# Latest **URL:** https://discuss.elastic.co/latest.md?page=1443 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1444 --- ## [handleSQSMessage failed: json unmarshal sqs message body failed at offset 1 with syntax error: invalid character 'T' looking for beginning of value](https://discuss.elastic.co/t/handlesqsmessage-failed-json-unmarshal-sqs-message-body-failed-at-offset-1-with-syntax-error-invalid-character-t-looking-for-beginning-of-value/286249)
**Author:** [@EvanGertis](https://discuss.elastic.co/u/EvanGertis)\ **Replies:** 0\ **Last updated:** [October 8, 2021, 2:11pm UTC](https://discuss.elastic.co/t/handlesqsmessage-failed-json-unmarshal-sqs-message-body-failed-at-offset-1-with-syntax-error-invalid-character-t-looking-for-beginning-of-value/286249 "2021-10-08T14:11:11Z")
I am trying to trouble shoot an issue. I have a set of logs from ecs that are to be sent to an sqs queue. The container logs show that the logs are being sent. However, when I poll the sqs queue none of the messages are … --- ## [Elasticsearch installation](https://discuss.elastic.co/t/elasticsearch-installation/285415)
**Author:** [@eugestel](https://discuss.elastic.co/u/eugestel)\ **Replies:** 45\ **Last updated:** [October 8, 2021, 2:08pm UTC](https://discuss.elastic.co/t/elasticsearch-installation/285415 "2021-10-08T14:08:19Z")
Requesting for help with Elasticsearch. I installed Elasticsearch in my ubuntu server 20.04 but unable to get it to work. The command : systemctl status Elasticsearch.service yielded the following: $ systemctl status… --- ## [Paginating through results in a query that doesnt use sort](https://discuss.elastic.co/t/paginating-through-results-in-a-query-that-doesnt-use-sort/286160)
**Author:** [@John\_Mackey](https://discuss.elastic.co/u/John_Mackey)\ **Replies:** 3\ **Last updated:** [October 8, 2021, 1:46pm UTC](https://discuss.elastic.co/t/paginating-through-results-in-a-query-that-doesnt-use-sort/286160 "2021-10-08T13:46:51Z")
We have the below query that returns 15K results. How do we paginate through all the results From the examples for search\_after , it can be used only if we are sorting by a unique field in the query . We do not intend … --- ## [Get Laste Value of each host with Query DSL in Discover](https://discuss.elastic.co/t/get-laste-value-of-each-host-with-query-dsl-in-discover/286002)
**Author:** [@GinkoLucas](https://discuss.elastic.co/u/GinkoLucas)\ **Replies:** 3\ **Last updated:** [October 8, 2021, 12:55pm UTC](https://discuss.elastic.co/t/get-laste-value-of-each-host-with-query-dsl-in-discover/286002 "2021-10-08T12:55:46Z")
Hi, Actually i store logs in Elastic. I would like to get all the last log collected from each host in Discover. If there is 20 differents hosts, the Discover have to show me 20 logs. I think i can use Elasticsearch Qu… --- ## [When does minimum\_should\_match change default value?](https://discuss.elastic.co/t/when-does-minimum-should-match-change-default-value/286234)
**Author:** [@dinamic](https://discuss.elastic.co/u/dinamic)\ **Replies:** 0\ **Last updated:** [October 8, 2021, 12:10pm UTC](https://discuss.elastic.co/t/when-does-minimum-should-match-change-default-value/286234 "2021-10-08T12:10:50Z")
Hey guys :wave: We've upgraded from 6.8 to 7.10 recently and are still finding out issues. It seems like minimum\_should\_match behaviour has been silently updated. Consider the following repeatable example: PUT /test-b… --- ## [Create user with multiple roles(of different spaces) and having access to only single space](https://discuss.elastic.co/t/create-user-with-multiple-roles-of-different-spaces-and-having-access-to-only-single-space/284591)
