# Latest **URL:** https://discuss.elastic.co/latest.md?page=1459 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1460 --- ## [APM java agent not capturing background process](https://discuss.elastic.co/t/apm-java-agent-not-capturing-background-process/284249)
**Author:** [@Ilham\_Sulaksono](https://discuss.elastic.co/u/Ilham_Sulaksono)\ **Replies:** 6\ **Last updated:** [September 28, 2021, 2:55am UTC](https://discuss.elastic.co/t/apm-java-agent-not-capturing-background-process/284249 "2021-09-28T02:55:27Z")
Kibana version: 7.13.3 Elasticsearch version: 7.13.3 APM Server version: 7.13.3 APM Agent language and version: Java 1.25.0 Browser version: Chrome Version 93.0.4577.63 Original install method (e.g. download page, y… --- ## [Help sending emails separately with only one watcher running (using forearch)](https://discuss.elastic.co/t/help-sending-emails-separately-with-only-one-watcher-running-using-forearch/285296)
**Author:** [@RaonyO](https://discuss.elastic.co/u/RaonyO)\ **Replies:** 0\ **Last updated:** [September 28, 2021, 2:01am UTC](https://discuss.elastic.co/t/help-sending-emails-separately-with-only-one-watcher-running-using-forearch/285296 "2021-09-28T02:01:49Z")
I need help in the structure of my watcher, I'm trying to create an alert where a notification is sent by email, but the notifications are going in message form (in the same initial email) and when it reaches 100, it's c… --- ## [Monitoring Process in Windows](https://discuss.elastic.co/t/monitoring-process-in-windows/285291)
**Author:** [@bevano](https://discuss.elastic.co/u/bevano)\ **Replies:** 2\ **Last updated:** [September 28, 2021, 1:46am UTC](https://discuss.elastic.co/t/monitoring-process-in-windows/285291 "2021-09-28T01:46:18Z")
Hi All, Currently trying to figure out how to monitor whether a Windows application is Up or Down. Currently using a filter to narrow down it to a specific agent.name (My Server) and process.name (application name) and… --- ## [差分集計のグラフ化方法](https://discuss.elastic.co/t/topic/285204)
**Author:** [@yuta.yokoyama](https://discuss.elastic.co/u/yuta.yokoyama)\ **Replies:** 4\ **Last updated:** [September 28, 2021, 12:32am UTC](https://discuss.elastic.co/t/topic/285204 "2021-09-28T00:32:28Z")
初めまして。 初歩的な質問かもしれませんが、 以下のようなJsonで登録し、エラーコード事に StartTimeとEndTime差分合計値をグラフ化したいと考えていますが、 Kibanaで差分の合計を指定する方法がわかりません。 どうすればよいでしょうか。 { "errorCode": "ERR0001", "Time": { "StartTime": "2021/06/29 00:59:57", "EndTim… --- ## [Decommissioning a node using cluster.routing.allocation.exclude.\_name](https://discuss.elastic.co/t/decommissioning-a-node-using-cluster-routing-allocation-exclude-name/284946)
**Author:** [@linkerc](https://discuss.elastic.co/u/linkerc)\ **Replies:** 2\ **Last updated:** [September 28, 2021, 12:16am UTC](https://discuss.elastic.co/t/decommissioning-a-node-using-cluster-routing-allocation-exclude-name/284946 "2021-09-28T00:16:27Z")
Why doesn't the primary shard switched away from the node being decommissioned? When I use cluster.routing.allocation.exclude.\_name to exclude a node from participating the cluster (and be removed eventually), I noticed… --- ## [Configuring Spaces - Identifying Permissions for Role Access](https://discuss.elastic.co/t/configuring-spaces-identifying-permissions-for-role-access/285107)
**Author:** [@tthiry](https://discuss.elastic.co/u/tthiry)\ **Replies:** 5\ **Last updated:** [September 28, 2021, 12:11am UTC](https://discuss.elastic.co/t/configuring-spaces-identifying-permissions-for-role-access/285107 "2021-09-28T00:11:04Z")
Hello, Short time reader, first time caller... I am new to Elasticsearch and I am stumbling around. I am following the best practice of creating separate spaces for different user groups. For example I have a space for… --- ## [Can i tronsform alert or event to IDMEF(Intrusion Detection Message Exchange Format)](https://discuss.elastic.co/t/can-i-tronsform-alert-or-event-to-idmef-intrusion-detection-message-exchange-format/285287)
