearch version 7.6.1 on three machines with roles dilm for all. Our index is divided into three shards and 2 replicas. Lately we've noticed that shards are not allocated on one node. When I run … --- ## [Ingest pipeline - processor - can't reuse fieldname after rename of fieldname](https://discuss.elastic.co/t/ingest-pipeline-processor-cant-reuse-fieldname-after-rename-of-fieldname/286677)
**Author:** [@justroll](https://discuss.elastic.co/u/justroll)\ **Replies:** 0\ **Last updated:** [October 14, 2021, 6:58am UTC](https://discuss.elastic.co/t/ingest-pipeline-processor-cant-reuse-fieldname-after-rename-of-fieldname/286677 "2021-10-14T06:58:05Z")
Hi I got a logfeed coming from a black box (aka. i can't change a bit in datastructure) and arriving at me ES. We use in all our logging the field "log" to structure our data to (after grok) like log.level, log.thread,… --- ## [Shards Not Being Allocated To Nodes](https://discuss.elastic.co/t/shards-not-being-allocated-to-nodes/286587)
**Author:** [@vilakazil](https://discuss.elastic.co/u/vilakazil)\ **Replies:** 6\ **Last updated:** [October 14, 2021, 6:54am UTC](https://discuss.elastic.co/t/shards-not-being-allocated-to-nodes/286587 "2021-10-14T06:54:04Z")
Hope to get assistance here as I have been struggling. I have 11 nodes that run Elasticsearch, with 2 master node. 5 shards and 1 replica (default) We recently ran patches on the nodes and upgraded the .Net software, t… --- ## [Auto Referesh or Trigger the refresh to show the updated results](https://discuss.elastic.co/t/auto-referesh-or-trigger-the-refresh-to-show-the-updated-results/285915)
**Author:** [@anuragchoudhary01](https://discuss.elastic.co/u/anuragchoudhary01)\ **Replies:** 3\ **Last updated:** [October 14, 2021, 6:00am UTC](https://discuss.elastic.co/t/auto-referesh-or-trigger-the-refresh-to-show-the-updated-results/285915 "2021-10-14T06:00:02Z")
Hi, I have one use case in which when I add the data to the AppSearch Engine from UI, it should reflect the changes on the Result View section(using Reference UI) at that moment. Currently, I need to refresh the page, … --- ## [Kibana shows internal server error after implementing Authentication](https://discuss.elastic.co/t/kibana-shows-internal-server-error-after-implementing-authentication/286308)
**Author:** [@Apoorv\_Singh](https://discuss.elastic.co/u/Apoorv_Singh)\ **Replies:** 2\ **Last updated:** [October 14, 2021, 5:16am UTC](https://discuss.elastic.co/t/kibana-shows-internal-server-error-after-implementing-authentication/286308 "2021-10-14T05:16:21Z")
I am trying to integrate my kibana dashboard into my website without password. To secure it I am using the auth\_request module of Nginx. But I am stuck at this error - Version: 7.14.1 Build: 42892 Error: Internal Server… --- ## [Newb question re: Enterprise Search Using Docker](https://discuss.elastic.co/t/newb-question-re-enterprise-search-using-docker/286667)
**Author:** [@neergttocsdivad](https://discuss.elastic.co/u/neergttocsdivad)\ **Replies:** 4\ **Last updated:** [October 14, 2021, 4:59am UTC](https://discuss.elastic.co/t/newb-question-re-enterprise-search-using-docker/286667 "2021-10-14T04:59:03Z")
Ref.: Running Enterprise Search Using Docker | Elastic Enterprise Search Documentation \[7.15\] | Elastic Says " Create a docker-compose.yml file replacing the {version} value with the product version you want to use:" I… --- ## [Filebeat not send logs to logstash on kubernetes](https://discuss.elastic.co/t/filebeat-not-send-logs-to-logstash-on-kubernetes/286671)
**Author:** [@dhody\_rhmd](https://discuss.elastic.co/u/dhody_rhmd)\ **Replies:** 0\ **Last updated:** [October 14, 2021, 4:32am UTC](https://discuss.elastic.co/t/filebeat-not-send-logs-to-logstash-on-kubernetes/286671 "2021-10-14T04:32:45Z")
Hello, I'm trying to send kubernetes logs with Filebeat and Logstash. I do have some deployment on the same namespace. I tried the suggested configuration for filebeat.yml from elastic in this \[link\].(https://raw.github… --- ## [Constant API Key Failures in Logs after enabling security](https://discuss.elastic.co/t/constant-api-key-failures-in-logs-after-enabling-security/286668)
**Author:** [@Heroj04](https://discuss.elastic.co/u/Heroj04)\ **Replies:** 1\ **Last updated:** [October 14, 2021, 4:16am UTC](https://discuss.elastic.co/t/constant-api-key-failures-in-logs-after-enabling-security/286668 "2021-10-14T04:16:38Z")
Just recently set up an Elasticsearch server. after enabling security and SSL I am seeing just constant apikey errors in the logs. Even if I shut down all other parts of the system (kibana/beats/fleet) they are still co… --- ## [Run logstash on ram](https://discuss.elastic.co/t/run-logstash-on-ram/286615)