**Author:** [@srinielk](https://discuss.elastic.co/u/srinielk)\ **Replies:** 10\ **Last updated:** [October 8, 2021, 12:20pm UTC](https://discuss.elastic.co/t/create-user-with-multiple-roles-of-different-spaces-and-having-access-to-only-single-space/284591 "2021-10-08T12:20:56Z")
please advise how to create user with multiple roles(of different spaces) and having access to only single space --- ## [Snapshot in s3 bucket not seen by other cluster](https://discuss.elastic.co/t/snapshot-in-s3-bucket-not-seen-by-other-cluster/286006)
**Author:** [@raphaelSeguin](https://discuss.elastic.co/u/raphaelSeguin)\ **Replies:** 3\ **Last updated:** [October 8, 2021, 11:22am UTC](https://discuss.elastic.co/t/snapshot-in-s3-bucket-not-seen-by-other-cluster/286006 "2021-10-08T11:22:02Z")
Hi, I'm using an s3 repository to snapshot a cluster. I was hoping to restore the snapshot on a remote cluster by registering a repository pointing to the same bucket. But the snapshot I took from he first cluster remai… --- ## [Alerting in Kibana](https://discuss.elastic.co/t/alerting-in-kibana/286212)
**Author:** [@josh12](https://discuss.elastic.co/u/josh12)\ **Replies:** 2\ **Last updated:** [October 8, 2021, 10:57am UTC](https://discuss.elastic.co/t/alerting-in-kibana/286212 "2021-10-08T10:57:10Z")
Hi all, i saw alerting is paid version like sending mail or slack. I saw there is alterntive which iselastalert2. However, there is elastalert as well .what the difference. I plan to use docker --- ## [APM (Dotnet) Agent support for arrays in Global Labels](https://discuss.elastic.co/t/apm-dotnet-agent-support-for-arrays-in-global-labels/286224)
**Author:** [@PeterDK](https://discuss.elastic.co/u/PeterDK)\ **Replies:** 0\ **Last updated:** [October 8, 2021, 10:32am UTC](https://discuss.elastic.co/t/apm-dotnet-agent-support-for-arrays-in-global-labels/286224 "2021-10-08T10:32:31Z")
Hello, in order to be able to give granular access to different teams for APM services, we would like to add an extra field that could be used in the document privileges of a user role. I thought that "Global Labels" c… --- ## [Parsed JSON object/hash requires a target configuration option](https://discuss.elastic.co/t/parsed-json-object-hash-requires-a-target-configuration-option/286217)
**Author:** [@ktpktr0](https://discuss.elastic.co/u/ktpktr0)\ **Replies:** 0\ **Last updated:** [October 8, 2021, 9:47am UTC](https://discuss.elastic.co/t/parsed-json-object-hash-requires-a-target-configuration-option/286217 "2021-10-08T09:47:06Z")
My cluster architecture is elk + Kafka + filebeat. Use the following configuration to parse JSON logs: input { kafka { bootstrap\_servers =\> "192.168.1.176:9092,192.168.1.178:9092,192.168.1.177:9092" cl… --- ## [Elastic Agent built-in Filebeat](https://discuss.elastic.co/t/elastic-agent-built-in-filebeat/286214)
**Author:** [@bil\_15](https://discuss.elastic.co/u/bil_15)\ **Replies:** 0\ **Last updated:** [October 8, 2021, 9:31am UTC](https://discuss.elastic.co/t/elastic-agent-built-in-filebeat/286214 "2021-10-08T09:31:24Z")
Hello! I've installed Elastic Agent on Ubuntu and enabled AuditD integration for it (it's attached to an agent) I left all the configurations by default. Now, when I'm trying to elastic\_agent.filebeat data stream I'm … --- ## [Read Last 3 moth Historic Log from Windows Events Log](https://discuss.elastic.co/t/read-last-3-moth-historic-log-from-windows-events-log/286182)
**Author:** [@rijinmp](https://discuss.elastic.co/u/rijinmp)\ **Replies:** 1\ **Last updated:** [October 8, 2021, 9:31am UTC](https://discuss.elastic.co/t/read-last-3-moth-historic-log-from-windows-events-log/286182 "2021-10-08T09:31:07Z")
I am planning to install winlog beat in one of my Windows host. How can we read last 3 month historic logs( logs generated before the winlogbeat installation) from windows event log. My requirement is to read the… --- ## [Nested query builder inside must\_not clause does not build inner hits](https://discuss.elastic.co/t/nested-query-builder-inside-must-not-clause-does-not-build-inner-hits/286210)