**Author:** [@bonus4u\_space](https://discuss.elastic.co/u/bonus4u_space)\ **Replies:** 0\ **Last updated:** [September 27, 2021, 10:44pm UTC](https://discuss.elastic.co/t/can-i-tronsform-alert-or-event-to-idmef-intrusion-detection-message-exchange-format/285287 "2021-09-27T22:44:17Z")
i want to normalize alerts from wireshark json format to the idmef standard format .any idea? --- ## [Single character column width in table view](https://discuss.elastic.co/t/single-character-column-width-in-table-view/285290)
**Author:** [@Chris\_Stone](https://discuss.elastic.co/u/Chris_Stone)\ **Replies:** 2\ **Last updated:** [September 27, 2021, 11:22pm UTC](https://discuss.elastic.co/t/single-character-column-width-in-table-view/285290 "2021-09-27T23:22:33Z")
After upgrading to 7.15 from 7.13, I see that many records in Discovery have a width of 1 character for the "field" column in table view. The json view looks fine. I see the issue in both the "classic" and updated views.… --- ## [\[request query.pattern\]: expected value of type \[string\] but got \[undefined\]](https://discuss.elastic.co/t/request-query-pattern-expected-value-of-type-string-but-got-undefined/284953)
**Author:** [@ewitkop](https://discuss.elastic.co/u/ewitkop)\ **Replies:** 6\ **Last updated:** [September 27, 2021, 10:58pm UTC](https://discuss.elastic.co/t/request-query-pattern-expected-value-of-type-string-but-got-undefined/284953 "2021-09-27T22:58:48Z")
I cannot seem to create an index pattern. There are over 600 fields and I cannot tell which one Kibana has an issue with. I have Kibana logging to stdout. And I can't get a idea of which field it has an issue with. Any … --- ## [GrokPraseFailure - JSON log - Success on Grokdebugger](https://discuss.elastic.co/t/grokprasefailure-json-log-success-on-grokdebugger/285282)
**Author:** [@Athul\_Devkar](https://discuss.elastic.co/u/Athul_Devkar)\ **Replies:** 3\ **Last updated:** [September 27, 2021, 10:48pm UTC](https://discuss.elastic.co/t/grokprasefailure-json-log-success-on-grokdebugger/285282 "2021-09-27T22:48:15Z")
I am facing issues while trying to parse this log. I have tried multiple options but nothing seems to work. No error message in the logs, except for this \_grokprasefailure tag in the records. Can you please help with wha… --- ## [Multiple elk stack structure](https://discuss.elastic.co/t/multiple-elk-stack-structure/285223)
**Author:** [@escking](https://discuss.elastic.co/u/escking)\ **Replies:** 0\ **Last updated:** [September 27, 2021, 11:41am UTC](https://discuss.elastic.co/t/multiple-elk-stack-structure/285223 "2021-09-27T11:41:08Z")
Hi all, I have a cluster about elastic stack using kafka connector . I want to migrate to kubernetes infrastructure to provide high availability. So my filebeat's output must send to data other kafka connector. Is it po… --- ## [\_grokparsefailure - Success in Grok Debugger - Log with Double quotes JSON](https://discuss.elastic.co/t/grokparsefailure-success-in-grok-debugger-log-with-double-quotes-json/285012)
**Author:** [@Athul\_Devkar](https://discuss.elastic.co/u/Athul_Devkar)\ **Replies:** 7\ **Last updated:** [September 27, 2021, 9:14pm UTC](https://discuss.elastic.co/t/grokparsefailure-success-in-grok-debugger-log-with-double-quotes-json/285012 "2021-09-27T21:14:42Z")
I am facing issues while trying to parse this log. I have tried multiple options but nothing seems to work. No error message in the logs, except for this tag in the records. Can you please help with what I am missing her… --- ## [SLM not starting](https://discuss.elastic.co/t/slm-not-starting/285231)
