# Latest **URL:** https://discuss.elastic.co/latest.md?page=1477 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1478 --- ## [How to add all field values in a single field?](https://discuss.elastic.co/t/how-to-add-all-field-values-in-a-single-field/284068)
**Author:** [@Husnain](https://discuss.elastic.co/u/Husnain)\ **Replies:** 2\ **Last updated:** [September 15, 2021, 10:16am UTC](https://discuss.elastic.co/t/how-to-add-all-field-values-in-a-single-field/284068 "2021-09-15T10:16:36Z")
Hii.I am trying to create a new\_field called "log\_data" and I want to add each value in "log\_data" field present in the message field.I want only one field with multiple values.How can I achieve this? This are the docu… --- ## [Wrong timestamp in kibana index](https://discuss.elastic.co/t/wrong-timestamp-in-kibana-index/284181)
**Author:** [@Tejas\_Bhosale](https://discuss.elastic.co/u/Tejas_Bhosale)\ **Replies:** 2\ **Last updated:** [September 15, 2021, 10:13am UTC](https://discuss.elastic.co/t/wrong-timestamp-in-kibana-index/284181 "2021-09-15T10:13:26Z")
I get worng time data in my index in kibana there is around lot of difference in @timestamp and log\_timestamp field. grok filter which i am using grok { match =\> \[ "message" , '%{IP:remote\_addr} -… --- ## [Reindex data from local to Server?](https://discuss.elastic.co/t/reindex-data-from-local-to-server/284262)
**Author:** [@padamrai](https://discuss.elastic.co/u/padamrai)\ **Replies:** 1\ **Last updated:** [September 15, 2021, 10:13am UTC](https://discuss.elastic.co/t/reindex-data-from-local-to-server/284262 "2021-09-15T10:13:10Z")
I am trying to send index npb\_bro to my server. But I am getting error. Below is my query POST \_reindex { "source": { "remote": { "host": "http://192.168.216.192:1992", "username": "xxxx", "passw… --- ## [How to change index pattern id?](https://discuss.elastic.co/t/how-to-change-index-pattern-id/284263)
**Author:** [@padamrai](https://discuss.elastic.co/u/padamrai)\ **Replies:** 1\ **Last updated:** [September 15, 2021, 10:08am UTC](https://discuss.elastic.co/t/how-to-change-index-pattern-id/284263 "2021-09-15T10:08:26Z")
I want to change id 6ac6d870-85ea-11eb-81eb-fb2732b01c07 and I want to set another Id. It is possible to change this ID. --- ## [Elastic pipeline calculate value for field](https://discuss.elastic.co/t/elastic-pipeline-calculate-value-for-field/283752)
**Author:** [@111452](https://discuss.elastic.co/u/111452)\ **Replies:** 2\ **Last updated:** [September 15, 2021, 10:07am UTC](https://discuss.elastic.co/t/elastic-pipeline-calculate-value-for-field/283752 "2021-09-15T10:07:16Z")
I'm trying to calculate the time value inside elastic pipeline and set this value for field. I need something like this : curl -X PUT "localhost:9200/\_ingest/pipeline/time-pipeline?pretty" -H 'Content-Type: application/… --- ## [Windows integration for event logs error](https://discuss.elastic.co/t/windows-integration-for-event-logs-error/284169)
**Author:** [@PhilA](https://discuss.elastic.co/u/PhilA)\ **Replies:** 2\ **Last updated:** [September 15, 2021, 9:55am UTC](https://discuss.elastic.co/t/windows-integration-for-event-logs-error/284169 "2021-09-15T09:55:27Z")
Hi I have had a look at the Windows integration to collect events from the Windows event log but I believe there may be a mapping error. We have an environment where all Windows event logs are forwarded to a central lo… --- ## [Injecting a namespace into helm template](https://discuss.elastic.co/t/injecting-a-namespace-into-helm-template/284230)