**Author:** [@cip999](https://discuss.elastic.co/u/cip999)\ **Replies:** 0\ **Last updated:** [October 8, 2021, 9:07am UTC](https://discuss.elastic.co/t/nested-query-builder-inside-must-not-clause-does-not-build-inner-hits/286210 "2021-10-08T09:07:25Z")
I encountered an unexpected behavior of ES when combining must\_not and nested. Let's say I have an index my\_index with the following schema: { "mappings": { "properties": { "normal\_field": { "type":… --- ## [Maximum number of shards reached on a single node cluster](https://discuss.elastic.co/t/maximum-number-of-shards-reached-on-a-single-node-cluster/286204)
**Author:** [@NoemieB](https://discuss.elastic.co/u/NoemieB)\ **Replies:** 2\ **Last updated:** [October 8, 2021, 8:40am UTC](https://discuss.elastic.co/t/maximum-number-of-shards-reached-on-a-single-node-cluster/286204 "2021-10-08T08:40:52Z")
Hello, When creating an Index, I get the following error : "this action would add \[2\] total shards, but this cluster currently has \[1000\]/\[1000\] maximum shards open;" I found out a few posts about this issue and checke… --- ## [New master is not getting selected](https://discuss.elastic.co/t/new-master-is-not-getting-selected/286194)
**Author:** [@NutaN\_Shrivastava](https://discuss.elastic.co/u/NutaN_Shrivastava)\ **Replies:** 3\ **Last updated:** [October 8, 2021, 8:40am UTC](https://discuss.elastic.co/t/new-master-is-not-getting-selected/286194 "2021-10-08T08:40:25Z")
I have created a cluster of 3 nodes, out of which 2 are data and master and 1 is only data node. Recently due to some technical glitch one of the master nodes was down, but through out we kept getting a log msg elastic… --- ## [Datastream index template not working](https://discuss.elastic.co/t/datastream-index-template-not-working/286201)
**Author:** [@Santhosh\_CT](https://discuss.elastic.co/u/Santhosh_CT)\ **Replies:** 0\ **Last updated:** [October 8, 2021, 8:12am UTC](https://discuss.elastic.co/t/datastream-index-template-not-working/286201 "2021-10-08T08:12:34Z")
I am trying to onboard datastream into my es cluster. I have created the ilm with necessary phases, created the index template and then creating the datastream. But I am stuck at one point and not able to go forward. I … --- ## [Options list control is not case sensitive](https://discuss.elastic.co/t/options-list-control-is-not-case-sensitive/285448)
**Author:** [@Rom1](https://discuss.elastic.co/u/Rom1)\ **Replies:** 2\ **Last updated:** [October 8, 2021, 8:01am UTC](https://discuss.elastic.co/t/options-list-control-is-not-case-sensitive/285448 "2021-10-08T08:01:43Z")
Hi all, I'm using the version 7.13.4 The answers I found for this topic don't resolve my problem. It seems that the 'options list' control is not case sensitive. My mapping is: ... "template" : { "settin… --- ## [How to parse different log in logstash configuration](https://discuss.elastic.co/t/how-to-parse-different-log-in-logstash-configuration/286142)
**Author:** [@Roccof97](https://discuss.elastic.co/u/Roccof97)\ **Replies:** 2\ **Last updated:** [October 8, 2021, 7:47am UTC](https://discuss.elastic.co/t/how-to-parse-different-log-in-logstash-configuration/286142 "2021-10-08T07:47:16Z")
Hello to all, i have a problem with activemq logos i have created different types of grok, but the problem is that sometimes the message is different with additional fields and consequently it is parsed incorrectly, i… --- ## [Extract concrete words with logstash](https://discuss.elastic.co/t/extract-concrete-words-with-logstash/286139)