**Author:** [@dazevedo](https://discuss.elastic.co/u/dazevedo)\ **Replies:** 9\ **Last updated:** [September 27, 2021, 9:13pm UTC](https://discuss.elastic.co/t/slm-not-starting/285231 "2021-09-27T21:13:16Z")
good morning, I'm trying to configure my slm policies to automatically snapshot in my nfs repository of a NetApp storage, but I'm not able to activate the policy because it says that my \_slm index was not started... Any… --- ## [Separate Indexes Per Log File From Two Different Servers (Filebeat -\> Logstash - \> Elastic -\> Kibana)](https://discuss.elastic.co/t/separate-indexes-per-log-file-from-two-different-servers-filebeat-logstash-elastic-kibana/285262)
**Author:** [@kingmilo](https://discuss.elastic.co/u/kingmilo)\ **Replies:** 5\ **Last updated:** [September 27, 2021, 8:50pm UTC](https://discuss.elastic.co/t/separate-indexes-per-log-file-from-two-different-servers-filebeat-logstash-elastic-kibana/285262 "2021-09-27T20:50:28Z")
I have two servers configured with Filebeat to send logs to Logstash which is working properly. I would now like to view each of those logs separately under their respective indexes within Kibana Discover but I am strugg… --- ## [Logstash S3 Output plugin](https://discuss.elastic.co/t/logstash-s3-output-plugin/285276)
**Author:** [@John\_snow](https://discuss.elastic.co/u/John_snow)\ **Replies:** 0\ **Last updated:** [September 27, 2021, 7:58pm UTC](https://discuss.elastic.co/t/logstash-s3-output-plugin/285276 "2021-09-27T19:58:25Z")
Hey all, Trying to send messages to S3 USING Logstash SQS as inout, but getting message in this format %{host} %{message} Also not able to see added filed in the logs. --- ## [How to use regex with vega](https://discuss.elastic.co/t/how-to-use-regex-with-vega/285237)
**Author:** [@forst](https://discuss.elastic.co/u/forst)\ **Replies:** 4\ **Last updated:** [September 27, 2021, 7:17pm UTC](https://discuss.elastic.co/t/how-to-use-regex-with-vega/285237 "2021-09-27T19:17:16Z")
I am new to vega lite / vega. I'm trying to write a regex query for a java log error as following with vega tree layout. A field 'message' contains : \[Poolthread\] com.xxxx.content.core-bundle com.xxxxx.content.model.… --- ## [Commenataries in kibana](https://discuss.elastic.co/t/commenataries-in-kibana/285198)
**Author:** [@ippo](https://discuss.elastic.co/u/ippo)\ **Replies:** 1\ **Last updated:** [September 27, 2021, 6:47pm UTC](https://discuss.elastic.co/t/commenataries-in-kibana/285198 "2021-09-27T18:47:44Z")
Hello guys i wanted to ask you if there is a way to add commentaries in a column to an enhanced table in kibana or if you think there is a way to implement this idea. any idea could help :pray: --- ## [Using Multiline for individual/specific Modules](https://discuss.elastic.co/t/using-multiline-for-individual-specific-modules/285264)
**Author:** [@User001](https://discuss.elastic.co/u/User001)\ **Replies:** 0\ **Last updated:** [September 27, 2021, 5:47pm UTC](https://discuss.elastic.co/t/using-multiline-for-individual-specific-modules/285264 "2021-09-27T17:47:39Z")
Hello, I am curious if you can set/override the multiline parameters within individual modules. I am trying to use a commonly configured filebeat instance within a larger project, of which, they currently and/or may not… --- ## [Configurable visualization](https://discuss.elastic.co/t/configurable-visualization/284990)