**Author:** [@AndreyL](https://discuss.elastic.co/u/AndreyL)\ **Replies:** 1\ **Last updated:** [September 15, 2021, 9:42am UTC](https://discuss.elastic.co/t/injecting-a-namespace-into-helm-template/284230 "2021-09-15T09:42:19Z")
Our Kubernetes environment is managed by Nirmata, which uses gitops for application deployments. It pulls a yaml file and creates the objects. I use the official Elasticsearch helm chart (https://github.com/elastic/helm… --- ## [Visualize two time series with nested objects](https://discuss.elastic.co/t/visualize-two-time-series-with-nested-objects/284171)
**Author:** [@maccn](https://discuss.elastic.co/u/maccn)\ **Replies:** 6\ **Last updated:** [September 15, 2021, 9:18am UTC](https://discuss.elastic.co/t/visualize-two-time-series-with-nested-objects/284171 "2021-09-15T09:18:40Z")
Hello everyone, I am trying to visualize two time series in Kibana reading the data from Elasticsearch. The structure of my document is the following: { "sensorName": "Sensor1", "values": \[ { "feature": … --- ## [CentOS Stream8 Elastic Agent not sending streams](https://discuss.elastic.co/t/centos-stream8-elastic-agent-not-sending-streams/283859)
**Author:** [@uf0](https://discuss.elastic.co/u/uf0)\ **Replies:** 2\ **Last updated:** [September 15, 2021, 9:04am UTC](https://discuss.elastic.co/t/centos-stream8-elastic-agent-not-sending-streams/283859 "2021-09-15T09:04:09Z")
Hello I have just setup a fresh install of ELK + a few agents running on Ubuntu and everything works as expected. However, as soon as I add the same agent version, 7.14.1 on a CentOS Strem 8, it fails with the followin… --- ## [Search timeouts during indexing](https://discuss.elastic.co/t/search-timeouts-during-indexing/284153)
**Author:** [@Drept](https://discuss.elastic.co/u/Drept)\ **Replies:** 10\ **Last updated:** [September 15, 2021, 8:49am UTC](https://discuss.elastic.co/t/search-timeouts-during-indexing/284153 "2021-09-15T08:49:06Z")
I have an index of around 90 million documents in Elasticsearch. I manage it via django-elasticsearch-dsl. The settings are the following: number\_of\_shards: 1 number\_of\_replicas: 0 The mapping is: { "series" : { … --- ## [Kibana dashboard display text line by line](https://discuss.elastic.co/t/kibana-dashboard-display-text-line-by-line/282078)
**Author:** [@hellotty](https://discuss.elastic.co/u/hellotty)\ **Replies:** 4\ **Last updated:** [September 15, 2021, 8:38am UTC](https://discuss.elastic.co/t/kibana-dashboard-display-text-line-by-line/282078 "2021-09-15T08:38:23Z")
Hello! In filebeat.yml I split my log file using multiline.pattern snippet filebeat: multiline.type: pattern multiline.pattern: '---------' multiline.negate: true multiline.match: after In discover, it is displaye… --- ## [Kibana dashboard отображение текста построчно](https://discuss.elastic.co/t/kibana-dashboard/283880)
**Author:** [@hellotty](https://discuss.elastic.co/u/hellotty)\ **Replies:** 4\ **Last updated:** [September 15, 2021, 8:02am UTC](https://discuss.elastic.co/t/kibana-dashboard/283880 "2021-09-15T08:02:17Z")
Здравствуйте! В filebeat.yml я разделил свой файл журнала, используя multiline.pattern Фрагмент filebeat: multiline.type: pattern multiline.pattern: '---------' multiline.negate: true multiline.match: after В Di… --- ## [Is it possible to make new property having default normalizer](https://discuss.elastic.co/t/is-it-possible-to-make-new-property-having-default-normalizer/284252)