**Author:** [@rodri.gz](https://discuss.elastic.co/u/rodri.gz)\ **Replies:** 2\ **Last updated:** [October 8, 2021, 7:38am UTC](https://discuss.elastic.co/t/extract-concrete-words-with-logstash/286139 "2021-10-08T07:38:38Z")
Hi! I was interested in knowing if with logstash I could find words that match a pattern and extract them from the message, without parsing the whole message. For example: there has been an error on the \*\*s123s\*\* mach… --- ## [How can we update value of a field in a document in a bulk not a single document](https://discuss.elastic.co/t/how-can-we-update-value-of-a-field-in-a-document-in-a-bulk-not-a-single-document/286192)
**Author:** [@1a2k3m](https://discuss.elastic.co/u/1a2k3m)\ **Replies:** 0\ **Last updated:** [October 8, 2021, 7:12am UTC](https://discuss.elastic.co/t/how-can-we-update-value-of-a-field-in-a-document-in-a-bulk-not-a-single-document/286192 "2021-10-08T07:12:15Z")
Hi team, i am a new joiner to this discussion, i want to update field of a document in Elasticsearch on Devtools. and i want update all the document in one go, i mean to say i want to update more that 10 document in one… --- ## [When disable close\_removed, why also need disable clean\_removed](https://discuss.elastic.co/t/when-disable-close-removed-why-also-need-disable-clean-removed/286188)
**Author:** [@honghong516](https://discuss.elastic.co/u/honghong516)\ **Replies:** 0\ **Last updated:** [October 8, 2021, 7:02am UTC](https://discuss.elastic.co/t/when-disable-close-removed-why-also-need-disable-clean-removed/286188 "2021-10-08T07:02:43Z")
close\_removed edit When this option is enabled, Filebeat closes the harvester when a file is removed. Normally a file should only be removed after it’s inactive for the duration specified by close\_inactive . However, if … --- ## [Missing DNS requests on Windows machine](https://discuss.elastic.co/t/missing-dns-requests-on-windows-machine/286067)
**Author:** [@nemhods](https://discuss.elastic.co/u/nemhods)\ **Replies:** 4\ **Last updated:** [October 8, 2021, 7:00am UTC](https://discuss.elastic.co/t/missing-dns-requests-on-windows-machine/286067 "2021-10-08T07:00:20Z")
Hey, I'm investigating outbound DNS connections from an Active Directory Domain Controller. It contacted the DNS server tm1.edgedns-tm.info which is apparently owned by Microsoft. Nothing overly suspicious, but I wante… --- ## [Highlight same field twice with different settings](https://discuss.elastic.co/t/highlight-same-field-twice-with-different-settings/286184)
**Author:** [@Sam\_Gaunt](https://discuss.elastic.co/u/Sam_Gaunt)\ **Replies:** 0\ **Last updated:** [October 8, 2021, 6:44am UTC](https://discuss.elastic.co/t/highlight-same-field-twice-with-different-settings/286184 "2021-10-08T06:44:06Z")
I would like to return multiple highlights of the same field but with different fragment sizes. One would have a smaller fragment size and be used as a preview for the user before they open the document to see the full r… --- ## [ElasticFleet randomly missing logs](https://discuss.elastic.co/t/elasticfleet-randomly-missing-logs/284949)
**Author:** [@RichardMatthews](https://discuss.elastic.co/u/RichardMatthews)\ **Replies:** 14\ **Last updated:** [October 8, 2021, 6:35am UTC](https://discuss.elastic.co/t/elasticfleet-randomly-missing-logs/284949 "2021-10-08T06:35:55Z")
Hey, We are running the Elasticsearch Operator on Kubernetes using Elasticsearch (7.14.1), Kibana (7.14.1) and ElasticAgent (7.14.1) in Fleet mode. We have noticed that we are missing logs intermittently from the agents… --- ## [Can I limit displayed search results to applicable sentences or paragraphs rather than entire document?](https://discuss.elastic.co/t/can-i-limit-displayed-search-results-to-applicable-sentences-or-paragraphs-rather-than-entire-document/286166)