**Author:** [@PaulBuciuman](https://discuss.elastic.co/u/PaulBuciuman)\ **Replies:** 3\ **Last updated:** [September 27, 2021, 5:33pm UTC](https://discuss.elastic.co/t/configurable-visualization/284990 "2021-09-27T17:33:04Z")
I'm create a simple visualization that shows using a treemap, top 20 request times from an API. But I want that 20 to be configurable outside the settings page, similar to the way I can customize the time range. Is this … --- ## [Querying a list to check the size](https://discuss.elastic.co/t/querying-a-list-to-check-the-size/284969)
**Author:** [@eztask.io](https://discuss.elastic.co/u/eztask.io)\ **Replies:** 3\ **Last updated:** [September 27, 2021, 5:32pm UTC](https://discuss.elastic.co/t/querying-a-list-to-check-the-size/284969 "2021-09-27T17:32:35Z")
Hello, I am just new to Kibana query. I am trying to query a field, which is a list of objects "leadStages" : \[ { "leadStage" : 1, "inTime" : 1597832744832, "outTime… --- ## [Kibana scripted field: doc\['some\_field'\] doesnt work when the field has a lot of data](https://discuss.elastic.co/t/kibana-scripted-field-doc-some-field-doesnt-work-when-the-field-has-a-lot-of-data/285106)
**Author:** [@Felipsz](https://discuss.elastic.co/u/Felipsz)\ **Replies:** 3\ **Last updated:** [September 27, 2021, 5:31pm UTC](https://discuss.elastic.co/t/kibana-scripted-field-doc-some-field-doesnt-work-when-the-field-has-a-lot-of-data/285106 "2021-09-27T17:31:06Z")
Hi everyone, Im creating some scripted fields to improve the visualization of the data that comes into Kibana 7.5. I have a big field that its a JSON, and it has a lot of data, and i want to separate this data in multi… --- ## [Enable xpack on a running Elastic cluster](https://discuss.elastic.co/t/enable-xpack-on-a-running-elastic-cluster/284671)
**Author:** [@ls4074](https://discuss.elastic.co/u/ls4074)\ **Replies:** 9\ **Last updated:** [September 27, 2021, 5:28pm UTC](https://discuss.elastic.co/t/enable-xpack-on-a-running-elastic-cluster/284671 "2021-09-27T17:28:59Z")
I deployed Elastic using helm chart (7.13) without xpack enabled. The ES and Kibana pods are running fine. I logged in to one of the master pods and ran the command "Elasticsearch-certutil" to generate the certs and the… --- ## [ElasticSearch crashing - Magento 2.4.3](https://discuss.elastic.co/t/elasticsearch-crashing-magento-2-4-3/284228)
**Author:** [@pmono](https://discuss.elastic.co/u/pmono)\ **Replies:** 24\ **Last updated:** [September 27, 2021, 4:42pm UTC](https://discuss.elastic.co/t/elasticsearch-crashing-magento-2-4-3/284228 "2021-09-27T16:42:39Z")
We're having issues with Elasticsearch crashing from time to time. It also sometimes spikes up RAM + CPU and server becomes unresponsive. We have left most of the settings as is, but had to add more RAM to JVM heap (48G… --- ## [How to migrate data from db oracle to ES use Logstash?](https://discuss.elastic.co/t/how-to-migrate-data-from-db-oracle-to-es-use-logstash/285248)
**Author:** [@NinhNM](https://discuss.elastic.co/u/NinhNM)\ **Replies:** 1\ **Last updated:** [September 27, 2021, 4:37pm UTC](https://discuss.elastic.co/t/how-to-migrate-data-from-db-oracle-to-es-use-logstash/285248 "2021-09-27T16:37:28Z")
I have around 1 millions record in db oracle and I want migrate to ES. Logstash: input { jdbc { jdbc\_driver\_library =\> "/Users/ninhnguyen/Desktop/ojdbc7.jar" jdbc\_driver\_class =\> "Java::oracle.jdbc.driver.Ora… --- ## [Creating choropleth maps using only geo locations](https://discuss.elastic.co/t/creating-choropleth-maps-using-only-geo-locations/284995)