**Author:** [@VincentGWZhang](https://discuss.elastic.co/u/VincentGWZhang)\ **Replies:** 0\ **Last updated:** [September 15, 2021, 6:55am UTC](https://discuss.elastic.co/t/is-it-possible-to-make-new-property-having-default-normalizer/284252 "2021-09-15T06:55:41Z")
Suppose I have a index having mapping setting as: { "settings": { "index": { "number\_of\_shards": 3, "number\_of\_replicas": 1 }, "analysis": { "normalizer": { "lowercase\_normalizer"… --- ## [Impact of group\_events on Filebeat and Kafka efficiency](https://discuss.elastic.co/t/impact-of-group-events-on-filebeat-and-kafka-efficiency/283414)
**Author:** [@md2](https://discuss.elastic.co/u/md2)\ **Replies:** 1\ **Last updated:** [September 15, 2021, 6:43am UTC](https://discuss.elastic.co/t/impact-of-group-events-on-filebeat-and-kafka-efficiency/283414 "2021-09-15T06:43:10Z")
Hello team, I have a pretty large fleet of Filebeat instances and all of them ship events to a Kafka cluster with multiple brokers which then got consumed by Logstash. I am currently researching on how to configure File… --- ## [I want to set up sending notifications about errors](https://discuss.elastic.co/t/i-want-to-set-up-sending-notifications-about-errors/283287)
**Author:** [@sasha198407](https://discuss.elastic.co/u/sasha198407)\ **Replies:** 8\ **Last updated:** [September 15, 2021, 6:13am UTC](https://discuss.elastic.co/t/i-want-to-set-up-sending-notifications-about-errors/283287 "2021-09-15T06:13:27Z")
Hello. I want to set up sending notifications about errors (errors in the operation of Apache, MySQL, Nginx, as well as if the server is not available) from logstesh to e-mail. Wrote at ./logstash/pipeline/logstash.conf … --- ## [Going from 6.8.15 to 6.8.18 should be no issue correct](https://discuss.elastic.co/t/going-from-6-8-15-to-6-8-18-should-be-no-issue-correct/284198)
**Author:** [@cis4life](https://discuss.elastic.co/u/cis4life)\ **Replies:** 4\ **Last updated:** [September 15, 2021, 5:29am UTC](https://discuss.elastic.co/t/going-from-6-8-15-to-6-8-18-should-be-no-issue-correct/284198 "2021-09-15T05:29:23Z")
Good Day, I have a cluster that has ES 6.8.15 install and see that 6.8.18 is there to upgrade to. This should be a straight forward upgrade correct. Everything is currently working in our cluster, but I wanted to make… --- ## [Elasticsearch 7.8.1 maximum shards open error](https://discuss.elastic.co/t/elasticsearch-7-8-1-maximum-shards-open-error/284234)
**Author:** [@ManOfDestiny](https://discuss.elastic.co/u/ManOfDestiny)\ **Replies:** 2\ **Last updated:** [September 15, 2021, 5:17am UTC](https://discuss.elastic.co/t/elasticsearch-7-8-1-maximum-shards-open-error/284234 "2021-09-15T05:17:01Z")
How can I solve this problem? Env 1. elsticsearch version : 7.8.1 2. cluster 1) master node 3EA 2) data Node : 7EA ConfigFile : elasticsearch.yml cluster.max\_shards\_per\_node: 10000 Cluster setting GET /\_clust… --- ## [Showing Invalid Fields! under Manage Section](https://discuss.elastic.co/t/showing-invalid-fields-under-manage-section/283893)
**Author:** [@anuragchoudhary01](https://discuss.elastic.co/u/anuragchoudhary01)\ **Replies:** 4\ **Last updated:** [September 15, 2021, 3:58am UTC](https://discuss.elastic.co/t/showing-invalid-fields-under-manage-section/283893 "2021-09-15T03:58:55Z")
Hi, On AppSearch Dashboard, I am getting an exclamation sign in front of Schema which says "Invalid Fields!" whereas it is not highlighting any of the schema as invalid. Can someone please advise ? --- ## [Routing to an Index Partition - Custom Routing](https://discuss.elastic.co/t/routing-to-an-index-partition-custom-routing/284240)