**Author:** [@neergttocsdivad](https://discuss.elastic.co/u/neergttocsdivad)\ **Replies:** 1\ **Last updated:** [October 8, 2021, 5:05am UTC](https://discuss.elastic.co/t/can-i-limit-displayed-search-results-to-applicable-sentences-or-paragraphs-rather-than-entire-document/286166 "2021-10-08T05:05:09Z")
I have indexed 24 Jack Reacher books. Any successful search displays at least one book in its entirety. e.g.: } GET books4/\_search { "query": { "match\_phrase":{ "content": "deerfield nodded" } } } Is … --- ## [No matching indices found: No indices match pattern](https://discuss.elastic.co/t/no-matching-indices-found-no-indices-match-pattern/286108)
**Author:** [@driveirk](https://discuss.elastic.co/u/driveirk)\ **Replies:** 3\ **Last updated:** [October 8, 2021, 5:25am UTC](https://discuss.elastic.co/t/no-matching-indices-found-no-indices-match-pattern/286108 "2021-10-08T05:25:56Z")
I have a lot of index patterns and not all of them now have an index in the elasticity, after updating the kibana from 7.8.1 to 7.14.0 I cannot go to Management - Index Patterns because of: Heavy load during transition … --- ## [Is it possible to turn off "Elasticsearch built-in security features are not enabled" notifications?](https://discuss.elastic.co/t/is-it-possible-to-turn-off-elasticsearch-built-in-security-features-are-not-enabled-notifications/286167)
**Author:** [@neergttocsdivad](https://discuss.elastic.co/u/neergttocsdivad)\ **Replies:** 2\ **Last updated:** [October 8, 2021, 4:20am UTC](https://discuss.elastic.co/t/is-it-possible-to-turn-off-elasticsearch-built-in-security-features-are-not-enabled-notifications/286167 "2021-10-08T04:20:26Z")
I'm using ES on a stand-alone computer, without a wired or wireless network or internet connections. --- ## [ElasticSearch freezes suddenly and unable to respond](https://discuss.elastic.co/t/elasticsearch-freezes-suddenly-and-unable-to-respond/284256)
**Author:** [@Vishal\_Goel](https://discuss.elastic.co/u/Vishal_Goel)\ **Replies:** 11\ **Last updated:** [October 8, 2021, 3:52am UTC](https://discuss.elastic.co/t/elasticsearch-freezes-suddenly-and-unable-to-respond/284256 "2021-10-08T03:52:12Z")
Hi, We have ES OSS 7.0 running for more than couple of months. In last 15 days, ES froze and became very slow. It is almost unable to process any request. Setup: Single Node, Windows VM, 16 cores, 32GB RAM, ES Xmx 4G, … --- ## [Setup Metricbeat only for one module](https://discuss.elastic.co/t/setup-metricbeat-only-for-one-module/286145)
**Author:** [@GinkoLucas](https://discuss.elastic.co/u/GinkoLucas)\ **Replies:** 1\ **Last updated:** [October 8, 2021, 2:55am UTC](https://discuss.elastic.co/t/setup-metricbeat-only-for-one-module/286145 "2021-10-08T02:55:03Z")
Hi, Last time i set up metricbeat with two modules enabled. Metricbeat created all possible dashboards for me, even those for disabled modules. How can I ask metricbeat to create dashboards/saved object for only activa… --- ## [\[Filebeat\] Metadata (Content-Type octet-stream) in S3 file - silently ignores 'Publish event'](https://discuss.elastic.co/t/filebeat-metadata-content-type-octet-stream-in-s3-file-silently-ignores-publish-event/286082)
**Author:** [@Maksim](https://discuss.elastic.co/u/Maksim)\ **Replies:** 2\ **Last updated:** [October 7, 2021, 11:15pm UTC](https://discuss.elastic.co/t/filebeat-metadata-content-type-octet-stream-in-s3-file-silently-ignores-publish-event/286082 "2021-10-07T23:15:51Z")
First debug log: If Object-string like: 2021-10-06/2021-10-06T23:13:06.107Z-test@simulator.json filebeat silently drop output 2021-10-06T23:13:08.827Z DEBUG \[input.aws-s3.sqs\] awss3/sqs.go:77 Received 1 SQS messages. … [Previous page](https://discuss.elastic.co/latest.md?page=1442) [Next page](https://discuss.elastic.co/latest.md?page=1444)