**Author:** [@Daniil\_Naumov](https://discuss.elastic.co/u/Daniil_Naumov)\ **Replies:** 4\ **Last updated:** [September 27, 2021, 4:29pm UTC](https://discuss.elastic.co/t/creating-choropleth-maps-using-only-geo-locations/284995 "2021-09-27T16:29:19Z")
How can I visualise requests on choropleth map if I have only location data in logs? --- ## [Filebeat slows down as registry file grows](https://discuss.elastic.co/t/filebeat-slows-down-as-registry-file-grows/284903)
**Author:** [@YvorL](https://discuss.elastic.co/u/YvorL)\ **Replies:** 2\ **Last updated:** [September 27, 2021, 4:22pm UTC](https://discuss.elastic.co/t/filebeat-slows-down-as-registry-file-grows/284903 "2021-09-27T16:22:40Z")
Filebeat version: 7.9.2 OS: Ubuntu 18.04.5 LTS VM: 16 CPU, 64 GB RAM Output: Kafka I have an issue with Filebeat's throughput. There are about 600 files are created every minute and those have around 4000 lines in th… --- ## [There is no match between one term and another in the result of a watcher](https://discuss.elastic.co/t/there-is-no-match-between-one-term-and-another-in-the-result-of-a-watcher/285254)
**Author:** [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\ **Replies:** 2\ **Last updated:** [September 27, 2021, 3:53pm UTC](https://discuss.elastic.co/t/there-is-no-match-between-one-term-and-another-in-the-result-of-a-watcher/285254 "2021-09-27T15:53:49Z")
very good day, I have a problem with an alert when I get a result of several terms, i.e. the first term does not match the second, for example. As you can see in the red circle the term "ADUANILLA DE PAIBA" has the … --- ## [Unable to load Kibana UI from Internet Exlporer](https://discuss.elastic.co/t/unable-to-load-kibana-ui-from-internet-exlporer/284118)
**Author:** [@MKirby](https://discuss.elastic.co/u/MKirby)\ **Replies:** 5\ **Last updated:** [September 27, 2021, 3:49pm UTC](https://discuss.elastic.co/t/unable-to-load-kibana-ui-from-internet-exlporer/284118 "2021-09-27T15:49:50Z")
I have completed installing Kibana, Logstash and ElasticStack all versions 7.13.4 (In that order) in the production environment. Each portion of the stack is installed on it's own Red Hat Enterprise 8 server, and Elasti… --- ## [Transactions that are created automatically by Elastic.Apm.Azure.ServiceBus instrumentation doesn't contain child spans](https://discuss.elastic.co/t/transactions-that-are-created-automatically-by-elastic-apm-azure-servicebus-instrumentation-doesnt-contain-child-spans/284896)
**Author:** [@waczi](https://discuss.elastic.co/u/waczi)\ **Replies:** 2\ **Last updated:** [September 27, 2021, 3:12pm UTC](https://discuss.elastic.co/t/transactions-that-are-created-automatically-by-elastic-apm-azure-servicebus-instrumentation-doesnt-contain-child-spans/284896 "2021-09-27T15:12:01Z")
Hi, I'm implementing the APM instrumentation for the ASP.NET CORE application. The application sends and receives messages to/from Service Bus. I found in the documentation (Supported technologies | APM .NET Agent Refer… --- ## [Can I create a Data table which aggregates a top hit per ID?](https://discuss.elastic.co/t/can-i-create-a-data-table-which-aggregates-a-top-hit-per-id/285089)
**Author:** [@Joao\_Silva](https://discuss.elastic.co/u/Joao_Silva)\ **Replies:** 2\ **Last updated:** [September 27, 2021, 2:58pm UTC](https://discuss.elastic.co/t/can-i-create-a-data-table-which-aggregates-a-top-hit-per-id/285089 "2021-09-27T14:58:21Z")
Imagine that I have documents with the fields ID, ValueA, ValueB and that my index for each ID, let's say from 1 to 50 have some random values for A and B. Is it possible to build a visualization with 50 rows, one per I… [Previous page](https://discuss.elastic.co/latest.md?page=1458) [Next page](https://discuss.elastic.co/latest.md?page=1460)