**Author:** [@sudhir-ch](https://discuss.elastic.co/u/sudhir-ch)\ **Replies:** 0\ **Last updated:** [September 15, 2021, 3:28am UTC](https://discuss.elastic.co/t/routing-to-an-index-partition-custom-routing/284240 "2021-09-15T03:28:31Z")
Hi, I have configured the index such that custom routing values will go to a subset of the shards rather than a single shard by providing the index level setting "index.routing\_partition\_size" at index creation. Index … --- ## [Audit Concurrent Logons](https://discuss.elastic.co/t/audit-concurrent-logons/284236)
**Author:** [@Tim\_Mobley](https://discuss.elastic.co/u/Tim_Mobley)\ **Replies:** 0\ **Last updated:** [September 15, 2021, 2:29am UTC](https://discuss.elastic.co/t/audit-concurrent-logons/284236 "2021-09-15T02:29:33Z")
I've been asked to come up with a way to audit concurrent Windows logins, and am trying to find anyone who has had success with this in Kibana. I can easily audit logons (4624) and logoffs (4647), but haven't yet figured… --- ## [Rally is not able to manage multiple types](https://discuss.elastic.co/t/rally-is-not-able-to-manage-multiple-types/283577)
**Author:** [@rschirin](https://discuss.elastic.co/u/rschirin)\ **Replies:** 6\ **Last updated:** [September 15, 2021, 2:43am UTC](https://discuss.elastic.co/t/rally-is-not-able-to-manage-multiple-types/283577 "2021-09-15T02:43:46Z")
Hey there, I created a custom track from an existing index that includes several document types (at least 3). Can I know how to use this track during the import phase to have the correct imported type? If I specify ta… --- ## [The rebalancing task lasted for more than a week without stopping, and the balance has not been reached](https://discuss.elastic.co/t/the-rebalancing-task-lasted-for-more-than-a-week-without-stopping-and-the-balance-has-not-been-reached/284020)
**Author:** [@liwanjie](https://discuss.elastic.co/u/liwanjie)\ **Replies:** 17\ **Last updated:** [September 15, 2021, 2:32am UTC](https://discuss.elastic.co/t/the-rebalancing-task-lasted-for-more-than-a-week-without-stopping-and-the-balance-has-not-been-reached/284020 "2021-09-15T02:32:51Z")
version ：7.10.2 My cluster has a total of 30 machines, one machine has two data nodes, so there are a total of 60 nodes i add a dataNode to cluster，and then the rebalance tasks started... but a week has passed，rebalan… --- ## [Kibana - Is the translation to pt-BR still working the same since 2019?](https://discuss.elastic.co/t/kibana-is-the-translation-to-pt-br-still-working-the-same-since-2019/284193)
**Author:** [@medina](https://discuss.elastic.co/u/medina)\ **Replies:** 3\ **Last updated:** [September 15, 2021, 2:29am UTC](https://discuss.elastic.co/t/kibana-is-the-translation-to-pt-br-still-working-the-same-since-2019/284193 "2021-09-15T02:29:28Z")
I need to translate kibana to pt-BR and I'm new to Kibana (and how it's plugins work). I checked this link Translating Kibana to pt-BR - Elastic Stack / Kibana - Discuss the Elastic Stack and I was wondering if it still… --- ## [Elasticsearch7.5 routing hash function](https://discuss.elastic.co/t/elasticsearch7-5-routing-hash-function/284187)
**Author:** [@chenchuangc](https://discuss.elastic.co/u/chenchuangc)\ **Replies:** 0\ **Last updated:** [September 14, 2021, 1:15pm UTC](https://discuss.elastic.co/t/elasticsearch7-5-routing-hash-function/284187 "2021-09-14T13:15:37Z")
the Elasticsearch routine description like this routing\_factor = num\_routing\_shards / num\_primary\_shards shard\_num = (hash(\_routing) % num\_routing\_shards) / routing\_factor i want to know the hash function so that i … --- ## [Packetbeat: Decode Https Traffic](https://discuss.elastic.co/t/packetbeat-decode-https-traffic/284194)