**Author:** [@hatuli](https://discuss.elastic.co/u/hatuli)\ **Replies:** 1\ **Last updated:** [October 13, 2021, 10:09pm UTC](https://discuss.elastic.co/t/run-logstash-on-ram/286615 "2021-10-13T22:09:29Z")
Hi, im working with fluentbit to export the logs from my k8s env, then to kafka, logstash and in the end to elasticearch, the massages are indexing inside ES but after a while they stop to index, i conf heap to 8G, but s… --- ## [Can't enroll MacOS agent](https://discuss.elastic.co/t/cant-enroll-macos-agent/283601)
**Author:** [@hilt86](https://discuss.elastic.co/u/hilt86)\ **Replies:** 11\ **Last updated:** [October 13, 2021, 9:05pm UTC](https://discuss.elastic.co/t/cant-enroll-macos-agent/283601 "2021-10-13T21:05:38Z")
Me again..I'm trying to enroll a macOS agent and when I run the enroll command I get the following : Error: fail to enroll: fail to execute request to fleet-server: fail to decode enrollment response: context canceled E… --- ## [Drilldown on Kibana Scripted Fields](https://discuss.elastic.co/t/drilldown-on-kibana-scripted-fields/285520)
**Author:** [@mightykat](https://discuss.elastic.co/u/mightykat)\ **Replies:** 2\ **Last updated:** [October 13, 2021, 8:32pm UTC](https://discuss.elastic.co/t/drilldown-on-kibana-scripted-fields/285520 "2021-10-13T20:32:18Z")
Kibana: 7.1.1 Background: I created a few Scripted Fields in Kibana using painless to parse a list of key/value pairs. I use different scripts to produce data formats to enable various visualizations. For example: P… --- ## [Istio with Elastic Stack for Observability](https://discuss.elastic.co/t/istio-with-elastic-stack-for-observability/286607)
**Author:** [@denukak2000](https://discuss.elastic.co/u/denukak2000)\ **Replies:** 0\ **Last updated:** [October 13, 2021, 10:42am UTC](https://discuss.elastic.co/t/istio-with-elastic-stack-for-observability/286607 "2021-10-13T10:42:55Z")
I am currently using Istio as service mesh with Kubernetes (On Prem). I want to implement observability infrastructure with Elastic Stack , I know Istio is supported for jaeger and Prometheus, But I have to capture dist… --- ## [Fleet Kibana Integration -\> To enable this usage, set xpack.enabled: true on the package config](https://discuss.elastic.co/t/fleet-kibana-integration-to-enable-this-usage-set-xpack-enabled-true-on-the-package-config/286660)
**Author:** [@zx8086](https://discuss.elastic.co/u/zx8086)\ **Replies:** 0\ **Last updated:** [October 13, 2021, 8:19pm UTC](https://discuss.elastic.co/t/fleet-kibana-integration-to-enable-this-usage-set-xpack-enabled-true-on-the-package-config/286660 "2021-10-13T20:19:26Z")
Hi, How is this done with a Fleet Managed Setup ? xpack.enabled: true Would like to see the Kibana Stats in Stack Monitoring --- ## [How to perform natural sort on a field in Elasticsearch?](https://discuss.elastic.co/t/how-to-perform-natural-sort-on-a-field-in-elasticsearch/285854)
**Author:** [@tranindigo](https://discuss.elastic.co/u/tranindigo)\ **Replies:** 1\ **Last updated:** [October 13, 2021, 8:04pm UTC](https://discuss.elastic.co/t/how-to-perform-natural-sort-on-a-field-in-elasticsearch/285854 "2021-10-13T20:04:02Z")
I have an Elasticsearch keyword field called LocationNumber that I want to sort "alphanumerically" (or "naturally") so that it is easy for users to read. I have been researching this for days and couldn't find any real d… --- ## [How to work with Query Results in Vega](https://discuss.elastic.co/t/how-to-work-with-query-results-in-vega/286643)
**Author:** [@nsimi](https://discuss.elastic.co/u/nsimi)\ **Replies:** 9\ **Last updated:** [October 13, 2021, 7:47pm UTC](https://discuss.elastic.co/t/how-to-work-with-query-results-in-vega/286643 "2021-10-13T19:47:10Z")
Hello all, I am directly querying elasticseach from my vega visualization, and I am looking for some education on how to access the results of my query. Can anyone provide an example or point me at something that shows/… --- ## [What is the grok pattern that can match variable length documents from a single log file?](https://discuss.elastic.co/t/what-is-the-grok-pattern-that-can-match-variable-length-documents-from-a-single-log-file/285338)
**Author:** [@shi](https://discuss.elastic.co/u/shi)\ **Replies:** 8\ **Last updated:** [October 13, 2021, 7:41pm UTC](https://discuss.elastic.co/t/what-is-the-grok-pattern-that-can-match-variable-length-documents-from-a-single-log-file/285338 "2021-10-13T19:41:38Z")
I am having records/documents of variable lengths, say 3 types of logs coming in a single log fie. What is the grok pattern that can match variable length documents from a single log file? This grok pattern can be used… --- ## [Please help me understand Workplace Search results](https://discuss.elastic.co/t/please-help-me-understand-workplace-search-results/286652)