**Author:** [@Claudio\_Ract\_Costa](https://discuss.elastic.co/u/Claudio_Ract_Costa)\ **Replies:** 3\ **Last updated:** [September 15, 2021, 12:57am UTC](https://discuss.elastic.co/t/packetbeat-decode-https-traffic/284194 "2021-09-15T00:57:12Z")
Hi Folks, Is there any way to decode https/ssl traffic using packetbeat ? I have to server/client key do decode the traffic but i dont know how can i use it to decode the traffic. Thks --- ## [Case Management System and external connectors](https://discuss.elastic.co/t/case-management-system-and-external-connectors/284189)
**Author:** [@thisisxgp](https://discuss.elastic.co/u/thisisxgp)\ **Replies:** 1\ **Last updated:** [September 15, 2021, 12:39am UTC](https://discuss.elastic.co/t/case-management-system-and-external-connectors/284189 "2021-09-15T00:39:46Z")
Hello guys, Currently, Elastic Security can send case updates to ServiceNow / Jira / Swimlane / IBM Resilient according to the official documentation. Are there any plans on expanding this list? I'd be very interested … --- ## [Filebeat dont send Logs to Kafka](https://discuss.elastic.co/t/filebeat-dont-send-logs-to-kafka/284200)
**Author:** [@Robsen\_Inc](https://discuss.elastic.co/u/Robsen_Inc)\ **Replies:** 1\ **Last updated:** [September 15, 2021, 12:19am UTC](https://discuss.elastic.co/t/filebeat-dont-send-logs-to-kafka/284200 "2021-09-15T00:19:39Z")
Hi guys! I have a question, what could be the reason that my Filebeat does not send log messages to the Kafka as soon as the time is behind. (When I stop my virtual machine and like the start no logs arrive, only when … --- ## [POST https://apm.\.com/intake/v2/rum/events net::ERR\_BLOCKED\_BY\_CLIENT](https://discuss.elastic.co/t/post-https-apm-acme-com-intake-v2-rum-events-net-err-blocked-by-client/280820)
**Author:** [@Kay\_Khan](https://discuss.elastic.co/u/Kay_Khan)\ **Replies:** 6\ **Last updated:** [September 14, 2021, 11:26pm UTC](https://discuss.elastic.co/t/post-https-apm-acme-com-intake-v2-rum-events-net-err-blocked-by-client/280820 "2021-09-14T23:26:40Z")
I have an elastic stack on kubernetes (k8s) using ECK. Kibana version: 7.13.2 Elasticsearch version: 7.13.2 APM Server version: 7.13.2 APM Agent language and version: @elastic/apm-rum - npm - 5.9.1 Browser versi… --- ## [Object Array in Painless source loses values and indexes with "\[\]" for values](https://discuss.elastic.co/t/object-array-in-painless-source-loses-values-and-indexes-with-for-values/284160)
**Author:** [@jthoni](https://discuss.elastic.co/u/jthoni)\ **Replies:** 3\ **Last updated:** [September 14, 2021, 11:05pm UTC](https://discuss.elastic.co/t/object-array-in-painless-source-loses-values-and-indexes-with-for-values/284160 "2021-09-14T23:05:14Z")
We have just upgraded from ES/Nest v5 to v 6.8. We have an api that does an upsert using a Painless script. The script checks to see that the lastUpdated date in the payload is greater than that in the indexed document, … --- ## [Automating Filebeat](https://discuss.elastic.co/t/automating-filebeat/283816)
**Author:** [@peter\_murphy](https://discuss.elastic.co/u/peter_murphy)\ **Replies:** 5\ **Last updated:** [September 14, 2021, 9:53pm UTC](https://discuss.elastic.co/t/automating-filebeat/283816 "2021-09-14T21:53:31Z")
Hello, I am using Filebeat to send my local device's Osquery log to my self-hosted Elasticsearch via Logstash. The pipeline is working correctly, but only if I trigger Filebeat manually. I'm sure the answer is simple, b… [Previous page](https://discuss.elastic.co/latest.md?page=1476) [Next page](https://discuss.elastic.co/latest.md?page=1478)