**Author:** [@Mymail\_Cpn](https://discuss.elastic.co/u/Mymail_Cpn)\ **Replies:** 2\ **Last updated:** [October 13, 2021, 7:39pm UTC](https://discuss.elastic.co/t/please-help-me-understand-workplace-search-results/286652 "2021-10-13T19:39:19Z")
Hello, I am new to Elasticsearch and currently I am exploring workplace search. I have created couple of documents to search for. I am wondering why my search is showing multiple results? My documents has partnumber (… --- ## [Some Fields of index not listed in kibana - discover- under avilable fields , , eventhough shown in in index using GET command](https://discuss.elastic.co/t/some-fields-of-index-not-listed-in-kibana-discover-under-avilable-fields-eventhough-shown-in-in-index-using-get-command/286545)
**Author:** [@shi](https://discuss.elastic.co/u/shi)\ **Replies:** 2\ **Last updated:** [October 13, 2021, 6:43pm UTC](https://discuss.elastic.co/t/some-fields-of-index-not-listed-in-kibana-discover-under-avilable-fields-eventhough-shown-in-in-index-using-get-command/286545 "2021-10-13T18:43:07Z")
Following log entries are put in index 2021-09-27T03:35:53.263029+05:30 \_gateway devname="PPFW01" 2021-09-27T03:42:22.549689+05:30 \_gateway devname="PPFW02" 2021-09-27T04:02:36.089881+05:30 \_gateway devname="PPFW03" … --- ## [FireEye HX for Endpoint protection Vs Elastic endpoint security](https://discuss.elastic.co/t/fireeye-hx-for-endpoint-protection-vs-elastic-endpoint-security/285784)
**Author:** [@mruthyu](https://discuss.elastic.co/u/mruthyu)\ **Replies:** 1\ **Last updated:** [October 13, 2021, 6:36pm UTC](https://discuss.elastic.co/t/fireeye-hx-for-endpoint-protection-vs-elastic-endpoint-security/285784 "2021-10-13T18:36:55Z")
Do we have the comparison details of FireEye HX for Endpoint protection Vs Elastic endpoint security opensource? --- ## [Adding sort to ES query returns inaccurate results?](https://discuss.elastic.co/t/adding-sort-to-es-query-returns-inaccurate-results/286549)
**Author:** [@bensalerno](https://discuss.elastic.co/u/bensalerno)\ **Replies:** 4\ **Last updated:** [October 13, 2021, 6:25pm UTC](https://discuss.elastic.co/t/adding-sort-to-es-query-returns-inaccurate-results/286549 "2021-10-13T18:25:38Z")
My queries are successfully returning the exact results that I am looking for. { "size":100, "from":0, "query":{ "bool":{ "must":\[ { "bool":{ "should"… --- ## [Does it make sense to add timestamp in "index sorting"?](https://discuss.elastic.co/t/does-it-make-sense-to-add-timestamp-in-index-sorting/286551)
**Author:** [@linkerc](https://discuss.elastic.co/u/linkerc)\ **Replies:** 2\ **Last updated:** [October 13, 2021, 6:05pm UTC](https://discuss.elastic.co/t/does-it-make-sense-to-add-timestamp-in-index-sorting/286551 "2021-10-13T18:05:05Z")
The documentation suggests using low cardinality field(s) for index sorting. We often search documents with some low cardinality ID (like site or org) and then with timestamp. Does it make sense to include timestamp in… --- ## [Can I disable replicas in when index is getting data from logstash?](https://discuss.elastic.co/t/can-i-disable-replicas-in-when-index-is-getting-data-from-logstash/286647)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 2\ **Last updated:** [October 13, 2021, 5:10pm UTC](https://discuss.elastic.co/t/can-i-disable-replicas-in-when-index-is-getting-data-from-logstash/286647 "2021-10-13T17:10:15Z")
Hi, I have a large quantity of data being indexed in elastic, is taking a long time to do it, so it is posible to disable replicas when data is being indexed to Elasticsearch? can this create any problem? it will speed u… --- ## [Grok regex pattern for symbols?](https://discuss.elastic.co/t/grok-regex-pattern-for-symbols/286624)
**Author:** [@helloworld1234](https://discuss.elastic.co/u/helloworld1234)\ **Replies:** 5\ **Last updated:** [October 13, 2021, 4:44pm UTC](https://discuss.elastic.co/t/grok-regex-pattern-for-symbols/286624 "2021-10-13T16:44:24Z")
Lets say I have a string: "petBreed":"dachshund" "petName":"rufus" "petAge":"12" The value is not constant and can vary in length and content. And i want to use grok overwrite to remove rufus from the raw string. So… [Previous page](https://discuss.elastic.co/latest.md?page=1433) [Next page](https://discuss.elastic.co/latest.md?page=1435)